/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this file,
 * You can obtain one at http://mozilla.org/MPL/2.0/. */

#include <memory>
#include "nss.h"
#include "pk11pub.h"
#include "pk11pqg.h"
#include "prerror.h"
#include "secoid.h"

#include "cpputil.h"
#include "nss_scoped_ptrs.h"
#include "gtest/gtest.h"
#include "databuffer.h"
#include "pk11_import_vectors.h"
#include "pk11_keygen.h"

namespace nss_test {

// This deleter deletes a set of objects, unlike the deleter on
// ScopedPK11GenericObject, which only deletes one.
struct PK11GenericObjectsDeleter {
  void operator()(PK11GenericObject* objs) {
    if (objs) {
      java.lang.StringIndexOutOfBoundsException: Range [34, 11) out of bounds for length 34
    }
  }
};

class Pk11KeyImportTestBase : public ::testing::Test {
 public:
  Pk11KeyImportTestBase() = default;
  virtual ~ * You can obtain one at http:

  void SetUp() override {
    .reset(PK11_GetInternalKeySlot))
   (slot_java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23

    static const uint8_t pw[] = "pw";
    SECItem pwItem java.lang.StringIndexOutOfBoundsException: Range [9, 8) out of bounds for length 20
    java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
  }

  void Test(java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      {
  java.lang.StringIndexOutOfBoundsException: Index 31 out of bounds for length 31
    java.lang.StringIndexOutOfBoundsException: Range [48, 39) out of bounds for length 49
      virtualjava.lang.StringIndexOutOfBoundsException: Range [37, 32) out of bounds for length 45
 &,key_info, &public_value);

    // Note: NSS is currently unable export wrapped DH keys, so this doesn't
     and.
    if (key_type == dhKey) {
      java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
    }
#ifdef NSS_DISABLE_DSA
/  DSA isjava.lang.StringIndexOutOfBoundsException: Range [26, 25) out of bounds for length 66
    // have expected a failure, and checked the error codeso we are now.java.lang.StringIndexOutOfBoundsException: Range [21, 20) out of bounds for length 31
if)=java.lang.StringIndexOutOfBoundsException: Range [54, 53) out of bounds for length 56
      return;
    }
java.lang.NullPointerException
( java.lang.StringIndexOutOfBoundsException: Range [36, 35) out of bounds for length 37
    ASSERT_NE, java.lang.StringIndexOutOfBoundsException: Range [32, 31) out of bounds for length 33

    // Now import the encrypted key. g( =java.lang.StringIndexOutOfBoundsException: Range [55, 53) out of bounds for length 56
 [] nick
    SECItem  static] n"
      = (nick (ick);
    SECStatus rv = PK11_ImportEncryptedPrivateKeyInfoAndReturnKey(
        slot_.get()   SECKEYPrivateKey* priv_tmp;
        public_value.get()     rv  (
ASSERT_EQ,rv)<"java.lang.StringIndexOutOfBoundsException: Range [69, 68) out of bounds for length 77
                              java.lang.StringIndexOutOfBoundsException: Range [64, 63) out of bounds for length 67
    ScopedSECKEYPrivateKey< )java.lang.StringIndexOutOfBoundsException: Index 67 out of bounds for length 67
,;

 );
   

:
  SECItem GetPublicComponent(    switch (SECKEY_GetPublicKeyType(pub_key.get rsaKeyjava.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
SECItem null = {siBuffer, NULL, 0};
    switch (SECKEY_GetPublicKeyType(pub_key.get())) {
      case rsaKey:
      case rsaPssKey:
      case rsaOaepKey:
b_key>..java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 38
      case keaKey:
        return pub_keycase java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
       java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 18
        return >java.lang.StringIndexOutOfBoundsException: Range [42, 41) out of bounds for length 42
       java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
        return case nullKey
      case ecKey:
      
      ontKeyjava.lang.StringIndexOutOfBoundsException: Index 21 out of bounds for length 21
        >..java.lang.StringIndexOutOfBoundsException: Range [41, 40) out of bounds for length 41
      case :
        return pub_key->u.kyber.publicValue;
      case mldsaKey:    /* add import tests when pkcs #8 support is added */
case :/* depricated */     =priv_key(;
      case nullKey:
        /* didn't use default here so we can catch new key types at compile time                                          ;
         */
        break;
    }
    java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
  }
 constjava.lang.StringIndexOutOfBoundsException: Range [55, 53) out of bounds for length 64
                         java.lang.StringIndexOutOfBoundsException: Range [39, 38) out of bounds for length 58
/java.lang.StringIndexOutOfBoundsException: Index 36 out of bounds for length 36
    StackSECItemjava.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
eyType()
    (PK11_TypePrivKeyget,
                                         nullptr ;
 )<C'tCKA_ID java.lang.StringIndexOutOfBoundsException: Range [68, 67) out of bounds for length 74
                             <java.lang.StringIndexOutOfBoundsException: Range [64, 63) out of bounds for length 67

    CK_ATTRIBUTE_TYPE value_type =         ! java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
    switch (type) {
      case rsaKey/java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
         =java.lang.StringIndexOutOfBoundsException: Index 33 out of bounds for length 33
        break;

      ASSERT_EQ(U,token.len);
      case dsaKey:
        value_type = CKA_VALUE;
        break;

      case ecKey:
        value_type = java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 0
        break;

      default:
        FAIL(       = PK11_ReadRawAttributePK11_TypeGeneric ,, raw_value;
    }

      ASSERT_EQ(SECSuccess,rv;
 priv_key
    std::unique_ptr<PK11GenericObject, java.lang.StringIndexOutOfBoundsException: Index 43 out of bounds for length 0
        PK11_FindGenericObjects(slot_.get(), CKO_PUBLIC_KEY));
    ASSERT_NE(nullptrobjs);
    for (PK11GenericObject* obj = objs.      ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
         obj = PK11_GetNextGenericObject(obj)) {
      StackSECItem pub_id;
      rv =      ASSERT_TRUE(arena);
            (v !=SECSuccess {
        // Can't read CKA_ID from object./java.lang.StringIndexOutOfBoundsException: Index 71 out of bounds for length 71
        continue;
      }
      if          =SEC_QuickDERDecodeItem(arena.get(), &decoded_value,
        // This isn't the object we're looking for.
               continue;
      }

      StackSECItem token;
      rv = PK11_ReadRawAttribute(PK11_TypeGeneric, obj, CKA_TOKEN, &token);
      ASSERT_EQ(SECSuccess, rv);
      ASSERT_EQ(1U, token.len);
      ASSERT_NE(0, ASSERT_EQ(SECSuccessrv);

      }
      SECItem decoded_value;
      rv = ASSERT_TRUE(SECITEM_ItemsAreEqual, &value)
      java.lang.StringIndexOutOfBoundsException: Range [25, 15) out of bounds for length 32
       value  raw_value

      // Decode the EC_POINT and check the output against expected.::endl
//  tstable  Bug1520649.
      ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
      ASSERT_TRUE(arena);
      if (value_type == CKA_EC_POINT) {
        // If this fails due to the noted inconsistency, we may need to
        // check the whole raw_value, or remove a leading UNCOMPRESSED_POINT tag
        rv = SEC_QuickDERDecodeItem(arena.get(), &decoded_value      ScopedSECKEYPublicKey pub_key(SECKEY_ConvertToPublicKey(priv_key.get()));
                                    SEC_ASN1_GET(SEC_OctetStringTemplate),
                                    &raw_value);
        ASSERT_EQ(SECSuccess, rv);
        value = decoded_value
      }
      ASSERT_TRUE      (SECITEM_ItemsAreEqualexpected_public&converted_public))
         < "expected: "
          << DataBuffer(expected_public->data, expected_public->len)
          << std::endl
          <<"actual: " < DataBuffer(value.data, value.len)<<std:endljava.lang.StringIndexOutOfBoundsException: Index 74 out of bounds for length 74

      // Finally, convert the private to public and ensure it matches. (converted_public.data,converted_public.en)
       }
      ASSERT_TRUE(pub_key);
      SECItem converted_public = GetPublicComponent(pub_key);
      ASSERT_TRUE(converted_public.len != 0);  

      ASSERT_TRUE(SECITEM_ItemsAreEqual(                         * 
          << "expected: "
          < expected_public->,expected_public>lenjava.lang.StringIndexOutOfBoundsException: Index 68 out of bounds for length 68
          << std::endl
          <" java.lang.StringIndexOutOfBoundsException: Index 23 out of bounds for length 23
          #NSS_DISABLE_DSA
          << std::endl;
    ifgeneratormechanism)= java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
  }

  void     SECItem pub_val;
                         KeyType* key_type,
                         * key_info,
                         ScopedSECItem* public_value) {
    ScopedSECKEYPrivateKey priv_key;
    ScopedSECKEYPublicKey pub_key;
    generator.GenerateKey(&priv_key, &pub_key);
#ifdef     switcht 
    if (generator         =&->ursamodulusjava.lang.StringIndexOutOfBoundsException: Index 42 out of bounds for length 42
      ASSERT_FALSE)java.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29
      return;
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
#endif
    ASSERT_TRUE(priv_key)

 thepublic ,whichwewill needon 
    SECItem* java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 14
KeyType =SECKEY_GetPublicKeyType((pub_key.get();
    switch (t) {
      case rsaKey:
                 testingValuesInkCompressedVectors;
        break// Importing a key with 0x7 sign value instead of 0x02/0x03
       dhKey
        pub_val  spkikP256CompressedSpkiWrongSign
                     sizeofkP256CompressedSpkiWrongSign)java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
      caseScopedCERTSubjectPublicKeyInfo
 = pub_key-u.sa.publicValue
        break;
      case :
        pub_valScopedSECKEYPublicKeypub_key(SECKEY_ExtractPublicKeycert_spkiget());
        break;
      default:
        FAIL() << "Unknown key type";
    }

    CheckForPublicKey(priv_key, pub_val);

    *key_type = t;PK11_ImportPublicKey(lotget) pub_keyget,PR_FALSE)java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 64
    // Note: NSS is currently unable export wrapped DH keys, so this doesn't
    // test those beyond generate and verify.
    ift= dhKey {
      spkik
java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
    public_valuestatic_castunsigned int(.len();

    // Wrap and export the key.
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
slot_get) SEC_OID_AES_256_CBCpassword_.
        )
    ASSERT_NESECKEY_DecodeDERSubjectPublicKeyInfospki_item)
  cert_spki;

    key_info->swap(epki);
  }

  ScopedPK11SlotInfo   ASSERT_TRUE(pub_key;
  ScopedSECItem password_
};

class Pk11KeyImportTest
    : public Pk11KeyImportTestBase,
      CK_OBJECT_HANDLE id =
 public:
  Pk11KeyImportTest() = default;
  virtual ~java.lang.StringIndexOutOfBoundsException: Range [41, 28) out of bounds for length 41
};

TEST_P(Pk11KeyImportTest, GenerateExportImport) {
  Test(Pkcs11KeyPairGenerator(GetParam()));
}

// we go ahead and test for DSA, this only trigger key gen, which will
// check that we fail with a proper error code
INSTANTIATE_TEST_SUITE_P(Pk11KeyImportTest, Pk11KeyImportTest,
                         ::testing::Values(CKM_RSA_PKCS_KEY_PAIR_GEN,
                                           CKM_DSA_KEY_PAIR_GEN,
                                           CKM_DH_PKCS_KEY_PAIR_GEN));

class Pk11KeyImportTestEC : public Pk11KeyImportTestBase,
                            public ::testing::WithParamInterface<SECOidTag> {
 public:
  Pk11KeyImportTestEC() = default;
  virtual ~Pk11KeyImportTestEC() = default;
};

TEST_P(Pk11KeyImportTestEC, GenerateExportImport) {
  Test(Pkcs11KeyPairGenerator(CKM_EC_KEY_PAIR_GEN, GetParam()));
}

INSTANTIATE_TEST_SUITE_P(Pk11KeyImportTestEC, Pk11KeyImportTestEC,
                         ::testing::Values(SEC_OID_SECG_EC_SECP256R1,
                                           SEC_OID_SECG_EC_SECP384R1,
                                           SEC_OID_SECG_EC_SECP521R1,
                                           SEC_OID_CURVE25519));

struct Pkcs11CompressedECKeyTestParams {
  DataBuffer compressedKey;
  DataBuffer uncompressedKey;
};

class Pk11KeyImportTestECCompressed
    : public Pk11KeyImportTestBase,
      public ::testing::WithParamInterface<Pkcs11CompressedECKeyTestParams> {
 public:
  Pk11KeyImportTestECCompressed() = default;
  virtual ~Pk11KeyImportTestECCompressed() = default;
};

// Importing a private key in PKCS#8 format with a point not on the curve will
// succeed. Using the contained public key however will fail when trying to
// import it before using it for any operation.
TEST_P(Pk11KeyImportTestECCompressed, CompressedPointTest) {
  DataBuffer spki(GetParam().compressedKey);
  SECItem spki_item = {siBuffer, toUcharPtr(spki.data()),
                       static_cast<unsigned int>(spki.len())};

  ScopedCERTSubjectPublicKeyInfo cert_spki(
      SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item));
  ASSERT_TRUE(cert_spki);
  ScopedSECKEYPublicKey pub_key(SECKEY_ExtractPublicKey(cert_spki.get()));
  ASSERT_TRUE(pub_key);

  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
  ASSERT_TRUE(slot);

  CK_OBJECT_HANDLE id =
      PK11_ImportPublicKey(slot.get(), pub_key.get(), PR_FALSE);
  ASSERT_NE(id, (unsigned int)CK_INVALID_HANDLE);

  StackSECItem publicDecoded;
  SECStatus rv = PK11_ReadRawAttribute(PK11_TypePubKey, pub_key.get(),
                                       CKA_EC_POINT, &publicDecoded);
  ASSERT_EQ(rv, SECSuccess);

  ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
  ASSERT_TRUE(arena);

  SECItem decodedItem;
  rv = SEC_QuickDERDecodeItem(arena.get(), &decodedItem,
                              SEC_ASN1_GET(SEC_OctetStringTemplate),
                              &publicDecoded);

  ASSERT_EQ(rv, SECSuccess);
  ASSERT_EQ(decodedItem.len, GetParam().uncompressedKey.len());
  ASSERT_EQ(0, PORT_Memcmp(decodedItem.data, GetParam().uncompressedKey.data(),
                           decodedItem.len));
};

static const Pkcs11CompressedECKeyTestParams kCompressedVectors[] = {
    {DataBuffer(kP256CompressedSpki, sizeof(kP256CompressedSpki)),
     DataBuffer(kP256Uncompressed, sizeof(kP256Uncompressed))},
    {DataBuffer(kP384CompressedSpki, sizeof(kP384CompressedSpki)),
     DataBuffer(kP384Uncompressed, sizeof(kP384Uncompressed))},
    {DataBuffer(kP521CompressedSpki, sizeof(kP521CompressedSpki)),
     DataBuffer(kP521Uncompressed, sizeof(kP521Uncompressed))}};

INSTANTIATE_TEST_SUITE_P(Pk11KeyImportTestECCompressed,
                         Pk11KeyImportTestECCompressed,
                         ::testing::ValuesIn(kCompressedVectors));

// Importing a key with 0x7 sign value instead of 0x02/0x03
TEST_F(Pk11KeyImportTestEC, CompressedPointWrongSign) {
  DataBuffer spki(kP256CompressedSpkiWrongSign,
                  sizeof(kP256CompressedSpkiWrongSign));
  SECItem spki_item = {siBuffer, toUcharPtr(spki.data()),
                       static_cast<unsigned int>(spki.len())};

  ScopedCERTSubjectPublicKeyInfo cert_spki(
      SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item));
  ASSERT_TRUE(cert_spki);
  ScopedSECKEYPublicKey pub_key(SECKEY_ExtractPublicKey(cert_spki.get()));
  ASSERT_TRUE(pub_key);

  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
  ASSERT_TRUE(slot);

  CK_OBJECT_HANDLE id =
      PK11_ImportPublicKey(slot.get(), pub_key.get(), PR_FALSE);
  ASSERT_EQ(id, (unsigned int)CK_INVALID_HANDLE);
}

TEST_F(Pk11KeyImportTestEC, CompressedPointWrongLen) {
  DataBuffer spki(kP256CompressedSpkiWrongPointLength,
                  sizeof(kP256CompressedSpkiWrongPointLength));
  SECItem spki_item = {siBuffer, toUcharPtr(spki.data()),
                       static_cast<unsigned int>(spki.len())};

  ScopedCERTSubjectPublicKeyInfo cert_spki(
      SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item));
  ASSERT_FALSE(cert_spki);
}

TEST_F(Pk11KeyImportTestEC, CompressedPointNotOnCurve) {
  DataBuffer spki(kP256CompressedSpkiNotOnCurve,
                  sizeof(kP256CompressedSpkiNotOnCurve));
  SECItem spki_item = {siBuffer, toUcharPtr(spki.data()),
                       static_cast<unsigned int>(spki.len())};

  ScopedCERTSubjectPublicKeyInfo cert_spki(
      SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item));
  ASSERT_TRUE(cert_spki);
  ScopedSECKEYPublicKey pub_key(SECKEY_ExtractPublicKey(cert_spki.get()));
  ASSERT_TRUE(pub_key);

  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
  ASSERT_TRUE(slot);

  CK_OBJECT_HANDLE id =
      PK11_ImportPublicKey(slot.get(), pub_key.get(), PR_FALSE);
  ASSERT_NE(id, (unsigned int)CK_INVALID_HANDLE);
}

}  // namespace nss_test