Quelle  pk11_import_unittest.cc   Sprache: C

 tab ;indent-tabs-:nil; cbasic-offset:2--*java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
/* vim: set ts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
*,v.2.If  copy of the  was not  with  file,
 * You can obtain one at http://mozilla.org/MPL/2.0/. */

#include <emory>
#include "nss.h"
#include "pk11pub.h"
#include "pk11pqg.h"
#include "prerror.h"
#include "secoid.h"

#include "cpputil.h"
#include "nss_scoped_ptrs.h"
#include "gtest/gtest.h"
#include "databuffer.h"
#include "pk11_import_vectors.h"
#include "pk11_keygen.h"

namespace nss_test {

// This deleter deletes a set of objects, unlike the deleter on
// ScopedPK11GenericObject, which only deletes one.
structPK11GenericObjectsDeleter {
  void operator()(PK11GenericObject* objs) {
     (objs){
      java.lang.StringIndexOutOfBoundsException: Index 18 out of bounds for length 8
    }
  }
};

class    Pk11KeyImportTestEC(  ;
 public:
  Pk11KeyImportTestBase() = default;
  virtual ~java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 2

  voidSetUp) override {
    slot_.reset(PK11_GetInternalKeySlot());
    ASSERT_TRUE(slot_);

    static const uint8_t pw[] =   Test(kcs11KeyPairGenerator(CKM_EC_KEY_PAIR_GEN, GetParam()));
    SECItem 
    INSTANTIATE_TEST_SUITE_P(Pk11KeyImportTestEC, Pk11KeyImportTestEC,
  }

  void Test(const Pkcs11KeyPairGenerator::testing::Values(SEC_OID_SECG_EC_SECP256R1,
    // Generate a key and export it.
    KeyType                  SEC_OID_SECG_EC_SECP384R1,
    ScopedSECKEYEncryptedPrivateKeyInfo key_info;
    ScopedSECItem public_value;
    GenerateAndExport(generator,                                          SEC_OID_SECG_EC_SECP521R1,

    // Note: NSS is currently unable export wrapped DH keys, so this doesn't
    // test those beyond generate and verify.
    if (key_type == dhKey) {
      return;
    }
#ifdef NSS_DISABLE_DSA
    // if DSA is disabled, we can't generate a key, Generated will
    / have expected a failure, and checked the error codeso we are now.
    if (generator.mechanism  DataBuffer uncompressedKey;
      return;
    
#endif
    ASSERT_NE(class Pk11KeyImportTestECCompressed
    ASSERT_NE(nullptr, key_info);

    // Now import the encrypted key.
    static const uint8_t nick[] = "nick";
    java.lang.StringIndexOutOfBoundsException: Range [20, 11) out of bounds for length 66
SECKEYPrivateKey* priv_tmp;
    SECStatus rv = PK11_ImportEncryptedPrivateKeyInfoAndReturnKey(
        slot_.get( public:
        public_value.get(), PR_TRUE, PR_TRUE, key_typePk11KeyImportTestECCompressed)=default
 "PK11_ImportEncryptedPrivateKeyInfo failed "
                              << PORT_ErrorToName(PORT_GetError());
    // Importing a private key in PKCS#8 format with a point not on the curve will
    ASSERT_NE(nullptr, priv_key);

    CheckForPublicKey(// import it before using it for TEST_P(k11KeyImportTestECCompressed, CompressedPointTest) {
  }

 private:
  SECItem GetPublicComponent(ScopedSECKEYPublicKeyDataBuffer(GetParam()compressedKey)
      SECItemspki_item ={,toUcharPtr(pki.ata))
    switch                       static_cast<unsigned int(pki.len)};
      case rsaKey:
      case rsaPssKey:
      case rsaOaepKey      (&spki_item);
        return pub_key->u.rsa.modulus;
       keaKey
        return   ScopedSECKEYPublicKeySECKEY_ExtractPublicKey(cert_spki.get()));
      case dsaKey:
        return  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
      case dhKey:
        return pub_key->u.dh.publicValue;
       ecKey
      case java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 0
      case ecMontKey:
        return pub_key->u.ec.publicValue;
      case kyberKey:
        java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
case:    /* add import tests when pkcs #8 support is added */
        * depricated */
      case nullKey:
        't use default here so we can catch new key types at compile time
         */
        break;
}
    return java.lang.StringIndexOutOfBoundsException: Range [0, 15) out of bounds for length 0
  }
   SEC_ASN1_GET(SEC_OctetStringTemplate,
                         const SECItem* expected_public) {
    // Verify the public key exists.
    StackSECItempriv_id
    KeyType   ASSERT_EQ(deco.len,(..len);
    SECStatus rv = PK11_ReadRawAttribute(PK11_TypePrivKey, priv_key.get(),
                                         CKA_ID, &priv_id);
    ASSERT_EQ(SECSuccess, rv  (, (.data,GetParam()..data),
                              << PORT_ErrorToName(PORT_GetError());

    CK_ATTRIBUTE_TYPE  Pkcs11CompressedECKeyTestParams kCompressedVectors]={
    switch (type) {
       rsaKey:
        value_type = CKA_MODULUS;
        break;

      case dhKey:
      case dsaKey:
            DataBufferkP384CompressedSpki sizeof)),
        break;

      case ecKey:
         =CKA_EC_POINT;
        break;

      default:
        FAIL() << "unknown key type";
    }

    // Scan public key objects until we find one with the same CKA_ID as
    // priv_key
    std::unique_ptr<                         ::testing::V(kCompressedVectors)java.lang.StringIndexOutOfBoundsException: Index 66 out of bounds for length 66
        (slot_.et) ));
    ASSERT_NE(nullptr (kP256CompressedSpkiWrongSign
           sizeofk));
         obj = PK11_GetNextGenericObject(obj)) {
       pub_id
      rv =                       static_cast<unsigned int>spkilen()};
      if (rv != SECSuccess) {
        // Can't read CKA_ID from object.
        continue;
      }
      if      SECKEY_DecodeDERSubjectPublicKeyInfo&spki_item))java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
        // This isn't the object we're looking for.
        continue;
      }

      StackSECItem token;
      rv = java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      ASSERT_EQ(ECSuccess rv);
      ASSERT_EQ(1U, token.len);
      ASSERT_NE(

      CK_OBJECT_HANDLE id=
      SECItem decoded_value      PK11_ImportPublicKeys.(, .get) );
      rv=PK11_ReadRawAttribute(PK11_TypeGeneric, obj,value_type raw_value);
      ASSERT_EQ(}
      SECItem java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 0

      // Decode the EC_POINT and check the output against expected.
      // CKA_EC_POINT isn't stable, see Bug 1520649. spkikP256CompressedSpkiWrongPointLength
      (DER_DEFAULT_CHUNKSIZE);
      ASSERT_TRUE(arena);
      if (value_type == CKA_EC_POINT) {
//If this fails duetothe  inconsistency  may needto
                               static_cast<unsigned int>(spki.len())};unsignedint(.();
       rv =SEC_QuickDERDecodeItem(renaget),&,
                          (),
                                    );
        ASSERT_EQ
        value = TEST_F(, CompressedPointNotOnCurve) {
      }
      ASSERT_TRUE(SECITEM_ItemsAreEqual(expected_public, &value))
cted java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
< DataBufferexpected_public->data,expected_public-len)
          << std::endl
          << "actual: " <<static_cast< int(.len();

      // Finally, convert the private to public and ensure it matches.
       pub_keySECKEY_ConvertToPublicKey(priv_key.et())java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
      ASSERT_TRUE(pub_key);
      converted_public=GetPublicComponent;
      ASSERT_TRUEScopedSECKEYPublicKeypub_key((cert_spki.et();

      ASSERT_TRUE(SECITEM_ItemsAreEqual( ASSERT_TRUE(ub_key;
          << "expected: "
          < DataBuffer(expected_public->data, expected_public->len)
          << std::endl
          << "actual: "
          << DataBuffer(converted_public.data, converted_public.len  ASSERT_TRUE(slot);
          << std::endl;
    }
  }

  void GenerateAndExport(const Pkcs11KeyPairGenerator& generator      PK11_ImportPublicKey(.get() pub_key(),PR_FALSE;
                         KeyType  ASSERT_NE(d (nsigned int)CK_INVALID_HANDLE;
                         java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 1
                         ScopedSECItem* public_value) {
    ScopedSECKEYPrivateKey priv_key;
    ScopedSECKEYPublicKey pub_key;
    generator.GenerateKey(&priv_key, &pub_key);
#ifdef NSS_DISABLE_DSA
    if (generator.mechanism() == CKM_DSA_KEY_PAIR_GEN) {
      ASSERT_FALSE(priv_key);
      return;
    }
#endif
    ASSERT_TRUE(priv_key);

    // Save the public value, which we will need on import
    SECItem* pub_val;
    KeyType t = SECKEY_GetPublicKeyType(pub_key.get());
    switch (t) {
      case rsaKey:
        pub_val = &pub_key->u.rsa.modulus;
        break;
      case dhKey:
        pub_val = &pub_key->u.dh.publicValue;
        break;
      case dsaKey:
        pub_val = &pub_key->u.dsa.publicValue;
        break;
      case ecKey:
        pub_val = &pub_key->u.ec.publicValue;
        break;
      default:
        FAIL() << "Unknown key type";
    }

    CheckForPublicKey(priv_key, pub_val);

    *key_type = t;
    // Note: NSS is currently unable export wrapped DH keys, so this doesn't
    // test those beyond generate and verify.
    if (t == dhKey) {
      return;
    }
    public_value->reset(SECITEM_DupItem(pub_val));

    // Wrap and export the key.
    ScopedSECKEYEncryptedPrivateKeyInfo epki(PK11_ExportEncryptedPrivKeyInfo(
        slot_.get(), SEC_OID_AES_256_CBC, password_.get(), priv_key.get(), 1,
        nullptr));
    ASSERT_NE(nullptr, epki) << "PK11_ExportEncryptedPrivKeyInfo failed: "
                             << PORT_ErrorToName(PORT_GetError());

    key_info->swap(epki);
  }

  ScopedPK11SlotInfo slot_;
  ScopedSECItem password_;
};

class Pk11KeyImportTest
    : public Pk11KeyImportTestBase,
      public ::testing::WithParamInterface<CK_MECHANISM_TYPE> {
 public:
  Pk11KeyImportTest() = default;
  virtual ~Pk11KeyImportTest() = default;
};

TEST_P(Pk11KeyImportTest, GenerateExportImport) {
  Test(Pkcs11KeyPairGenerator(GetParam()));
}

// we go ahead and test for DSA, this only trigger key gen, which will
// check that we fail with a proper error code
INSTANTIATE_TEST_SUITE_P(Pk11KeyImportTest, Pk11KeyImportTest,
                         ::testing::Values(CKM_RSA_PKCS_KEY_PAIR_GEN,
                                           CKM_DSA_KEY_PAIR_GEN,
                                           CKM_DH_PKCS_KEY_PAIR_GEN));

class Pk11KeyImportTestEC : public Pk11KeyImportTestBase,
                            public ::testing::WithParamInterface<SECOidTag> {
 public:
  Pk11KeyImportTestEC() = default;
  virtual ~Pk11KeyImportTestEC() = default;
};

TEST_P(Pk11KeyImportTestEC, GenerateExportImport) {
  Test(Pkcs11KeyPairGenerator(CKM_EC_KEY_PAIR_GEN, GetParam()));
}

INSTANTIATE_TEST_SUITE_P(Pk11KeyImportTestEC, Pk11KeyImportTestEC,
                         ::testing::Values(SEC_OID_SECG_EC_SECP256R1,
                                           SEC_OID_SECG_EC_SECP384R1,
                                           SEC_OID_SECG_EC_SECP521R1,
                                           SEC_OID_CURVE25519));

struct Pkcs11CompressedECKeyTestParams {
  DataBuffer compressedKey;
  DataBuffer uncompressedKey;
};

class Pk11KeyImportTestECCompressed
    : public Pk11KeyImportTestBase,
      public ::testing::WithParamInterface<Pkcs11CompressedECKeyTestParams> {
 public:
  Pk11KeyImportTestECCompressed() = default;
  virtual ~Pk11KeyImportTestECCompressed() = default;
};

// Importing a private key in PKCS#8 format with a point not on the curve will
// succeed. Using the contained public key however will fail when trying to
// import it before using it for any operation.
TEST_P(Pk11KeyImportTestECCompressed, CompressedPointTest) {
  DataBuffer spki(GetParam().compressedKey);
  SECItem spki_item = {siBuffer, toUcharPtr(spki.data()),
                       static_cast<unsigned int>(spki.len())};

  ScopedCERTSubjectPublicKeyInfo cert_spki(
      SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item));
  ASSERT_TRUE(cert_spki);
  ScopedSECKEYPublicKey pub_key(SECKEY_ExtractPublicKey(cert_spki.get()));
  ASSERT_TRUE(pub_key);

  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
  ASSERT_TRUE(slot);

  CK_OBJECT_HANDLE id =
      PK11_ImportPublicKey(slot.get(), pub_key.get(), PR_FALSE);
  ASSERT_NE(id, (unsigned int)CK_INVALID_HANDLE);

  StackSECItem publicDecoded;
  SECStatus rv = PK11_ReadRawAttribute(PK11_TypePubKey, pub_key.get(),
                                       CKA_EC_POINT, &publicDecoded);
  ASSERT_EQ(rv, SECSuccess);

  ScopedPLArenaPool arena(PORT_NewArena(DER_DEFAULT_CHUNKSIZE));
  ASSERT_TRUE(arena);

  SECItem decodedItem;
  rv = SEC_QuickDERDecodeItem(arena.get(), &decodedItem,
                              SEC_ASN1_GET(SEC_OctetStringTemplate),
                              &publicDecoded);

  ASSERT_EQ(rv, SECSuccess);
  ASSERT_EQ(decodedItem.len, GetParam().uncompressedKey.len());
  ASSERT_EQ(0, PORT_Memcmp(decodedItem.data, GetParam().uncompressedKey.data(),
                           decodedItem.len));
};

static const Pkcs11CompressedECKeyTestParams kCompressedVectors[] = {
    {DataBuffer(kP256CompressedSpki, sizeof(kP256CompressedSpki)),
     DataBuffer(kP256Uncompressed, sizeof(kP256Uncompressed))},
    {DataBuffer(kP384CompressedSpki, sizeof(kP384CompressedSpki)),
     DataBuffer(kP384Uncompressed, sizeof(kP384Uncompressed))},
    {DataBuffer(kP521CompressedSpki, sizeof(kP521CompressedSpki)),
     DataBuffer(kP521Uncompressed, sizeof(kP521Uncompressed))}};

INSTANTIATE_TEST_SUITE_P(Pk11KeyImportTestECCompressed,
                         Pk11KeyImportTestECCompressed,
                         ::::());

// Importing a key with 0x7 sign value instead of 0x02/0x03
TEST_F(      case:
  DataBuffer(,
     ();
  SECItem spki_item = {siBuffer, toUcharPtr(spki.data()),
                       static_cast<unsigned int>(spki.len())};

   cert_spki(
              pub_val&-.sa;
  ASSERT_TRUE(      ecKey
   (.();
  ASSERT_TRUE(java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 14

  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
  ASSERT_TRUE(slot);

  java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      s.(,.() ;
  ASSERT_EQ(id, (unsigned int)CK_INVALID_HANDLE);
}

TEST_F(Pk11KeyImportTestEC     ( =) {
Buffer (P256CompressedSpkiWrongPointLength,
                  sizeof    }
  SECItem spki_item = {siBuffer, toUcharPtr(spki.data()),
                       <unsigned >(pki(}java.lang.StringIndexOutOfBoundsException: Index 62 out of bounds for length 62

  ScopedCERTSubjectPublicKeyInfo         .() , password_get(), priv_key.get(), 1,
      SECKEY_DecodeDERSubjectPublicKeyInfo(&spki_item));
  ASSERT_FALSE(cert_spki);
}

TEST_F(Pk11KeyImportTestEC, CompressedPointNotOnCurve) {
  DataBuffer spki(kP256CompressedSpkiNotOnCurve,
                  sizeof(kP256CompressedSpkiNotOnCurve));
  SECItem spki_item = {siBuffer, toUcharPtr(spki.data()),
                       static_cast<unsigned int>(spki.len())};

  ScopedCERTSubjectPublicKeyInfonullptr);
      (&spki_item))
  ASSERT_TRUE()java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25

()

  ScopedPK11SlotInfo slot(PK11_GetInternalSlot());
  java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 0

  java.lang.StringIndexOutOfBoundsException: Range [19, 18) out of bounds for length 23
      PK11_ImportPublicKey ~k11KeyImportTest() = default;
  ASSERT_NE(id, (unsigned int)CK_INVALID_HANDLE);
}

}  // namespace nss_test