blob: f438ea49cd1fb92608eeca3b7ddca6488fe0c2d1 [file] [log] [blame]
Yingdi Yufe4733a2015-10-22 14:24:12 -07001/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
2/**
3 * Copyright (c) 2013-2017 Regents of the University of California.
4 *
5 * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
6 *
7 * ndn-cxx library is free software: you can redistribute it and/or modify it under the
8 * terms of the GNU Lesser General Public License as published by the Free Software
9 * Foundation, either version 3 of the License, or (at your option) any later version.
10 *
11 * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
12 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
13 * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
14 *
15 * You should have received copies of the GNU General Public License and GNU Lesser
16 * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see
17 * <http://www.gnu.org/licenses/>.
18 *
19 * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
20 */
21
22#include "security/v2/key-chain.hpp"
23#include "security/signing-helpers.hpp"
24
25#include "boost-test.hpp"
26#include "unit-tests/test-home-env-saver.hpp"
Alexander Afanasyevf8379172017-01-11 16:56:04 -080027#include "identity-management-fixture.hpp"
Yingdi Yufe4733a2015-10-22 14:24:12 -070028#include "validator.hpp"
29
30namespace ndn {
31namespace security {
32namespace v2 {
33namespace tests {
34
35using namespace ndn::tests;
36
37BOOST_AUTO_TEST_SUITE(Security)
38BOOST_AUTO_TEST_SUITE(V2)
39BOOST_FIXTURE_TEST_SUITE(TestKeyChain, TestHomeEnvSaver)
40
41template<class Path>
42class TestHomeAndPibFixture : public TestHomeFixture<Path>
43{
44public:
45 TestHomeAndPibFixture()
46 {
47 unsetenv("NDN_CLIENT_PIB");
48 unsetenv("NDN_CLIENT_TPM");
49 }
50};
51
52struct PibPathConfigFileHome
53{
54 const std::string PATH = "build/config-file-home/";
55};
56
57BOOST_FIXTURE_TEST_CASE(ConstructorNormalConfig, TestHomeAndPibFixture<PibPathConfigFileHome>)
58{
59 createClientConf({"pib=pib-memory:", "tpm=tpm-memory:"});
60
61 BOOST_REQUIRE_NO_THROW(KeyChain());
62
63 KeyChain keyChain;
64 BOOST_CHECK_EQUAL(keyChain.getPib().getPibLocator(), "pib-memory:");
65 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-memory:");
66 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-memory:");
67}
68
69struct PibPathConfigFileEmptyHome
70{
71 const std::string PATH = "build/config-file-empty-home/";
72};
73
74BOOST_FIXTURE_TEST_CASE(ConstructorEmptyConfig, TestHomeAndPibFixture<PibPathConfigFileEmptyHome>)
75{
76 createClientConf({"pib=pib-memory:"});
77
78#if defined(NDN_CXX_HAVE_OSX_SECURITY)
79 std::string oldHOME;
80 if (std::getenv("OLD_HOME"))
81 oldHOME = std::getenv("OLD_HOME");
82
83 std::string HOME;
84 if (std::getenv("HOME"))
85 HOME = std::getenv("HOME");
86
87 if (!oldHOME.empty())
88 setenv("HOME", oldHOME.c_str(), 1);
89 else
90 unsetenv("HOME");
91#endif
92
93 BOOST_REQUIRE_NO_THROW(KeyChain());
94 KeyChain keyChain;
95 BOOST_CHECK_EQUAL(keyChain.getPib().getPibLocator(), "pib-memory:");
96
97#if defined(NDN_CXX_HAVE_OSX_SECURITY)
98 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-osxkeychain:");
99 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-osxkeychain:");
100#else
101 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-file:");
102 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-file:");
103#endif
104
105#if defined(NDN_CXX_HAVE_OSX_SECURITY)
106 if (!HOME.empty())
107 setenv("HOME", HOME.c_str(), 1);
108 else
109 unsetenv("HOME");
110
111 if (!oldHOME.empty())
112 setenv("OLD_HOME", oldHOME.c_str(), 1);
113 else
114 unsetenv("OLD_HOME");
115#endif
116}
117
118struct PibPathConfigFileEmpty2Home
119{
120 const std::string PATH = "build/config-file-empty2-home/";
121};
122
123BOOST_FIXTURE_TEST_CASE(ConstructorEmpty2Config, TestHomeAndPibFixture<PibPathConfigFileEmpty2Home>)
124{
125 createClientConf({"tpm=tpm-memory:"});
126
127 BOOST_REQUIRE_NO_THROW(KeyChain());
128
129 KeyChain keyChain;
130 BOOST_CHECK_EQUAL(keyChain.getPib().getPibLocator(), "pib-sqlite3:");
131 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-memory:");
132 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-memory:");
133}
134
135struct PibPathConfigFileMalformedHome
136{
137 const std::string PATH = "build/config-file-malformed-home/";
138};
139
140BOOST_FIXTURE_TEST_CASE(ConstructorMalConfig, TestHomeAndPibFixture<PibPathConfigFileMalformedHome>)
141{
142 createClientConf({"pib=lord", "tpm=ring"});
143
144 BOOST_REQUIRE_THROW(KeyChain(), KeyChain::Error); // Wrong configuration. Error expected.
145}
146
147struct PibPathConfigFileMalformed2Home
148{
149 const std::string PATH = "build/config-file-malformed2-home/";
150};
151
152BOOST_FIXTURE_TEST_CASE(ConstructorMal2Config, TestHomeAndPibFixture<PibPathConfigFileMalformed2Home>)
153{
154 createClientConf({"pib=pib-sqlite3:%PATH%", "tpm=just-wrong"});
155
156 BOOST_REQUIRE_THROW(KeyChain(), KeyChain::Error); // Wrong configuration. Error expected.
157}
158
159BOOST_AUTO_TEST_CASE(KeyChainWithCustomTpmAndPib)
160{
161 BOOST_REQUIRE_NO_THROW((KeyChain("pib-memory", "tpm-memory")));
162 BOOST_REQUIRE_NO_THROW((KeyChain("pib-memory:", "tpm-memory:")));
163 BOOST_REQUIRE_NO_THROW((KeyChain("pib-memory:/something", "tpm-memory:/something")));
164
165 KeyChain keyChain("pib-memory", "tpm-memory");
166 BOOST_CHECK_EQUAL(keyChain.getPib().getPibLocator(), "pib-memory:");
167 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-memory:");
168 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-memory:");
169}
170
Yingdi Yufe4733a2015-10-22 14:24:12 -0700171BOOST_FIXTURE_TEST_CASE(Management, IdentityManagementFixture)
172{
173 Name identityName("/test/id");
174 Name identity2Name("/test/id2");
175
176 BOOST_CHECK_EQUAL(m_keyChain.getPib().getIdentities().size(), 0);
177 BOOST_REQUIRE_THROW(m_keyChain.getPib().getDefaultIdentity(), Pib::Error);
178
179 // Create identity
180 Identity id = m_keyChain.createIdentity(identityName);
181 BOOST_CHECK(id);
182 BOOST_CHECK(m_keyChain.getPib().getIdentities().find(identityName) != m_keyChain.getPib().getIdentities().end());
183 // The first added identity becomes the default identity
184 BOOST_REQUIRE_NO_THROW(m_keyChain.getPib().getDefaultIdentity());
185 // The default key of the added identity must exist
186 Key key;
187 BOOST_REQUIRE_NO_THROW(key = id.getDefaultKey());
188 // The default certificate of the default key must exist
189 BOOST_REQUIRE_NO_THROW(key.getDefaultCertificate());
190
191 // Delete key
192 Name key1Name = key.getName();
193 BOOST_CHECK_NO_THROW(id.getKey(key1Name));
194 BOOST_CHECK_EQUAL(id.getKeys().size(), 1);
195 m_keyChain.deleteKey(id, key);
196 // The key instance should not be valid any more
197 BOOST_CHECK(!key);
198 BOOST_CHECK_THROW(id.getKey(key1Name), Pib::Error);
199 BOOST_CHECK_EQUAL(id.getKeys().size(), 0);
200
201 // Create another key
202 m_keyChain.createKey(id);
203 // The added key becomes the default key.
204 BOOST_REQUIRE_NO_THROW(id.getDefaultKey());
205 Key key2 = id.getDefaultKey();
206 BOOST_REQUIRE(key2);
207 BOOST_CHECK_NE(key2.getName(), key1Name);
208 BOOST_CHECK_EQUAL(id.getKeys().size(), 1);
209 BOOST_REQUIRE_NO_THROW(key2.getDefaultCertificate());
210
211 // Create the third key
212 Key key3 = m_keyChain.createKey(id);
213 BOOST_CHECK(key3.getName() != key2.getName());
214 // The added key will not be the default key, because the default key already exists
215 BOOST_CHECK(id.getDefaultKey().getName() == key2.getName());
216 BOOST_CHECK_EQUAL(id.getKeys().size(), 2);
217 BOOST_REQUIRE_NO_THROW(key3.getDefaultCertificate());
218
219 // Delete cert
220 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 1);
221 Certificate key3Cert1 = *key3.getCertificates().begin();
222 Name key3CertName = key3Cert1.getName();
223 m_keyChain.deleteCertificate(key3, key3CertName);
224 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 0);
225 BOOST_REQUIRE_THROW(key3.getDefaultCertificate(), Pib::Error);
226
227 // Add cert
228 m_keyChain.addCertificate(key3, key3Cert1);
229 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 1);
230 BOOST_REQUIRE_NO_THROW(key3.getDefaultCertificate());
231 // Overwrite the same cert again, should throw Pib::Error.
232 BOOST_REQUIRE_THROW(m_keyChain.addCertificate(key3, key3Cert1), Pib::Error);
233 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 1);
234 // Add another cert
235 Certificate key3Cert2 = key3Cert1;
236 Name key3Cert2Name = key3.getName();
237 key3Cert2Name.append("Self");
238 key3Cert2Name.appendVersion();
239 key3Cert2.setName(key3Cert2Name);
240 m_keyChain.addCertificate(key3, key3Cert2);
241 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 2);
242
243 // Default certificate setting
244 BOOST_CHECK_EQUAL(key3.getDefaultCertificate().getName(), key3CertName);
245 m_keyChain.setDefaultCertificate(key3, key3Cert2);
246 BOOST_CHECK_EQUAL(key3.getDefaultCertificate().getName(), key3Cert2Name);
247
248 // Default key setting
249 BOOST_CHECK_EQUAL(id.getDefaultKey().getName(), key2.getName());
250 m_keyChain.setDefaultKey(id, key3);
251 BOOST_CHECK_EQUAL(id.getDefaultKey().getName(), key3.getName());
252
253 // Default identity setting
254 Identity id2 = m_keyChain.createIdentity(identity2Name);
255 BOOST_CHECK_EQUAL(m_keyChain.getPib().getDefaultIdentity().getName(), id.getName());
256 m_keyChain.setDefaultIdentity(id2);
257 BOOST_CHECK_EQUAL(m_keyChain.getPib().getDefaultIdentity().getName(), id2.getName());
258
259 // Delete identity
260 m_keyChain.deleteIdentity(id);
261 // The identity instance should not be valid any more
262 BOOST_CHECK(!id);
263 BOOST_REQUIRE_THROW(m_keyChain.getPib().getIdentity(identityName), Pib::Error);
264 BOOST_CHECK(m_keyChain.getPib().getIdentities().find(identityName) == m_keyChain.getPib().getIdentities().end());
265}
266
267BOOST_FIXTURE_TEST_CASE(GeneralSigningInterface, IdentityManagementFixture)
268{
269 Identity id = addIdentity("/id");
270 Key key = id.getDefaultKey();
271 Certificate cert = key.getDefaultCertificate();
272
273 std::list<SigningInfo> signingInfos = {
274 SigningInfo(),
275
276 SigningInfo(SigningInfo::SIGNER_TYPE_ID, id.getName()),
277 signingByIdentity(id.getName()),
278
Alexander Afanasyevd6d78aa2017-01-02 18:14:23 -0800279 SigningInfo(id),
280 signingByIdentity(id),
281
Yingdi Yufe4733a2015-10-22 14:24:12 -0700282 SigningInfo(SigningInfo::SIGNER_TYPE_KEY, key.getName()),
283 signingByKey(key.getName()),
284
Alexander Afanasyevd6d78aa2017-01-02 18:14:23 -0800285 SigningInfo(key),
286 signingByKey(key),
287
Yingdi Yufe4733a2015-10-22 14:24:12 -0700288 SigningInfo(SigningInfo::SIGNER_TYPE_CERT, cert.getName()),
289 signingByCertificate(cert.getName()),
Alexander Afanasyevd6d78aa2017-01-02 18:14:23 -0800290 signingByCertificate(cert),
Yingdi Yufe4733a2015-10-22 14:24:12 -0700291
292 SigningInfo(SigningInfo::SIGNER_TYPE_SHA256),
293 signingWithSha256()
294 };
295
296 for (const auto& signingInfo : signingInfos) {
297 BOOST_TEST_MESSAGE("SigningInfo: " << signingInfo);
298 Data data("/data");
299 Interest interest("/interest");
300
301 if (signingInfo.getSignerType() == SigningInfo::SIGNER_TYPE_NULL) {
302 m_keyChain.sign(data);
303 m_keyChain.sign(interest);
304 }
305 else {
306 m_keyChain.sign(data, signingInfo);
307 m_keyChain.sign(interest, signingInfo);
308 }
309
310 Signature interestSignature(interest.getName()[-2].blockFromValue(), interest.getName()[-1].blockFromValue());
311
312 if (signingInfo.getSignerType() == SigningInfo::SIGNER_TYPE_SHA256) {
313 BOOST_CHECK_EQUAL(data.getSignature().getType(), tlv::DigestSha256);
314 BOOST_CHECK_EQUAL(interestSignature.getType(), tlv::DigestSha256);
315
316 BOOST_CHECK(Validator::verifySha256Digest(data));
317 BOOST_CHECK(Validator::verifySha256Digest(interest));
318 }
319 else {
320 BOOST_CHECK_EQUAL(data.getSignature().getType(), tlv::SignatureSha256WithEcdsa);
321 BOOST_CHECK_EQUAL(interestSignature.getType(), tlv::SignatureSha256WithEcdsa);
322
323 BOOST_CHECK_EQUAL(data.getSignature().getKeyLocator().getName(), cert.getName().getPrefix(-2));
324 BOOST_CHECK_EQUAL(interestSignature.getKeyLocator().getName(), cert.getName().getPrefix(-2));
325
326 BOOST_CHECK(Validator::verifySignature(data, key.getPublicKey()));
327 BOOST_CHECK(Validator::verifySignature(interest, key.getPublicKey()));
328 }
329 }
330}
331
332BOOST_FIXTURE_TEST_CASE(PublicKeySigningDefaults, IdentityManagementFixture)
333{
334 Data data("/test/data");
335
336 // Identity will be created with generated key and self-signed cert with default parameters
337 BOOST_CHECK_THROW(m_keyChain.sign(data, signingByIdentity("/non-existing/identity")), KeyChain::InvalidSigningInfoError);
338
Spyridon Mastorakis1ece2e32015-08-27 18:52:21 -0700339 // Create identity with EC key and the corresponding self-signed certificate
340 Identity id = addIdentity("/ndn/test/ec", EcKeyParams());
Yingdi Yufe4733a2015-10-22 14:24:12 -0700341 BOOST_CHECK_NO_THROW(m_keyChain.sign(data, signingByIdentity(id.getName())));
342 BOOST_CHECK_EQUAL(data.getSignature().getType(),
Spyridon Mastorakis1ece2e32015-08-27 18:52:21 -0700343 KeyChain::getSignatureType(EcKeyParams().getKeyType(), DigestAlgorithm::SHA256));
Yingdi Yufe4733a2015-10-22 14:24:12 -0700344 BOOST_CHECK(id.getName().isPrefixOf(data.getSignature().getKeyLocator().getName()));
345
346 // Create identity with RSA key and the corresponding self-signed certificate
347 id = addIdentity("/ndn/test/rsa", RsaKeyParams());
348 BOOST_CHECK_NO_THROW(m_keyChain.sign(data, signingByIdentity(id.getName())));
349 BOOST_CHECK_EQUAL(data.getSignature().getType(),
350 KeyChain::getSignatureType(RsaKeyParams().getKeyType(), DigestAlgorithm::SHA256));
351 BOOST_CHECK(id.getName().isPrefixOf(data.getSignature().getKeyLocator().getName()));
352}
353
354BOOST_FIXTURE_TEST_CASE(ExportImport, IdentityManagementFixture)
355{
356 Identity id = addIdentity("/TestKeyChain/ExportIdentity/");
357 Certificate cert = id.getDefaultKey().getDefaultCertificate();
358
359 shared_ptr<SafeBag> exported = m_keyChain.exportSafeBag(cert, "1234", 4);
360 Block block = exported->wireEncode();
361
362 m_keyChain.deleteIdentity(id);
363
364 BOOST_CHECK_EQUAL(m_keyChain.getTpm().hasKey(cert.getKeyName()), false);
365 BOOST_CHECK_EQUAL(m_keyChain.getPib().getIdentities().size(), 0);
366
367 SafeBag imported;
368 imported.wireDecode(block);
369 m_keyChain.importSafeBag(imported, "1234", 4);
370
371 BOOST_CHECK_EQUAL(m_keyChain.getTpm().hasKey(cert.getKeyName()), true);
372 BOOST_CHECK_EQUAL(m_keyChain.getPib().getIdentities().size(), 1);
373 BOOST_REQUIRE_NO_THROW(m_keyChain.getPib().getIdentity(cert.getIdentity()));
374 Identity newId = m_keyChain.getPib().getIdentity(cert.getIdentity());
375 BOOST_CHECK_EQUAL(newId.getKeys().size(), 1);
376 BOOST_REQUIRE_NO_THROW(newId.getKey(cert.getKeyName()));
377 Key newKey = newId.getKey(cert.getKeyName());
378 BOOST_CHECK_EQUAL(newKey.getCertificates().size(), 1);
379 BOOST_REQUIRE_NO_THROW(newKey.getCertificate(cert.getName()));
380
381 m_keyChain.deleteIdentity(newId);
382 BOOST_CHECK_EQUAL(m_keyChain.getPib().getIdentities().size(), 0);
383 BOOST_CHECK_EQUAL(m_keyChain.getTpm().hasKey(cert.getKeyName()), false);
384}
385
Alexander Afanasyevf8379172017-01-11 16:56:04 -0800386BOOST_FIXTURE_TEST_CASE(SelfSignedCertValidity, IdentityManagementFixture)
387{
388 Certificate cert = addIdentity("/Security/V2/TestKeyChain/SelfSignedCertValidity")
389 .getDefaultKey()
390 .getDefaultCertificate();
391 BOOST_CHECK(cert.isValid());
392 BOOST_CHECK(cert.isValid(time::system_clock::now() + time::days(10 * 365)));
393 BOOST_CHECK_GT(cert.getValidityPeriod().getPeriod().second,
394 time::system_clock::now() + time::days(10 * 365));
395}
396
Yingdi Yufe4733a2015-10-22 14:24:12 -0700397BOOST_AUTO_TEST_SUITE_END() // TestKeyChain
Alexander Afanasyevf8379172017-01-11 16:56:04 -0800398BOOST_AUTO_TEST_SUITE_END() // V2
Yingdi Yufe4733a2015-10-22 14:24:12 -0700399BOOST_AUTO_TEST_SUITE_END() // Security
400
401} // namespace tests
402} // namespace v2
403} // namespace security
404} // namespace ndn