blob: 8ce962e0d62365734f685b1114eea986585816a7 [file] [log] [blame]
Yingdi Yufe4733a2015-10-22 14:24:12 -07001/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
2/**
3 * Copyright (c) 2013-2017 Regents of the University of California.
4 *
5 * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
6 *
7 * ndn-cxx library is free software: you can redistribute it and/or modify it under the
8 * terms of the GNU Lesser General Public License as published by the Free Software
9 * Foundation, either version 3 of the License, or (at your option) any later version.
10 *
11 * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
12 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
13 * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
14 *
15 * You should have received copies of the GNU General Public License and GNU Lesser
16 * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see
17 * <http://www.gnu.org/licenses/>.
18 *
19 * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
20 */
21
22#include "security/v2/key-chain.hpp"
23#include "security/signing-helpers.hpp"
24
25#include "boost-test.hpp"
26#include "unit-tests/test-home-env-saver.hpp"
Alexander Afanasyevfc99b512017-01-04 11:10:36 -080027#include "test-home-fixture.hpp"
Yingdi Yufe4733a2015-10-22 14:24:12 -070028#include "validator.hpp"
29
30namespace ndn {
31namespace security {
32namespace v2 {
33namespace tests {
34
35using namespace ndn::tests;
36
37BOOST_AUTO_TEST_SUITE(Security)
38BOOST_AUTO_TEST_SUITE(V2)
39BOOST_FIXTURE_TEST_SUITE(TestKeyChain, TestHomeEnvSaver)
40
41template<class Path>
42class TestHomeAndPibFixture : public TestHomeFixture<Path>
43{
44public:
45 TestHomeAndPibFixture()
46 {
47 unsetenv("NDN_CLIENT_PIB");
48 unsetenv("NDN_CLIENT_TPM");
49 }
50};
51
52struct PibPathConfigFileHome
53{
54 const std::string PATH = "build/config-file-home/";
55};
56
57BOOST_FIXTURE_TEST_CASE(ConstructorNormalConfig, TestHomeAndPibFixture<PibPathConfigFileHome>)
58{
59 createClientConf({"pib=pib-memory:", "tpm=tpm-memory:"});
60
61 BOOST_REQUIRE_NO_THROW(KeyChain());
62
63 KeyChain keyChain;
64 BOOST_CHECK_EQUAL(keyChain.getPib().getPibLocator(), "pib-memory:");
65 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-memory:");
66 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-memory:");
67}
68
69struct PibPathConfigFileEmptyHome
70{
71 const std::string PATH = "build/config-file-empty-home/";
72};
73
74BOOST_FIXTURE_TEST_CASE(ConstructorEmptyConfig, TestHomeAndPibFixture<PibPathConfigFileEmptyHome>)
75{
76 createClientConf({"pib=pib-memory:"});
77
78#if defined(NDN_CXX_HAVE_OSX_SECURITY)
79 std::string oldHOME;
80 if (std::getenv("OLD_HOME"))
81 oldHOME = std::getenv("OLD_HOME");
82
83 std::string HOME;
84 if (std::getenv("HOME"))
85 HOME = std::getenv("HOME");
86
87 if (!oldHOME.empty())
88 setenv("HOME", oldHOME.c_str(), 1);
89 else
90 unsetenv("HOME");
91#endif
92
93 BOOST_REQUIRE_NO_THROW(KeyChain());
94 KeyChain keyChain;
95 BOOST_CHECK_EQUAL(keyChain.getPib().getPibLocator(), "pib-memory:");
96
97#if defined(NDN_CXX_HAVE_OSX_SECURITY)
98 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-osxkeychain:");
99 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-osxkeychain:");
100#else
101 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-file:");
102 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-file:");
103#endif
104
105#if defined(NDN_CXX_HAVE_OSX_SECURITY)
106 if (!HOME.empty())
107 setenv("HOME", HOME.c_str(), 1);
108 else
109 unsetenv("HOME");
110
111 if (!oldHOME.empty())
112 setenv("OLD_HOME", oldHOME.c_str(), 1);
113 else
114 unsetenv("OLD_HOME");
115#endif
116}
117
118struct PibPathConfigFileEmpty2Home
119{
120 const std::string PATH = "build/config-file-empty2-home/";
121};
122
123BOOST_FIXTURE_TEST_CASE(ConstructorEmpty2Config, TestHomeAndPibFixture<PibPathConfigFileEmpty2Home>)
124{
125 createClientConf({"tpm=tpm-memory:"});
126
127 BOOST_REQUIRE_NO_THROW(KeyChain());
128
129 KeyChain keyChain;
130 BOOST_CHECK_EQUAL(keyChain.getPib().getPibLocator(), "pib-sqlite3:");
131 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-memory:");
132 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-memory:");
133}
134
135struct PibPathConfigFileMalformedHome
136{
137 const std::string PATH = "build/config-file-malformed-home/";
138};
139
140BOOST_FIXTURE_TEST_CASE(ConstructorMalConfig, TestHomeAndPibFixture<PibPathConfigFileMalformedHome>)
141{
142 createClientConf({"pib=lord", "tpm=ring"});
143
144 BOOST_REQUIRE_THROW(KeyChain(), KeyChain::Error); // Wrong configuration. Error expected.
145}
146
147struct PibPathConfigFileMalformed2Home
148{
149 const std::string PATH = "build/config-file-malformed2-home/";
150};
151
152BOOST_FIXTURE_TEST_CASE(ConstructorMal2Config, TestHomeAndPibFixture<PibPathConfigFileMalformed2Home>)
153{
154 createClientConf({"pib=pib-sqlite3:%PATH%", "tpm=just-wrong"});
155
156 BOOST_REQUIRE_THROW(KeyChain(), KeyChain::Error); // Wrong configuration. Error expected.
157}
158
159BOOST_AUTO_TEST_CASE(KeyChainWithCustomTpmAndPib)
160{
161 BOOST_REQUIRE_NO_THROW((KeyChain("pib-memory", "tpm-memory")));
162 BOOST_REQUIRE_NO_THROW((KeyChain("pib-memory:", "tpm-memory:")));
163 BOOST_REQUIRE_NO_THROW((KeyChain("pib-memory:/something", "tpm-memory:/something")));
164
165 KeyChain keyChain("pib-memory", "tpm-memory");
166 BOOST_CHECK_EQUAL(keyChain.getPib().getPibLocator(), "pib-memory:");
167 BOOST_CHECK_EQUAL(keyChain.getPib().getTpmLocator(), "tpm-memory:");
168 BOOST_CHECK_EQUAL(keyChain.getTpm().getTpmLocator(), "tpm-memory:");
169}
170
171// @TODO Delete after upgrade of the existing management fixture
172class IdentityManagementFixture
173{
174public:
175 IdentityManagementFixture()
176 : m_keyChain("pib-memory:", "tpm-memory:")
177 {
178 }
179
180 Identity
181 addIdentity(const Name& identityName, const KeyParams& params = KeyChain::getDefaultKeyParams())
182 {
183 Identity identity = m_keyChain.createIdentity(identityName, params);
184 m_identities.push_back(identity);
185 return identity;
186 }
187
188protected:
189 KeyChain m_keyChain;
190
191private:
192 std::vector<Identity> m_identities;
193};
194
195BOOST_FIXTURE_TEST_CASE(Management, IdentityManagementFixture)
196{
197 Name identityName("/test/id");
198 Name identity2Name("/test/id2");
199
200 BOOST_CHECK_EQUAL(m_keyChain.getPib().getIdentities().size(), 0);
201 BOOST_REQUIRE_THROW(m_keyChain.getPib().getDefaultIdentity(), Pib::Error);
202
203 // Create identity
204 Identity id = m_keyChain.createIdentity(identityName);
205 BOOST_CHECK(id);
206 BOOST_CHECK(m_keyChain.getPib().getIdentities().find(identityName) != m_keyChain.getPib().getIdentities().end());
207 // The first added identity becomes the default identity
208 BOOST_REQUIRE_NO_THROW(m_keyChain.getPib().getDefaultIdentity());
209 // The default key of the added identity must exist
210 Key key;
211 BOOST_REQUIRE_NO_THROW(key = id.getDefaultKey());
212 // The default certificate of the default key must exist
213 BOOST_REQUIRE_NO_THROW(key.getDefaultCertificate());
214
215 // Delete key
216 Name key1Name = key.getName();
217 BOOST_CHECK_NO_THROW(id.getKey(key1Name));
218 BOOST_CHECK_EQUAL(id.getKeys().size(), 1);
219 m_keyChain.deleteKey(id, key);
220 // The key instance should not be valid any more
221 BOOST_CHECK(!key);
222 BOOST_CHECK_THROW(id.getKey(key1Name), Pib::Error);
223 BOOST_CHECK_EQUAL(id.getKeys().size(), 0);
224
225 // Create another key
226 m_keyChain.createKey(id);
227 // The added key becomes the default key.
228 BOOST_REQUIRE_NO_THROW(id.getDefaultKey());
229 Key key2 = id.getDefaultKey();
230 BOOST_REQUIRE(key2);
231 BOOST_CHECK_NE(key2.getName(), key1Name);
232 BOOST_CHECK_EQUAL(id.getKeys().size(), 1);
233 BOOST_REQUIRE_NO_THROW(key2.getDefaultCertificate());
234
235 // Create the third key
236 Key key3 = m_keyChain.createKey(id);
237 BOOST_CHECK(key3.getName() != key2.getName());
238 // The added key will not be the default key, because the default key already exists
239 BOOST_CHECK(id.getDefaultKey().getName() == key2.getName());
240 BOOST_CHECK_EQUAL(id.getKeys().size(), 2);
241 BOOST_REQUIRE_NO_THROW(key3.getDefaultCertificate());
242
243 // Delete cert
244 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 1);
245 Certificate key3Cert1 = *key3.getCertificates().begin();
246 Name key3CertName = key3Cert1.getName();
247 m_keyChain.deleteCertificate(key3, key3CertName);
248 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 0);
249 BOOST_REQUIRE_THROW(key3.getDefaultCertificate(), Pib::Error);
250
251 // Add cert
252 m_keyChain.addCertificate(key3, key3Cert1);
253 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 1);
254 BOOST_REQUIRE_NO_THROW(key3.getDefaultCertificate());
255 // Overwrite the same cert again, should throw Pib::Error.
256 BOOST_REQUIRE_THROW(m_keyChain.addCertificate(key3, key3Cert1), Pib::Error);
257 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 1);
258 // Add another cert
259 Certificate key3Cert2 = key3Cert1;
260 Name key3Cert2Name = key3.getName();
261 key3Cert2Name.append("Self");
262 key3Cert2Name.appendVersion();
263 key3Cert2.setName(key3Cert2Name);
264 m_keyChain.addCertificate(key3, key3Cert2);
265 BOOST_CHECK_EQUAL(key3.getCertificates().size(), 2);
266
267 // Default certificate setting
268 BOOST_CHECK_EQUAL(key3.getDefaultCertificate().getName(), key3CertName);
269 m_keyChain.setDefaultCertificate(key3, key3Cert2);
270 BOOST_CHECK_EQUAL(key3.getDefaultCertificate().getName(), key3Cert2Name);
271
272 // Default key setting
273 BOOST_CHECK_EQUAL(id.getDefaultKey().getName(), key2.getName());
274 m_keyChain.setDefaultKey(id, key3);
275 BOOST_CHECK_EQUAL(id.getDefaultKey().getName(), key3.getName());
276
277 // Default identity setting
278 Identity id2 = m_keyChain.createIdentity(identity2Name);
279 BOOST_CHECK_EQUAL(m_keyChain.getPib().getDefaultIdentity().getName(), id.getName());
280 m_keyChain.setDefaultIdentity(id2);
281 BOOST_CHECK_EQUAL(m_keyChain.getPib().getDefaultIdentity().getName(), id2.getName());
282
283 // Delete identity
284 m_keyChain.deleteIdentity(id);
285 // The identity instance should not be valid any more
286 BOOST_CHECK(!id);
287 BOOST_REQUIRE_THROW(m_keyChain.getPib().getIdentity(identityName), Pib::Error);
288 BOOST_CHECK(m_keyChain.getPib().getIdentities().find(identityName) == m_keyChain.getPib().getIdentities().end());
289}
290
291BOOST_FIXTURE_TEST_CASE(GeneralSigningInterface, IdentityManagementFixture)
292{
293 Identity id = addIdentity("/id");
294 Key key = id.getDefaultKey();
295 Certificate cert = key.getDefaultCertificate();
296
297 std::list<SigningInfo> signingInfos = {
298 SigningInfo(),
299
300 SigningInfo(SigningInfo::SIGNER_TYPE_ID, id.getName()),
301 signingByIdentity(id.getName()),
302
Alexander Afanasyevd6d78aa2017-01-02 18:14:23 -0800303 SigningInfo(id),
304 signingByIdentity(id),
305
Yingdi Yufe4733a2015-10-22 14:24:12 -0700306 SigningInfo(SigningInfo::SIGNER_TYPE_KEY, key.getName()),
307 signingByKey(key.getName()),
308
Alexander Afanasyevd6d78aa2017-01-02 18:14:23 -0800309 SigningInfo(key),
310 signingByKey(key),
311
Yingdi Yufe4733a2015-10-22 14:24:12 -0700312 SigningInfo(SigningInfo::SIGNER_TYPE_CERT, cert.getName()),
313 signingByCertificate(cert.getName()),
Alexander Afanasyevd6d78aa2017-01-02 18:14:23 -0800314 signingByCertificate(cert),
Yingdi Yufe4733a2015-10-22 14:24:12 -0700315
316 SigningInfo(SigningInfo::SIGNER_TYPE_SHA256),
317 signingWithSha256()
318 };
319
320 for (const auto& signingInfo : signingInfos) {
321 BOOST_TEST_MESSAGE("SigningInfo: " << signingInfo);
322 Data data("/data");
323 Interest interest("/interest");
324
325 if (signingInfo.getSignerType() == SigningInfo::SIGNER_TYPE_NULL) {
326 m_keyChain.sign(data);
327 m_keyChain.sign(interest);
328 }
329 else {
330 m_keyChain.sign(data, signingInfo);
331 m_keyChain.sign(interest, signingInfo);
332 }
333
334 Signature interestSignature(interest.getName()[-2].blockFromValue(), interest.getName()[-1].blockFromValue());
335
336 if (signingInfo.getSignerType() == SigningInfo::SIGNER_TYPE_SHA256) {
337 BOOST_CHECK_EQUAL(data.getSignature().getType(), tlv::DigestSha256);
338 BOOST_CHECK_EQUAL(interestSignature.getType(), tlv::DigestSha256);
339
340 BOOST_CHECK(Validator::verifySha256Digest(data));
341 BOOST_CHECK(Validator::verifySha256Digest(interest));
342 }
343 else {
344 BOOST_CHECK_EQUAL(data.getSignature().getType(), tlv::SignatureSha256WithEcdsa);
345 BOOST_CHECK_EQUAL(interestSignature.getType(), tlv::SignatureSha256WithEcdsa);
346
347 BOOST_CHECK_EQUAL(data.getSignature().getKeyLocator().getName(), cert.getName().getPrefix(-2));
348 BOOST_CHECK_EQUAL(interestSignature.getKeyLocator().getName(), cert.getName().getPrefix(-2));
349
350 BOOST_CHECK(Validator::verifySignature(data, key.getPublicKey()));
351 BOOST_CHECK(Validator::verifySignature(interest, key.getPublicKey()));
352 }
353 }
354}
355
356BOOST_FIXTURE_TEST_CASE(PublicKeySigningDefaults, IdentityManagementFixture)
357{
358 Data data("/test/data");
359
360 // Identity will be created with generated key and self-signed cert with default parameters
361 BOOST_CHECK_THROW(m_keyChain.sign(data, signingByIdentity("/non-existing/identity")), KeyChain::InvalidSigningInfoError);
362
363 // Create identity with ECDSA key and the corresponding self-signed certificate
364 Identity id = addIdentity("/ndn/test/ecdsa", EcdsaKeyParams());
365 BOOST_CHECK_NO_THROW(m_keyChain.sign(data, signingByIdentity(id.getName())));
366 BOOST_CHECK_EQUAL(data.getSignature().getType(),
367 KeyChain::getSignatureType(EcdsaKeyParams().getKeyType(), DigestAlgorithm::SHA256));
368 BOOST_CHECK(id.getName().isPrefixOf(data.getSignature().getKeyLocator().getName()));
369
370 // Create identity with RSA key and the corresponding self-signed certificate
371 id = addIdentity("/ndn/test/rsa", RsaKeyParams());
372 BOOST_CHECK_NO_THROW(m_keyChain.sign(data, signingByIdentity(id.getName())));
373 BOOST_CHECK_EQUAL(data.getSignature().getType(),
374 KeyChain::getSignatureType(RsaKeyParams().getKeyType(), DigestAlgorithm::SHA256));
375 BOOST_CHECK(id.getName().isPrefixOf(data.getSignature().getKeyLocator().getName()));
376}
377
378BOOST_FIXTURE_TEST_CASE(ExportImport, IdentityManagementFixture)
379{
380 Identity id = addIdentity("/TestKeyChain/ExportIdentity/");
381 Certificate cert = id.getDefaultKey().getDefaultCertificate();
382
383 shared_ptr<SafeBag> exported = m_keyChain.exportSafeBag(cert, "1234", 4);
384 Block block = exported->wireEncode();
385
386 m_keyChain.deleteIdentity(id);
387
388 BOOST_CHECK_EQUAL(m_keyChain.getTpm().hasKey(cert.getKeyName()), false);
389 BOOST_CHECK_EQUAL(m_keyChain.getPib().getIdentities().size(), 0);
390
391 SafeBag imported;
392 imported.wireDecode(block);
393 m_keyChain.importSafeBag(imported, "1234", 4);
394
395 BOOST_CHECK_EQUAL(m_keyChain.getTpm().hasKey(cert.getKeyName()), true);
396 BOOST_CHECK_EQUAL(m_keyChain.getPib().getIdentities().size(), 1);
397 BOOST_REQUIRE_NO_THROW(m_keyChain.getPib().getIdentity(cert.getIdentity()));
398 Identity newId = m_keyChain.getPib().getIdentity(cert.getIdentity());
399 BOOST_CHECK_EQUAL(newId.getKeys().size(), 1);
400 BOOST_REQUIRE_NO_THROW(newId.getKey(cert.getKeyName()));
401 Key newKey = newId.getKey(cert.getKeyName());
402 BOOST_CHECK_EQUAL(newKey.getCertificates().size(), 1);
403 BOOST_REQUIRE_NO_THROW(newKey.getCertificate(cert.getName()));
404
405 m_keyChain.deleteIdentity(newId);
406 BOOST_CHECK_EQUAL(m_keyChain.getPib().getIdentities().size(), 0);
407 BOOST_CHECK_EQUAL(m_keyChain.getTpm().hasKey(cert.getKeyName()), false);
408}
409
410BOOST_AUTO_TEST_SUITE_END() // TestKeyChain
411BOOST_AUTO_TEST_SUITE_END() // Tmp
412BOOST_AUTO_TEST_SUITE_END() // Security
413
414} // namespace tests
415} // namespace v2
416} // namespace security
417} // namespace ndn