google_apis/cup/client_update_protocol_unittest.cc

   1 // Copyright 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <limits>
   6 #include <vector>
   7
   8 #include "base/base64.h"
   9 #include "base/memory/scoped_ptr.h"
  10 #include "crypto/random.h"
  11 #include "crypto/secure_util.h"
  12 #include "google_apis/cup/client_update_protocol.h"
  13 #include "testing/gtest/include/gtest/gtest.h"
  14
  15 namespace {
  16
  17 std::string GetPublicKeyForTesting() {
  18   // How to generate this key:
  19   //   openssl genpkey -out cr.pem -outform PEM -algorithm RSA
  20   //                   -pkeyopt rsa_keygen_pubexp:3
  21   //   openssl rsa -in cr.pem -pubout -out cr_pub.pem
  22
  23   static const char kCupTestKey1024_Base64[] =
  24     "MIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKBgQC7ct1JhLSol2DkBcJdNjR3KkEA"
  25     "ZfXpF22lDD2WZu5JAZ4NiZqnHsKGJNPUbCH4AhFsXmuW5wEHhUVNhsMP6F9mQ06D"
  26     "i+ygwZ8aXlklmW4S0Et+SNg3i73fnYn0KDQzrzJnMu46s/CFPhjr4f0TH9b7oHkU"
  27     "XbqNZtG6gwaN1bmzFwIBAw==";
  28
  29   std::string result;
  30   if (!base::Base64Decode(std::string(kCupTestKey1024_Base64), &result))
  31     return "";
  32
  33   return result;
  34 }
  35
  36 }  // end namespace
  37
  38 #if defined(USE_OPENSSL)
  39
  40 // Once CUP is implemented for OpenSSL, remove this #if block.
  41 TEST(CupTest, OpenSSLStub) {
  42   scoped_ptr<ClientUpdateProtocol> cup =
  43       ClientUpdateProtocol::Create(8, GetPublicKeyForTesting());
  44   ASSERT_FALSE(cup.get());
  45 }
  46
  47 #else
  48
  49 class CupTest : public testing::Test {
  50  protected:
  51   virtual void SetUp() {
  52     cup_ = ClientUpdateProtocol::Create(8, GetPublicKeyForTesting());
  53     ASSERT_TRUE(cup_.get());
  54   }
  55
  56   void OverrideRAndRebuildKeys() {
  57     // This must be the same length as the modulus of the public key being
  58     // used in the unit test.
  59     static const size_t kPublicKeyLength = 1024 / 8;
  60     static const char kFixedR[] =
  61       "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do "
  62       "eiusmod tempor incididunt ut labore et dolore magna aliqua.    ";
  63
  64     ASSERT_EQ(kPublicKeyLength, strlen(kFixedR));
  65     ASSERT_TRUE(cup_->SetSharedKeyForTesting(kFixedR));
  66   }
  67
  68   ClientUpdateProtocol& CUP() {
  69     return *cup_.get();
  70   }
  71
  72  private:
  73   scoped_ptr<ClientUpdateProtocol> cup_;
  74 };
  75
  76 TEST_F(CupTest, GetVersionedSecret) {
  77   // Given a fixed public key set in the test fixture, if the key source |r|
  78   // is filled with known data, |w| can be tested against an expected output,
  79   // and the signing/verification for an given request becomes fixed.
  80   //
  81   // The expected output can be generated using this command line, where
  82   // plaintext.bin is the contents of kFixedR[] in OverrideRAndRebuildKeys():
  83   //
  84   //   openssl rsautl -inkey cr2_pub.pem -pubin -encrypt -raw
  85   //                  -in plaintext.bin | base64
  86   //
  87   // Remember to prepend the key version number, and fix up the Base64
  88   // afterwards to be URL-safe.
  89
  90   static const char kExpectedVW[] =
  91     "8:lMmNR3mVbOitbq8ceYGStFBwrJcpvY-sauFSbMVe6VONS9x42xTOLY_KdqsWCy"
  92     "KuiJBiQziQLOybPUyA9vk0N5kMnC90LIh2nP2FgFG0M0Z22qjB3drsdJPi7TQZbb"
  93     "Xhqm587M8vjc6VlM_eoC0qYwCPaXBqXjsyiHnXetcn5X0";
  94
  95   EXPECT_NE(kExpectedVW, CUP().GetVersionedSecret());
  96   OverrideRAndRebuildKeys();
  97   EXPECT_EQ(kExpectedVW, CUP().GetVersionedSecret());
  98 }
  99
 100 TEST_F(CupTest, SignRequest) {
 101   static const char kUrl[] = "//testserver.chromium.org/update";
 102   static const char kUrlQuery[] = "?junk=present";
 103   static const char kRequest[] = "testbody";
 104
 105   static const char kExpectedCP[] = "tfjmVMDAbU0-Kye4PjrCuyQIDCU";
 106
 107   OverrideRAndRebuildKeys();
 108
 109   // Check the case with no query string other than v|w.
 110   std::string url(kUrl);
 111   url.append("?w=");
 112   url.append(CUP().GetVersionedSecret());
 113
 114   std::string cp;
 115   ASSERT_TRUE(CUP().SignRequest(url, kRequest, &cp));
 116
 117   // Check the case with a pre-existing query string.
 118   std::string url2(kUrl);
 119   url2.append(kUrlQuery);
 120   url2.append("&w=");
 121   url2.append(CUP().GetVersionedSecret());
 122
 123   std::string cp2;
 124   ASSERT_TRUE(CUP().SignRequest(url2, kRequest, &cp2));
 125
 126   // Changes in the URL should result in changes in the client proof.
 127   EXPECT_EQ(kExpectedCP, cp2);
 128   EXPECT_NE(cp, cp2);
 129 }
 130
 131 TEST_F(CupTest, ValidateResponse) {
 132   static const char kUrl[] = "//testserver.chromium.orgupdate?junk=present&w=";
 133   static const char kRequest[] = "testbody";
 134
 135   static const char kGoodResponse[] = "intact_response";
 136   static const char kGoodC[] = "c=EncryptedDataFromTheUpdateServer";
 137   static const char kGoodSP[] = "5rMFMPL9Hgqb-2J8kL3scsHeNgg";
 138
 139   static const char kBadResponse[] = "tampered_response";
 140   static const char kBadC[] = "c=TotalJunkThatAnAttackerCouldSend";
 141   static const char kBadSP[] = "Base64TamperedShaOneHash";
 142
 143   OverrideRAndRebuildKeys();
 144
 145   std::string url(kUrl);
 146   url.append(CUP().GetVersionedSecret());
 147
 148   std::string client_proof;
 149   ASSERT_TRUE(CUP().SignRequest(url, kRequest, &client_proof));
 150
 151   // Return true on a valid response and server proof.
 152   EXPECT_TRUE(CUP().ValidateResponse(kGoodResponse, kGoodC, kGoodSP));
 153
 154   // Return false on anything invalid.
 155   EXPECT_FALSE(CUP().ValidateResponse(kBadResponse, kGoodC, kGoodSP));
 156   EXPECT_FALSE(CUP().ValidateResponse(kGoodResponse, kBadC, kGoodSP));
 157   EXPECT_FALSE(CUP().ValidateResponse(kGoodResponse, kGoodC, kBadSP));
 158   EXPECT_FALSE(CUP().ValidateResponse(kGoodResponse, kBadC, kBadSP));
 159   EXPECT_FALSE(CUP().ValidateResponse(kBadResponse, kGoodC, kBadSP));
 160   EXPECT_FALSE(CUP().ValidateResponse(kBadResponse, kBadC, kGoodSP));
 161   EXPECT_FALSE(CUP().ValidateResponse(kBadResponse, kBadC, kBadSP));
 162 }
 163
 164 #endif  // !defined(USE_OPENSSL)
 165