Ви не можете вибрати більше 25 тем Теми мають розпочинатися з літери або цифри, можуть містити дефіси (-) і не повинні перевищувати 35 символів.

Implement new SPKI parsers. Many consumers need SPKI support (X.509, TLS, QUIC, WebCrypto), each with different ways to set signature parameters. SPKIs themselves can get complex with id-RSASSA-PSS keys which come with various constraints in the key parameters. This suggests we want a common in-library representation of an SPKI. This adds two new functions EVP_parse_public_key and EVP_marshal_public_key which converts EVP_PKEY to and from SPKI and implements X509_PUBKEY functions with them. EVP_PKEY seems to have been intended to be able to express the supported SPKI types with full-fidelity, so these APIs will continue this. This means future support for id-RSASSA-PSS would *not* repurpose EVP_PKEY_RSA. I'm worried about code assuming EVP_PKEY_RSA implies acting on the RSA* is legal. Instead, it'd add an EVP_PKEY_RSA_PSS and the data pointer would be some (exposed, so the caller may still check key size, etc.) RSA_PSS_KEY struct. Internally, the EVP_PKEY_CTX implementation would enforce the key constraints. If RSA_PSS_KEY would later need its own API, that code would move there, but that seems unlikely. Ideally we'd have a 1:1 correspondence with key OID, although we may have to fudge things if mistakes happen in standardization. (Whether or not X.509 reuses id-ecPublicKey for Ed25519, we'll give it a separate EVP_PKEY type.) DSA parsing hooks are still implemented, missing parameters and all for now. This isn't any worse than before. Decoupling from the giant crypto/obj OID table will be a later task. BUG=522228 Change-Id: I0e3964edf20cb795a18b0991d17e5ca8bce3e28c Reviewed-on: https://boringssl-review.googlesource.com/6861 Reviewed-by: Adam Langley <agl@google.com>
8 роки тому
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157
  1. /* Copyright (c) 2015, Google Inc.
  2. *
  3. * Permission to use, copy, modify, and/or distribute this software for any
  4. * purpose with or without fee is hereby granted, provided that the above
  5. * copyright notice and this permission notice appear in all copies.
  6. *
  7. * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  8. * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  9. * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
  10. * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  11. * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
  12. * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  13. * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
  14. #ifndef OPENSSL_HEADER_CRYPTO_TEST_FILE_TEST_H
  15. #define OPENSSL_HEADER_CRYPTO_TEST_FILE_TEST_H
  16. #include <openssl/base.h>
  17. #include <stdint.h>
  18. #include <stdio.h>
  19. OPENSSL_MSVC_PRAGMA(warning(push))
  20. OPENSSL_MSVC_PRAGMA(warning(disable: 4702))
  21. #include <string>
  22. #include <map>
  23. #include <set>
  24. #include <vector>
  25. OPENSSL_MSVC_PRAGMA(warning(pop))
  26. // File-based test framework.
  27. //
  28. // This module provides a file-based test framework. The file format is based on
  29. // that of OpenSSL upstream's evp_test and BoringSSL's aead_test. Each input
  30. // file is a sequence of attributes and blank lines.
  31. //
  32. // Each attribute has the form:
  33. //
  34. // Name = Value
  35. //
  36. // Either '=' or ':' may be used to delimit the name from the value. Both the
  37. // name and value have leading and trailing spaces stripped.
  38. //
  39. // Lines beginning with # are ignored.
  40. //
  41. // A test is a sequence of one or more attributes followed by a blank line.
  42. // Blank lines are otherwise ignored. For tests that process multiple kinds of
  43. // test cases, the first attribute is parsed out as the test's type and
  44. // parameter. Otherwise, attributes are unordered. The first attribute is also
  45. // included in the set of attributes, so tests which do not dispatch may ignore
  46. // this mechanism.
  47. //
  48. // Functions in this module freely output to |stderr| on failure. Tests should
  49. // also do so, and it is recommended they include the corresponding test's line
  50. // number in any output. |PrintLine| does this automatically.
  51. //
  52. // Each attribute in a test must be consumed. When a test completes, if any
  53. // attributes haven't been processed, the framework reports an error.
  54. class FileTest {
  55. public:
  56. explicit FileTest(const char *path);
  57. ~FileTest();
  58. // is_open returns true if the file was successfully opened.
  59. bool is_open() const { return file_ != nullptr; }
  60. enum ReadResult {
  61. kReadSuccess,
  62. kReadEOF,
  63. kReadError,
  64. };
  65. // ReadNext reads the next test from the file. It returns |kReadSuccess| if
  66. // successfully reading a test and |kReadEOF| at the end of the file. On
  67. // error or if the previous test had unconsumed attributes, it returns
  68. // |kReadError|.
  69. ReadResult ReadNext();
  70. // PrintLine is a variant of printf which prepends the line number and appends
  71. // a trailing newline.
  72. void PrintLine(const char *format, ...) OPENSSL_PRINTF_FORMAT_FUNC(2, 3);
  73. unsigned start_line() const { return start_line_; }
  74. // GetType returns the name of the first attribute of the current test.
  75. const std::string &GetType();
  76. // GetParameter returns the value of the first attribute of the current test.
  77. const std::string &GetParameter();
  78. // HasAttribute returns true if the current test has an attribute named |key|.
  79. bool HasAttribute(const std::string &key);
  80. // GetAttribute looks up the attribute with key |key|. It sets |*out_value| to
  81. // the value and returns true if it exists and returns false with an error to
  82. // |stderr| otherwise.
  83. bool GetAttribute(std::string *out_value, const std::string &key);
  84. // GetAttributeOrDie looks up the attribute with key |key| and aborts if it is
  85. // missing. It should only be used after a |HasAttribute| call.
  86. const std::string &GetAttributeOrDie(const std::string &key);
  87. // GetBytes looks up the attribute with key |key| and decodes it as a byte
  88. // string. On success, it writes the result to |*out| and returns
  89. // true. Otherwise it returns false with an error to |stderr|. The value may
  90. // be either a hexadecimal string or a quoted ASCII string. It returns true on
  91. // success and returns false with an error to |stderr| on failure.
  92. bool GetBytes(std::vector<uint8_t> *out, const std::string &key);
  93. // ExpectBytesEqual returns true if |expected| and |actual| are equal.
  94. // Otherwise, it returns false and prints a message to |stderr|.
  95. bool ExpectBytesEqual(const uint8_t *expected, size_t expected_len,
  96. const uint8_t *actual, size_t actual_len);
  97. private:
  98. void ClearTest();
  99. void OnKeyUsed(const std::string &key);
  100. FILE *file_ = nullptr;
  101. // line_ is the number of lines read.
  102. unsigned line_ = 0;
  103. // start_line_ is the line number of the first attribute of the test.
  104. unsigned start_line_ = 0;
  105. // type_ is the name of the first attribute of the test.
  106. std::string type_;
  107. // parameter_ is the value of the first attribute.
  108. std::string parameter_;
  109. // attributes_ contains all attributes in the test, including the first.
  110. std::map<std::string, std::string> attributes_;
  111. // unused_attributes_ is the set of attributes that have been queried.
  112. std::set<std::string> unused_attributes_;
  113. FileTest(const FileTest&) = delete;
  114. FileTest &operator=(const FileTest&) = delete;
  115. };
  116. // FileTestMain runs a file-based test out of |path| and returns an exit code
  117. // suitable to return out of |main|. |run_test| should return true on pass and
  118. // false on failure. FileTestMain also implements common handling of the 'Error'
  119. // attribute. A test with that attribute is expected to fail. The value of the
  120. // attribute is the reason string of the expected OpenSSL error code.
  121. //
  122. // Tests are guaranteed to run serially and may affect global state if need be.
  123. // It is legal to use "tests" which, for example, import a private key into a
  124. // list of keys. This may be used to initialize a shared set of keys for many
  125. // tests. However, if one test fails, the framework will continue to run
  126. // subsequent tests.
  127. int FileTestMain(bool (*run_test)(FileTest *t, void *arg), void *arg,
  128. const char *path);
  129. #endif /* OPENSSL_HEADER_CRYPTO_TEST_FILE_TEST_H */