| # Copyright (c) 2013 The Chromium OS Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| import base64 |
| import json |
| import logging |
| import os.path |
| import tempfile |
| |
| import common |
| from autotest_lib.client.bin import test |
| from autotest_lib.client.common_lib import error |
| from autotest_lib.client.common_lib import utils |
| |
| # This modifies the include path to include the shill test-scripts. |
| # pylint: disable=W0611 |
| from autotest_lib.client.cros import flimflam_test_path |
| # pylint: enable=W0611 |
| import crypto_util_pb2 |
| |
| |
| TEST_DATA1 = """{ |
| "connected":false, |
| "debug_build":true, |
| "has_update":false, |
| "hotspot_bssid":"00:1A:11:FF:AC:DF", |
| "locale":"en_US", |
| "location": { |
| "latitude":37.4193105, |
| "longitude":-122.07878869999999 |
| }, |
| "mac_address":"4C:AA:16:A5:AC:DF", |
| "name":"eureka8997", |
| "public_key":"MIGJAoGBAK3SXmWZBOhJibv8It05qIbgHXXhnCXxHkW+C6jNMHR5sZgDpFaOY1xwXERjKdJxcwrEy3VAT5Uv9MgHPBvxxJku76HYh1yVfIw1rhLnHBTHSxwUzJNCrgc3l3t/UACacLjVNIzccDpYf2vnOcA+t1t6IXRjzuU2NdwY4dJXNtWPAgMBAAE=", |
| "setup_state":11, |
| "sign": { |
| "certificate":"-----BEGIN CERTIFICATE-----\\nMIIDhzCCAm8CBFE2SCMwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCVVMxEzAR\\nBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEzARBgNV\\nBAoMCkdvb2dsZSBJbmMxEjAQBgNVBAsMCUdvb2dsZSBUVjEYMBYGA1UEAwwPRXVy\\nZWthIEdlbjEgSUNBMB4XDTEzMDMwNTE5MzE0N1oXDTMzMDIyODE5MzE0N1owgYMx\\nFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxEjAQBgNVBAsTCUdvb2dsZSBUVjETMBEG\\nA1UEChMKR29vZ2xlIEluYzETMBEGA1UECBMKQ2FsaWZvcm5pYTELMAkGA1UEBhMC\\nVVMxHjAcBgNVBAMUFWV2dF9lMTYxIDAwMWExMWZmYWNkZjCCASIwDQYJKoZIhvcN\\nAQEBBQADggEPADCCAQoCggEBAPHGDV0lLoTYK78q13y/2u77YTjgbBlWAOxgrSNc\\nMmGHx1K0aPyo50p99dGQnjapW6jtGrMzReWV2Wz3VL8rYlqY7oWjeJwsLQwo2tcn\\n7vIZ/PuvPz9xgnGMUbBOfhCf3Epb1N4Jz82pxxrOFhUawWAglC9C4fUeZLCZpOJs\\nQd4QeAznkydl3xbqdSm74kwxE6vkGEzSCDnC7aYx0Rvvr1mZOKdl4AinYrxzWgmV\\nsTnaFT1soSjmC5e/i6Jcrs4dDFgY6mKy9Qtly2XPSCYljm6L4SgqgJNmlpY0qYJg\\nO++BdofIbU2jsOiCMvIuKkbMn72NsPQG0QhnVMwk7kYg6kkCAwEAAaMNMAswCQYD\\nVR0TBAIwADANBgkqhkiG9w0BAQUFAAOCAQEAW0bQl9yjBc7DgMp94i7ZDOUxKQrz\\nthephuwzb3/wWiTHcw6KK6FRPefXn6NPWxKKeQmv/tBxHbVlmYRXUbrhksnD0aUk\\ni4InvtL2m0H1fPfMxmJRFE+HoSXu+s0sGON831JaMcYRbAku5uHnltaGNzOI0KPH\\nFGoCDmjAZD+IuoR2LR4FuuTrECK7KLjkdf//z5d5j7nBDPZS7uTCwC/BwM9asRj3\\ntJA5VRFbLbsit1VI7IaRCk9rsSKkpBUaVeKbPLz+y/Z6JonXXT6AxsfgUSKDd4B7\\nMYLrTwMQfGuUaaaKko6ldKIrovjrcPloQr1Hxb2bipFcjLmG7nxQLoS6vQ==\\n-----END CERTIFICATE-----\\n", |
| "nonce":"+6KSGuRu833m1+TP", |
| "signed_data":"vwMBgANrp5XpCswLyk/OTXT56ORPeIWjH7xAdCk3qgjkwI6+8o56zJS02+tC5hhIHWh7oppTmWYF4tKvBQ3GeCz7IW9f7HWDMtO7x7yRWxzJyehaJbCfXvLdfs0/WKllzvGVBgNpcIAwU2NSFUG/jpXclntFzds0EUJG9wHxS6PXXSYRu+PlIFdCDcQJsUlnwO9AGFOJRV/aARGh8YUTWCFIQPOtPEqT5eegt+TLf01Gq0YcrRwSTKy1I3twOnWiMfIdkJdQKPtBwwbvuAyGuqYFocfjKABbnH9Tvl04yyO3euKbYlSqaF/l8CXmzDJTyO7tDOFK59bV9auE4KljrQ==" |
| }, |
| "ssdp_udn":"c5b2a83b-5958-7ce6-b179-e1f44699429b", |
| "ssid":"", |
| "timezone":"America/Los_Angeles", |
| "uptime":1991.7, |
| "version":4, |
| "wpa_configured":false, |
| "wpa_state":1 |
| } """ |
| TEST_DATA2 = """{ |
| "connected": false, |
| "debug_build": true, |
| "has_update": false, |
| "hotspot_bssid": "00:1A:11:FF:AC:1E", |
| "ip_address": "192.168.43.32", |
| "locale": "en_US", |
| "mac_address": "B0:EE:45:49:AC:1E", |
| "name": "Greg's Eureka", |
| "noise_level": -85, |
| "public_key": "MIGJAoGBAOe+6bF51A7wFVMbyPiHYLdgAmP6sdhOUohqCHn4qHSfDY41AbAbVmXLbUZ5BF2KSdDYqU4fAXoaI8V8D5DRWh57Ax10Sl1/6M1u22KT6FYQyUToXGPcXldBzRRMok8H4XyiebDVevjvvV6yuABSYYhfSlrMdGj8qxRVwTxx0CItAgMBAAE=", |
| "release_track": "beta-channel", |
| "setup_state": 50, |
| "sign": { |
| "certificate": "-----BEGIN CERTIFICATE-----\\nMIIDejCCAmICBFEtN4wwDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCVVMxEzAR\\nBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEzARBgNV\\nBAoMCkdvb2dsZSBJbmMxEjAQBgNVBAsMCUdvb2dsZSBUVjEYMBYGA1UEAwwPRXVy\\nZWthIEdlbjEgSUNBMB4XDTEzMDIyNjIyMzAzNloXDTMzMDIyMTIyMzAzNlowdzET\\nMBEGA1UECBMKQ2FsaWZvcm5pYTELMAkGA1UEBhMCVVMxFjAUBgNVBAcTDU1vdW50\\nYWluIFZpZXcxEjAQBgNVBAsTCUdvb2dsZSBUVjETMBEGA1UEChMKR29vZ2xlIElu\\nYzESMBAGA1UEAxQJZXZ0X2UxMjYyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\\nCgKCAQEAo7Uu+bdyCjtiUYpmNU4ZvRjDg6VkEh/g0YPDG2pICBU4XKvsqHH1i0hb\\ntWp1J79hV9Rqst1yHT02Oeh3o1SOd2zeamYzmvXRVN7AZqfQlzWxwxk/ltpXGwew\\nm+EIR2bP4kpvyEKvvziTMtTxviOK+A395QyodMhMXClKTus/Gme2r1fBoQqJJR/z\\nrmwXCsl5kpdhj7FOIII3BCYV0zejjQquzywjsKfCVON28VGgJdaKgmXxkeRYYWVN\\nnuTNna57vXe16FP6hS1ty1U77ESffLTpNJ/M4tsd2dMVVTDuGeX3q8Ix4TN8cqpq\\nu1AKEf59hygys9j6cHZRKR/div0+uQIDAQABow0wCzAJBgNVHRMEAjAAMA0GCSqG\\nSIb3DQEBBQUAA4IBAQAZx6XyEK9SLHE+rbKCVsLN9+hTEa50aikPmxOZt+lFuB4+\\nVJZ/GCPQCZJIde2tlWUe2YBgoZw2xUKgIsM3Yq42Gawi35/oZ3qycTgYU8KJP9kU\\nMbYNAH90mz9BDH7MmnRID5dFexHyBCG88EJ+ZvxmUVn0EVDcsSMt11wIAZ/T+/gs\\nE1120d/GxhjYQ9YZz7SZXBQfRdqCdcPNl2+QSHHl+WvYLzdJa2xYj39/kQu47Vp7\\nX5rZrHSBvzdVymH0Od2D18t+Q6lxbSdyUNhP1MVhdkT1Ct4OmRS3FJ4aannXMhfq\\nNg7k4Sfif5iktYT4VRKpThe0EGJNfqKJKYtvHEVC\\n-----END CERTIFICATE-----\\n", |
| "nonce": "pTwRhdsB5cb3Ev8o", |
| "signed_data": "WIvN6Ujo4CoxUNcsm1YaLRUe1KJVEG+oXorUBJae/fKQrLfnH9ChDfxzW+EDZlLBLPk9u5EAptr8LKK6AunbBTDIeBkjzXv3nS+xlmV9ZdA71imitva88HPzC+a2H61dJL8puNbZu9j1Zs3sCybw2F+qZbDBhbG0sJTEXytPjewqAl8iBZSAS0BoNJZYA7Q/bCPI07pg404pI392cKP8FYJR08Y4xoV94Em+jnZ2nZabSsmsScYGvpWVNeS2z+f0to6ureOxaqgT+AAckqtCRcHd66QtLGwKXWviaevKte1z185f4r55U4P5pkQi+xd6lZRsMQydwUzLxgk7UY5U3Q==" |
| }, |
| "signal_level": -42, |
| "ssdp_udn": "cd7c1f15-2f49-076b-51ac-9d651872c784", |
| "ssid": "Greg's Phone", |
| "timezone": "America/Los_Angeles", |
| "uptime": 207.33, |
| "version": 4, |
| "wpa_configured": true, |
| "wpa_id": 0, |
| "wpa_state": 10 |
| } |
| """ |
| TEST_DATA3 = """{ |
| "build_version":"10566", |
| "connected":false, |
| "has_update":false, |
| "hotspot_bssid":"FA:8F:CA:30:08:26", |
| "locale":"en_US", |
| "mac_address":"B0:EE:45:68:B5:52", |
| "name":"Chromekey Greg", |
| "public_key":"MIIBCgKCAQEApQoxFRJWEP9Oa+lSF2PCMBCpd2LYeyPMHjVKCF2IlrGbrgQ3U9wI6tBvLkHg570KSA6onL/7e9J31RLwA8gIE0zJ9M7NToxj1cVa8jOqXPIllJP7uY/TmtMIwCvuMCu6KBNW/wzKK6jkT7wScwrPJscmwWr/0h6lKXZrv0DhwvVv3i6VGsasZzVYlOoZ7eRe1OHiJgehPFUh0Vp7lVRDzumtJ0N6hybWP/Ap6dNlcO9Hq67bljHRrgwuBT2iRJBIdZt6m4xZlf78dH6Y2gfeQ3GBtDZWbZ5v6hzaYeIxlMTelz6ZlEQa0fPegK1dsxCddvLhRCDQr2bZlwyRdof6uwIDAQAB", |
| "release_track":"beta-channel", |
| "setup_state":11, |
| "sign": { |
| "certificate": "-----BEGIN CERTIFICATE-----\\nMIIDpjCCAo4CBFFfTz8wDQYJKoZIhvcNAQEFBQAwfTELMAkGA1UEBhMCVVMxEzAR\\nBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxEzARBgNV\\nBAoMCkdvb2dsZSBJbmMxEjAQBgNVBAsMCUdvb2dsZSBUVjEYMBYGA1UEAwwPRXVy\\nZWthIEdlbjEgSUNBMB4XDTEzMDQwNTIyMjUwM1oXDTMzMDMzMTIyMjUwM1owgYAx\\nCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRMwEQYDVQQKEwpHb29n\\nbGUgSW5jMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRIwEAYDVQQLEwlHb29nbGUg\\nVFYxGzAZBgNVBAMTElpaQUlNIEZBOEZDQTMwMDgyNjCCASIwDQYJKoZIhvcNAQEB\\nBQADggEPADCCAQoCggEBALmAGRcIQt/k7WfoUHDCWQhzQ/FrHDnNiHcVj09Tyu7/\\n2pIB+pVnLac8pfFwdVAcDG4xmjnROIHeajz627uq8bHEVDfPCHe8WiM+CsPrMC85\\nlQOq8rBwNw3WO82suvWL8wjdqFy0uQHajp9e9ix3FXzfZDAuf7ABHmVZnPMWQz0a\\nR3zDCCF2NhEVhBwq+IGKNNvuIPhVF/5tkdWPmihFukJabmV2kjFUuPbEf4T1OMu+\\nhyqZ+lsTc/XVIqICRIq9ZE36MquAw0g9Hoah8OFFpkq2xJqlCY+HKvdhiA1HybfY\\nXSxOsI2rTQk3YHFMrAGMu16UYuOA+CRHD+UC8SI0fqkCAwEAAaMvMC0wCQYDVR0T\\nBAIwADALBgNVHQ8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwIwDQYJKoZIhvcN\\nAQEFBQADggEBAJGyWBoDvwZBlDcyX31l5kwGVf6nVZR4KedcQMGpm76C6fgzeLHt\\nAq7OQhZgifFVLvzG7kqYgRRsW7WQKTF/QmHn8rnCdY16YtZv3vFzLbdBWkmSqAxD\\nqmBum9oD74AYeJaR0v68KCGvAVG0juRSs3H93s8k/fhY+LespUMlHwB4DwRYxDNP\\nIu3HX8NEmOBwjodKDDa8yu1weYUf8GFXH3b+tu7IHRzQpPzbSSibs+AXc8WbJWk3\\nrtQSugqegiiM/OAdRuSvkXtc1DJP9F7OLsVpF9i/VZ2k/QDPCu06vXB2w3wlRyR3\\nf6nQGB1Ej8Klsxlo8B+rmQ6N8C7f48GMI8s=\\n-----END CERTIFICATE-----\\n", |
| "nonce": "E1oqNODwWVIfSjUs", |
| "signed_data": "aaT56/P7KiMxVbWCedpSNIikpxh0EzdjgEuP153pCNfYys2KmlVtvEnXeFGYKJP2ypsX0qx/9Bx2C18T8HZ4PvNW0fUEheScvkzbDTn/gBpwUJv3XT+55XneUdjIAQu83qNR/AjxYa9cDGzxbnZJL91Fd1Grw/fNaKEMiedWRiESABQREiS2OW+iZ3Z/JRs99o4M6m+6f/mvNkgZ3GrFxNnPEXe7g1sYjspPhnDLvASNzd9j24YIxu+PTWZCNL6clps+/ghNA/0fB3PBDILrcGnER36Vc8gNhjD1r1f/ACU1qk06yMNC/Kgt2pMQkpjaXby+B75Z9yrogNHs4f5tIA==" |
| }, |
| "ssdp_udn":"b91027b5-f19e-7df6-6533-5056ad190575", |
| "ssid":"Greg's Phone", |
| "uptime":262650.75, |
| "version":4, |
| "wpa_configured":false, |
| "wpa_id":0, |
| "wpa_state":1 |
| }""" |
| # This is just a DER formatted public key with the first 22 bytes stripped. |
| # Technically, this is called RSAPublicKey format. |
| ENCRYPTION_PUBLIC_KEY = ( |
| '0\x81\x89\x02\x81\x81\x00\xd4\xe3z\x82\x0b6D\x8a\x1dY' |
| '\x1d\xdel\xbf\xad,\r\x8b\xefm\xe3\xbd\xef<\x954\x96C<' |
| '\x9e\x7fB\xef\xe8&h\xfb\xc4Z\x0e\x196C\x1d\xd7f\x88\\5' |
| '\xd5\x1e\xb8\xe0\x8d\xc4\xbc\xd1\xb3\xc4\xd3)!7\xd2{' |
| '\x11\x89\t\xfb\x8d\xe8\xbaRL\xacI\xf2\x0f.JB\x8e\xd4' |
| '\xdc\xc2\x81v6\x8a\x154\xbe8\xfc\xa8\x84zH\xf0j\x87(' |
| '\xcf\x142B\xcfV\xd0\n\xbbPW\x80d\xd2\x0e\xf1\x1a\x04' |
| '\x0b\xa8U=\x8f3\x85\xcd\x02\x03\x01\x00\x01' |
| ) |
| # This is the matching private key. Note that the public key is |
| # a subset of this information should you need it for debugging. |
| ENCRYPTION_PRIVATE_KEY = """ |
| -----BEGIN RSA PRIVATE KEY----- |
| MIICXQIBAAKBgQDU43qCCzZEih1ZHd5sv60sDYvvbeO97zyVNJZDPJ5/Qu/oJmj7 |
| xFoOGTZDHddmiFw11R644I3EvNGzxNMpITfSexGJCfuN6LpSTKxJ8g8uSkKO1NzC |
| gXY2ihU0vjj8qIR6SPBqhyjPFDJCz1bQCrtQV4Bk0g7xGgQLqFU9jzOFzQIDAQAB |
| AoGBALfdR/9s44/KoZJIQ8Q0v8HeaU9+30U5jF9pLaYggtty2nTsR5u6d/TZPY42 |
| BcVeXBV6XbBa8NZMJelXQvCw6d3hrirtRgqo+R9n6Z5Ji9oKA9NR0ZD0d66OLgRz |
| 7U1w2wiM9KqfjRpRhuID1MrDF8R0mxORSFnlMeoHD74ncK6ZAkEA+NBV2OOigyU/ |
| CVWCTKmOpxUGb6bRZfvQRln4XlVUhSgZU0Acf0APl3Av1vUPyPjRIXRnMS5ZBDFK |
| YoUqWH3ymwJBANsJhX3HHYXk7aDrmPKE7q25xR7Eu4C7XEdiG0SSl8PNAicU0APy |
| zFs9GLhTgGCTZf/SCzH6ejEIiOC/RZeqW7cCQCapAF3F6O9lryi9H5TX17GAY9Kf |
| YfPtr4vu2NeXfJ2AAIdd88+V3ZZTOSu2QjCg8KW5F3udzvkGy58JP+4mC7cCQBEU |
| +gMoHyZNBzcwiHoJYe/MeBIBN7o/Yl/yx7ueTxWnDE7t8ZcNPWC0MBRX9sARXrgH |
| snXQWe0vBDW61PuR/psCQQDthOoMBnuWamOEZrEJr+itK5+ZPlE+KpT3ladXui57 |
| zvz3CljmlLwyufahWaF+LzfohVAG5CLr4Zi/bv7j1lnJ |
| -----END RSA PRIVATE KEY----- |
| """ |
| |
| |
| def unicode2str(value): |
| """ |
| Recurses through value, converting unicode to strings. |
| |
| The output of the json python decoder looks like a dictionary with |
| unicode keys mapping to more unicode strings, and possibly |
| dictionaries. Convert those unicode strings to ASCII strings |
| recursively with this function. |
| |
| @param value: dict or unicode. |
| @returns value with unicode recursively replaced with string. |
| |
| """ |
| if isinstance(value, dict): |
| ret = {} |
| for k,v in value.items(): |
| ret[unicode2str(k)] = unicode2str(v) |
| return ret |
| |
| if isinstance(value, unicode): |
| return str(value) |
| |
| return value |
| |
| |
| class network_DestinationVerification(test.test): |
| """Tests that the destination verification logic in shill works. |
| |
| This logic allows us to verify that (for instance) we trust the |
| credentials of a Chromekey. |
| |
| """ |
| version = 1 |
| |
| |
| @property |
| def shim_path(self): |
| """@return path to crypto-util shim.""" |
| lib_paths = ['lib', 'lib64'] |
| shim_path = '/usr/%s/shill/shims/crypto-util' |
| for lib in lib_paths: |
| path = shim_path % lib |
| if os.path.exists(path): |
| return path |
| raise error.TestFail('Unable to find crypto-util.') |
| |
| |
| def _call_shim_with_args(self, args, protobuffer): |
| """Calls the crypto_util shim with args and stdin as specified. |
| |
| Calls crypto shim with args for paramters, and the serialized form of |
| protobuffer on stdin. Asserts that the command completes successfully |
| and returns the raw output bytestring. |
| |
| @param args: tuple of string arguments to the shim. |
| @param protobuffer: python protocol buffer object. |
| @return stdout of the shim call as string. |
| |
| """ |
| raw_input_bytes = protobuffer.SerializeToString() |
| result = utils.run(self.shim_path, |
| stderr_tee=utils.TEE_TO_LOGS, |
| stdin=raw_input_bytes, |
| verbose=True, |
| args=args, |
| timeout=10, |
| ignore_status=True) |
| if result.exit_status: |
| return None |
| raw_output = result.stdout |
| logging.debug('Got raw output: %s.', |
| ''.join([hex(ord(c)) for c in raw_output])) |
| return raw_output |
| |
| |
| def _test_verify(self, test_data, expect_failure=False): |
| """Test that shim verify operation works correctly. |
| |
| Call into the shim to perform a verify operation, check that the call |
| succeeds unless |expect_failure|. |test_data| looks like the decoded |
| json data we're given by the destination. |
| |
| @param test_data: dictionary of test data to use with the call. |
| @param expect_failure: bool true if test_data should fail to verify. |
| |
| @raises TestFail when verification doesn't go as expected. |
| |
| """ |
| # See doc/manager-api.txt, but the format goes roughly: |
| # ssid,udn,bssid,key,nonce |
| sign_bundle = test_data['sign'] |
| unsigned_data = '%s,%s,%s,%s,%s' % (test_data['name'], |
| test_data['ssdp_udn'], |
| test_data['hotspot_bssid'], |
| test_data['public_key'], |
| sign_bundle['nonce']) |
| message = crypto_util_pb2.VerifyCredentialsMessage() |
| message.certificate = sign_bundle['certificate'] |
| message.signed_data = base64.b64decode(sign_bundle['signed_data']) |
| message.unsigned_data = unsigned_data |
| message.mac_address = test_data['hotspot_bssid'] |
| output = self._call_shim_with_args(('verify',), message) |
| if expect_failure: |
| if output is None: |
| # Expected a failure, and got it. We're done here. |
| return |
| raise error.TestFail('Expected verification to fail, but it ' |
| 'succeeded.') |
| |
| if not output: |
| raise error.TestFail('Verification failed unexpectedly.') |
| |
| response = crypto_util_pb2.VerifyCredentialsResponse() |
| response.ParseFromString(output) |
| if response.ret != crypto_util_pb2.OK: |
| raise error.TestFail('Expected verification success, ' |
| 'but got: %d.' % response.ret) |
| |
| |
| def _test_encrypt(self, public_key, data_to_encrypt, expect_failure=False): |
| """Test that shim encrypt operation works correctly. |
| |
| Call into the shim to perform an encrypt operation. |
| Raise a test error if the call fails, unless |expect_failure|. |
| |
| @param public_key: string containing RSAPublicKey format RSA key. |
| @param data_to_encrypt: string data to encrypt. |
| @param expect_failure: bool true if encrypt should fail. |
| |
| """ |
| message = crypto_util_pb2.EncryptDataMessage() |
| message.public_key = public_key |
| message.data = data_to_encrypt |
| output = self._call_shim_with_args(('encrypt',), message) |
| if expect_failure: |
| if output is None: |
| # Expected a failure, and got it. We're done here. |
| return |
| raise error.TestFail('Expected encryption to fail, ' |
| 'but it did not.') |
| |
| if not output: |
| raise error.TestFail('Encryption failed unexpectedly.') |
| |
| response = crypto_util_pb2.EncryptDataResponse() |
| response.ParseFromString(output) |
| if response.ret != crypto_util_pb2.OK: |
| raise error.TestFail('Data encryption failed.') |
| |
| logging.debug('Decrypting %d bytes of encrypted data to confirm match.', |
| len(response.encrypted_data)) |
| try: |
| private_key = tempfile.NamedTemporaryFile() |
| encrypted_data = tempfile.NamedTemporaryFile() |
| private_key.write(ENCRYPTION_PRIVATE_KEY) |
| private_key.flush() |
| encrypted_data.write(response.encrypted_data) |
| encrypted_data.flush() |
| result = utils.run('openssl rsautl -decrypt -inkey %s -in %s' % |
| (private_key.name, encrypted_data.name), |
| stdin=response.encrypted_data, |
| stderr_tee=utils.TEE_TO_LOGS, |
| verbose=True, |
| ignore_status=True) |
| if result.exit_status: |
| if data_to_encrypt == '': |
| # Due to an open bug in OpenSSL, rsautl doesn't handle this |
| # case correctly. For now, just pass and assume that |
| # we're doing this correctly. |
| # http://rt.openssl.org/Ticket/Display.html?id=2018 |
| return |
| raise error.TestFail('Failed to decrypt shim output.') |
| |
| if result.stdout != data_to_encrypt: |
| raise error.TestFail('Data encyption failed: ' |
| 'expected: %s, but got: %s' % |
| (data_to_encrypt, result.stdout)) |
| |
| finally: |
| private_key.close() |
| encrypted_data.close() |
| |
| |
| def run_once(self): |
| """Body of the test.""" |
| logging.info('Checking basic encryption operation of the shim.') |
| self._test_encrypt(ENCRYPTION_PUBLIC_KEY, 'disco boy') |
| |
| logging.info('Checking graceful fail for too much data to encrypt.') |
| self._test_encrypt(ENCRYPTION_PUBLIC_KEY, |
| ''.join(['x' for i in range(500)]), |
| expect_failure=True) |
| |
| logging.info('Checking graceful fail for a bad key format.') |
| self._test_encrypt('this will not parse in openssl', |
| 'disco boy', |
| expect_failure=True) |
| |
| logging.info('Checking that we encrypt the empty string correctly.') |
| self._test_encrypt(ENCRYPTION_PUBLIC_KEY, '') |
| |
| logging.info('Checking basic verification operation.') |
| test_data = unicode2str(json.loads(TEST_DATA1)) |
| self._test_verify(test_data) |
| |
| logging.info('Checking bad nonce in unsigned_data.') |
| test_data = unicode2str(json.loads(TEST_DATA1)) |
| test_data['sign']['nonce'] = 'does not match' |
| self._test_verify(test_data, expect_failure=True) |
| |
| logging.info('Checking for graceful fail for invalid ' |
| 'certificate format') |
| test_data = unicode2str(json.loads(TEST_DATA1)) |
| test_data['sign']['certificate'] = 'not a certificate' |
| self._test_verify(test_data, expect_failure=True) |
| |
| logging.info('Verification fails when the certificate is signed, but ' |
| 'subject is malformed.') |
| test_data = unicode2str(json.loads(TEST_DATA2)) |
| self._test_verify(test_data, expect_failure=True) |
| |
| logging.info('Verification should succeed on third set of data.') |
| test_data = unicode2str(json.loads(TEST_DATA3)) |
| self._test_verify(test_data) |
| |
| logging.info('Test completed successfully.') |
