1 /* Copyright (c) 2020, Google Inc.
2  *
3  * Permission to use, copy, modify, and/or distribute this software for any
4  * purpose with or without fee is hereby granted, provided that the above
5  * copyright notice and this permission notice appear in all copies.
6  *
7  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
8  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
9  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
10  * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
11  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
12  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
13  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
14 
15 #include <stdio.h>
16 #include <string.h>
17 #include <time.h>
18 
19 #include <algorithm>
20 #include <limits>
21 #include <string>
22 #include <tuple>
23 #include <utility>
24 #include <vector>
25 
26 #include <gtest/gtest.h>
27 
28 #include <openssl/bytestring.h>
29 #include <openssl/curve25519.h>
30 #include <openssl/evp.h>
31 #include <openssl/mem.h>
32 #include <openssl/rand.h>
33 #include <openssl/trust_token.h>
34 
35 #include "../internal.h"
36 #include "internal.h"
37 
38 
39 BSSL_NAMESPACE_BEGIN
40 
41 namespace {
42 
TEST(TrustTokenTest,KeyGen)43 TEST(TrustTokenTest, KeyGen) {
44   uint8_t priv_key[TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE];
45   uint8_t pub_key[TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE];
46   size_t priv_key_len, pub_key_len;
47   ASSERT_TRUE(TRUST_TOKEN_generate_key(
48       priv_key, &priv_key_len, TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE, pub_key,
49       &pub_key_len, TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE, 0x0001));
50   ASSERT_EQ(400u, priv_key_len);
51   ASSERT_EQ(409u, pub_key_len);
52 }
53 
54 class TrustTokenProtocolTest : public ::testing::Test {
55  public:
56   // KeyID returns the key ID associated with key index |i|.
KeyID(size_t i)57   static uint32_t KeyID(size_t i) {
58     // Use a different value from the indices to that we do not mix them up.
59     return 7 + i;
60   }
61 
62  protected:
SetupContexts()63   void SetupContexts() {
64     client.reset(TRUST_TOKEN_CLIENT_new(client_max_batchsize));
65     ASSERT_TRUE(client);
66     issuer.reset(TRUST_TOKEN_ISSUER_new(issuer_max_batchsize));
67     ASSERT_TRUE(issuer);
68 
69     for (size_t i = 0; i < 3; i++) {
70       uint8_t priv_key[TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE];
71       uint8_t pub_key[TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE];
72       size_t priv_key_len, pub_key_len, key_index;
73       ASSERT_TRUE(TRUST_TOKEN_generate_key(
74           priv_key, &priv_key_len, TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE, pub_key,
75           &pub_key_len, TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE, KeyID(i)));
76       ASSERT_TRUE(TRUST_TOKEN_CLIENT_add_key(client.get(), &key_index, pub_key,
77                                              pub_key_len));
78       ASSERT_EQ(i, key_index);
79       ASSERT_TRUE(
80           TRUST_TOKEN_ISSUER_add_key(issuer.get(), priv_key, priv_key_len));
81     }
82 
83     uint8_t public_key[32], private_key[64];
84     ED25519_keypair(public_key, private_key);
85     bssl::UniquePtr<EVP_PKEY> priv(EVP_PKEY_new_raw_private_key(
86         EVP_PKEY_ED25519, nullptr, private_key, 32));
87     ASSERT_TRUE(priv);
88     bssl::UniquePtr<EVP_PKEY> pub(
89         EVP_PKEY_new_raw_public_key(EVP_PKEY_ED25519, nullptr, public_key, 32));
90     ASSERT_TRUE(pub);
91 
92     TRUST_TOKEN_CLIENT_set_srr_key(client.get(), pub.get());
93     TRUST_TOKEN_ISSUER_set_srr_key(issuer.get(), priv.get());
94     RAND_bytes(metadata_key, sizeof(metadata_key));
95     ASSERT_TRUE(TRUST_TOKEN_ISSUER_set_metadata_key(issuer.get(), metadata_key,
96                                                     sizeof(metadata_key)));
97   }
98 
99   uint16_t client_max_batchsize = 10;
100   uint16_t issuer_max_batchsize = 10;
101   bssl::UniquePtr<TRUST_TOKEN_CLIENT> client;
102   bssl::UniquePtr<TRUST_TOKEN_ISSUER> issuer;
103   uint8_t metadata_key[32];
104 };
105 
TEST_F(TrustTokenProtocolTest,InvalidToken)106 TEST_F(TrustTokenProtocolTest, InvalidToken) {
107   ASSERT_NO_FATAL_FAILURE(SetupContexts());
108 
109   uint8_t *issue_msg = NULL, *issue_resp = NULL;
110   size_t msg_len, resp_len;
111 
112   size_t key_index;
113   uint8_t tokens_issued;
114   ASSERT_TRUE(
115       TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg, &msg_len, 1));
116   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
117   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
118       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
119       /*public_metadata=*/KeyID(0), /*private_metadata=*/1,
120       /*max_issuance=*/10));
121   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
122   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
123       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, issue_resp,
124                                          resp_len));
125   ASSERT_TRUE(tokens);
126 
127   for (TRUST_TOKEN *token : tokens.get()) {
128     // Corrupt the token.
129     token->data[0] ^= 0x42;
130 
131     uint8_t *redeem_msg = NULL, *redeem_resp = NULL;
132     ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_redemption(
133         client.get(), &redeem_msg, &msg_len, token, NULL, 0, 0));
134     bssl::UniquePtr<uint8_t> free_redeem_msg(redeem_msg);
135     TRUST_TOKEN *rtoken;
136     uint8_t *client_data;
137     size_t client_data_len;
138     uint64_t redemption_time;
139     ASSERT_FALSE(TRUST_TOKEN_ISSUER_redeem(
140         issuer.get(), &redeem_resp, &resp_len, &rtoken, &client_data,
141         &client_data_len, &redemption_time, redeem_msg, msg_len, 600));
142     bssl::UniquePtr<uint8_t> free_redeem_resp(redeem_resp);
143   }
144 }
145 
TEST_F(TrustTokenProtocolTest,TruncatedIssuanceRequest)146 TEST_F(TrustTokenProtocolTest, TruncatedIssuanceRequest) {
147   ASSERT_NO_FATAL_FAILURE(SetupContexts());
148 
149   uint8_t *issue_msg = NULL, *issue_resp = NULL;
150   size_t msg_len, resp_len;
151   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
152                                                 &msg_len, 10));
153   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
154   msg_len = 10;
155   uint8_t tokens_issued;
156   ASSERT_FALSE(TRUST_TOKEN_ISSUER_issue(
157       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
158       /*public_metadata=*/KeyID(0), /*private_metadata=*/0,
159       /*max_issuance=*/10));
160   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
161 }
162 
TEST_F(TrustTokenProtocolTest,TruncatedIssuanceResponse)163 TEST_F(TrustTokenProtocolTest, TruncatedIssuanceResponse) {
164   ASSERT_NO_FATAL_FAILURE(SetupContexts());
165 
166   uint8_t *issue_msg = NULL, *issue_resp = NULL;
167   size_t msg_len, resp_len;
168   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
169                                                 &msg_len, 10));
170   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
171   uint8_t tokens_issued;
172   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
173       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
174       /*public_metadata=*/KeyID(0), /*private_metadata=*/0,
175       /*max_issuance=*/10));
176   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
177   resp_len = 10;
178   size_t key_index;
179   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
180       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, issue_resp,
181                                          resp_len));
182   ASSERT_FALSE(tokens);
183 }
184 
TEST_F(TrustTokenProtocolTest,ExtraDataIssuanceResponse)185 TEST_F(TrustTokenProtocolTest, ExtraDataIssuanceResponse) {
186   ASSERT_NO_FATAL_FAILURE(SetupContexts());
187 
188   uint8_t *request = NULL, *response = NULL;
189   size_t request_len, response_len;
190   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &request,
191                                                 &request_len, 10));
192   bssl::UniquePtr<uint8_t> free_request(request);
193   uint8_t tokens_issued;
194   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(issuer.get(), &response, &response_len,
195                                        &tokens_issued, request, request_len,
196                                        /*public_metadata=*/KeyID(0),
197                                        /*private_metadata=*/0,
198                                        /*max_issuance=*/10));
199   bssl::UniquePtr<uint8_t> free_response(response);
200   std::vector<uint8_t> response2(response, response + response_len);
201   response2.push_back(0);
202   size_t key_index;
203   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
204       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index,
205                                          response2.data(), response2.size()));
206   ASSERT_FALSE(tokens);
207 }
208 
TEST_F(TrustTokenProtocolTest,TruncatedRedemptionRequest)209 TEST_F(TrustTokenProtocolTest, TruncatedRedemptionRequest) {
210   ASSERT_NO_FATAL_FAILURE(SetupContexts());
211 
212   uint8_t *issue_msg = NULL, *issue_resp = NULL;
213   size_t msg_len, resp_len;
214   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
215                                                 &msg_len, 10));
216   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
217   uint8_t tokens_issued;
218   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
219       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
220       /*public_metadata=*/KeyID(0), /*private_metadata=*/0,
221       /*max_issuance=*/10));
222   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
223   size_t key_index;
224   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
225       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, issue_resp,
226                                          resp_len));
227   ASSERT_TRUE(tokens);
228 
229   for (TRUST_TOKEN *token : tokens.get()) {
230     const uint8_t kClientData[] = "\x70TEST CLIENT DATA";
231     uint64_t kRedemptionTime = 13374242;
232 
233     uint8_t *redeem_msg = NULL, *redeem_resp = NULL;
234     ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_redemption(
235         client.get(), &redeem_msg, &msg_len, token, kClientData,
236         sizeof(kClientData) - 1, kRedemptionTime));
237     bssl::UniquePtr<uint8_t> free_redeem_msg(redeem_msg);
238     msg_len = 10;
239 
240     TRUST_TOKEN *rtoken;
241     uint8_t *client_data;
242     size_t client_data_len;
243     uint64_t redemption_time;
244     ASSERT_FALSE(TRUST_TOKEN_ISSUER_redeem(
245         issuer.get(), &redeem_resp, &resp_len, &rtoken, &client_data,
246         &client_data_len, &redemption_time, redeem_msg, msg_len, 600));
247   }
248 }
249 
TEST_F(TrustTokenProtocolTest,TruncatedRedemptionResponse)250 TEST_F(TrustTokenProtocolTest, TruncatedRedemptionResponse) {
251   ASSERT_NO_FATAL_FAILURE(SetupContexts());
252 
253   uint8_t *issue_msg = NULL, *issue_resp = NULL;
254   size_t msg_len, resp_len;
255   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
256                                                 &msg_len, 10));
257   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
258   uint8_t tokens_issued;
259   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
260       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
261       /*public_metadata=*/KeyID(0), /*private_metadata=*/0,
262       /*max_issuance=*/10));
263   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
264   size_t key_index;
265   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
266       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, issue_resp,
267                                          resp_len));
268   ASSERT_TRUE(tokens);
269 
270   for (TRUST_TOKEN *token : tokens.get()) {
271     const uint8_t kClientData[] = "\x70TEST CLIENT DATA";
272     uint64_t kRedemptionTime = 13374242;
273 
274     uint8_t *redeem_msg = NULL, *redeem_resp = NULL;
275     ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_redemption(
276         client.get(), &redeem_msg, &msg_len, token, kClientData,
277         sizeof(kClientData) - 1, kRedemptionTime));
278     bssl::UniquePtr<uint8_t> free_redeem_msg(redeem_msg);
279     TRUST_TOKEN *rtoken;
280     uint8_t *client_data;
281     size_t client_data_len;
282     uint64_t redemption_time;
283     ASSERT_TRUE(TRUST_TOKEN_ISSUER_redeem(
284         issuer.get(), &redeem_resp, &resp_len, &rtoken, &client_data,
285         &client_data_len, &redemption_time, redeem_msg, msg_len, 600));
286     bssl::UniquePtr<uint8_t> free_redeem_resp(redeem_resp);
287     bssl::UniquePtr<uint8_t> free_client_data(client_data);
288     bssl::UniquePtr<TRUST_TOKEN> free_rtoken(rtoken);
289 
290     ASSERT_EQ(redemption_time, kRedemptionTime);
291     ASSERT_TRUE(sizeof(kClientData) - 1 == client_data_len);
292     ASSERT_EQ(OPENSSL_memcmp(kClientData, client_data, client_data_len), 0);
293     resp_len = 10;
294 
295     uint8_t *srr = NULL, *sig = NULL;
296     size_t srr_len, sig_len;
297     ASSERT_FALSE(TRUST_TOKEN_CLIENT_finish_redemption(
298         client.get(), &srr, &srr_len, &sig, &sig_len, redeem_resp, resp_len));
299     bssl::UniquePtr<uint8_t> free_srr(srr);
300     bssl::UniquePtr<uint8_t> free_sig(sig);
301   }
302 }
303 
TEST_F(TrustTokenProtocolTest,IssuedWithBadKeyID)304 TEST_F(TrustTokenProtocolTest, IssuedWithBadKeyID) {
305   client.reset(TRUST_TOKEN_CLIENT_new(client_max_batchsize));
306   ASSERT_TRUE(client);
307   issuer.reset(TRUST_TOKEN_ISSUER_new(issuer_max_batchsize));
308   ASSERT_TRUE(issuer);
309 
310   // We configure the client and the issuer with different key IDs and test
311   // that the client notices.
312   const uint32_t kClientKeyID = 0;
313   const uint32_t kIssuerKeyID = 42;
314 
315   uint8_t priv_key[TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE];
316   uint8_t pub_key[TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE];
317   size_t priv_key_len, pub_key_len, key_index;
318   ASSERT_TRUE(TRUST_TOKEN_generate_key(
319       priv_key, &priv_key_len, TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE, pub_key,
320       &pub_key_len, TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE, kClientKeyID));
321   ASSERT_TRUE(TRUST_TOKEN_CLIENT_add_key(client.get(), &key_index, pub_key,
322                                          pub_key_len));
323   ASSERT_EQ(0UL, key_index);
324 
325   ASSERT_TRUE(TRUST_TOKEN_generate_key(
326       priv_key, &priv_key_len, TRUST_TOKEN_MAX_PRIVATE_KEY_SIZE, pub_key,
327       &pub_key_len, TRUST_TOKEN_MAX_PUBLIC_KEY_SIZE, kIssuerKeyID));
328   ASSERT_TRUE(TRUST_TOKEN_ISSUER_add_key(issuer.get(), priv_key, priv_key_len));
329 
330 
331   uint8_t public_key[32], private_key[64];
332   ED25519_keypair(public_key, private_key);
333   bssl::UniquePtr<EVP_PKEY> priv(
334       EVP_PKEY_new_raw_private_key(EVP_PKEY_ED25519, nullptr, private_key, 32));
335   ASSERT_TRUE(priv);
336   bssl::UniquePtr<EVP_PKEY> pub(
337       EVP_PKEY_new_raw_public_key(EVP_PKEY_ED25519, nullptr, public_key, 32));
338   ASSERT_TRUE(pub);
339 
340   TRUST_TOKEN_CLIENT_set_srr_key(client.get(), pub.get());
341   TRUST_TOKEN_ISSUER_set_srr_key(issuer.get(), priv.get());
342   RAND_bytes(metadata_key, sizeof(metadata_key));
343   ASSERT_TRUE(TRUST_TOKEN_ISSUER_set_metadata_key(issuer.get(), metadata_key,
344                                                   sizeof(metadata_key)));
345 
346 
347   uint8_t *issue_msg = NULL, *issue_resp = NULL;
348   size_t msg_len, resp_len;
349   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
350                                                 &msg_len, 10));
351   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
352   uint8_t tokens_issued;
353   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
354       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
355       /*public_metadata=*/42, /*private_metadata=*/0, /*max_issuance=*/10));
356   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
357   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
358       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, issue_resp,
359                                          resp_len));
360   ASSERT_FALSE(tokens);
361 }
362 
363 class TrustTokenMetadataTest
364     : public TrustTokenProtocolTest,
365       public testing::WithParamInterface<std::tuple<int, bool>> {};
366 
TEST_P(TrustTokenMetadataTest,SetAndGetMetadata)367 TEST_P(TrustTokenMetadataTest, SetAndGetMetadata) {
368   ASSERT_NO_FATAL_FAILURE(SetupContexts());
369 
370   uint8_t *issue_msg = NULL, *issue_resp = NULL;
371   size_t msg_len, resp_len;
372   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
373                                                 &msg_len, 10));
374   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
375   uint8_t tokens_issued;
376   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
377       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
378       std::get<0>(GetParam()), std::get<1>(GetParam()), /*max_issuance=*/1));
379   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
380   size_t key_index;
381   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
382       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, issue_resp,
383                                          resp_len));
384   ASSERT_TRUE(tokens);
385 
386   for (TRUST_TOKEN *token : tokens.get()) {
387     const uint8_t kClientData[] = "\x70TEST CLIENT DATA";
388     uint64_t kRedemptionTime = 13374242;
389 
390     const uint8_t kExpectedSRR[] =
391         "\xa3\x68\x6d\x65\x74\x61\x64\x61\x74\x61\xa2\x66\x70\x75\x62\x6c\x69"
392         "\x63\x00\x67\x70\x72\x69\x76\x61\x74\x65\x00\x6b\x63\x6c\x69\x65\x6e"
393         "\x74\x2d\x64\x61\x74\x61\x70\x54\x45\x53\x54\x20\x43\x4c\x49\x45\x4e"
394         "\x54\x20\x44\x41\x54\x41\x70\x65\x78\x70\x69\x72\x79\x2d\x74\x69\x6d"
395         "\x65\x73\x74\x61\x6d\x70\x1a\x00\xcc\x15\x7a";
396 
397     uint8_t *redeem_msg = NULL, *redeem_resp = NULL;
398     ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_redemption(
399         client.get(), &redeem_msg, &msg_len, token, kClientData,
400         sizeof(kClientData) - 1, kRedemptionTime));
401     bssl::UniquePtr<uint8_t> free_redeem_msg(redeem_msg);
402     TRUST_TOKEN *rtoken;
403     uint8_t *client_data;
404     size_t client_data_len;
405     uint64_t redemption_time;
406     ASSERT_TRUE(TRUST_TOKEN_ISSUER_redeem(
407         issuer.get(), &redeem_resp, &resp_len, &rtoken, &client_data,
408         &client_data_len, &redemption_time, redeem_msg, msg_len, 600));
409     bssl::UniquePtr<uint8_t> free_redeem_resp(redeem_resp);
410     bssl::UniquePtr<uint8_t> free_client_data(client_data);
411     bssl::UniquePtr<TRUST_TOKEN> free_rtoken(rtoken);
412 
413     ASSERT_EQ(redemption_time, kRedemptionTime);
414     ASSERT_TRUE(sizeof(kClientData) - 1 == client_data_len);
415     ASSERT_EQ(OPENSSL_memcmp(kClientData, client_data, client_data_len), 0);
416 
417     uint8_t *srr = NULL, *sig = NULL;
418     size_t srr_len, sig_len;
419     ASSERT_TRUE(TRUST_TOKEN_CLIENT_finish_redemption(
420         client.get(), &srr, &srr_len, &sig, &sig_len, redeem_resp, resp_len));
421     bssl::UniquePtr<uint8_t> free_srr(srr);
422     bssl::UniquePtr<uint8_t> free_sig(sig);
423 
424     uint8_t private_metadata;
425     ASSERT_TRUE(TRUST_TOKEN_decode_private_metadata(
426         &private_metadata, metadata_key, sizeof(metadata_key), kClientData,
427         sizeof(kClientData) - 1, srr[27]));
428     ASSERT_EQ(srr[18], std::get<0>(GetParam()));
429     ASSERT_EQ(private_metadata, std::get<1>(GetParam()));
430 
431     // Clear out the metadata bits.
432     srr[18] = 0;
433     srr[27] = 0;
434 
435     ASSERT_TRUE(sizeof(kExpectedSRR) - 1 == srr_len);
436     ASSERT_EQ(OPENSSL_memcmp(kExpectedSRR, srr, srr_len), 0);
437   }
438 }
439 
TEST_P(TrustTokenMetadataTest,TooManyRequests)440 TEST_P(TrustTokenMetadataTest, TooManyRequests) {
441   issuer_max_batchsize = 1;
442   ASSERT_NO_FATAL_FAILURE(SetupContexts());
443 
444   uint8_t *issue_msg = NULL, *issue_resp = NULL;
445   size_t msg_len, resp_len;
446   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
447                                                 &msg_len, 10));
448   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
449   uint8_t tokens_issued;
450   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
451       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
452       std::get<0>(GetParam()), std::get<1>(GetParam()), /*max_issuance=*/1));
453   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
454   ASSERT_EQ(tokens_issued, issuer_max_batchsize);
455   size_t key_index;
456   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
457       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, issue_resp,
458                                          resp_len));
459   ASSERT_TRUE(tokens);
460   ASSERT_EQ(sk_TRUST_TOKEN_num(tokens.get()), 1UL);
461 }
462 
463 
TEST_P(TrustTokenMetadataTest,TruncatedProof)464 TEST_P(TrustTokenMetadataTest, TruncatedProof) {
465   ASSERT_NO_FATAL_FAILURE(SetupContexts());
466 
467   uint8_t *issue_msg = NULL, *issue_resp = NULL;
468   size_t msg_len, resp_len;
469   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
470                                                 &msg_len, 10));
471   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
472   uint8_t tokens_issued;
473   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
474       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
475       std::get<0>(GetParam()), std::get<1>(GetParam()), /*max_issuance=*/1));
476   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
477 
478   CBS real_response;
479   CBS_init(&real_response, issue_resp, resp_len);
480   uint16_t count;
481   uint32_t public_metadata;
482   bssl::ScopedCBB bad_response;
483   ASSERT_TRUE(CBB_init(bad_response.get(), 0));
484   ASSERT_TRUE(CBS_get_u16(&real_response, &count));
485   ASSERT_TRUE(CBB_add_u16(bad_response.get(), count));
486   ASSERT_TRUE(CBS_get_u32(&real_response, &public_metadata));
487   ASSERT_TRUE(CBB_add_u32(bad_response.get(), public_metadata));
488 
489   for (size_t i = 0; i < count; i++) {
490     uint8_t s[PMBTOKEN_NONCE_SIZE];
491     CBS tmp;
492     ASSERT_TRUE(CBS_copy_bytes(&real_response, s, PMBTOKEN_NONCE_SIZE));
493     ASSERT_TRUE(CBB_add_bytes(bad_response.get(), s, PMBTOKEN_NONCE_SIZE));
494     ASSERT_TRUE(CBS_get_u16_length_prefixed(&real_response, &tmp));
495     ASSERT_TRUE(CBB_add_u16(bad_response.get(), CBS_len(&tmp)));
496     ASSERT_TRUE(
497         CBB_add_bytes(bad_response.get(), CBS_data(&tmp), CBS_len(&tmp)));
498     ASSERT_TRUE(CBS_get_u16_length_prefixed(&real_response, &tmp));
499     ASSERT_TRUE(CBB_add_u16(bad_response.get(), CBS_len(&tmp)));
500     ASSERT_TRUE(
501         CBB_add_bytes(bad_response.get(), CBS_data(&tmp), CBS_len(&tmp)));
502     ASSERT_TRUE(CBS_get_u16_length_prefixed(&real_response, &tmp));
503     ASSERT_TRUE(CBB_add_u16(bad_response.get(), CBS_len(&tmp) - 2));
504     ASSERT_TRUE(
505         CBB_add_bytes(bad_response.get(), CBS_data(&tmp), CBS_len(&tmp) - 2));
506   }
507 
508   uint8_t *bad_buf;
509   size_t bad_len;
510   ASSERT_TRUE(CBB_finish(bad_response.get(), &bad_buf, &bad_len));
511   bssl::UniquePtr<uint8_t> free_bad(bad_buf);
512 
513   size_t key_index;
514   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
515       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, bad_buf, bad_len));
516   ASSERT_FALSE(tokens);
517 }
518 
TEST_P(TrustTokenMetadataTest,ExcessDataProof)519 TEST_P(TrustTokenMetadataTest, ExcessDataProof) {
520   ASSERT_NO_FATAL_FAILURE(SetupContexts());
521 
522   uint8_t *issue_msg = NULL, *issue_resp = NULL;
523   size_t msg_len, resp_len;
524   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
525                                                 &msg_len, 10));
526   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
527   uint8_t tokens_issued;
528   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
529       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
530       std::get<0>(GetParam()), std::get<1>(GetParam()), /*max_issuance=*/1));
531   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
532 
533   CBS real_response;
534   CBS_init(&real_response, issue_resp, resp_len);
535   uint16_t count;
536   uint32_t public_metadata;
537   bssl::ScopedCBB bad_response;
538   ASSERT_TRUE(CBB_init(bad_response.get(), 0));
539   ASSERT_TRUE(CBS_get_u16(&real_response, &count));
540   ASSERT_TRUE(CBB_add_u16(bad_response.get(), count));
541   ASSERT_TRUE(CBS_get_u32(&real_response, &public_metadata));
542   ASSERT_TRUE(CBB_add_u32(bad_response.get(), public_metadata));
543 
544   for (size_t i = 0; i < count; i++) {
545     uint8_t s[PMBTOKEN_NONCE_SIZE];
546     CBS tmp;
547     ASSERT_TRUE(CBS_copy_bytes(&real_response, s, PMBTOKEN_NONCE_SIZE));
548     ASSERT_TRUE(CBB_add_bytes(bad_response.get(), s, PMBTOKEN_NONCE_SIZE));
549     ASSERT_TRUE(CBS_get_u16_length_prefixed(&real_response, &tmp));
550     ASSERT_TRUE(CBB_add_u16(bad_response.get(), CBS_len(&tmp)));
551     ASSERT_TRUE(
552         CBB_add_bytes(bad_response.get(), CBS_data(&tmp), CBS_len(&tmp)));
553     ASSERT_TRUE(CBS_get_u16_length_prefixed(&real_response, &tmp));
554     ASSERT_TRUE(CBB_add_u16(bad_response.get(), CBS_len(&tmp)));
555     ASSERT_TRUE(
556         CBB_add_bytes(bad_response.get(), CBS_data(&tmp), CBS_len(&tmp)));
557     ASSERT_TRUE(CBS_get_u16_length_prefixed(&real_response, &tmp));
558     ASSERT_TRUE(CBB_add_u16(bad_response.get(), CBS_len(&tmp) + 2));
559     ASSERT_TRUE(
560         CBB_add_bytes(bad_response.get(), CBS_data(&tmp), CBS_len(&tmp)));
561     ASSERT_TRUE(CBB_add_u16(bad_response.get(), 42));
562   }
563 
564   uint8_t *bad_buf;
565   size_t bad_len;
566   ASSERT_TRUE(CBB_finish(bad_response.get(), &bad_buf, &bad_len));
567   bssl::UniquePtr<uint8_t> free_bad(bad_buf);
568 
569   size_t key_index;
570   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
571       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, bad_buf,
572                                          bad_len));
573   ASSERT_FALSE(tokens);
574 }
575 
576 INSTANTIATE_TEST_SUITE_P(
577     TrustTokenAllMetadataTest, TrustTokenMetadataTest,
578     testing::Combine(testing::Values(TrustTokenProtocolTest::KeyID(0),
579                                      TrustTokenProtocolTest::KeyID(1),
580                                      TrustTokenProtocolTest::KeyID(2)),
581                      testing::Bool()));
582 
583 
584 class TrustTokenBadKeyTest
585     : public TrustTokenProtocolTest,
586       public testing::WithParamInterface<std::tuple<bool, int>> {};
587 
TEST_P(TrustTokenBadKeyTest,BadKey)588 TEST_P(TrustTokenBadKeyTest, BadKey) {
589   ASSERT_NO_FATAL_FAILURE(SetupContexts());
590 
591   uint8_t *issue_msg = NULL, *issue_resp = NULL;
592   size_t msg_len, resp_len;
593   ASSERT_TRUE(TRUST_TOKEN_CLIENT_begin_issuance(client.get(), &issue_msg,
594                                                 &msg_len, 10));
595   bssl::UniquePtr<uint8_t> free_issue_msg(issue_msg);
596 
597   struct trust_token_issuer_key_st *key = &issuer->keys[0];
598   EC_SCALAR *scalars[] = {&key->x0, &key->y0, &key->x1,
599                           &key->y1, &key->xs, &key->ys};
600   int corrupted_key = std::get<1>(GetParam());
601 
602   // Corrupt private key scalar.
603   scalars[corrupted_key]->bytes[0] ^= 42;
604 
605   uint8_t tokens_issued;
606   ASSERT_TRUE(TRUST_TOKEN_ISSUER_issue(
607       issuer.get(), &issue_resp, &resp_len, &tokens_issued, issue_msg, msg_len,
608       /*public_metadata=*/7, std::get<0>(GetParam()), /*max_issuance=*/1));
609   bssl::UniquePtr<uint8_t> free_msg(issue_resp);
610   size_t key_index;
611   bssl::UniquePtr<STACK_OF(TRUST_TOKEN)> tokens(
612       TRUST_TOKEN_CLIENT_finish_issuance(client.get(), &key_index, issue_resp,
613                                          resp_len));
614 
615   // If the unused private key is corrupted, then the DLEQ proof should succeed.
616   if ((corrupted_key / 2 == 0 && std::get<0>(GetParam()) == true) ||
617       (corrupted_key / 2 == 1 && std::get<0>(GetParam()) == false)) {
618     ASSERT_TRUE(tokens);
619   } else {
620     ASSERT_FALSE(tokens);
621   }
622 }
623 
624 INSTANTIATE_TEST_SUITE_P(
625     TrustTokenAllBadKeyTest, TrustTokenBadKeyTest,
626     testing::Combine(testing::Bool(),
627                      testing::Values(0, 1, 2, 3, 4, 5)));
628 
629 }  // namespace
630 BSSL_NAMESPACE_END
631