src/crypto/rsa/boring_test.go

   1 // Copyright 2017 The Go Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style
   3 // license that can be found in the LICENSE file.
   4
   5 // Note: Can run these tests against the non-BoringCrypto
   6 // version of the code by using "CGO_ENABLED=0 go test".
   7
   8 package rsa
   9
  10 import (
  11         "crypto"
  12         "crypto/rand"
  13         "encoding/asn1"
  14         "reflect"
  15         "runtime"
  16         "runtime/debug"
  17         "sync"
  18         "sync/atomic"
  19         "testing"
  20         "unsafe"
  21 )
  22
  23 func TestBoringASN1Marshal(t *testing.T) {
  24         k, err := GenerateKey(rand.Reader, 128)
  25         if err != nil {
  26                 t.Fatal(err)
  27         }
  28         // This used to fail, because of the unexported 'boring' field.
  29         // Now the compiler hides it [sic].
  30         _, err = asn1.Marshal(k.PublicKey)
  31         if err != nil {
  32                 t.Fatal(err)
  33         }
  34 }
  35
  36 func TestBoringDeepEqual(t *testing.T) {
  37         k, err := GenerateKey(rand.Reader, 128)
  38         if err != nil {
  39                 t.Fatal(err)
  40         }
  41         k.boring = nil // probably nil already but just in case
  42         k2 := *k
  43         k2.boring = unsafe.Pointer(k) // anything not nil, for this test
  44         if !reflect.DeepEqual(k, &k2) {
  45                 // compiler should be hiding the boring field from reflection
  46                 t.Fatalf("DeepEqual compared boring fields")
  47         }
  48 }
  49
  50 func TestBoringVerify(t *testing.T) {
  51         // This changed behavior and broke golang.org/x/crypto/openpgp.
  52         // Go accepts signatures without leading 0 padding, while BoringCrypto does not.
  53         // So the Go wrappers must adapt.
  54         key := &PublicKey{
  55                 N: bigFromHex("c4fdf7b40a5477f206e6ee278eaef888ca73bf9128a9eef9f2f1ddb8b7b71a4c07cfa241f028a04edb405e4d916c61d6beabc333813dc7b484d2b3c52ee233c6a79b1eea4e9cc51596ba9cd5ac5aeb9df62d86ea051055b79d03f8a4fa9f38386f5bd17529138f3325d46801514ea9047977e0829ed728e68636802796801be1"),
  56                 E: 65537,
  57         }
  58
  59         hash := fromHex("019c5571724fb5d0e47a4260c940e9803ba05a44")
  60         paddedHash := fromHex("3021300906052b0e03021a05000414019c5571724fb5d0e47a4260c940e9803ba05a44")
  61
  62         // signature is one byte shorter than key.N.
  63         sig := fromHex("5edfbeb6a73e7225ad3cc52724e2872e04260d7daf0d693c170d8c4b243b8767bc7785763533febc62ec2600c30603c433c095453ede59ff2fcabeb84ce32e0ed9d5cf15ffcbc816202b64370d4d77c1e9077d74e94a16fb4fa2e5bec23a56d7a73cf275f91691ae1801a976fcde09e981a2f6327ac27ea1fecf3185df0d56")
  64
  65         err := VerifyPKCS1v15(key, 0, paddedHash, sig)
  66         if err != nil {
  67                 t.Errorf("raw: %v", err)
  68         }
  69
  70         err = VerifyPKCS1v15(key, crypto.SHA1, hash, sig)
  71         if err != nil {
  72                 t.Errorf("sha1: %v", err)
  73         }
  74 }
  75
  76 func TestBoringGenerateKey(t *testing.T) {
  77         k, err := GenerateKey(rand.Reader, 2048) // 2048 is smallest size BoringCrypto might kick in for
  78         if err != nil {
  79                 t.Fatal(err)
  80         }
  81
  82         // Non-Boring GenerateKey always sets CRTValues to a non-nil (possibly empty) slice.
  83         if k.Precomputed.CRTValues == nil {
  84                 t.Fatalf("GenerateKey: Precomputed.CRTValues = nil")
  85         }
  86 }
  87
  88 func TestBoringFinalizers(t *testing.T) {
  89         if runtime.GOOS == "nacl" {
  90                 // Times out on nacl (without BoringCrypto)
  91                 // but not clear why - probably consuming rand.Reader too quickly
  92                 // and being throttled. Also doesn't really matter.
  93                 t.Skip("skipping on nacl")
  94         }
  95
  96         k, err := GenerateKey(rand.Reader, 2048)
  97         if err != nil {
  98                 t.Fatal(err)
  99         }
 100
 101         // Run test with GOGC=10, to make bug more likely.
 102         // Without the KeepAlives, the loop usually dies after
 103         // about 30 iterations.
 104         defer debug.SetGCPercent(debug.SetGCPercent(10))
 105         for n := 0; n < 200; n++ {
 106                 // Clear the underlying BoringCrypto object.
 107                 atomic.StorePointer(&k.boring, nil)
 108
 109                 // Race to create the underlying BoringCrypto object.
 110                 // The ones that lose the race are prime candidates for
 111                 // being GC'ed too early if the finalizers are not being
 112                 // used correctly.
 113                 var wg sync.WaitGroup
 114                 for i := 0; i < 10; i++ {
 115                         wg.Add(1)
 116                         go func() {
 117                                 defer wg.Done()
 118                                 sum := make([]byte, 32)
 119                                 _, err := SignPKCS1v15(rand.Reader, k, crypto.SHA256, sum)
 120                                 if err != nil {
 121                                         panic(err) // usually caused by memory corruption, so hard stop
 122                                 }
 123                         }()
 124                 }
 125                 wg.Wait()
 126         }
 127 }