1 // Copyright 2019 Google LLC
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 //
15 ////////////////////////////////////////////////////////////////////////////////
16
17 #include "tink/aead/kms_aead_key_manager.h"
18
19 #include <stdlib.h>
20
21 #include <memory>
22 #include <string>
23
24 #include "gmock/gmock.h"
25 #include "gtest/gtest.h"
26 #include "absl/memory/memory.h"
27 #include "absl/status/status.h"
28 #include "tink/aead.h"
29 #include "tink/kms_client.h"
30 #include "tink/kms_clients.h"
31 #include "tink/subtle/aead_test_util.h"
32 #include "tink/util/status.h"
33 #include "tink/util/statusor.h"
34 #include "tink/util/test_matchers.h"
35 #include "tink/util/test_util.h"
36 #include "proto/kms_aead.pb.h"
37 #include "proto/tink.pb.h"
38
39 namespace crypto {
40 namespace tink {
41
42 using ::crypto::tink::test::DummyAead;
43 using ::crypto::tink::test::DummyKmsClient;
44 using ::crypto::tink::test::IsOk;
45 using ::crypto::tink::test::StatusIs;
46 using ::google::crypto::tink::KmsAeadKey;
47 using ::google::crypto::tink::KmsAeadKeyFormat;
48 using ::testing::Eq;
49 using ::testing::Not;
50
51 namespace {
52
TEST(KmsAeadKeyManagerTest,Basics)53 TEST(KmsAeadKeyManagerTest, Basics) {
54 EXPECT_THAT(KmsAeadKeyManager().get_version(), Eq(0));
55 EXPECT_THAT(KmsAeadKeyManager().get_key_type(),
56 Eq("type.googleapis.com/google.crypto.tink.KmsAeadKey"));
57 EXPECT_THAT(KmsAeadKeyManager().key_material_type(),
58 Eq(google::crypto::tink::KeyData::REMOTE));
59 }
60
TEST(KmsAeadKeyManagerTest,ValidateEmptyKey)61 TEST(KmsAeadKeyManagerTest, ValidateEmptyKey) {
62 EXPECT_THAT(KmsAeadKeyManager().ValidateKey(KmsAeadKey()),
63 StatusIs(absl::StatusCode::kInvalidArgument));
64 }
65
TEST(KmsAeadKeyManagerTest,ValidateValidKey)66 TEST(KmsAeadKeyManagerTest, ValidateValidKey) {
67 KmsAeadKey key;
68 key.set_version(0);
69 key.mutable_params()->set_key_uri("Some uri");
70 EXPECT_THAT(KmsAeadKeyManager().ValidateKey(key), IsOk());
71 }
72
TEST(KmsAeadKeyManagerTest,ValidateWrongVersion)73 TEST(KmsAeadKeyManagerTest, ValidateWrongVersion) {
74 KmsAeadKey key;
75 key.set_version(1);
76 key.mutable_params()->set_key_uri("Some uri");
77 EXPECT_THAT(KmsAeadKeyManager().ValidateKey(key), Not(IsOk()));
78 }
79
TEST(KmsAeadKeyManagerTest,ValidateNoUri)80 TEST(KmsAeadKeyManagerTest, ValidateNoUri) {
81 KmsAeadKey key;
82 key.set_version(0);
83 EXPECT_THAT(KmsAeadKeyManager().ValidateKey(key), Not(IsOk()));
84 }
85
TEST(KmsAeadKeyManagerTest,ValidateKeyFormatEmptyKey)86 TEST(KmsAeadKeyManagerTest, ValidateKeyFormatEmptyKey) {
87 EXPECT_THAT(KmsAeadKeyManager().ValidateKeyFormat(KmsAeadKeyFormat()),
88 StatusIs(absl::StatusCode::kInvalidArgument));
89 }
90
TEST(KmsAeadKeyManagerTest,ValidateKeyFormatValidKey)91 TEST(KmsAeadKeyManagerTest, ValidateKeyFormatValidKey) {
92 KmsAeadKeyFormat key_format;
93 key_format.set_key_uri("Some uri");
94 EXPECT_THAT(KmsAeadKeyManager().ValidateKeyFormat(key_format), IsOk());
95 }
96
TEST(KmsAeadKeyManagerTest,ValidateKeyFormatNoUri)97 TEST(KmsAeadKeyManagerTest, ValidateKeyFormatNoUri) {
98 KmsAeadKeyFormat key_format;
99 EXPECT_THAT(KmsAeadKeyManager().ValidateKeyFormat(key_format), Not(IsOk()));
100 }
101
TEST(KmsAeadKeyManagerTest,CreateKey)102 TEST(KmsAeadKeyManagerTest, CreateKey) {
103 KmsAeadKeyFormat key_format;
104 key_format.set_key_uri("Some uri");
105 auto key_or = KmsAeadKeyManager().CreateKey(key_format);
106 ASSERT_THAT(key_or, IsOk());
107 EXPECT_THAT(key_or.value().params().key_uri(), Eq(key_format.key_uri()));
108 }
109
110 class KmsAeadKeyManagerCreateTest : public ::testing::Test {
111 public:
112 // The KmsClients class has a global variable which keeps the registered
113 // clients. To reflect that in the test, we set them up in the SetUpTestSuite
114 // function.
SetUpTestSuite()115 static void SetUpTestSuite() {
116 if (!KmsClients::Add(
117 absl::make_unique<DummyKmsClient>("prefix1", "prefix1:some_key1"))
118 .ok())
119 abort();
120 if (!KmsClients::Add(absl::make_unique<DummyKmsClient>("prefix2", "")).ok())
121 abort();
122 }
123 };
124
TEST_F(KmsAeadKeyManagerCreateTest,CreateAead)125 TEST_F(KmsAeadKeyManagerCreateTest, CreateAead) {
126 KmsAeadKey key;
127 key.set_version(0);
128 key.mutable_params()->set_key_uri("prefix1:some_key1");
129
130 auto kms_aead = KmsAeadKeyManager().GetPrimitive<Aead>(key);
131 ASSERT_THAT(kms_aead, IsOk());
132
133 DummyAead direct_aead("prefix1:some_key1");
134
135 EXPECT_THAT(
136 EncryptThenDecrypt(*kms_aead.value(), direct_aead, "plaintext", "aad"),
137 IsOk());
138 }
139
TEST_F(KmsAeadKeyManagerCreateTest,CreateAeadWrongKeyName)140 TEST_F(KmsAeadKeyManagerCreateTest, CreateAeadWrongKeyName) {
141 KmsAeadKey key;
142 key.set_version(0);
143 key.mutable_params()->set_key_uri("prefix1:some_other_key");
144
145 auto kms_aead = KmsAeadKeyManager().GetPrimitive<Aead>(key);
146 ASSERT_THAT(kms_aead, Not(IsOk()));
147 }
148
TEST_F(KmsAeadKeyManagerCreateTest,CreateAeadWrongPrefix)149 TEST_F(KmsAeadKeyManagerCreateTest, CreateAeadWrongPrefix) {
150 KmsAeadKey key;
151 key.set_version(0);
152 key.mutable_params()->set_key_uri("non-existing-prefix:some_key1");
153
154 auto kms_aead = KmsAeadKeyManager().GetPrimitive<Aead>(key);
155 ASSERT_THAT(kms_aead, Not(IsOk()));
156 }
157
TEST_F(KmsAeadKeyManagerCreateTest,CreateAeadUnboundKey)158 TEST_F(KmsAeadKeyManagerCreateTest, CreateAeadUnboundKey) {
159 KmsAeadKey key;
160 key.set_version(0);
161 key.mutable_params()->set_key_uri("prefix2:some_key2");
162
163 auto kms_aead = KmsAeadKeyManager().GetPrimitive<Aead>(key);
164 ASSERT_THAT(kms_aead, IsOk());
165
166 DummyAead direct_aead("prefix2:some_key2");
167
168 EXPECT_THAT(
169 EncryptThenDecrypt(*kms_aead.value(), direct_aead, "plaintext", "aad"),
170 IsOk());
171 }
172
173 } // namespace
174 } // namespace tink
175 } // namespace crypto
176