WebCrypto: Check that the key can be used for given operation.

Source/modules/crypto/SubtleCrypto.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 22 matching lines @@
 
 #include "bindings/v8/ExceptionState.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/platform/NotImplemented.h"
 #include "modules/crypto/CryptoOperation.h"
 #include "modules/crypto/Key.h"
 #include "modules/crypto/KeyOperation.h"
 #include "modules/crypto/NormalizeAlgorithm.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCrypto.h"
+#include "public/platform/WebCryptoAlgorithmParams.h"
 #include "wtf/ArrayBufferView.h"
 
 namespace WebCore {
 
 // FIXME: Outstanding KeyOperations and CryptoOperations should be aborted when
 // tearing down SubtleCrypto (to avoid problems completing a
 // ScriptPromiseResolver which is no longer valid).
 
 namespace {
 
-bool keyCanBeUsedForAlgorithm(const WebKit::WebCryptoKey& key, const WebKit::WebCryptoAlgorithm& algorithm, ExceptionState& es)
+WebKit::WebCryptoKeyUsageMask toKeyUsage(AlgorithmOperation operation)
 {
-    // FIXME: Need to enforce that the key's algorithm matches the operation,
-    // and that the key's usages allow it to be used with this operation.
-    notImplemented();
-    return true;
+    switch (operation) {
+    case Encrypt:
+        return WebKit::WebCryptoKeyUsageEncrypt;
+    case Decrypt:
+        return WebKit::WebCryptoKeyUsageDecrypt;
+    case Sign:
+        return WebKit::WebCryptoKeyUsageSign;
+    case Verify:
+        return WebKit::WebCryptoKeyUsageVerify;
+    case DeriveKey:
+        return WebKit::WebCryptoKeyUsageDeriveKey;
+    case WrapKey:
+        return WebKit::WebCryptoKeyUsageWrapKey;
+    case UnwrapKey:
+        return WebKit::WebCryptoKeyUsageUnwrapKey;
+    case Digest:
+    case GenerateKey:
+    case ImportKey:
+    case NumberOfAlgorithmOperations:
+        break;
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+bool keyCanBeUsedForAlgorithm(const WebKit::WebCryptoKey& key, const WebKit::WebCryptoAlgorithm& algorithm, AlgorithmOperation op)
+{
+    if (!(key.usages() & toKeyUsage(op)))
+        return false;
+
+    if (key.algorithm().id() != algorithm.id())
+        return false;
+
+    if (key.algorithm().paramsType() == WebKit::WebCryptoAlgorithmParamsTypeNone)
+        return true;
+
+    // Verify that the algorithm-specific parameters for the key conform to the
+    // algorithm.
+
+    if (key.algorithm().paramsType() == WebKit::WebCryptoAlgorithmParamsTypeHmacParams) {
+        return key.algorithm().hmacParams()->hash().id() == algorithm.hmacParams()->hash().id();
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
 }
 
 PassRefPtr<CryptoOperation> createCryptoOperation(const Dictionary& rawAlgorithm, Key* key, AlgorithmOperation operationType, ExceptionState& es)
 {
     WebKit::WebCrypto* platformCrypto = WebKit::Platform::current()->crypto();
     if (!platformCrypto) {
         es.throwDOMException(NotSupportedError);
         return 0;
     }
 
     WebKit::WebCryptoAlgorithm algorithm;
     if (!normalizeAlgorithm(rawAlgorithm, operationType, algorithm, es))
         return 0;
 
     // All operations other than Digest require a valid Key.
     if (operationType != Digest) {
         if (!key) {
             es.throwDOMException(TypeError);
             return 0;
         }
 
-        if (!keyCanBeUsedForAlgorithm(key->key(), algorithm, es)) {
+        if (!keyCanBeUsedForAlgorithm(key->key(), algorithm, operationType)) {
+            es.throwDOMException(NotSupportedError);
             return 0;
         }
     }
 
     RefPtr<CryptoOperationImpl> opImpl = CryptoOperationImpl::create();
     WebKit::WebCryptoOperationResult result(opImpl.get());
 
     switch (operationType) {
     case Encrypt:
         platformCrypto->encrypt(algorithm, key->key(), result);
@@ skipping 81 matching lines @@
 
     const unsigned char* keyDataBytes = static_cast<unsigned char*>(keyData->baseAddress());
 
     RefPtr<KeyOperation> keyOp = KeyOperation::create();
     WebKit::WebCryptoKeyOperationResult result(keyOp.get());
     platformCrypto->importKey(format, keyDataBytes, keyData->byteLength(), algorithm, extractable, keyUsages, result);
     return keyOp->returnValue(es);
 }
 
 } // namespace WebCore