go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-08-08 22:46:33 +02:00
Code Issues Releases Activity

Move Encrypt/Decrypt Into helper to session_state.go

Browse Source 
This helper method is only applicable for Base64 wrapped
encryption since it operated on string -> string primarily.
It wouldn't be used for pure CFB/GCM ciphers. After a messagePack
session refactor, this method would further only be used for
legacy session compatibility - making its placement in cipher.go
not ideal.
This commit is contained in:
Nick Meves
2020-06-04 14:39:31 -07:00
parent 014fa682be
commit 1979627534
4 changed files with 105 additions and 169 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
pkg/encryption/cipher_test.go
View File

@ -5,7 +5,6 @@ import (
"encoding/base64"
"fmt"
"io"
mathrand "math/rand"
"testing"
"github.com/stretchr/testify/assert"
@ -118,80 +117,6 @@ func runEncryptAndDecrypt(t *testing.T, c Cipher, dataSize int) {
assert.NotEqual(t, encrypted, decrypted)
}
func TestEncryptIntoAndDecryptInto(t *testing.T) {
// Test our 2 cipher types
cipherInits := map[string]func([]byte) (Cipher, error){
"CFB": NewCFBCipher,
"GCM": NewGCMCipher,
}
for name, initCipher := range cipherInits {
t.Run(name, func(t *testing.T) {
// Test all 3 valid AES sizes
for _, secretSize := range []int{16, 24, 32} {
t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
secret := make([]byte, secretSize)
_, err := io.ReadFull(rand.Reader, secret)
assert.Equal(t, nil, err)
// Test Standard & Base64 wrapped
cstd, err := initCipher(secret)
assert.Equal(t, nil, err)
cb64, err := NewBase64Cipher(initCipher, secret)
assert.Equal(t, nil, err)
ciphers := map[string]Cipher{
"Standard": cstd,
"Base64": cb64,
}
for cName, c := range ciphers {
// Check no errors with empty or nil strings
if cName == "Base64" {
empty := ""
assert.Equal(t, nil, c.EncryptInto(&empty))
assert.Equal(t, nil, c.DecryptInto(&empty))
assert.Equal(t, nil, c.EncryptInto(nil))
assert.Equal(t, nil, c.DecryptInto(nil))
}
t.Run(cName, func(t *testing.T) {
// Test various sizes sessions might be
for _, dataSize := range []int{10, 100, 1000, 5000, 10000} {
t.Run(fmt.Sprintf("%d", dataSize), func(t *testing.T) {
runEncryptIntoAndDecryptInto(t, c, cName, dataSize)
})
}
})
}
})
}
})
}
}
func runEncryptIntoAndDecryptInto(t *testing.T, c Cipher, cipherType string, dataSize int) {
const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
b := make([]byte, dataSize)
for i := range b {
b[i] = charset[mathrand.Intn(len(charset))]
}
data := string(b)
originalData := data
// Base64 is the only cipher that supports string->string Encrypt/Decrypt Into methods
if cipherType == "Base64" {
assert.Equal(t, nil, c.EncryptInto(&data))
assert.NotEqual(t, originalData, data)
assert.Equal(t, nil, c.DecryptInto(&data))
assert.Equal(t, originalData, data)
} else {
assert.NotEqual(t, nil, c.EncryptInto(&data))
assert.NotEqual(t, nil, c.DecryptInto(&data))
}
}
func TestDecryptCFBWrongSecret(t *testing.T) {
secret1 := []byte("0123456789abcdefghijklmnopqrstuv")
secret2 := []byte("9876543210abcdefghijklmnopqrstuv")