59 lines
1.5 KiB
Go
59 lines
1.5 KiB
Go
package security
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/base64"
|
|
"testing"
|
|
)
|
|
|
|
func TestVaultAuthenticatesCiphertextPurposeAndKey(t *testing.T) {
|
|
key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{1}, 32))
|
|
v, err := NewVault(key)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
plaintext := []byte("database-password")
|
|
a, err := v.Seal(plaintext, "proxy:a")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
b, err := v.Seal(plaintext, "proxy:a")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if bytes.Equal(a, b) || bytes.Contains(a, plaintext) {
|
|
t.Fatal("nonce reused or plaintext stored")
|
|
}
|
|
got, err := v.Open(a, "proxy:a")
|
|
if err != nil || !bytes.Equal(got, plaintext) {
|
|
t.Fatalf("round trip: %q %v", got, err)
|
|
}
|
|
if _, err = v.Open(a, "proxy:b"); err == nil {
|
|
t.Fatal("accepted incorrect associated data")
|
|
}
|
|
other, _ := NewVault(base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{2}, 32)))
|
|
if _, err = other.Open(a, "proxy:a"); err == nil {
|
|
t.Fatal("accepted wrong key")
|
|
}
|
|
for i := range a {
|
|
corrupt := bytes.Clone(a)
|
|
corrupt[i] ^= 1
|
|
if _, err := v.Open(corrupt, "proxy:a"); err == nil {
|
|
t.Fatalf("accepted tamper at %d", i)
|
|
}
|
|
}
|
|
for i := 0; i < len(a); i++ {
|
|
if _, err := v.Open(a[:i], "proxy:a"); err == nil {
|
|
t.Fatalf("accepted truncation %d", i)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestVaultRejectsInvalidMasterKeys(t *testing.T) {
|
|
for _, key := range []string{"", "invalid", base64.StdEncoding.EncodeToString(make([]byte, 16)), base64.StdEncoding.EncodeToString(make([]byte, 33))} {
|
|
if _, err := NewVault(key); err == nil {
|
|
t.Fatal("accepted invalid master key")
|
|
}
|
|
}
|
|
}
|