+// Copyright (C) The Arvados Authors. All rights reserved.
+//
+// SPDX-License-Identifier: AGPL-3.0
+
package main
import (
"strconv"
"testing"
"time"
+
+ "git.curoverse.com/arvados.git/sdk/go/arvados"
)
const (
"gokee3eamvjy8qq1fvy238838enjmy5wzy2md7yvsitp5vztft6j4q866efym7e6" +
"vu5wm9fpnwjyxfldw3vbo01mgjs75rgo7qioh8z8ij7jpyp8508okhgbbex3ceei" +
"786u5rw2a9gx743dj3fgq2irk"
- knownSignature = "257f3f5f5f0a4e4626a18fc74bd42ec34dcb228a"
+ knownSignatureTTL = arvados.Duration(24 * 14 * time.Hour)
+ knownSignature = "89118b78732c33104a4d6231e8b5a5fa1e4301e3"
knownTimestamp = "7fffffff"
knownSigHint = "+A" + knownSignature + "@" + knownTimestamp
knownSignedLocator = knownLocator + knownSigHint
)
func TestSignLocator(t *testing.T) {
- PermissionSecret = []byte(knownKey)
- defer func() { PermissionSecret = nil }()
+ defer func(b []byte) {
+ theConfig.blobSigningKey = b
+ }(theConfig.blobSigningKey)
tsInt, err := strconv.ParseInt(knownTimestamp, 16, 0)
if err != nil {
- t.Fail()
- }
- if knownSignedLocator != SignLocator(knownLocator, knownToken, time.Unix(tsInt, 0)) {
- t.Fail()
- }
-}
-
-func TestVerifySignature(t *testing.T) {
- PermissionSecret = []byte(knownKey)
- defer func() { PermissionSecret = nil }()
-
- if VerifySignature(knownSignedLocator, knownToken) != nil {
- t.Fail()
+ t.Fatal(err)
}
-}
+ t0 := time.Unix(tsInt, 0)
-func TestVerifySignatureExtraHints(t *testing.T) {
- PermissionSecret = []byte(knownKey)
- defer func() { PermissionSecret = nil }()
+ theConfig.BlobSignatureTTL = knownSignatureTTL
- if VerifySignature(knownLocator+"+K@xyzzy"+knownSigHint, knownToken) != nil {
- t.Fatal("Verify cannot handle hint before permission signature")
+ theConfig.blobSigningKey = []byte(knownKey)
+ if x := SignLocator(knownLocator, knownToken, t0); x != knownSignedLocator {
+ t.Fatalf("Got %+q, expected %+q", x, knownSignedLocator)
}
- if VerifySignature(knownLocator+knownSigHint+"+Zfoo", knownToken) != nil {
- t.Fatal("Verify cannot handle hint after permission signature")
- }
-
- if VerifySignature(knownLocator+"+K@xyzzy"+knownSigHint+"+Zfoo", knownToken) != nil {
- t.Fatal("Verify cannot handle hints around permission signature")
+ theConfig.blobSigningKey = []byte("arbitrarykey")
+ if x := SignLocator(knownLocator, knownToken, t0); x == knownSignedLocator {
+ t.Fatalf("Got same signature %+q, even though blobSigningKey changed", x)
}
}
-// The size hint on the locator string should not affect signature validation.
-func TestVerifySignatureWrongSize(t *testing.T) {
- PermissionSecret = []byte(knownKey)
- defer func() { PermissionSecret = nil }()
-
- if VerifySignature(knownHash+"+999999"+knownSigHint, knownToken) != nil {
- t.Fatal("Verify cannot handle incorrect size hint")
- }
-
- if VerifySignature(knownHash+knownSigHint, knownToken) != nil {
- t.Fatal("Verify cannot handle missing size hint")
- }
-}
+func TestVerifyLocator(t *testing.T) {
+ defer func(b []byte) {
+ theConfig.blobSigningKey = b
+ }(theConfig.blobSigningKey)
-func TestVerifySignatureBadSig(t *testing.T) {
- PermissionSecret = []byte(knownKey)
- defer func() { PermissionSecret = nil }()
+ theConfig.BlobSignatureTTL = knownSignatureTTL
- badLocator := knownLocator + "+Aaaaaaaaaaaaaaaa@" + knownTimestamp
- if VerifySignature(badLocator, knownToken) != PermissionError {
- t.Fail()
+ theConfig.blobSigningKey = []byte(knownKey)
+ if err := VerifySignature(knownSignedLocator, knownToken); err != nil {
+ t.Fatal(err)
}
-}
-
-func TestVerifySignatureBadTimestamp(t *testing.T) {
- PermissionSecret = []byte(knownKey)
- defer func() { PermissionSecret = nil }()
-
- badLocator := knownLocator + "+A" + knownSignature + "@OOOOOOOl"
- if VerifySignature(badLocator, knownToken) != PermissionError {
- t.Fail()
- }
-}
-
-func TestVerifySignatureBadSecret(t *testing.T) {
- PermissionSecret = []byte("00000000000000000000")
- defer func() { PermissionSecret = nil }()
-
- if VerifySignature(knownSignedLocator, knownToken) != PermissionError {
- t.Fail()
- }
-}
-
-func TestVerifySignatureBadToken(t *testing.T) {
- PermissionSecret = []byte(knownKey)
- defer func() { PermissionSecret = nil }()
-
- if VerifySignature(knownSignedLocator, "00000000") != PermissionError {
- t.Fail()
- }
-}
-
-func TestVerifySignatureExpired(t *testing.T) {
- PermissionSecret = []byte(knownKey)
- defer func() { PermissionSecret = nil }()
- yesterday := time.Now().AddDate(0, 0, -1)
- expiredLocator := SignLocator(knownHash, knownToken, yesterday)
- if VerifySignature(expiredLocator, knownToken) != ExpiredError {
- t.Fail()
+ theConfig.blobSigningKey = []byte("arbitrarykey")
+ if err := VerifySignature(knownSignedLocator, knownToken); err == nil {
+ t.Fatal("Verified signature even with wrong blobSigningKey")
}
}