From eaa4e03cfed731b5a1c2756add1eb28d34af05d6 Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Sat, 18 Jun 2022 13:47:00 +0200 Subject: [PATCH] tests: finish parsing and X25519 tests, distinguish HMAC errors If the implementation re-encodes the header before checking the HMAC, that would mask malleability issues: the HMAC check would fail because the tests HMAC'd the original header, but an attacker could also produce the right HMAC. Instead of duplicating every parsing tests (with the original and re-encoded HMAC), we make the test framework distinguish HMAC errors, which ensures bad encodings are recognized as such and not bypassable HMAC errors. --- internal/format/format.go | 2 +- internal/testkit/testkit.go | 38 +++++++++++++----- testdata/testkit/{crlf => header_crlf} | Bin testdata/testkit/hmac_bad | Bin 355 -> 353 bytes ...g_file_key_scrypt => scrypt_long_file_key} | Bin testdata/testkit/stanza_bad_start | Bin 0 -> 366 bytes testdata/testkit/stanza_base64_padding | Bin 0 -> 435 bytes testdata/testkit/stanza_empty_argument | Bin 0 -> 376 bytes testdata/testkit/stanza_empty_last_line | Bin 498 -> 563 bytes testdata/testkit/stanza_invalid_character | Bin 0 -> 369 bytes testdata/testkit/stanza_long_line | Bin 0 -> 482 bytes testdata/testkit/stanza_no_arguments | Bin 0 -> 359 bytes testdata/testkit/stanza_not_canonical | Bin 0 -> 434 bytes testdata/testkit/stanza_spurious_cr | Bin 0 -> 430 bytes testdata/testkit/version_unsupported | Bin 0 -> 358 bytes testdata/testkit/x25519_bad_tag | Bin 0 -> 446 bytes testdata/testkit/x25519_grease | Bin 0 -> 444 bytes .../{long_file_key => x25519_long_file_key} | Bin testdata/testkit/x25519_long_share | Bin 0 -> 414 bytes testdata/testkit/x25519_lowercase | Bin 0 -> 417 bytes testdata/testkit/x25519_short_share | Bin 0 -> 412 bytes testkit_test.go | 35 +++++++++------- tests/{crlf.go => header_crlf.go} | 0 tests/hmac_bad.go | 2 +- ..._key_scrypt.go => scrypt_long_file_key.go} | 0 tests/stanza_bad_start.go | 21 ++++++++++ tests/stanza_base64_padding.go | 26 ++++++++++++ tests/stanza_empty_argument.go | 21 ++++++++++ tests/stanza_empty_last_line.go | 2 +- tests/stanza_invalid_character.go | 21 ++++++++++ tests/stanza_long_line.go | 27 +++++++++++++ tests/stanza_no_arguments.go | 21 ++++++++++ tests/stanza_not_canonical.go | 26 ++++++++++++ tests/stanza_spurious_cr.go | 25 ++++++++++++ tests/version_unsupported.go | 19 +++++++++ tests/x25519_bad_tag.go | 27 +++++++++++++ tests/x25519_grease.go | 22 ++++++++++ tests/x25519_identity.go | 18 ++------- ...ng_file_key.go => x25519_long_file_key.go} | 0 tests/x25519_long_share.go | 30 ++++++++++++++ tests/x25519_low_order.go | 16 +------- tests/x25519_lowercase.go | 27 +++++++++++++ tests/x25519_short_share.go | 30 ++++++++++++++ 43 files changed, 399 insertions(+), 57 deletions(-) rename testdata/testkit/{crlf => header_crlf} (100%) rename testdata/testkit/{long_file_key_scrypt => scrypt_long_file_key} (100%) create mode 100644 testdata/testkit/stanza_bad_start create mode 100644 testdata/testkit/stanza_base64_padding create mode 100644 testdata/testkit/stanza_empty_argument create mode 100644 testdata/testkit/stanza_invalid_character create mode 100644 testdata/testkit/stanza_long_line create mode 100644 testdata/testkit/stanza_no_arguments create mode 100644 testdata/testkit/stanza_not_canonical create mode 100644 testdata/testkit/stanza_spurious_cr create mode 100644 testdata/testkit/version_unsupported create mode 100644 testdata/testkit/x25519_bad_tag create mode 100644 testdata/testkit/x25519_grease rename testdata/testkit/{long_file_key => x25519_long_file_key} (100%) create mode 100644 testdata/testkit/x25519_long_share create mode 100644 testdata/testkit/x25519_lowercase create mode 100644 testdata/testkit/x25519_short_share rename tests/{crlf.go => header_crlf.go} (100%) rename tests/{long_file_key_scrypt.go => scrypt_long_file_key.go} (100%) create mode 100644 tests/stanza_bad_start.go create mode 100644 tests/stanza_base64_padding.go create mode 100644 tests/stanza_empty_argument.go create mode 100644 tests/stanza_invalid_character.go create mode 100644 tests/stanza_long_line.go create mode 100644 tests/stanza_no_arguments.go create mode 100644 tests/stanza_not_canonical.go create mode 100644 tests/stanza_spurious_cr.go create mode 100644 tests/version_unsupported.go create mode 100644 tests/x25519_bad_tag.go create mode 100644 tests/x25519_grease.go rename tests/{long_file_key.go => x25519_long_file_key.go} (100%) create mode 100644 tests/x25519_long_share.go create mode 100644 tests/x25519_lowercase.go create mode 100644 tests/x25519_short_share.go diff --git a/internal/format/format.go b/internal/format/format.go index 94925d9..a91064a 100644 --- a/internal/format/format.go +++ b/internal/format/format.go @@ -258,7 +258,7 @@ func Parse(input io.Reader) (*Header, io.Reader, error) { return nil, nil, errorf("malformed closing line: %q", line) } h.MAC, err = DecodeString(args[0]) - if err != nil { + if err != nil || len(h.MAC) != 32 { return nil, nil, errorf("malformed closing line %q: %v", line, err) } break diff --git a/internal/testkit/testkit.go b/internal/testkit/testkit.go index b2410ae..60e0823 100644 --- a/internal/testkit/testkit.go +++ b/internal/testkit/testkit.go @@ -106,16 +106,22 @@ func (f *TestFile) Body(body []byte) { } } -func (f *TestFile) Stanza(args []string, body []byte) { - f.ArgsLine(args...) - f.Body(body) -} - func (f *TestFile) AEADBody(key, body []byte) { aead, _ := chacha20poly1305.New(key) f.Body(aead.Seal(nil, make([]byte, chacha20poly1305.NonceSize), body, nil)) } +func x25519(scalar, point []byte) []byte { + secret, err := curve25519.X25519(scalar, point) + if err != nil { + if err.Error() == "bad input point: low order point" { + return make([]byte, 32) + } + panic(err) + } + return secret +} + func (f *TestFile) X25519(identity []byte) { f.X25519RecordIdentity(identity) f.X25519NoRecordIdentity(identity) @@ -127,11 +133,16 @@ func (f *TestFile) X25519RecordIdentity(identity []byte) { } func (f *TestFile) X25519NoRecordIdentity(identity []byte) { - recipient, _ := curve25519.X25519(identity, curve25519.Basepoint) - ephemeral := f.Rand(32) - share, _ := curve25519.X25519(ephemeral, curve25519.Basepoint) + share := x25519(f.Rand(32), curve25519.Basepoint) + f.X25519Stanza(share, identity) +} + +func (f *TestFile) X25519Stanza(share, identity []byte) { + recipient := x25519(identity, curve25519.Basepoint) f.ArgsLine("X25519", b64(share)) - secret, _ := curve25519.X25519(ephemeral, recipient) + // This would be ordinarily done as [ephemeral]recipient rather than + // [identity]share, but for some tests we don't have the dlog of share. + secret := x25519(identity, share) key := make([]byte, 32) hkdf.New(sha256.New, secret, append(share, recipient...), []byte("age-encryption.org/v1/X25519")).Read(key) @@ -150,8 +161,11 @@ func (f *TestFile) ScryptRecordPassphrase(passphrase string) { func (f *TestFile) ScryptNoRecordPassphrase(passphrase string, workFactor int) { salt := f.Rand(16) f.ArgsLine("scrypt", b64(salt), strconv.Itoa(workFactor)) - key, _ := scrypt.Key([]byte(passphrase), append([]byte("age-encryption.org/v1/scrypt"), salt...), + key, err := scrypt.Key([]byte(passphrase), append([]byte("age-encryption.org/v1/scrypt"), salt...), 1<598-99O(zxz0Ga4qeV$v|nR}}?mmQ&`8HXQ~j5W#p;im=Ed2_Y!L z1PVxm3ZxK$ETKi6)tgm4B&MF?B!E@BBNFM|V=V^coM#(>A!GL=mlCXb>ebpiApI2E3Q6)qp#p>;$mEN z(#7X6#>E&DV|@nm=i9z~KRr)rkk^%LYZS)))*v11cUV=garxWpx~kPD!Wc=N zPDhkXPIm_l!!|8#tVxn?!J#9XSd{?qrj(^gkdAwB0h?6O$Dl|2-^oFS+o*aI7BwhjoDL1D0i(e%{3GqSx{w!E8;6`Req1T8(D@ zEWhBYjW(L1elx^&3!5Bxd+{HiuWrTd-t6_`Yg4<^j($ELZj7h*`;F_JtxNtp`USrU BibzYy;?j_+}qB~^5TO{Je&<+A!P-r9*f}Lm*+L~?9?ib0! zifNj%;tF;&>N|n!Q;#Z&?W1uhyQ-l85YHITinMCVI$sr^R@JPv69NAjh7!i21}7vp zgr;0qTvG1RbvS5r-z=#*-0nx2zaLT68k5B65A_s~CDFSiwFX?#@;92B1i8;$ZH0;> zZAVr6Sr9c@TQ2sh_g>i4adC_xjH}spd3pnY=Xsc{Hob%I^p2LHv1M}@YdzwuRj!Xs z%i|WigluTryE0pD7yNoo9-eM~${z>wm$yIX^p<}8_xt{b^Z0sq_Wk0+wfJ}X9|3@R A-~a#s literal 0 HcmV?d00001 diff --git a/testdata/testkit/stanza_empty_last_line b/testdata/testkit/stanza_empty_last_line index 285f0d83720359fbeed54bad1b78331466776d32..30a6c8fde8b636156413a0145e77d8ceb51864d8 100644 GIT binary patch delta 69 zcmeywyqRUgJjTh1j5el$p>9rGT)Mit3du<(!G$HIdBI*)5#BEDS%s;Q6{Tf~mQJY_ Z27wW-F5WJAMv2}|iO$94lg}}#000sq7OVgO delta 59 zcmdnY@`-uFJjTiQ8CkWpjRTxb49(Ij63ul7o&Vkawq{2blLN7qM=)~o;rB+HQz2NE-IQj<0*~G=T zIOwE{&tZ&z#y3r>V%Xv3ds<`=&u2icoqo= zK_14CLp+orfe0iqNsFZTqxA#KSXeQ!&9t!3aGv413M=ZqfH5+C+cRWC)9XikABoLo zQxGlI@Vlz%T8`e=MbU6z&l4<369EW@gdu5^msyca)7@!4tSmXe>`@+%5GPYMPBga6 zW;q>Z%V_4cOT}qsy3|>$y0NqB>QbwRLrv`{5x}QdspF{CrqhZum#xrE9Qts<<}|LF zlBCA2U&d7-T}l1_!@LO6vw(WI0)Sx{YHm07E36htFdt=O1)BBs)D$qw5y!SuH(vxQ s9ig5(ZZ*K$OZfPFaU*QEN3S1WoBFMO{PTH#Z9cu~V-74HB@3Mx>ZwPVw>nm?`E;$klW;Teo%j3pgz2s6d8xoszDv(Ij$)o28Z#?r2b zgOdjb$I_N-lA7~tBLk!&#*Adk)r4OJo$jR}3ntG8v7L}hSJUQs7?1g-!VjAN&(QS= zKPF)I9|C|N2(ag_@5=kC@^v{ob~l{WCLV5z$fv!(JNot7ajrJ{p&APC?MwRc^V<)~ glhy9)k6(|iJL~12pAYZdPv7q!y*od9BmLg~1&w8z`2YX_ literal 0 HcmV?d00001 diff --git a/testdata/testkit/stanza_no_arguments b/testdata/testkit/stanza_no_arguments new file mode 100644 index 0000000000000000000000000000000000000000..a667ad976b0836515e18a43677824cf8b7ddc25e GIT binary patch literal 359 zcmWN~yH3JT0D$5B3@+}bn*&yQIj5xzCRh$)IR$!ebt>%v%B7T2z|KB_qp#p>;$mEN z(#7X6#>E&DBl*`a`RP?gqoU4?X&BR-8HUMhol`JOW|W!Ivd$m{A{gx&B3a;&h!7ND z40$9#1yYDW64SIuiXCm7Vb;Q`iEXxn1D5x7&r>;x1R}=B3~XOl^cHDc2o91oO%o-H z(}RA~^emS+M3QtD8op@BEeU{dL|K|fd6^Z-B0XN@qw0nS>iqW$yzD=ep@bNZy ie!aOD54+>{ub+MLKra8jpYF_;&&R#nql0VyclZw{4s>Gx literal 0 HcmV?d00001 diff --git a/testdata/testkit/stanza_not_canonical b/testdata/testkit/stanza_not_canonical new file mode 100644 index 0000000000000000000000000000000000000000..f7794aad41ce87d59372fa03b88d66113e502ca8 GIT binary patch literal 434 zcmbu2y-tHr07myaxVRfO2gLGoFO&`@m0mRMg_eKNiNbA5tVk(XarFrteFbL|7vrjv zEc(h(L1-~A7N0l;w_lUs)9Yv;!%8I@jLnt{nWfx7aGmRh@p w)si*WGn9EdX+!Y(Jbrk(ypcA|*~|OqI=Ll>-yiqa_T$^#+SS&^h43}`0Vd3f;Q#;t literal 0 HcmV?d00001 diff --git a/testdata/testkit/stanza_spurious_cr b/testdata/testkit/stanza_spurious_cr new file mode 100644 index 0000000000000000000000000000000000000000..b85c2ce628cc9994813464bbad2fc755a50b6fa6 GIT binary patch literal 430 zcmaityH49s0EYJ?wF`UYtwV6*%Q-$a1Cr$&w{nhiu@hgy|fd3o6Px|@34~o6U!uNx7RA#!P@YrVIH); zZKSG2bPwYW3*(0AYO%xPw}*9|6c-6F-`R(EJP<`ua3_gv&h-Vm7)!RU_ncF@M-9VS z!4QsoWc8Q3^VxP-M?>)Y=k)&Z`?dPHH~;nb>44tQlmGwjuDpjow;z8Te!7&Ovljtx BhvNVM literal 0 HcmV?d00001 diff --git a/testdata/testkit/version_unsupported b/testdata/testkit/version_unsupported new file mode 100644 index 0000000000000000000000000000000000000000..e7a7ddf4cced5a4f1a174878fc33ecc817f8012a GIT binary patch literal 358 zcmWN{y-tHb007{f!NuLMIaDlgcl>lPsr1^09{mBzk4^=yEon=EmLjuH;OHwjo46QP zopkXzjBzo>#Mpf6N3T*EZX4{JP9mDK(@DH6a>`8OC1n@1YOqL!2!?x8B#S%(2tg4> zP(UJ7A%%#EBbsdE?Y=fUn6t2EVw>w>pA$U8bv0fhKEN26zU>*R(I(9caf~Eg*MVg5 zhCghXuH}$1ktD-`BM(?|TVj~WjB+#y^D5oO>*REu&+0ot1d!p*SWiSqP+1$tZN5sg zycVRpF!TDA=IAMr2SquIoN`Fy-UtWn)<6pxyuw-&hrNC+sXH6h3f$PKbqhYPVa1f? zR^<9sq=2N9#|+1DEKr(6F>>gXD@)S)fdPY1E`VEh&Rf~Wu+8qE@O3p@WEweUOr2fYJy(*OVf literal 0 HcmV?d00001 diff --git a/testdata/testkit/x25519_bad_tag b/testdata/testkit/x25519_bad_tag new file mode 100644 index 0000000000000000000000000000000000000000..9a087456d82f68788cca16a3d267dc39bc00c6f4 GIT binary patch literal 446 zcmXYqy>8S%6oq>iH1udXip9h~Gj_ZM(#AUu*&S~-_QpR@jqR~L%C5)pjgYyS z)F|9LIJVJo5`W_Af9a zu^?8MVBvQl#DWkKqKxP*Z+OyEuUaLBsoo!iP<^kpeBAE1oa(@|DvS^Sf==Z_ zY93{A8YF>jhbg+qt(YuqP2(G7s77>SJJh@8(XQK^UYnZnSl@Jt_e%SxImFm>^fjv& zU~Ko@q-?LnK3|S*>a_tmKO9#wJ+1=cU$Am9KX--3UNU#aguk3Lr)lrRWmcz?vjgZR zj7EgaWmb%mTFsFp|IG|TC(EF#$|$)U?7a_KIn1J@!j3#U?o1e|t-SL5t8iN~>#6qb nOZoBh&0Fi?^7+>vzwQU`f@gnzes~jo`u_gj?a71J=I`n+-&%}O literal 0 HcmV?d00001 diff --git a/testdata/testkit/long_file_key b/testdata/testkit/x25519_long_file_key similarity index 100% rename from testdata/testkit/long_file_key rename to testdata/testkit/x25519_long_file_key diff --git a/testdata/testkit/x25519_long_share b/testdata/testkit/x25519_long_share new file mode 100644 index 0000000000000000000000000000000000000000..a2f3a047aafcae0e5b4c36884558d49228697911 GIT binary patch literal 414 zcmXwzJx|*}0ETxDUD(lW48hbs-^C|f}N z)TLsD36}njs_Ifzm8zNnz0)f_di1cHg2h!AWGqaW0BOiqTfwB1uNb&wyDq>Tgi+iq z#X3~5hB1ODK`Mr*gBZdRPuQm7RfF~hM0QEvAye5Tb6F*W>A7bZ9#oDsZ25Dq4RwVE zbI*jHX$5dJIyL>dNk;<*9nX4xfD{`}ARQ@EoUhl7whKZ~iKdBf7T}hN9PkpXd0D>w zROD+=WefxmW3>ayENsf9aKU7@iN&s{c)mHx#p2_&D#@STu_@t(vMa7cD=MzztH9dz zy|aSq<83`jym~@)(p8GQMN*lJ!G~Erd~WBEzPp zU>#$mp%kfDLl$BP1D>+7ybb`QE3>xW#U^iNaj^#|~=!Ley z#&kN>4Nq~R<=728pKhpOI6hj1x@S%dkW~Bq>2?U)g29Z7riHP{4}Trxvnr||m!XifM;>FX;YZR=xl70!Fx zpVrh|9J*!dcS~x{R%AOFFYE-6J+Vh5na!p0+;1#z8*pEGeo%x&2Ciw2(;({8fnIjz z2FS7uy)K+B^faV}wZkj!cE|2SC2ph|ZhtZhd%Y0q`)zzQjlw-> z>O&fZ1cu~@LeF!^G$KQCi3ATtIi#MrPvoyASL5-*s_%0#S}l2_$!B^KJsP}EQVvD~asHK7*8Zd)VAPOO>T zk=_-yl@f1S7uMn6JlX{LV4TE9>v{svO`b9bu%Q1*{U92-Ub2XZ4g%c1P zDXOZ1S!rnDSRO1Lt9>93X|OVaR?9!8j3lF;d2O_^CCxl;pIsWWM_7Z7 literal 0 HcmV?d00001 diff --git a/testkit_test.go b/testkit_test.go index 578efcf..3a44b48 100644 --- a/testkit_test.go +++ b/testkit_test.go @@ -75,10 +75,9 @@ func TestVectors(t *testing.T) { func testVector(t *testing.T, test []byte) { var ( - expectHeaderFailure bool - expectPayloadFailure bool - payloadHash *[32]byte - identities []age.Identity + expect string + payloadHash *[32]byte + identities []age.Identity ) for { @@ -95,13 +94,13 @@ func testVector(t *testing.T, test []byte) { case "expect": switch value { case "success": + case "HMAC failure": case "header failure": - expectHeaderFailure = true case "payload failure": - expectPayloadFailure = true default: t.Fatal("invalid test file: unknown expect value:", value) } + expect = value case "payload": h, err := hex.DecodeString(value) if err != nil { @@ -130,24 +129,30 @@ func testVector(t *testing.T, test []byte) { } r, err := age.Decrypt(bytes.NewReader(test), identities...) - if err != nil { - if expectHeaderFailure { + if err != nil && strings.HasSuffix(err.Error(), "bad header MAC") { + if expect == "HMAC failure" { t.Log(err) return } - t.Fatal("unexpected header error:", err) - } else if expectHeaderFailure { - t.Fatal("expected header error") + t.Fatalf("expected %s, got HMAC error", expect) + } else if err != nil { + if expect == "header failure" { + t.Log(err) + return + } + t.Fatalf("expected %s, got: %v", expect, err) + } else if expect != "success" && expect != "payload failure" { + t.Fatalf("expected %s, got success", expect) } out, err := io.ReadAll(r) if err != nil { - if expectPayloadFailure { + if expect == "payload failure" { t.Log(err) return } - t.Fatal("unexpected payload error:", err) - } else if expectPayloadFailure { - t.Fatal("expected payload error") + t.Fatalf("expected %s, got: %v", expect, err) + } else if expect != "success" { + t.Fatalf("expected %s, got success", expect) } if sha256.Sum256(out) != *payloadHash { t.Error("payload hash mismatch") diff --git a/tests/crlf.go b/tests/header_crlf.go similarity index 100% rename from tests/crlf.go rename to tests/header_crlf.go diff --git a/tests/hmac_bad.go b/tests/hmac_bad.go index a8556f0..b6a7eba 100644 --- a/tests/hmac_bad.go +++ b/tests/hmac_bad.go @@ -16,6 +16,6 @@ func main() { f.HMAC() f.FileKey(testkit.TestFileKey) f.Payload("age") - f.ExpectHeaderFailure() + f.ExpectHMACFailure() f.Generate() } diff --git a/tests/long_file_key_scrypt.go b/tests/scrypt_long_file_key.go similarity index 100% rename from tests/long_file_key_scrypt.go rename to tests/scrypt_long_file_key.go diff --git a/tests/stanza_bad_start.go b/tests/stanza_bad_start.go new file mode 100644 index 0000000..3e473c2 --- /dev/null +++ b/tests/stanza_bad_start.go @@ -0,0 +1,21 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import "filippo.io/age/internal/testkit" + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + f.TextLine("-- stanza") + f.Body([]byte("")) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Generate() +} diff --git a/tests/stanza_base64_padding.go b/tests/stanza_base64_padding.go new file mode 100644 index 0000000..0c81221 --- /dev/null +++ b/tests/stanza_base64_padding.go @@ -0,0 +1,26 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import ( + "bytes" + + "filippo.io/age/internal/testkit" +) + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + f.ArgsLine("stanza") + f.Body(bytes.Repeat([]byte("A"), 50)) + f.TextLine(f.UnreadLine() + "=") + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Generate() +} diff --git a/tests/stanza_empty_argument.go b/tests/stanza_empty_argument.go new file mode 100644 index 0000000..60b707f --- /dev/null +++ b/tests/stanza_empty_argument.go @@ -0,0 +1,21 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import "filippo.io/age/internal/testkit" + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + f.ArgsLine("stanza", "", "argument") + f.Body([]byte("")) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Generate() +} diff --git a/tests/stanza_empty_last_line.go b/tests/stanza_empty_last_line.go index 519be1e..8ed8f78 100644 --- a/tests/stanza_empty_last_line.go +++ b/tests/stanza_empty_last_line.go @@ -17,7 +17,7 @@ func main() { f.VersionLine("v1") f.X25519(testkit.TestX25519Recipient) f.ArgsLine("stanza") - f.Body(bytes.Repeat([]byte("A"), 48)) + f.Body(bytes.Repeat([]byte("A"), 48*2)) f.HMAC() f.Payload("age") f.Generate() diff --git a/tests/stanza_invalid_character.go b/tests/stanza_invalid_character.go new file mode 100644 index 0000000..bd9c7e3 --- /dev/null +++ b/tests/stanza_invalid_character.go @@ -0,0 +1,21 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import "filippo.io/age/internal/testkit" + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + f.ArgsLine("stanza", "รจ") + f.Body([]byte("")) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Generate() +} diff --git a/tests/stanza_long_line.go b/tests/stanza_long_line.go new file mode 100644 index 0000000..5eb7d5c --- /dev/null +++ b/tests/stanza_long_line.go @@ -0,0 +1,27 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import ( + "strings" + + "filippo.io/age/internal/testkit" +) + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + f.ArgsLine("stanza") + f.TextLine(strings.Repeat("A", 68)) + f.TextLine("") + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Comment("a body line is longer than 64 columns") + f.Generate() +} diff --git a/tests/stanza_no_arguments.go b/tests/stanza_no_arguments.go new file mode 100644 index 0000000..ecba530 --- /dev/null +++ b/tests/stanza_no_arguments.go @@ -0,0 +1,21 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import "filippo.io/age/internal/testkit" + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + f.ArgsLine() + f.Body([]byte("")) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Generate() +} diff --git a/tests/stanza_not_canonical.go b/tests/stanza_not_canonical.go new file mode 100644 index 0000000..88935e7 --- /dev/null +++ b/tests/stanza_not_canonical.go @@ -0,0 +1,26 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import ( + "bytes" + + "filippo.io/age/internal/testkit" +) + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + f.ArgsLine("stanza") + f.Body(bytes.Repeat([]byte("A"), 50)) + f.TextLine(testkit.NotCanonicalBase64(f.UnreadLine())) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Generate() +} diff --git a/tests/stanza_spurious_cr.go b/tests/stanza_spurious_cr.go new file mode 100644 index 0000000..b898616 --- /dev/null +++ b/tests/stanza_spurious_cr.go @@ -0,0 +1,25 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import ( + "strings" + + "filippo.io/age/internal/testkit" +) + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + f.ArgsLine("stanza") + f.TextLine(strings.Repeat("A", 32) + "\r" + strings.Repeat("A", 31)) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Generate() +} diff --git a/tests/version_unsupported.go b/tests/version_unsupported.go new file mode 100644 index 0000000..e1fc997 --- /dev/null +++ b/tests/version_unsupported.go @@ -0,0 +1,19 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import "filippo.io/age/internal/testkit" + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1234") + f.X25519(testkit.TestX25519Recipient) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Generate() +} diff --git a/tests/x25519_bad_tag.go b/tests/x25519_bad_tag.go new file mode 100644 index 0000000..e56cd7c --- /dev/null +++ b/tests/x25519_bad_tag.go @@ -0,0 +1,27 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import ( + "encoding/base64" + + "filippo.io/age/internal/testkit" +) + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + body, _ := base64.RawStdEncoding.DecodeString(f.UnreadLine()) + body[len(body)-1] ^= 0xff + f.TextLine(base64.RawStdEncoding.EncodeToString(body)) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Comment("the ChaCha20Poly1305 authentication tag on the body of the X25519 stanza is wrong") + f.Generate() +} diff --git a/tests/x25519_grease.go b/tests/x25519_grease.go new file mode 100644 index 0000000..98f7148 --- /dev/null +++ b/tests/x25519_grease.go @@ -0,0 +1,22 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import "filippo.io/age/internal/testkit" + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.ArgsLine("grease") + f.Body(nil) + f.X25519(testkit.TestX25519Recipient) + f.ArgsLine("grease") + f.Body(nil) + f.HMAC() + f.Payload("age") + f.Generate() +} diff --git a/tests/x25519_identity.go b/tests/x25519_identity.go index be8e531..f1b86e6 100644 --- a/tests/x25519_identity.go +++ b/tests/x25519_identity.go @@ -6,26 +6,14 @@ package main -import ( - "crypto/sha256" - "encoding/base64" - - "filippo.io/age/internal/testkit" - "golang.org/x/crypto/curve25519" - "golang.org/x/crypto/hkdf" -) +import "filippo.io/age/internal/testkit" func main() { f := testkit.NewTestFile() f.VersionLine("v1") f.X25519RecordIdentity(testkit.TestX25519Identity) - share := make([]byte, curve25519.PointSize) - f.ArgsLine("X25519", base64.RawStdEncoding.EncodeToString(share)) - secret := make([]byte, curve25519.PointSize) - key := make([]byte, 32) - hkdf.New(sha256.New, secret, append(share, testkit.TestX25519Recipient...), - []byte("age-encryption.org/v1/X25519")).Read(key) - f.AEADBody(key, testkit.TestFileKey) + share := make([]byte, 32) + f.X25519Stanza(share, testkit.TestX25519Identity) f.HMAC() f.Payload("age") f.ExpectHeaderFailure() diff --git a/tests/long_file_key.go b/tests/x25519_long_file_key.go similarity index 100% rename from tests/long_file_key.go rename to tests/x25519_long_file_key.go diff --git a/tests/x25519_long_share.go b/tests/x25519_long_share.go new file mode 100644 index 0000000..eca52d4 --- /dev/null +++ b/tests/x25519_long_share.go @@ -0,0 +1,30 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import ( + "encoding/base64" + + "filippo.io/age/internal/testkit" + "golang.org/x/crypto/curve25519" +) + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + share, _ := curve25519.X25519(f.Rand(32), curve25519.Basepoint) + f.X25519RecordIdentity(testkit.TestX25519Identity) + f.X25519Stanza(share, testkit.TestX25519Identity) + body, _ := f.UnreadLine(), f.UnreadLine() + f.TextLine("-> X25519 " + base64.RawStdEncoding.EncodeToString(append(share, 0x00))) + f.TextLine(body) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Comment("a trailing zero is missing from the X25519 share") + f.Generate() +} diff --git a/tests/x25519_low_order.go b/tests/x25519_low_order.go index 2e465bb..b27db75 100644 --- a/tests/x25519_low_order.go +++ b/tests/x25519_low_order.go @@ -6,14 +6,7 @@ package main -import ( - "crypto/sha256" - "encoding/base64" - - "filippo.io/age/internal/testkit" - "golang.org/x/crypto/curve25519" - "golang.org/x/crypto/hkdf" -) +import "filippo.io/age/internal/testkit" func main() { f := testkit.NewTestFile() @@ -24,12 +17,7 @@ func main() { share := []byte{0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24, 0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b, 0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86, 0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0xd7} - f.ArgsLine("X25519", base64.RawStdEncoding.EncodeToString(share)) - secret := make([]byte, curve25519.PointSize) - key := make([]byte, 32) - hkdf.New(sha256.New, secret, append(share, testkit.TestX25519Recipient...), - []byte("age-encryption.org/v1/X25519")).Read(key) - f.AEADBody(key, testkit.TestFileKey) + f.X25519Stanza(share, testkit.TestX25519Identity) f.HMAC() f.Payload("age") f.ExpectHeaderFailure() diff --git a/tests/x25519_lowercase.go b/tests/x25519_lowercase.go new file mode 100644 index 0000000..838690c --- /dev/null +++ b/tests/x25519_lowercase.go @@ -0,0 +1,27 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import ( + "strings" + + "filippo.io/age/internal/testkit" +) + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + f.X25519(testkit.TestX25519Recipient) + body, args := f.UnreadLine(), f.UnreadLine() + f.TextLine(strings.Replace(args, "X25519", "x25519", -1)) + f.TextLine(body) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Comment("the first argument in the X25519 stanza is lowercase") + f.Generate() +} diff --git a/tests/x25519_short_share.go b/tests/x25519_short_share.go new file mode 100644 index 0000000..9210a7a --- /dev/null +++ b/tests/x25519_short_share.go @@ -0,0 +1,30 @@ +// Copyright 2022 The age Authors. All rights reserved. +// Use of this source code is governed by a BSD-style +// license that can be found in the LICENSE file. + +//go:build ignore + +package main + +import ( + "encoding/base64" + "encoding/hex" + + "filippo.io/age/internal/testkit" +) + +func main() { + f := testkit.NewTestFile() + f.VersionLine("v1") + share, _ := hex.DecodeString("97ba38a135fd5f9137fca3836bfec24340ab03d7ca316b26f482636334a52600") + f.X25519RecordIdentity(testkit.TestX25519Identity) + f.X25519Stanza(share, testkit.TestX25519Identity) + body, _ := f.UnreadLine(), f.UnreadLine() + f.TextLine("-> X25519 " + base64.RawStdEncoding.EncodeToString(share[:31])) + f.TextLine(body) + f.HMAC() + f.Payload("age") + f.ExpectHeaderFailure() + f.Comment("a trailing zero is missing from the X25519 share") + f.Generate() +}