mirror of
https://github.com/FiloSottile/age.git
synced 2026-03-11 08:55:41 +00:00
9d4b2ae7ac
The important one is the decryption side one, because when a user types a password they expect it to both decrypt and authenticate the file. Moved that one out of Decrypt and into ScryptIdentity, now that Identities get all the stanzas. special_cases-- This also opens the door to other Identity implementations that do allow multiple scrypt recipients, if someone really wants that. The CLI will never allow it, but an explicit choice by an API consumer feels like something we shouldn't interfere with. Moreover, this also allows alternative Identity implementations that use different recipient types to replicate the behavior if they have the same authentication semantics. The encryption side one is only a courtesy, to stop API users from making files that won't decrypt. Unfortunately, that one needs to stay as a special case in Encrypt, as the Recipient can't see around itself. However, changed it to a type assertion, so custom recipients can generate multiple scrypt recipient stanzas, if they really want.
96 lines
2.3 KiB
Go
96 lines
2.3 KiB
Go
// Copyright 2019 Google LLC
|
|
//
|
|
// Use of this source code is governed by a BSD-style
|
|
// license that can be found in the LICENSE file or at
|
|
// https://developers.google.com/open-source/licenses/bsd
|
|
|
|
package main
|
|
|
|
import (
|
|
"errors"
|
|
"io/ioutil"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"filippo.io/age"
|
|
)
|
|
|
|
func TestVectors(t *testing.T) {
|
|
var defaultIDs []age.Identity
|
|
|
|
password, err := ioutil.ReadFile("testdata/default_password.txt")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
p := strings.TrimSpace(string(password))
|
|
i, err := age.NewScryptIdentity(p)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defaultIDs = append(defaultIDs, i)
|
|
|
|
ids, err := parseIdentitiesFile("testdata/default_key.txt")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defaultIDs = append(defaultIDs, ids...)
|
|
|
|
files, _ := filepath.Glob("testdata/*.age")
|
|
for _, f := range files {
|
|
_, name := filepath.Split(f)
|
|
name = strings.TrimSuffix(name, ".age")
|
|
expectPass := strings.HasPrefix(name, "good_")
|
|
expectFailure := strings.HasPrefix(name, "fail_")
|
|
expectNoMatch := strings.HasPrefix(name, "nomatch_")
|
|
t.Run(name, func(t *testing.T) {
|
|
identities := defaultIDs
|
|
ids, err := parseIdentitiesFile("testdata/" + name + "_key.txt")
|
|
if err == nil {
|
|
identities = ids
|
|
}
|
|
password, err := ioutil.ReadFile("testdata/" + name + "_password.txt")
|
|
if err == nil {
|
|
p := strings.TrimSpace(string(password))
|
|
i, err := age.NewScryptIdentity(p)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
identities = []age.Identity{i}
|
|
}
|
|
|
|
in, err := os.Open("testdata/" + name + ".age")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r, err := age.Decrypt(in, identities...)
|
|
if expectFailure {
|
|
if err == nil {
|
|
t.Fatal("expected Decrypt failure")
|
|
}
|
|
if e := new(age.NoIdentityMatchError); errors.As(err, &e) {
|
|
t.Errorf("got ErrIncorrectIdentity, expected more specific error")
|
|
}
|
|
} else if expectNoMatch {
|
|
if err == nil {
|
|
t.Fatal("expected Decrypt failure")
|
|
}
|
|
if e := new(age.NoIdentityMatchError); !errors.As(err, &e) {
|
|
t.Errorf("expected ErrIncorrectIdentity, got %v", err)
|
|
}
|
|
} else if expectPass {
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
out, err := ioutil.ReadAll(r)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Logf("%s", out)
|
|
} else {
|
|
t.Fatal("invalid test vector")
|
|
}
|
|
})
|
|
}
|
|
}
|