Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Hold signatures to the length SHA-256 gives
The fake HMAC returned 16 bytes, so the checks signed with signatures
half the real length, and a signature cut short passed. tohex's output
was never pinned either, so dropping its zero padding stayed
consistent with itself and passed.
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/extensions/harness.lua | 5 | |
| -rw-r--r-- | tests/extensions/test-auth.lua | 3 |
2 files changed, 7 insertions, 1 deletion
diff --git a/tests/extensions/harness.lua b/tests/extensions/harness.lua index 1a669ff..ead3c97 100644 --- a/tests/extensions/harness.lua +++ b/tests/extensions/harness.lua @@ -311,11 +311,14 @@ function harness.stub_auth_modules() return table.concat(out) end, }) + -- An HMAC-SHA256 is 32 bytes, twice what one fake digest gives, so two + -- of different input are joined to make signatures the real length. preload("openssl.hmac", { new = function(key, algorithm) return { final = function(self, payload) - return fake_digest_bytes(key .. "\1" .. algorithm .. "\1" .. payload) + local text = key .. "\1" .. algorithm .. "\1" .. payload + return fake_digest_bytes(text) .. fake_digest_bytes("\2" .. text) end, } end, diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index d91287a..a7e1b70 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -292,6 +292,9 @@ local now = os.time() local cookie = secure_value("username", "alice", now + 3600) h.equals("a signed value verifies and comes back", validate_value("username", cookie), "alice") +local signature = cookie:match("|(%x+)$") +h.equals("its signature is a whole SHA-256 in hex", signature and #signature, 64) +h.equals("each byte becomes two hex digits", tohex("\0\15\255"), "000fff") cookie = secure_value("username", "a|b", now + 3600) h.equals("a value holding the separator survives the round trip", validate_value("username", cookie), "a|b") |