Skip to content

Commit

Permalink
Move Encrypt/Decrypt Into helper to session_state.go
Browse files Browse the repository at this point in the history 
This helper method is only applicable for Base64 wrapped
encryption since it operated on string -> string primarily.
It wouldn't be used for pure CFB/GCM ciphers. After a messagePack
session refactor, this method would further only be used for
legacy session compatibility - making its placement in cipher.go
not ideal.
  • Loading branch information
Nick Meves committed Jun 8, 2020
1 parent fbd568b commit 998dc9a
Show file tree
Hide file tree
Showing 4 changed files with 104 additions and 168 deletions.
25 changes: 21 additions & 4 deletions pkg/apis/sessions/session_state.go
View file
Expand Up @@ -75,7 +75,7 @@ func (s *SessionState) EncodeSessionState(c encryption.Cipher) (string, error) {
&ss.IDToken,
&ss.RefreshToken,
} {
err := c.EncryptInto(s)
err := into(s, c.Encrypt)
if err != nil {
return "", err
}
Expand Down Expand Up @@ -104,20 +104,37 @@ func DecodeSessionState(v string, c encryption.Cipher) (*SessionState, error) {
} else {
// Backward compatibility with using unencrypted Email or User
// Decryption errors will leave original string
_ = c.DecryptInto(&ss.Email)
_ = c.DecryptInto(&ss.User)
_ = into(&ss.Email, c.Decrypt)
_ = into(&ss.User, c.Decrypt)

for _, s := range []*string{
&ss.PreferredUsername,
&ss.AccessToken,
&ss.IDToken,
&ss.RefreshToken,
} {
err := c.DecryptInto(s)
err := into(s, c.Decrypt)
if err != nil {
return nil, err
}
}
}
return &ss, nil
}

// codecFunc is a function that takes a []byte and encodes/decodes it
type codecFunc func([]byte) ([]byte, error)

func into(s *string, f codecFunc) error {
// Do not encrypt/decrypt nil or empty strings
if s == nil || *s == "" {
return nil
}

d, err := f([]byte(*s))
if err != nil {
return err
}
*s = string(d)
return nil
}
99 changes: 71 additions & 28 deletions pkg/apis/sessions/session_state_test.go
View file
@@ -1,11 +1,13 @@
package sessions_test
package sessions

import (
"crypto/rand"
"fmt"
"io"
mathrand "math/rand"
"testing"
"time"

"github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
"github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"
"github.com/stretchr/testify/assert"
)
Expand All @@ -26,7 +28,7 @@ func TestSessionStateSerialization(t *testing.T) {
assert.Equal(t, nil, err)
c2, err := newTestCipher([]byte(altSecret))
assert.Equal(t, nil, err)
s := &sessions.SessionState{
s := &SessionState{
Email: "user@domain.com",
PreferredUsername: "user",
AccessToken: "token1234",
Expand All @@ -38,7 +40,7 @@ func TestSessionStateSerialization(t *testing.T) {
encoded, err := s.EncodeSessionState(c)
assert.Equal(t, nil, err)

ss, err := sessions.DecodeSessionState(encoded, c)
ss, err := DecodeSessionState(encoded, c)
t.Logf("%#v", ss)
assert.Equal(t, nil, err)
assert.Equal(t, "", ss.User)
Expand All @@ -51,7 +53,7 @@ func TestSessionStateSerialization(t *testing.T) {
assert.Equal(t, s.RefreshToken, ss.RefreshToken)

// ensure a different cipher can't decode properly (ie: it gets gibberish)
ss, err = sessions.DecodeSessionState(encoded, c2)
ss, err = DecodeSessionState(encoded, c2)
t.Logf("%#v", ss)
assert.Equal(t, nil, err)
assert.NotEqual(t, "user@domain.com", ss.User)
Expand All @@ -69,7 +71,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {
assert.Equal(t, nil, err)
c2, err := newTestCipher([]byte(altSecret))
assert.Equal(t, nil, err)
s := &sessions.SessionState{
s := &SessionState{
User: "just-user",
PreferredUsername: "ju",
Email: "user@domain.com",
Expand All @@ -81,7 +83,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {
encoded, err := s.EncodeSessionState(c)
assert.Equal(t, nil, err)

ss, err := sessions.DecodeSessionState(encoded, c)
ss, err := DecodeSessionState(encoded, c)
t.Logf("%#v", ss)
assert.Equal(t, nil, err)
assert.Equal(t, s.User, ss.User)
Expand All @@ -93,7 +95,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {
assert.Equal(t, s.RefreshToken, ss.RefreshToken)

// ensure a different cipher can't decode properly (ie: it gets gibberish)
ss, err = sessions.DecodeSessionState(encoded, c2)
ss, err = DecodeSessionState(encoded, c2)
t.Logf("%#v", ss)
assert.Equal(t, nil, err)
assert.NotEqual(t, s.User, ss.User)
Expand All @@ -106,7 +108,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {
}

func TestSessionStateSerializationNoCipher(t *testing.T) {
s := &sessions.SessionState{
s := &SessionState{
Email: "user@domain.com",
PreferredUsername: "user",
AccessToken: "token1234",
Expand All @@ -118,7 +120,7 @@ func TestSessionStateSerializationNoCipher(t *testing.T) {
assert.Equal(t, nil, err)

// only email should have been serialized
ss, err := sessions.DecodeSessionState(encoded, nil)
ss, err := DecodeSessionState(encoded, nil)
assert.Equal(t, nil, err)
assert.Equal(t, "", ss.User)
assert.Equal(t, s.Email, ss.Email)
Expand All @@ -128,7 +130,7 @@ func TestSessionStateSerializationNoCipher(t *testing.T) {
}

func TestSessionStateSerializationNoCipherWithUser(t *testing.T) {
s := &sessions.SessionState{
s := &SessionState{
User: "just-user",
Email: "user@domain.com",
PreferredUsername: "user",
Expand All @@ -141,7 +143,7 @@ func TestSessionStateSerializationNoCipherWithUser(t *testing.T) {
assert.Equal(t, nil, err)

// only email should have been serialized
ss, err := sessions.DecodeSessionState(encoded, nil)
ss, err := DecodeSessionState(encoded, nil)
assert.Equal(t, nil, err)
assert.Equal(t, s.User, ss.User)
assert.Equal(t, s.Email, ss.Email)
Expand All @@ -151,18 +153,18 @@ func TestSessionStateSerializationNoCipherWithUser(t *testing.T) {
}

func TestExpired(t *testing.T) {
s := &sessions.SessionState{ExpiresOn: timePtr(time.Now().Add(time.Duration(-1) * time.Minute))}
s := &SessionState{ExpiresOn: timePtr(time.Now().Add(time.Duration(-1) * time.Minute))}
assert.Equal(t, true, s.IsExpired())

s = &sessions.SessionState{ExpiresOn: timePtr(time.Now().Add(time.Duration(1) * time.Minute))}
s = &SessionState{ExpiresOn: timePtr(time.Now().Add(time.Duration(1) * time.Minute))}
assert.Equal(t, false, s.IsExpired())

s = &sessions.SessionState{}
s = &SessionState{}
assert.Equal(t, false, s.IsExpired())
}

type testCase struct {
sessions.SessionState
SessionState
Encoded string
Cipher encryption.Cipher
Error bool
Expand All @@ -178,14 +180,14 @@ func TestEncodeSessionState(t *testing.T) {

testCases := []testCase{
{
SessionState: sessions.SessionState{
SessionState: SessionState{
Email: "user@domain.com",
User: "just-user",
},
Encoded: `{"Email":"user@domain.com","User":"just-user"}`,
},
{
SessionState: sessions.SessionState{
SessionState: SessionState{
Email: "user@domain.com",
User: "just-user",
AccessToken: "token1234",
Expand All @@ -200,7 +202,7 @@ func TestEncodeSessionState(t *testing.T) {

for i, tc := range testCases {
encoded, err := tc.EncodeSessionState(tc.Cipher)
t.Logf("i:%d Encoded:%#vsessions.SessionState:%#v Error:%#v", i, encoded, tc.SessionState, err)
t.Logf("i:%d Encoded:%#vSessionState:%#v Error:%#v", i, encoded, tc.SessionState, err)
if tc.Error {
assert.Error(t, err)
assert.Empty(t, encoded)
Expand All @@ -225,34 +227,34 @@ func TestDecodeSessionState(t *testing.T) {

testCases := []testCase{
{
SessionState: sessions.SessionState{
SessionState: SessionState{
Email: "user@domain.com",
User: "just-user",
},
Encoded: `{"Email":"user@domain.com","User":"just-user"}`,
},
{
SessionState: sessions.SessionState{
SessionState: SessionState{
Email: "user@domain.com",
User: "",
},
Encoded: `{"Email":"user@domain.com"}`,
},
{
SessionState: sessions.SessionState{
SessionState: SessionState{
User: "just-user",
},
Encoded: `{"User":"just-user"}`,
},
{
SessionState: sessions.SessionState{
SessionState: SessionState{
Email: "user@domain.com",
User: "just-user",
},
Encoded: fmt.Sprintf(`{"Email":"user@domain.com","User":"just-user","AccessToken":"I6s+ml+/MldBMgHIiC35BTKTh57skGX24w==","IDToken":"xojNdyyjB1HgYWh6XMtXY/Ph5eCVxa1cNsklJw==","RefreshToken":"qEX0x6RmASxo4dhlBG6YuRs9Syn/e9sHu/+K","CreatedAt":%s,"ExpiresOn":%s}`, createdString, eString),
},
{
SessionState: sessions.SessionState{
SessionState: SessionState{
Email: "user@domain.com",
User: "just-user",
AccessToken: "token1234",
Expand All @@ -265,7 +267,7 @@ func TestDecodeSessionState(t *testing.T) {
Cipher: c,
},
{
SessionState: sessions.SessionState{
SessionState: SessionState{
Email: "user@domain.com",
User: "just-user",
},
Expand All @@ -285,8 +287,8 @@ func TestDecodeSessionState(t *testing.T) {
}

for i, tc := range testCases {
ss, err := sessions.DecodeSessionState(tc.Encoded, tc.Cipher)
t.Logf("i:%d Encoded:%#vsessions.SessionState:%#v Error:%#v", i, tc.Encoded, ss, err)
ss, err := DecodeSessionState(tc.Encoded, tc.Cipher)
t.Logf("i:%d Encoded:%#vSessionState:%#v Error:%#v", i, tc.Encoded, ss, err)
if tc.Error {
assert.Error(t, err)
assert.Nil(t, ss)
Expand All @@ -308,7 +310,7 @@ func TestDecodeSessionState(t *testing.T) {
}

func TestSessionStateAge(t *testing.T) {
ss := &sessions.SessionState{}
ss := &SessionState{}

// Created at unset so should be 0
assert.Equal(t, time.Duration(0), ss.Age())
Expand All @@ -317,3 +319,44 @@ func TestSessionStateAge(t *testing.T) {
ss.CreatedAt = timePtr(time.Now().Add(-1 * time.Hour))
assert.Equal(t, time.Hour, ss.Age().Round(time.Minute))
}

func TestIntoEncryptAndIntoDecrypt(t *testing.T) {
const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"

// Test all 3 valid AES sizes
for _, secretSize := range []int{16, 24, 32} {
t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
secret := make([]byte, secretSize)
_, err := io.ReadFull(rand.Reader, secret)
assert.Equal(t, nil, err)

c, err := newTestCipher(secret)
assert.NoError(t, err)

// Check no errors with empty or nil strings
empty := ""
assert.Equal(t, nil, into(&empty, c.Encrypt))
assert.Equal(t, nil, into(&empty, c.Decrypt))
assert.Equal(t, nil, into(nil, c.Encrypt))
assert.Equal(t, nil, into(nil, c.Decrypt))

// Test various sizes tokens might be
for _, dataSize := range []int{10, 100, 1000, 5000, 10000} {
t.Run(fmt.Sprintf("%d", dataSize), func(t *testing.T) {
b := make([]byte, dataSize)
for i := range b {
b[i] = charset[mathrand.Intn(len(charset))]
}
data := string(b)
originalData := data

assert.Equal(t, nil, into(&data, c.Encrypt))
assert.NotEqual(t, originalData, data)

assert.Equal(t, nil, into(&data, c.Decrypt))
assert.Equal(t, originalData, data)
})
}
})
}
}

0 comments on commit 998dc9a

Please sign in to comment.