62 lines
2.9 KiB
Plaintext
62 lines
2.9 KiB
Plaintext
#include "testlib.h"
|
|
|
|
RENDER(Request& context)
|
|
{
|
|
u64 passed = 0;
|
|
u64 failed = 0;
|
|
u64 skipped = 0;
|
|
auto check = [&](String name, bool ok, String detail)
|
|
{
|
|
site_tests_case(name, ok ? "pass" : "fail", detail);
|
|
if(ok) passed++; else failed++;
|
|
};
|
|
site_tests_page_start("Structured crypto operations", "Algorithm-selected P-256 JWK creation and ES256 JWT signing.");
|
|
DValue key_request;
|
|
key_request["operation"] = "key_generate";
|
|
key_request["algorithm"] = "ES256";
|
|
DValue key = crypto_operation(key_request);
|
|
DValue header;
|
|
header["alg"] = "none";
|
|
header["kid"] = key["kid"];
|
|
DValue claims;
|
|
claims["iss"] = "https://client.example";
|
|
claims["sub"] = "client.example";
|
|
DValue sign_request;
|
|
sign_request["operation"] = "jwt_sign";
|
|
sign_request["algorithm"] = "ES256";
|
|
sign_request["private_jwk"] = key["private_jwk"];
|
|
sign_request["protected_header"] = header;
|
|
sign_request["claims"] = claims;
|
|
DValue signed_result = crypto_operation(sign_request);
|
|
String jwt = signed_result["jwt"].to_string();
|
|
StringList parts = split(jwt, ".");
|
|
String header_b64 = parts.size() == 3 ? parts[0] : "";
|
|
while(header_b64.size() % 4) header_b64 += "=";
|
|
String decoded_header = base64_decode(header_b64);
|
|
DValue wrong_curve = key["private_jwk"];
|
|
wrong_curve["crv"] = "P-384";
|
|
DValue malformed = key["private_jwk"];
|
|
malformed["x"] = "not_base64url=";
|
|
DValue wrong_request = sign_request;
|
|
wrong_request["private_jwk"] = wrong_curve;
|
|
DValue malformed_request = sign_request;
|
|
malformed_request["private_jwk"] = malformed;
|
|
DValue unsupported;
|
|
unsupported["operation"] = "encrypt";
|
|
unsupported["algorithm"] = "ES256";
|
|
DValue list_header;
|
|
list_header.set_array();
|
|
DValue list_item;
|
|
list_item = "not-an-object";
|
|
list_header.push(list_item);
|
|
DValue list_request = sign_request;
|
|
list_request["protected_header"] = list_header;
|
|
DValue control_request = sign_request;
|
|
control_request["claims"]["bad"] = String("control\nbyte");
|
|
DValue oversized = key_request;
|
|
oversized["ignored"] = String(17000, 'x');
|
|
check("crypto_operation() ES256 key generation and JWT signing", key["ok"].to_bool() && signed_result["ok"].to_bool() && key["private_jwk"]["kty"].to_string() == "EC" && key["private_jwk"]["crv"].to_string() == "P-256" && key["public_jwk"]["d"].to_string() == "" && key["kid"].to_string() == key["thumbprint"].to_string() && parts.size() == 3 && parts[2].size() == 86 && decoded_header.find("ES256") != String::npos && !crypto_operation(wrong_request)["ok"].to_bool() && !crypto_operation(malformed_request)["ok"].to_bool() && crypto_operation(unsupported)["error"].to_string() == "unsupported_operation" && !crypto_operation(list_request)["ok"].to_bool() && crypto_operation(control_request)["error"].to_string() == "invalid_request" && crypto_operation(oversized)["error"].to_string() == "invalid_request", key["kid"].to_string());
|
|
site_tests_summary(passed, failed, skipped, "Structured crypto tests generate ephemeral P-256 keys and retain no key material.");
|
|
site_tests_page_end();
|
|
}
|