| /* Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include <assert.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| |
| #include "apr_jose.h" |
| |
| #include "abts.h" |
| #include "testutil.h" |
| |
| |
| static apr_status_t sign_cb(apr_bucket_brigade *bb, apr_jose_t *jose, |
| apr_jose_signature_t *signature, void *ctx, apr_pool_t *pool) |
| { |
| abts_case *tc = ctx; |
| apr_json_kv_t *alg = NULL; |
| |
| if (signature) { |
| apr_json_value_t *ph = signature->protected_header; |
| |
| ABTS_INT_EQUAL(tc, APR_JSON_OBJECT, ph->type); |
| |
| if (ph->type == APR_JSON_OBJECT) { |
| alg = apr_json_object_get(ph, APR_JOSE_JWKSE_ALGORITHM, |
| APR_JSON_VALUE_STRING); |
| } |
| } |
| |
| if (alg) { |
| |
| ABTS_INT_EQUAL(tc, APR_JSON_STRING, alg->v->type); |
| |
| /* unsecured jws/jwt */ |
| if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "none", |
| alg->v->value.string.len)) { |
| |
| signature->sig.data = (unsigned const char *) ""; |
| signature->sig.len = 0; |
| |
| return APR_SUCCESS; |
| } |
| |
| /* hs256 jws - https://tools.ietf.org/html/rfc7515#appendix-A.1 */ |
| else if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "HS256", |
| alg->v->value.string.len)) { |
| |
| const unsigned char hs256[] = { 116, 24, 223, 180, 151, 153, 224, |
| 37, 79, 250, 96, 125, 216, 173, 187, 186, 22, 212, 37, 77, |
| 105, 214, 191, 240, 91, 88, 5, 88, 83, 132, 141, 121 }; |
| signature->sig.data = apr_pmemdup(p, hs256, sizeof(hs256)); |
| signature->sig.len = sizeof(hs256); |
| |
| return APR_SUCCESS; |
| } |
| |
| /* rs256 jws - https://tools.ietf.org/html/rfc7515#appendix-A.2 */ |
| else if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "RS256", |
| alg->v->value.string.len)) { |
| |
| const unsigned char rs256[] = { 112, 46, 33, 137, 67, 232, 143, 209, |
| 30, 181, 216, 45, 191, 120, 69, 243, 65, 6, 174, 27, 129, |
| 255, 247, 115, 17, 22, 173, 209, 113, 125, 131, 101, 109, |
| 66, 10, 253, 60, 150, 238, 221, 115, 162, 102, 62, 81, 102, |
| 104, 123, 0, 11, 135, 34, 110, 1, 135, 237, 16, 115, 249, |
| 69, 229, 130, 173, 252, 239, 22, 216, 90, 121, 142, 232, |
| 198, 109, 219, 61, 184, 151, 91, 23, 208, 148, 2, 190, 237, |
| 213, 217, 217, 112, 7, 16, 141, 178, 129, 96, 213, 248, 4, |
| 12, 167, 68, 87, 98, 184, 31, 190, 127, 249, 217, 46, 10, |
| 231, 111, 36, 242, 91, 51, 187, 230, 244, 74, 230, 30, 177, |
| 4, 10, 203, 32, 4, 77, 62, 249, 18, 142, 212, 1, 48, 121, |
| 91, 212, 189, 59, 65, 238, 202, 208, 102, 171, 101, 25, 129, |
| 253, 228, 141, 247, 127, 55, 45, 195, 139, 159, 175, 221, |
| 59, 239, 177, 139, 93, 163, 204, 60, 46, 176, 47, 158, 58, |
| 65, 214, 18, 202, 173, 21, 145, 18, 115, 160, 95, 35, 185, |
| 232, 56, 250, 175, 132, 157, 105, 132, 41, 239, 90, 30, 136, |
| 121, 130, 54, 195, 212, 14, 96, 69, 34, 165, 68, 200, 242, |
| 122, 122, 45, 184, 6, 99, 209, 108, 247, 202, 234, 86, 222, |
| 64, 92, 178, 33, 90, 69, 178, 194, 85, 102, 181, 90, 193, |
| 167, 72, 160, 112, 223, 200, 163, 42, 70, 149, 67, 208, 25, |
| 238, 251, 71 }; |
| signature->sig.data = apr_pmemdup(p, rs256, sizeof(rs256)); |
| signature->sig.len = sizeof(rs256); |
| |
| return APR_SUCCESS; |
| } |
| |
| /* es256 jws - https://tools.ietf.org/html/rfc7515#appendix-A.3 */ |
| else if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "ES256", |
| alg->v->value.string.len)) { |
| |
| const unsigned char es256[] = { 14, 209, 33, 83, 121, 99, 108, 72, |
| 60, 47, 127, 21, 88, 7, 212, 2, 163, 178, 40, 3, 58, 249, |
| 124, 126, 23, 129, 154, 195, 22, 158, 166, 101, 197, 10, 7, |
| 211, 140, 60, 112, 229, 216, 241, 45, 175, 8, 74, 84, 128, |
| 166, 101, 144, 197, 242, 147, 80, 154, 143, 63, 127, 138, |
| 131, 163, 84, 213 }; |
| signature->sig.data = apr_pmemdup(p, es256, sizeof(es256)); |
| signature->sig.len = sizeof(es256); |
| |
| return APR_SUCCESS; |
| } |
| |
| else { |
| apr_errprintf(&jose->result, jose->pool, NULL, 0, |
| "Header 'alg' not recognised: %.*s", |
| (int) alg->v->value.string.len, alg->v->value.string.p); |
| return APR_ENOTIMPL; |
| } |
| |
| } |
| |
| else { |
| apr_errprintf(&jose->result, jose->pool, NULL, 0, |
| "Header 'alg' missing"); |
| return APR_ENOTIMPL; |
| } |
| |
| return APR_ENOTIMPL; |
| } |
| |
| static apr_status_t verify_cb(apr_bucket_brigade *bb, |
| apr_jose_t *jose, apr_jose_signature_t *signature, void *ctx, |
| int *vflags, apr_pool_t *pool) |
| { |
| abts_case *tc = ctx; |
| apr_json_kv_t *alg = NULL; |
| |
| *vflags = APR_JOSE_FLAG_NONE; |
| |
| if (signature) { |
| apr_json_value_t *ph = signature->protected_header; |
| |
| ABTS_INT_EQUAL(tc, APR_JSON_OBJECT, ph->type); |
| |
| alg = apr_json_object_get(ph, APR_JOSE_JWKSE_ALGORITHM, |
| APR_JSON_VALUE_STRING); |
| } |
| |
| if (alg) { |
| |
| ABTS_INT_EQUAL(tc, APR_JSON_STRING, alg->v->type); |
| |
| /* unsecured jws/jwt */ |
| if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "none", |
| alg->v->value.string.len)) { |
| |
| if (!memcmp(signature->sig.data, (unsigned const char *) "", |
| signature->sig.len)) { |
| return APR_SUCCESS; |
| } |
| } |
| |
| /* hs256 jws - https://tools.ietf.org/html/rfc7515#appendix-A.1 */ |
| else if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "HS256", |
| alg->v->value.string.len)) { |
| |
| const unsigned char hs256[] = { 116, 24, 223, 180, 151, 153, 224, |
| 37, 79, 250, 96, 125, 216, 173, 187, 186, 22, 212, 37, 77, |
| 105, 214, 191, 240, 91, 88, 5, 88, 83, 132, 141, 121 }; |
| |
| if (!memcmp(signature->sig.data, hs256, sizeof(hs256))) { |
| return APR_SUCCESS; |
| } |
| |
| } |
| |
| /* rs256 jws - https://tools.ietf.org/html/rfc7515#appendix-A.2 */ |
| else if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "RS256", |
| alg->v->value.string.len)) { |
| |
| const unsigned char rs256[] = { 112, 46, 33, 137, 67, 232, 143, 209, |
| 30, 181, 216, 45, 191, 120, 69, 243, 65, 6, 174, 27, 129, |
| 255, 247, 115, 17, 22, 173, 209, 113, 125, 131, 101, 109, |
| 66, 10, 253, 60, 150, 238, 221, 115, 162, 102, 62, 81, 102, |
| 104, 123, 0, 11, 135, 34, 110, 1, 135, 237, 16, 115, 249, |
| 69, 229, 130, 173, 252, 239, 22, 216, 90, 121, 142, 232, |
| 198, 109, 219, 61, 184, 151, 91, 23, 208, 148, 2, 190, 237, |
| 213, 217, 217, 112, 7, 16, 141, 178, 129, 96, 213, 248, 4, |
| 12, 167, 68, 87, 98, 184, 31, 190, 127, 249, 217, 46, 10, |
| 231, 111, 36, 242, 91, 51, 187, 230, 244, 74, 230, 30, 177, |
| 4, 10, 203, 32, 4, 77, 62, 249, 18, 142, 212, 1, 48, 121, |
| 91, 212, 189, 59, 65, 238, 202, 208, 102, 171, 101, 25, 129, |
| 253, 228, 141, 247, 127, 55, 45, 195, 139, 159, 175, 221, |
| 59, 239, 177, 139, 93, 163, 204, 60, 46, 176, 47, 158, 58, |
| 65, 214, 18, 202, 173, 21, 145, 18, 115, 160, 95, 35, 185, |
| 232, 56, 250, 175, 132, 157, 105, 132, 41, 239, 90, 30, 136, |
| 121, 130, 54, 195, 212, 14, 96, 69, 34, 165, 68, 200, 242, |
| 122, 122, 45, 184, 6, 99, 209, 108, 247, 202, 234, 86, 222, |
| 64, 92, 178, 33, 90, 69, 178, 194, 85, 102, 181, 90, 193, |
| 167, 72, 160, 112, 223, 200, 163, 42, 70, 149, 67, 208, 25, |
| 238, 251, 71 }; |
| |
| if (!memcmp(signature->sig.data, rs256, sizeof(rs256))) { |
| return APR_SUCCESS; |
| } |
| |
| } |
| |
| /* es256 jws - https://tools.ietf.org/html/rfc7515#appendix-A.3 */ |
| else if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "ES256", |
| alg->v->value.string.len)) { |
| |
| const unsigned char es256[] = { 14, 209, 33, 83, 121, 99, 108, 72, |
| 60, 47, 127, 21, 88, 7, 212, 2, 163, 178, 40, 3, 58, 249, |
| 124, 126, 23, 129, 154, 195, 22, 158, 166, 101, 197, 10, 7, |
| 211, 140, 60, 112, 229, 216, 241, 45, 175, 8, 74, 84, 128, |
| 166, 101, 144, 197, 242, 147, 80, 154, 143, 63, 127, 138, |
| 131, 163, 84, 213 }; |
| |
| if (!memcmp(signature->sig.data, es256, sizeof(es256))) { |
| return APR_SUCCESS; |
| } |
| |
| return APR_SUCCESS; |
| } |
| |
| else { |
| apr_errprintf(&jose->result, jose->pool, NULL, 0, |
| "Header 'alg' not recognised: %.*s", |
| (int) alg->v->value.string.len, alg->v->value.string.p); |
| return APR_ENOTIMPL; |
| } |
| |
| } |
| |
| else { |
| apr_errprintf(&jose->result, jose->pool, NULL, 0, |
| "Header 'alg' missing"); |
| return APR_ENOTIMPL; |
| } |
| |
| return APR_ENOTIMPL; |
| } |
| |
| static apr_status_t encrypt_cb(apr_bucket_brigade *brigade, apr_jose_t *jose, |
| apr_jose_recipient_t *recipient, apr_jose_encryption_t *encryption, |
| void *ctx, apr_pool_t *p) |
| { |
| abts_case *tc = ctx; |
| apr_json_value_t *protected_header; |
| apr_json_value_t *header; |
| apr_json_kv_t *alg = NULL; |
| |
| if (encryption) { |
| |
| if (encryption->protected) { |
| |
| protected_header = encryption->protected; |
| if (protected_header) { |
| |
| char buf[1024]; |
| apr_size_t len = sizeof(buf); |
| |
| apr_bucket_brigade *bb = apr_brigade_create(p, |
| brigade->bucket_alloc); |
| |
| apr_json_encode(bb, NULL, NULL, protected_header, |
| APR_JSON_FLAGS_WHITESPACE, p); |
| |
| apr_brigade_flatten(bb, buf, &len); |
| |
| /* RSAES-OAEP and AES GCM jwe - https://tools.ietf.org/html/rfc7516#appendix-A.1 */ |
| if (!strncmp("{\"alg\":\"RSA-OAEP\",\"enc\":\"A256GCM\"}", buf, len)) { |
| |
| const unsigned char iv[] = { 227, 197, 117, 252, 2, 219, 233, |
| 68, 180, 225, 77, 219 }; |
| |
| const unsigned char aad[] = { 101, 121, 74, 104, 98, 71, 99, |
| 105, 79, 105, 74, 83, 85, 48, 69, 116, 84, 48, 70, 70, |
| 85, 67, 73, 115, 73, 109, 86, 117, 89, 121, 73, 54, 73, |
| 107, 69, 121, 78, 84, 90, 72, 81, 48, 48, 105, 102, 81 }; |
| |
| const unsigned char cipher[] = { 229, 236, 166, 241, 53, 191, |
| 115, 196, 174, 43, 73, 109, 39, 122, 233, 96, 140, 206, |
| 120, 52, 51, 237, 48, 11, 190, 219, 186, 80, 111, 104, |
| 50, 142, 47, 167, 59, 61, 181, 127, 196, 21, 40, 82, |
| 242, 32, 123, 143, 168, 226, 73, 216, 176, 144, 138, |
| 247, 106, 60, 16, 205, 160, 109, 64, 63, 192 }; |
| |
| const unsigned char tag[] = { 92, 80, 104, 49, 133, 25, 161, |
| 215, 173, 101, 219, 211, 136, 91, 210, 145 }; |
| |
| encryption->iv.data = apr_pmemdup(p, iv, sizeof(iv)); |
| encryption->iv.len = sizeof(iv); |
| |
| encryption->aad.data = apr_pmemdup(p, aad, sizeof(aad)); |
| encryption->aad.len = sizeof(aad); |
| |
| encryption->cipher.data = apr_pmemdup(p, cipher, sizeof(cipher)); |
| encryption->cipher.len = sizeof(cipher); |
| |
| encryption->tag.data = apr_pmemdup(p, tag, sizeof(tag)); |
| encryption->tag.len = sizeof(tag); |
| |
| } |
| |
| /* RSAES-PKCS1-v1_5 - https://tools.ietf.org/html/rfc7516#appendix-A.2 */ |
| else if (!strncmp("{\"alg\":\"RSA1_5\",\"enc\":\"A128CBC-HS256\"}", buf, len)) { |
| |
| const unsigned char iv[] = { 3, 22, 60, 12, 43, 67, 104, 105, |
| 108, 108, 105, 99, 111, 116, 104, 101 }; |
| |
| const unsigned char cipher[] = { 40, 57, 83, 181, 119, 33, 133, |
| 148, 198, 185, 243, 24, 152, 230, 6, 75, 129, 223, 127, |
| 19, 210, 82, 183, 230, 168, 33, 215, 104, 143, 112, 56, |
| 102 }; |
| |
| const unsigned char tag[] = { 246, 17, 244, 190, 4, 95, 98, 3, |
| 231, 0, 115, 157, 242, 203, 100, 191 }; |
| |
| encryption->iv.data = apr_pmemdup(p, iv, sizeof(iv)); |
| encryption->iv.len = sizeof(iv); |
| |
| encryption->cipher.data = apr_pmemdup(p, cipher, sizeof(cipher)); |
| encryption->cipher.len = sizeof(cipher); |
| |
| encryption->tag.data = apr_pmemdup(p, tag, sizeof(tag)); |
| encryption->tag.len = sizeof(tag); |
| |
| } |
| |
| /* A128KW A128CBC-HS256 - https://tools.ietf.org/html/rfc7516#appendix-A.3 */ |
| else if (!strncmp("{\"alg\":\"A128KW\",\"enc\":\"A128CBC-HS256\"}", buf, len)) { |
| |
| const unsigned char iv[] = { 3, 22, 60, 12, 43, 67, 104, 105, |
| 108, 108, 105, 99, 111, 116, 104, 101 }; |
| |
| const unsigned char cipher[] = { 40, 57, 83, 181, 119, 33, 133, |
| 148, 198, 185, 243, 24, 152, 230, 6, 75, 129, 223, 127, |
| 19, 210, 82, 183, 230, 168, 33, 215, 104, 143, 112, 56, |
| 102 }; |
| |
| const unsigned char tag[] = { 83, 73, 191, 98, 104, 205, 211, |
| 128, 201, 189, 199, 133, 32, 38, 194, 85 }; |
| |
| encryption->iv.data = apr_pmemdup(p, iv, sizeof(iv)); |
| encryption->iv.len = sizeof(iv); |
| |
| encryption->cipher.data = apr_pmemdup(p, cipher, sizeof(cipher)); |
| encryption->cipher.len = sizeof(cipher); |
| |
| encryption->tag.data = apr_pmemdup(p, tag, sizeof(tag)); |
| encryption->tag.len = sizeof(tag); |
| |
| } |
| |
| /* General JWE JSON - https://tools.ietf.org/html/rfc7516#appendix-A.4 */ |
| else if (!strncmp("{\"enc\":\"A128CBC-HS256\"}", buf, len)) { |
| |
| const unsigned char iv[] = { 3, 22, 60, 12, 43, 67, 104, 105, |
| 108, 108, 105, 99, 111, 116, 104, 101 }; |
| |
| const unsigned char cipher[] = { 40, 57, 83, 181, 119, 33, 133, |
| 148, 198, 185, 243, 24, 152, 230, 6, 75, 129, 223, 127, |
| 19, 210, 82, 183, 230, 168, 33, 215, 104, 143, 112, 56, |
| 102 }; |
| |
| const unsigned char tag[] = { 51, 63, 149, 60, 252, 148, |
| 225, 25, 92, 185, 139, 245, 35, 2, 47, 207 }; |
| |
| encryption->iv.data = apr_pmemdup(p, iv, sizeof(iv)); |
| encryption->iv.len = sizeof(iv); |
| |
| encryption->cipher.data = apr_pmemdup(p, cipher, sizeof(cipher)); |
| encryption->cipher.len = sizeof(cipher); |
| |
| encryption->tag.data = apr_pmemdup(p, tag, sizeof(tag)); |
| encryption->tag.len = sizeof(tag); |
| |
| } |
| |
| else { |
| apr_errprintf(&jose->result, jose->pool, NULL, 0, |
| "Protected header not recognised: %.*s", (int)len, buf); |
| return APR_ENOTIMPL; |
| } |
| |
| |
| } |
| } |
| |
| |
| if (recipient) { |
| header = recipient->header; |
| if (header) { |
| |
| ABTS_INT_EQUAL(tc, APR_JSON_OBJECT, header->type); |
| |
| alg = apr_json_object_get(header, APR_JOSE_JWKSE_ALGORITHM, |
| APR_JSON_VALUE_STRING); |
| } |
| } |
| |
| if (!alg) { |
| protected_header = encryption->protected; |
| if (protected_header) { |
| |
| ABTS_INT_EQUAL(tc, APR_JSON_OBJECT, protected_header->type); |
| |
| alg = apr_json_object_get(protected_header, |
| APR_JOSE_JWKSE_ALGORITHM, APR_JSON_VALUE_STRING); |
| } |
| } |
| |
| if (alg && recipient) { |
| |
| ABTS_INT_EQUAL(tc, APR_JSON_STRING, alg->v->type); |
| |
| /* RSAES-OAEP and AES GCM jwe - https://tools.ietf.org/html/rfc7516#appendix-A.1 */ |
| if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "RSA-OAEP", |
| alg->v->value.string.len)) { |
| |
| const unsigned char ekey[] = { 56, 163, 154, 192, 58, 53, 222, |
| 4, 105, 218, 136, 218, 29, 94, 203, 22, 150, 92, 129, |
| 94, 211, 232, 53, 89, 41, 60, 138, 56, 196, 216, 82, 98, |
| 168, 76, 37, 73, 70, 7, 36, 8, 191, 100, 136, 196, 244, |
| 220, 145, 158, 138, 155, 4, 117, 141, 230, 199, 247, |
| 173, 45, 182, 214, 74, 177, 107, 211, 153, 11, 205, 196, |
| 171, 226, 162, 128, 171, 182, 13, 237, 239, 99, 193, 4, |
| 91, 219, 121, 223, 107, 167, 61, 119, 228, 173, 156, |
| 137, 134, 200, 80, 219, 74, 253, 56, 185, 91, 177, 34, |
| 158, 89, 154, 205, 96, 55, 18, 138, 43, 96, 218, 215, |
| 128, 124, 75, 138, 243, 85, 25, 109, 117, 140, 26, 155, |
| 249, 67, 167, 149, 231, 100, 6, 41, 65, 214, 251, 232, |
| 87, 72, 40, 182, 149, 154, 168, 31, 193, 126, 215, 89, |
| 28, 111, 219, 125, 182, 139, 235, 195, 197, 23, 234, 55, |
| 58, 63, 180, 68, 202, 206, 149, 75, 205, 248, 176, 67, |
| 39, 178, 60, 98, 193, 32, 238, 122, 96, 158, 222, 57, |
| 183, 111, 210, 55, 188, 215, 206, 180, 166, 150, 166, |
| 106, 250, 55, 229, 72, 40, 69, 214, 216, 104, 23, 40, |
| 135, 212, 28, 127, 41, 80, 175, 174, 168, 115, 171, 197, |
| 89, 116, 92, 103, 246, 83, 216, 182, 176, 84, 37, 147, |
| 35, 45, 219, 172, 99, 226, 233, 73, 37, 124, 42, 72, 49, |
| 242, 35, 127, 184, 134, 117, 114, 135, 206 }; |
| |
| recipient->ekey.data = apr_pmemdup(p, ekey, sizeof(ekey)); |
| recipient->ekey.len = sizeof(ekey); |
| |
| return APR_SUCCESS; |
| } |
| |
| /* RSAES-PKCS1-v1_5 - https://tools.ietf.org/html/rfc7516#appendix-A.2 */ |
| if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "RSA1_5", |
| alg->v->value.string.len)) { |
| |
| const unsigned char ekey[] = { 80, 104, 72, 58, 11, 130, 236, |
| 139, 132, 189, 255, 205, 61, 86, 151, 176, 99, 40, 44, |
| 233, 176, 189, 205, 70, 202, 169, 72, 40, 226, 181, 156, |
| 223, 120, 156, 115, 232, 150, 209, 145, 133, 104, 112, |
| 237, 156, 116, 250, 65, 102, 212, 210, 103, 240, 177, |
| 61, 93, 40, 71, 231, 223, 226, 240, 157, 15, 31, 150, |
| 89, 200, 215, 198, 203, 108, 70, 117, 66, 212, 238, 193, |
| 205, 23, 161, 169, 218, 243, 203, 128, 214, 127, 253, |
| 215, 139, 43, 17, 135, 103, 179, 220, 28, 2, 212, 206, |
| 131, 158, 128, 66, 62, 240, 78, 186, 141, 125, 132, 227, |
| 60, 137, 43, 31, 152, 199, 54, 72, 34, 212, 115, 11, |
| 152, 101, 70, 42, 219, 233, 142, 66, 151, 250, 126, 146, |
| 141, 216, 190, 73, 50, 177, 146, 5, 52, 247, 28, 197, |
| 21, 59, 170, 247, 181, 89, 131, 241, 169, 182, 246, 99, |
| 15, 36, 102, 166, 182, 172, 197, 136, 230, 120, 60, 58, |
| 219, 243, 149, 94, 222, 150, 154, 194, 110, 227, 225, |
| 112, 39, 89, 233, 112, 207, 211, 241, 124, 174, 69, 221, |
| 179, 107, 196, 225, 127, 167, 112, 226, 12, 242, 16, 24, |
| 28, 120, 182, 244, 213, 244, 153, 194, 162, 69, 160, |
| 244, 248, 63, 165, 141, 4, 207, 249, 193, 79, 131, 0, |
| 169, 233, 127, 167, 101, 151, 125, 56, 112, 111, 248, |
| 29, 232, 90, 29, 147, 110, 169, 146, 114, 165, 204, 71, |
| 136, 41, 252 }; |
| |
| recipient->ekey.data = apr_pmemdup(p, ekey, sizeof(ekey)); |
| recipient->ekey.len = sizeof(ekey); |
| |
| return APR_SUCCESS; |
| } |
| |
| /* A128KW A128CBC-HS256 - https://tools.ietf.org/html/rfc7516#appendix-A.3 */ |
| if (alg->v->type == APR_JSON_STRING |
| && !strncmp(alg->v->value.string.p, "A128KW", |
| alg->v->value.string.len)) { |
| |
| const unsigned char ekey[] = { 232, 160, 123, 211, 183, 76, 245, |
| 132, 200, 128, 123, 75, 190, 216, 22, 67, 201, 138, 193, |
| 186, 9, 91, 122, 31, 246, 90, 28, 139, 57, 3, 76, 124, |
| 193, 11, 98, 37, 173, 61, 104, 57 }; |
| |
| recipient->ekey.data = apr_pmemdup(p, ekey, sizeof(ekey)); |
| recipient->ekey.len = sizeof(ekey); |
| |
| return APR_SUCCESS; |
| } |
| |
| } |
| } |
| |
| return APR_ENOTIMPL; |
| } |
| |
| static apr_status_t decrypt_cb(apr_bucket_brigade *brigade, apr_jose_t *jose, |
| apr_jose_recipient_t *recipient, apr_jose_encryption_t *encryption, |
| apr_json_value_t *header, apr_jose_text_t *ph64, apr_jose_text_t *aad64, |
| void *ctx, int *dflags, apr_pool_t *pool) |
| { |
| |
| *dflags = APR_JOSE_FLAG_NONE; |
| |
| if (encryption && recipient && header) { |
| |
| char buf[1024]; |
| apr_size_t len = sizeof(buf); |
| |
| apr_bucket_brigade *bb = apr_brigade_create(p, |
| brigade->bucket_alloc); |
| |
| apr_json_encode(bb, NULL, NULL, header, |
| APR_JSON_FLAGS_WHITESPACE, p); |
| |
| apr_brigade_flatten(bb, buf, &len); |
| |
| /* RSAES-OAEP and AES GCM jwe - https://tools.ietf.org/html/rfc7516#appendix-A.1 */ |
| if (!strncmp("{\"alg\":\"RSA-OAEP\",\"enc\":\"A256GCM\"}", buf, len)) { |
| |
| const char plaintext[] = { 84, 104, 101, 32, 116, 114, 117, |
| 101, 32, 115, 105, 103, 110, 32, 111, 102, 32, 105, 110, |
| 116, 101, 108, 108, 105, 103, 101, 110, 99, 101, 32, 105, |
| 115, 32, 110, 111, 116, 32, 107, 110, 111, 119, 108, 101, |
| 100, 103, 101, 32, 98, 117, 116, 32, 105, 109, 97, 103, 105, |
| 110, 97, 116, 105, 111, 110, 46 }; |
| |
| apr_brigade_write(brigade, NULL, NULL, plaintext, sizeof(plaintext)); |
| |
| return APR_SUCCESS; |
| } |
| |
| /* RSAES-PKCS1-v1_5 - https://tools.ietf.org/html/rfc7516#appendix-A.2 */ |
| else if (!strncmp("{\"jku\":\"https://server.example.com/keys.jwks\",\"enc\":\"A128CBC-HS256\",\"alg\":\"RSA1_5\",\"kid\":\"2011-04-29\"}", buf, len)) { |
| |
| const char plaintext[] = { 76, 105, 118, 101, 32, 108, 111, 110, |
| 103, 32, 97, 110, 100, 32, 112, 114, 111, 115, 112, 101, |
| 114, 46 }; |
| |
| apr_brigade_write(brigade, NULL, NULL, plaintext, sizeof(plaintext)); |
| |
| return APR_SUCCESS; |
| } |
| |
| /* Flattened JWE JSON - https://tools.ietf.org/html/rfc7516#appendix-A.5 */ |
| else if (!strncmp("{\"jku\":\"https://server.example.com/keys.jwks\",\"enc\":\"A128CBC-HS256\",\"alg\":\"A128KW\",\"kid\":\"7\"}", buf, len)) { |
| |
| const char plaintext[] = { 76, 105, 118, 101, 32, 108, 111, 110, |
| 103, 32, 97, 110, 100, 32, 112, 114, 111, 115, 112, 101, |
| 114, 46 }; |
| |
| apr_brigade_write(brigade, NULL, NULL, plaintext, sizeof(plaintext)); |
| |
| return APR_SUCCESS; |
| } |
| |
| |
| else { |
| apr_errprintf(&jose->result, pool, NULL, 0, |
| "Header not recognised: %.*s", (int)len, buf); |
| return APR_ENOTIMPL; |
| } |
| |
| } |
| |
| return APR_ENOTIMPL; |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7515#appendix-A.5 |
| */ |
| static void test_jose_encode_jws_compact_unsecured(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_jose_t *jdata; |
| apr_jose_signature_t signature; |
| char buf[1024]; |
| apr_size_t len = sizeof(buf); |
| apr_off_t offset; |
| apr_status_t status; |
| |
| const char *ph = "{\"alg\":\"none\"}"; |
| const unsigned char pl[] = {123, 34, 105, 115, 115, 34, 58, 34, 106, 111, 101, 34, 44, 13, 10, |
| 32, 34, 101, 120, 112, 34, 58, 49, 51, 48, 48, 56, 49, 57, 51, 56, |
| 48, 44, 13, 10, 32, 34, 104, 116, 116, 112, 58, 47, 47, 101, 120, 97, |
| 109, 112, 108, 101, 46, 99, 111, 109, 47, 105, 115, 95, 114, 111, |
| 111, 116, 34, 58, 116, 114, 117, 101, 125}; |
| const char *expect = "eyJhbGciOiJub25lIn0" |
| "." |
| "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt" |
| "cGxlLmNvbS9pc19yb290Ijp0cnVlfQ" |
| "."; |
| |
| apr_jose_cb_t cb; |
| |
| cb.sign = sign_cb; |
| cb.ctx = tc; |
| |
| signature.header = NULL; |
| apr_json_decode(&signature.protected_header, ph, APR_JSON_VALUE_STRING, &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| jdata = apr_jose_data_make(NULL, "JWT", pl, sizeof(pl), p); |
| jose = apr_jose_jws_make(NULL, &signature, NULL, jdata, p); |
| |
| status = apr_jose_encode(bb, NULL, NULL, jose, &cb, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| |
| apr_brigade_flatten(bb, buf, &len); |
| ABTS_STR_NEQUAL(tc, expect, buf, len); |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7515#appendix-A.1 |
| */ |
| static void test_jose_encode_jws_compact_hs256(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_jose_t *jdata; |
| apr_jose_signature_t signature; |
| char buf[1024]; |
| apr_size_t len = sizeof(buf); |
| apr_off_t offset; |
| apr_status_t status; |
| |
| const unsigned char ph[] = { 123, 34, 116, 121, 112, 34, 58, 34, 74, 87, 84, |
| 34, 44, 13, 10, 32, 34, 97, 108, 103, 34, 58, 34, 72, 83, 50, 53, |
| 54, 34, 125 }; |
| |
| const unsigned char pl[] = {123, 34, 105, 115, 115, 34, 58, 34, 106, 111, 101, 34, 44, 13, 10, |
| 32, 34, 101, 120, 112, 34, 58, 49, 51, 48, 48, 56, 49, 57, 51, 56, |
| 48, 44, 13, 10, 32, 34, 104, 116, 116, 112, 58, 47, 47, 101, 120, 97, |
| 109, 112, 108, 101, 46, 99, 111, 109, 47, 105, 115, 95, 114, 111, |
| 111, 116, 34, 58, 116, 114, 117, 101, 125}; |
| const char *expect = "eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9" |
| "." |
| "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt" |
| "cGxlLmNvbS9pc19yb290Ijp0cnVlfQ" |
| "." |
| "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.sign = sign_cb; |
| cb.ctx = tc; |
| |
| signature.header = NULL; |
| apr_json_decode(&signature.protected_header, (const char *) ph, sizeof(ph), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| jdata = apr_jose_data_make(NULL, "JWT", pl, sizeof(pl), p); |
| jose = apr_jose_jws_make(NULL, &signature, NULL, jdata, p); |
| |
| status = apr_jose_encode(bb, NULL, NULL, jose, &cb, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| |
| apr_brigade_flatten(bb, buf, &len); |
| ABTS_STR_NEQUAL(tc, expect, buf, len); |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7515#appendix-A.6 |
| */ |
| static void test_jose_encode_jws_json_general(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_jose_t *jdata; |
| apr_jose_signature_t **signature; |
| apr_jose_signature_t signature1; |
| apr_jose_signature_t signature2; |
| apr_array_header_t *signatures = apr_array_make(p, 2, |
| sizeof(apr_jose_signature_t *)); |
| char buf[1024]; |
| apr_size_t len = sizeof(buf); |
| apr_off_t offset; |
| apr_status_t status; |
| |
| const unsigned char pl[] = { 123, 34, 105, 115, 115, 34, 58, 34, 106, 111, |
| 101, 34, 44, 13, 10, 32, 34, 101, 120, 112, 34, 58, 49, 51, 48, 48, |
| 56, 49, 57, 51, 56, 48, 44, 13, 10, 32, 34, 104, 116, 116, 112, 58, |
| 47, 47, 101, 120, 97, 109, 112, 108, 101, 46, 99, 111, 109, 47, 105, |
| 115, 95, 114, 111, 111, 116, 34, 58, 116, 114, 117, 101, 125 }; |
| |
| const char *s1h = "{\"kid\":\"2010-12-29\"}"; |
| const char *s1ph = "{\"alg\":\"RS256\"}"; |
| const char *s2h = "{\"kid\":\"e9bc097a-ce51-4036-9562-d2ade882db0d\"}"; |
| const char *s2ph = "{\"alg\":\"ES256\"}"; |
| |
| const char *expect = "{" |
| "\"payload\":" |
| "\"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF" |
| "tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ\"," |
| "\"signatures\":[" |
| "{\"protected\":\"eyJhbGciOiJSUzI1NiJ9\"," |
| "\"header\":" |
| "{\"kid\":\"2010-12-29\"}," |
| "\"signature\":" |
| "\"cC4hiUPoj9Eetdgtv3hF80EGrhuB__dzERat0XF9g2VtQgr9PJbu3XOiZj5RZ" |
| "mh7AAuHIm4Bh-0Qc_lF5YKt_O8W2Fp5jujGbds9uJdbF9CUAr7t1dnZcAcQjb" |
| "KBYNX4BAynRFdiuB--f_nZLgrnbyTyWzO75vRK5h6xBArLIARNPvkSjtQBMHl" |
| "b1L07Qe7K0GarZRmB_eSN9383LcOLn6_dO--xi12jzDwusC-eOkHWEsqtFZES" |
| "c6BfI7noOPqvhJ1phCnvWh6IeYI2w9QOYEUipUTI8np6LbgGY9Fs98rqVt5AX" |
| "LIhWkWywlVmtVrBp0igcN_IoypGlUPQGe77Rw\"}," |
| "{\"protected\":\"eyJhbGciOiJFUzI1NiJ9\"," |
| "\"header\":" |
| "{\"kid\":\"e9bc097a-ce51-4036-9562-d2ade882db0d\"}," |
| "\"signature\":" |
| "\"DtEhU3ljbEg8L38VWAfUAqOyKAM6-Xx-F4GawxaepmXFCgfTjDxw5djxLa8IS" |
| "lSApmWQxfKTUJqPP3-Kg6NU1Q\"}]" |
| "}"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.sign = sign_cb; |
| cb.ctx = tc; |
| |
| apr_json_decode(&signature1.header, (const char *) s1h, strlen(s1h), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| apr_json_decode(&signature1.protected_header, (const char *) s1ph, strlen(s1ph), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| apr_json_decode(&signature2.header, (const char *) s2h, strlen(s2h), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| apr_json_decode(&signature2.protected_header, (const char *) s2ph, strlen(s2ph), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| |
| signature = apr_array_push(signatures); |
| *signature = &signature1; |
| signature = apr_array_push(signatures); |
| *signature = &signature2; |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| jdata = apr_jose_data_make(NULL, "JWT", pl, sizeof(pl), p); |
| jose = apr_jose_jws_json_make(NULL, NULL, signatures, jdata, p); |
| |
| status = apr_jose_encode(bb, NULL, NULL, jose, &cb, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| |
| apr_brigade_flatten(bb, buf, &len); |
| ABTS_STR_NEQUAL(tc, expect, buf, len); |
| |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7515#appendix-A.7 |
| */ |
| static void test_jose_encode_jws_json_flattened(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_jose_t *jdata; |
| apr_jose_signature_t signature2; |
| char buf[1024]; |
| apr_size_t len = sizeof(buf); |
| apr_off_t offset; |
| apr_status_t status; |
| |
| const unsigned char pl[] = { 123, 34, 105, 115, 115, 34, 58, 34, 106, 111, |
| 101, 34, 44, 13, 10, 32, 34, 101, 120, 112, 34, 58, 49, 51, 48, 48, |
| 56, 49, 57, 51, 56, 48, 44, 13, 10, 32, 34, 104, 116, 116, 112, 58, |
| 47, 47, 101, 120, 97, 109, 112, 108, 101, 46, 99, 111, 109, 47, 105, |
| 115, 95, 114, 111, 111, 116, 34, 58, 116, 114, 117, 101, 125 }; |
| |
| const char *s2h = "{\"kid\":\"e9bc097a-ce51-4036-9562-d2ade882db0d\"}"; |
| const char *s2ph = "{\"alg\":\"ES256\"}"; |
| |
| const char *expect = "{" |
| "\"payload\":" |
| "\"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF" |
| "tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ\"," |
| "\"protected\":\"eyJhbGciOiJFUzI1NiJ9\"," |
| "\"header\":" |
| "{\"kid\":\"e9bc097a-ce51-4036-9562-d2ade882db0d\"}," |
| "\"signature\":" |
| "\"DtEhU3ljbEg8L38VWAfUAqOyKAM6-Xx-F4GawxaepmXFCgfTjDxw5djxLa8IS" |
| "lSApmWQxfKTUJqPP3-Kg6NU1Q\"" |
| "}"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.sign = sign_cb; |
| cb.ctx = tc; |
| |
| apr_json_decode(&signature2.header, (const char *) s2h, strlen(s2h), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| apr_json_decode(&signature2.protected_header, (const char *) s2ph, strlen(s2ph), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| jdata = apr_jose_data_make(NULL, "JWT", pl, sizeof(pl), p); |
| jose = apr_jose_jws_json_make(NULL, &signature2, NULL, jdata, p); |
| |
| status = apr_jose_encode(bb, NULL, NULL, jose, &cb, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| |
| apr_brigade_flatten(bb, buf, &len); |
| ABTS_STR_NEQUAL(tc, expect, buf, len); |
| |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7516#appendix-A.1 |
| */ |
| static void test_jose_encode_jwe_compact_rsaes_oaep_aes_gcm(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_jose_t *jdata; |
| apr_jose_encryption_t *encryption; |
| apr_jose_recipient_t *recipient; |
| apr_json_value_t *header = NULL; |
| apr_json_value_t *protected_header = NULL; |
| char buf[1024]; |
| apr_size_t len = sizeof(buf); |
| apr_off_t offset; |
| apr_status_t status; |
| |
| const char *ph = "{\"alg\":\"RSA-OAEP\",\"enc\":\"A256GCM\"}"; |
| |
| const unsigned char pl[] = { 84, 104, 101, 32, 116, 114, 117, 101, 32, 115, |
| 105, 103, 110, 32, 111, 102, 32, 105, 110, 116, 101, 108, 108, 105, |
| 103, 101, 110, 99, 101, 32, 105, 115, 32, 110, 111, 116, 32, 107, |
| 110, 111, 119, 108, 101, 100, 103, 101, 32, 98, 117, 116, 32, 105, |
| 109, 97, 103, 105, 110, 97, 116, 105, 111, 110, 46 }; |
| |
| const char *expect = "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ." |
| "OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe" |
| "ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb" |
| "Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV" |
| "mqgfwX7XWRxv2322i-vDxRfqNzo_tETKzpVLzfiwQyeyPGLBIO56YJ7eObdv0je8" |
| "1860ppamavo35UgoRdbYaBcoh9QcfylQr66oc6vFWXRcZ_ZT2LawVCWTIy3brGPi" |
| "6UklfCpIMfIjf7iGdXKHzg." |
| "48V1_ALb6US04U3b." |
| "5eym8TW_c8SuK0ltJ3rpYIzOeDQz7TALvtu6UG9oMo4vpzs9tX_EFShS8iB7j6ji" |
| "SdiwkIr3ajwQzaBtQD_A." |
| "XFBoMYUZodetZdvTiFvSkQ"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.encrypt = encrypt_cb; |
| cb.ctx = tc; |
| |
| apr_json_decode(&protected_header, ph, APR_JSON_VALUE_STRING, &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| jdata = apr_jose_data_make(NULL, "JWT", pl, sizeof(pl), p); |
| recipient = apr_jose_recipient_make(NULL, header, NULL, p); |
| encryption = apr_jose_encryption_make(NULL, NULL, protected_header, p); |
| jose = apr_jose_jwe_make(NULL, recipient, NULL, encryption, jdata, p); |
| |
| status = apr_jose_encode(bb, NULL, NULL, jose, &cb, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| |
| apr_brigade_flatten(bb, buf, &len); |
| ABTS_STR_NEQUAL(tc, expect, buf, len); |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7516#appendix-A.4 |
| */ |
| static void test_jose_encode_jwe_json_general(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_jose_t *jdata; |
| apr_json_value_t *header = NULL; |
| apr_json_value_t *protected_header = NULL; |
| apr_jose_recipient_t **recipient; |
| apr_jose_recipient_t recipient1; |
| apr_jose_recipient_t recipient2; |
| apr_array_header_t *recipients = apr_array_make(p, 2, |
| sizeof(apr_jose_recipient_t *)); |
| apr_jose_encryption_t *encryption; |
| char buf[1024]; |
| apr_size_t len = sizeof(buf); |
| apr_off_t offset; |
| apr_status_t status; |
| |
| const char *r1h = "{\"alg\":\"RSA1_5\",\"kid\":\"2011-04-29\"}"; |
| const char *r2h = "{\"alg\":\"A128KW\",\"kid\":\"7\"}"; |
| |
| const char *ph = "{\"enc\":\"A128CBC-HS256\"}"; |
| const char *h = "{\"jku\":\"https://server.example.com/keys.jwks\"}"; |
| |
| const unsigned char pl[] = { 76, 105, 118, 101, 32, 108, 111, 110, 103, 32, |
| 97, 110, 100, 32, 112, 114, 111, 115, 112, 101, 114, 46 }; |
| |
| const char *expect = "{" |
| "\"protected\":" |
| "\"eyJlbmMiOiJBMTI4Q0JDLUhTMjU2In0\"," |
| "\"unprotected\":" |
| "{\"jku\":\"https://server.example.com/keys.jwks\"}," |
| "\"recipients\":[" |
| "{\"header\":" |
| "{\"alg\":\"RSA1_5\",\"kid\":\"2011-04-29\"}," |
| "\"encrypted_key\":" |
| "\"UGhIOguC7IuEvf_NPVaXsGMoLOmwvc1GyqlIKOK1nN94nHPoltGRhWhw7Zx0-" |
| "kFm1NJn8LE9XShH59_i8J0PH5ZZyNfGy2xGdULU7sHNF6Gp2vPLgNZ__deLKx" |
| "GHZ7PcHALUzoOegEI-8E66jX2E4zyJKx-YxzZIItRzC5hlRirb6Y5Cl_p-ko3" |
| "YvkkysZIFNPccxRU7qve1WYPxqbb2Yw8kZqa2rMWI5ng8OtvzlV7elprCbuPh" |
| "cCdZ6XDP0_F8rkXds2vE4X-ncOIM8hAYHHi29NX0mcKiRaD0-D-ljQTP-cFPg" |
| "wCp6X-nZZd9OHBv-B3oWh2TbqmScqXMR4gp_A\"}," |
| "{\"header\":" |
| "{\"alg\":\"A128KW\",\"kid\":\"7\"}," |
| "\"encrypted_key\":" |
| "\"6KB707dM9YTIgHtLvtgWQ8mKwboJW3of9locizkDTHzBC2IlrT1oOQ\"}]," |
| "\"iv\":" |
| "\"AxY8DCtDaGlsbGljb3RoZQ\"," |
| "\"ciphertext\":" |
| "\"KDlTtXchhZTGufMYmOYGS4HffxPSUrfmqCHXaI9wOGY\"," |
| "\"tag\":" |
| "\"Mz-VPPyU4RlcuYv1IwIvzw\"" |
| "}\";"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.encrypt = encrypt_cb; |
| cb.ctx = tc; |
| |
| apr_json_decode(&recipient1.header, (const char *) r1h, strlen(r1h), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| apr_json_decode(&recipient2.header, (const char *) r2h, strlen(r2h), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| |
| recipient = apr_array_push(recipients); |
| *recipient = &recipient1; |
| recipient = apr_array_push(recipients); |
| *recipient = &recipient2; |
| |
| apr_json_decode(&header, h, APR_JSON_VALUE_STRING, &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| apr_json_decode(&protected_header, ph, APR_JSON_VALUE_STRING, &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| jdata = apr_jose_data_make(NULL, "plain", pl, sizeof(pl), p); |
| encryption = apr_jose_encryption_make(NULL, header, protected_header, p); |
| jose = apr_jose_jwe_json_make(NULL, NULL, recipients, encryption, jdata, p); |
| |
| status = apr_jose_encode(bb, NULL, NULL, jose, &cb, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| |
| apr_brigade_flatten(bb, buf, &len); |
| ABTS_STR_NEQUAL(tc, expect, buf, len); |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7516#appendix-A.5 |
| */ |
| static void test_jose_encode_jwe_json_flattened(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_jose_t *jdata; |
| apr_json_value_t *header = NULL; |
| apr_json_value_t *protected_header = NULL; |
| apr_jose_recipient_t recipient; |
| apr_jose_encryption_t *encryption; |
| char buf[1024]; |
| apr_size_t len = sizeof(buf); |
| apr_off_t offset; |
| apr_status_t status; |
| |
| const char *rh = "{\"alg\":\"A128KW\",\"kid\":\"7\"}"; |
| |
| const char *ph = "{\"enc\":\"A128CBC-HS256\"}"; |
| const char *h = "{\"jku\":\"https://server.example.com/keys.jwks\"}"; |
| |
| const unsigned char pl[] = { 76, 105, 118, 101, 32, 108, 111, 110, 103, 32, |
| 97, 110, 100, 32, 112, 114, 111, 115, 112, 101, 114, 46 }; |
| |
| const char *expect = "{" |
| "\"protected\":" |
| "\"eyJlbmMiOiJBMTI4Q0JDLUhTMjU2In0\"," |
| "\"unprotected\":" |
| "{\"jku\":\"https://server.example.com/keys.jwks\"}," |
| "\"header\":" |
| "{\"alg\":\"A128KW\",\"kid\":\"7\"}," |
| "\"encrypted_key\":" |
| "\"6KB707dM9YTIgHtLvtgWQ8mKwboJW3of9locizkDTHzBC2IlrT1oOQ\"," |
| "\"iv\":" |
| "\"AxY8DCtDaGlsbGljb3RoZQ\"," |
| "\"ciphertext\":" |
| "\"KDlTtXchhZTGufMYmOYGS4HffxPSUrfmqCHXaI9wOGY\"," |
| "\"tag\":" |
| "\"Mz-VPPyU4RlcuYv1IwIvzw\"" |
| "}"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.encrypt = encrypt_cb; |
| cb.ctx = tc; |
| |
| apr_json_decode(&recipient.header, (const char *) rh, strlen(rh), &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| |
| apr_json_decode(&header, h, APR_JSON_VALUE_STRING, &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| apr_json_decode(&protected_header, ph, APR_JSON_VALUE_STRING, &offset, |
| APR_JSON_FLAGS_WHITESPACE, 10, p); |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| jdata = apr_jose_data_make(NULL, "plain", pl, sizeof(pl), p); |
| encryption = apr_jose_encryption_make(NULL, header, protected_header, p); |
| jose = apr_jose_jwe_json_make(NULL, &recipient, NULL, encryption, jdata, p); |
| |
| status = apr_jose_encode(bb, NULL, NULL, jose, &cb, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| |
| apr_brigade_flatten(bb, buf, &len); |
| ABTS_STR_NEQUAL(tc, expect, buf, len); |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7515#appendix-A.5 |
| */ |
| static void test_jose_decode_jws_compact_unsecured(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_json_kv_t *kv; |
| apr_status_t status; |
| |
| const char *source = "eyJhbGciOiJub25lIn0" |
| "." |
| "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt" |
| "cGxlLmNvbS9pc19yb290Ijp0cnVlfQ" |
| "."; |
| |
| apr_jose_cb_t cb; |
| |
| cb.verify = verify_cb; |
| cb.decrypt = decrypt_cb; |
| cb.ctx = tc; |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| apr_brigade_write(bb, NULL, NULL, source, strlen(source)); |
| |
| status = apr_jose_decode(&jose, "JWT", bb, &cb, 10, APR_JOSE_FLAG_NONE, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| ABTS_PTR_NOTNULL(tc, jose); |
| ABTS_INT_EQUAL(tc, APR_JOSE_TYPE_JWT, jose->type); |
| |
| kv = apr_json_object_get(jose->jose.jwt->claims, "iss", |
| APR_JSON_VALUE_STRING); |
| ABTS_PTR_NOTNULL(tc, kv); |
| ABTS_INT_EQUAL(tc, APR_JSON_STRING, kv->v->type); |
| |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7515#appendix-A.1 |
| */ |
| static void test_jose_decode_jws_compact_hs256(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_json_kv_t *kv; |
| apr_status_t status; |
| |
| const char *source = "eyJ0eXAiOiJKV1QiLA0KICJhbGciOiJIUzI1NiJ9" |
| "." |
| "eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGFt" |
| "cGxlLmNvbS9pc19yb290Ijp0cnVlfQ" |
| "." |
| "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.verify = verify_cb; |
| cb.decrypt = decrypt_cb; |
| cb.ctx = tc; |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| apr_brigade_write(bb, NULL, NULL, source, strlen(source)); |
| |
| status = apr_jose_decode(&jose, "JWT", bb, &cb, 10, APR_JOSE_FLAG_NONE, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| ABTS_PTR_NOTNULL(tc, jose); |
| ABTS_INT_EQUAL(tc, APR_JOSE_TYPE_JWT, jose->type); |
| |
| kv = apr_json_object_get(jose->jose.jwt->claims, "iss", |
| APR_JSON_VALUE_STRING); |
| ABTS_PTR_NOTNULL(tc, kv); |
| ABTS_INT_EQUAL(tc, APR_JSON_STRING, kv->v->type); |
| |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7515#appendix-A.6 |
| */ |
| static void test_jose_decode_jws_json_general(abts_case *tc, void *data) |
| { |
| const char *source = "{" |
| "\"payload\":" |
| "\"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF" |
| "tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ\"," |
| "\"signatures\":[" |
| "{\"protected\":\"eyJhbGciOiJSUzI1NiJ9\"," |
| "\"header\":" |
| "{\"kid\":\"2010-12-29\"}," |
| "\"signature\":" |
| "\"cC4hiUPoj9Eetdgtv3hF80EGrhuB__dzERat0XF9g2VtQgr9PJbu3XOiZj5RZ" |
| "mh7AAuHIm4Bh-0Qc_lF5YKt_O8W2Fp5jujGbds9uJdbF9CUAr7t1dnZcAcQjb" |
| "KBYNX4BAynRFdiuB--f_nZLgrnbyTyWzO75vRK5h6xBArLIARNPvkSjtQBMHl" |
| "b1L07Qe7K0GarZRmB_eSN9383LcOLn6_dO--xi12jzDwusC-eOkHWEsqtFZES" |
| "c6BfI7noOPqvhJ1phCnvWh6IeYI2w9QOYEUipUTI8np6LbgGY9Fs98rqVt5AX" |
| "LIhWkWywlVmtVrBp0igcN_IoypGlUPQGe77Rw\"}," |
| "{\"protected\":\"eyJhbGciOiJFUzI1NiJ9\"," |
| "\"header\":" |
| "{\"kid\":\"e9bc097a-ce51-4036-9562-d2ade882db0d\"}," |
| "\"signature\":" |
| "\"DtEhU3ljbEg8L38VWAfUAqOyKAM6-Xx-F4GawxaepmXFCgfTjDxw5djxLa8IS" |
| "lSApmWQxfKTUJqPP3-Kg6NU1Q\"}]" |
| "}"; |
| |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_status_t status; |
| |
| apr_jose_cb_t cb; |
| |
| cb.verify = verify_cb; |
| cb.decrypt = decrypt_cb; |
| cb.ctx = tc; |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| apr_brigade_write(bb, NULL, NULL, source, strlen(source)); |
| |
| status = apr_jose_decode(&jose, "JOSE+JSON", bb, &cb, 10, APR_JOSE_FLAG_NONE, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| ABTS_PTR_NOTNULL(tc, jose); |
| |
| /* |
| * There is nothing in this structure to identify the MIME type of the payload, |
| * so raw data is returned. |
| */ |
| ABTS_INT_EQUAL(tc, APR_JOSE_TYPE_DATA, jose->type); |
| |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7515#appendix-A.7 |
| */ |
| static void test_jose_decode_jws_json_flattened(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_status_t status; |
| |
| const char *source = "{" |
| "\"payload\":" |
| "\"eyJpc3MiOiJqb2UiLA0KICJleHAiOjEzMDA4MTkzODAsDQogImh0dHA6Ly9leGF" |
| "tcGxlLmNvbS9pc19yb290Ijp0cnVlfQ\"," |
| "\"protected\":\"eyJhbGciOiJFUzI1NiJ9\"," |
| "\"header\":" |
| "{\"kid\":\"e9bc097a-ce51-4036-9562-d2ade882db0d\"}," |
| "\"signature\":" |
| "\"DtEhU3ljbEg8L38VWAfUAqOyKAM6-Xx-F4GawxaepmXFCgfTjDxw5djxLa8IS" |
| "lSApmWQxfKTUJqPP3-Kg6NU1Q\"" |
| "}"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.verify = verify_cb; |
| cb.decrypt = decrypt_cb; |
| cb.ctx = tc; |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| apr_brigade_write(bb, NULL, NULL, source, strlen(source)); |
| |
| status = apr_jose_decode(&jose, "JOSE+JSON", bb, &cb, 10, APR_JOSE_FLAG_NONE, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| ABTS_PTR_NOTNULL(tc, jose); |
| ABTS_INT_EQUAL(tc, APR_JOSE_TYPE_DATA, jose->type); |
| |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7516#appendix-A.1 |
| */ |
| static void test_jose_decode_jwe_compact_rsaes_oaep_aes_gcm(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_status_t status; |
| |
| const char *source = "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ." |
| "OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe" |
| "ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb" |
| "Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV" |
| "mqgfwX7XWRxv2322i-vDxRfqNzo_tETKzpVLzfiwQyeyPGLBIO56YJ7eObdv0je8" |
| "1860ppamavo35UgoRdbYaBcoh9QcfylQr66oc6vFWXRcZ_ZT2LawVCWTIy3brGPi" |
| "6UklfCpIMfIjf7iGdXKHzg." |
| "48V1_ALb6US04U3b." |
| "5eym8TW_c8SuK0ltJ3rpYIzOeDQz7TALvtu6UG9oMo4vpzs9tX_EFShS8iB7j6ji" |
| "SdiwkIr3ajwQzaBtQD_A." |
| "XFBoMYUZodetZdvTiFvSkQ"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.verify = verify_cb; |
| cb.decrypt = decrypt_cb; |
| cb.ctx = tc; |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| apr_brigade_write(bb, NULL, NULL, source, strlen(source)); |
| |
| status = apr_jose_decode(&jose, "JWE", bb, &cb, 10, APR_JOSE_FLAG_NONE, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| ABTS_PTR_NOTNULL(tc, jose); |
| ABTS_INT_EQUAL(tc, APR_JOSE_TYPE_DATA, jose->type); |
| |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7516#appendix-A.4 |
| */ |
| static void test_jose_decode_jwe_json_general(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_status_t status; |
| |
| const char *source = "{" |
| "\"protected\":" |
| "\"eyJlbmMiOiJBMTI4Q0JDLUhTMjU2In0\"," |
| "\"unprotected\":" |
| "{\"jku\":\"https://server.example.com/keys.jwks\"}," |
| "\"recipients\":[" |
| "{\"header\":" |
| "{\"alg\":\"RSA1_5\",\"kid\":\"2011-04-29\"}," |
| "\"encrypted_key\":" |
| "\"UGhIOguC7IuEvf_NPVaXsGMoLOmwvc1GyqlIKOK1nN94nHPoltGRhWhw7Zx0-" |
| "kFm1NJn8LE9XShH59_i8J0PH5ZZyNfGy2xGdULU7sHNF6Gp2vPLgNZ__deLKx" |
| "GHZ7PcHALUzoOegEI-8E66jX2E4zyJKx-YxzZIItRzC5hlRirb6Y5Cl_p-ko3" |
| "YvkkysZIFNPccxRU7qve1WYPxqbb2Yw8kZqa2rMWI5ng8OtvzlV7elprCbuPh" |
| "cCdZ6XDP0_F8rkXds2vE4X-ncOIM8hAYHHi29NX0mcKiRaD0-D-ljQTP-cFPg" |
| "wCp6X-nZZd9OHBv-B3oWh2TbqmScqXMR4gp_A\"}," |
| "{\"header\":" |
| "{\"alg\":\"A128KW\",\"kid\":\"7\"}," |
| "\"encrypted_key\":" |
| "\"6KB707dM9YTIgHtLvtgWQ8mKwboJW3of9locizkDTHzBC2IlrT1oOQ\"}]," |
| "\"iv\":" |
| "\"AxY8DCtDaGlsbGljb3RoZQ\"," |
| "\"ciphertext\":" |
| "\"KDlTtXchhZTGufMYmOYGS4HffxPSUrfmqCHXaI9wOGY\"," |
| "\"tag\":" |
| "\"Mz-VPPyU4RlcuYv1IwIvzw\"" |
| "}"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.verify = verify_cb; |
| cb.decrypt = decrypt_cb; |
| cb.ctx = tc; |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| apr_brigade_write(bb, NULL, NULL, source, strlen(source)); |
| |
| status = apr_jose_decode(&jose, "JOSE+JSON", bb, &cb, 10, |
| APR_JOSE_FLAG_NONE, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| ABTS_PTR_NOTNULL(tc, jose); |
| ABTS_INT_EQUAL(tc, APR_JOSE_TYPE_DATA, jose->type); |
| |
| } |
| |
| /** |
| * Test from https://tools.ietf.org/html/rfc7516#appendix-A.5 |
| */ |
| static void test_jose_decode_jwe_json_flattened(abts_case *tc, void *data) |
| { |
| apr_bucket_alloc_t *ba; |
| apr_bucket_brigade *bb; |
| apr_jose_t *jose; |
| apr_status_t status; |
| |
| const char *source = "{" |
| "\"protected\":" |
| "\"eyJlbmMiOiJBMTI4Q0JDLUhTMjU2In0\"," |
| "\"unprotected\":" |
| "{\"jku\":\"https://server.example.com/keys.jwks\"}," |
| "\"header\":" |
| "{\"alg\":\"A128KW\",\"kid\":\"7\"}," |
| "\"encrypted_key\":" |
| "\"6KB707dM9YTIgHtLvtgWQ8mKwboJW3of9locizkDTHzBC2IlrT1oOQ\"," |
| "\"iv\":" |
| "\"AxY8DCtDaGlsbGljb3RoZQ\"," |
| "\"ciphertext\":" |
| "\"KDlTtXchhZTGufMYmOYGS4HffxPSUrfmqCHXaI9wOGY\"," |
| "\"tag\":" |
| "\"Mz-VPPyU4RlcuYv1IwIvzw\"" |
| "}"; |
| |
| apr_jose_cb_t cb; |
| |
| cb.verify = verify_cb; |
| cb.decrypt = decrypt_cb; |
| cb.ctx = tc; |
| |
| ba = apr_bucket_alloc_create(p); |
| bb = apr_brigade_create(p, ba); |
| |
| apr_brigade_write(bb, NULL, NULL, source, strlen(source)); |
| |
| status = apr_jose_decode(&jose, "JOSE+JSON", bb, &cb, 10, |
| APR_JOSE_FLAG_NONE, p); |
| |
| ABTS_INT_EQUAL(tc, APR_SUCCESS, status); |
| ABTS_PTR_NOTNULL(tc, jose); |
| ABTS_INT_EQUAL(tc, APR_JOSE_TYPE_DATA, jose->type); |
| |
| } |
| |
| abts_suite *testjose(abts_suite *suite) |
| { |
| suite = ADD_SUITE(suite); |
| |
| abts_run_test(suite, test_jose_decode_jws_compact_unsecured, NULL); |
| abts_run_test(suite, test_jose_decode_jws_compact_hs256, NULL); |
| abts_run_test(suite, test_jose_decode_jws_json_general, NULL); |
| abts_run_test(suite, test_jose_decode_jws_json_flattened, NULL); |
| abts_run_test(suite, test_jose_decode_jwe_compact_rsaes_oaep_aes_gcm, NULL); |
| abts_run_test(suite, test_jose_decode_jwe_json_general, NULL); |
| abts_run_test(suite, test_jose_decode_jwe_json_flattened, NULL); |
| |
| abts_run_test(suite, test_jose_encode_jws_compact_unsecured, NULL); |
| abts_run_test(suite, test_jose_encode_jws_compact_hs256, NULL); |
| abts_run_test(suite, test_jose_encode_jws_json_general, NULL); |
| abts_run_test(suite, test_jose_encode_jws_json_flattened, NULL); |
| abts_run_test(suite, test_jose_encode_jwe_compact_rsaes_oaep_aes_gcm, NULL); |
| abts_run_test(suite, test_jose_encode_jwe_json_general, NULL); |
| abts_run_test(suite, test_jose_encode_jwe_json_flattened, NULL); |
| |
| return suite; |
| } |
