RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
haproxy/reg-tests/jwt/jws_verify.vtc

419 lines
26 KiB
Plaintext
Raw Normal View History

REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
#REGTEST_TYPE=devel
# This reg-test uses the JSON Web Token (JWT) converters to verify a token's signature.
# It uses the http_auth_bearer sample fetch to fetch a token contained in an
# HTTP Authorization header (with the Bearer scheme) which is the common way of
# transmitting a token (see RFC6750). It then uses the jwt_header_query
# converter to get the "alg" field declared in the token's JOSE header and
# gives it to the jwt_verify converter with the appropriate certificate.
#
# All the supported algorithms are tested at least once (HMAC, RSA and ECDSA)
# and the errors codes returned by jwt_verify are tested as well.
varnishtest "Test the 'set ssl ca-file' feature of the CLI"
feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'"
feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
feature cmd "command -v socat"
feature ignore_unknown_macro
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
server s1 -repeat 24 {
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
rxreq
txresp
} -start
haproxy h1 -conf {
global
tune.ssl.default-dh-param 2048
tune.ssl.capture-buffer-size 1
stats socket "${tmpdir}/h1/stats" level admin
defaults
mode http
REGTESTS: extend the default I/O timeouts and make them overridable With the CI occasionally slowing down, we're starting to see again some spurious failures despite the long 1-second timeouts. This reports false positives that are disturbing and doesn't provide as much value as this could. However at this delay it already becomes a pain for developers to wait for the tests to complete. This commit adds support for the new environment variable HAPROXY_TEST_TIMEOUT that will allow anyone to modify the connect, client and server timeouts. It was set to 5 seconds by default, which should be plenty for quite some time in the CI. All relevant values that were 200ms or above were replaced by this one. A few larger values were left as they are special. One test for the set-timeout action that used to rely on a fixed 1-sec value was extended to a fixed 5-sec, as the timeout is normally not reached, but it needs to be known to compare the old and new values.
2021-11-18 16:46:22 +00:00
timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
timeout client "${HAPROXY_TEST_TIMEOUT-5s}"
timeout server "${HAPROXY_TEST_TIMEOUT-5s}"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
listen main-fe
bind "fd@${mainfe}"
use_backend hsXXX_be if { path_beg /hs }
use_backend rsXXX_be if { path_beg /rs }
use_backend esXXX_be if { path_beg /es }
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
use_backend psXXX_be if { path_beg /ps }
BUG/MINOR: http: http_auth_bearer fetch does not work on custom header name The http_auth_bearer sample fetch can take a header name as parameter, in which case it will try to extract a Bearer value out of the given header name instead of the default "Authorization" one. In this case, the extraction would not have worked because of a misuse of strncasecmp. This patch fixes this by replacing the standard string functions by ist ones. It also properly manages the multiple spaces that could be found between the scheme and its value. No backport needed, that's part of JWT which is only in 2.5. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2021-10-29 13:25:19 +00:00
use_backend auth_bearer_be if { path /auth_bearer }
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
default_backend dflt_be
backend hsXXX_be
http-request set-var(txn.bearer) http_auth_bearer
http-request set-var(txn.jwt_alg) var(txn.bearer),jwt_header_query('$.alg')
http-request deny unless { var(txn.jwt_alg) -m beg "HS" }
http-response set-header x-jwt-token %[var(txn.bearer)]
http-response set-header x-jwt-alg %[var(txn.jwt_alg)]
MEDIUM: vars: make the var() sample fetch function really return type ANY A long-standing issue was reported in issue #1215. In short, var() was initially internally declared as returning a string because it was not possible by then to return "any type". As such, users regularly get trapped thinking that when they're storing an integer there, then the integer matching method automatically applies. Except that this is not possible since this is related to the config parser and is decided at boot time where the variable's type is not known yet. As such, what is done is that the output being declared as type string, the string match will automatically apply, and any value will first be converted to a string. This results in several issues like: http-request set-var(txn.foo) int(-1) http-request deny if { var(txn.foo) lt 0 } not working. This is because the string match on the second line will in fact compare the string representation of the variable against strings "lt" and "0", none of which matches. The doc says that the matching method is mandatory, though that's not the case in the code due to that default string type being permissive. There's not even a warning when no explicit match is placed, because this happens very deep in the expression evaluator and making a special case just for "var" can reveal very complicated. The set-var() converter already mandates a matching method, as the following will be rejected: ... if { int(12),set-var(txn.truc) 12 } while this one will work: ... if { int(12),set-var(txn.truc) -m int 12 } As such, this patch this modifies var() to match the doc, returning the type "any", and mandating the matching method, implying that this bogus config which does not work: http-request set-var(txn.foo) int(-1) http-request deny if { var(txn.foo) lt 0 } will need to be written like this: http-request set-var(txn.foo) int(-1) http-request deny if { var(txn.foo) -m int lt 0 } This *will* break some configs (and even 3 of our regtests relied on this), but except those which already match string exclusively, all other ones are already broken and silently fail (and one of the 3 regtests, the one on FIX, was bogus regarding this). In order to fix existing configs, one can simply append "-m str" after a "var()" in an ACL or "if" expression: http-request deny unless { var(txn.jwt_alg) "ES" } must become: http-request deny unless { var(txn.jwt_alg) -m str "ES" } Most commonly, patterns such as "le", "lt", "ge", "gt", "eq", "ne" in front of a number indicate that the intent was to match an integer, and in this case "-m int" would be desired: tcp-response content reject if ! { var(res.size) gt 3800 } ought to become: tcp-response content reject if ! { var(res.size) -m int gt 3800 } This must not be backported, but if a solution is found to at least detect this exact condition in the generic expression parser and emit a warning, this could probably help spot configuration bugs. Link: https://www.mail-archive.com/haproxy@formilux.org/msg41341.html Cc: Christopher Faulet <cfaulet@haproxy.com> Cc: Tim Dsterhus <tim@bastelstu.be>
2021-11-02 16:08:15 +00:00
http-response set-header x-jwt-verify-HS256 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"hmac key hs256")] if { var(txn.jwt_alg) -m str "HS256" }
http-response set-header x-jwt-verify-HS384 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"hmac key hs384")] if { var(txn.jwt_alg) -m str "HS384" }
http-response set-header x-jwt-verify-HS512 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"hmac key hs512")] if { var(txn.jwt_alg) -m str "HS512" }
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
server s1 ${s1_addr}:${s1_port}
backend rsXXX_be
http-request set-var(txn.bearer) http_auth_bearer
http-request set-var(txn.jwt_alg) var(txn.bearer),jwt_header_query('$.alg')
http-request deny unless { var(txn.jwt_alg) -m beg "RS" }
http-response set-header x-jwt-token %[var(txn.bearer)]
http-response set-header x-jwt-alg %[var(txn.jwt_alg)]
MEDIUM: vars: make the var() sample fetch function really return type ANY A long-standing issue was reported in issue #1215. In short, var() was initially internally declared as returning a string because it was not possible by then to return "any type". As such, users regularly get trapped thinking that when they're storing an integer there, then the integer matching method automatically applies. Except that this is not possible since this is related to the config parser and is decided at boot time where the variable's type is not known yet. As such, what is done is that the output being declared as type string, the string match will automatically apply, and any value will first be converted to a string. This results in several issues like: http-request set-var(txn.foo) int(-1) http-request deny if { var(txn.foo) lt 0 } not working. This is because the string match on the second line will in fact compare the string representation of the variable against strings "lt" and "0", none of which matches. The doc says that the matching method is mandatory, though that's not the case in the code due to that default string type being permissive. There's not even a warning when no explicit match is placed, because this happens very deep in the expression evaluator and making a special case just for "var" can reveal very complicated. The set-var() converter already mandates a matching method, as the following will be rejected: ... if { int(12),set-var(txn.truc) 12 } while this one will work: ... if { int(12),set-var(txn.truc) -m int 12 } As such, this patch this modifies var() to match the doc, returning the type "any", and mandating the matching method, implying that this bogus config which does not work: http-request set-var(txn.foo) int(-1) http-request deny if { var(txn.foo) lt 0 } will need to be written like this: http-request set-var(txn.foo) int(-1) http-request deny if { var(txn.foo) -m int lt 0 } This *will* break some configs (and even 3 of our regtests relied on this), but except those which already match string exclusively, all other ones are already broken and silently fail (and one of the 3 regtests, the one on FIX, was bogus regarding this). In order to fix existing configs, one can simply append "-m str" after a "var()" in an ACL or "if" expression: http-request deny unless { var(txn.jwt_alg) "ES" } must become: http-request deny unless { var(txn.jwt_alg) -m str "ES" } Most commonly, patterns such as "le", "lt", "ge", "gt", "eq", "ne" in front of a number indicate that the intent was to match an integer, and in this case "-m int" would be desired: tcp-response content reject if ! { var(res.size) gt 3800 } ought to become: tcp-response content reject if ! { var(res.size) -m int gt 3800 } This must not be backported, but if a solution is found to at least detect this exact condition in the generic expression parser and emit a warning, this could probably help spot configuration bugs. Link: https://www.mail-archive.com/haproxy@formilux.org/msg41341.html Cc: Christopher Faulet <cfaulet@haproxy.com> Cc: Tim Dsterhus <tim@bastelstu.be>
2021-11-02 16:08:15 +00:00
http-response set-header x-jwt-verify-RS256 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"${testdir}/rsa-public.pem")] if { var(txn.jwt_alg) -m str "RS256" }
http-response set-header x-jwt-verify-RS384 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"${testdir}/rsa-public.pem")] if { var(txn.jwt_alg) -m str "RS384" }
http-response set-header x-jwt-verify-RS512 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"${testdir}/rsa-public.pem")] if { var(txn.jwt_alg) -m str "RS512" }
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
server s1 ${s1_addr}:${s1_port}
backend esXXX_be
http-request set-var(txn.bearer) http_auth_bearer
http-request set-var(txn.jwt_alg) var(txn.bearer),jwt_header_query('$.alg')
http-request deny unless { var(txn.jwt_alg) -m beg "ES" }
http-response set-header x-jwt-token %[var(txn.bearer)]
http-response set-header x-jwt-alg %[var(txn.jwt_alg)]
MEDIUM: vars: make the var() sample fetch function really return type ANY A long-standing issue was reported in issue #1215. In short, var() was initially internally declared as returning a string because it was not possible by then to return "any type". As such, users regularly get trapped thinking that when they're storing an integer there, then the integer matching method automatically applies. Except that this is not possible since this is related to the config parser and is decided at boot time where the variable's type is not known yet. As such, what is done is that the output being declared as type string, the string match will automatically apply, and any value will first be converted to a string. This results in several issues like: http-request set-var(txn.foo) int(-1) http-request deny if { var(txn.foo) lt 0 } not working. This is because the string match on the second line will in fact compare the string representation of the variable against strings "lt" and "0", none of which matches. The doc says that the matching method is mandatory, though that's not the case in the code due to that default string type being permissive. There's not even a warning when no explicit match is placed, because this happens very deep in the expression evaluator and making a special case just for "var" can reveal very complicated. The set-var() converter already mandates a matching method, as the following will be rejected: ... if { int(12),set-var(txn.truc) 12 } while this one will work: ... if { int(12),set-var(txn.truc) -m int 12 } As such, this patch this modifies var() to match the doc, returning the type "any", and mandating the matching method, implying that this bogus config which does not work: http-request set-var(txn.foo) int(-1) http-request deny if { var(txn.foo) lt 0 } will need to be written like this: http-request set-var(txn.foo) int(-1) http-request deny if { var(txn.foo) -m int lt 0 } This *will* break some configs (and even 3 of our regtests relied on this), but except those which already match string exclusively, all other ones are already broken and silently fail (and one of the 3 regtests, the one on FIX, was bogus regarding this). In order to fix existing configs, one can simply append "-m str" after a "var()" in an ACL or "if" expression: http-request deny unless { var(txn.jwt_alg) "ES" } must become: http-request deny unless { var(txn.jwt_alg) -m str "ES" } Most commonly, patterns such as "le", "lt", "ge", "gt", "eq", "ne" in front of a number indicate that the intent was to match an integer, and in this case "-m int" would be desired: tcp-response content reject if ! { var(res.size) gt 3800 } ought to become: tcp-response content reject if ! { var(res.size) -m int gt 3800 } This must not be backported, but if a solution is found to at least detect this exact condition in the generic expression parser and emit a warning, this could probably help spot configuration bugs. Link: https://www.mail-archive.com/haproxy@formilux.org/msg41341.html Cc: Christopher Faulet <cfaulet@haproxy.com> Cc: Tim Dsterhus <tim@bastelstu.be>
2021-11-02 16:08:15 +00:00
http-response set-header x-jwt-verify-ES256 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"${testdir}/es256-public.pem")] if { var(txn.jwt_alg) -m str "ES256" }
http-response set-header x-jwt-verify-ES384 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"${testdir}/es384-public.pem")] if { var(txn.jwt_alg) -m str "ES384" }
http-response set-header x-jwt-verify-ES512 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"${testdir}/es512-public.pem")] if { var(txn.jwt_alg) -m str "ES512" }
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
server s1 ${s1_addr}:${s1_port}
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
backend psXXX_be
http-request set-var(txn.bearer) http_auth_bearer
http-request set-var(txn.jwt_alg) var(txn.bearer),jwt_header_query('$.alg')
http-request deny unless { var(txn.jwt_alg) -m beg "PS" }
http-response set-header x-jwt-token %[var(txn.bearer)]
http-response set-header x-jwt-alg %[var(txn.jwt_alg)]
http-response set-header x-jwt-verify-PS256 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"${testdir}/rsa-public.pem")] if { var(txn.jwt_alg) -m str "PS256" }
http-response set-header x-jwt-verify-PS384 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"${testdir}/rsa-public.pem")] if { var(txn.jwt_alg) -m str "PS384" }
http-response set-header x-jwt-verify-PS512 %[var(txn.bearer),jwt_verify(txn.jwt_alg,"${testdir}/rsa-public.pem")] if { var(txn.jwt_alg) -m str "PS512" }
server s1 ${s1_addr}:${s1_port}
BUG/MINOR: http: http_auth_bearer fetch does not work on custom header name The http_auth_bearer sample fetch can take a header name as parameter, in which case it will try to extract a Bearer value out of the given header name instead of the default "Authorization" one. In this case, the extraction would not have worked because of a misuse of strncasecmp. This patch fixes this by replacing the standard string functions by ist ones. It also properly manages the multiple spaces that could be found between the scheme and its value. No backport needed, that's part of JWT which is only in 2.5. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2021-10-29 13:25:19 +00:00
# This backend will only be used to test the http_auth_bearer sample fetch.
# No jwt_verify will then be performed.
backend auth_bearer_be
http-request set-var(txn.bearer) http_auth_bearer("Custom-Authorization")
http-response set-header x-jwt-token %[var(txn.bearer)]
server s1 ${s1_addr}:${s1_port}
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
# This backend will mostly be used to test error cases (invalid tokens, algorithm and so on)
backend dflt_be
http-request set-var(txn.bearer) http_auth_bearer
http-request set-var(txn.jwt_alg) var(txn.bearer),jwt_header_query('$.alg')
http-request set-var(txn.jwt_verify) var(txn.bearer),jwt_verify(txn.jwt_alg,"unknown_cert.pem")
http-response set-header x-jwt-token %[var(txn.bearer)]
http-response set-header x-jwt-alg %[var(txn.jwt_alg)]
http-response set-header x-jwt-verify %[var(txn.jwt_verify)]
server s1 ${s1_addr}:${s1_port}
} -start
client c1 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"HS256","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# HMAC key : 'hmac key hs256'
# OpenSSL cmd : openssl dgst -sha256 -mac HMAC -macopt key:'hmac key hs256' data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/hs256" -hdr "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.hhj1mbYgezxFoYwinThsZQbckYHt4jJlRoQ7W8ksrFM"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "HS256"
expect resp.http.x-jwt-verify-HS256 == "1"
} -run
client c2 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"HS384","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# HMAC key : 'hmac key hs384'
# OpenSSL cmd : openssl dgst -sha384 -mac HMAC -macopt key:'hmac key hs384' data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/hs384" -hdr "Authorization: Bearer eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.3EsbLfl6DDh5nZMkLWg3ssCurFHyOhXP28a4PDS48aPAIoYLzHchtXmNaYI8He-R"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "HS384"
expect resp.http.x-jwt-verify-HS384 == "1"
} -run
client c3 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"HS512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# HMAC key : 'hmac key hs512'
# OpenSSL cmd : openssl dgst -sha512 -mac HMAC -macopt key:'hmac key hs512' data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/hs512" -hdr "Authorization: Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.K4Yze5N7jeJrDbJymphaH1YsFlYph5F-U75HzBRKDybrN7WBO494EgNG77mAQj4CVci_xbTD_IsqY2umO0f47A"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "HS512"
expect resp.http.x-jwt-verify-HS512 == "1"
} -run
# The following token is invalid (it has three extra characters at the end of the signature)
client c4 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"HS512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# HMAC key : 'hmac key hs512'
# OpenSSL cmd : openssl dgst -sha512 -mac HMAC -macopt key:'hmac key hs512' data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/hs512" -hdr "Authorization: Bearer eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.K4Yze5N7jeJrDbJymphaH1YsFlYph5F-U75HzBRKDybrN7WBO494EgNG77mAQj4CVci_xbTD_IsqY2umO0f47AAAA"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "HS512"
MINOR: jwt: jwt_verify returns negative values in case of error In order for all the error return values to be distributed on the same side (instead of surrounding the success error code), the return values for errors other than a simple verification failure are switched to negative values. This way the result of the jwt_verify converter can be compared strictly to 1 as well relative to 0 (any <= 0 return value is an error). The documentation was also modified to discourage conversion of the return value into a boolean (which would definitely not work).
2021-10-18 13:14:49 +00:00
expect resp.http.x-jwt-verify-HS512 == "-3"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
} -run
client c5 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"RS256","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# OpenSSL cmd : openssl dgst -sha256 -sign rsa-private.pem data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/rs256" -hdr "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.hRqFM87JzV_YinYhdERp2E9BLhl6s7I5J37GTXAeT5fixJx-OCjTFvwKssyVo7fWAFcQMdQU7vGEXDOiWbNaMUFGIsMxx0Uflk0BeNwk6pWvNGk8KZGMtiqOv-IuPdAiaSW_xhxLHIk7eOwVefvBfk8j2hgU9yoHN87AYnl8oEnzrkzwWvEt-x-P2zB4s_VwhF0gbL1G4FsP5hxWL1HWmSFLBpvWaL5Lx3OJE7mLRLRf8TpMwEe4ROakzMpiv9Xk1H3mZth6d2a91F5Bm65MIJpJ7P2kEL3tdS62VRx8DM_SlsFuWcsqryO3CDQquMbwzAvfRgLPy8PBLRLT64wM3mZtue5GI2KUlqSYsSwKwK580b4drosLvAS75l_4jJwdwuQEvVd8Gry3DWS2mKJSMefmGfD-cdty1vvszs5sUa96Gf7Ro5DvkgXtVCKYk8KJLI62YgZd5S3M0ucP5NLBc_flUi4A2B_aSkd7NDM0ELddk0y48pcF95tejcvliGIy1GRRwevdqensXXQrFweFSZVvuKo8c9pcCBVfKTSllgL0lFGyI_vz6dUYt69I1gqWBDeGcA2XQUBJqfX3o9nkhZspA7b7QxMESatoATsM_XmfhbwsyY-sTq25XIGC4awaZHViZr1YFVD6BwNZWBCEBvW5zObiD5h5A5AgWoBv14E"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "RS256"
expect resp.http.x-jwt-verify-RS256 == "1"
} -run
client c6 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"RS384","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# OpenSSL cmd : openssl dgst -sha384 -sign rsa-private.pem data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/rs384" -hdr "Authorization: Bearer eyJhbGciOiJSUzM4NCIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.GuR-v91EMCVvvTTLiE56O0oDAKeQ5JdLqvHtrgOp2MbUtF7zCDutV0LTmMo4qDNVpvTnD3GZfTTGaVUTvW7kIQ3_1iEVAg61qVWkT9rtHHxifDX70RDBKkvNcMWyQH-dFP_FUvCmhCu7q-AzgBT6PHvs5ZqYyQvlQ1gSWZEPFi184dhvcUQrQC6CySEAdOzIryIHH2oQjN_a9lA9V9M_CH3P-AAwFE7NwUE1H1SGIYM4NHcngEZ3B4lBCHOhhgQMpfagcxQjjXv7VfeSqza6OZDpupwlOl34bb0gnFDGMh4hHSS6iHvvwCeCkclbyvKV0Vq0MaRtJuoKRF-_Oww-nKT_bfNtbF6MeOQLNRlYjGCHerWoBtjv3w2KjoLvQ5iGIFI3cEguyrrKNimpovF4Y5uINH0pWdRF99zOwVUlcJBk3RivIb--Y6s47aNFIVWimUpSn-8MSHTla20TYbcdVaZaMur09Cw500jPrOy6jFqVydSnmU6r13NkmCD5-Bl0mgwGtpZcOQExrnIcPQky12kQJAIrffVblvtkd-8FIBPBy1uBKCgkE-q9_suEvBTdvaoTocBmPcIxfPjZUVXeU3UmnRrXEz17pue0YfrwK9CUR9UoP0F5C7O5eSbAtZNm4Hpkiah0w7qugWG3esMgku3-xx0B2xwg6Ul7bAgEJFg"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "RS384"
expect resp.http.x-jwt-verify-RS384 == "1"
} -run
client c7 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"RS512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# OpenSSL cmd : openssl dgst -sha512 -sign rsa-private.pem data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/rs512" -hdr "Authorization: Bearer eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.dgUDvxbWXV-q9lVFDVDt6zffrAjCMkKL7UURz-vvc6utCNMEgt8jSkDWi-mt-jmttkD5mwHqUf3HxWPhfjYNmkTok_XL79F5RXhiF_cu_2oDLDc-RuXdrHaRt9xjUIyZhVJMhaMLdmpcAokQlZxc2W6aj92HKzk3EjyHwfdwfKQNgMooXNzxjE9vCHUbahyLZvtPwiqDtYUSnvN_XOpAMUilxByJStwNqdB7MaOxeAzn76nITh6DqD1bNtxBiLzA7MxYdfsUSmXHMLpkWNAhlrcEIJui9PKm9E0OLFD3M7cCqi6rVvzDxvHqXz3-fcXiSJSRrSmSTu1_ok35TT4WwA9SkHpGe2MJ3uc-8CRlYmjDTcLyXWs_d8i3iNozo6xgiwqIkty4HqScTjhXndRQdmiK-RcUfNLM0Iqm6wYgOifWj728_9GCtdjup-C2uVPdwVwuOjwLbzctZLlFqH3i5IGrCfuOOCAcc_vN3REFqSrDEi4-9qpXuh7yk5pOaiCZYr3-uVhmY5neo55_eV8N3NooDyztwkzRtB_DdbaNrqxk3WEHU79Hseg7c1mkXGm6Djqt3dkkrdpbltzRLrnGKxA4-FzccKOT_P27UYmxQSkyfpAQhfH3jpOE0n9-UYyULbMOY7ZIypXUTquJnrZM3rD_NypU7Jg8uBBGqcziZFc"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "RS512"
expect resp.http.x-jwt-verify-RS512 == "1"
} -run
# The following token is invalid (the signature used SHA384 instead of SHA512)
client c8 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"RS512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# OpenSSL cmd : openssl dgst -sha512 -sign rsa-private.pem data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/rs512" -hdr "Authorization: Bearer eyJhbGciOiJSUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.GuR-v91EMCVvvTTLiE56O0oDAKeQ5JdLqvHtrgOp2MbUtF7zCDutV0LTmMo4qDNVpvTnD3GZfTTGaVUTvW7kIQ3_1iEVAg61qVWkT9rtHHxifDX70RDBKkvNcMWyQH-dFP_FUvCmhCu7q-AzgBT6PHvs5ZqYyQvlQ1gSWZEPFi184dhvcUQrQC6CySEAdOzIryIHH2oQjN_a9lA9V9M_CH3P-AAwFE7NwUE1H1SGIYM4NHcngEZ3B4lBCHOhhgQMpfagcxQjjXv7VfeSqza6OZDpupwlOl34bb0gnFDGMh4hHSS6iHvvwCeCkclbyvKV0Vq0MaRtJuoKRF-_Oww-nKT_bfNtbF6MeOQLNRlYjGCHerWoBtjv3w2KjoLvQ5iGIFI3cEguyrrKNimpovF4Y5uINH0pWdRF99zOwVUlcJBk3RivIb--Y6s47aNFIVWimUpSn-8MSHTla20TYbcdVaZaMur09Cw500jPrOy6jFqVydSnmU6r13NkmCD5-Bl0mgwGtpZcOQExrnIcPQky12kQJAIrffVblvtkd-8FIBPBy1uBKCgkE-q9_suEvBTdvaoTocBmPcIxfPjZUVXeU3UmnRrXEz17pue0YfrwK9CUR9UoP0F5C7O5eSbAtZNm4Hpkiah0w7qugWG3esMgku3-xx0B2xwg6Ul7bAgEJFg"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "RS512"
expect resp.http.x-jwt-verify-RS512 == "0"
} -run
client c9 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"ES256","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# Key gen process : openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out es256-private.pem; openssl ec -in es256-private.pem -pubout -out es256-public.pem
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
# Token creation : ./build_token.py ES256 '{"sub":"1234567890","name":"John Doe","iat":1516239022}' es256-private.pem
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
txreq -url "/es256" -hdr "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.pNI_c5mHE3mLV0YDpstlP4l3t5XARLl6OmcKLuvF5r60m-C63mbgfKWdPjmJPMTCmX_y50YW_v2SKw0ju0tJHw"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "ES256"
expect resp.http.x-jwt-verify-ES256 == "1"
} -run
client c10 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"ES384","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# Key gen process : openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-384 -out es384-private.pem; openssl ec -in es384-private.pem -pubout -out es384-public.pem
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
# Token creation : ./build_token.py ES384 '{"sub":"1234567890","name":"John Doe","iat":1516239022}' es384-private.pem
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
txreq -url "/es384" -hdr "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzM4NCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.cs59CQiCI_Pl8J-PKQ2y73L5IJascZXkf7MfRXycO1HkT9pqDW2bFr1bh7pFyPA85GaML4BPYVH_zDhcmjSMn_EIvUV8cPDuuUu69Au7n9LYGVkVJ-k7qN4DAR5eLCiU"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "ES384"
expect resp.http.x-jwt-verify-ES384 == "1"
} -run
client c11 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"ES512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# Key gen process : openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-521 -out es512-private.pem; openssl ec -in es512-private.pem -pubout -out es512-public.pem
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
# Token creation : ./build_token.py ES512 '{"sub":"1234567890","name":"John Doe","iat":1516239022}' es512-private.pem
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
txreq -url "/es512" -hdr "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzUxMiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.AJcyt0OYf2wg7SggJJVKYysLUkBQA0f0Zc0EbKgud2fQLeT65n42A9l9hhGje79VLWhEyisQmDpFXTpfFXeD_NiaAXyNnX5b8TbZALqxbjx8iIpbcObgUh_g5Gi81bKmRmfXUHW7L5iAwoNjYbUpXGipCpCD0N6-8zCrjcFD2UX01f0Y"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "ES512"
expect resp.http.x-jwt-verify-ES512 == "1"
} -run
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
client c12 -connect ${h1_mainfe_sock} {
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
# Token content : {"alg":"PS256","typ":"JWT"}
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
# Token creation : ./build_token.py PS256 '{"sub":"1234567890","name":"John Doe","iat":1516239022}' rsa-private.pem
txreq -url "/ps256" -hdr "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.eXzN8m41ejgmbtJPhgifU_jMuYwVXL3HsLMOJ_ERipNcuqVQUmfHib1MWydSOYkgNBIm2lK9LjUmRCs1LvMUsbcqnokebFUNmO6IFdbMj3kD4cvqXHyK0yogQ7fdtJZf3_ukcJQ_-IdCG6mwowq6-OLjv-v2EflwPsT33EGmEDuE-7Z8AVTOVPiKUrqq1KqBi7NnnzdghqKfXn4b0yT7CnxQ_GK4F-ghBxBiMXK2J8M6pvS1vof7PyzVQmpeNzn2Rpbk-Ez88WeoTQXqZL1_BeW0z8FeyWXoIiqAzluRHSfZf2iUwrHuiH-tZ5BkAsJXHMDhMoL8_TKdD2hAnCWdVA9W9bQpzfaCbF5xv8lkGcy01ekrh-rN6ZOjItYeDj3BuaQgrKa5YAs_Grei_iSLqAu_YmDiVJxBfv5ahe1I8rwBQ7lIsZqv6p8BKqBFNylLzIFioAtmHJBF0HtItLoj0Mp_bUuU6RLIwf7C8ZWPQVTVsTgHMAlnZLNnQ3vhcxCjLm-r45M3AUFQfMEy1ajiqpFb3z2ElEwiOS9uLYJs3AOAoJDc-e62VJ7tRlw7KB-Vw0mvztvXgYdit48KOxdbn15HQ0lbBM_jJHvbYjDFC0iGUaizBPqmOJcTvObvKv5itEhPT6ffsv9XBnRSv9f3kW_rI7chrCyRZc0nFUvEJ9o"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
rxresp
expect resp.status == 200
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
expect resp.http.x-jwt-alg == "PS256"
expect resp.http.x-jwt-verify-PS256 == "1"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
} -run
client c13 -connect ${h1_mainfe_sock} {
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
# Token content : {"alg":"PS384","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# Token creation : ./build_token.py PS384 '{"sub":"1234567890","name":"John Doe","iat":1516239022}' rsa-private.pem
txreq -url "/ps384" -hdr "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzM4NCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.f-il5pRvC_vYuJ5jI-q9zxgqStCzvICKJyJEmVSjK47uLtt24SNLsQ1V24gqGuDOkXAhxlVu9rUwvtbzOQbF6N1YFFKbCuJ7zbGG81j5r3IuFl_5y6v077PW3hSNn62WX1GDv8w_kGedAZqGwKhJR7D1CbPBE5v-b4PskVF1V7IrFx8PufS_LUeJq1Etei0iU7H9OWD0yVApE_nmeELy4Kz1cc1fQZTBzd-b6kB562JbUbENM14HoiuKpnZvDtQks93A7y_B14SZPrxDaiVI-fR1n8Ja10wyBqbw8mWzt4s7vkxQI8U0eTBcj6bpWcm6S947G_jjoum_Lu3ZSKXE4UxcZ2IIuM74PEUgWJUjr4f9klB8kplJS5AIXMUNG6QbgZhOdSfZmlfzZUmSt1CLI22rTadXjvn-5CG_VxWJUjcPF9hViFFKQ7qQw3Tcn73ZKf5toK3imQBay4vR11DYWP5flLscFtqPvFcV4qhNarG-kVTI2xO8wXDXEoKeIXvsr3GTmCmBbs-kxvtyI80GUTzKN2I9vp0W9Qo5GNa3DDU1-io3olVwtMFh_0qfhmdO1Rt-j11gGnYTz3S5zMMMG2Ihy8ho3ayNZlZf7MJvVBSPqbCpHdiRa8VgTyYdYvK81lgkSc3wE8CygFEBMEi9b181OKPODlpux6k-3AL_2Hs"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "PS384"
expect resp.http.x-jwt-verify-PS384 == "1"
} -run
client c14 -connect ${h1_mainfe_sock} {
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
# Token content : {"alg":"PS512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
# Token creation : ./build_token.py PS512 '{"sub":"1234567890","name":"John Doe","iat":1516239022}' rsa-private.pem
txreq -url "/ps512" -hdr "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJQUzUxMiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.tJZQn0ksGx7vFpBzhNkP8vupyRiAAy5Rf6UdR2MEnO6-iwisbXOUrwwh8XQWngEe2O5FJabCxJRI_shSVEUuWY2Vz6kvRAQ6sWv_4uoPTUk9zjSXkS6C_nb_UY_6tUz39qA-OI80JKcLadvjB66CGWHI00C5Xz2gyWQuFgSItBIV6l0wI6Spf4NJa2Lefo7XbobQ7-u-yzgbIJ1BgXFOTWHYsgJ67n39gj7MDDsUjSaNbFlKfbvGJrdli5_PNNSdoNiF0pdsd6vldnucs5Rfysp4V-nbBzrORuJhl0_BlPG7_Wbap0sm6NCnzp1ks3D5_OWLZxJZNw_TJ2OuVHOX2PNj2MuHjMPDMKKxgxIXQJ8ry39-sk56ZrCJ8UqZofk8NX7Z4ypeWrK62BNSTLY8Le4WzF6dYcuawxiyt7xsC0MkaplXpRFLdmHrMhvyZz6S8BFhtlGD-PnRnEr8qZkThiZSs5kcEW8ryneKlN5TQ7E0H1HekUUii3_T9MtC5rNsT1vzyGr0XAn5TLxeal4Gvp3WyOHs4l7Q1EyQXPkAX8bWwODtLZ3DrREwdLb7Ex2k9wRDF52aww9EMpeLM3at6MQKggWQhNEClahN9AWBj7Vz-RqliWEIdUdNTL3d1JgLX41GZqXjOGZIwiVJwYpVRh1jKVhUn8pN8jCtoeiUxh8"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "PS512"
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
expect resp.http.x-jwt-verify-PS512 == "1"
} -run
# The following token is invalid (too short)
client c15 -connect ${h1_mainfe_sock} {
# Token content : {"alg":"ES512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# OpenSSL cmd : openssl dgst -sha512 -sign es512-private.pem data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/es512" -hdr "Authorization: Bearer eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.MIGHAkEEPEgIrFKIDofBpFKX_mtya55QboGr09P6--v8uO85DwQWR0iKgMNSzYkL3K1lwyExG0Vtwfnife0lNe7Fn5TigAJCAY95NShiTn3tvleXVGCkkD0-HcribnMhd34QPGRc4rlwTkUg9umIUhxnEhPR--OohlmhJyIYGHuH8Ksm5f"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "ES512"
# Invalid token
expect resp.http.x-jwt-verify-ES512 == "-3"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
} -run
# Unknown algorithm
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
client c16 -connect ${h1_mainfe_sock} {
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
# Token content : {"alg":"UNKNOWN_ALG","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
txreq -url "/errors" -hdr "Authorization: Bearer eyJhbGciOiJVTktOT1dOX0FMRyIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.MIGHAkEEPEgIrFKIDofBpFKX_mtya55QboGr09P6--v8uO85DwQWR0iKgMNSzYkL3K1lwyExG0Vtwfnife0lNe7Fn5TigAJCAY95NShiTn3tvleXVGCkkD0-HcribnMhd34QPGRc4rlwTkUg9umIUhxnEhPR--OohlmhJyIYGHuH8Ksm5f"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "UNKNOWN_ALG"
# Unmanaged algorithm
MINOR: jwt: jwt_verify returns negative values in case of error In order for all the error return values to be distributed on the same side (instead of surrounding the success error code), the return values for errors other than a simple verification failure are switched to negative values. This way the result of the jwt_verify converter can be compared strictly to 1 as well relative to 0 (any <= 0 return value is an error). The documentation was also modified to discourage conversion of the return value into a boolean (which would definitely not work).
2021-10-18 13:14:49 +00:00
expect resp.http.x-jwt-verify == "-1"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
} -run
# Invalid token (not enough fields)
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
client c17 -connect ${h1_mainfe_sock} {
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
# Token content : {"alg":"ES512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
txreq -url "/errors" -hdr "Authorization: Bearer eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "ES512"
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
# Invalid token
MINOR: jwt: jwt_verify returns negative values in case of error In order for all the error return values to be distributed on the same side (instead of surrounding the success error code), the return values for errors other than a simple verification failure are switched to negative values. This way the result of the jwt_verify converter can be compared strictly to 1 as well relative to 0 (any <= 0 return value is an error). The documentation was also modified to discourage conversion of the return value into a boolean (which would definitely not work).
2021-10-18 13:14:49 +00:00
expect resp.http.x-jwt-verify == "-3"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
} -run
# Invalid token (too many fields)
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
client c18 -connect ${h1_mainfe_sock} {
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
# Token content : {"alg":"ES512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
txreq -url "/errors" -hdr "Authorization: Bearer eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.MIGHAkEEPEgIrFKIDofBpFKX_mtya55QboGr09P6--v8uO85DwQWR0iKgMNSzYkL3K1lwyExG0Vtwfnife0lNe7Fn5TigAJCAY95NShiTn3tvleXVGCkkD0-HcribnMhd34QPGRc4rlwTkUg9umIUhxnEhPR--OohlmhJyIYGHuH8Ksm5f.unexpectedextrafield"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "ES512"
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
# Invalid token
MINOR: jwt: jwt_verify returns negative values in case of error In order for all the error return values to be distributed on the same side (instead of surrounding the success error code), the return values for errors other than a simple verification failure are switched to negative values. This way the result of the jwt_verify converter can be compared strictly to 1 as well relative to 0 (any <= 0 return value is an error). The documentation was also modified to discourage conversion of the return value into a boolean (which would definitely not work).
2021-10-18 13:14:49 +00:00
expect resp.http.x-jwt-verify == "-3"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
} -run
# Invalid token (empty signature)
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
client c19 -connect ${h1_mainfe_sock} {
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
# Token content : {"alg":"ES512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
txreq -url "/errors" -hdr "Authorization: Bearer eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ."
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "ES512"
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
# Invalid token
MINOR: jwt: jwt_verify returns negative values in case of error In order for all the error return values to be distributed on the same side (instead of surrounding the success error code), the return values for errors other than a simple verification failure are switched to negative values. This way the result of the jwt_verify converter can be compared strictly to 1 as well relative to 0 (any <= 0 return value is an error). The documentation was also modified to discourage conversion of the return value into a boolean (which would definitely not work).
2021-10-18 13:14:49 +00:00
expect resp.http.x-jwt-verify == "-3"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
} -run
# Unknown certificate
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
client c20 -connect ${h1_mainfe_sock} {
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
# Token content : {"alg":"ES512","typ":"JWT"}
# {"sub":"1234567890","name":"John Doe","iat":1516239022}
# Key gen process : openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-521 -out es512-private.pem; openssl ec -in es512-private.pem -pubout -out es512-public.pem
# OpenSSL cmd : openssl dgst -sha512 -sign es512-private.pem data.txt | base64 | tr -d '=\n' | tr '/+' '_-'
txreq -url "/errors" -hdr "Authorization: Bearer eyJhbGciOiJFUzUxMiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.MIGHAkEEPEgIrFKIDofBpFKX_mtya55QboGr09P6--v8uO85DwQWR0iKgMNSzYkL3K1lwyExG0Vtwfnife0lNe7Fn5TigAJCAY95NShiTn3tvleXVGCkkD0-HcribnMhd34QPGRc4rlwTkUg9umIUhxnEhPR--OohlmhJyIYGHuH8Ksm5fSIWfRa"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-alg == "ES512"
BUG/MEDIUM: jwt: Properly process ecdsa signatures (concatenated R and S params) When the JWT token signature is using ECDSA algorithm (ES256 for instance), the signature is a direct concatenation of the R and S parameters instead of OpenSSL's DER format (see section 3.4 of RFC7518). The code that verified the signatures wrongly assumed that they came in OpenSSL's format and it did not actually work. We now have the extra step of converting the signature into a complete ECDSA_SIG that can be fed into OpenSSL's digest verification functions. The ECDSA signatures in the regtest had to be recalculated and it was made via the PyJWT python library so that we don't end up checking signatures that we built ourselves anymore. This patch should fix GitHub issue #2001. It should be backported up to branch 2.5.
2023-01-18 14:32:28 +00:00
# Unknown certificate
MINOR: jwt: jwt_verify returns negative values in case of error In order for all the error return values to be distributed on the same side (instead of surrounding the success error code), the return values for errors other than a simple verification failure are switched to negative values. This way the result of the jwt_verify converter can be compared strictly to 1 as well relative to 0 (any <= 0 return value is an error). The documentation was also modified to discourage conversion of the return value into a boolean (which would definitely not work).
2021-10-18 13:14:49 +00:00
expect resp.http.x-jwt-verify == "-5"
REGTESTS: jwt: Add tests for the jwt_verify converter This regtest uses the new jwt_header_query, jwt_payload_query and jwt_verify converters that can be used to validate a JSON Web Token.
2021-10-01 13:36:59 +00:00
} -run
BUG/MINOR: http: http_auth_bearer fetch does not work on custom header name The http_auth_bearer sample fetch can take a header name as parameter, in which case it will try to extract a Bearer value out of the given header name instead of the default "Authorization" one. In this case, the extraction would not have worked because of a misuse of strncasecmp. This patch fixes this by replacing the standard string functions by ist ones. It also properly manages the multiple spaces that could be found between the scheme and its value. No backport needed, that's part of JWT which is only in 2.5. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2021-10-29 13:25:19 +00:00
# Test the http_auth_bearer special cases (other header than the default "Authorization" one)
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
client c21 -connect ${h1_mainfe_sock} {
BUG/MINOR: http: http_auth_bearer fetch does not work on custom header name The http_auth_bearer sample fetch can take a header name as parameter, in which case it will try to extract a Bearer value out of the given header name instead of the default "Authorization" one. In this case, the extraction would not have worked because of a misuse of strncasecmp. This patch fixes this by replacing the standard string functions by ist ones. It also properly manages the multiple spaces that could be found between the scheme and its value. No backport needed, that's part of JWT which is only in 2.5. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2021-10-29 13:25:19 +00:00
txreq -url "/auth_bearer" -hdr "Custom-Authorization: Bearer random_value"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-token == "random_value"
} -run
# Test the http_auth_bearer special cases (multiple spaces after the scheme)
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
client c22 -connect ${h1_mainfe_sock} {
BUG/MINOR: http: http_auth_bearer fetch does not work on custom header name The http_auth_bearer sample fetch can take a header name as parameter, in which case it will try to extract a Bearer value out of the given header name instead of the default "Authorization" one. In this case, the extraction would not have worked because of a misuse of strncasecmp. This patch fixes this by replacing the standard string functions by ist ones. It also properly manages the multiple spaces that could be found between the scheme and its value. No backport needed, that's part of JWT which is only in 2.5. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2021-10-29 13:25:19 +00:00
txreq -url "/auth_bearer" -hdr "Custom-Authorization: Bearer random_value"
rxresp
expect resp.status == 200
expect resp.http.x-jwt-token == "random_value"
} -run
# Test the http_auth_bearer special cases (no value after the scheme)
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
client c23 -connect ${h1_mainfe_sock} {
BUG/MINOR: http: http_auth_bearer fetch does not work on custom header name The http_auth_bearer sample fetch can take a header name as parameter, in which case it will try to extract a Bearer value out of the given header name instead of the default "Authorization" one. In this case, the extraction would not have worked because of a misuse of strncasecmp. This patch fixes this by replacing the standard string functions by ist ones. It also properly manages the multiple spaces that could be found between the scheme and its value. No backport needed, that's part of JWT which is only in 2.5. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2021-10-29 13:25:19 +00:00
txreq -url "/auth_bearer" -hdr "Custom-Authorization: Bearer "
rxresp
expect resp.status == 200
expect resp.http.x-jwt-token == ""
} -run
# Test the http_auth_bearer special cases (no value after the scheme)
MINOR: jwt: Add support for RSA-PSS signatures (PS256 algorithm) This patch adds the support for the PS algorithms when verifying JWT signatures (rsa-pss). It was not managed during the first implementation and previously raised an "Unmanaged algorithm" error. The tests use the same rsa signature as the plain rsa tests (RS256 ...) and the implementation simply adds a call to EVP_PKEY_CTX_set_rsa_padding in the function that manages rsa and ecdsa signatures. The signatures in the reg-test were built thanks to the PyJWT python library once again.
2023-03-07 16:43:57 +00:00
client c24 -connect ${h1_mainfe_sock} {
BUG/MINOR: http: http_auth_bearer fetch does not work on custom header name The http_auth_bearer sample fetch can take a header name as parameter, in which case it will try to extract a Bearer value out of the given header name instead of the default "Authorization" one. In this case, the extraction would not have worked because of a misuse of strncasecmp. This patch fixes this by replacing the standard string functions by ist ones. It also properly manages the multiple spaces that could be found between the scheme and its value. No backport needed, that's part of JWT which is only in 2.5. Co-authored-by: Tim Duesterhus <tim@bastelstu.be>
2021-10-29 13:25:19 +00:00
txreq -url "/errors" -hdr "Authorization: Bearer "
rxresp
expect resp.status == 200
expect resp.http.x-jwt-token == ""
} -run