git.iko.soy/typeable/oauth2-proxy
on master help sign in
Move Encrypt/Decrypt Into helper to session_state.go

This helper method is only applicable for Base64 wrapped encryption since it operated on string -> string primarily. It wouldn't be used for pure CFB/GCM ciphers. After a messagePack session refactor, this method would further only be used for legacy session compatibility - making its placement in cipher.go not ideal.

commit19796275347540d561a1585d5fadab89f8220fa8 authorNick Meves <nick.meves@greenhouse.io> dateThu 4 Jun 2020, 14:39 (6 years ago) parent014fa68
4 files changed+105−169
compare with master
unifiedsplit
pkg/apis/sessions/session_state.go+21−4 pkg/apis/sessions/session_state_test.go+72−29 pkg/encryption/cipher.go+12−61 pkg/encryption/cipher_test.go−75
pkg/apis/sessions/session_state.go+21−4
@@ -77,7 +77,7 @@ func (s *SessionState) EncodeSessionState(c encryption.Cipher) (string, error) {
7777 &ss.IDToken,
7878 &ss.RefreshToken,
7979 } {
80− err := c.EncryptInto(s)
80+ err := into(s, c.Encrypt)
8181 if err != nil {
8282 return "", err
8383 }
@@ -106,13 +106,13 @@ func DecodeSessionState(v string, c encryption.Cipher) (*SessionState, error) {
106106 } else {
107107 // Backward compatibility with using unencrypted Email or User
108108 // Decryption errors will leave original string
109− err = c.DecryptInto(&ss.Email)
109+ err = into(&ss.Email, c.Decrypt)
110110 if err == nil {
111111 if !utf8.ValidString(ss.Email) {
112112 return nil, errors.New("invalid value for decrypted email")
113113 }
114114 }
115− err = c.DecryptInto(&ss.User)
115+ err = into(&ss.User, c.Decrypt)
116116 if err == nil {
117117 if !utf8.ValidString(ss.User) {
118118 return nil, errors.New("invalid value for decrypted user")
@@ -125,7 +125,7 @@ func DecodeSessionState(v string, c encryption.Cipher) (*SessionState, error) {
125125 &ss.IDToken,
126126 &ss.RefreshToken,
127127 } {
128− err := c.DecryptInto(s)
128+ err := into(s, c.Decrypt)
129129 if err != nil {
130130 return nil, err
131131 }
@@ -133,3 +133,20 @@ func DecodeSessionState(v string, c encryption.Cipher) (*SessionState, error) {
133133 }
134134 return &ss, nil
135135}
136+
137+// codecFunc is a function that takes a []byte and encodes/decodes it
138+type codecFunc func([]byte) ([]byte, error)
139+
140+func into(s *string, f codecFunc) error {
141+ // Do not encrypt/decrypt nil or empty strings
142+ if s == nil || *s == "" {
143+ return nil
144+ }
145+
146+ d, err := f([]byte(*s))
147+ if err != nil {
148+ return err
149+ }
150+ *s = string(d)
151+ return nil
152+}
pkg/apis/sessions/session_state_test.go+72−29
@@ -1,11 +1,13 @@
1−package sessions_test
1+package sessions
22
33import (
4+ "crypto/rand"
45 "fmt"
6+ "io"
7+ mathrand "math/rand"
58 "testing"
69 "time"
710
8− "github.com/oauth2-proxy/oauth2-proxy/pkg/apis/sessions"
911 "github.com/oauth2-proxy/oauth2-proxy/pkg/encryption"
1012 "github.com/stretchr/testify/assert"
1113)
@@ -26,7 +28,7 @@ func TestSessionStateSerialization(t *testing.T) {
2628 assert.Equal(t, nil, err)
2729 c2, err := newTestCipher([]byte(altSecret))
2830 assert.Equal(t, nil, err)
29− s := &sessions.SessionState{
31+ s := &SessionState{
3032 Email: "user@domain.com",
3133 PreferredUsername: "user",
3234 AccessToken: "token1234",
@@ -38,7 +40,7 @@ func TestSessionStateSerialization(t *testing.T) {
3840 encoded, err := s.EncodeSessionState(c)
3941 assert.Equal(t, nil, err)
4042
41− ss, err := sessions.DecodeSessionState(encoded, c)
43+ ss, err := DecodeSessionState(encoded, c)
4244 t.Logf("%#v", ss)
4345 assert.Equal(t, nil, err)
4446 assert.Equal(t, "", ss.User)
@@ -51,7 +53,7 @@ func TestSessionStateSerialization(t *testing.T) {
5153 assert.Equal(t, s.RefreshToken, ss.RefreshToken)
5254
5355 // ensure a different cipher can't decode properly (ie: it gets gibberish)
54− ss, err = sessions.DecodeSessionState(encoded, c2)
56+ ss, err = DecodeSessionState(encoded, c2)
5557 t.Logf("%#v", ss)
5658 assert.NotEqual(t, nil, err)
5759}
@@ -61,7 +63,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {
6163 assert.Equal(t, nil, err)
6264 c2, err := newTestCipher([]byte(altSecret))
6365 assert.Equal(t, nil, err)
64− s := &sessions.SessionState{
66+ s := &SessionState{
6567 User: "just-user",
6668 PreferredUsername: "ju",
6769 Email: "user@domain.com",
@@ -73,7 +75,7 @@ func TestSessionStateSerializationWithUser(t *testing.T) {
7375 encoded, err := s.EncodeSessionState(c)
7476 assert.Equal(t, nil, err)
7577
76− ss, err := sessions.DecodeSessionState(encoded, c)
78+ ss, err := DecodeSessionState(encoded, c)
7779 t.Logf("%#v", ss)
7880 assert.Equal(t, nil, err)
7981 assert.Equal(t, s.User, ss.User)
@@ -85,13 +87,13 @@ func TestSessionStateSerializationWithUser(t *testing.T) {
8587 assert.Equal(t, s.RefreshToken, ss.RefreshToken)
8688
8789 // ensure a different cipher can't decode properly (ie: it gets gibberish)
88− ss, err = sessions.DecodeSessionState(encoded, c2)
90+ ss, err = DecodeSessionState(encoded, c2)
8991 t.Logf("%#v", ss)
9092 assert.NotEqual(t, nil, err)
9193}
9294
9395func TestSessionStateSerializationNoCipher(t *testing.T) {
94− s := &sessions.SessionState{
96+ s := &SessionState{
9597 Email: "user@domain.com",
9698 PreferredUsername: "user",
9799 AccessToken: "token1234",
@@ -103,7 +105,7 @@ func TestSessionStateSerializationNoCipher(t *testing.T) {
103105 assert.Equal(t, nil, err)
104106
105107 // only email should have been serialized
106− ss, err := sessions.DecodeSessionState(encoded, nil)
108+ ss, err := DecodeSessionState(encoded, nil)
107109 assert.Equal(t, nil, err)
108110 assert.Equal(t, "", ss.User)
109111 assert.Equal(t, s.Email, ss.Email)
@@ -113,7 +115,7 @@ func TestSessionStateSerializationNoCipher(t *testing.T) {
113115}
114116
115117func TestSessionStateSerializationNoCipherWithUser(t *testing.T) {
116− s := &sessions.SessionState{
118+ s := &SessionState{
117119 User: "just-user",
118120 Email: "user@domain.com",
119121 PreferredUsername: "user",
@@ -126,7 +128,7 @@ func TestSessionStateSerializationNoCipherWithUser(t *testing.T) {
126128 assert.Equal(t, nil, err)
127129
128130 // only email should have been serialized
129− ss, err := sessions.DecodeSessionState(encoded, nil)
131+ ss, err := DecodeSessionState(encoded, nil)
130132 assert.Equal(t, nil, err)
131133 assert.Equal(t, s.User, ss.User)
132134 assert.Equal(t, s.Email, ss.Email)
@@ -136,18 +138,18 @@ func TestSessionStateSerializationNoCipherWithUser(t *testing.T) {
136138}
137139
138140func TestExpired(t *testing.T) {
139− s := &sessions.SessionState{ExpiresOn: timePtr(time.Now().Add(time.Duration(-1) * time.Minute))}
141+ s := &SessionState{ExpiresOn: timePtr(time.Now().Add(time.Duration(-1) * time.Minute))}
140142 assert.Equal(t, true, s.IsExpired())
141143
142− s = &sessions.SessionState{ExpiresOn: timePtr(time.Now().Add(time.Duration(1) * time.Minute))}
144+ s = &SessionState{ExpiresOn: timePtr(time.Now().Add(time.Duration(1) * time.Minute))}
143145 assert.Equal(t, false, s.IsExpired())
144146
145− s = &sessions.SessionState{}
147+ s = &SessionState{}
146148 assert.Equal(t, false, s.IsExpired())
147149}
148150
149151type testCase struct {
150− sessions.SessionState
152+ SessionState
151153 Encoded string
152154 Cipher encryption.Cipher
153155 Error bool
@@ -163,14 +165,14 @@ func TestEncodeSessionState(t *testing.T) {
163165
164166 testCases := []testCase{
165167 {
166− SessionState: sessions.SessionState{
168+ SessionState: SessionState{
167169 Email: "user@domain.com",
168170 User: "just-user",
169171 },
170172 Encoded: `{"Email":"user@domain.com","User":"just-user"}`,
171173 },
172174 {
173− SessionState: sessions.SessionState{
175+ SessionState: SessionState{
174176 Email: "user@domain.com",
175177 User: "just-user",
176178 AccessToken: "token1234",
@@ -185,7 +187,7 @@ func TestEncodeSessionState(t *testing.T) {
185187
186188 for i, tc := range testCases {
187189 encoded, err := tc.EncodeSessionState(tc.Cipher)
188− t.Logf("i:%d Encoded:%#vsessions.SessionState:%#v Error:%#v", i, encoded, tc.SessionState, err)
190+ t.Logf("i:%d Encoded:%#vSessionState:%#v Error:%#v", i, encoded, tc.SessionState, err)
189191 if tc.Error {
190192 assert.Error(t, err)
191193 assert.Empty(t, encoded)
@@ -210,34 +212,34 @@ func TestDecodeSessionState(t *testing.T) {
210212
211213 testCases := []testCase{
212214 {
213− SessionState: sessions.SessionState{
215+ SessionState: SessionState{
214216 Email: "user@domain.com",
215217 User: "just-user",
216218 },
217219 Encoded: `{"Email":"user@domain.com","User":"just-user"}`,
218220 },
219221 {
220− SessionState: sessions.SessionState{
222+ SessionState: SessionState{
221223 Email: "user@domain.com",
222224 User: "",
223225 },
224226 Encoded: `{"Email":"user@domain.com"}`,
225227 },
226228 {
227− SessionState: sessions.SessionState{
229+ SessionState: SessionState{
228230 User: "just-user",
229231 },
230232 Encoded: `{"User":"just-user"}`,
231233 },
232234 {
233− SessionState: sessions.SessionState{
235+ SessionState: SessionState{
234236 Email: "user@domain.com",
235237 User: "just-user",
236238 },
237239 Encoded: fmt.Sprintf(`{"Email":"user@domain.com","User":"just-user","AccessToken":"I6s+ml+/MldBMgHIiC35BTKTh57skGX24w==","IDToken":"xojNdyyjB1HgYWh6XMtXY/Ph5eCVxa1cNsklJw==","RefreshToken":"qEX0x6RmASxo4dhlBG6YuRs9Syn/e9sHu/+K","CreatedAt":%s,"ExpiresOn":%s}`, createdString, eString),
238240 },
239241 {
240− SessionState: sessions.SessionState{
242+ SessionState: SessionState{
241243 Email: "user@domain.com",
242244 User: "just-user",
243245 AccessToken: "token1234",
@@ -250,7 +252,7 @@ func TestDecodeSessionState(t *testing.T) {
250252 Cipher: c,
251253 },
252254 {
253− SessionState: sessions.SessionState{
255+ SessionState: SessionState{
254256 Email: "user@domain.com",
255257 User: "just-user",
256258 },
@@ -268,7 +270,7 @@ func TestDecodeSessionState(t *testing.T) {
268270 Error: true,
269271 },
270272 {
271− SessionState: sessions.SessionState{
273+ SessionState: SessionState{
272274 Email: "user@domain.com",
273275 User: "YmFzZTY0LWVuY29kZWQtdXNlcgo=", // Base64 encoding of base64-encoded-user
274276 },
@@ -278,8 +280,8 @@ func TestDecodeSessionState(t *testing.T) {
278280 }
279281
280282 for i, tc := range testCases {
281− ss, err := sessions.DecodeSessionState(tc.Encoded, tc.Cipher)
282− t.Logf("i:%d Encoded:%#vsessions.SessionState:%#v Error:%#v", i, tc.Encoded, ss, err)
283+ ss, err := DecodeSessionState(tc.Encoded, tc.Cipher)
284+ t.Logf("i:%d Encoded:%#vSessionState:%#v Error:%#v", i, tc.Encoded, ss, err)
283285 if tc.Error {
284286 assert.Error(t, err)
285287 assert.Nil(t, ss)
@@ -301,7 +303,7 @@ func TestDecodeSessionState(t *testing.T) {
301303}
302304
303305func TestSessionStateAge(t *testing.T) {
304− ss := &sessions.SessionState{}
306+ ss := &SessionState{}
305307
306308 // Created at unset so should be 0
307309 assert.Equal(t, time.Duration(0), ss.Age())
@@ -310,3 +312,44 @@ func TestSessionStateAge(t *testing.T) {
310312 ss.CreatedAt = timePtr(time.Now().Add(-1 * time.Hour))
311313 assert.Equal(t, time.Hour, ss.Age().Round(time.Minute))
312314}
315+
316+func TestIntoEncryptAndIntoDecrypt(t *testing.T) {
317+ const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
318+
319+ // Test all 3 valid AES sizes
320+ for _, secretSize := range []int{16, 24, 32} {
321+ t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
322+ secret := make([]byte, secretSize)
323+ _, err := io.ReadFull(rand.Reader, secret)
324+ assert.Equal(t, nil, err)
325+
326+ c, err := newTestCipher(secret)
327+ assert.NoError(t, err)
328+
329+ // Check no errors with empty or nil strings
330+ empty := ""
331+ assert.Equal(t, nil, into(&empty, c.Encrypt))
332+ assert.Equal(t, nil, into(&empty, c.Decrypt))
333+ assert.Equal(t, nil, into(nil, c.Encrypt))
334+ assert.Equal(t, nil, into(nil, c.Decrypt))
335+
336+ // Test various sizes tokens might be
337+ for _, dataSize := range []int{10, 100, 1000, 5000, 10000} {
338+ t.Run(fmt.Sprintf("%d", dataSize), func(t *testing.T) {
339+ b := make([]byte, dataSize)
340+ for i := range b {
341+ b[i] = charset[mathrand.Intn(len(charset))]
342+ }
343+ data := string(b)
344+ originalData := data
345+
346+ assert.Equal(t, nil, into(&data, c.Encrypt))
347+ assert.NotEqual(t, originalData, data)
348+
349+ assert.Equal(t, nil, into(&data, c.Decrypt))
350+ assert.Equal(t, originalData, data)
351+ })
352+ }
353+ })
354+ }
355+}
pkg/encryption/cipher.go+12−61
@@ -13,11 +13,9 @@ import (
1313type Cipher interface {
1414 Encrypt(value []byte) ([]byte, error)
1515 Decrypt(ciphertext []byte) ([]byte, error)
16− EncryptInto(s *string) error
17− DecryptInto(s *string) error
1816}
1917
20−type Base64Cipher struct {
18+type base64Cipher struct {
2119 Cipher Cipher
2220}
2321
@@ -28,11 +26,11 @@ func NewBase64Cipher(initCipher func([]byte) (Cipher, error), secret []byte) (Ci
2826 if err != nil {
2927 return nil, err
3028 }
31− return &Base64Cipher{Cipher: c}, nil
29+ return &base64Cipher{Cipher: c}, nil
3230}
3331
3432// Encrypt encrypts a value with the embedded Cipher & Base64 encodes it
35−func (c *Base64Cipher) Encrypt(value []byte) ([]byte, error) {
33+func (c *base64Cipher) Encrypt(value []byte) ([]byte, error) {
3634 encrypted, err := c.Cipher.Encrypt(value)
3735 if err != nil {
3836 return nil, err
@@ -42,7 +40,7 @@ func (c *Base64Cipher) Encrypt(value []byte) ([]byte, error) {
4240}
4341
4442// Decrypt Base64 decodes a value & decrypts it with the embedded Cipher
45−func (c *Base64Cipher) Decrypt(ciphertext []byte) ([]byte, error) {
43+func (c *base64Cipher) Decrypt(ciphertext []byte) ([]byte, error) {
4644 encrypted, err := base64.StdEncoding.DecodeString(string(ciphertext))
4745 if err != nil {
4846 return nil, fmt.Errorf("failed to base64 decode value %s", err)
@@ -51,17 +49,7 @@ func (c *Base64Cipher) Decrypt(ciphertext []byte) ([]byte, error) {
5149 return c.Cipher.Decrypt(encrypted)
5250}
5351
54−// EncryptInto encrypts the value and stores it back in the string pointer
55−func (c *Base64Cipher) EncryptInto(s *string) error {
56− return into(c.Encrypt, s)
57−}
58−
59−// DecryptInto decrypts the value and stores it back in the string pointer
60−func (c *Base64Cipher) DecryptInto(s *string) error {
61− return into(c.Decrypt, s)
62−}
63−
64−type CFBCipher struct {
52+type cfbCipher struct {
6553 cipher.Block
6654}
6755
@@ -71,11 +59,11 @@ func NewCFBCipher(secret []byte) (Cipher, error) {
7159 if err != nil {
7260 return nil, err
7361 }
74− return &CFBCipher{Block: c}, err
62+ return &cfbCipher{Block: c}, err
7563}
7664
7765// Encrypt with AES CFB
78−func (c *CFBCipher) Encrypt(value []byte) ([]byte, error) {
66+func (c *cfbCipher) Encrypt(value []byte) ([]byte, error) {
7967 ciphertext := make([]byte, aes.BlockSize+len(value))
8068 iv := ciphertext[:aes.BlockSize]
8169 if _, err := io.ReadFull(rand.Reader, iv); err != nil {
@@ -88,7 +76,7 @@ func (c *CFBCipher) Encrypt(value []byte) ([]byte, error) {
8876}
8977
9078// Decrypt an AES CFB ciphertext
91−func (c *CFBCipher) Decrypt(ciphertext []byte) ([]byte, error) {
79+func (c *cfbCipher) Decrypt(ciphertext []byte) ([]byte, error) {
9280 if len(ciphertext) < aes.BlockSize {
9381 return nil, fmt.Errorf("encrypted value should be at least %d bytes, but is only %d bytes", aes.BlockSize, len(ciphertext))
9482 }
@@ -101,17 +89,7 @@ func (c *CFBCipher) Decrypt(ciphertext []byte) ([]byte, error) {
10189 return plaintext, nil
10290}
10391
104−// EncryptInto returns an error since the encrypted data is a []byte that isn't string cast-able
105−func (c *CFBCipher) EncryptInto(s *string) error {
106− return fmt.Errorf("CFBCipher is not a string->string compatible cipher")
107−}
108−
109−// EncryptInto returns an error since the encrypted data needs to be a []byte
110−func (c *CFBCipher) DecryptInto(s *string) error {
111− return fmt.Errorf("CFBCipher is not a string->string compatible cipher")
112−}
113−
114−type GCMCipher struct {
92+type gcmCipher struct {
11593 cipher.Block
11694}
11795
@@ -121,11 +99,11 @@ func NewGCMCipher(secret []byte) (Cipher, error) {
12199 if err != nil {
122100 return nil, err
123101 }
124− return &GCMCipher{Block: c}, err
102+ return &gcmCipher{Block: c}, err
125103}
126104
127105// Encrypt with AES GCM on raw bytes
128−func (c *GCMCipher) Encrypt(value []byte) ([]byte, error) {
106+func (c *gcmCipher) Encrypt(value []byte) ([]byte, error) {
129107 gcm, err := cipher.NewGCM(c.Block)
130108 if err != nil {
131109 return nil, err
@@ -141,7 +119,7 @@ func (c *GCMCipher) Encrypt(value []byte) ([]byte, error) {
141119}
142120
143121// Decrypt an AES GCM ciphertext
144−func (c *GCMCipher) Decrypt(ciphertext []byte) ([]byte, error) {
122+func (c *gcmCipher) Decrypt(ciphertext []byte) ([]byte, error) {
145123 gcm, err := cipher.NewGCM(c.Block)
146124 if err != nil {
147125 return nil, err
@@ -156,30 +134,3 @@ func (c *GCMCipher) Decrypt(ciphertext []byte) ([]byte, error) {
156134 }
157135 return plaintext, nil
158136}
159−
160−// EncryptInto returns an error since the encrypted data is a []byte that isn't string cast-able
161−func (c *GCMCipher) EncryptInto(s *string) error {
162− return fmt.Errorf("CFBCipher is not a string->string compatible cipher")
163−}
164−
165−// EncryptInto returns an error since the encrypted data needs to be a []byte
166−func (c *GCMCipher) DecryptInto(s *string) error {
167− return fmt.Errorf("CFBCipher is not a string->string compatible cipher")
168−}
169−
170−// codecFunc is a function that takes a string and encodes/decodes it
171−type codecFunc func([]byte) ([]byte, error)
172−
173−func into(f codecFunc, s *string) error {
174− // Do not encrypt/decrypt nil or empty strings
175− if s == nil || *s == "" {
176− return nil
177− }
178−
179− d, err := f([]byte(*s))
180− if err != nil {
181− return err
182− }
183− *s = string(d)
184− return nil
185−}
pkg/encryption/cipher_test.go−75
@@ -5,7 +5,6 @@ import (
55 "encoding/base64"
66 "fmt"
77 "io"
8− mathrand "math/rand"
98 "testing"
109
1110 "github.com/stretchr/testify/assert"
@@ -118,80 +117,6 @@ func runEncryptAndDecrypt(t *testing.T, c Cipher, dataSize int) {
118117 assert.NotEqual(t, encrypted, decrypted)
119118}
120119
121−func TestEncryptIntoAndDecryptInto(t *testing.T) {
122− // Test our 2 cipher types
123− cipherInits := map[string]func([]byte) (Cipher, error){
124− "CFB": NewCFBCipher,
125− "GCM": NewGCMCipher,
126− }
127− for name, initCipher := range cipherInits {
128− t.Run(name, func(t *testing.T) {
129− // Test all 3 valid AES sizes
130− for _, secretSize := range []int{16, 24, 32} {
131− t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
132− secret := make([]byte, secretSize)
133− _, err := io.ReadFull(rand.Reader, secret)
134− assert.Equal(t, nil, err)
135−
136− // Test Standard & Base64 wrapped
137− cstd, err := initCipher(secret)
138− assert.Equal(t, nil, err)
139−
140− cb64, err := NewBase64Cipher(initCipher, secret)
141− assert.Equal(t, nil, err)
142−
143− ciphers := map[string]Cipher{
144− "Standard": cstd,
145− "Base64": cb64,
146− }
147−
148− for cName, c := range ciphers {
149− // Check no errors with empty or nil strings
150− if cName == "Base64" {
151− empty := ""
152− assert.Equal(t, nil, c.EncryptInto(&empty))
153− assert.Equal(t, nil, c.DecryptInto(&empty))
154− assert.Equal(t, nil, c.EncryptInto(nil))
155− assert.Equal(t, nil, c.DecryptInto(nil))
156− }
157−
158− t.Run(cName, func(t *testing.T) {
159− // Test various sizes sessions might be
160− for _, dataSize := range []int{10, 100, 1000, 5000, 10000} {
161− t.Run(fmt.Sprintf("%d", dataSize), func(t *testing.T) {
162− runEncryptIntoAndDecryptInto(t, c, cName, dataSize)
163− })
164− }
165− })
166− }
167− })
168− }
169− })
170− }
171−}
172−
173−func runEncryptIntoAndDecryptInto(t *testing.T, c Cipher, cipherType string, dataSize int) {
174− const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
175− b := make([]byte, dataSize)
176− for i := range b {
177− b[i] = charset[mathrand.Intn(len(charset))]
178− }
179− data := string(b)
180− originalData := data
181−
182− // Base64 is the only cipher that supports string->string Encrypt/Decrypt Into methods
183− if cipherType == "Base64" {
184− assert.Equal(t, nil, c.EncryptInto(&data))
185− assert.NotEqual(t, originalData, data)
186−
187− assert.Equal(t, nil, c.DecryptInto(&data))
188− assert.Equal(t, originalData, data)
189− } else {
190− assert.NotEqual(t, nil, c.EncryptInto(&data))
191− assert.NotEqual(t, nil, c.DecryptInto(&data))
192− }
193−}
194−
195120func TestDecryptCFBWrongSecret(t *testing.T) {
196121 secret1 := []byte("0123456789abcdefghijklmnopqrstuv")
197122 secret2 := []byte("9876543210abcdefghijklmnopqrstuv")