TestDKIMKeyEncryptedAtRest: with a cipher configured, ClaimOrCreateDomain stores the private key encrypted (tagged 0x01, not parseable as DER), yet both internal readers return the original, valid PKCS#1 key.
(t *testing.T)
| 32 | // the private key encrypted (tagged 0x01, not parseable as DER), yet both internal |
| 33 | // readers return the original, valid PKCS#1 key. |
| 34 | func TestDKIMKeyEncryptedAtRest(t *testing.T) { |
| 35 | pool := testutil.TestDB(t) |
| 36 | ctx := context.Background() |
| 37 | |
| 38 | cipher, err := identity.NewDKIMCipher(dkimMaster()) |
| 39 | if err != nil { |
| 40 | t.Fatalf("NewDKIMCipher: %v", err) |
| 41 | } |
| 42 | store := identity.NewStore(pool) |
| 43 | store.SetDKIMCipher(cipher) |
| 44 | |
| 45 | user, err := store.CreateOrGetUser(ctx, "owner@enc.example.com", "Owner", "google-enc") |
| 46 | if err != nil { |
| 47 | t.Fatalf("CreateOrGetUser: %v", err) |
| 48 | } |
| 49 | if _, err := store.ClaimOrCreateDomain(ctx, "enc.example.com", user.ID); err != nil { |
| 50 | t.Fatalf("ClaimOrCreateDomain: %v", err) |
| 51 | } |
| 52 | |
| 53 | // Raw column is encrypted: tagged 0x01 (DER would be 0x30) and not parseable. |
| 54 | raw := rawDKIMColumn(t, pool, "enc.example.com") |
| 55 | if len(raw) == 0 || raw[0] != 0x01 { |
| 56 | t.Fatalf("dkim_private_key not encrypted at rest: first byte = %#x", raw[0]) |
| 57 | } |
| 58 | if _, err := x509.ParsePKCS1PrivateKey(raw); err == nil { |
| 59 | t.Error("encrypted column should not parse as a PKCS#1 key") |
| 60 | } |
| 61 | |
| 62 | // Both readers decrypt back to a valid key. |
| 63 | for _, rd := range []struct { |
| 64 | name string |
| 65 | der func() ([]byte, error) |
| 66 | }{ |
| 67 | {"GetDKIMKeyInternal", func() ([]byte, error) { |
| 68 | _, der, err := store.GetDKIMKeyInternal(ctx, "enc.example.com") |
| 69 | return der, err |
| 70 | }}, |
| 71 | {"SendingProvisionInputs", func() ([]byte, error) { |
| 72 | _, der, _, err := store.SendingProvisionInputs(ctx, "enc.example.com") |
| 73 | return der, err |
| 74 | }}, |
| 75 | } { |
| 76 | der, err := rd.der() |
| 77 | if err != nil { |
| 78 | t.Fatalf("%s: %v", rd.name, err) |
| 79 | } |
| 80 | if _, err := x509.ParsePKCS1PrivateKey(der); err != nil { |
| 81 | t.Errorf("%s did not return a valid PKCS#1 key: %v", rd.name, err) |
| 82 | } |
| 83 | } |
| 84 | } |
| 85 | |
| 86 | // TestDKIMKeyEncryptedNoCipherFailsClosed: a reader without the cipher must error |
| 87 | // on an encrypted row rather than hand back ciphertext as a key. |
nothing calls this directly
no test coverage detected