Skip to content

Commit 237d86b

Browse files
yaronfyaronf
committed
Rename "context" to "tag"
1 parent 08cd0bd commit 237d86b

File tree

4 files changed

+51
-54
lines changed

4 files changed

+51
-54
lines changed

‎config.go‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ type SignConfig struct {
1515
fakeCreated int64
1616
expires int64
1717
nonce string
18-
context string
18+
tag string
1919
}
2020

2121
// NewSignConfig generates a default configuration.
@@ -26,7 +26,7 @@ func NewSignConfig() *SignConfig {
2626
fakeCreated: 0,
2727
expires: 0,
2828
nonce: "",
29-
context: "", // we disallow an empty context
29+
tag: "", // we disallow an empty tag
3030
}
3131
}
3232

@@ -63,23 +63,23 @@ func (c *SignConfig) SetNonce(nonce string) *SignConfig {
6363
return c
6464
}
6565

66-
// SetContext adds a "context" string parameter that defines a per-application or per-protocol signature
67-
// context, to mitigate cross-protocol attacks.
68-
func (c *SignConfig) SetContext(ctx string) *SignConfig {
69-
c.context = ctx
66+
// SetTag adds a "tag" string parameter that defines a per-application or per-protocol signature
67+
// tag, to mitigate cross-protocol attacks.
68+
func (c *SignConfig) SetTag(tag string) *SignConfig {
69+
c.tag = tag
7070
return c
7171
}
7272

7373
// VerifyConfig contains additional configuration for the verifier.
7474
type VerifyConfig struct {
75-
verifyCreated bool
76-
notNewerThan time.Duration
77-
notOlderThan time.Duration
78-
allowedAlgs []string
79-
rejectExpired bool
80-
verifyKeyID bool
81-
dateWithin time.Duration
82-
allowedContexts []string
75+
verifyCreated bool
76+
notNewerThan time.Duration
77+
notOlderThan time.Duration
78+
allowedAlgs []string
79+
rejectExpired bool
80+
verifyKeyID bool
81+
dateWithin time.Duration
82+
allowedTags []string
8383
}
8484

8585
// SetNotNewerThan sets the window for messages that appear to be newer than the current time,
@@ -135,24 +135,24 @@ func (v *VerifyConfig) SetVerifyDateWithin(d time.Duration) *VerifyConfig {
135135
return v
136136
}
137137

138-
// SetAllowedContexts defines the allowed values of the "context" parameter.
138+
// SetAllowedTags defines the allowed values of the "tag" parameter.
139139
// Default: an empty list, signifying all values are accepted.
140-
func (v *VerifyConfig) SetAllowedContexts(allowedCtx []string) *VerifyConfig {
141-
v.allowedContexts = allowedCtx
140+
func (v *VerifyConfig) SetAllowedTags(allowedTags []string) *VerifyConfig {
141+
v.allowedTags = allowedTags
142142
return v
143143
}
144144

145145
// NewVerifyConfig generates a default configuration.
146146
func NewVerifyConfig() *VerifyConfig {
147147
return &VerifyConfig{
148-
verifyCreated: true,
149-
notNewerThan: 2 * time.Second,
150-
notOlderThan: 10 * time.Second,
151-
rejectExpired: true,
152-
allowedAlgs: []string{},
153-
verifyKeyID: true,
154-
dateWithin: 0, // meaning no constraint
155-
allowedContexts: nil, // no constraint
148+
verifyCreated: true,
149+
notNewerThan: 2 * time.Second,
150+
notOlderThan: 10 * time.Second,
151+
rejectExpired: true,
152+
allowedAlgs: []string{},
153+
verifyKeyID: true,
154+
dateWithin: 0, // meaning no constraint
155+
allowedTags: nil, // no constraint
156156
}
157157
}
158158

‎digest_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ func TestMessages(t *testing.T) {
6161
assert.NotEqual(t, h, d)
6262

6363
res4 := readResponse(resdigest3)
64-
d, err = GenerateContentDigestHeader(&res4.Body, []string{DigestSha256, "sha-999"})
64+
_, err = GenerateContentDigestHeader(&res4.Body, []string{DigestSha256, "sha-999"})
6565
assert.Error(t, err, "bad digest scheme")
6666

6767
res5 := readResponse(resdigest5)

‎signatures.go‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -249,12 +249,12 @@ func generateSigParams(config *SignConfig, keyID, alg string, foreignSigner inte
249249
}
250250
p.Add("alg", alg)
251251
}
252-
if config.context != "" {
253-
qContext, err := quotedString(config.context)
252+
if config.tag != "" {
253+
qContext, err := quotedString(config.tag)
254254
if err != nil {
255-
return "", fmt.Errorf("malformed context: %w", err)
255+
return "", fmt.Errorf("malformed tag: %w", err)
256256
}
257-
p.Add("context", qContext)
257+
p.Add("tag", qContext)
258258
}
259259
p.Add("keyid", keyID)
260260
return fields.asSignatureInput(p)
@@ -547,23 +547,23 @@ func applyPolicyAlgs(psi *psiSignature, config VerifyConfig) error {
547547
}
548548

549549
func applyPolicyContexts(psi *psiSignature, config VerifyConfig) error {
550-
if len(config.allowedContexts) > 0 {
551-
ctxParam, ok := psi.params["context"]
550+
if len(config.allowedTags) > 0 {
551+
ctxParam, ok := psi.params["tag"]
552552
if !ok {
553-
return fmt.Errorf("missing \"context\" parameter")
553+
return fmt.Errorf("missing \"tag\" parameter")
554554
}
555555
ctx, ok := ctxParam.(string)
556556
if !ok {
557-
return fmt.Errorf("malformed \"context\" parameter")
557+
return fmt.Errorf("malformed \"tag\" parameter")
558558
}
559559
var ctxFound = false
560-
for _, c := range config.allowedContexts {
560+
for _, c := range config.allowedTags {
561561
if c == ctx {
562562
ctxFound = true
563563
}
564564
}
565565
if !ctxFound {
566-
return fmt.Errorf("\"context\" parameter not allowed by policy")
566+
return fmt.Errorf("\"tag\" parameter not allowed by policy")
567567
}
568568
}
569569
return nil

‎signatures_test.go‎

Lines changed: 15 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,8 @@ Date: Tue, 20 Apr 2021 02:07:55 GMT
6060
Content-Type: application/json
6161
Content-Digest: sha-512=:WZDPaVn/7XgHaAy8pmojAkGWoRx2UFChF41A2svX+TaPm+AbwAgBWnrIiYllu7BNNyealdVLvRwEmTHWXvJwew==:
6262
Content-Length: 18
63-
Signature-Input: sig-b22=("@authority" "content-digest" "@query-param";name="Pet");created=1618884473;keyid="test-key-rsa-pss";context="header-example"
64-
Signature: sig-b22=:SW3AKyCPY7PQSARlOEg8+tb43JD4uYGBrt6G+RWKgrOZ9ZJWq8VnVM1qTcdjChi6HGZI4xDwKZteoQH8mj2HT1cWdUTxu2JaUvcJDINpa0m20NYywRu/HLXmh/FfeefGIUpkAneT/X/sWL/ShiTtp7REtxdJaiLCjQidY9eUpFmBXPMdR/FiYI3hGWarGGiGmTpgbjI713ywhKoGPm7Q8lpfhz5T59tOsZVPxlqdpwPD0RVGOwZMzI5VzoY4YaGrB2fqvPOxNUNuh5bveYQOYAmzmpDaLfgkQB/C4AHzKWAYs9yV6Wf78u4en7AP1Y+iM0G6MviZvX1/lcgC2n1bDg==:
63+
Signature-Input: sig-b22=("@authority" "content-digest" "@query-param";name="Pet");created=1618884473;keyid="test-key-rsa-pss";tag="header-example"
64+
Signature: sig-b22=:LjbtqUbfmvjj5C5kr1Ugj4PmLYvx9wVjZvD9GsTT4F7GrcQEdJzgI9qHxICagShLRiLMlAJjtq6N4CDfKtjvuJyE5qH7KT8UCMkSowOB4+ECxCmT8rtAmj/0PIXxi0A0nxKyB09RNrCQibbUjsLS/2YyFYXEu4TRJQzRw1rLEuEfY17SARYhpTlaqwZVtR8NV7+4UKkjqpcAoFqWFQh62s7Cl+H2fjBSpqfZUJcsIk4N6wiKYd4je2U/lankenQ99PZfB4jY3I5rSV2DSBVkSFsURIjYErOs0tFTQosMTAoxk//0RoKUqiYY8Bh0aaUEb0rQl3/XaVe4bXTugEjHSw==:
6565
6666
{"hello": "world"}
6767
`
@@ -1575,10 +1575,7 @@ func TestRequestBinding(t *testing.T) {
15751575
fields := *NewFields()
15761576
verifier, err := NewRSAPSSVerifier("test-key-rsa-pss", *pubKey, NewVerifyConfig().SetVerifyCreated(false), fields)
15771577
assert.NoError(t, err, "create verifier")
1578-
sigBase, err := verifyRequestDebug("sig1", *verifier, req)
1579-
_ = sigBase
1580-
// fmt.Println(sigBase)
1581-
// assert.NoError(t, err, "verify request") // Note: does not verify
1578+
_, err = verifyRequestDebug("sig1", *verifier, req)
15821579

15831580
res := readResponse(httpres6)
15841581
pubKey2, err := parseECPublicKeyFromPemStr(p256PubKey2)
@@ -1640,7 +1637,7 @@ func TestBinarySequence(t *testing.T) {
16401637
signer1, err := NewP256Signer("key20", *priv, NewSignConfig(),
16411638
*NewFields().AddHeader("@status").AddHeaderExt("set-cookie", false, false, false))
16421639
assert.NoError(t, err, "could not create signer")
1643-
sigInput, sig, err := SignResponse("sig2", *signer1, res, nil)
1640+
_, _, err = SignResponse("sig2", *signer1, res, nil)
16441641
assert.Error(t, err, "signature should have failed")
16451642

16461643
signer2, err := NewP256Signer("key20", *priv, NewSignConfig().setFakeCreated(1659563420),
@@ -1667,43 +1664,43 @@ func TestBinarySequence(t *testing.T) {
16671664
assert.NoError(t, err, "could not verify response")
16681665
}
16691666

1670-
func TestSignatureContext(t *testing.T) {
1667+
func TestSignatureTag(t *testing.T) {
16711668
priv, pub, err := genP256KeyPair()
16721669
assert.NoError(t, err, "failed to generate key")
16731670
res := readResponse(httpres2)
16741671

1675-
signer1, err := NewP256Signer("key21", *priv, NewSignConfig().SetContext("ctx1").setFakeCreated(1660755826),
1672+
signer1, err := NewP256Signer("key21", *priv, NewSignConfig().SetTag("ctx1").setFakeCreated(1660755826),
16761673
*NewFields().AddHeader("@status"))
16771674
assert.NoError(t, err, "could not create signer")
16781675
sigInput, sig, sigBase, err := signResponseDebug("sig2", *signer1, res, nil)
16791676
assert.NoError(t, err, "signature failed")
1680-
assert.Equal(t, "\"@status\": 200\n\"@signature-params\": (\"@status\");created=1660755826;alg=\"ecdsa-p256-sha256\";context=\"ctx1\";keyid=\"key21\"", sigBase, "unexpected signature base")
1677+
assert.Equal(t, "\"@status\": 200\n\"@signature-params\": (\"@status\");created=1660755826;alg=\"ecdsa-p256-sha256\";tag=\"ctx1\";keyid=\"key21\"", sigBase, "unexpected signature base")
16811678
res.Header.Add("Signature-Input", sigInput)
16821679
res.Header.Add("Signature", sig)
16831680

1684-
// Signature should fail with malformed context
1685-
signer2, err := NewP256Signer("key21", *priv, NewSignConfig().SetContext("ctx1\x00"),
1681+
// Signature should fail with malformed tag
1682+
signer2, err := NewP256Signer("key21", *priv, NewSignConfig().SetTag("ctx1\x00"),
16861683
*NewFields().AddHeader("@status"))
16871684
assert.NoError(t, err, "could not create signer")
1688-
sigInput, sig, _, err = signResponseDebug("sig2", *signer2, res, nil)
1685+
_, _, _, err = signResponseDebug("sig2", *signer2, res, nil)
16891686
assert.Error(t, err, "signature should fail")
16901687

1691-
// Client verifies response - should succeed, no context constraint
1688+
// Client verifies response - should succeed, no tag constraint
16921689
verifier1, err := NewP256Verifier("key21", *pub, NewVerifyConfig().SetVerifyCreated(false),
16931690
*NewFields().AddHeader("@status"))
16941691
assert.NoError(t, err, "could not create verifier")
16951692
err = VerifyResponse("sig2", *verifier1, res, nil)
16961693
assert.NoError(t, err, "failed to verify response")
16971694

1698-
// Client verifies response - should succeed, correct context
1699-
verifier2, err := NewP256Verifier("key21", *pub, NewVerifyConfig().SetVerifyCreated(false).SetAllowedContexts([]string{"ctx3", "ctx2", "ctx1"}),
1695+
// Client verifies response - should succeed, correct tag
1696+
verifier2, err := NewP256Verifier("key21", *pub, NewVerifyConfig().SetVerifyCreated(false).SetAllowedTags([]string{"ctx3", "ctx2", "ctx1"}),
17001697
*NewFields().AddHeader("@status"))
17011698
assert.NoError(t, err, "could not create verifier")
17021699
err = VerifyResponse("sig2", *verifier2, res, nil)
17031700
assert.NoError(t, err, "failed to verify response")
17041701

1705-
// Client verifies response - should fail, incorrect contexts
1706-
verifier3, err := NewP256Verifier("key21", *pub, NewVerifyConfig().SetVerifyCreated(false).SetAllowedContexts([]string{"ctx5", "ctx6", "ctx7"}),
1702+
// Client verifies response - should fail, incorrect tags
1703+
verifier3, err := NewP256Verifier("key21", *pub, NewVerifyConfig().SetVerifyCreated(false).SetAllowedTags([]string{"ctx5", "ctx6", "ctx7"}),
17071704
*NewFields().AddHeader("@status"))
17081705
assert.NoError(t, err, "could not create verifier")
17091706
err = VerifyResponse("sig2", *verifier3, res, nil)

0 commit comments

Comments
 (0)