|
| 1 | +/* |
| 2 | +Copyright IBM Corp. All Rights Reserved. |
| 3 | +
|
| 4 | +SPDX-License-Identifier: Apache-2.0 |
| 5 | +*/ |
| 6 | + |
| 7 | +package crypto |
| 8 | + |
| 9 | +import ( |
| 10 | + "fmt" |
| 11 | + "testing" |
| 12 | + |
| 13 | + "github.com/hyperledger/fabric-lib-go/bccsp" |
| 14 | + "github.com/stretchr/testify/assert" |
| 15 | + "github.com/stretchr/testify/require" |
| 16 | +) |
| 17 | + |
| 18 | +const testPIN = "s3cr3t-pin-9999" |
| 19 | + |
| 20 | +// PKCS11.String must redact the PIN and never emit it verbatim, whether the |
| 21 | +// *PKCS11 is logged directly or as a field of a *BCCSP. |
| 22 | +func TestPKCS11_String_RedactsPin(t *testing.T) { |
| 23 | + p := &PKCS11{Library: "/usr/lib/libpkcs11.so", Label: "tok", Pin: testPIN} |
| 24 | + |
| 25 | + s := p.String() |
| 26 | + assert.Contains(t, s, "[REDACTED]") |
| 27 | + assert.NotContains(t, s, testPIN) |
| 28 | + // Non-secret fields remain visible for debugging. |
| 29 | + assert.Contains(t, s, "/usr/lib/libpkcs11.so") |
| 30 | + assert.Contains(t, s, "tok") |
| 31 | + |
| 32 | + // %v / %s go through the Stringer as well. |
| 33 | + assert.NotContains(t, fmt.Sprintf("%s", p), testPIN) //nolint:staticcheck // Explicitly checking fmt.Sprintf |
| 34 | + assert.NotContains(t, fmt.Sprintf("%+v", p), testPIN) //nolint:staticcheck // Explicitly checking fmt.Sprintf |
| 35 | +} |
| 36 | + |
| 37 | +// A nil *PKCS11 must format without panicking (SW-only configs have a nil PKCS11). |
| 38 | +func TestPKCS11_String_Nil(t *testing.T) { |
| 39 | + var p *PKCS11 |
| 40 | + assert.NotPanics(t, func() { _ = p.String() }) |
| 41 | + assert.Equal(t, "<nil>", p.String()) |
| 42 | + assert.NotPanics(t, func() { _ = fmt.Sprintf("%v", p) }) |
| 43 | +} |
| 44 | + |
| 45 | +// Formatting a *BCCSP (as setup.go and kmp.go do) must redact the nested PKCS11 PIN, |
| 46 | +// and must not panic when the PKCS11 field is nil. |
| 47 | +func TestBCCSP_Format_RedactsPin(t *testing.T) { |
| 48 | + t.Run("WithPKCS11", func(t *testing.T) { |
| 49 | + cfg := &BCCSP{Default: "PKCS11", PKCS11: &PKCS11{Label: "tok", Pin: testPIN}} |
| 50 | + out := fmt.Sprintf("%v", cfg) |
| 51 | + assert.Contains(t, out, "[REDACTED]") |
| 52 | + assert.NotContains(t, out, testPIN) |
| 53 | + }) |
| 54 | + t.Run("NilPKCS11", func(t *testing.T) { |
| 55 | + cfg := &BCCSP{Default: "SW", SW: &SoftwareProvider{Hash: "SHA2", Security: 256}} |
| 56 | + assert.NotPanics(t, func() { _ = fmt.Sprintf("%v", cfg) }) |
| 57 | + }) |
| 58 | + t.Run("NilBCCSP", func(t *testing.T) { |
| 59 | + var cfg *BCCSP |
| 60 | + assert.NotPanics(t, func() { _ = fmt.Sprintf("%v", cfg) }) |
| 61 | + }) |
| 62 | +} |
| 63 | + |
| 64 | +// getIdentityFactory must never mutate the caller's live config and must never panic, |
| 65 | +// across the nil, SW-only, and error paths. Regression test for the pointer-aliasing |
| 66 | +// redaction bug (Issue #2069) that overwrote the real PIN and dereferenced nil. |
| 67 | +func TestGetIdentityFactory_NoMutationNoPanic(t *testing.T) { |
| 68 | + conf := &Config{CryptoConfig: &CryptoConfig{SignatureHashFamily: bccsp.SHA2}} |
| 69 | + |
| 70 | + t.Run("NilBccspConfig", func(t *testing.T) { |
| 71 | + // Default SW provider; nil bccspConfig is a supported, common path. |
| 72 | + assert.NotPanics(t, func() { |
| 73 | + _, err := getIdentityFactory(conf, nil, nil) |
| 74 | + require.NoError(t, err) |
| 75 | + }) |
| 76 | + }) |
| 77 | + |
| 78 | + t.Run("SWOnlyConfigLeavesPinUntouched", func(t *testing.T) { |
| 79 | + bccspConfig := &BCCSP{ |
| 80 | + Default: "SW", |
| 81 | + SW: &SoftwareProvider{Hash: "SHA2", Security: 256}, |
| 82 | + // A PIN may be present even on the SW path; it must survive verbatim. |
| 83 | + PKCS11: &PKCS11{Label: "tok", Pin: testPIN}, |
| 84 | + } |
| 85 | + |
| 86 | + _, err := getIdentityFactory(conf, bccspConfig, nil) |
| 87 | + require.NoError(t, err) |
| 88 | + assert.Equal(t, testPIN, bccspConfig.PKCS11.Pin, "the caller's live PIN must not be mutated") |
| 89 | + }) |
| 90 | + |
| 91 | + t.Run("ErrorPathRedactsWithoutMutating", func(t *testing.T) { |
| 92 | + bccspConfig := &BCCSP{ |
| 93 | + Default: "does-not-exist", // forces GetBCCSPFromConf to return an error |
| 94 | + PKCS11: &PKCS11{Label: "tok", Pin: testPIN}, |
| 95 | + } |
| 96 | + |
| 97 | + _, err := getIdentityFactory(conf, bccspConfig, nil) |
| 98 | + require.Error(t, err) |
| 99 | + assert.Contains(t, err.Error(), "[REDACTED]", "error must show redaction marker") |
| 100 | + assert.NotContains(t, err.Error(), testPIN, "error must not leak the PIN") |
| 101 | + assert.Equal(t, testPIN, bccspConfig.PKCS11.Pin, "the caller's live PIN must not be mutated") |
| 102 | + }) |
| 103 | +} |
0 commit comments