Test errors, corner cases and logging for decryption.

src/tests/decrypt.vtc

@@ -58,10 +58,245 @@ client c1 {
 
 logexpect l1 -v v1 -d 1 -g vxid -q "VfpAcct" {
 	expect 0 * Begin	bereq
+	expect * = Debug	{^ece_decrypt: id ""$}
+	expect 0 = Debug	{^ece_decrypt: record size 4096$}
 	expect * = VfpAcct	{^ece_decrypt \d+ 15$}
 	expect * = End
 
 	expect 0 * Begin	bereq
+	expect * = Debug	{^ece_decrypt: id "a1"$}
+	expect 0 = Debug	{^ece_decrypt: record size 25$}
 	expect * = VfpAcct	{^ece_decrypt \d+ 15$}
 	expect * = End
 } -run
+
+## Corner cases
+
+server s1 -wait
+server s1 {
+	# Valid header but no message, accepted as empty decryption.
+	rxreq
+	txresp -nolen -hdr "Content-Encoding: aes128gcm" \
+	    -hdr "Content-Length: 21"
+	sendhex "23 50 6c c6 d1 6d b6 5b f7 bb f3 a8 f7 8c 67 9b"
+	sendhex "00 00 10 00 00"
+} -start
+
+logexpect l1 -v v1 -d 0 -g vxid -q "VfpAcct" {
+	expect 0 * Begin	bereq
+	expect * = Debug	{^ece_decrypt: id ""$}
+	expect 0 = Debug	{^ece_decrypt: record size 4096$}
+	expect * = VfpAcct	{^ece_decrypt \d+ 0$}
+	expect * = End
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 200
+	expect resp.http.Content-Encoding == <undef>
+	expect resp.bodylen == 0
+} -run
+
+logexpect l1 -wait
+
+## Errors
+
+server s1 -wait
+server s1 {
+	# Invalid header
+	rxreq
+	txresp -hdr "Content-Encoding: aes128gcm" -body {foo}
+} -start
+
+varnish v1 -vcl+backend {
+	import ${vmod_ece};
+	import blob;
+
+	sub vcl_init {
+		ece.set_key("", blob.decode(BASE64URLNOPAD,
+		                            encoded="yqdlZ-tYemfogSmv7Ws5PQ"));
+		ece.set_key("a1", blob.decode(BASE64URLNOPAD,
+		                             encoded="BO3ZVPxUlnLORbVGMpbT1Q"));
+	}
+
+	sub vcl_backend_response {
+		set beresp.filters = "ece_decrypt";
+		set beresp.uncacheable = true;
+		set beresp.do_stream = false;
+	}
+}
+
+logexpect l1 -v v1 -d 0 -g vxid -q "FetchError" {
+	expect 0 * Begin	bereq
+	expect * = FetchError	{^ece decrypt: truncated header$}
+	expect * = End
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "Backend fetch failed"
+} -run
+
+logexpect l1 -wait
+
+server s1 -wait
+server s1 {
+	# No body but 53 bytes expected, VFP below ece-decrypt fails.
+	rxreq
+	txresp -nolen -hdr "Content-Encoding: aes128gcm" \
+	    -hdr "Content-Length: 53"
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "Backend fetch failed"
+} -run
+
+server s1 -wait
+server s1 {
+	# Header prefix is complete but id is incomplete
+	rxreq
+	txresp -nolen -hdr "Content-Encoding: aes128gcm" \
+	    -hdr "Content-Length: 22"
+	sendhex "b8 d0 a4 5a 23 58 cc a4 e7 04 df 63 8b 7f aa 58"
+	sendhex "00 00 00 19 02 61"
+} -start
+
+logexpect l1 -v v1 -d 0 -g vxid -q "FetchError" {
+	expect 0 * Begin	bereq
+	expect * = FetchError	{^ece decrypt: truncated header$}
+	expect * = End
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "Backend fetch failed"
+} -run
+
+logexpect l1 -wait
+
+server s1 -wait
+server s1 {
+	# 23 bytes for the header expected, but 22 sent, low-level VFP fails
+	rxreq
+	txresp -nolen -hdr "Content-Encoding: aes128gcm" \
+	    -hdr "Content-Length: 23"
+	sendhex "b8 d0 a4 5a 23 58 cc a4 e7 04 df 63 8b 7f aa 58"
+	sendhex "00 00 00 19 02 61"
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "Backend fetch failed"
+} -run
+
+server s1 -wait
+server s1 {
+	# Record length 17 too small
+	rxreq
+	txresp -nolen -hdr "Content-Encoding: aes128gcm" \
+	    -hdr "Content-Length: 23"
+	sendhex "b8 d0 a4 5a 23 58 cc a4 e7 04 df 63 8b 7f aa 58"
+	sendhex "00 00 00 11 02 61 31"
+} -start
+
+logexpect l1 -v v1 -d 0 -g vxid -q "FetchError" {
+	expect 0 * Begin	bereq
+	expect * = FetchError	{^ece decrypt: invalid record size 17$}
+	expect * = End
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "Backend fetch failed"
+} -run
+
+logexpect l1 -wait
+
+server s1 -wait
+server s1 {
+	# Record length exceeds default max
+	rxreq
+	txresp -nolen -hdr "Content-Encoding: aes128gcm" \
+	    -hdr "Content-Length: 23"
+	sendhex "b8 d0 a4 5a 23 58 cc a4 e7 04 df 63 8b 7f aa 58"
+	sendhex "00 10 00 01 02 61 31"
+} -start
+
+logexpect l1 -v v1 -d 0 -g vxid -q "FetchError" {
+	expect 0 * Begin	bereq
+	expect * = FetchError	{^ece decrypt: record size \d+ exceeds max \d+$}
+	expect * = End
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "Backend fetch failed"
+} -run
+
+logexpect l1 -wait
+
+server s1 -wait
+server s1 {
+	# Record shorter than allowable minimum.
+	rxreq
+	txresp -nolen -hdr "Content-Encoding: aes128gcm" \
+	    -hdr "Content-Length: 32"
+	sendhex "b8 d0 a4 5a 23 58 cc a4 e7 04 df 63 8b 7f aa 58"
+	sendhex "00 00 00 19 02 61 31 ce 1b c7 21 cf f8 27 be 03"
+} -start
+
+logexpect l1 -v v1 -d 0 -g vxid -q "FetchError" {
+	expect 0 * Begin	bereq
+	expect * = FetchError	{^ece decrypt: record truncated$}
+	expect * = End
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "Backend fetch failed"
+} -run
+
+logexpect l1 -wait
+
+server s1 -wait
+server s1 {
+	# Header valid, but decryption fails
+	rxreq
+	txresp -nolen -hdr "Content-Encoding: aes128gcm" \
+	    -hdr "Content-Length: 53"
+	sendhex "23 50 6c c6 d1 6d b6 5b f7 bb f3 a8 f7 8c 67 9b"
+	sendhex "00 00 10 00 00 de ad be ef de ad be ef de ad be"
+	sendhex "de ad be ef de ad be ef de ad be ef de ad be ef"
+	sendhex "de ad be ef de"
+} -start
+
+logexpect l1 -v v1 -d 0 -g vxid -q "FetchError" {
+	expect 0 * Begin	bereq
+	expect * = FetchError	{^ece decrypt: .+$}
+	expect * = End
+} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 503
+	expect resp.reason == "Backend fetch failed"
+} -run
+
+logexpect l1 -wait