From f20f2b895a442755e5e9a5c8b1d4e68e3ff7b9be Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 11:33:29 -0700
Subject: [PATCH 01/13] requirements: move crypto packages to a -crypto.txt
 file

This can be reused for testing just the crypto snippets.
---
 requirements-crypto.txt | 2 ++
 requirements.txt        | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 requirements-crypto.txt

diff --git a/requirements-crypto.txt b/requirements-crypto.txt
new file mode 100644
index 00000000..9e27a3d6
--- /dev/null
+++ b/requirements-crypto.txt
@@ -0,0 +1,2 @@
+pycrypto>=2.6.1,<3.0.0
+pyOpenSSL>=19.1.0,<20.0.0
diff --git a/requirements.txt b/requirements.txt
index 3f765a26..fdccba67 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -11,8 +11,7 @@ django-admin-autocomplete-filter==0.4
 boto3>=1.12.24,<2.0.0
 django-storages>=1.9.1,<2.0.0
 django-recaptcha>=2.0.6,<3.0.0
-pycrypto>=2.6.1,<3.0.0
-pyOpenSSL>=19.1.0,<20.0.0
+-r requirements-crypto.txt
 django-file-resubmit>=0.5.2,<1.0.0
 django-extensions==2.2.8
 requests==2.23.0

From 55d480ce2cc3dccac2cd2e740596c3d324e89b5f Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 11:34:46 -0700
Subject: [PATCH 02/13] docker: add crypto-test image

This builds a test environment for the pycrypto bits.  For now we just pip
install and verify that the source module can resolve all imports.
---
 docker/crypto-test/Dockerfile | 12 ++++++++++++
 requirements-crypto-test.txt  |  2 ++
 2 files changed, 14 insertions(+)
 create mode 100644 docker/crypto-test/Dockerfile
 create mode 100644 requirements-crypto-test.txt

diff --git a/docker/crypto-test/Dockerfile b/docker/crypto-test/Dockerfile
new file mode 100644
index 00000000..d627aa06
--- /dev/null
+++ b/docker/crypto-test/Dockerfile
@@ -0,0 +1,12 @@
+# not "-alpine", because "cryptography" has no wheel for it, it tries to
+# compile, wants rust, and fails.
+FROM python:3.7.4
+
+WORKDIR /build
+ADD requirements-crypto*.txt ./
+RUN pip install --upgrade pip \
+	&& pip install -r requirements-crypto-test.txt
+
+ADD ro_help ro_help/
+# just verify imports
+RUN python3 ro_help/mobilpay/mobilpay/util/encrypt_data.py
diff --git a/requirements-crypto-test.txt b/requirements-crypto-test.txt
new file mode 100644
index 00000000..928a1484
--- /dev/null
+++ b/requirements-crypto-test.txt
@@ -0,0 +1,2 @@
+-r requirements-crypto.txt
+requests==2.23.0

From 22ddaa59b6585d42ba55a9f4b42e467f5b25127f Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 12:06:17 -0700
Subject: [PATCH 03/13] crypto-test: generate some test keys

---
 docker/crypto-test/Dockerfile | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/docker/crypto-test/Dockerfile b/docker/crypto-test/Dockerfile
index d627aa06..b00983e5 100644
--- a/docker/crypto-test/Dockerfile
+++ b/docker/crypto-test/Dockerfile
@@ -7,6 +7,16 @@ ADD requirements-crypto*.txt ./
 RUN pip install --upgrade pip \
 	&& pip install -r requirements-crypto-test.txt
 
+RUN \
+	for size in 1024 ; do \
+		for side in us them ; do \
+			d=pki/${side}-rsa${size} ; \
+			mkdir -p $d ; \
+			openssl genrsa -out $d/private.pem $size ; \
+		done ; \
+	done
+
+
 ADD ro_help ro_help/
 # just verify imports
 RUN python3 ro_help/mobilpay/mobilpay/util/encrypt_data.py

From c5acdee0e8c73aad466fe140df740334e5bfad7a Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 12:10:34 -0700
Subject: [PATCH 04/13] crypto-test: generate associated self-signed
 certificates

aka public keys.
---
 docker/crypto-test/Dockerfile | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docker/crypto-test/Dockerfile b/docker/crypto-test/Dockerfile
index b00983e5..c0d35ccf 100644
--- a/docker/crypto-test/Dockerfile
+++ b/docker/crypto-test/Dockerfile
@@ -13,6 +13,12 @@ RUN \
 			d=pki/${side}-rsa${size} ; \
 			mkdir -p $d ; \
 			openssl genrsa -out $d/private.pem $size ; \
+			openssl req \
+				-x509 \
+				-key $d/private.pem \
+				-out $d/public.pem \
+				-subj "/OU=test/CN=$side" \
+				-days 36525 ; \
 		done ; \
 	done
 

From ee144c83f0c4153cf4c4591b4aa76b77c90cbbc6 Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 12:12:36 -0700
Subject: [PATCH 05/13] crypto-test: use only ro_help/mobilpay source directory

We don't need the rest, and it matches existing imports ("from
mobilpay....").
---
 docker/crypto-test/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker/crypto-test/Dockerfile b/docker/crypto-test/Dockerfile
index c0d35ccf..aa04c084 100644
--- a/docker/crypto-test/Dockerfile
+++ b/docker/crypto-test/Dockerfile
@@ -23,6 +23,6 @@ RUN \
 	done
 
 
-ADD ro_help ro_help/
+ADD ro_help/mobilpay mobilpay/
 # just verify imports
-RUN python3 ro_help/mobilpay/mobilpay/util/encrypt_data.py
+RUN python3 mobilpay/mobilpay/util/encrypt_data.py

From 6c692ba8eef87e9fdd28132f47890acdd2d3bede Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 12:14:51 -0700
Subject: [PATCH 06/13] crypto-test: move import check into a unittest module

No tests yet, but still verify import succeeds.
---
 docker/crypto-test/Dockerfile     |  3 +--
 ro_help/mobilpay/mobilpay/test.py | 10 ++++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)
 create mode 100755 ro_help/mobilpay/mobilpay/test.py

diff --git a/docker/crypto-test/Dockerfile b/docker/crypto-test/Dockerfile
index aa04c084..6f47fdfc 100644
--- a/docker/crypto-test/Dockerfile
+++ b/docker/crypto-test/Dockerfile
@@ -24,5 +24,4 @@ RUN \
 
 
 ADD ro_help/mobilpay mobilpay/
-# just verify imports
-RUN python3 mobilpay/mobilpay/util/encrypt_data.py
+RUN python3 -m mobilpay.mobilpay.test -v
diff --git a/ro_help/mobilpay/mobilpay/test.py b/ro_help/mobilpay/mobilpay/test.py
new file mode 100755
index 00000000..3da78cb5
--- /dev/null
+++ b/ro_help/mobilpay/mobilpay/test.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+
+import unittest
+from mobilpay.mobilpay.util.encrypt_data import Crypto
+
+class TestCrypto(unittest.TestCase):
+    pass
+
+if __name__ == "__main__":
+    unittest.main()

From c28f089180751828e6d62dcc656f92b0eb99bb72 Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 12:18:06 -0700
Subject: [PATCH 07/13] crypto-test: add test cases for reading public/private
 key files

Just verify they don't except and they return _something_.
---
 ro_help/mobilpay/mobilpay/test.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/ro_help/mobilpay/mobilpay/test.py b/ro_help/mobilpay/mobilpay/test.py
index 3da78cb5..5dbd83ad 100755
--- a/ro_help/mobilpay/mobilpay/test.py
+++ b/ro_help/mobilpay/mobilpay/test.py
@@ -4,7 +4,14 @@
 from mobilpay.mobilpay.util.encrypt_data import Crypto
 
 class TestCrypto(unittest.TestCase):
-    pass
+    def test_load_pub(self):
+        pubkey = Crypto().get_rsa_key('pki/us-rsa1024/public.pem')
+        self.assertIsNotNone(pubkey)
+        self.assertTrue(pubkey)
+    def test_load_priv(self):
+        privkey = Crypto().get_private_key('pki/us-rsa1024/private.pem')
+        self.assertIsNotNone(privkey)
+        self.assertTrue(privkey)
 
 if __name__ == "__main__":
     unittest.main()

From 96bf708e10ed9ee0d009a2c3e09a3007c0e2fcaa Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 12:50:00 -0700
Subject: [PATCH 08/13] crypto-test: exercise encrypt-decrypt round trip

This just excercises the code, but doesn't test correctness.
---
 ro_help/mobilpay/mobilpay/test.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/ro_help/mobilpay/mobilpay/test.py b/ro_help/mobilpay/mobilpay/test.py
index 5dbd83ad..62136a8f 100755
--- a/ro_help/mobilpay/mobilpay/test.py
+++ b/ro_help/mobilpay/mobilpay/test.py
@@ -12,6 +12,13 @@ def test_load_priv(self):
         privkey = Crypto().get_private_key('pki/us-rsa1024/private.pem')
         self.assertIsNotNone(privkey)
         self.assertTrue(privkey)
+    def test_self_roundtrip(self):
+        pubkey = Crypto().get_rsa_key('pki/us-rsa1024/public.pem')
+        privkey = Crypto().get_private_key('pki/us-rsa1024/private.pem')
+        clear_msg = b'forty-two'
+        enc_msg, enc_block_key = Crypto().encrypt(clear_msg, pubkey)
+        dec_msg = Crypto().decrypt(enc_msg, privkey, enc_block_key)
+        self.assertEqual(dec_msg, clear_msg)
 
 if __name__ == "__main__":
     unittest.main()

From b496bfd751001c86894c86a88efef755dbb061d4 Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 12:52:01 -0700
Subject: [PATCH 09/13] README: add note on running crypto tests

---
 README.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/README.md b/README.md
index 04267e3d..8580938c 100644
--- a/README.md
+++ b/README.md
@@ -57,6 +57,13 @@ black --line-length 120 --target-version py37
 ```
 before a commit will do the trick.
 
+
+To run the crypto unit tests, one can invoke
+```bash
+docker build -f docker/crypto-test/Dockerfile .
+```
+The unit-tests are run from the Dockerfile, if `docker build` succeeds, the tests have passed.
+
 ## Deployment
 The deployment process is fully automated using AWS CodeBuild and ECS. Each time a PR is merged on master, a new docker image build is trigger and if it's successful, [the staging environment](http://dev.rohelp.ro/) will point to your latest changes.
 

From 5c53dfaf579504b959d403dad78e5e2c8282caf3 Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 15:55:38 -0700
Subject: [PATCH 10/13] crypto-test: generate and encrypt RC4 test messages

With openssl.  N.B., only the "-K" option to "openssl enc" allows
specifying a raw RC4 key (in hex), all others (-k, -kfile, -pass) go
through a KDF (sha256, by default) which is not what the mobilpay flow
does.
---
 docker/crypto-test/Dockerfile | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/docker/crypto-test/Dockerfile b/docker/crypto-test/Dockerfile
index 6f47fdfc..4c4f0796 100644
--- a/docker/crypto-test/Dockerfile
+++ b/docker/crypto-test/Dockerfile
@@ -19,6 +19,27 @@ RUN \
 				-out $d/public.pem \
 				-subj "/OU=test/CN=$side" \
 				-days 36525 ; \
+			openssl rsa \
+				-in $d/private.pem \
+				-out $d/rawpublic.pem \
+				-outform PEM \
+				-pubout ; \
+			echo "message from $side" > $d/msg.clear ; \
+			openssl rand 16 > $d/enc.key ; \
+			openssl enc \
+				-rc4 \
+				-nosalt \
+				-in $d/msg.clear \
+				-out $d/msg.enc \
+				-K $(od -tx1 -An < $d/enc.key | tr -d ' ') ; \
+			base64 -w0 < $d/msg.enc > $d/msg.enc.b64 ; \
+			openssl rsautl \
+				-encrypt \
+				-inkey $d/rawpublic.pem \
+				-pubin \
+				-in $d/enc.key \
+				-out $d/enc.key.rsaenc ; \
+			base64 -w0 < $d/enc.key.rsaenc > $d/enc.key.rsaenc.b64 ; \
 		done ; \
 	done
 

From 6ef4a7233fde20a35993dda5bd99d2e00514e986 Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 24 Apr 2021 15:57:36 -0700
Subject: [PATCH 11/13] crypto test: add decryption test case

Using input data generated by openssl.
---
 ro_help/mobilpay/mobilpay/test.py | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/ro_help/mobilpay/mobilpay/test.py b/ro_help/mobilpay/mobilpay/test.py
index 62136a8f..8eb8e051 100755
--- a/ro_help/mobilpay/mobilpay/test.py
+++ b/ro_help/mobilpay/mobilpay/test.py
@@ -19,6 +19,17 @@ def test_self_roundtrip(self):
         enc_msg, enc_block_key = Crypto().encrypt(clear_msg, pubkey)
         dec_msg = Crypto().decrypt(enc_msg, privkey, enc_block_key)
         self.assertEqual(dec_msg, clear_msg)
+    def test_decrypt(self):
+        d = 'pki/them-rsa1024/'
+        def _slurp(fname):
+            with open(d + fname, 'r') as fp:
+                return fp.read()
+
+        msg_enc = _slurp('msg.enc.b64')
+        enc_key_rsaenc = _slurp('enc.key.rsaenc.b64')
+        privkey = Crypto().get_private_key(d + 'private.pem')
+        dec_msg = Crypto().decrypt(msg_enc, privkey, enc_key_rsaenc)
+        self.assertEqual(dec_msg, b'message from them\n')
 
 if __name__ == "__main__":
     unittest.main()

From 11ccf704920536aea6952da0fc5b39ef84c4dd12 Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 8 May 2021 00:22:47 -0700
Subject: [PATCH 12/13] crypto-test: move generation of testdata to a script

For readability, eschew escaping of newlines.
---
 docker/crypto-test/Dockerfile      | 38 ++----------------------------
 docker/crypto-test/gen_testdata.sh | 37 +++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 36 deletions(-)
 create mode 100755 docker/crypto-test/gen_testdata.sh

diff --git a/docker/crypto-test/Dockerfile b/docker/crypto-test/Dockerfile
index 4c4f0796..122ffa7e 100644
--- a/docker/crypto-test/Dockerfile
+++ b/docker/crypto-test/Dockerfile
@@ -7,42 +7,8 @@ ADD requirements-crypto*.txt ./
 RUN pip install --upgrade pip \
 	&& pip install -r requirements-crypto-test.txt
 
-RUN \
-	for size in 1024 ; do \
-		for side in us them ; do \
-			d=pki/${side}-rsa${size} ; \
-			mkdir -p $d ; \
-			openssl genrsa -out $d/private.pem $size ; \
-			openssl req \
-				-x509 \
-				-key $d/private.pem \
-				-out $d/public.pem \
-				-subj "/OU=test/CN=$side" \
-				-days 36525 ; \
-			openssl rsa \
-				-in $d/private.pem \
-				-out $d/rawpublic.pem \
-				-outform PEM \
-				-pubout ; \
-			echo "message from $side" > $d/msg.clear ; \
-			openssl rand 16 > $d/enc.key ; \
-			openssl enc \
-				-rc4 \
-				-nosalt \
-				-in $d/msg.clear \
-				-out $d/msg.enc \
-				-K $(od -tx1 -An < $d/enc.key | tr -d ' ') ; \
-			base64 -w0 < $d/msg.enc > $d/msg.enc.b64 ; \
-			openssl rsautl \
-				-encrypt \
-				-inkey $d/rawpublic.pem \
-				-pubin \
-				-in $d/enc.key \
-				-out $d/enc.key.rsaenc ; \
-			base64 -w0 < $d/enc.key.rsaenc > $d/enc.key.rsaenc.b64 ; \
-		done ; \
-	done
-
+ADD docker/crypto-test/gen_testdata.sh .
+RUN ./gen_testdata.sh
 
 ADD ro_help/mobilpay mobilpay/
 RUN python3 -m mobilpay.mobilpay.test -v
diff --git a/docker/crypto-test/gen_testdata.sh b/docker/crypto-test/gen_testdata.sh
new file mode 100755
index 00000000..e8377cce
--- /dev/null
+++ b/docker/crypto-test/gen_testdata.sh
@@ -0,0 +1,37 @@
+#!/bin/sh
+# Generate data for crypto tests
+
+for size in 1024 ; do
+	for side in us them ; do
+		d=pki/${side}-rsa${size}
+		mkdir -p $d
+		openssl genrsa -out $d/private.pem $size
+		openssl req \
+			-x509 \
+			-key $d/private.pem \
+			-out $d/public.pem \
+			-subj "/OU=test/CN=$side" \
+			-days 36525
+		openssl rsa \
+			-in $d/private.pem \
+			-out $d/rawpublic.pem \
+			-outform PEM \
+			-pubout
+		echo "message from $side" > $d/msg.clear
+		openssl rand 16 > $d/enc.key
+		openssl enc \
+			-rc4 \
+			-nosalt \
+			-in $d/msg.clear \
+			-out $d/msg.enc \
+			-K $(od -tx1 -An < $d/enc.key | tr -d ' ')
+		base64 -w0 < $d/msg.enc > $d/msg.enc.b64
+		openssl rsautl \
+			-encrypt \
+			-inkey $d/rawpublic.pem \
+			-pubin \
+			-in $d/enc.key \
+			-out $d/enc.key.rsaenc
+		base64 -w0 < $d/enc.key.rsaenc > $d/enc.key.rsaenc.b64
+	done
+done

From 38052ffa8e82bd690a1a620572b6b5a06f202f7e Mon Sep 17 00:00:00 2001
From: Alex Badea <vamposdecampos@gmail.com>
Date: Sat, 8 May 2021 00:26:40 -0700
Subject: [PATCH 13/13] crypto-test: run tests with pytest

No changes required to the actual test source, pytest groks unittest API.
---
 docker/crypto-test/Dockerfile | 2 +-
 requirements-crypto-test.txt  | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/docker/crypto-test/Dockerfile b/docker/crypto-test/Dockerfile
index 122ffa7e..988a6805 100644
--- a/docker/crypto-test/Dockerfile
+++ b/docker/crypto-test/Dockerfile
@@ -11,4 +11,4 @@ ADD docker/crypto-test/gen_testdata.sh .
 RUN ./gen_testdata.sh
 
 ADD ro_help/mobilpay mobilpay/
-RUN python3 -m mobilpay.mobilpay.test -v
+RUN pytest mobilpay/mobilpay/test.py -v
diff --git a/requirements-crypto-test.txt b/requirements-crypto-test.txt
index 928a1484..00bc942d 100644
--- a/requirements-crypto-test.txt
+++ b/requirements-crypto-test.txt
@@ -1,2 +1,3 @@
 -r requirements-crypto.txt
 requests==2.23.0
+pytest==5.4.1