27052752106

Committed 06 Jun 2026 12:06AM UTC coverage: 89.396% (+0.002%) from 89.394%

Build # 27052752106

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #5649 from randombit/jack/small-hardenings

Various small hardenings and improve input validation

Coverage Stats

110625 of 123747 relevant lines covered (89.4%)

11055225.92 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

90.91

/src/tests/test_otp.cpp

/*
* OTP tests
* (C) 2017 Jack Lloyd
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include "tests.h"

#if defined(BOTAN_HAS_HOTP) && defined(BOTAN_HAS_TOTP)
   #include <botan/hash.h>
   #include <botan/otp.h>
   #include <botan/internal/calendar.h>
   #include <botan/internal/parsing.h>
#endif

namespace Botan_Tests {

namespace {

#if defined(BOTAN_HAS_HOTP) && defined(BOTAN_HAS_TOTP)

class HOTP_KAT_Tests final : public Text_Based_Test {
   public:
      HOTP_KAT_Tests() : Text_Based_Test("otp/hotp.vec", "Key,Digits,Counter,OTP") {}

      bool clear_between_callbacks() const override { return false; }

      Test::Result run_one_test(const std::string& hash_algo, const VarMap& vars) override {
         Test::Result result("HOTP " + hash_algo);

         auto hash_test = Botan::HashFunction::create(hash_algo);
         if(!hash_test) {
            return {result};
         }

         const auto key = Botan::SymmetricKey(vars.get_req_bin("Key"));
         const uint32_t otp = static_cast<uint32_t>(vars.get_req_sz("OTP"));
         const uint64_t counter = vars.get_req_sz("Counter");
         const size_t digits = vars.get_req_sz("Digits");

         Botan::HOTP hotp(key, hash_algo, digits);

         result.test_u32_eq("OTP", hotp.generate_hotp(counter), otp);

         std::pair<bool, uint64_t> otp_res = hotp.verify_hotp(otp, counter, 0);
         result.test_is_true("OTP verify result", otp_res.first);
         result.test_u64_eq("OTP verify next counter", otp_res.second, counter + 1);

         // Test invalid OTP
         otp_res = hotp.verify_hotp(otp + 1, counter, 0);
         result.test_is_false("OTP verify result", otp_res.first);
         result.test_u64_eq("OTP verify next counter", otp_res.second, counter);

         // Test invalid OTP with long range
         otp_res = hotp.verify_hotp(otp + 1, counter, 100);
         result.test_is_false("OTP verify result", otp_res.first);
         result.test_u64_eq("OTP verify next counter", otp_res.second, counter);

         // Test valid OTP with long range
         const uint64_t starting_counter = (counter >= 90) ? (counter - 90) : uint64_t(0);
         otp_res = hotp.verify_hotp(otp, starting_counter, 100);
         result.test_is_true("OTP verify result", otp_res.first);
         result.test_u64_eq("OTP verify next counter", otp_res.second, counter + 1);

         return result;
      }
};

BOTAN_REGISTER_TEST("otp", "otp_hotp", HOTP_KAT_Tests);

class TOTP_KAT_Tests final : public Text_Based_Test {
   public:
      TOTP_KAT_Tests() : Text_Based_Test("otp/totp.vec", "Key,Digits,Timestep,Timestamp,OTP") {}

      bool clear_between_callbacks() const override { return false; }

      Test::Result run_one_test(const std::string& hash_algo, const VarMap& vars) override {
         Test::Result result("TOTP " + hash_algo);

         auto hash_test = Botan::HashFunction::create(hash_algo);
         if(!hash_test) {
            return {result};
         }

         const auto key = Botan::SymmetricKey(vars.get_req_bin("Key"));
         const uint32_t otp = static_cast<uint32_t>(vars.get_req_sz("OTP"));
         const size_t digits = vars.get_req_sz("Digits");
         const size_t timestep = vars.get_req_sz("Timestep");
         const std::string timestamp = vars.get_req_str("Timestamp");

         Botan::TOTP totp(key, hash_algo, digits, timestep);

         const std::chrono::system_clock::time_point time = from_timestring(timestamp);
         const std::chrono::system_clock::time_point later_time = time + std::chrono::seconds(timestep);
         const std::chrono::system_clock::time_point too_late = time + std::chrono::seconds(2 * timestep);

         result.test_u32_eq("TOTP generate", totp.generate_totp(time), otp);

         result.test_is_true("TOTP verify valid", totp.verify_totp(otp, time, 0));
         result.test_is_false("TOTP verify invalid", totp.verify_totp(otp ^ 1, time, 0));
         result.test_is_false("TOTP verify time slip", totp.verify_totp(otp, later_time, 0));
         result.test_is_true("TOTP verify time slip allowed", totp.verify_totp(otp, later_time, 1));
         result.test_is_false("TOTP verify time slip out of range", totp.verify_totp(otp, too_late, 1));

         return result;
      }

   private:
      static std::chrono::system_clock::time_point from_timestring(const std::string& time_str) {
         if(time_str.size() != 19) {
            throw Test_Error("Invalid TOTP timestamp string " + time_str);
         }
         // YYYY-MM-DDTHH:MM:SS
         // 0123456789012345678
         const auto year = Botan::parse_u32(time_str.substr(0, 4));
         const auto month = Botan::parse_u32(time_str.substr(5, 2));
         const auto day = Botan::parse_u32(time_str.substr(8, 2));
         const auto hour = Botan::parse_u32(time_str.substr(11, 2));
         const auto minute = Botan::parse_u32(time_str.substr(14, 2));
         const auto second = Botan::parse_u32(time_str.substr(17, 2));

         if(year && month && day && hour && minute && second) {
            return Botan::calendar_point(*year, *month, *day, *hour, *minute, *second).to_std_timepoint();
         } else {
            throw Test_Error("Invalid TOTP timestamp string " + time_str);
         }
      }
};

BOTAN_REGISTER_TEST("otp", "otp_totp", TOTP_KAT_Tests);

#endif

}  // namespace

}  // namespace Botan_Tests

1	/*
2	* OTP tests
3	* (C) 2017 Jack Lloyd
4	*
5	* Botan is released under the Simplified BSD License (see license.txt)
6	*/
7
8	#include "tests.h"
9
10	#if defined(BOTAN_HAS_HOTP) && defined(BOTAN_HAS_TOTP)
11	#include <botan/hash.h>
12	#include <botan/otp.h>
13	#include <botan/internal/calendar.h>
14	#include <botan/internal/parsing.h>
15	#endif
16
17	namespace Botan_Tests {
18
19	namespace {
20
21	#if defined(BOTAN_HAS_HOTP) && defined(BOTAN_HAS_TOTP)
22
23	class HOTP_KAT_Tests final : public Text_Based_Test {	×
24	public:
25	HOTP_KAT_Tests() : Text_Based_Test("otp/hotp.vec", "Key,Digits,Counter,OTP") {}	2✔
26
27	bool clear_between_callbacks() const override { return false; }	32✔
28
29	Test::Result run_one_test(const std::string& hash_algo, const VarMap& vars) override {	32✔
30	Test::Result result("HOTP " + hash_algo);	32✔
31
32	auto hash_test = Botan::HashFunction::create(hash_algo);	32✔
33	if(!hash_test) {	32✔
34	return {result};	×
35	}
36
37	const auto key = Botan::SymmetricKey(vars.get_req_bin("Key"));	32✔
38	const uint32_t otp = static_cast<uint32_t>(vars.get_req_sz("OTP"));	32✔
39	const uint64_t counter = vars.get_req_sz("Counter");	32✔
40	const size_t digits = vars.get_req_sz("Digits");	32✔
41
42	Botan::HOTP hotp(key, hash_algo, digits);	32✔
43
44	result.test_u32_eq("OTP", hotp.generate_hotp(counter), otp);	32✔
45
46	std::pair<bool, uint64_t> otp_res = hotp.verify_hotp(otp, counter, 0);	32✔
47	result.test_is_true("OTP verify result", otp_res.first);	32✔
48	result.test_u64_eq("OTP verify next counter", otp_res.second, counter + 1);	32✔
49
50	// Test invalid OTP
51	otp_res = hotp.verify_hotp(otp + 1, counter, 0);	32✔
52	result.test_is_false("OTP verify result", otp_res.first);	32✔
53	result.test_u64_eq("OTP verify next counter", otp_res.second, counter);	32✔
54
55	// Test invalid OTP with long range
56	otp_res = hotp.verify_hotp(otp + 1, counter, 100);	32✔
57	result.test_is_false("OTP verify result", otp_res.first);	32✔
58	result.test_u64_eq("OTP verify next counter", otp_res.second, counter);	32✔
59
60	// Test valid OTP with long range
61	const uint64_t starting_counter = (counter >= 90) ? (counter - 90) : uint64_t(0);	32✔
62	otp_res = hotp.verify_hotp(otp, starting_counter, 100);	32✔
63	result.test_is_true("OTP verify result", otp_res.first);	32✔
64	result.test_u64_eq("OTP verify next counter", otp_res.second, counter + 1);	32✔
65
66	return result;	32✔
67	}	96✔
68	};
69
70	BOTAN_REGISTER_TEST("otp", "otp_hotp", HOTP_KAT_Tests);
71
72	class TOTP_KAT_Tests final : public Text_Based_Test {	×
73	public:
74	TOTP_KAT_Tests() : Text_Based_Test("otp/totp.vec", "Key,Digits,Timestep,Timestamp,OTP") {}	2✔
75
76	bool clear_between_callbacks() const override { return false; }	3✔
77
78	Test::Result run_one_test(const std::string& hash_algo, const VarMap& vars) override {	3✔
79	Test::Result result("TOTP " + hash_algo);	3✔
80
81	auto hash_test = Botan::HashFunction::create(hash_algo);	3✔
82	if(!hash_test) {	3✔
83	return {result};	×
84	}
85
86	const auto key = Botan::SymmetricKey(vars.get_req_bin("Key"));	3✔
87	const uint32_t otp = static_cast<uint32_t>(vars.get_req_sz("OTP"));	3✔
88	const size_t digits = vars.get_req_sz("Digits");	3✔
89	const size_t timestep = vars.get_req_sz("Timestep");	3✔
90	const std::string timestamp = vars.get_req_str("Timestamp");	3✔
91
92	Botan::TOTP totp(key, hash_algo, digits, timestep);	3✔
93
94	const std::chrono::system_clock::time_point time = from_timestring(timestamp);	3✔
95	const std::chrono::system_clock::time_point later_time = time + std::chrono::seconds(timestep);	3✔
96	const std::chrono::system_clock::time_point too_late = time + std::chrono::seconds(2 * timestep);	3✔
97
98	result.test_u32_eq("TOTP generate", totp.generate_totp(time), otp);	3✔
99
100	result.test_is_true("TOTP verify valid", totp.verify_totp(otp, time, 0));	3✔
101	result.test_is_false("TOTP verify invalid", totp.verify_totp(otp ^ 1, time, 0));	3✔
102	result.test_is_false("TOTP verify time slip", totp.verify_totp(otp, later_time, 0));	3✔
103	result.test_is_true("TOTP verify time slip allowed", totp.verify_totp(otp, later_time, 1));	3✔
104	result.test_is_false("TOTP verify time slip out of range", totp.verify_totp(otp, too_late, 1));	3✔
105
106	return result;	3✔
107	}	9✔
108
109	private:
110	static std::chrono::system_clock::time_point from_timestring(const std::string& time_str) {	3✔
111	if(time_str.size() != 19) {	3✔
112	throw Test_Error("Invalid TOTP timestamp string " + time_str);	×
113	}
114	// YYYY-MM-DDTHH:MM:SS
115	// 0123456789012345678
116	const auto year = Botan::parse_u32(time_str.substr(0, 4));	3✔
117	const auto month = Botan::parse_u32(time_str.substr(5, 2));	3✔
118	const auto day = Botan::parse_u32(time_str.substr(8, 2));	3✔
119	const auto hour = Botan::parse_u32(time_str.substr(11, 2));	3✔
120	const auto minute = Botan::parse_u32(time_str.substr(14, 2));	3✔
121	const auto second = Botan::parse_u32(time_str.substr(17, 2));	3✔
122
123	if(year && month && day && hour && minute && second) {	3✔
124	return Botan::calendar_point(year, month, day, hour, minute, second).to_std_timepoint();	3✔
125	} else {
126	throw Test_Error("Invalid TOTP timestamp string " + time_str);	×
127	}
128	}
129	};
130
131	BOTAN_REGISTER_TEST("otp", "otp_totp", TOTP_KAT_Tests);
132
133	#endif
134
135	} // namespace
136
137	} // namespace Botan_Tests

randombit / botan / 27052752106

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous