Dmitri Shuralyov <******@****.***> 1652741088 -0400

# This configures all services within the namespace to use mTLS with permissive mode (allowing plaintext).

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: ns-default
  namespace: {{ .To.NamespaceName }}
spec:
  mtls:
    mode: PERMISSIVE

---
# This configures requests to any service in the namespace to use mTLS.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  annotations:
    test-suite: plaintext-to-permissive
spec:
  mtls:
    mode: PERMISSIVE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: default
  annotations:
    test-suite: plaintext-to-permissive
spec:
  host: "*.local"
  trafficPolicy:
    tls:

John Howard <******@****.***> 1676573723 -0800

	plaintext := []byte("exampleplaintext")

	// CBC mode works on blocks so plaintexts may need to be padded to the
	// next whole block. For an example of such padding, see
	// https://tools.ietf.org/html/rfc5246#section-6.2.3.2. Here we'll
	// assume that the plaintext is already of the correct length.
	if len(plaintext)%aes.BlockSize != 0 {
		panic("plaintext is not a multiple of the block size")
	}

			}
		}

		ct := aesgcm.Seal(nil, nonce, plaintext, ad)
		if ctHex := hex.EncodeToString(ct); ctHex != test.result {
			t.Errorf("#%d: got %s, want %s", i, ctHex, test.result)
			continue
		}

		plaintext2, err := aesgcm.Open(nil, nonce, ct, ad)
		if err != nil {
			t.Errorf("#%d: Open failed", i)
			continue
		}

		if !bytes.Equal(plaintext, plaintext2) {

					Name:   "plaintext on tls port",
					Call:   mkCall(8080, simulation.Plaintext),
					Result: simulation.Result{Error: simulation.ErrNoFilterChain},
				},
				{
					Name:   "tls on tls port",
					Call:   mkCall(8080, simulation.MTLS),
					Result: simulation.Result{ClusterMatched: "inbound|8080||"},
				},
				{
					Name:   "plaintext on plaintext port",
					Call:   mkCall(9090, simulation.Plaintext),

mtls_k8s_ca,TestMtlsStrictK8sCA/global-plaintext/a->tcp://naked:tcp
mtls_k8s_ca,TestMtlsStrictK8sCA/global-plaintext/a->ws://a:http
mtls_k8s_ca,TestMtlsStrictK8sCA/global-plaintext/a->ws://b:http
mtls_k8s_ca,TestMtlsStrictK8sCA/global-plaintext/a->ws://headless:http
mtls_k8s_ca,TestMtlsStrictK8sCA/global-plaintext/a->ws://multiversion:http
mtls_k8s_ca,TestMtlsStrictK8sCA/global-plaintext/a->ws://naked:http

		t.Fatalf("Failed to generate key: %v", err)
	}
	plaintext, err := KMS.Decrypt(context.TODO(), &DecryptRequest{
		Name:       key.KeyID,
		Ciphertext: key.Ciphertext,
	})
	if err != nil {
		t.Fatalf("Failed to decrypt key: %v", err)
	}
	if !bytes.Equal(key.Plaintext, plaintext) {
		t.Fatalf("Decrypted key does not match generated one: got %x - want %x", key.Plaintext, plaintext)
	}
}

func TestDecryptKey(t *testing.T) {

	block, err := aes.NewCipher(commonKey128)
	if err != nil {
		t.Error(err)
		return
	}

	plaintext := []byte("this is the plaintext. this is the plaintext.")
	iv := make([]byte, block.BlockSize())
	rand.Reader.Read(iv)
	cfb := cipher.NewCFBEncrypter(block, iv)
	ciphertext := make([]byte, len(plaintext))
	copy(ciphertext, plaintext)
	cfb.XORKeyStream(ciphertext, ciphertext)

	cfbdec := cipher.NewCFBDecrypter(block, iv)