From e49f2f5a18cd6ec5a9784db66a8010aa46df8e89 Mon Sep 17 00:00:00 2001
From: Dave Grijalva <grijalva@gmail.com>
Date: Tue, 17 Apr 2012 18:41:12 -0700
Subject: [PATCH] almost working

---
 rs256.go            | 45 ++++++++++++++++++++++++++++++++++++----
 rs256_test.go       | 50 +++++++++++++++++++++++++++++++++++++++++++++
 test/sample_key     | 27 ++++++++++++++++++++++++
 test/sample_key.pub |  9 ++++++++
 4 files changed, 127 insertions(+), 4 deletions(-)
 create mode 100644 rs256_test.go
 create mode 100644 test/sample_key
 create mode 100644 test/sample_key.pub

diff --git a/rs256.go b/rs256.go
index 430950b..7f4be64 100644
--- a/rs256.go
+++ b/rs256.go
@@ -1,7 +1,16 @@
 package jwt
 
-type SigningMethodRS256 struct {
-}
+import (
+	"errors"
+	"encoding/base64"
+	"encoding/pem"
+	"crypto"
+	"crypto/x509"
+	"crypto/rsa"
+	_ "crypto/sha256"
+)
+
+type SigningMethodRS256 struct {}
 
 func init() {
 	RegisterSigningMethod("RS256", func() SigningMethod {
@@ -9,8 +18,36 @@ func init() {
 	})
 }
 
-func (m *SigningMethodRS256) Verify(signingString, signature string, key []byte)error {
-	return nil
+func (m *SigningMethodRS256) Verify(signingString, signature string, key []byte)(err error) {
+	// len % 4
+	switch len(signature) % 4 {
+		case 2:
+		signature = signature + "=="
+		case 3:
+		signature = signature + "==="
+	}
+	
+	// Key
+	var sig []byte
+	if sig, err = base64.URLEncoding.DecodeString(signature); err == nil {
+		var block *pem.Block
+		if block, _ = pem.Decode(key); block != nil {
+			var parsedKey interface{}
+			if parsedKey, err = x509.ParsePKIXPublicKey(block.Bytes); err == nil {
+				if rsaKey, ok := parsedKey.(*rsa.PublicKey); ok {
+					hasher := crypto.SHA256.New()
+					hasher.Write([]byte(signingString))
+					
+					err = rsa.VerifyPKCS1v15(rsaKey, crypto.SHA256, hasher.Sum(nil), sig)
+				} else {
+					err = errors.New("Key is not a valid RSA public key")
+				}
+			}
+		} else {
+			err = errors.New("Could not parse key data")
+		}
+	}
+	return
 }
 
 func (m *SigningMethodRS256) Sign(token, key []byte)error {
diff --git a/rs256_test.go b/rs256_test.go
new file mode 100644
index 0000000..41d2598
--- /dev/null
+++ b/rs256_test.go
@@ -0,0 +1,50 @@
+package jwt
+
+import (
+	"os"
+	"io"
+	"bytes"
+	"testing"
+	"strings"
+)
+
+var testData = []struct{
+	name string
+	tokenString string
+	claims map[string]interface{}
+	valid bool
+}{
+	{
+		"basic: foo => bar",
+		"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJmb28iOiJiYXIifQ.FhkiHkoESI_cG3NPigFrxEk9Z60_oXrOT2vGm9Pn6RDgYNovYORQmmA0zs1AoAOf09ly2Nx2YAg6ABqAYga1AcMFkJljwxTT5fYphTuqpWdy4BELeSYJx5Ty2gmr8e7RonuUztrdD5WfPqLKMm1Ozp_T6zALpRmwTIW0QPnaBXaQD90FplAg46Iy1UlDKr-Eupy0i5SLch5Q-p2ZpaL_5fnTIUDlxC3pWhJTyx_71qDI-mAA_5lE_VdroOeflG56sSmDxopPEG3bFlSu1eowyBfxtu0_CuVd-M42RU75Zc4Gsj6uV77MBtbMrf4_7M_NUTSgoIF3fRqxrj0NzihIBg",
+		map[string]interface{}{"foo": "bar"},
+		true,
+	},
+	{
+		"basic invalid: foo => bar",
+		"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJmb28iOiJiYXIifQ.EhkiHkoESI_cG3NPigFrxEk9Z60_oXrOT2vGm9Pn6RDgYNovYORQmmA0zs1AoAOf09ly2Nx2YAg6ABqAYga1AcMFkJljwxTT5fYphTuqpWdy4BELeSYJx5Ty2gmr8e7RonuUztrdD5WfPqLKMm1Ozp_T6zALpRmwTIW0QPnaBXaQD90FplAg46Iy1UlDKr-Eupy0i5SLch5Q-p2ZpaL_5fnTIUDlxC3pWhJTyx_71qDI-mAA_5lE_VdroOeflG56sSmDxopPEG3bFlSu1eowyBfxtu0_CuVd-M42RU75Zc4Gsj6uV77MBtbMrf4_7M_NUTSgoIF3fRqxrj0NzihIBg",
+		map[string]interface{}{"foo": "bar"},
+		false,
+	},
+}
+
+func TestRS256Verify(t *testing.T) {
+	file, _ := os.Open("test/sample_key.pub")
+	buf := new(bytes.Buffer)
+	io.Copy(buf, file)
+	key := buf.Bytes()
+	file.Close()
+	
+	for _, data := range testData {
+		parts := strings.Split(data.tokenString, ".")
+		
+		method, _ := GetSigningMethod("RS256")
+		err := method.Verify(strings.Join(parts[0:1], "."), parts[2], key)
+		if data.valid && err != nil {
+			t.Errorf("[%v] Error while verifying key: %v", data.name, err)
+		}
+		if !data.valid && err == nil {
+			t.Errorf("[%v] Invalid key passed validation", data.name)
+		}
+	}
+}
\ No newline at end of file
diff --git a/test/sample_key b/test/sample_key
new file mode 100644
index 0000000..abdbade
--- /dev/null
+++ b/test/sample_key
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA4f5wg5l2hKsTeNem/V41fGnJm6gOdrj8ym3rFkEU/wT8RDtn
+SgFEZOQpHEgQ7JL38xUfU0Y3g6aYw9QT0hJ7mCpz9Er5qLaMXJwZxzHzAahlfA0i
+cqabvJOMvQtzD6uQv6wPEyZtDTWiQi9AXwBpHssPnpYGIn20ZZuNlX2BrClciHhC
+PUIIZOQn/MmqTD31jSyjoQoV7MhhMTATKJx2XrHhR+1DcKJzQBSTAGnpYVaqpsAR
+ap+nwRipr3nUTuxyGohBTSmjJ2usSeQXHI3bODIRe1AuTyHceAbewn8b462yEWKA
+Rdpd9AjQW5SIVPfdsz5B6GlYQ5LdYKtznTuy7wIDAQABAoIBAQCwia1k7+2oZ2d3
+n6agCAbqIE1QXfCmh41ZqJHbOY3oRQG3X1wpcGH4Gk+O+zDVTV2JszdcOt7E5dAy
+MaomETAhRxB7hlIOnEN7WKm+dGNrKRvV0wDU5ReFMRHg31/Lnu8c+5BvGjZX+ky9
+POIhFFYJqwCRlopGSUIxmVj5rSgtzk3iWOQXr+ah1bjEXvlxDOWkHN6YfpV5ThdE
+KdBIPGEVqa63r9n2h+qazKrtiRqJqGnOrHzOECYbRFYhexsNFz7YT02xdfSHn7gM
+IvabDDP/Qp0PjE1jdouiMaFHYnLBbgvlnZW9yuVf/rpXTUq/njxIXMmvmEyyvSDn
+FcFikB8pAoGBAPF77hK4m3/rdGT7X8a/gwvZ2R121aBcdPwEaUhvj/36dx596zvY
+mEOjrWfZhF083/nYWE2kVquj2wjs+otCLfifEEgXcVPTnEOPO9Zg3uNSL0nNQghj
+FuD3iGLTUBCtM66oTe0jLSslHe8gLGEQqyMzHOzYxNqibxcOZIe8Qt0NAoGBAO+U
+I5+XWjWEgDmvyC3TrOSf/KCGjtu0TSv30ipv27bDLMrpvPmD/5lpptTFwcxvVhCs
+2b+chCjlghFSWFbBULBrfci2FtliClOVMYrlNBdUSJhf3aYSG2Doe6Bgt1n2CpNn
+/iu37Y3NfemZBJA7hNl4dYe+f+uzM87cdQ214+jrAoGAXA0XxX8ll2+ToOLJsaNT
+OvNB9h9Uc5qK5X5w+7G7O998BN2PC/MWp8H+2fVqpXgNENpNXttkRm1hk1dych86
+EunfdPuqsX+as44oCyJGFHVBnWpm33eWQw9YqANRI+pCJzP08I5WK3osnPiwshd+
+hR54yjgfYhBFNI7B95PmEQkCgYBzFSz7h1+s34Ycr8SvxsOBWxymG5zaCsUbPsL0
+4aCgLScCHb9J+E86aVbbVFdglYa5Id7DPTL61ixhl7WZjujspeXZGSbmq0Kcnckb
+mDgqkLECiOJW2NHP/j0McAkDLL4tysF8TLDO8gvuvzNC+WQ6drO2ThrypLVZQ+ry
+eBIPmwKBgEZxhqa0gVvHQG/7Od69KWj4eJP28kq13RhKay8JOoN0vPmspXJo1HY3
+CKuHRG+AP579dncdUnOMvfXOtkdM4vk0+hWASBQzM9xzVcztCa+koAugjVaLS9A+
+9uQoqEeVNTckxx0S2bYevRy7hGQmUJTyQm3j1zEUR5jpdbL83Fbq
+-----END RSA PRIVATE KEY-----
diff --git a/test/sample_key.pub b/test/sample_key.pub
new file mode 100644
index 0000000..03dc982
--- /dev/null
+++ b/test/sample_key.pub
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4f5wg5l2hKsTeNem/V41
+fGnJm6gOdrj8ym3rFkEU/wT8RDtnSgFEZOQpHEgQ7JL38xUfU0Y3g6aYw9QT0hJ7
+mCpz9Er5qLaMXJwZxzHzAahlfA0icqabvJOMvQtzD6uQv6wPEyZtDTWiQi9AXwBp
+HssPnpYGIn20ZZuNlX2BrClciHhCPUIIZOQn/MmqTD31jSyjoQoV7MhhMTATKJx2
+XrHhR+1DcKJzQBSTAGnpYVaqpsARap+nwRipr3nUTuxyGohBTSmjJ2usSeQXHI3b
+ODIRe1AuTyHceAbewn8b462yEWKARdpd9AjQW5SIVPfdsz5B6GlYQ5LdYKtznTuy
+7wIDAQAB
+-----END PUBLIC KEY-----