151 lines
9.8 KiB
C
151 lines
9.8 KiB
C
#include <assert.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <sqlite3.h>
|
|
#include <openssl/rand.h>
|
|
#include "utun_instance.h"
|
|
#include "routing_layer/topo_node.h"
|
|
#include "routing_layer/topo_node_sqlite.h"
|
|
#include "routing_layer/devgroup.h"
|
|
#include "dm/dm_identity.h"
|
|
#include "dm/dm_crypto.h"
|
|
|
|
/* Полноценные ключи/удостоверения без сети: офлайн-узлы входят в snapshot. */
|
|
static void device(struct TOPO_NODE* node, struct SC_MYKEYS* keys, uint8_t ed_private[32]) {
|
|
memset(node, 0, sizeof(*node));
|
|
assert(sc_generate_keypair(keys) == SC_OK && RAND_bytes(ed_private, 32) == 1);
|
|
assert(!devgroup_public_keys(ed_private, keys->private_key, node->ed25519_public_key, node->public_key));
|
|
node->node_id = sc_derive_node_id_from_pubkey(node->public_key);
|
|
}
|
|
|
|
static void group(struct TOPO_NODE* node, const uint8_t ed[32], const uint8_t x[32], const char* name, uint64_t version) {
|
|
assert(!devgroup_public_keys(ed, x, node->devgroup.ed, node->devgroup.x));
|
|
assert(!devgroup_sign(&node->devgroup, ed, name, version, version,
|
|
node->node_id, node->public_key, node->ed25519_public_key));
|
|
}
|
|
|
|
/* Устойчивое собственное состояние, которое читает штатный devgroup_load_local. */
|
|
static void local_group(struct UTUN_INSTANCE* inst, const struct devgroup_record* record, const uint8_t ed[32], const uint8_t x[32]) {
|
|
uint8_t wire[DEVGROUP_WIRE_MAX]; int n = devgroup_encode(record, wire, sizeof(wire)); assert(n > 0);
|
|
sqlite3_stmt* st = NULL;
|
|
assert(sqlite3_prepare_v2(inst->topo_sqlite_db,
|
|
"INSERT INTO devgroup_local(node_id,ed_priv,x_priv,record) VALUES(?,?,?,?)", -1, &st, NULL) == SQLITE_OK);
|
|
assert(sqlite3_bind_int64(st, 1, (sqlite3_int64)inst->node_id) == SQLITE_OK);
|
|
assert(sqlite3_bind_blob(st, 2, ed, 32, SQLITE_STATIC) == SQLITE_OK);
|
|
assert(sqlite3_bind_blob(st, 3, x, 32, SQLITE_STATIC) == SQLITE_OK);
|
|
assert(sqlite3_bind_blob(st, 4, wire, n, SQLITE_STATIC) == SQLITE_OK);
|
|
assert(sqlite3_step(st) == SQLITE_DONE && sqlite3_finalize(st) == SQLITE_OK);
|
|
}
|
|
|
|
static int deny_nodes(void* arg, int action, const char* table, const char* column, const char* db, const char* trigger) {
|
|
(void)arg; (void)column; (void)db; (void)trigger;
|
|
return action == SQLITE_READ && table && !strcmp(table, "nodes") ? SQLITE_DENY : SQLITE_OK;
|
|
}
|
|
|
|
static int has_target(const struct dm_target* targets, size_t count, uint64_t node, unsigned side) {
|
|
for (size_t i = 0; i < count; i++) if (targets[i].node == node && targets[i].side == side) return 1;
|
|
return 0;
|
|
}
|
|
|
|
int main(void) {
|
|
debug_config_init(); debug_set_level(DEBUG_LEVEL_DEBUG);
|
|
struct UTUN_INSTANCE inst = {0};
|
|
assert(sqlite3_open(":memory:", &inst.topo_sqlite_db) == SQLITE_OK && !topo_node_sqlite_init(inst.topo_sqlite_db));
|
|
struct TOPO_NODE nodes[5]; struct SC_MYKEYS keys[5]; uint8_t ed_private[5][32];
|
|
uint8_t group_ed[2][32], group_x[2][32];
|
|
assert(RAND_bytes((uint8_t*)group_ed, sizeof(group_ed)) == 1 && RAND_bytes((uint8_t*)group_x, sizeof(group_x)) == 1);
|
|
for (unsigned i = 0; i < 5; i++) {
|
|
device(nodes + i, keys + i, ed_private[i]);
|
|
if (i < 4) group(nodes + i, group_ed[i / 2], group_x[i / 2], i < 2 ? "Own devices" : "Peer devices", 1);
|
|
assert(!devgroup_project(inst.topo_sqlite_db, nodes + i));
|
|
}
|
|
inst.node_id = nodes[0].node_id; inst.my_keys = keys[0];
|
|
memcpy(inst.my_ed25519_pubkey, nodes[0].ed25519_public_key, 32); memcpy(inst.my_ed25519_privkey, ed_private[0], 32);
|
|
local_group(&inst, &nodes[0].devgroup, group_ed[0], group_x[0]);
|
|
|
|
struct dm_party direct[2], parties[2], reversed[2], standalone;
|
|
assert(!dm_party_resolve(&inst, nodes[0].node_id, DM_MODE_DEVICE, direct));
|
|
assert(!dm_party_resolve(&inst, nodes[2].node_id, DM_MODE_DEVICE, direct + 1));
|
|
assert(dm_identity_conv_id(DM_MODE_DEVICE, direct) == dm_derive_conv_id(nodes[0].node_id, nodes[2].node_id));
|
|
struct dm_target targets[DM_TARGET_MAX] = {{0}}; size_t count = 99;
|
|
assert(!dm_identity_targets(&inst, direct, targets, DM_TARGET_MAX, &count) && count == 2);
|
|
assert(has_target(targets, count, nodes[0].node_id, 0) && has_target(targets, count, nodes[2].node_id, 1));
|
|
assert(!dm_party_resolve(&inst, nodes[1].node_id, DM_MODE_DEVICE, direct + 1));
|
|
assert(dm_identity_conv_id(DM_MODE_DEVICE, direct) == dm_derive_conv_id(nodes[0].node_id, nodes[1].node_id));
|
|
assert(!dm_identity_targets(&inst, direct, targets, DM_TARGET_MAX, &count) && count == 2);
|
|
|
|
assert(!dm_party_resolve(&inst, nodes[0].node_id, DM_MODE_GROUPS, parties));
|
|
assert(!dm_party_resolve(&inst, nodes[2].node_id, DM_MODE_GROUPS, parties + 1));
|
|
assert(parties[0].kind == DM_PARTY_GROUP && parties[1].kind == DM_PARTY_GROUP);
|
|
reversed[0] = parties[1]; reversed[1] = parties[0];
|
|
uint64_t conv = dm_identity_conv_id(DM_MODE_GROUPS, parties);
|
|
assert(conv && conv == dm_identity_conv_id(DM_MODE_GROUPS, reversed));
|
|
assert(!dm_identity_conv_id(DM_MODE_DEVICE, parties));
|
|
assert(!dm_identity_targets(&inst, parties, targets, DM_TARGET_MAX, &count) && count == 4);
|
|
for (unsigned i = 0; i < 4; i++) assert(has_target(targets, count, nodes[i].node_id, i / 2));
|
|
for (size_t i = 1; i < count; i++) assert(targets[i - 1].node < targets[i].node);
|
|
assert(dm_party_member(&inst, parties, nodes[4].node_id) == 0);
|
|
uint8_t secret[32]; assert(!dm_party_private(&inst, parties, secret) && !memcmp(secret, group_x[0], 32));
|
|
memset(secret, 0x5a, sizeof(secret)); uint8_t before_secret[32]; memcpy(before_secret, secret, 32);
|
|
assert(dm_party_private(&inst, parties + 1, secret) < 0 && !memcmp(secret, before_secret, 32));
|
|
|
|
struct dm_target snapshot[DM_TARGET_MAX]; memcpy(snapshot, targets, sizeof(targets)); size_t old_count = count;
|
|
assert(dm_identity_targets(&inst, parties, targets, 3, &count) < 0);
|
|
assert(count == old_count && !memcmp(targets, snapshot, sizeof(targets)));
|
|
assert(!dm_party_resolve(&inst, nodes[4].node_id, DM_MODE_GROUPS, &standalone) && standalone.kind == DM_PARTY_DEVICE);
|
|
reversed[0] = parties[0]; reversed[1] = standalone;
|
|
assert(!dm_identity_targets(&inst, reversed, targets, DM_TARGET_MAX, &count) && count == 3);
|
|
reversed[0] = standalone; reversed[1] = parties[1];
|
|
assert(!dm_identity_targets(&inst, reversed, targets, DM_TARGET_MAX, &count) && count == 3);
|
|
reversed[0] = parties[0]; reversed[1] = parties[0];
|
|
assert(!dm_identity_conv_id(DM_MODE_GROUPS, reversed));
|
|
assert(dm_identity_targets(&inst, reversed, targets, DM_TARGET_MAX, &count) < 0);
|
|
reversed[1].x[0] ^= 1;
|
|
assert(!dm_identity_conv_id(DM_MODE_GROUPS, reversed));
|
|
assert(dm_identity_targets(&inst, reversed, targets, DM_TARGET_MAX, &count) < 0);
|
|
|
|
group(nodes + 2, group_ed[1], group_x[1], "Renamed peer devices", 2);
|
|
assert(!devgroup_project(inst.topo_sqlite_db, nodes + 2));
|
|
assert(!dm_party_resolve(&inst, nodes[3].node_id, DM_MODE_GROUPS, reversed + 1));
|
|
assert(dm_party_equal(reversed + 1, parties + 1) && conv == dm_identity_conv_id(DM_MODE_GROUPS, parties));
|
|
group(nodes + 4, group_ed[1], group_x[1], "Renamed peer devices", 2);
|
|
assert(!devgroup_project(inst.topo_sqlite_db, nodes + 4));
|
|
assert(!dm_identity_targets(&inst, parties, targets, DM_TARGET_MAX, &count) && count == 5);
|
|
assert(old_count == 4 && !has_target(snapshot, old_count, nodes[4].node_id, 1));
|
|
|
|
struct dm_party decoded = parties[0]; uint8_t wire[DM_PARTY_WIRE_SIZE];
|
|
assert(!dm_party_encode(direct, wire) && !dm_party_decode(wire, &decoded) && dm_party_equal(direct, &decoded));
|
|
wire[1] ^= 1; assert(dm_party_decode(wire, &decoded) < 0 && dm_party_equal(direct, &decoded));
|
|
assert(!dm_party_encode(parties, wire) && !dm_party_decode(wire, &decoded) && dm_party_equal(parties, &decoded));
|
|
wire[0] = 42; assert(dm_party_decode(wire, &decoded) < 0 && dm_party_equal(parties, &decoded));
|
|
|
|
/* Поддельная принадлежность не превращается в fallback на устройство. */
|
|
struct TOPO_NODE bad = nodes[1]; bad.devgroup.member_sig[0] ^= 1;
|
|
assert(!devgroup_project(inst.topo_sqlite_db, &bad));
|
|
decoded = parties[1];
|
|
assert(dm_party_resolve(&inst, bad.node_id, DM_MODE_GROUPS, &decoded) < 0 && dm_party_equal(&decoded, parties + 1));
|
|
assert(dm_identity_targets(&inst, parties, targets, DM_TARGET_MAX, &count) < 0);
|
|
assert(!devgroup_project(inst.topo_sqlite_db, nodes + 1));
|
|
|
|
/* Одинаковый Ed ID с разными X ключами не объединяет две криптографические группы. */
|
|
bad = nodes[2]; uint8_t other_x[32]; assert(RAND_bytes(other_x, 32) == 1);
|
|
group(&bad, group_ed[1], other_x, "Conflicting key", 3);
|
|
assert(!devgroup_project(inst.topo_sqlite_db, &bad));
|
|
assert(dm_party_resolve(&inst, nodes[3].node_id, DM_MODE_GROUPS, &decoded) < 0);
|
|
assert(!devgroup_project(inst.topo_sqlite_db, nodes + 2));
|
|
|
|
assert(sqlite3_set_authorizer(inst.topo_sqlite_db, deny_nodes, NULL) == SQLITE_OK);
|
|
decoded = parties[0];
|
|
assert(dm_party_resolve(&inst, nodes[2].node_id, DM_MODE_GROUPS, &decoded) < 0 && dm_party_equal(&decoded, parties));
|
|
assert(sqlite3_set_authorizer(inst.topo_sqlite_db, NULL, NULL) == SQLITE_OK);
|
|
|
|
/* Выход удаляет секрет: закреплённая сторона не должна незаметно стать DEVICE. */
|
|
assert(sqlite3_exec(inst.topo_sqlite_db, "DELETE FROM devgroup_local", NULL, NULL, NULL) == SQLITE_OK);
|
|
assert(dm_party_private(&inst, parties, secret) < 0);
|
|
assert(!dm_party_resolve(&inst, inst.node_id, DM_MODE_GROUPS, &decoded) && decoded.kind == DM_PARTY_DEVICE);
|
|
assert(!dm_party_equal(&decoded, parties) && dm_identity_conv_id(DM_MODE_GROUPS, parties) == conv);
|
|
assert(sqlite3_close(inst.topo_sqlite_db) == SQLITE_OK);
|
|
puts("PASS DM identity: device/group modes, own devices, fallback, offline snapshots, rename, signatures, SQL errors and leave");
|
|
return 0;
|
|
}
|