WHCandCursor
dade4072cf
Introduce a user Realm keypair (Monocypher) that signs instance certificates so same-domain peers can later auto-discover and connect. Co-authored-by: Cursor <cursoragent@cursor.com>
70 lines
2.1 KiB
C
70 lines
2.1 KiB
C
#define _POSIX_C_SOURCE 200809L
|
|
#include "cst_realm.h"
|
|
#include "cst_test_util.h"
|
|
|
|
#include <assert.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <time.h>
|
|
|
|
int main(void) {
|
|
char dir[2048];
|
|
assert(!test_tmpdir(dir, sizeof(dir), "realm"));
|
|
|
|
cst_realm_keys_t realm;
|
|
assert(cst_realm_generate(&realm) == 0);
|
|
assert(cst_realm_save(dir, &realm) == 0);
|
|
|
|
cst_realm_keys_t loaded;
|
|
assert(cst_realm_load(dir, &loaded) == 0);
|
|
assert(memcmp(loaded.pk, realm.pk, 32) == 0);
|
|
|
|
char fp[33], fp2[33];
|
|
assert(cst_realm_fingerprint(realm.pk, fp) == 0);
|
|
assert(cst_realm_fingerprint(loaded.pk, fp2) == 0);
|
|
assert(!strcmp(fp, fp2));
|
|
assert(strlen(fp) == 32);
|
|
|
|
cst_realm_cert_t cert;
|
|
uint8_t iseed[32], isk[64];
|
|
assert(cst_realm_enroll(&realm, "inst-a", "laptop", 0, &cert, iseed, isk) == 0);
|
|
assert(cst_realm_verify_cert(realm.pk, &cert, time(NULL)) == 0);
|
|
|
|
char *json = cst_realm_cert_to_json(&cert);
|
|
assert(json && strstr(json, "inst-a"));
|
|
cst_realm_cert_t parsed;
|
|
assert(cst_realm_cert_from_json(json, &parsed) == 0);
|
|
free(json);
|
|
assert(cst_realm_verify_cert(realm.pk, &parsed, time(NULL)) == 0);
|
|
assert(!strcmp(parsed.instance_id, "inst-a"));
|
|
|
|
uint8_t chal[32];
|
|
memset(chal, 0x5a, sizeof(chal));
|
|
uint8_t sig[64];
|
|
assert(cst_realm_challenge_sign(isk, chal, sizeof(chal), sig) == 0);
|
|
assert(cst_realm_challenge_check(&cert, chal, sizeof(chal), sig) == 0);
|
|
sig[0] ^= 1;
|
|
assert(cst_realm_challenge_check(&cert, chal, sizeof(chal), sig) != 0);
|
|
|
|
/* Foreign realm cannot verify. */
|
|
cst_realm_keys_t other;
|
|
assert(cst_realm_generate(&other) == 0);
|
|
assert(cst_realm_verify_cert(other.pk, &cert, time(NULL)) != 0);
|
|
|
|
/* Expiry. */
|
|
cst_realm_cert_t expired;
|
|
uint8_t s2[32], sk2[64];
|
|
assert(cst_realm_enroll(&realm, "inst-old", "old", 10, &expired, s2, sk2) == 0);
|
|
assert(cst_realm_verify_cert(realm.pk, &expired, 100) != 0);
|
|
assert(cst_realm_verify_cert(realm.pk, &expired, 5) == 0);
|
|
|
|
assert(cst_realm_revoke_add(dir, "inst-a") == 0);
|
|
assert(cst_realm_revoked(dir, "inst-a"));
|
|
assert(!cst_realm_revoked(dir, "inst-b"));
|
|
|
|
test_rmrf(dir);
|
|
puts("test_realm: OK");
|
|
return 0;
|
|
}
|