aboutsummaryrefslogtreecommitdiff
path: root/src/test/test_routerkeys.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/test/test_routerkeys.c')
-rw-r--r--src/test/test_routerkeys.c334
1 files changed, 205 insertions, 129 deletions
diff --git a/src/test/test_routerkeys.c b/src/test/test_routerkeys.c
index 24b0da1c46..727fa5660f 100644
--- a/src/test/test_routerkeys.c
+++ b/src/test/test_routerkeys.c
@@ -1,24 +1,32 @@
/* Copyright (c) 2001-2004, Roger Dingledine.
* Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson.
- * Copyright (c) 2007-2016, The Tor Project, Inc. */
+ * Copyright (c) 2007-2019, The Tor Project, Inc. */
/* See LICENSE for licensing information */
#include "orconfig.h"
#define ROUTER_PRIVATE
-#include "or.h"
-#include "config.h"
-#include "router.h"
-#include "routerkeys.h"
-#include "util.h"
-#include "crypto.h"
-#include "torcert.h"
-#include "test.h"
+#include "core/or/or.h"
+#include "app/config/config.h"
+#include "feature/relay/router.h"
+#include "feature/relay/routerkeys.h"
+#include "lib/crypt_ops/crypto_cipher.h"
+#include "lib/crypt_ops/crypto_format.h"
+#include "feature/keymgt/loadkey.h"
+#include "feature/nodelist/torcert.h"
+#include "test/test.h"
#ifdef _WIN32
/* For mkdir() */
#include <direct.h>
#endif
+#ifdef HAVE_UNISTD_H
+#include <unistd.h>
+#endif
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
+
static void
test_routerkeys_write_fingerprint(void *arg)
{
@@ -92,8 +100,8 @@ test_routerkeys_ed_certs(void *args)
uint8_t *junk = NULL;
char *base64 = NULL;
- tt_int_op(0,==,ed25519_keypair_generate(&kp1, 0));
- tt_int_op(0,==,ed25519_keypair_generate(&kp2, 0));
+ tt_int_op(0,OP_EQ,ed25519_keypair_generate(&kp1, 0));
+ tt_int_op(0,OP_EQ,ed25519_keypair_generate(&kp2, 0));
for (int i = 0; i <= 1; ++i) {
uint32_t flags = i ? CERT_FLAG_INCLUDE_SIGNING_KEY : 0;
@@ -101,45 +109,45 @@ test_routerkeys_ed_certs(void *args)
cert[i] = tor_cert_create(&kp1, 5, &kp2.pubkey, now, 10000, flags);
tt_assert(cert[i]);
- tt_assert(cert[i]->sig_bad == 0);
- tt_assert(cert[i]->sig_ok == 1);
- tt_assert(cert[i]->cert_expired == 0);
- tt_assert(cert[i]->cert_valid == 1);
- tt_int_op(cert[i]->cert_type, ==, 5);
- tt_mem_op(cert[i]->signed_key.pubkey, ==, &kp2.pubkey.pubkey, 32);
- tt_mem_op(cert[i]->signing_key.pubkey, ==, &kp1.pubkey.pubkey, 32);
- tt_int_op(cert[i]->signing_key_included, ==, i);
+ tt_uint_op(cert[i]->sig_bad, OP_EQ, 0);
+ tt_uint_op(cert[i]->sig_ok, OP_EQ, 1);
+ tt_uint_op(cert[i]->cert_expired, OP_EQ, 0);
+ tt_uint_op(cert[i]->cert_valid, OP_EQ, 1);
+ tt_int_op(cert[i]->cert_type, OP_EQ, 5);
+ tt_mem_op(cert[i]->signed_key.pubkey, OP_EQ, &kp2.pubkey.pubkey, 32);
+ tt_mem_op(cert[i]->signing_key.pubkey, OP_EQ, &kp1.pubkey.pubkey, 32);
+ tt_int_op(cert[i]->signing_key_included, OP_EQ, i);
tt_assert(cert[i]->encoded);
- tt_int_op(cert[i]->encoded_len, ==, 104 + 36 * i);
- tt_int_op(cert[i]->encoded[0], ==, 1);
- tt_int_op(cert[i]->encoded[1], ==, 5);
+ tt_int_op(cert[i]->encoded_len, OP_EQ, 104 + 36 * i);
+ tt_int_op(cert[i]->encoded[0], OP_EQ, 1);
+ tt_int_op(cert[i]->encoded[1], OP_EQ, 5);
parsed_cert[i] = tor_cert_parse(cert[i]->encoded, cert[i]->encoded_len);
tt_assert(parsed_cert[i]);
- tt_int_op(cert[i]->encoded_len, ==, parsed_cert[i]->encoded_len);
- tt_mem_op(cert[i]->encoded, ==, parsed_cert[i]->encoded,
+ tt_int_op(cert[i]->encoded_len, OP_EQ, parsed_cert[i]->encoded_len);
+ tt_mem_op(cert[i]->encoded, OP_EQ, parsed_cert[i]->encoded,
cert[i]->encoded_len);
- tt_assert(parsed_cert[i]->sig_bad == 0);
- tt_assert(parsed_cert[i]->sig_ok == 0);
- tt_assert(parsed_cert[i]->cert_expired == 0);
- tt_assert(parsed_cert[i]->cert_valid == 0);
+ tt_uint_op(parsed_cert[i]->sig_bad, OP_EQ, 0);
+ tt_uint_op(parsed_cert[i]->sig_ok, OP_EQ, 0);
+ tt_uint_op(parsed_cert[i]->cert_expired, OP_EQ, 0);
+ tt_uint_op(parsed_cert[i]->cert_valid, OP_EQ, 0);
/* Expired */
tt_int_op(tor_cert_checksig(parsed_cert[i], &kp1.pubkey, now + 30000),
- <, 0);
- tt_assert(parsed_cert[i]->cert_expired == 1);
+ OP_LT, 0);
+ tt_uint_op(parsed_cert[i]->cert_expired, OP_EQ, 1);
parsed_cert[i]->cert_expired = 0;
/* Wrong key */
- tt_int_op(tor_cert_checksig(parsed_cert[i], &kp2.pubkey, now), <, 0);
- tt_assert(parsed_cert[i]->sig_bad== 1);
+ tt_int_op(tor_cert_checksig(parsed_cert[i], &kp2.pubkey, now), OP_LT, 0);
+ tt_uint_op(parsed_cert[i]->sig_bad, OP_EQ, 1);
parsed_cert[i]->sig_bad = 0;
/* Missing key */
int ok = tor_cert_checksig(parsed_cert[i], NULL, now);
- tt_int_op(ok < 0, ==, i == 0);
- tt_assert(parsed_cert[i]->sig_bad == 0);
+ tt_int_op(ok < 0, OP_EQ, i == 0);
+ tt_uint_op(parsed_cert[i]->sig_bad, OP_EQ, 0);
tt_assert(parsed_cert[i]->sig_ok == (i != 0));
tt_assert(parsed_cert[i]->cert_valid == (i != 0));
parsed_cert[i]->sig_bad = 0;
@@ -147,29 +155,29 @@ test_routerkeys_ed_certs(void *args)
parsed_cert[i]->cert_valid = 0;
/* Right key */
- tt_int_op(tor_cert_checksig(parsed_cert[i], &kp1.pubkey, now), ==, 0);
- tt_assert(parsed_cert[i]->sig_bad == 0);
- tt_assert(parsed_cert[i]->sig_ok == 1);
- tt_assert(parsed_cert[i]->cert_expired == 0);
- tt_assert(parsed_cert[i]->cert_valid == 1);
+ tt_int_op(tor_cert_checksig(parsed_cert[i], &kp1.pubkey, now), OP_EQ, 0);
+ tt_uint_op(parsed_cert[i]->sig_bad, OP_EQ, 0);
+ tt_uint_op(parsed_cert[i]->sig_ok, OP_EQ, 1);
+ tt_uint_op(parsed_cert[i]->cert_expired, OP_EQ, 0);
+ tt_uint_op(parsed_cert[i]->cert_valid, OP_EQ, 1);
}
/* Now try some junky certs. */
/* - Truncated */
nocert = tor_cert_parse(cert[0]->encoded, cert[0]->encoded_len-1);
- tt_ptr_op(NULL, ==, nocert);
+ tt_ptr_op(NULL, OP_EQ, nocert);
/* - First byte modified */
cert[0]->encoded[0] = 99;
nocert = tor_cert_parse(cert[0]->encoded, cert[0]->encoded_len);
- tt_ptr_op(NULL, ==, nocert);
+ tt_ptr_op(NULL, OP_EQ, nocert);
cert[0]->encoded[0] = 1;
/* - Extra byte at the end*/
junk = tor_malloc_zero(cert[0]->encoded_len + 1);
memcpy(junk, cert[0]->encoded, cert[0]->encoded_len);
nocert = tor_cert_parse(junk, cert[0]->encoded_len+1);
- tt_ptr_op(NULL, ==, nocert);
+ tt_ptr_op(NULL, OP_EQ, nocert);
/* - Multiple signing key instances */
tor_free(junk);
@@ -183,7 +191,7 @@ test_routerkeys_ed_certs(void *args)
junk[77] = 32; /* extlen */
junk[78] = 4; /* exttype */
nocert = tor_cert_parse(junk, 104 + 36 * 2);
- tt_ptr_op(NULL, ==, nocert);
+ tt_ptr_op(NULL, OP_EQ, nocert);
done:
tor_cert_free(cert[0]);
@@ -211,11 +219,12 @@ test_routerkeys_ed_key_create(void *arg)
kp2 = ed_key_new(kp1, INIT_ED_KEY_NEEDCERT, now, 3600, 4, &cert);
tt_assert(kp2);
tt_assert(cert);
- tt_mem_op(&cert->signed_key, ==, &kp2->pubkey, sizeof(ed25519_public_key_t));
+ tt_mem_op(&cert->signed_key, OP_EQ, &kp2->pubkey,
+ sizeof(ed25519_public_key_t));
tt_assert(! cert->signing_key_included);
- tt_int_op(cert->valid_until, >=, now);
- tt_int_op(cert->valid_until, <=, now+7200);
+ tt_int_op(cert->valid_until, OP_GE, now);
+ tt_int_op(cert->valid_until, OP_LE, now+7200);
/* Create a new key-including certificate signed by kp1 */
ed25519_keypair_free(kp2);
@@ -227,8 +236,10 @@ test_routerkeys_ed_key_create(void *arg)
tt_assert(kp2);
tt_assert(cert);
tt_assert(cert->signing_key_included);
- tt_mem_op(&cert->signed_key, ==, &kp2->pubkey, sizeof(ed25519_public_key_t));
- tt_mem_op(&cert->signing_key, ==, &kp1->pubkey,sizeof(ed25519_public_key_t));
+ tt_mem_op(&cert->signed_key, OP_EQ, &kp2->pubkey,
+ sizeof(ed25519_public_key_t));
+ tt_mem_op(&cert->signing_key, OP_EQ, &kp1->pubkey,
+ sizeof(ed25519_public_key_t));
done:
ed25519_keypair_free(kp1);
@@ -252,82 +263,83 @@ test_routerkeys_ed_key_init_basic(void *arg)
unlink(fname2);
/* Fail to load a key that isn't there. */
- kp1 = ed_key_init_from_file(fname1, 0, LOG_INFO, NULL, now, 0, 7, &cert);
+ kp1 = ed_key_init_from_file(fname1, 0, LOG_INFO, NULL, now, 0, 7, &cert,
+ NULL);
tt_assert(kp1 == NULL);
tt_assert(cert == NULL);
/* Create the key if requested to do so. */
kp1 = ed_key_init_from_file(fname1, INIT_ED_KEY_CREATE, LOG_INFO,
- NULL, now, 0, 7, &cert);
+ NULL, now, 0, 7, &cert, NULL);
tt_assert(kp1 != NULL);
tt_assert(cert == NULL);
- tt_int_op(stat(get_fname("test_ed_key_1_cert"), &st), <, 0);
- tt_int_op(stat(get_fname("test_ed_key_1_secret_key"), &st), ==, 0);
+ tt_int_op(stat(get_fname("test_ed_key_1_cert"), &st), OP_LT, 0);
+ tt_int_op(stat(get_fname("test_ed_key_1_secret_key"), &st), OP_EQ, 0);
/* Fail to load if we say we need a cert */
kp2 = ed_key_init_from_file(fname1, INIT_ED_KEY_NEEDCERT, LOG_INFO,
- NULL, now, 0, 7, &cert);
+ NULL, now, 0, 7, &cert, NULL);
tt_assert(kp2 == NULL);
/* Fail to load if we say the wrong key type */
kp2 = ed_key_init_from_file(fname1, 0, LOG_INFO,
- NULL, now, 0, 6, &cert);
+ NULL, now, 0, 6, &cert, NULL);
tt_assert(kp2 == NULL);
/* Load successfully if we're not picky, whether we say "create" or not. */
kp2 = ed_key_init_from_file(fname1, INIT_ED_KEY_CREATE, LOG_INFO,
- NULL, now, 0, 7, &cert);
+ NULL, now, 0, 7, &cert, NULL);
tt_assert(kp2 != NULL);
tt_assert(cert == NULL);
- tt_mem_op(kp1, ==, kp2, sizeof(*kp1));
+ tt_mem_op(kp1, OP_EQ, kp2, sizeof(*kp1));
ed25519_keypair_free(kp2); kp2 = NULL;
kp2 = ed_key_init_from_file(fname1, 0, LOG_INFO,
- NULL, now, 0, 7, &cert);
+ NULL, now, 0, 7, &cert, NULL);
tt_assert(kp2 != NULL);
tt_assert(cert == NULL);
- tt_mem_op(kp1, ==, kp2, sizeof(*kp1));
+ tt_mem_op(kp1, OP_EQ, kp2, sizeof(*kp1));
ed25519_keypair_free(kp2); kp2 = NULL;
/* Now create a key with a cert. */
kp2 = ed_key_init_from_file(fname2, (INIT_ED_KEY_CREATE|
INIT_ED_KEY_NEEDCERT),
- LOG_INFO, kp1, now, 7200, 7, &cert);
+ LOG_INFO, kp1, now, 7200, 7, &cert, NULL);
tt_assert(kp2 != NULL);
tt_assert(cert != NULL);
- tt_mem_op(kp1, !=, kp2, sizeof(*kp1));
- tt_int_op(stat(get_fname("test_ed_key_2_cert"), &st), ==, 0);
- tt_int_op(stat(get_fname("test_ed_key_2_secret_key"), &st), ==, 0);
+ tt_mem_op(kp1, OP_NE, kp2, sizeof(*kp1));
+ tt_int_op(stat(get_fname("test_ed_key_2_cert"), &st), OP_EQ, 0);
+ tt_int_op(stat(get_fname("test_ed_key_2_secret_key"), &st), OP_EQ, 0);
tt_assert(cert->cert_valid == 1);
- tt_mem_op(&cert->signed_key, ==, &kp2->pubkey, 32);
+ tt_mem_op(&cert->signed_key, OP_EQ, &kp2->pubkey, 32);
/* Now verify we can load the cert... */
kp3 = ed_key_init_from_file(fname2, (INIT_ED_KEY_CREATE|
INIT_ED_KEY_NEEDCERT),
- LOG_INFO, kp1, now, 7200, 7, &cert2);
- tt_mem_op(kp2, ==, kp3, sizeof(*kp2));
- tt_mem_op(cert2->encoded, ==, cert->encoded, cert->encoded_len);
+ LOG_INFO, kp1, now, 7200, 7, &cert2, NULL);
+ tt_mem_op(kp2, OP_EQ, kp3, sizeof(*kp2));
+ tt_mem_op(cert2->encoded, OP_EQ, cert->encoded, cert->encoded_len);
ed25519_keypair_free(kp3); kp3 = NULL;
tor_cert_free(cert2); cert2 = NULL;
/* ... even without create... */
kp3 = ed_key_init_from_file(fname2, INIT_ED_KEY_NEEDCERT,
- LOG_INFO, kp1, now, 7200, 7, &cert2);
- tt_mem_op(kp2, ==, kp3, sizeof(*kp2));
- tt_mem_op(cert2->encoded, ==, cert->encoded, cert->encoded_len);
+ LOG_INFO, kp1, now, 7200, 7, &cert2, NULL);
+ tt_mem_op(kp2, OP_EQ, kp3, sizeof(*kp2));
+ tt_mem_op(cert2->encoded, OP_EQ, cert->encoded, cert->encoded_len);
ed25519_keypair_free(kp3); kp3 = NULL;
tor_cert_free(cert2); cert2 = NULL;
/* ... but that we don't crash or anything if we say we don't want it. */
kp3 = ed_key_init_from_file(fname2, INIT_ED_KEY_NEEDCERT,
- LOG_INFO, kp1, now, 7200, 7, NULL);
- tt_mem_op(kp2, ==, kp3, sizeof(*kp2));
+ LOG_INFO, kp1, now, 7200, 7, NULL, NULL);
+ tt_mem_op(kp2, OP_EQ, kp3, sizeof(*kp2));
ed25519_keypair_free(kp3); kp3 = NULL;
/* Fail if we're told the wrong signing key */
kp3 = ed_key_init_from_file(fname2, INIT_ED_KEY_NEEDCERT,
- LOG_INFO, kp2, now, 7200, 7, &cert2);
+ LOG_INFO, kp2, now, 7200, 7, &cert2, NULL);
tt_assert(kp3 == NULL);
tt_assert(cert2 == NULL);
@@ -358,51 +370,52 @@ test_routerkeys_ed_key_init_split(void *arg)
unlink(fname2);
/* Can't load key that isn't there. */
- kp1 = ed_key_init_from_file(fname1, flags, LOG_INFO, NULL, now, 0, 7, &cert);
+ kp1 = ed_key_init_from_file(fname1, flags, LOG_INFO, NULL, now, 0, 7, &cert,
+ NULL);
tt_assert(kp1 == NULL);
tt_assert(cert == NULL);
/* Create a split key */
kp1 = ed_key_init_from_file(fname1, flags|INIT_ED_KEY_CREATE,
- LOG_INFO, NULL, now, 0, 7, &cert);
+ LOG_INFO, NULL, now, 0, 7, &cert, NULL);
tt_assert(kp1 != NULL);
tt_assert(cert == NULL);
- tt_int_op(stat(get_fname("test_ed_key_3_cert"), &st), <, 0);
- tt_int_op(stat(get_fname("test_ed_key_3_secret_key"), &st), ==, 0);
- tt_int_op(stat(get_fname("test_ed_key_3_public_key"), &st), ==, 0);
+ tt_int_op(stat(get_fname("test_ed_key_3_cert"), &st), OP_LT, 0);
+ tt_int_op(stat(get_fname("test_ed_key_3_secret_key"), &st), OP_EQ, 0);
+ tt_int_op(stat(get_fname("test_ed_key_3_public_key"), &st), OP_EQ, 0);
/* Load it. */
kp2 = ed_key_init_from_file(fname1, flags|INIT_ED_KEY_CREATE,
- LOG_INFO, NULL, now, 0, 7, &cert);
+ LOG_INFO, NULL, now, 0, 7, &cert, NULL);
tt_assert(kp2 != NULL);
tt_assert(cert == NULL);
- tt_mem_op(kp1, ==, kp2, sizeof(*kp2));
+ tt_mem_op(kp1, OP_EQ, kp2, sizeof(*kp2));
ed25519_keypair_free(kp2); kp2 = NULL;
/* Okay, try killing the secret key and loading it. */
unlink(get_fname("test_ed_key_3_secret_key"));
kp2 = ed_key_init_from_file(fname1, flags,
- LOG_INFO, NULL, now, 0, 7, &cert);
+ LOG_INFO, NULL, now, 0, 7, &cert, NULL);
tt_assert(kp2 != NULL);
tt_assert(cert == NULL);
- tt_mem_op(&kp1->pubkey, ==, &kp2->pubkey, sizeof(kp2->pubkey));
+ tt_mem_op(&kp1->pubkey, OP_EQ, &kp2->pubkey, sizeof(kp2->pubkey));
tt_assert(tor_mem_is_zero((char*)kp2->seckey.seckey,
sizeof(kp2->seckey.seckey)));
ed25519_keypair_free(kp2); kp2 = NULL;
/* Even when we're told to "create", don't create if there's a public key */
kp2 = ed_key_init_from_file(fname1, flags|INIT_ED_KEY_CREATE,
- LOG_INFO, NULL, now, 0, 7, &cert);
+ LOG_INFO, NULL, now, 0, 7, &cert, NULL);
tt_assert(kp2 != NULL);
tt_assert(cert == NULL);
- tt_mem_op(&kp1->pubkey, ==, &kp2->pubkey, sizeof(kp2->pubkey));
+ tt_mem_op(&kp1->pubkey, OP_EQ, &kp2->pubkey, sizeof(kp2->pubkey));
tt_assert(tor_mem_is_zero((char*)kp2->seckey.seckey,
sizeof(kp2->seckey.seckey)));
ed25519_keypair_free(kp2); kp2 = NULL;
/* Make sure we fail on a tag mismatch, though */
kp2 = ed_key_init_from_file(fname1, flags,
- LOG_INFO, NULL, now, 0, 99, &cert);
+ LOG_INFO, NULL, now, 0, 99, &cert, NULL);
tt_assert(kp2 == NULL);
done:
@@ -418,6 +431,7 @@ test_routerkeys_ed_keys_init_all(void *arg)
{
(void)arg;
char *dir = tor_strdup(get_fname("test_ed_keys_init_all"));
+ char *keydir = tor_strdup(get_fname("test_ed_keys_init_all/KEYS"));
or_options_t *options = tor_malloc_zero(sizeof(or_options_t));
time_t now = time(NULL);
ed25519_public_key_t id;
@@ -442,16 +456,17 @@ test_routerkeys_ed_keys_init_all(void *arg)
#ifdef _WIN32
mkdir(dir);
- mkdir(get_fname("test_ed_keys_init_all/keys"));
+ mkdir(keydir);
#else
mkdir(dir, 0700);
- mkdir(get_fname("test_ed_keys_init_all/keys"), 0700);
-#endif
+ mkdir(keydir, 0700);
+#endif /* defined(_WIN32) */
options->DataDirectory = dir;
+ options->KeyDirectory = keydir;
- tt_int_op(0, ==, load_ed_keys(options, now));
- tt_int_op(0, ==, generate_ed_link_cert(options, now));
+ tt_int_op(1, OP_EQ, load_ed_keys(options, now));
+ tt_int_op(0, OP_EQ, generate_ed_link_cert(options, now, 0));
tt_assert(get_master_identity_key());
tt_assert(get_master_identity_key());
tt_assert(get_master_signing_keypair());
@@ -465,21 +480,21 @@ test_routerkeys_ed_keys_init_all(void *arg)
link_cert = tor_cert_dup(get_current_link_cert_cert());
/* Call load_ed_keys again, but nothing has changed. */
- tt_int_op(0, ==, load_ed_keys(options, now));
- tt_int_op(0, ==, generate_ed_link_cert(options, now));
- tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));
- tt_mem_op(&sign, ==, get_master_signing_keypair(), sizeof(sign));
- tt_mem_op(&auth, ==, get_current_auth_keypair(), sizeof(auth));
+ tt_int_op(0, OP_EQ, load_ed_keys(options, now));
+ tt_int_op(0, OP_EQ, generate_ed_link_cert(options, now, 0));
+ tt_mem_op(&id, OP_EQ, get_master_identity_key(), sizeof(id));
+ tt_mem_op(&sign, OP_EQ, get_master_signing_keypair(), sizeof(sign));
+ tt_mem_op(&auth, OP_EQ, get_current_auth_keypair(), sizeof(auth));
tt_assert(tor_cert_eq(link_cert, get_current_link_cert_cert()));
/* Force a reload: we make new link/auth keys. */
routerkeys_free_all();
- tt_int_op(0, ==, load_ed_keys(options, now));
- tt_int_op(0, ==, generate_ed_link_cert(options, now));
- tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));
- tt_mem_op(&sign, ==, get_master_signing_keypair(), sizeof(sign));
+ tt_int_op(1, OP_EQ, load_ed_keys(options, now));
+ tt_int_op(0, OP_EQ, generate_ed_link_cert(options, now, 0));
+ tt_mem_op(&id, OP_EQ, get_master_identity_key(), sizeof(id));
+ tt_mem_op(&sign, OP_EQ, get_master_signing_keypair(), sizeof(sign));
tt_assert(tor_cert_eq(link_cert, get_current_link_cert_cert()));
- tt_mem_op(&auth, !=, get_current_auth_keypair(), sizeof(auth));
+ tt_mem_op(&auth, OP_NE, get_current_auth_keypair(), sizeof(auth));
tt_assert(get_master_signing_key_cert());
tt_assert(get_current_link_cert_cert());
tt_assert(get_current_auth_key_cert());
@@ -488,12 +503,12 @@ test_routerkeys_ed_keys_init_all(void *arg)
memcpy(&auth, get_current_auth_keypair(), sizeof(auth));
/* Force a link/auth-key regeneration by advancing time. */
- tt_int_op(0, ==, load_ed_keys(options, now+3*86400));
- tt_int_op(0, ==, generate_ed_link_cert(options, now+3*86400));
- tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));
- tt_mem_op(&sign, ==, get_master_signing_keypair(), sizeof(sign));
+ tt_int_op(0, OP_EQ, load_ed_keys(options, now+3*86400));
+ tt_int_op(0, OP_EQ, generate_ed_link_cert(options, now+3*86400, 0));
+ tt_mem_op(&id, OP_EQ, get_master_identity_key(), sizeof(id));
+ tt_mem_op(&sign, OP_EQ, get_master_signing_keypair(), sizeof(sign));
tt_assert(! tor_cert_eq(link_cert, get_current_link_cert_cert()));
- tt_mem_op(&auth, !=, get_current_auth_keypair(), sizeof(auth));
+ tt_mem_op(&auth, OP_NE, get_current_auth_keypair(), sizeof(auth));
tt_assert(get_master_signing_key_cert());
tt_assert(get_current_link_cert_cert());
tt_assert(get_current_auth_key_cert());
@@ -502,12 +517,12 @@ test_routerkeys_ed_keys_init_all(void *arg)
memcpy(&auth, get_current_auth_keypair(), sizeof(auth));
/* Force a signing-key regeneration by advancing time. */
- tt_int_op(0, ==, load_ed_keys(options, now+100*86400));
- tt_int_op(0, ==, generate_ed_link_cert(options, now+100*86400));
- tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));
- tt_mem_op(&sign, !=, get_master_signing_keypair(), sizeof(sign));
+ tt_int_op(1, OP_EQ, load_ed_keys(options, now+100*86400));
+ tt_int_op(0, OP_EQ, generate_ed_link_cert(options, now+100*86400, 0));
+ tt_mem_op(&id, OP_EQ, get_master_identity_key(), sizeof(id));
+ tt_mem_op(&sign, OP_NE, get_master_signing_keypair(), sizeof(sign));
tt_assert(! tor_cert_eq(link_cert, get_current_link_cert_cert()));
- tt_mem_op(&auth, !=, get_current_auth_keypair(), sizeof(auth));
+ tt_mem_op(&auth, OP_NE, get_current_auth_keypair(), sizeof(auth));
tt_assert(get_master_signing_key_cert());
tt_assert(get_current_link_cert_cert());
tt_assert(get_current_auth_key_cert());
@@ -518,14 +533,14 @@ test_routerkeys_ed_keys_init_all(void *arg)
/* Demonstrate that we can start up with no secret identity key */
routerkeys_free_all();
- unlink(get_fname("test_ed_keys_init_all/keys/"
+ unlink(get_fname("test_ed_keys_init_all/KEYS/"
"ed25519_master_id_secret_key"));
- tt_int_op(0, ==, load_ed_keys(options, now));
- tt_int_op(0, ==, generate_ed_link_cert(options, now));
- tt_mem_op(&id, ==, get_master_identity_key(), sizeof(id));
- tt_mem_op(&sign, ==, get_master_signing_keypair(), sizeof(sign));
+ tt_int_op(1, OP_EQ, load_ed_keys(options, now));
+ tt_int_op(0, OP_EQ, generate_ed_link_cert(options, now, 0));
+ tt_mem_op(&id, OP_EQ, get_master_identity_key(), sizeof(id));
+ tt_mem_op(&sign, OP_EQ, get_master_signing_keypair(), sizeof(sign));
tt_assert(! tor_cert_eq(link_cert, get_current_link_cert_cert()));
- tt_mem_op(&auth, !=, get_current_auth_keypair(), sizeof(auth));
+ tt_mem_op(&auth, OP_NE, get_current_auth_keypair(), sizeof(auth));
tt_assert(get_master_signing_key_cert());
tt_assert(get_current_link_cert_cert());
tt_assert(get_current_auth_key_cert());
@@ -535,10 +550,11 @@ test_routerkeys_ed_keys_init_all(void *arg)
log_global_min_severity_ = LOG_ERR; /* Suppress warnings.
* XXX (better way to do this)? */
routerkeys_free_all();
- tt_int_op(-1, ==, load_ed_keys(options, now+200*86400));
+ tt_int_op(-1, OP_EQ, load_ed_keys(options, now+200*86400));
done:
tor_free(dir);
+ tor_free(keydir);
tor_free(options);
tor_cert_free(link_cert);
routerkeys_free_all();
@@ -556,20 +572,20 @@ test_routerkeys_cross_certify_ntor(void *args)
time_t now = time(NULL);
int sign;
- tt_int_op(0, ==, ed25519_public_from_base64(&master_key,
+ tt_int_op(0, OP_EQ, ed25519_public_from_base64(&master_key,
"IamwritingthesetestsOnARainyAfternoonin2014"));
- tt_int_op(0, ==, curve25519_keypair_generate(&onion_keys, 0));
+ tt_int_op(0, OP_EQ, curve25519_keypair_generate(&onion_keys, 0));
cert = make_ntor_onion_key_crosscert(&onion_keys,
&master_key,
now, 10000,
&sign);
tt_assert(cert);
tt_assert(sign == 0 || sign == 1);
- tt_int_op(cert->cert_type, ==, CERT_TYPE_ONION_ID);
- tt_int_op(1, ==, ed25519_pubkey_eq(&cert->signed_key, &master_key));
- tt_int_op(0, ==, ed25519_public_key_from_curve25519_public_key(
+ tt_int_op(cert->cert_type, OP_EQ, CERT_TYPE_ONION_ID);
+ tt_int_op(1, OP_EQ, ed25519_pubkey_eq(&cert->signed_key, &master_key));
+ tt_int_op(0, OP_EQ, ed25519_public_key_from_curve25519_public_key(
&onion_check_key, &onion_keys.pubkey, sign));
- tt_int_op(0, ==, tor_cert_checksig(cert, &onion_check_key, now));
+ tt_int_op(0, OP_EQ, tor_cert_checksig(cert, &onion_check_key, now));
done:
tor_cert_free(cert);
@@ -587,7 +603,7 @@ test_routerkeys_cross_certify_tap(void *args)
char buf[128];
int n;
- tt_int_op(0, ==, ed25519_public_from_base64(&master_key,
+ tt_int_op(0, OP_EQ, ed25519_public_from_base64(&master_key,
"IAlreadyWroteTestsForRouterdescsUsingTheseX"));
cc = make_tap_onion_key_crosscert(onion_key,
@@ -598,14 +614,14 @@ test_routerkeys_cross_certify_tap(void *args)
n = crypto_pk_public_checksig(onion_key, buf, sizeof(buf),
(char*)cc, cc_len);
- tt_int_op(n,>,0);
- tt_int_op(n,==,52);
+ tt_int_op(n,OP_GT,0);
+ tt_int_op(n,OP_EQ,52);
crypto_pk_get_digest(id_key, digest);
- tt_mem_op(buf,==,digest,20);
- tt_mem_op(buf+20,==,master_key.pubkey,32);
+ tt_mem_op(buf,OP_EQ,digest,20);
+ tt_mem_op(buf+20,OP_EQ,master_key.pubkey,32);
- tt_int_op(0, ==, check_tap_onion_key_crosscert(cc, cc_len,
+ tt_int_op(0, OP_EQ, check_tap_onion_key_crosscert(cc, cc_len,
onion_key, &master_key, (uint8_t*)digest));
done:
@@ -614,6 +630,66 @@ test_routerkeys_cross_certify_tap(void *args)
crypto_pk_free(onion_key);
}
+static void
+test_routerkeys_rsa_ed_crosscert(void *arg)
+{
+ (void)arg;
+ ed25519_public_key_t ed;
+ crypto_pk_t *rsa = pk_generate(2);
+
+ uint8_t *cc = NULL;
+ ssize_t cc_len;
+ time_t expires_in = 1470846177;
+
+ tt_int_op(0, OP_EQ, ed25519_public_from_base64(&ed,
+ "ThisStringCanContainAnythingSoNoKeyHereNowX"));
+ cc_len = tor_make_rsa_ed25519_crosscert(&ed, rsa, expires_in, &cc);
+
+ tt_int_op(cc_len, OP_GT, 0);
+ tt_int_op(cc_len, OP_GT, 37); /* key, expires, siglen */
+ tt_mem_op(cc, OP_EQ, ed.pubkey, 32);
+ time_t expires_out = 3600 * ntohl(get_uint32(cc+32));
+ tt_int_op(expires_out, OP_GE, expires_in);
+ tt_int_op(expires_out, OP_LE, expires_in + 3600);
+
+ tt_int_op(cc_len, OP_EQ, 37 + get_uint8(cc+36));
+
+ tt_int_op(0, OP_EQ, rsa_ed25519_crosscert_check(cc, cc_len, rsa, &ed,
+ expires_in - 10));
+
+ /* Now try after it has expired */
+ tt_int_op(-4, OP_EQ, rsa_ed25519_crosscert_check(cc, cc_len, rsa, &ed,
+ expires_out + 1));
+
+ /* Truncated object */
+ tt_int_op(-2, OP_EQ, rsa_ed25519_crosscert_check(cc, cc_len - 2, rsa, &ed,
+ expires_in - 10));
+
+ /* Key not as expected */
+ cc[0] ^= 3;
+ tt_int_op(-3, OP_EQ, rsa_ed25519_crosscert_check(cc, cc_len, rsa, &ed,
+ expires_in - 10));
+ cc[0] ^= 3;
+
+ /* Bad signature */
+ cc[40] ^= 3;
+ tt_int_op(-5, OP_EQ, rsa_ed25519_crosscert_check(cc, cc_len, rsa, &ed,
+ expires_in - 10));
+ cc[40] ^= 3;
+
+ /* Signature of wrong data */
+ cc[0] ^= 3;
+ ed.pubkey[0] ^= 3;
+ tt_int_op(-6, OP_EQ, rsa_ed25519_crosscert_check(cc, cc_len, rsa, &ed,
+ expires_in - 10));
+ cc[0] ^= 3;
+ ed.pubkey[0] ^= 3;
+
+ done:
+ crypto_pk_free(rsa);
+ tor_free(cc);
+}
+
#define TEST(name, flags) \
{ #name , test_routerkeys_ ## name, (flags), NULL, NULL }
@@ -626,6 +702,6 @@ struct testcase_t routerkeys_tests[] = {
TEST(ed_keys_init_all, TT_FORK),
TEST(cross_certify_ntor, 0),
TEST(cross_certify_tap, 0),
+ TEST(rsa_ed_crosscert, 0),
END_OF_TESTCASES
};
-
7apu2bq3rhoylwmucxizk54afw5jyda7pho4j5zdcqpwkufke7zdzwad.onion