X-Git-Url: https://git.distorted.org.uk/~mdw/tripe/blobdiff_plain/de8edc7fdb0a26ca9cb736a49b020a64ee4a0d40..5891679d126ad426ed4250aeec75901bc854bf41:/server/tests.at
diff --git a/server/tests.at b/server/tests.at
index 88b9d160..ef2039ae 100644
--- a/server/tests.at
+++ b/server/tests.at
@@ -9,19 +9,18 @@
###
### This file is part of Trivial IP Encryption (TrIPE).
###
-### TrIPE is free software; you can redistribute it and/or modify
-### it under the terms of the GNU General Public License as published by
-### the Free Software Foundation; either version 2 of the License, or
-### (at your option) any later version.
+### TrIPE is free software: you can redistribute it and/or modify it under
+### the terms of the GNU General Public License as published by the Free
+### Software Foundation; either version 3 of the License, or (at your
+### option) any later version.
###
-### TrIPE is distributed in the hope that it will be useful,
-### but WITHOUT ANY WARRANTY; without even the implied warranty of
-### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-### GNU General Public License for more details.
+### TrIPE is distributed in the hope that it will be useful, but WITHOUT
+### ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+### FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+### for more details.
###
### You should have received a copy of the GNU General Public License
-### along with TrIPE; if not, write to the Free Software Foundation,
-### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+### along with TrIPE. If not, see .
m4_define([nl], [
])
@@ -35,13 +34,17 @@ m4_define([SETUPDIR], [
## Running standard programs with useful options.
m4_define([TRIPE],
[env TRIPE_PRIVHELPER=$abs_top_builddir/priv/tripe-privhelper \
- $abs_top_builddir/server/tripe -F -d. -aadmin -p0 -b127.0.0.1 -talice \
+ $abs_top_builddir/server/tripe -F -d. -aadmin -p0 -b127.0.0.1 \
${TRIPE_TEST_TRACEOPTS+-T$TRIPE_TEST_TRACEOPTS}])
m4_define([TRIPECTL], [$abs_top_builddir/client/tripectl -d. -aadmin])
m4_define([USLIP], [$abs_top_builddir/uslip/tripe-uslip])
-m4_define([PKSTREAM],
- [$abs_top_builddir/pkstream/pkstream -b127.0.0.1 -p127.0.0.1])
m4_define([MITM], [$abs_top_builddir/proxy/tripe-mitm])
+m4_define([BULKTEST],
+ [$abs_top_builddir/server/tripe-test \
+ ${TRIPE_TEST_TRACEOPTS+-T$TRIPE_TEST_TRACEOPTS}])
+
+## Pause for a bit.
+m4_define([SLEEP], [sleep 0.2])
## WITH_STRACE(tag, cmd)
##
@@ -109,7 +112,7 @@ $3
## End of the test, now run the server.
) && :; } | {
cd $1
- echo TRIPE $2 >&2
+ echo "TRIPE $2" >&2
WITH_STRACE([tripe], [TRIPE $2 >server-output.full 2>server-errors.full])
stat=$?
echo $stat >server-status
@@ -239,7 +242,7 @@ m4_define([AWAIT_KXDONE], [
## Watch for the key-exchange completion announcement in the background.
COPROCESSES([wait-$1], [
- echo WATCH +n
+ echo "WATCH +n"
while read line; do
set x $line; shift
echo >&2 ">>> $line"
@@ -317,7 +320,7 @@ m4_define([TRIPECTL_COMMAND], [
AT_SETUP([server basics])
SETUPDIR([alpha])
-AT_CHECK([echo port | TRIPE -p54321],, [INFO 54321[]nl[]OK[]nl])
+AT_CHECK([echo "port" | TRIPE -p54321],, [INFO 54321[]nl[]OK[]nl])
AT_CLEANUP
###--------------------------------------------------------------------------
@@ -335,7 +338,7 @@ WITH_TRIPE(, [
## server chose the same key is negligible.)
AT_CHECK([TRIPECTL checkchal AAAAAHyoOL+HMaE0Y9B3ivuszt0], [1],,
[tripectl: invalid-challenge[]nl])
- echo WARN CHAL incorrect-tag >>expected-server-output
+ echo "WARN CHAL incorrect-tag" >>expected-server-output
## A duplicated challenge.
AT_CHECK([
@@ -343,7 +346,7 @@ WITH_TRIPE(, [
TRIPECTL CHECKCHAL $chal
TRIPECTL CHECKCHAL $chal
], [1],, [tripectl: invalid-challenge[]nl])
- echo WARN CHAL replay duplicated-sequence >>expected-server-output
+ echo "WARN CHAL replay duplicated-sequence" >>expected-server-output
## Out-of-order reception. There should be a window of 32 challenges; we
## make 33 and check them in a strange order.
@@ -405,16 +408,23 @@ export TRIPE_SLIPIF=USLIP
for p in alice bob carol; do (mkdir $p; cd $p; SETUPDIR([alpha])); done
-## WITH_PKSTREAM(adir, aport, bdir, bport, body)
-m4_define([WITH_PKSTREAM], [
- echo >&2 "pkstream: $1 <--> :$2 <-pkstream-> :$4 <--> $3"
- PKSTREAM -l$4 127.0.0.1:$4 127.0.0.1:$(cat $3/port)& pkstream_$3_$1=$!
- sleep 1
- PKSTREAM -c127.0.0.1:$4 127.0.0.1:$2 127.0.0.1:$(cat $1/port)&
- pkstream_$1_$3=$!
- set +x
+## WITH_MITM(adir, aport, bdir, bport, body)
+m4_define([WITH_MITM], [
+ aspec="$2" bspec="$4"
+ case $aspec in =*) aport="?$1/$3.mitm" ;; *) aport=$aspec ;; esac
+ case $bspec in =*) bport="?$3/$1.mitm" ;; *) bport=$bspec ;; esac
+ MITM -k$1/keyring.pub \
+ peer:$1:$aport:127.0.0.1:$(cat $1/port) \
+ peer:$3:$bport:127.0.0.1:$(cat $3/port) \
+ filt:send& mitmpid_$1_$3=$!
+ SLEEP
+ case $aspec in =*) aport=$(cat ${aport#\?}); eval ${aspec#=}=\$aport ;; esac
+ case $bspec in =*) bport=$(cat ${bport#\?}); eval ${bspec#=}=\$bport ;; esac
+ echo >&2 "mitm: $1 <--> :$aport <-mitm-> :$bport <--> $3"
+ trap 'kill $mitmpid_$1_$3; exit 127' EXIT INT QUIT TERM HUP
+ SLEEP
$5
- kill $pkstream_$3_$1 $pkstream_$1_$3
+ kill $mitmpid_$1_$3; trap - EXIT INT QUIT TERM HUP
])
WITH_3TRIPES([alice], [bob], [carol], [-nslip],
@@ -422,35 +432,38 @@ WITH_3TRIPES([alice], [bob], [carol], [-nslip],
## We need an indirection layer between the two peers so that we can
## simulate the effects of NAT remapping. The nearest thing we have to
- ## this is pkstream, so we may as well use that.
+ ## this is the mitm proxy, so we may as well use that.
##
- ## alice <--> :5311 <-pkstream-> :5312 <--> bob
- ## alice <--> :5321 <-pkstream-> :5322 <--> carol
+ ## alice <--> :5311 <-mitm-> :5312 <--> bob
+ ## alice <--> :5321 <-mitm-> :5322 <--> carol
- WITH_PKSTREAM([alice], [5311], [bob], [5312], [
- ESTABLISH([alice], [alice], [], [bob], [bob], [-mobile], [5312], [5311])
+ WITH_MITM([alice], [=bob_from_alice], [bob], [=alice_from_bob], [
+ ESTABLISH([alice], [alice], [],
+ [bob], [bob], [-mobile],
+ [$alice_from_bob], [$bob_from_alice])
])
- WITH_PKSTREAM([alice], [5319], [bob], [5312], [
+ WITH_MITM([alice], [=new_bob_from_alice], [bob], [$alice_from_bob], [
COMMS_EPING([bob], [bob], [alice], [alice])
COMMS_SLIP([bob], [bob], [alice], [alice])
])
- WITH_PKSTREAM([alice], [5321], [carol], [5322], [
- ESTABLISH([alice], [alice], [], [carol], [carol], [-mobile],
- [5322], [5321])
+ WITH_MITM([alice], [=carol_from_alice], [carol], [=alice_from_carol], [
+ ESTABLISH([alice], [alice], [],
+ [carol], [carol], [-mobile],
+ [$alice_from_carol], [$carol_from_alice])
])
- WITH_PKSTREAM([alice], [5311], [bob], [5312], [
- WITH_PKSTREAM([alice], [5321], [carol], [5322], [
+ WITH_MITM([alice], [$bob_from_alice], [bob], [$alice_from_bob], [
+ WITH_MITM([alice], [$carol_from_alice], [carol], [$alice_from_carol], [
COMMS_EPING([bob], [bob], [alice], [alice])
COMMS_EPING([carol], [carol], [alice], [alice])
COMMS_SLIP([bob], [bob], [alice], [alice])
COMMS_SLIP([carol], [carol], [alice], [alice])
])])
- WITH_PKSTREAM([alice], [5321], [bob], [5312], [
- WITH_PKSTREAM([alice], [5311], [carol], [5322], [
+ WITH_MITM([alice], [$carol_from_alice], [bob], [$alice_from_bob], [
+ WITH_MITM([alice], [$bob_from_alice], [carol], [$alice_from_carol], [
COMMS_EPING([bob], [bob], [alice], [alice])
COMMS_EPING([carol], [carol], [alice], [alice])
COMMS_SLIP([bob], [bob], [alice], [alice])
@@ -473,15 +486,16 @@ for i in alice bob; do (mkdir $i; cd $i; SETUPDIR([beta])); done
WITH_2TRIPES([alice], [bob], [-nslip], [-talice], [-tbob], [
## Set up the evil proxy.
- alicemitm=24516 bobmitm=14016
mknod pipe-mitmpid p
WITH_STRACE([mitm],
[sh -c 'echo $$ >pipe-mitmpid; exec "$@"' - \
MITM -kalice/keyring.pub >mitm.out 2>mitm.err \
- peer:alice:$alicemitm:127.0.0.1:$(cat alice/port) \
- peer:bob:$bobmitm:127.0.0.1:$(cat bob/port) \
+ peer:alice:\?alice.mitm:127.0.0.1:$(cat alice/port) \
+ peer:bob:\?bob.mitm:127.0.0.1:$(cat bob/port) \
filt:drop:5 filt:send])&
read mitmpid &-
@@ -586,10 +600,10 @@ WITH_3TRIPES([alice], [bob], [carol], [-nslip -Tmx],
for p in $princs; do TRIPECTL -d$p RELOAD; done
AT_DATA([algs-alpha], [dnl
-kx-group=ec kx-group-order-bits=256 kx-group-elt-bits=512
+kx-group=curve25519 kx-group-order-bits=252 kx-group-elt-bits=255
hash=sha256 mgf=sha256-mgf hash-sz=32
bulk-transform=naclbox bulk-overhead=20
-cipher=salsa20 cipher-keysz=32
+cipher=chacha20 cipher-keysz=32
mac=poly1305 mac-tagsz=16
cipher-data-limit=2147483648
])
@@ -658,7 +672,7 @@ WITH_TRIPE(, [
## Run a simple service.
rm -f svc-test-running tripectl-status
COPROCESSES([svc], [
- echo SVCCLAIM test 1.0.0
+ echo "SVCCLAIM test 1.0.0"
read line
case "$line" in
OK)
@@ -668,19 +682,19 @@ WITH_TRIPE(, [
exit 1
;;
esac
- echo ok >svc-test-running
+ echo "ok" >svc-test-running
while read line; do
set -- $line
case "$[]1,$[]3,$[]4" in
SVCJOB,test,HELP)
- echo SVCINFO try not to use this service for anything useful
- echo SVCOK $[]2
+ echo "SVCINFO try not to use this service for anything useful"
+ echo "SVCOK $[]2"
;;
SVCJOB,test,GOOD)
- echo SVCOK $[]2
+ echo "SVCOK $[]2"
;;
SVCJOB,test,BAD)
- echo SVCFAIL $[]2 this-command-always-fails
+ echo "SVCFAIL $[]2 this-command-always-fails"
;;
SVCJOB,test,UGLY)
tag=$2
@@ -699,11 +713,11 @@ WITH_TRIPE(, [
firsttag=$[]2
;;
SVCJOB,test,SECOND)
- echo SVCOK $firsttag
- echo SVCOK $[]2
+ echo "SVCOK $firsttag"
+ echo "SVCOK $[]2"
;;
SVCJOB,*)
- echo SVCFAIL $[]2 unknown-svc-command $[]4
+ echo "SVCFAIL $[]2 unknown-svc-command $[]4"
;;
SVCCLAIM,*)
break
@@ -753,4 +767,87 @@ WITH_TRIPE(, [
AT_CLEANUP
+###--------------------------------------------------------------------------
+### Knock and bye.
+
+AT_SETUP([server knock])
+AT_KEYWORDS([knock])
+export TRIPE_SLIPIF=USLIP
+
+for i in alice bob; do (mkdir $i; cd $i; SETUPDIR([gamma])); done
+
+WITH_2TRIPES([alice], [bob], [-nslip], [-talice], [-tbob], [
+ WITH_MITM([alice], [=bob_from_alice], [bob], [=alice_from_bob], [
+
+ COPROCESSES([wait-knock], [
+ echo WATCH +n
+ while read line; do
+ set x $line; shift
+ echo >&2 ">>> $line"
+ case "$1:$2:$3" in
+ OK::) ;;
+ NOTE:KNOCK:bob) shift 3; echo "$*" >knock-addr; break ;;
+ NOTE:* | TRACE:* | WARN:*) ;;
+ *) exit 63 ;;
+ esac
+ done
+ ], [
+ TRIPECTL -dalice
+ ])& waiter=$!
+
+ AT_CHECK([TRIPECTL -dbob ADD -knock bob -ephemeral alice INET 127.0.0.1 $alice_from_bob])
+
+ wait $waiter; waitrc=$?
+ AT_CHECK([echo $waitrc],, [0[]nl])
+ AT_CHECK_UNQUOTED([cat knock-addr],, [INET 127.0.0.1 $bob_from_alice[]nl])
+
+ AWAIT_KXDONE([alice], [alice], [bob], [bob], [
+ AT_CHECK([TRIPECTL -dalice ADD -ephemeral bob INET 127.0.0.1 $bob_from_alice])
+ ])
+
+ COMMS_EPING([alice], [alice], [bob], [bob])
+ COMMS_SLIP([alice], [alice], [bob], [bob])
+ ])
+
+ WITH_MITM([alice], [=new_bob_from_alice], [bob], [$alice_from_bob], [
+ AWAIT_KXDONE([alice], [alice], [bob], [bob], [
+ AT_CHECK([TRIPECTL -dalice FORCEKX bob])
+ AT_CHECK([TRIPECTL -dbob FORCEKX alice])
+ ])
+
+ AT_CHECK([TRIPECTL -dbob KILL alice])
+ AT_CHECK([TRIPECTL -dalice LIST],, [])
+ ])
+])
+
+AT_CLEANUP
+
+###--------------------------------------------------------------------------
+### Key-exchange ad bulk crypto round trip.
+
+AT_SETUP([server roundtrip])
+AT_KEYWORDS([roundtrip])
+
+while read label genalg paramalg spec; do
+ paramopts=${spec%--*} attrs=${spec#*--}
+ key -kkeyring.$label add -a$paramalg -eforever $paramopts -tparam tripe-param $attrs
+ key -kkeyring.$label add -a$genalg -pparam -eforever -talice tripe
+ key -kkeyring.$label extract -f-secret keyring.$label-pub
+ { sh -c "echo $$"; date; } >msg
+ AT_CHECK([BULKTEST -kkeyring.$label -talice \
+ ies-encrypt 99 "$(cat msg)nl"], [0], [stdout], [stderr])
+ cp msg expout; mv stdout ct
+ AT_CHECK([BULKTEST -kkeyring.$label -talice \
+ ies-decrypt 99 "$(cat ct)"], [0], [expout], [stderr])
+done <