196 lines
10 KiB
C#
196 lines
10 KiB
C#
using System.Buffers.Text;
|
|
using System.Security.Cryptography;
|
|
using System.Text;
|
|
using Fleet.Identity;
|
|
|
|
namespace Fleet.Tests;
|
|
|
|
/// <summary>软件 passkey：只做断言（navigator.credentials.get 的结果），用来测信任链。</summary>
|
|
internal sealed class TestAuthenticator : IDisposable
|
|
{
|
|
public const string RpId = "panel.example.com";
|
|
public const string Origin = "https://panel.example.com";
|
|
|
|
private readonly ECDsa _key = ECDsa.Create(ECCurve.NamedCurves.nistP256);
|
|
private uint _counter;
|
|
|
|
public string CredentialId { get; } = Base64Url.EncodeToString(RandomNumberGenerator.GetBytes(32));
|
|
|
|
public OperatorKey Key => new(CredentialId, _key.ExportSubjectPublicKeyInfo());
|
|
|
|
public SignedStatement Sign(string statement, byte flags = 0x05, string origin = Origin)
|
|
{
|
|
byte[] challenge = SHA256.HashData(Encoding.UTF8.GetBytes(statement));
|
|
_counter++;
|
|
byte[] authData = [.. SHA256.HashData(Encoding.UTF8.GetBytes(RpId)), flags, (byte)(_counter >> 24), (byte)(_counter >> 16), (byte)(_counter >> 8), (byte)_counter];
|
|
byte[] clientData = Encoding.UTF8.GetBytes($"{{\"type\":\"webauthn.get\",\"challenge\":\"{Base64Url.EncodeToString(challenge)}\",\"origin\":\"{origin}\",\"crossOrigin\":false}}");
|
|
byte[] signature = _key.SignData([.. authData, .. SHA256.HashData(clientData)], HashAlgorithmName.SHA256, DSASignatureFormat.Rfc3279DerSequence);
|
|
return new SignedStatement(statement, CredentialId, Base64Url.EncodeToString(authData), Base64Url.EncodeToString(clientData), Base64Url.EncodeToString(signature));
|
|
}
|
|
|
|
public void Dispose() => _key.Dispose();
|
|
}
|
|
|
|
public sealed class OperatorTrustTests : IDisposable
|
|
{
|
|
private readonly TestAuthenticator _alice = new();
|
|
private readonly TestAuthenticator _bob = new();
|
|
|
|
public void Dispose()
|
|
{
|
|
_alice.Dispose();
|
|
_bob.Dispose();
|
|
}
|
|
|
|
private OperatorSet Genesis(params TestAuthenticator[] keys) =>
|
|
new(1, OperatorTrust.Genesis, TestAuthenticator.RpId, [TestAuthenticator.Origin], [.. keys.Select(k => k.Key)]);
|
|
|
|
private SignedStatement SignedGenesis(OperatorSet set, TestAuthenticator signer) => signer.Sign(OperatorTrust.Encode(set));
|
|
|
|
[Fact]
|
|
public void TheGenesis_IsPinnedByItsFingerprint_AndMustBeSelfSigned()
|
|
{
|
|
OperatorSet set = Genesis(_alice);
|
|
SignedStatement genesis = SignedGenesis(set, _alice);
|
|
string pin = OperatorTrust.Fingerprint(genesis.Statement);
|
|
|
|
Assert.NotNull(OperatorTrust.VerifyChain(pin, [genesis]));
|
|
Assert.Null(OperatorTrust.VerifyChain(new string('0', 64), [genesis])); // 指纹对不上：Backend 换了一份创世
|
|
Assert.Null(OperatorTrust.VerifyChain(pin, [SignedGenesis(set, _bob)])); // 不是集合里的凭证签的（也改不了指纹）
|
|
Assert.Null(OperatorTrust.VerifyChain(pin, []));
|
|
}
|
|
|
|
[Fact]
|
|
public void ABackendThatSwapsTheKeys_CannotMakeAChainTheNodeAccepts()
|
|
{
|
|
SignedStatement real = SignedGenesis(Genesis(_alice), _alice);
|
|
string pin = OperatorTrust.Fingerprint(real.Statement);
|
|
|
|
using var attacker = new TestAuthenticator();
|
|
SignedStatement forged = SignedGenesis(Genesis(attacker), attacker); // 自洽的假创世，但指纹不同
|
|
Assert.Null(OperatorTrust.VerifyChain(pin, [forged]));
|
|
|
|
// 在真创世后面接一个攻击者签的更新：上一版里没有他的凭证
|
|
var update = new OperatorSet(2, OperatorTrust.Fingerprint(real.Statement), TestAuthenticator.RpId, [TestAuthenticator.Origin], [_alice.Key, attacker.Key]);
|
|
Assert.Null(OperatorTrust.VerifyChain(pin, [real, attacker.Sign(OperatorTrust.Encode(update))]));
|
|
}
|
|
|
|
[Fact]
|
|
public void AnUpdate_NeedsAKeyOfThePreviousVersion_AndFollowsTheChain()
|
|
{
|
|
SignedStatement genesis = SignedGenesis(Genesis(_alice), _alice);
|
|
string pin = OperatorTrust.Fingerprint(genesis.Statement);
|
|
var second = new OperatorSet(2, OperatorTrust.Fingerprint(genesis.Statement), TestAuthenticator.RpId, [TestAuthenticator.Origin], [_alice.Key, _bob.Key]);
|
|
SignedStatement signedSecond = _alice.Sign(OperatorTrust.Encode(second));
|
|
|
|
OperatorSet? current = OperatorTrust.VerifyChain(pin, [genesis, signedSecond]);
|
|
Assert.Equal(2, current?.Version);
|
|
Assert.Equal(2, current?.Keys.Count);
|
|
|
|
// 新加的 bob 可以签下一版（上一版里有他）
|
|
var third = new OperatorSet(3, OperatorTrust.Fingerprint(signedSecond.Statement), TestAuthenticator.RpId, [TestAuthenticator.Origin], [_bob.Key]);
|
|
Assert.Equal(3, OperatorTrust.VerifyChain(pin, [genesis, signedSecond, _bob.Sign(OperatorTrust.Encode(third))])?.Version);
|
|
|
|
// 版本号跳了、prev 不对、域名换了：都不行
|
|
var skipped = second with { Version = 3 };
|
|
Assert.Null(OperatorTrust.VerifyChain(pin, [genesis, _alice.Sign(OperatorTrust.Encode(skipped))]));
|
|
var wrongPrev = second with { Previous = new string('a', 64) };
|
|
Assert.Null(OperatorTrust.VerifyChain(pin, [genesis, _alice.Sign(OperatorTrust.Encode(wrongPrev))]));
|
|
var otherRp = second with { RpId = "evil.example" };
|
|
Assert.Null(OperatorTrust.VerifyChain(pin, [genesis, _alice.Sign(OperatorTrust.Encode(otherRp))]));
|
|
}
|
|
|
|
[Fact]
|
|
public void AnAssertion_NeedsUserVerification_TheRightOrigin_AndTheExactStatement()
|
|
{
|
|
OperatorSet set = Genesis(_alice);
|
|
Assert.True(OperatorTrust.VerifyOperator(_alice.Sign("hello"), set));
|
|
Assert.False(OperatorTrust.VerifyOperator(_alice.Sign("hello", flags: 0x01), set)); // 没有用户验证
|
|
Assert.False(OperatorTrust.VerifyOperator(_alice.Sign("hello", origin: "https://evil.example"), set));
|
|
Assert.False(OperatorTrust.VerifyOperator(_alice.Sign("hello") with { Statement = "hellO" }, set)); // 语句被改
|
|
Assert.False(OperatorTrust.VerifyOperator(_bob.Sign("hello"), set)); // 不在集合里
|
|
}
|
|
|
|
private sealed record Enrolled(OperatorSet Set, byte[] Seed, MemberProof Proof, byte[] NodeKey, byte[] PeerKey, string Auth);
|
|
|
|
private Enrolled Enroll(string role = "probe", long now = 1_000_000, long notBefore = 0, long notAfter = 2_000_000, TestAuthenticator? signer = null)
|
|
{
|
|
OperatorSet set = Genesis(_alice);
|
|
using ECDsa code = ECDsa.Create(ECCurve.NamedCurves.nistP256);
|
|
byte[] seed = code.ExportParameters(true).D!;
|
|
string auth = OperatorTrust.AuthToken(seed);
|
|
var grant = new Grant(role, OperatorTrust.AuthHash(auth), code.ExportSubjectPublicKeyInfo(), notBefore, notAfter, 1);
|
|
SignedStatement signedGrant = (signer ?? _alice).Sign(OperatorTrust.Encode(grant));
|
|
|
|
byte[] nodeKey = RandomNumberGenerator.GetBytes(91);
|
|
byte[] peerKey = RandomNumberGenerator.GetBytes(91);
|
|
using ECDsa? signing = OperatorTrust.CodeSigningKey(seed, grant.CodeKey);
|
|
Assert.NotNull(signing);
|
|
string signature = OperatorTrust.SignBinding(signing, new Binding("tokyo", role, nodeKey, peerKey, grant.AuthHash, now), out string statement);
|
|
return new Enrolled(set, seed, new MemberProof(signedGrant, statement, signature), nodeKey, peerKey, auth);
|
|
}
|
|
|
|
[Fact]
|
|
public void AMember_VerifiesThroughTheWholeChain()
|
|
{
|
|
Enrolled e = Enroll();
|
|
Assert.Equal(TrustFailure.None, OperatorTrust.VerifyMember(e.Set, e.Proof, e.NodeKey, e.PeerKey, "probe"));
|
|
}
|
|
|
|
[Fact]
|
|
public void TheSeed_IsNotRecoverableFromWhatTheBackendSees()
|
|
{
|
|
Enrolled e = Enroll();
|
|
Assert.StartsWith("ja_", e.Auth, StringComparison.Ordinal);
|
|
Assert.DoesNotContain(Base64Url.EncodeToString(e.Seed), e.Auth, StringComparison.Ordinal);
|
|
Assert.DoesNotContain(Base64Url.EncodeToString(e.Seed), e.Proof.Grant.Statement + e.Proof.BindingStatement, StringComparison.Ordinal);
|
|
Assert.Equal(e.Auth, OperatorTrust.AuthToken(e.Seed)); // 节点自己能算出同一个
|
|
}
|
|
|
|
[Fact]
|
|
public void ABindingForOtherKeys_AnotherRole_OrAnExpiredGrant_IsRefused()
|
|
{
|
|
Enrolled e = Enroll();
|
|
Assert.Equal(TrustFailure.KeyMismatch, OperatorTrust.VerifyMember(e.Set, e.Proof, RandomNumberGenerator.GetBytes(91), e.PeerKey, "probe")); // Backend 想把别的节点密钥挂在这个绑定上
|
|
Assert.Equal(TrustFailure.KeyMismatch, OperatorTrust.VerifyMember(e.Set, e.Proof, e.NodeKey, RandomNumberGenerator.GetBytes(91), "probe"));
|
|
Assert.Equal(TrustFailure.RoleMismatch, OperatorTrust.VerifyMember(e.Set, e.Proof, e.NodeKey, e.PeerKey, "agent")); // 一个 Probe 的绑定不能冒充 Agent
|
|
|
|
Enrolled late = Enroll(now: 3_000_000, notAfter: 2_000_000); // 有效期之后才签的绑定
|
|
Assert.Equal(TrustFailure.GrantExpired, OperatorTrust.VerifyMember(late.Set, late.Proof, late.NodeKey, late.PeerKey, "probe"));
|
|
}
|
|
|
|
[Fact]
|
|
public void AGrantNotSignedByTheOperator_OrABindingNotSignedByTheCodeKey_IsRefused()
|
|
{
|
|
using var stranger = new TestAuthenticator();
|
|
Enrolled forged = Enroll(signer: stranger);
|
|
Assert.Equal(TrustFailure.GrantNotSigned, OperatorTrust.VerifyMember(forged.Set, forged.Proof, forged.NodeKey, forged.PeerKey, "probe"));
|
|
|
|
// Backend 拿到了委托但没有种子：用自己的密钥签绑定
|
|
Enrolled e = Enroll();
|
|
using ECDsa backend = ECDsa.Create(ECCurve.NamedCurves.nistP256);
|
|
Binding stolen = OperatorTrust.ParseBinding(e.Proof.BindingStatement)!;
|
|
string bogus = OperatorTrust.SignBinding(backend, stolen, out string statement);
|
|
Assert.Equal(TrustFailure.BindingInvalid, OperatorTrust.VerifyMember(e.Set, new MemberProof(e.Proof.Grant, statement, bogus), e.NodeKey, e.PeerKey, "probe"));
|
|
}
|
|
|
|
[Fact]
|
|
public void RemovingAnOperatorKey_InvalidatesTheGrantsItSigned()
|
|
{
|
|
Enrolled e = Enroll();
|
|
OperatorSet withoutAlice = Genesis(_bob) with { Version = 2, Previous = new string('a', 64) };
|
|
Assert.Equal(TrustFailure.GrantNotSigned, OperatorTrust.VerifyMember(withoutAlice, e.Proof, e.NodeKey, e.PeerKey, "probe"));
|
|
}
|
|
|
|
[Fact]
|
|
public void Parsing_IsStrict()
|
|
{
|
|
Assert.Null(OperatorTrust.ParseGrant("moshiro-grant-v1\nrole=probe"));
|
|
Assert.Null(OperatorTrust.ParseBinding("moshiro-binding-v1\nname=x"));
|
|
Assert.Null(OperatorTrust.ParseSet("moshiro-opset-v2\nversion=1"));
|
|
OperatorSet set = Genesis(_alice);
|
|
Assert.Equal(set.Keys[0].CredentialId, OperatorTrust.ParseSet(OperatorTrust.Encode(set))!.Keys[0].CredentialId);
|
|
Assert.Null(OperatorTrust.ParseSet(OperatorTrust.Encode(set with { Previous = "abc" }))); // 创世的 prev 必须是 0
|
|
}
|
|
}
|