234 lines
8.1 KiB
Go
234 lines
8.1 KiB
Go
package licensing
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/ed25519"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"errors"
|
|
"os"
|
|
"path/filepath"
|
|
"reflect"
|
|
"strings"
|
|
"testing"
|
|
|
|
"softbox.local/core/internal/canonicaljson"
|
|
)
|
|
|
|
type licenseVectorCorpus struct {
|
|
SchemaVersion int `json:"schema_version"`
|
|
PublicKeyBase64 string `json:"public_key_base64"`
|
|
Vectors []licenseVector `json:"vectors"`
|
|
}
|
|
|
|
type licenseVector struct {
|
|
Name string `json:"name"`
|
|
Document string `json:"document"`
|
|
SignedPayloadBase64 string `json:"signed_payload_base64"`
|
|
Signature string `json:"signature"`
|
|
ExpectedMachineHash string `json:"expected_machine_hash"`
|
|
ExpectedProducts []string `json:"expected_products"`
|
|
WantError string `json:"want_error"`
|
|
}
|
|
|
|
func TestVerifierStaticCorpus(t *testing.T) {
|
|
corpus := readLicenseVectorCorpus(t)
|
|
publicKey := corpusPublicKey(t, corpus)
|
|
verifier, err := NewVerifier(publicKey)
|
|
if err != nil {
|
|
t.Fatalf("NewVerifier() error = %v", err)
|
|
}
|
|
valid := corpusValidVector(t, corpus)
|
|
|
|
for _, vector := range corpus.Vectors {
|
|
vector := vector
|
|
t.Run(vector.Name, func(t *testing.T) {
|
|
license, err := verifier.Verify([]byte(vector.Document), valid.ExpectedMachineHash)
|
|
if vector.WantError != "" {
|
|
want := licenseVectorError(t, vector.WantError)
|
|
if !errors.Is(err, want) {
|
|
t.Fatalf("Verify() error = %v, want %v", err, want)
|
|
}
|
|
return
|
|
}
|
|
if err != nil {
|
|
t.Fatalf("Verify() error = %v", err)
|
|
}
|
|
if !reflect.DeepEqual(license.Products, vector.ExpectedProducts) {
|
|
t.Fatalf("Products = %q, want %q", license.Products, vector.ExpectedProducts)
|
|
}
|
|
if !license.AuthorizesProduct("product-json-parser") || license.AuthorizesProduct("other-product") {
|
|
t.Fatal("AuthorizesProduct() did not preserve the verified product set")
|
|
}
|
|
})
|
|
}
|
|
|
|
expectedPayload, err := base64.StdEncoding.DecodeString(valid.SignedPayloadBase64)
|
|
if err != nil {
|
|
t.Fatalf("decode signed payload: %v", err)
|
|
}
|
|
payload := canonicalLicensePayload(t, []byte(valid.Document))
|
|
if !bytes.Equal(payload, expectedPayload) {
|
|
t.Fatalf("canonical signing bytes = %q, want static corpus %q", payload, expectedPayload)
|
|
}
|
|
signature, err := base64.StdEncoding.DecodeString(valid.Signature)
|
|
if err != nil {
|
|
t.Fatalf("decode signature: %v", err)
|
|
}
|
|
if !ed25519.Verify(publicKey, expectedPayload, signature) {
|
|
t.Fatal("static public key does not verify static signing bytes")
|
|
}
|
|
}
|
|
|
|
func TestVerifierCanonicalWhitespaceAndKeyOrder(t *testing.T) {
|
|
corpus := readLicenseVectorCorpus(t)
|
|
publicKey := corpusPublicKey(t, corpus)
|
|
valid := corpusValidVector(t, corpus)
|
|
var wire licenseWire
|
|
if err := json.Unmarshal([]byte(valid.Document), &wire); err != nil {
|
|
t.Fatalf("decode static document: %v", err)
|
|
}
|
|
equivalent := ` { "update_policy" : "` + wire.UpdatePolicy + `", "signature" : "` + wire.Signature + `", "schema_version" : 1, "rebind_policy" : "` + wire.RebindPolicy + `", "products" : [ "` + wire.Products[0] + `", "` + wire.Products[1] + `" ], "perpetual" : true, "machine_hash" : "` + wire.MachineHash + `", "license_id" : "` + wire.LicenseID + `", "issued_at" : "` + wire.IssuedAt + `" } `
|
|
verifier, err := NewVerifier(publicKey)
|
|
if err != nil {
|
|
t.Fatalf("NewVerifier() error = %v", err)
|
|
}
|
|
license, err := verifier.Verify([]byte(equivalent), valid.ExpectedMachineHash)
|
|
if err != nil {
|
|
t.Fatalf("Verify(equivalent) error = %v", err)
|
|
}
|
|
if !reflect.DeepEqual(license.Products, valid.ExpectedProducts) {
|
|
t.Fatalf("equivalent products = %q", license.Products)
|
|
}
|
|
}
|
|
|
|
func TestVerifierFailsClosed(t *testing.T) {
|
|
corpus := readLicenseVectorCorpus(t)
|
|
publicKey := corpusPublicKey(t, corpus)
|
|
valid := corpusValidVector(t, corpus)
|
|
verifier, err := NewVerifier(publicKey)
|
|
if err != nil {
|
|
t.Fatalf("NewVerifier() error = %v", err)
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
document []byte
|
|
hash string
|
|
wantErr error
|
|
}{
|
|
{name: "wrong machine", document: []byte(valid.Document), hash: strings.Repeat("f", 64), wantErr: ErrMachineMismatch},
|
|
{name: "invalid expected hash", document: []byte(valid.Document), hash: strings.ToUpper(valid.ExpectedMachineHash), wantErr: ErrMachineHashInvalid},
|
|
{name: "tampered", document: bytes.Replace([]byte(valid.Document), []byte("toolkit"), []byte("toolkitz"), 1), hash: valid.ExpectedMachineHash, wantErr: ErrSignatureInvalid},
|
|
{name: "duplicate field", document: []byte(`{"schema_version":1,"schema_version":1,"signature":"x"}`), hash: valid.ExpectedMachineHash, wantErr: ErrDuplicateField},
|
|
{name: "fractional number", document: []byte(`{"schema_version":1.5,"signature":"x"}`), hash: valid.ExpectedMachineHash, wantErr: ErrUnsupportedNumber},
|
|
{name: "invalid signature encoding", document: []byte(strings.Replace(valid.Document, `=="`, `"`, 1)), hash: valid.ExpectedMachineHash, wantErr: ErrSignatureInvalid},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
_, err := verifier.Verify(test.document, test.hash)
|
|
if !errors.Is(err, test.wantErr) {
|
|
t.Fatalf("Verify() error = %v, want %v", err, test.wantErr)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestVerifierCopiesPublicKeyAndProducts(t *testing.T) {
|
|
corpus := readLicenseVectorCorpus(t)
|
|
publicKey := corpusPublicKey(t, corpus)
|
|
valid := corpusValidVector(t, corpus)
|
|
verifier, err := NewVerifier(publicKey)
|
|
if err != nil {
|
|
t.Fatalf("NewVerifier() error = %v", err)
|
|
}
|
|
publicKey[0] ^= 0xff
|
|
first, err := verifier.Verify([]byte(valid.Document), valid.ExpectedMachineHash)
|
|
if err != nil {
|
|
t.Fatalf("Verify(first) error = %v", err)
|
|
}
|
|
second, err := verifier.Verify([]byte(valid.Document), valid.ExpectedMachineHash)
|
|
if err != nil {
|
|
t.Fatalf("Verify(second) error = %v", err)
|
|
}
|
|
first.Products[0] = "changed"
|
|
if !second.AuthorizesProduct("product-json-parser") || second.AuthorizesProduct("changed") {
|
|
t.Fatal("Verify() returned products sharing mutable state")
|
|
}
|
|
if _, err := NewVerifier(make([]byte, ed25519.PublicKeySize-1)); !errors.Is(err, ErrPublicKeyInvalid) {
|
|
t.Fatalf("NewVerifier(short key) error = %v, want ErrPublicKeyInvalid", err)
|
|
}
|
|
var unconfigured Verifier
|
|
if _, err := unconfigured.Verify([]byte(valid.Document), valid.ExpectedMachineHash); !errors.Is(err, ErrPublicKeyInvalid) {
|
|
t.Fatalf("zero Verifier.Verify() error = %v, want ErrPublicKeyInvalid", err)
|
|
}
|
|
}
|
|
|
|
func readLicenseVectorCorpus(t *testing.T) licenseVectorCorpus {
|
|
t.Helper()
|
|
path := filepath.Join("..", "..", "testdata", "license", "license-v1-vectors.json")
|
|
data, err := os.ReadFile(path)
|
|
if err != nil {
|
|
t.Fatalf("read license vector corpus: %v", err)
|
|
}
|
|
var corpus licenseVectorCorpus
|
|
decoder := json.NewDecoder(bytes.NewReader(data))
|
|
decoder.DisallowUnknownFields()
|
|
if err := decoder.Decode(&corpus); err != nil {
|
|
t.Fatalf("decode license vector corpus: %v", err)
|
|
}
|
|
if corpus.SchemaVersion != 1 || len(corpus.Vectors) == 0 {
|
|
t.Fatal("license vector corpus is incomplete")
|
|
}
|
|
return corpus
|
|
}
|
|
|
|
func corpusPublicKey(t *testing.T, corpus licenseVectorCorpus) ed25519.PublicKey {
|
|
t.Helper()
|
|
publicKey, err := base64.StdEncoding.DecodeString(corpus.PublicKeyBase64)
|
|
if err != nil || len(publicKey) != ed25519.PublicKeySize {
|
|
t.Fatal("license vector corpus has an invalid public key")
|
|
}
|
|
return ed25519.PublicKey(publicKey)
|
|
}
|
|
|
|
func corpusValidVector(t *testing.T, corpus licenseVectorCorpus) licenseVector {
|
|
t.Helper()
|
|
for _, vector := range corpus.Vectors {
|
|
if vector.Name == "valid" {
|
|
return vector
|
|
}
|
|
}
|
|
t.Fatal("license vector corpus has no valid vector")
|
|
return licenseVector{}
|
|
}
|
|
|
|
func licenseVectorError(t *testing.T, value string) error {
|
|
t.Helper()
|
|
switch value {
|
|
case "invalid_license":
|
|
return ErrInvalidLicense
|
|
default:
|
|
t.Fatalf("unsupported license vector want_error %q", value)
|
|
return nil
|
|
}
|
|
}
|
|
|
|
func canonicalLicensePayload(t *testing.T, document []byte) []byte {
|
|
t.Helper()
|
|
value, err := canonicaljson.Parse(document)
|
|
if err != nil {
|
|
t.Fatalf("parse license document: %v", err)
|
|
}
|
|
root, ok := value.(map[string]any)
|
|
if !ok {
|
|
t.Fatal("license document root is not an object")
|
|
}
|
|
delete(root, "signature")
|
|
payload, err := canonicaljson.Marshal(root)
|
|
if err != nil {
|
|
t.Fatalf("canonicalize license document: %v", err)
|
|
}
|
|
return payload
|
|
}
|