JGZYES
3e8a5442fa
TLS 1.3 PSK 会话恢复: NewSessionTicket 签发/解析、ticket+binder 校验、selected_identity 回选、恢复握手免证书(pazessl -sess_in/-sess_out 端到端验证); 构建脚本输出 bin/ 并支持独立命令与 psftp; 修复 SFTP 二进制传输与 copy_id -P; 补充 tests/ 调试与 verify_tls
81 行
2.8 KiB
C
81 行
2.8 KiB
C
/* verify_tls.c —— TLS 相关密码原语验证
|
|
* 测试 1: X25519 RFC 7748 固定向量
|
|
* 测试 2: X.509 ECDSA P-256 自签证书 (make_self_signed -> parse -> verify) */
|
|
#include "paze/curve25519.h"
|
|
#include "paze/x509.h"
|
|
#include "paze/ecdsa.h"
|
|
#include "paze/random.h"
|
|
#include "paze/error.h"
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
|
|
static int hex_byte(char c) {
|
|
if (c >= '0' && c <= '9') return c - '0';
|
|
if (c >= 'a' && c <= 'f') return c - 'a' + 10;
|
|
if (c >= 'A' && c <= 'F') return c - 'A' + 10;
|
|
return -1;
|
|
}
|
|
|
|
static int hex_decode(uint8_t *out, size_t outlen, const char *hex) {
|
|
size_t n = strlen(hex);
|
|
if (n != outlen * 2) return -1;
|
|
for (size_t i = 0; i < outlen; i++) {
|
|
int hi = hex_byte(hex[i * 2]);
|
|
int lo = hex_byte(hex[i * 2 + 1]);
|
|
if (hi < 0 || lo < 0) return -1;
|
|
out[i] = (uint8_t)((hi << 4) | lo);
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
/* RFC 7748 §5.2: X25519(Alice scalar, Bob u) == 共享密钥 */
|
|
static int test_x25519(void) {
|
|
uint8_t scalar[32], u[32], out[32];
|
|
if (hex_decode(scalar, 32,
|
|
"77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a") != 0) return -1;
|
|
if (hex_decode(u, 32,
|
|
"de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f") != 0) return -1;
|
|
if (paze_x25519(out, scalar, u) != PAZE_OK) return -1;
|
|
/* 期望共享密钥 */
|
|
static const uint8_t expect[32] = {
|
|
0x4a,0x5d,0x9d,0x5b,0xa4,0xce,0x2d,0xe1,0x72,0x8e,0x3b,0xf4,0x80,0x35,0x0f,0x25,
|
|
0xe0,0x7e,0x21,0xc9,0x47,0xd1,0x9e,0x33,0x76,0xf0,0x9b,0x3c,0x1e,0x16,0x17,0x42
|
|
};
|
|
return memcmp(out, expect, 32) == 0;
|
|
}
|
|
|
|
static int test_x509_ecdsa(void) {
|
|
uint8_t der[4096];
|
|
size_t derlen = sizeof(der);
|
|
paze_x509_signer_t signer;
|
|
memset(&signer, 0, sizeof(signer));
|
|
signer.kind = PAZE_X509_PK_ECDSA_P256;
|
|
paze_ecdsa_priv_t ec;
|
|
if (paze_ecdsa_gen(&ec) != PAZE_OK) return -10;
|
|
memcpy(signer.ecdsa_d, ec.d, 32);
|
|
|
|
if (paze_x509_make_self_signed(der, &derlen, &signer, "test.example",
|
|
1700000000LL, 1900000000LL) != PAZE_OK) return -11;
|
|
|
|
paze_x509_cert_t cert;
|
|
memset(&cert, 0, sizeof(cert));
|
|
if (paze_x509_parse_der(&cert, der, derlen) != PAZE_OK) return -12;
|
|
if (!paze_x509_is_self_signed(&cert)) return -13;
|
|
if (paze_x509_verify_signature(&cert, &cert) != PAZE_OK) return -14;
|
|
if (paze_x509_check_validity(&cert, 1750000000LL) != PAZE_OK) return -15;
|
|
if (!paze_x509_match_host(&cert, "test.example")) return -16;
|
|
return 0;
|
|
}
|
|
|
|
int main(void) {
|
|
int r;
|
|
r = test_x25519();
|
|
printf("[%s] X25519 RFC7748 vector\n", r == 0 ? "PASS" : "FAIL");
|
|
if (r != 0) return 1;
|
|
r = test_x509_ecdsa();
|
|
printf("[%s] X.509 ECDSA self-signed cert (rc=%d)\n", r == 0 ? "PASS" : "FAIL", r);
|
|
if (r != 0) return 1;
|
|
printf("all passed\n");
|
|
return 0;
|
|
}
|