blob: ded88258ffc1266e0bc2672eae96f10109d3665b [file] [log] [blame]
Eric Newberry1caa6342020-08-23 19:29:08 -07001/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
2/*
Davide Pesavento47ce2ee2023-05-09 01:33:33 -04003 * Copyright (c) 2013-2023 Regents of the University of California.
Eric Newberry1caa6342020-08-23 19:29:08 -07004 *
5 * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
6 *
7 * ndn-cxx library is free software: you can redistribute it and/or modify it under the
8 * terms of the GNU Lesser General Public License as published by the Free Software
9 * Foundation, either version 3 of the License, or (at your option) any later version.
10 *
11 * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
12 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
13 * PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.
14 *
15 * You should have received copies of the GNU General Public License and GNU Lesser
16 * General Public License along with ndn-cxx, e.g., in COPYING.md file. If not, see
17 * <http://www.gnu.org/licenses/>.
18 *
19 * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
20 */
21
22#include "ndn-cxx/security/validation-policy-signed-interest.hpp"
Davide Pesavento4c1ad4c2020-11-16 21:12:02 -050023
Eric Newberry1caa6342020-08-23 19:29:08 -070024#include "ndn-cxx/security/interest-signer.hpp"
Eric Newberry1caa6342020-08-23 19:29:08 -070025#include "ndn-cxx/security/validation-policy-accept-all.hpp"
26#include "ndn-cxx/security/validation-policy-simple-hierarchy.hpp"
27
Davide Pesavento4c1ad4c2020-11-16 21:12:02 -050028#include "tests/test-common.hpp"
Eric Newberry1caa6342020-08-23 19:29:08 -070029#include "tests/unit/security/validator-fixture.hpp"
30
Eric Newberry1caa6342020-08-23 19:29:08 -070031#include <boost/mpl/vector.hpp>
32
Davide Pesavento47ce2ee2023-05-09 01:33:33 -040033namespace ndn::tests {
Eric Newberry1caa6342020-08-23 19:29:08 -070034
Davide Pesavento47ce2ee2023-05-09 01:33:33 -040035using namespace ndn::security;
Eric Newberry1caa6342020-08-23 19:29:08 -070036
37BOOST_AUTO_TEST_SUITE(Security)
38
Davide Pesavento2acce252022-09-08 22:03:03 -040039struct SignedInterestDefaultOptions
Eric Newberry1caa6342020-08-23 19:29:08 -070040{
Eric Newberry1caa6342020-08-23 19:29:08 -070041 static ValidationPolicySignedInterest::Options
42 getOptions()
43 {
44 return {};
45 }
46};
47
48template<class T, class InnerPolicy>
49class SignedInterestPolicyWrapper : public ValidationPolicySignedInterest
50{
51public:
52 SignedInterestPolicyWrapper()
53 : ValidationPolicySignedInterest(make_unique<InnerPolicy>(), T::getOptions())
54 {
55 }
56};
57
58template<class T, class InnerPolicy = ValidationPolicySimpleHierarchy>
59class ValidationPolicySignedInterestFixture
60 : public HierarchicalValidatorFixture<SignedInterestPolicyWrapper<T, InnerPolicy>>
61{
Davide Pesavento2acce252022-09-08 22:03:03 -040062protected:
Eric Newberry1caa6342020-08-23 19:29:08 -070063 Interest
64 makeSignedInterest(const Identity& identity,
65 uint32_t signingFlags = InterestSigner::WantNonce | InterestSigner::WantTime)
66 {
67 Interest i(Name(identity.getName()).append("CMD"));
Eric Newberry1caa6342020-08-23 19:29:08 -070068 m_signer.makeSignedInterest(i, signingByIdentity(identity), signingFlags);
69 return i;
70 }
71
Davide Pesavento2acce252022-09-08 22:03:03 -040072protected:
73 InterestSigner m_signer{this->m_keyChain};
Eric Newberry1caa6342020-08-23 19:29:08 -070074
75 static constexpr uint32_t WantAll = InterestSigner::WantNonce |
76 InterestSigner::WantTime |
77 InterestSigner::WantSeqNum;
78};
79
80BOOST_FIXTURE_TEST_SUITE(TestValidationPolicySignedInterest,
81 ValidationPolicySignedInterestFixture<SignedInterestDefaultOptions>)
82
Davide Pesavento2acce252022-09-08 22:03:03 -040083BOOST_AUTO_TEST_CASE(Basic)
Eric Newberry1caa6342020-08-23 19:29:08 -070084{
85 auto i1 = makeSignedInterest(identity, WantAll);
86 VALIDATE_SUCCESS(i1, "Should succeed (within grace period)");
87 VALIDATE_FAILURE(i1, "Should fail (replay attack)");
Davide Pesavento2acce252022-09-08 22:03:03 -040088 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -070089
90 advanceClocks(5_ms);
91 auto i2 = makeSignedInterest(identity, WantAll);
92 VALIDATE_SUCCESS(i2, "Should succeed (timestamp and sequence number larger than previous)");
93
94 Interest i3(Name(identity.getName()).append("CMD"));
Eric Newberry1caa6342020-08-23 19:29:08 -070095 m_signer.makeSignedInterest(i3, signingWithSha256());
96 VALIDATE_FAILURE(i3, "Should fail (Sha256 signature violates policy)");
Davide Pesavento2acce252022-09-08 22:03:03 -040097 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -070098}
99
100BOOST_AUTO_TEST_CASE(DataPassthrough)
101{
102 Data d1("/Security/ValidatorFixture/Sub1");
103 m_keyChain.sign(d1);
104 VALIDATE_SUCCESS(d1, "Should succeed (fallback on inner validation policy for data)");
105}
106
107BOOST_AUTO_TEST_CASE(InnerPolicyReject)
108{
109 auto i1 = makeSignedInterest(otherIdentity);
110 VALIDATE_FAILURE(i1, "Should fail (inner policy should reject)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400111 BOOST_TEST(lastError.getCode() == ValidationError::LOOP_DETECTED);
Eric Newberry1caa6342020-08-23 19:29:08 -0700112}
113
Davide Pesavento2acce252022-09-08 22:03:03 -0400114template<ssize_t count>
115struct MaxRecordCount
Eric Newberry1caa6342020-08-23 19:29:08 -0700116{
Eric Newberry1caa6342020-08-23 19:29:08 -0700117 static ValidationPolicySignedInterest::Options
118 getOptions()
119 {
120 ValidationPolicySignedInterest::Options options;
121 options.timestampGracePeriod = 15_s;
Davide Pesavento2acce252022-09-08 22:03:03 -0400122 options.maxRecordCount = count;
Eric Newberry1caa6342020-08-23 19:29:08 -0700123 return options;
124 }
125};
126
Davide Pesavento2acce252022-09-08 22:03:03 -0400127BOOST_FIXTURE_TEST_CASE(LimitedRecords, ValidationPolicySignedInterestFixture<MaxRecordCount<3>>)
Eric Newberry1caa6342020-08-23 19:29:08 -0700128{
129 Identity id1 = addSubCertificate("/Security/ValidatorFixture/Sub1", identity);
130 cache.insert(id1.getDefaultKey().getDefaultCertificate());
131 Identity id2 = addSubCertificate("/Security/ValidatorFixture/Sub2", identity);
132 cache.insert(id2.getDefaultKey().getDefaultCertificate());
133 Identity id3 = addSubCertificate("/Security/ValidatorFixture/Sub3", identity);
134 cache.insert(id3.getDefaultKey().getDefaultCertificate());
135 Identity id4 = addSubCertificate("/Security/ValidatorFixture/Sub4", identity);
136 cache.insert(id4.getDefaultKey().getDefaultCertificate());
137
138 auto i1 = makeSignedInterest(id2);
139 auto i2 = makeSignedInterest(id3);
140 auto i3 = makeSignedInterest(id4);
141 auto i00 = makeSignedInterest(id1); // signed at 0s
142 advanceClocks(1_s);
143 auto i01 = makeSignedInterest(id1); // signed at 1s
144 advanceClocks(1_s);
145 auto i02 = makeSignedInterest(id1); // signed at 2s
146
147 VALIDATE_SUCCESS(i00, "Should succeed");
148 rewindClockAfterValidation();
149
150 VALIDATE_SUCCESS(i02, "Should succeed");
151 rewindClockAfterValidation();
152
153 VALIDATE_SUCCESS(i1, "Should succeed");
154 rewindClockAfterValidation();
155
156 VALIDATE_SUCCESS(i2, "Should succeed");
157 rewindClockAfterValidation();
158
159 VALIDATE_SUCCESS(i3, "Should succeed, forgets identity id1");
160 rewindClockAfterValidation();
161
162 VALIDATE_SUCCESS(i01, "Should succeed despite timestamp is reordered, because record has been evicted");
163}
164
Davide Pesavento2acce252022-09-08 22:03:03 -0400165BOOST_FIXTURE_TEST_CASE(UnlimitedRecords, ValidationPolicySignedInterestFixture<MaxRecordCount<-1>>)
Eric Newberry1caa6342020-08-23 19:29:08 -0700166{
167 std::vector<Identity> identities;
Davide Pesavento4c1ad4c2020-11-16 21:12:02 -0500168 for (size_t i = 0; i < 20; ++i) {
Eric Newberry1caa6342020-08-23 19:29:08 -0700169 Identity id = addSubCertificate("/Security/ValidatorFixture/Sub" + to_string(i), identity);
170 cache.insert(id.getDefaultKey().getDefaultCertificate());
171 identities.push_back(id);
172 }
173
174 auto i1 = makeSignedInterest(identities.at(0)); // signed at 0s
175 advanceClocks(1_s);
Davide Pesavento4c1ad4c2020-11-16 21:12:02 -0500176 for (size_t i = 0; i < 20; ++i) {
Eric Newberry1caa6342020-08-23 19:29:08 -0700177 auto i2 = makeSignedInterest(identities.at(i)); // signed at +1s
Eric Newberry1caa6342020-08-23 19:29:08 -0700178 VALIDATE_SUCCESS(i2, "Should succeed");
179 rewindClockAfterValidation();
180 }
Davide Pesavento2acce252022-09-08 22:03:03 -0400181
Eric Newberry1caa6342020-08-23 19:29:08 -0700182 VALIDATE_FAILURE(i1, "Should fail (timestamp reorder)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400183 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700184}
185
Davide Pesavento2acce252022-09-08 22:03:03 -0400186BOOST_FIXTURE_TEST_CASE(ZeroRecords, ValidationPolicySignedInterestFixture<MaxRecordCount<0>>)
Eric Newberry1caa6342020-08-23 19:29:08 -0700187{
188 auto i1 = makeSignedInterest(identity); // signed at 0s
189 advanceClocks(1_s);
190 auto i2 = makeSignedInterest(identity); // signed at +1s
191 VALIDATE_SUCCESS(i2, "Should succeed");
192 rewindClockAfterValidation();
193
194 VALIDATE_SUCCESS(i1, "Should succeed despite timestamp reordering, as records aren't kept");
195}
196
197BOOST_AUTO_TEST_SUITE(TimestampValidation)
198
199BOOST_AUTO_TEST_CASE(MissingTimestamp)
200{
201 auto i1 = makeSignedInterest(identity, InterestSigner::WantSeqNum);
202 VALIDATE_FAILURE(i1, "Should fail (timestamp missing)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400203 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700204}
205
Davide Pesavento2acce252022-09-08 22:03:03 -0400206struct DisabledTimestampValidationOptions
Eric Newberry1caa6342020-08-23 19:29:08 -0700207{
Eric Newberry1caa6342020-08-23 19:29:08 -0700208 static ValidationPolicySignedInterest::Options
209 getOptions()
210 {
211 ValidationPolicySignedInterest::Options options;
212 options.shouldValidateTimestamps = false;
213 return options;
214 }
215};
216
217BOOST_FIXTURE_TEST_CASE(Disabled,
218 ValidationPolicySignedInterestFixture<DisabledTimestampValidationOptions>)
219{
220 auto i1 = makeSignedInterest(identity); // signed at 0ms
221 advanceClocks(100_ms);
222 VALIDATE_SUCCESS(i1, "Should succeed");
223
224 auto i2 = makeSignedInterest(identity); // signed at +100ms
225 // Set i2 to have same timestamp as i1
226 auto si2 = i2.getSignatureInfo();
227 si2->setTime(i2.getSignatureInfo()->getTime());
228 i2.setSignatureInfo(*si2);
229 VALIDATE_SUCCESS(i2, "Should succeed");
230}
231
Davide Pesavento2acce252022-09-08 22:03:03 -0400232template<int secs>
233struct GracePeriodSeconds
Eric Newberry1caa6342020-08-23 19:29:08 -0700234{
Eric Newberry1caa6342020-08-23 19:29:08 -0700235 static ValidationPolicySignedInterest::Options
236 getOptions()
237 {
238 ValidationPolicySignedInterest::Options options;
Davide Pesavento2acce252022-09-08 22:03:03 -0400239 options.timestampGracePeriod = time::seconds(secs);
Eric Newberry1caa6342020-08-23 19:29:08 -0700240 return options;
241 }
242};
243
Davide Pesavento2acce252022-09-08 22:03:03 -0400244BOOST_FIXTURE_TEST_CASE(TimestampTooOld, ValidationPolicySignedInterestFixture<GracePeriodSeconds<15>>)
Eric Newberry1caa6342020-08-23 19:29:08 -0700245{
246 auto i1 = makeSignedInterest(identity); // signed at 0s
247 advanceClocks(16_s); // verifying at +16s
248 VALIDATE_FAILURE(i1, "Should fail (timestamp outside the grace period)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400249 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700250 rewindClockAfterValidation();
251
252 auto i2 = makeSignedInterest(identity); // signed at +16s
253 VALIDATE_SUCCESS(i2, "Should succeed");
254}
255
Davide Pesavento2acce252022-09-08 22:03:03 -0400256BOOST_FIXTURE_TEST_CASE(TimestampTooNew, ValidationPolicySignedInterestFixture<GracePeriodSeconds<15>>)
Eric Newberry1caa6342020-08-23 19:29:08 -0700257{
258 auto i1 = makeSignedInterest(identity); // signed at 0s
259 advanceClocks(1_s);
260 auto i2 = makeSignedInterest(identity); // signed at +1s
261 advanceClocks(1_s);
262 auto i3 = makeSignedInterest(identity); // signed at +2s
263
Davide Pesavento4c1ad4c2020-11-16 21:12:02 -0500264 m_systemClock->advance(-18_s); // verifying at -16s
Eric Newberry1caa6342020-08-23 19:29:08 -0700265 VALIDATE_FAILURE(i1, "Should fail (timestamp outside the grace period)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400266 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700267 rewindClockAfterValidation();
268
269 // SignedInterestValidator should not remember i1's timestamp
270 VALIDATE_FAILURE(i2, "Should fail (timestamp outside the grace period)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400271 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700272 rewindClockAfterValidation();
273
274 // SignedInterestValidator should not remember i2's timestamp, and should treat i3 as initial
275 advanceClocks(18_s); // verifying at +2s
276 VALIDATE_SUCCESS(i3, "Should succeed");
277}
278
279BOOST_AUTO_TEST_CASE(TimestampReorderEqual)
280{
281 auto i1 = makeSignedInterest(identity); // signed at 0s
282 VALIDATE_SUCCESS(i1, "Should succeed");
283
284 auto i2 = makeSignedInterest(identity); // signed at 0s
285 auto si2 = i2.getSignatureInfo();
286 si2->setTime(i1.getSignatureInfo()->getTime());
287 i2.setSignatureInfo(*si2);
288 VALIDATE_FAILURE(i2, "Should fail (timestamp reordered)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400289 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700290
291 advanceClocks(2_s);
292 auto i3 = makeSignedInterest(identity); // signed at +2s
293 VALIDATE_SUCCESS(i3, "Should succeed");
294}
295
296BOOST_AUTO_TEST_CASE(TimestampReorderNegative)
297{
298 auto i2 = makeSignedInterest(identity); // signed at 0ms
299 advanceClocks(200_ms);
300 auto i3 = makeSignedInterest(identity); // signed at +200ms
301 advanceClocks(900_ms);
302 auto i1 = makeSignedInterest(identity); // signed at +1100ms
303 advanceClocks(300_ms);
304 auto i4 = makeSignedInterest(identity); // signed at +1400ms
305
Davide Pesavento4c1ad4c2020-11-16 21:12:02 -0500306 m_systemClock->advance(-300_ms); // verifying at +1100ms
Eric Newberry1caa6342020-08-23 19:29:08 -0700307 VALIDATE_SUCCESS(i1, "Should succeed");
308 rewindClockAfterValidation();
309
Davide Pesavento4c1ad4c2020-11-16 21:12:02 -0500310 m_systemClock->advance(-1100_ms); // verifying at 0ms
Eric Newberry1caa6342020-08-23 19:29:08 -0700311 VALIDATE_FAILURE(i2, "Should fail (timestamp reordered)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400312 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700313 rewindClockAfterValidation();
314
315 // SignedInterestValidator should not remember i2's timestamp
316 advanceClocks(200_ms); // verifying at +200ms
317 VALIDATE_FAILURE(i3, "Should fail (timestamp reordered)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400318 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700319 rewindClockAfterValidation();
320
321 advanceClocks(1200_ms); // verifying at 1400ms
322 VALIDATE_SUCCESS(i4, "Should succeed");
323}
324
Davide Pesavento2acce252022-09-08 22:03:03 -0400325using NonPositiveGracePeriods = boost::mpl::vector<
326 GracePeriodSeconds<0>,
327 GracePeriodSeconds<-1>
328>;
Eric Newberry1caa6342020-08-23 19:29:08 -0700329
Davide Pesavento2acce252022-09-08 22:03:03 -0400330BOOST_FIXTURE_TEST_CASE_TEMPLATE(GraceNonPositive, GracePeriod, NonPositiveGracePeriods,
Eric Newberry1caa6342020-08-23 19:29:08 -0700331 ValidationPolicySignedInterestFixture<GracePeriod>)
332{
333 auto i1 = this->makeSignedInterest(this->identity); // signed at 0ms
334 auto i2 = this->makeSignedInterest(this->subIdentity); // signed at 0ms
335 // ensure timestamps are exactly 0ms
336 for (auto interest : {&i1, &i2}) {
337 auto si = interest->getSignatureInfo();
338 si->setTime(time::system_clock::now());
339 interest->setSignatureInfo(*si);
340 }
341
342 VALIDATE_SUCCESS(i1, "Should succeed when validating at 0ms");
343 this->rewindClockAfterValidation();
344
345 this->advanceClocks(1_ms);
346 VALIDATE_FAILURE(i2, "Should fail when validating at 1ms");
Davide Pesavento2acce252022-09-08 22:03:03 -0400347 BOOST_TEST(this->lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700348}
349
350BOOST_AUTO_TEST_SUITE_END() // TimestampValidation
351
352BOOST_AUTO_TEST_SUITE(SeqNumValidation)
353
354// By default, sequence number validation is disabled
355BOOST_AUTO_TEST_CASE(Disabled)
356{
357 auto i1 = makeSignedInterest(identity, WantAll); // signed at 0ms
358 VALIDATE_SUCCESS(i1, "Should succeed");
359
360 auto i2 = makeSignedInterest(identity, WantAll); // signed at +100ms
361 // Set i2 to have same seq num as i1
362 auto si2 = i2.getSignatureInfo();
363 si2->setSeqNum(i2.getSignatureInfo()->getSeqNum());
364 i2.setSignatureInfo(*si2);
365 VALIDATE_SUCCESS(i2, "Should succeed");
366}
367
Davide Pesavento2acce252022-09-08 22:03:03 -0400368struct SeqNumValidationOptions
Eric Newberry1caa6342020-08-23 19:29:08 -0700369{
Eric Newberry1caa6342020-08-23 19:29:08 -0700370 static ValidationPolicySignedInterest::Options
371 getOptions()
372 {
373 ValidationPolicySignedInterest::Options options;
374 options.shouldValidateSeqNums = true;
375 return options;
376 }
377};
378
379BOOST_FIXTURE_TEST_CASE(MissingSeqNum,
380 ValidationPolicySignedInterestFixture<SeqNumValidationOptions>)
381{
382 auto i1 = makeSignedInterest(identity, InterestSigner::WantTime);
383 VALIDATE_FAILURE(i1, "Should fail (sequence number missing");
Davide Pesavento2acce252022-09-08 22:03:03 -0400384 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700385}
386
387BOOST_FIXTURE_TEST_CASE(SeqNumReorder,
388 ValidationPolicySignedInterestFixture<SeqNumValidationOptions>)
389{
390 auto i1 = makeSignedInterest(identity, WantAll); // seq num is i
391 VALIDATE_SUCCESS(i1, "Should succeed");
392
393 auto i2 = makeSignedInterest(identity, WantAll); // seq num is i+1
394 auto si2 = i2.getSignatureInfo();
395 si2->setSeqNum(i1.getSignatureInfo()->getSeqNum());
396 i2.setSignatureInfo(*si2);
397 VALIDATE_FAILURE(i2, "Should fail (sequence number reordered)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400398 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700399
400 auto i3 = makeSignedInterest(identity, WantAll); // seq num is i+2
401 VALIDATE_SUCCESS(i3, "Should succeed");
402}
403
404BOOST_AUTO_TEST_SUITE_END() // SeqNumValidation
405
406BOOST_AUTO_TEST_SUITE(NonceValidation)
407
408BOOST_AUTO_TEST_CASE(MissingNonce)
409{
410 auto i1 = makeSignedInterest(identity, InterestSigner::WantTime); // Specifically exclude nonce
411 VALIDATE_FAILURE(i1, "Should fail (nonce missing)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400412 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700413}
414
415BOOST_AUTO_TEST_CASE(DuplicateNonce)
416{
417 auto i1 = makeSignedInterest(identity, WantAll);
418 VALIDATE_SUCCESS(i1, "Should succeed");
419
420 auto i2 = makeSignedInterest(identity, WantAll);
421 auto si2 = i2.getSignatureInfo();
422 si2->setNonce(i1.getSignatureInfo()->getNonce());
423 i2.setSignatureInfo(*si2);
424 VALIDATE_FAILURE(i2, "Should fail (duplicate nonce)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400425 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700426
427 auto i3 = makeSignedInterest(identity, WantAll);
428 // On the off chance that the generated nonce is identical to i1
429 while (i3.getSignatureInfo()->getNonce() == i1.getSignatureInfo()->getNonce()) {
430 i3 = makeSignedInterest(identity, WantAll);
431 }
432 VALIDATE_SUCCESS(i3, "Should succeed");
433}
434
Davide Pesavento2acce252022-09-08 22:03:03 -0400435struct DisabledNonceValidationOptions
Eric Newberry1caa6342020-08-23 19:29:08 -0700436{
Eric Newberry1caa6342020-08-23 19:29:08 -0700437 static ValidationPolicySignedInterest::Options
438 getOptions()
439 {
440 ValidationPolicySignedInterest::Options options;
441 options.shouldValidateNonces = false;
442 return options;
443 }
444};
445
446BOOST_FIXTURE_TEST_CASE(Disabled,
447 ValidationPolicySignedInterestFixture<DisabledNonceValidationOptions>)
448{
449 auto i1 = makeSignedInterest(identity, WantAll ^ InterestSigner::WantNonce);
450 VALIDATE_SUCCESS(i1, "Should succeed");
451
452 // Ensure still works when a nonce is present
453 auto i2 = makeSignedInterest(identity, WantAll);
454 VALIDATE_SUCCESS(i2, "Should succeed");
455
456 // Ensure a duplicate still succeeds
457 auto i3 = makeSignedInterest(identity, WantAll);
458 auto si3 = i3.getSignatureInfo();
459 si3->setNonce(i2.getSignatureInfo()->getNonce());
460 i3.setSignatureInfo(*si3);
461 m_keyChain.sign(i3, signingByIdentity(identity).setSignedInterestFormat(SignedInterestFormat::V03)
462 .setSignatureInfo(*si3));
463 VALIDATE_SUCCESS(i3, "Should succeed");
464}
465
Davide Pesavento2acce252022-09-08 22:03:03 -0400466struct NonceLimit2Options
Eric Newberry1caa6342020-08-23 19:29:08 -0700467{
Eric Newberry1caa6342020-08-23 19:29:08 -0700468 static ValidationPolicySignedInterest::Options
469 getOptions()
470 {
471 ValidationPolicySignedInterest::Options options;
472 options.shouldValidateTimestamps = false;
473 options.shouldValidateSeqNums = false;
474 options.maxNonceRecordCount = 2;
475 return options;
476 }
477};
478
479BOOST_FIXTURE_TEST_CASE(NonceRecordLimit,
480 ValidationPolicySignedInterestFixture<NonceLimit2Options>)
481{
482 auto i1 = makeSignedInterest(identity, WantAll);
483 VALIDATE_SUCCESS(i1, "Should succeed");
484
485 auto i2 = makeSignedInterest(identity, WantAll);
486 // On the off chance that the generated nonce is identical to i1
487 while (i2.getSignatureInfo()->getNonce() == i1.getSignatureInfo()->getNonce()) {
488 i2 = makeSignedInterest(identity, WantAll);
489 }
490 VALIDATE_SUCCESS(i2, "Should succeed");
491
492 auto i3 = makeSignedInterest(identity, WantAll);
493 auto si3 = i3.getSignatureInfo();
494 si3->setNonce(i1.getSignatureInfo()->getNonce());
495 i3.setSignatureInfo(*si3);
496 m_keyChain.sign(i3, signingByIdentity(identity).setSignedInterestFormat(SignedInterestFormat::V03)
497 .setSignatureInfo(*si3));
498 VALIDATE_FAILURE(i3, "Should fail (duplicate nonce)");
Davide Pesavento2acce252022-09-08 22:03:03 -0400499 BOOST_TEST(lastError.getCode() == ValidationError::POLICY_ERROR);
Eric Newberry1caa6342020-08-23 19:29:08 -0700500
501 // Pop i1's nonce off the list
502 auto i4 = makeSignedInterest(identity, WantAll);
503 // On the off chance that the generated nonce is identical to i1 or i2
504 while (i4.getSignatureInfo()->getNonce() == i1.getSignatureInfo()->getNonce() ||
505 i4.getSignatureInfo()->getNonce() == i2.getSignatureInfo()->getNonce()) {
506 i4 = makeSignedInterest(identity, WantAll);
507 }
508 VALIDATE_SUCCESS(i4, "Should succeed");
509
510 // Now i3 should succeed because i1's nonce has been popped off the list
511 auto i5 = makeSignedInterest(identity, WantAll);
512 auto si5 = i5.getSignatureInfo();
513 si5->setNonce(i1.getSignatureInfo()->getNonce());
514 i5.setSignatureInfo(*si5);
515 m_keyChain.sign(i5, signingByIdentity(identity).setSignedInterestFormat(SignedInterestFormat::V03)
516 .setSignatureInfo(*si5));
517 VALIDATE_SUCCESS(i5, "Should succeed");
518}
519
520BOOST_AUTO_TEST_SUITE_END() // NonceValidation
521
522BOOST_AUTO_TEST_SUITE_END() // TestValidationPolicySignedInterest
523BOOST_AUTO_TEST_SUITE_END() // Security
524
Davide Pesavento47ce2ee2023-05-09 01:33:33 -0400525} // namespace ndn::tests