release: restore ZUPT and harden source-only 5.2.2
This commit is contained in:
Cristian Cezar Moisés
parent
74e393ba3e
commit
ff99770bd0
205 changed files with 19627 additions and 13215 deletions
|
|
@ -2,7 +2,7 @@
|
|||
# SPDX-License-Identifier: AGPL-3.0-or-later
|
||||
# Copyright (c) 2025-2026 Cristian Cezar Moisés
|
||||
#
|
||||
# F-11 regression test (Zupt 2.4.2).
|
||||
# F-11 regression test (VaptVupt 2.4.2).
|
||||
#
|
||||
# F-11: pre-2.4.2 the AIT-fail message said "archive header or footer has
|
||||
# been tampered with" in both the actual-tamper case AND the wrong-password
|
||||
|
|
@ -16,32 +16,39 @@
|
|||
# message for both cases eliminates a verbal probe-oracle. Plaintext-mode
|
||||
# tamper detection (no key involvement) keeps detailed wording.
|
||||
|
||||
set -u
|
||||
set -Eeuo pipefail
|
||||
|
||||
ZUPT="${ZUPT_BIN:-./zupt}"
|
||||
# Source-only build (WITH_SDK=0) has no libzuptsdk: the SDK-mode paths this
|
||||
# test exercises are unavailable, so skip cleanly instead of failing.
|
||||
_sdkck="$(mktemp -d)"
|
||||
if ! "$ZUPT" keygen --sdk -o "$_sdkck/p" >/dev/null 2>&1; then
|
||||
rm -rf "$_sdkck"; echo " SKIP: built without libzuptsdk (source-only) - SDK-mode test not applicable"; exit 0
|
||||
fi
|
||||
rm -rf "$_sdkck"
|
||||
|
||||
case "$ZUPT" in
|
||||
/*) ;;
|
||||
*) ZUPT="$PWD/$ZUPT" ;;
|
||||
esac
|
||||
repo_root=$(CDPATH='' cd -- "$(dirname -- "$0")/.." && pwd -P)
|
||||
ZUPT=${ZUPT_BIN:-$repo_root/zupt}
|
||||
|
||||
if [ ! -x "$ZUPT" ]; then
|
||||
echo " ✗ $ZUPT not found — run 'make' first" >&2
|
||||
exit 1
|
||||
fi
|
||||
version=$("$ZUPT" --version 2>&1)
|
||||
SDK_ENABLED=0
|
||||
if grep -Fq 'libvuptsdk=enabled' <<<"$version"; then
|
||||
SDK_ENABLED=1
|
||||
fi
|
||||
|
||||
PASS=0
|
||||
FAIL=0
|
||||
P() { PASS=$((PASS+1)); echo " ✓ $1"; }
|
||||
F() { FAIL=$((FAIL+1)); echo " ✗ $1"; }
|
||||
|
||||
capture_expected_failure() {
|
||||
local output_name=$1 label=$2 directory=$3 output status
|
||||
shift 3
|
||||
set +e
|
||||
output=$(cd "$directory" && "$@" 2>&1)
|
||||
status=$?
|
||||
set -e
|
||||
if ((status == 0)); then
|
||||
F "$label returned success"
|
||||
fi
|
||||
printf -v "$output_name" '%s' "$output"
|
||||
}
|
||||
|
||||
TMPDIR=$(mktemp -d)
|
||||
trap 'rm -rf "$TMPDIR"' EXIT
|
||||
cd "$TMPDIR"
|
||||
|
|
@ -50,46 +57,49 @@ echo "F-11 regression: error-message hygiene"
|
|||
|
||||
echo "F-11 payload" > input.txt
|
||||
|
||||
# Test 1: wrong-password message on Argon2id default (no --verbose)
|
||||
# Test 1: wrong-password message on the build's default KDF (no --verbose)
|
||||
"$ZUPT" c -p correct argon.zupt input.txt >/dev/null 2>&1
|
||||
mkdir out1
|
||||
ERR=$( (cd out1 && "$ZUPT" x -p wrong ../argon.zupt) 2>&1 || true )
|
||||
capture_expected_failure ERR 'default KDF wrong-pw' out1 \
|
||||
"$ZUPT" x -p wrong ../argon.zupt
|
||||
if echo "$ERR" | grep -q "Authentication failed (wrong key, wrong password, or tampered archive)"; then
|
||||
P "Argon2id wrong-pw default: generic auth-fail message"
|
||||
P "default KDF wrong-pw: generic auth-fail message"
|
||||
else
|
||||
F "Argon2id wrong-pw default: message wrong: '$ERR'"
|
||||
F "default KDF wrong-pw: message wrong: '$ERR'"
|
||||
fi
|
||||
# Must NOT contain the standalone "header or footer has been tampered with"
|
||||
if ! echo "$ERR" | grep -q "header or footer has been tampered with"; then
|
||||
P "Argon2id wrong-pw default: no standalone tamper claim"
|
||||
P "default KDF wrong-pw: no standalone tamper claim"
|
||||
else
|
||||
F "Argon2id wrong-pw default: still claims archive tampered"
|
||||
F "default KDF wrong-pw: still claims archive tampered"
|
||||
fi
|
||||
# Must NOT contain the verbose top-MAC line
|
||||
if ! echo "$ERR" | grep -q "archive-integrity-trailer (top-MAC)"; then
|
||||
P "Argon2id wrong-pw default: no top-MAC technical detail"
|
||||
P "default KDF wrong-pw: no top-MAC technical detail"
|
||||
else
|
||||
F "Argon2id wrong-pw default: top-MAC leaked without --verbose"
|
||||
F "default KDF wrong-pw: top-MAC leaked without --verbose"
|
||||
fi
|
||||
|
||||
# Test 2: --verbose surfaces the technical detail
|
||||
mkdir out2
|
||||
ERR_V=$( (cd out2 && "$ZUPT" x -p wrong --verbose ../argon.zupt) 2>&1 || true )
|
||||
capture_expected_failure ERR_V 'default KDF wrong-pw --verbose' out2 \
|
||||
"$ZUPT" x -p wrong --verbose ../argon.zupt
|
||||
if echo "$ERR_V" | grep -q "top-MAC"; then
|
||||
P "Argon2id wrong-pw --verbose: top-MAC detail shown"
|
||||
P "default KDF wrong-pw --verbose: top-MAC detail shown"
|
||||
else
|
||||
F "Argon2id wrong-pw --verbose: top-MAC missing"
|
||||
F "default KDF wrong-pw --verbose: top-MAC missing"
|
||||
fi
|
||||
if echo "$ERR_V" | grep -q "Authentication failed (wrong key, wrong password, or tampered archive)"; then
|
||||
P "Argon2id wrong-pw --verbose: still has the generic line"
|
||||
P "default KDF wrong-pw --verbose: still has the generic line"
|
||||
else
|
||||
F "Argon2id wrong-pw --verbose: missing generic line"
|
||||
F "default KDF wrong-pw --verbose: missing generic line"
|
||||
fi
|
||||
|
||||
# Test 3: PBKDF2 archive same behaviour
|
||||
"$ZUPT" c -p correct --kdf pbkdf2 pbkdf.zupt input.txt >/dev/null 2>&1
|
||||
mkdir out3
|
||||
ERR3=$( (cd out3 && "$ZUPT" x -p wrong ../pbkdf.zupt) 2>&1 || true )
|
||||
capture_expected_failure ERR3 'PBKDF2 wrong-pw' out3 \
|
||||
"$ZUPT" x -p wrong ../pbkdf.zupt
|
||||
if echo "$ERR3" | grep -q "Authentication failed (wrong key, wrong password, or tampered archive)"; then
|
||||
P "PBKDF2 wrong-pw default: generic auth-fail message"
|
||||
else
|
||||
|
|
@ -104,7 +114,8 @@ b = bytearray(open('tampered.zupt','rb').read())
|
|||
b[15] ^= 1 # creation_time byte
|
||||
open('tampered.zupt','wb').write(bytes(b))"
|
||||
mkdir out4
|
||||
ERR4=$( (cd out4 && "$ZUPT" x -p correct ../tampered.zupt) 2>&1 || true )
|
||||
capture_expected_failure ERR4 'encrypted header tamper' out4 \
|
||||
"$ZUPT" x -p correct ../tampered.zupt
|
||||
if echo "$ERR4" | grep -q "Authentication failed (wrong key, wrong password, or tampered archive)"; then
|
||||
P "Actual tamper (encrypted): same generic message — no verbal oracle"
|
||||
else
|
||||
|
|
@ -125,7 +136,8 @@ b = bytearray(open('ptamp.zupt','rb').read())
|
|||
b[10] ^= 1
|
||||
open('ptamp.zupt','wb').write(bytes(b))"
|
||||
mkdir out5
|
||||
ERR5=$( (cd out5 && "$ZUPT" x ../ptamp.zupt) 2>&1 || true )
|
||||
capture_expected_failure ERR5 'plaintext header tamper' out5 \
|
||||
"$ZUPT" x ../ptamp.zupt
|
||||
if echo "$ERR5" | grep -q "corrupted or tampered"; then
|
||||
P "Plaintext tamper: detailed XXH64-failure message kept"
|
||||
else
|
||||
|
|
@ -146,16 +158,21 @@ else
|
|||
F "Correct password: regression — extract broken"
|
||||
fi
|
||||
|
||||
# Test 7: PQ-SDK wrong key triggers the same generic message
|
||||
"$ZUPT" keygen --sdk -o k.priv >/dev/null 2>&1
|
||||
"$ZUPT" keygen --sdk -o other.priv >/dev/null 2>&1
|
||||
"$ZUPT" c --pq-sdk k.priv.pub pq.zupt input.txt >/dev/null 2>&1
|
||||
mkdir out7
|
||||
ERR7=$( (cd out7 && "$ZUPT" x --pq-sdk ../other.priv ../pq.zupt) 2>&1 || true )
|
||||
if echo "$ERR7" | grep -q "Authentication failed (wrong key, wrong password, or tampered archive)"; then
|
||||
P "PQ-SDK wrong-key: generic auth-fail message"
|
||||
# Test 7: when enabled, PQ-SDK wrong key triggers the same generic message.
|
||||
if ((SDK_ENABLED)); then
|
||||
"$ZUPT" keygen --sdk -o k.priv >/dev/null 2>&1
|
||||
"$ZUPT" keygen --sdk -o other.priv >/dev/null 2>&1
|
||||
"$ZUPT" c --pq-sdk k.priv.pub pq.zupt input.txt >/dev/null 2>&1
|
||||
mkdir out7
|
||||
capture_expected_failure ERR7 'PQ-SDK wrong key' out7 \
|
||||
"$ZUPT" x --pq-sdk ../other.priv ../pq.zupt
|
||||
if echo "$ERR7" | grep -q "Authentication failed (wrong key, wrong password, or tampered archive)"; then
|
||||
P "PQ-SDK wrong-key: generic auth-fail message"
|
||||
else
|
||||
F "PQ-SDK wrong-key: didn't get generic message: '$ERR7'"
|
||||
fi
|
||||
else
|
||||
F "PQ-SDK wrong-key: didn't get generic message: '$ERR7'"
|
||||
echo ' SKIP: PQ-SDK wrong-key message needs system libvuptsdk (WITH_SDK=1)'
|
||||
fi
|
||||
|
||||
echo ""
|
||||
|
|
|
|||
Loading…
Reference in a new issue