Skip to content

Commit 47500a2

Browse files
werwurmwerwurm
committed
Add nat20 integration test suite for linux examples
 Adds a C integration test binary (nat20_integration_test) that exercises the full DICE service stack via /dev/nat200. The test generates certificate chains across all supported key type (P-256, P-384) and format (X.509, COSE) permutations, verifies cryptographic signatures at each link, and confirms that parent_path-based issuance produces identical results to direct issuance after promote. Test structure: - Phase 1 (level 1): Generate CDI1, CDI2, ECA, ECA_EE certs and signatures using parent paths of varying depth from the UDS level. Verify all X.509 and COSE chains cryptographically. - Phase 2 (level 2): After one promote, regenerate CDI2/ECA/ECA_EE/sign with reduced parent path depth and assert byte-for-byte equality. - Phase 3 (level 3): After second promote, regenerate ECA/ECA_EE/sign with no parent path and assert equality. Also includes: - test_helpers.c: OpenSSL-based X.509 signature verification, public key extraction, COSE_Sign1 parsing and verification, CWT subject public key extraction, and compressed input computation. - nat20_qemu_init.sh: init wrapper for running tests in QEMU CI. - GitHub Action steps to build the rootfs and run the test suite in QEMU. - Buildroot package (nat20test) with OpenSSL dependency.
1 parent 0612f25 commit 47500a2

13 files changed

Lines changed: 2160 additions & 1 deletion

File tree

‎.github/workflows/linux-kmod-build.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,3 +168,39 @@ jobs:
168168
find ${{ runner.temp }}/buildroot.build -name 'nat20cli' | grep -q nat20cli
169169
echo "nat20cli built successfully:"
170170
find ${{ runner.temp }}/buildroot.build -name 'nat20cli' -exec ls -la {} \;
171+
172+
- name: Build rootfs image
173+
env:
174+
NAT20LIB_OVERRIDE_SRCDIR: ${{ github.workspace }}
175+
NAT20DEVICE_OVERRIDE_SRCDIR: ${{ github.workspace }}
176+
NAT20CRYPTO_OVERRIDE_SRCDIR: ${{ github.workspace }}
177+
NAT20SW_OVERRIDE_SRCDIR: ${{ github.workspace }}
178+
LIBNAT20_OVERRIDE_SRCDIR: ${{ github.workspace }}
179+
NAT20CLI_OVERRIDE_SRCDIR: ${{ github.workspace }}
180+
NAT20TEST_OVERRIDE_SRCDIR: ${{ github.workspace }}
181+
run: make -C ${{ runner.temp }}/buildroot.build/buildroot -j $(( $(nproc) + 1 ))
182+
183+
- name: Run integration tests in QEMU
184+
timeout-minutes: 5
185+
run: |
186+
BUILDROOT_DIR="${{ runner.temp }}/buildroot.build/buildroot"
187+
KERNEL="${BUILDROOT_DIR}/output/images/bzImage"
188+
ROOTFS="${BUILDROOT_DIR}/output/images/rootfs.ext2"
189+
190+
qemu-system-x86_64 \
191+
-M pc \
192+
-kernel "${KERNEL}" \
193+
-drive file="${ROOTFS}",if=virtio,format=raw \
194+
-append "rootwait root=/dev/vda console=ttyS0 init=/usr/bin/nat20_qemu_init.sh" \
195+
-nographic \
196+
-no-reboot \
197+
-net none \
198+
2>&1 | tee qemu_output.log
199+
200+
if grep -q "INTEGRATION_TESTS_PASSED" qemu_output.log; then
201+
echo "Integration tests passed."
202+
else
203+
echo "Integration tests failed. QEMU output:"
204+
cat qemu_output.log
205+
exit 1
206+
fi

‎examples/linux/br_external/Config.in‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,3 +39,4 @@ source "$BR2_EXTERNAL_NAT20_PATH/package/nat20device/Config.in"
3939
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20sw/Config.in"
4040
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20lib/Config.in"
4141
source "$BR2_EXTERNAL_NAT20_PATH/package/libnat20/Config.in"
42+
source "$BR2_EXTERNAL_NAT20_PATH/package/nat20test/Config.in"

‎examples/linux/br_external/configs/qemu_br_defconfig‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3982,3 +3982,4 @@ BR2_PACKAGE_NAT20DEVICE=y
39823982
BR2_PACKAGE_NAT20SW=y
39833983
BR2_PACKAGE_NAT20LIB=y
39843984
BR2_PACKAGE_LIBNAT20=y
3985+
BR2_PACKAGE_NAT20TEST=y

‎examples/linux/br_external/package/nat20cli/nat20cli.mk‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@
3333
# along with this program; if not, see
3434
# <https://www.gnu.org/licenses/>.
3535

36+
# In CI NAT20CLI_OVERRIDE_SRCDIR is set to the root of the repository,
37+
# so that the source under test is always the current branch.
38+
# Integrators who use this configuration should pin the version
39+
# to a specific commit or branch to avoid breakages when the main branch changes.
3640
NAT20CLI_VERSION = origin/main
3741
NAT20CLI_SITE = https://github.com/aurora-opensource/libnat20.git
3842
NAT20CLI_SITE_METHOD = git

‎examples/linux/br_external/package/nat20test/Config.in‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
config BR2_PACKAGE_NAT20TEST
37+
bool "nat20cli"
38+
depends on BR2_PACKAGE_LIBNAT20
39+
depends on BR2_PACKAGE_OPENSSL
40+
help
41+
Enable building the nat20test, an integration test for ant20device with nat20sw.

‎examples/linux/br_external/package/nat20test/nat20test.mk‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
# In CI NAT20TEST_OVERRIDE_SRCDIR is set to the root of the repository,
37+
# so that the source under test is always the current branch.
38+
# Integrators who use this configuration should pin the version
39+
# to a specific commit or branch to avoid breakages when the main branch changes.
40+
NAT20TEST_VERSION = origin/main
41+
NAT20TEST_SITE = https://github.com/aurora-opensource/libnat20.git
42+
NAT20TEST_SITE_METHOD = git
43+
NAT20TEST_LICENSE = Apache-2.0 OR GPL-2.0
44+
NAT20TEST_LICENSE_FILES = LICENSE-Apache-2.0.txt LICENSE-GPL-2.0.txt
45+
46+
NAT20TEST_SUBDIR = examples/linux/nat20test
47+
48+
NAT20TEST_INSTALL_TARGET = YES
49+
NAT20TEST_DEPENDENCIES += libnat20 openssl
50+
51+
$(eval $(cmake-package))

‎examples/linux/br_external/utils/envsetup.sh‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ export NAT20CRYPTO_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5151
export NAT20SW_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5252
export NAT20DEVICE_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5353
export NAT20LIB_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
54+
export NAT20TEST_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5455
export LIBNAT20_OVERRIDE_SRCDIR="$LIBNAT20_ROOT"
5556

5657
function ensure_popd() {
@@ -79,13 +80,14 @@ function brrebuild() {
7980
echo " nat20device - Rebuild the nat20device module"
8081
echo " nat20sw - Rebuild the nat20sw module"
8182
echo " nat20lib - Rebuild the nat20lib library"
83+
echo " nat20test - Rebuild the nat20device integration test"
8284
popd
8385
return 1
8486
fi
8587

8688
case "$1" in
8789
all)
88-
ensure_popd make linux-rebuild nat20lib-rebuild nat20crypto-rebuild nat20device-rebuild nat20sw-rebuild libnat20-rebuild nat20cli-rebuild all
90+
ensure_popd make linux-rebuild nat20lib-rebuild nat20crypto-rebuild nat20device-rebuild nat20sw-rebuild libnat20-rebuild nat20cli-rebuild nat20test-rebuild all
8991
;;
9092
*)
9193
ensure_popd make $1-rebuild all

‎examples/linux/nat20test/CMakeLists.txt‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Copyright 2026 Aurora Operations, Inc.
2+
#
3+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
4+
#
5+
# This work is dual licensed.
6+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
7+
#
8+
# Licensed under the Apache License, Version 2.0 (the "License");
9+
# you may not use this file except in compliance with the License.
10+
# You may obtain a copy of the License at
11+
#
12+
# http://www.apache.org/licenses/LICENSE-2.0
13+
#
14+
# Unless required by applicable law or agreed to in writing, software
15+
# distributed under the License is distributed on an "AS IS" BASIS,
16+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
# See the License for the specific language governing permissions and
18+
# limitations under the License.
19+
#
20+
# OR
21+
#
22+
# This program is free software; you can redistribute it and/or
23+
# modify it under the terms of the GNU General Public License
24+
# as published by the Free Software Foundation; either version 2
25+
# of the License, or (at your option) any later version.
26+
#
27+
# This program is distributed in the hope that it will be useful,
28+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
29+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
30+
# GNU General Public License for more details.
31+
#
32+
# You should have received a copy of the GNU General Public License
33+
# along with this program; if not, see
34+
# <https://www.gnu.org/licenses/>.
35+
36+
cmake_minimum_required(VERSION 3.22)
37+
38+
project(NAT20TEST VERSION 0.0.1 LANGUAGES C)
39+
40+
# The C standard shall be C11.
41+
set(CMAKE_C_STANDARD 11)
42+
43+
# CMake shall generate a compile_commands.json file for
44+
# the benfit of clangd based IDE support.
45+
set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
46+
47+
48+
###################################################################################################
49+
# Integration test binary — exercises the nat20 DICE service via /dev/nat200.
50+
add_executable(nat20_integration_test)
51+
52+
find_package(LibNat20 REQUIRED)
53+
find_package(OpenSSL REQUIRED)
54+
55+
target_sources(nat20_integration_test
56+
PRIVATE test/nat20_integration_test.c
57+
PRIVATE test/test_helpers.c
58+
)
59+
60+
target_include_directories(nat20_integration_test
61+
PRIVATE test
62+
)
63+
64+
target_link_libraries(nat20_integration_test
65+
PRIVATE LibNat20::nat20
66+
PRIVATE LibNat20::nat20_service
67+
PRIVATE LibNat20::nat20_crypto_nat20
68+
PRIVATE OpenSSL::Crypto
69+
)
70+
71+
target_compile_options(nat20_integration_test
72+
PRIVATE -pedantic
73+
PRIVATE -Wall
74+
PRIVATE -Wextra
75+
PRIVATE -Werror
76+
)
77+
78+
install(TARGETS nat20_integration_test RUNTIME DESTINATION bin)
79+
install(PROGRAMS nat20test.sh DESTINATION bin)
80+
install(PROGRAMS nat20_qemu_init.sh DESTINATION bin)
81+
82+
###################################################################################################

‎examples/linux/nat20test/nat20_qemu_init.sh‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/bin/sh
2+
3+
# Copyright 2026 Aurora Operations, Inc.
4+
#
5+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
6+
#
7+
# This work is dual licensed.
8+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
9+
#
10+
# Licensed under the Apache License, Version 2.0 (the "License");
11+
# you may not use this file except in compliance with the License.
12+
# You may obtain a copy of the License at
13+
#
14+
# http://www.apache.org/licenses/LICENSE-2.0
15+
#
16+
# Unless required by applicable law or agreed to in writing, software
17+
# distributed under the License is distributed on an "AS IS" BASIS,
18+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19+
# See the License for the specific language governing permissions and
20+
# limitations under the License.
21+
#
22+
# OR
23+
#
24+
# This program is free software; you can redistribute it and/or
25+
# modify it under the terms of the GNU General Public License
26+
# as published by the Free Software Foundation; either version 2
27+
# of the License, or (at your option) any later version.
28+
#
29+
# This program is distributed in the hope that it will be useful,
30+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
31+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
32+
# GNU General Public License for more details.
33+
#
34+
# You should have received a copy of the GNU General Public License
35+
# along with this program; if not, see
36+
# <https://www.gnu.org/licenses/>.
37+
38+
# Init wrapper for running nat20clitest.sh in a QEMU VM.
39+
# This script is intended to be used as the init process (PID 1).
40+
# It mounts the necessary filesystems, runs the test suite, prints
41+
# a machine-parseable result marker, and powers off the VM.
42+
43+
export PATH="/usr/bin:/bin:/sbin:/usr/sbin"
44+
45+
mount -t proc none /proc
46+
mount -t sysfs none /sys
47+
mount -t tmpfs none /tmp
48+
49+
cd /tmp
50+
51+
nat20test.sh
52+
rc=$?
53+
54+
if [ $rc -eq 0 ]; then
55+
echo "INTEGRATION_TESTS_PASSED"
56+
else
57+
echo "INTEGRATION_TESTS_FAILED (exit code: $rc)"
58+
fi
59+
60+
poweroff -f

‎examples/linux/nat20test/nat20test.sh‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/sh
2+
3+
# Copyright 2026 Aurora Operations, Inc.
4+
#
5+
# SPDX-License-Identifier: Apache-2.0 OR GPL-2.0
6+
#
7+
# This work is dual licensed.
8+
# You may use it under Apache-2.0 or GPL-2.0 at your option.
9+
#
10+
# Licensed under the Apache License, Version 2.0 (the "License");
11+
# you may not use this file except in compliance with the License.
12+
# You may obtain a copy of the License at
13+
#
14+
# http://www.apache.org/licenses/LICENSE-2.0
15+
#
16+
# Unless required by applicable law or agreed to in writing, software
17+
# distributed under the License is distributed on an "AS IS" BASIS,
18+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19+
# See the License for the specific language governing permissions and
20+
# limitations under the License.
21+
#
22+
# OR
23+
#
24+
# This program is free software; you can redistribute it and/or
25+
# modify it under the terms of the GNU General Public License
26+
# as published by the Free Software Foundation; either version 2
27+
# of the License, or (at your option) any later version.
28+
#
29+
# This program is distributed in the hope that it will be useful,
30+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
31+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
32+
# GNU General Public License for more details.
33+
#
34+
# You should have received a copy of the GNU General Public License
35+
# along with this program; if not, see
36+
# <https://www.gnu.org/licenses/>.
37+
38+
set -e
39+
40+
SCRIPT_DIR="$(dirname "$0")"
41+
42+
modprobe nat20sw
43+
mount -t securityfs none /sys/kernel/security
44+
45+
echo "Running integration test suite..."
46+
"${SCRIPT_DIR}/nat20_integration_test"

0 commit comments

Comments
 (0)