inital commit

2026-08-31 15:55:09 -05:00
commit e71b3ada71
22 changed files with 1783 additions and 0 deletions
@@ -0,0 +1,71 @@
+import Foundation
+import UltraMeshCore
+
+struct TestFailure: Error, LocalizedError {
+    let errorDescription: String?
+    init(_ message: String) { errorDescription = message }
+}
+
+var passed = 0
+func check(_ condition: @autoclosure () throws -> Bool, _ name: String) throws {
+    guard try condition() else { throw TestFailure(name) }
+    passed += 1; print("ok \(passed) - \(name)")
+}
+
+do {
+    let alice = try NodeIdentity(); let bob = try NodeIdentity(); let carol = try NodeIdentity()
+    try check(try MeshAddress(alice.record.address.description) == alice.record.address, "mesh address round trip")
+    try check(alice.record.address.bytes.first == 0xfd, "mesh address uses fd prefix")
+
+    let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+    defer { try? FileManager.default.removeItem(at: directory) }
+    let identityURL = directory.appendingPathComponent("identity.plist")
+    let stored1 = try NodeIdentity.loadOrCreate(at: identityURL)
+    let stored2 = try NodeIdentity.loadOrCreate(at: identityURL)
+    try check(stored1.record == stored2.record, "identity persists")
+    let attributes = try FileManager.default.attributesOfItem(atPath: identityURL.path)
+    try check((attributes[.posixPermissions] as? NSNumber)?.intValue == 0o600, "identity permissions")
+
+    let original = InnerFrame(kind: .text, port: 7000, payload: Data("hello".utf8), sourceRecord: alice.record)
+    let sealed = try alice.seal(original, to: bob.record)
+    let opened = try bob.open(sealed, expectedSource: alice.record.address)
+    try check(opened.payload == Data("hello".utf8), "end-to-end encryption round trip")
+    var corrupted = sealed.combinedCiphertext; corrupted[corrupted.startIndex] ^= 1
+    let tampered = SealedPayload(ephemeralPublicKey: sealed.ephemeralPublicKey, combinedCiphertext: corrupted)
+    var rejected = false
+    do { _ = try bob.open(tampered, expectedSource: alice.record.address) } catch { rejected = true }
+    try check(rejected, "tampered ciphertext rejected")
+
+    let router = LinkStateRouter(local: alice.record.address)
+    try check(router.ingest(try alice.makeLinkState(sequence: 1, neighbors: [bob.record.address])), "local topology accepted")
+    try check(router.ingest(try bob.makeLinkState(sequence: 1, neighbors: [alice.record.address, carol.record.address])), "relay topology accepted")
+    try check(router.ingest(try carol.makeLinkState(sequence: 1, neighbors: [bob.record.address])), "remote topology accepted")
+    let route = router.routes()[carol.record.address]
+    try check(route?.nextHop == bob.record.address && route?.hopCount == 2, "three-node route uses relay")
+    try check(!router.ingest(try carol.makeLinkState(sequence: 1, neighbors: [])), "stale topology rejected")
+    let forged = LinkState(origin: carol.record, sequence: 2, neighbors: [], signature: Data(repeating: 0, count: 64))
+    try check(!router.ingest(forged), "forged topology rejected")
+
+    let firewall = MeshFirewall()
+    try check(!firewall.allows(port: 80, source: alice.record.address), "firewall defaults to deny")
+    firewall.allow(port: 80, source: alice.record.address)
+    try check(firewall.allows(port: 80, source: alice.record.address), "scoped firewall rule allows source")
+    try check(!firewall.allows(port: 80, source: bob.record.address), "scoped firewall rule denies other source")
+    firewall.allow(port: 443, source: nil)
+    try check(firewall.allows(port: 443, source: bob.record.address), "any-source firewall rule")
+
+    let framed = try FrameCodec.encode(WireEnvelope(message: .keepalive))
+    try check(try FrameCodec.bodyLength(from: framed.prefix(4)) == framed.count - 4, "frame length prefix")
+    let decoded = try FrameCodec.decode(WireEnvelope.self, body: framed.dropFirst(4))
+    if decoded.version == 1, case .keepalive = decoded.message { try check(true, "wire frame round trip") }
+    else { throw TestFailure("wire frame round trip") }
+    var zeroRejected = false
+    do { _ = try FrameCodec.bodyLength(from: Data([0, 0, 0, 0])) } catch { zeroRejected = true }
+    try check(zeroRejected, "zero-length frame rejected")
+
+    print("1..\(passed)")
+    print("all core self-tests passed")
+} catch {
+    fputs("not ok - \(error.localizedDescription)\n", stderr)
+    exit(1)
+}