Changeset 11127 in ntrip for trunk/BNC/tests/README.md

Timestamp:

Oct 24, 2026, 11:15:22 PM (6 days ago)

Author:

stuerze

Message:

test suite extended regardiing security aspects

File:

• trunk/BNC/tests/README.md (modified) (3 diffs)

trunk/BNC/tests/README.md

@@ -26 +26 @@
 | `cases/<name>/expected/*.gz` | normalised reference outputs |
 | `data/*.raw` | short raw captures (BNC `rawOutFile` format) replayed via `--file` |
-| `tools/fakecaster.py` | local Ntrip caster recording an upload as a BNC raw file (case key `fakecaster`) |
-| `tools/bncraw.py` | `info` (streams, time span, RTCM3 message types) and `slice` for raw captures |
+| `tools/fakecaster.py` | local Ntrip caster recording an upload as a BNC raw file (case key `fakecaster`); optionally TLS and serving a stream |
+| `tools/bncraw.py` | `info` (streams, time span, RTCM3 message types), `slice` and `crs` (decode 1300/1301/1302) for raw captures |
 | `tools/mkcrafted.py` | writes `data/crafted_limits.raw`: crafted frames at the upper field limits |
 | `tools/ssr_harness.sh` | builds `tools/ssr_harness.cpp` with the SSR decoders under ASan/UBSan and runs it |
+| `tools/ssl_check.py` | TLS checks of the Ntrip 2s client and upload (not part of `run_tests.py`) |
 | `work/` | scratch output, not versioned |
 
@@ -75 +76 @@
   (`tools/fakecaster.py`, Ntrip 1/2, chunked), and a `post` step decodes the
   received stream again: `upload_rtnet` (IGS-SSR encoding, SP3/CLK/BIA files,
-  decoded `.ssr`), `upload_eph` (RTCM3 ephemerides to RINEX nav) and
+  decoded `.ssr`, CRS messages 1300/1302 decoded by `bncraw.py crs` in a
+  `tool` post step), `upload_eph` (RTCM3 ephemerides to RINEX nav) and
   `upload_raw` (raw forwarding to RINEX nav). `upload_rtnet_rtcm` encodes the same input to RTCM-SSR
   (message numbers 1057-1068, 1240-1270) and decodes it again.
@@ -114 +116 @@
 `crafted_limits.raw`: 7 entries with additional parameters of 40 and 0 bits,
 and 31 entries, which must be rejected), which `RTCM3Decoder.cpp` does not
-dispatch at present. Exit code 0 only without sanitizer errors.
+dispatch at present. Every decoded VTEC and metadata message is encoded
+again with the `Make*` function of the same class and decoded once more; the
+result must be identical. Exit code 0 only without sanitizer errors and
+differences.
+
+## TLS check
+
+```
+tests/tools/ssl_check.py [--bnc PATH]
+```
+
+Runs BNC against `tools/fakecaster.py` with TLS on port 443 (BNC uploads with
+Ntrip 2s always to 443) inside an unprivileged user and network namespace
+(`unshare -rn`), with a test CA, server and client certificates created by
+openssl in `work/ssl_check/`. Checks for upload and download: certificate of
+an unknown CA rejected, accepted with the CA in `sslCaCertPath`, accepted with
+`sslIgnoreErrors` and the ignored errors logged; for upload also a
+certificate for another host name (rejected) and a client certificate
+required by the caster, with and without `sslIgnoreErrors`. Takes about 3 min.
 
 ## Adding a replay case