github.com/slackhq/nebula v1.6.1: cert.NebulaCertificateDetails

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/slackhq/nebula/cert.NebulaCertificateDetails in pkg:golang/github.com/slackhq/nebula@v1.6.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/slackhq/nebula@v1.6.1
Demonstrate these symbols/APIs:
  - github.com/slackhq/nebula/cert.NebulaCertificateDetails

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:280b5400454141c1fc237ee93efc966343cd6a6e28c3f3dcc480553677f464f7","contract":["NebulaCertificateDetails fields (Name, Ips, Subnets, Groups, NotBefore, NotAfter, PublicKey, IsCA, Issuer) initialize properly on a NebulaCertificate.","NebulaCertificate.Sign and MarshalToPEM serialize NebulaCertificateDetails into a valid PEM-encoded certificate block.","UnmarshalNebulaCertificateFromPEM deserializes PEM certificate data, restoring all NebulaCertificateDetails fields and populating InvertedGroups.","NebulaCertificate.CheckRootConstrains verifies that child certificate Details conform to CA certificate constraints.","NebulaCertificate.CheckRootConstrains rejects child certificate Details that violate CA groups, subnets, or validity period constraints.","NebulaCertificate.Expired evaluates certificate validity against NotBefore and NotAfter timestamps defined in NebulaCertificateDetails.","NebulaCertificate.Verify validates signature and Details constraint hierarchy against a trusted NebulaCAPool."],"goal":"verify github.com/slackhq/nebula/cert.NebulaCertificateDetails in pkg:golang/github.com/slackhq/nebula@v1.6.1","kind":"HOW","packages":["pkg:golang/github.com/slackhq/nebula@v1.6.1"],"schemaVersion":1,"symbols":["github.com/slackhq/nebula/cert.NebulaCertificateDetails"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/slackhq/nebula@v1.6.1"],"schemaVersion":1,"subject":"pkg:golang/github.com/slackhq/nebula@v1.6.1","symbols":["github.com/slackhq/nebula/cert.NebulaCertificateDetails"],"verifierAdapter":"golang@1"}

module sample

go 1.20

require github.com/slackhq/nebula v1.6.1

require (
	golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29 // indirect
	google.golang.org/protobuf v1.28.0 // indirect
)

github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/sirupsen/logrus v1.8.1 h1:dJKuHgqk1NNQlqoA6BTlM1Wf9DOH3NBjQyu0h9+AZZE=
github.com/slackhq/nebula v1.6.1 h1:/OCTR3abj0Sbf2nGoLUrdDXImrCv0ZVFpVPP5qa0DsM=
github.com/slackhq/nebula v1.6.1/go.mod h1:UmkqnXe4O53QwToSl/gG7sM4BroQwAB7dd4hUaT6MlI=
github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29 h1:tkVvjkPTB7pnW3jnid7kNyAMPVWllTNOf/qKDze4p9o=
golang.org/x/crypto v0.0.0-20220331220935-ae2d96664a29/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/sys v0.0.0-20220406155245-289d7a0edf71 h1:PRD0hj6tTuUnCFD08vkvjkYFbQg/9lV8KIxe1y4/cvU=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
google.golang.org/protobuf v1.28.0 h1:w43yiav+6bVFTBQFZX0r7ipe9JQ1QsbMgHwbBziscLw=
google.golang.org/protobuf v1.28.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=

package main

import (
	"crypto/ed25519"
	"crypto/rand"
	"fmt"
	"log"
	"net"
	"time"

	"github.com/slackhq/nebula/cert"
)

func main() {
	now := time.Now()

	// 1. Generate CA key pair and certificate with Details
	caPub, caPriv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		log.Fatalf("generate CA key error: %v", err)
	}

	_, caSubnet, err := net.ParseCIDR("10.100.0.0/16")
	if err != nil {
		log.Fatalf("parse CA subnet error: %v", err)
	}

	caDetails := cert.NebulaCertificateDetails{
		Name:      "nebula-ca",
		Subnets:   []*net.IPNet{caSubnet},
		Groups:    []string{"default", "services", "admin"},
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(365 * 24 * time.Hour),
		PublicKey: caPub,
		IsCA:      true,
	}

	caCert := &cert.NebulaCertificate{Details: caDetails}
	if err := caCert.Sign(caPriv); err != nil {
		log.Fatalf("sign CA cert error: %v", err)
	}

	caPem, err := caCert.MarshalToPEM()
	if err != nil {
		log.Fatalf("marshal CA PEM error: %v", err)
	}

	caPool, err := cert.NewCAPoolFromBytes(caPem)
	if err != nil {
		log.Fatalf("create CA pool error: %v", err)
	}

	caFingerprint, err := caCert.Sha256Sum()
	if err != nil {
		log.Fatalf("CA fingerprint error: %v", err)
	}

	// 2. Generate Node key pair and certificate with Details
	nodePub, _, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		log.Fatalf("generate node key error: %v", err)
	}

	_, nodeIP, err := net.ParseCIDR("10.100.1.5/24")
	if err != nil {
		log.Fatalf("parse node IP error: %v", err)
	}

	nodeDetails := cert.NebulaCertificateDetails{
		Name:      "web-node-01",
		Ips:       []*net.IPNet{nodeIP},
		Groups:    []string{"default", "services"},
		NotBefore: now.Add(-10 * time.Minute),
		NotAfter:  now.Add(30 * 24 * time.Hour),
		PublicKey: nodePub,
		IsCA:      false,
		Issuer:    caFingerprint,
	}

	nodeCert := &cert.NebulaCertificate{Details: nodeDetails}
	if err := nodeCert.Sign(caPriv); err != nil {
		log.Fatalf("sign node cert error: %v", err)
	}

	nodePem, err := nodeCert.MarshalToPEM()
	if err != nil {
		log.Fatalf("marshal node PEM error: %v", err)
	}

	// 3. Unmarshal and verify node certificate Details against CA pool
	parsedNodeCert, _, err := cert.UnmarshalNebulaCertificateFromPEM(nodePem)
	if err != nil {
		log.Fatalf("unmarshal node PEM error: %v", err)
	}

	valid, err := parsedNodeCert.Verify(now, caPool)
	if err != nil || !valid {
		log.Fatalf("node verification failed: valid=%v, err=%v", valid, err)
	}

	fmt.Printf("Nebula Certificate Details successfully verified:\n")
	fmt.Printf("  Name: %s\n", parsedNodeCert.Details.Name)
	fmt.Printf("  IP: %s\n", parsedNodeCert.Details.Ips[0].String())
	fmt.Printf("  Groups: %v\n", parsedNodeCert.Details.Groups)
	fmt.Printf("  Issuer CA: %s\n", parsedNodeCert.Details.Issuer)
	fmt.Printf("  Is CA: %t\n", parsedNodeCert.Details.IsCA)
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/slackhq/nebula/cert.NebulaCertificateDetails in pkg:golang/github.com/slackhq/nebula@v1.6.1",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/slackhq/nebula@v1.6.1"
  ],
  "symbols": [
    "github.com/slackhq/nebula/cert.NebulaCertificateDetails"
  ]
}

package main

import (
	"bytes"
	"crypto/ed25519"
	"crypto/rand"
	"fmt"
	"net"
	"os"
	"time"

	"github.com/slackhq/nebula/cert"
)

func main() {
	now := time.Now().Truncate(time.Second)

	// Assertion 1: NebulaCertificateDetails initializes with expected metadata fields (Name, Subnets, Groups, NotBefore, NotAfter, PublicKey, IsCA).
	caPub, caPriv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: failed to generate CA key: %v\n", err)
		os.Exit(1)
	}

	_, caSubnet, err := net.ParseCIDR("10.0.0.0/8")
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: parse CA subnet: %v\n", err)
		os.Exit(1)
	}

	caDetails := cert.NebulaCertificateDetails{
		Name:      "root-ca",
		Subnets:   []*net.IPNet{caSubnet},
		Groups:    []string{"default", "prod", "internal"},
		NotBefore: now.Add(-1 * time.Hour),
		NotAfter:  now.Add(48 * time.Hour),
		PublicKey: caPub,
		IsCA:      true,
	}

	caCert := &cert.NebulaCertificate{
		Details: caDetails,
	}

	if caCert.Details.Name != "root-ca" || !caCert.Details.IsCA || len(caCert.Details.Groups) != 3 {
		fmt.Fprintf(os.Stderr, "FAIL: caCert details mismatch\n")
		os.Exit(1)
	}

	// Assertion 2: NebulaCertificate.Sign and MarshalToPEM serialize NebulaCertificateDetails into a valid PEM block.
	if err := caCert.Sign(caPriv); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: caCert.Sign failed: %v\n", err)
		os.Exit(1)
	}

	caPem, err := caCert.MarshalToPEM()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: caCert.MarshalToPEM failed: %v\n", err)
		os.Exit(1)
	}
	if len(caPem) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: caPem is empty\n")
		os.Exit(1)
	}

	// Assertion 3: UnmarshalNebulaCertificateFromPEM parses PEM data, restoring NebulaCertificateDetails fields and populating InvertedGroups.
	parsedCACert, _, err := cert.UnmarshalNebulaCertificateFromPEM(caPem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: UnmarshalNebulaCertificateFromPEM failed: %v\n", err)
		os.Exit(1)
	}
	if parsedCACert.Details.Name != "root-ca" {
		fmt.Fprintf(os.Stderr, "FAIL: parsed CA name mismatch: got %q, want 'root-ca'\n", parsedCACert.Details.Name)
		os.Exit(1)
	}
	if !parsedCACert.Details.IsCA {
		fmt.Fprintf(os.Stderr, "FAIL: parsed CA IsCA mismatch\n")
		os.Exit(1)
	}
	if len(parsedCACert.Details.InvertedGroups) != 3 {
		fmt.Fprintf(os.Stderr, "FAIL: parsed CA InvertedGroups length mismatch\n")
		os.Exit(1)
	}
	if _, ok := parsedCACert.Details.InvertedGroups["prod"]; !ok {
		fmt.Fprintf(os.Stderr, "FAIL: parsed CA missing 'prod' in InvertedGroups\n")
		os.Exit(1)
	}

	caFingerprint, err := parsedCACert.Sha256Sum()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: ca Sha256Sum failed: %v\n", err)
		os.Exit(1)
	}

	// Node Certificate Setup
	nodePub, _, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: generate node key: %v\n", err)
		os.Exit(1)
	}

	_, nodeIPNet, err := net.ParseCIDR("10.0.1.10/24")
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: parse node CIDR: %v\n", err)
		os.Exit(1)
	}

	_, nodeSubnet, err := net.ParseCIDR("10.0.1.0/24")
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: parse node subnet CIDR: %v\n", err)
		os.Exit(1)
	}

	nodeDetails := cert.NebulaCertificateDetails{
		Name:      "test-node",
		Ips:       []*net.IPNet{nodeIPNet},
		Subnets:   []*net.IPNet{nodeSubnet},
		Groups:    []string{"default", "prod"},
		NotBefore: now.Add(-30 * time.Minute),
		NotAfter:  now.Add(24 * time.Hour),
		PublicKey: nodePub,
		IsCA:      false,
		Issuer:    caFingerprint,
	}

	nodeCert := &cert.NebulaCertificate{
		Details: nodeDetails,
	}
	if err := nodeCert.Sign(caPriv); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: nodeCert.Sign failed: %v\n", err)
		os.Exit(1)
	}

	nodePem, err := nodeCert.MarshalToPEM()
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: nodeCert.MarshalToPEM failed: %v\n", err)
		os.Exit(1)
	}

	parsedNodeCert, _, err := cert.UnmarshalNebulaCertificateFromPEM(nodePem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: parse node PEM failed: %v\n", err)
		os.Exit(1)
	}
	if parsedNodeCert.Details.Name != "test-node" {
		fmt.Fprintf(os.Stderr, "FAIL: node name mismatch\n")
		os.Exit(1)
	}
	if parsedNodeCert.Details.Issuer != caFingerprint {
		fmt.Fprintf(os.Stderr, "FAIL: node issuer mismatch: got %q, want %q\n", parsedNodeCert.Details.Issuer, caFingerprint)
		os.Exit(1)
	}
	if !bytes.Equal(parsedNodeCert.Details.PublicKey, nodePub) {
		fmt.Fprintf(os.Stderr, "FAIL: node public key mismatch\n")
		os.Exit(1)
	}

	// Assertion 4: NebulaCertificate.CheckRootConstrains verifies that child certificate Details conform to CA constraints.
	if err := parsedNodeCert.CheckRootConstrains(parsedCACert); err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: CheckRootConstrains failed on valid node: %v\n", err)
		os.Exit(1)
	}

	// Assertion 5: NebulaCertificate.CheckRootConstrains rejects child certificate Details violating CA groups, subnets, or validity.
	badGroupCert := &cert.NebulaCertificate{
		Details: cert.NebulaCertificateDetails{
			Name:      "bad-group-node",
			Ips:       []*net.IPNet{nodeIPNet},
			Groups:    []string{"unauthorized-group"},
			NotBefore: now.Add(-30 * time.Minute),
			NotAfter:  now.Add(24 * time.Hour),
			PublicKey: nodePub,
		},
	}
	if err := badGroupCert.CheckRootConstrains(parsedCACert); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: CheckRootConstrains should reject unauthorized group\n")
		os.Exit(1)
	}

	_, outsideSubnet, _ := net.ParseCIDR("192.168.1.0/24")
	badSubnetCert := &cert.NebulaCertificate{
		Details: cert.NebulaCertificateDetails{
			Name:      "bad-subnet-node",
			Subnets:   []*net.IPNet{outsideSubnet},
			Groups:    []string{"default"},
			NotBefore: now.Add(-30 * time.Minute),
			NotAfter:  now.Add(24 * time.Hour),
			PublicKey: nodePub,
		},
	}
	if err := badSubnetCert.CheckRootConstrains(parsedCACert); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: CheckRootConstrains should reject subnet outside CA scope\n")
		os.Exit(1)
	}

	badTimeCert := &cert.NebulaCertificate{
		Details: cert.NebulaCertificateDetails{
			Name:      "bad-time-node",
			Groups:    []string{"default"},
			NotBefore: now.Add(-30 * time.Minute),
			NotAfter:  now.Add(72 * time.Hour),
			PublicKey: nodePub,
		},
	}
	if err := badTimeCert.CheckRootConstrains(parsedCACert); err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: CheckRootConstrains should reject validity past CA expiry\n")
		os.Exit(1)
	}

	// Assertion 6: NebulaCertificate.Expired evaluates validity against NotBefore and NotAfter timestamps in NebulaCertificateDetails.
	if parsedNodeCert.Expired(now) {
		fmt.Fprintf(os.Stderr, "FAIL: node cert should not be expired at current time\n")
		os.Exit(1)
	}
	if !parsedNodeCert.Expired(now.Add(-2 * time.Hour)) {
		fmt.Fprintf(os.Stderr, "FAIL: node cert should be expired before NotBefore\n")
		os.Exit(1)
	}
	if !parsedNodeCert.Expired(now.Add(48 * time.Hour)) {
		fmt.Fprintf(os.Stderr, "FAIL: node cert should be expired after NotAfter\n")
		os.Exit(1)
	}

	// Assertion 7: NebulaCertificate.Verify validates signature and Details constraint hierarchy against a trusted NebulaCAPool.
	caPool, err := cert.NewCAPoolFromBytes(caPem)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: NewCAPoolFromBytes failed: %v\n", err)
		os.Exit(1)
	}

	valid, err := parsedNodeCert.Verify(now, caPool)
	if err != nil || !valid {
		fmt.Fprintf(os.Stderr, "FAIL: parsedNodeCert.Verify failed: valid=%v, err=%v\n", valid, err)
		os.Exit(1)
	}

	fmt.Println("PASS: all NebulaCertificateDetails contract assertions passed.")
}