Strengthen SHAKE XOF tests and cover peer-certificate FFI (#57)

The SHAKE output-length property tests asserted `final().size() ==
sample`, but the returned array's size comes from the Pony-side
allocation (`@pony_alloc`), not from what `EVP_DigestFinalXOF` wrote —
a silent no-op would pass. Replaced with known-answer unit tests at
two non-default lengths per variant, and the prefix-property tests
are now split into a small-range variant (2..15 / 2..31 bytes, no
anchor) and a large-range variant (16..256 / 32..256 with a KAT
anchor at the low end), so an all-zero XOF can't satisfy the
prefix equality at the anchored sizes.

`SSL_get1_peer_certificate` / `SSL_get_peer_certificate` had zero
runtime coverage — every net test ran with `set_client_verify(false)`
or an empty hostname, so `_verify_hostname` never ran and the FFI
binding was only checked at link time. Added a positive test (match
→ SSLReady → `connected`) and a negative test (mismatch → SSLAuthFail
→ `auth_failed`). Both use separate client and server SSLContexts;
the client context has no local certificate, so a regression that
returned the local cert instead of the peer cert would get NULL and
fail verification — distinguishing peer-cert retrieval from
local-cert retrieval.

`assets/cert.pem` and `assets/key.pem` regenerated. The prior cert
expired in April 2025 and had no subjectAltName, so it couldn't
support a hostname-verified test. The new cert has
`subjectAltName=DNS:localhost,IP:127.0.0.1`, is backdated to
2026-01-01 for clock-skew tolerance, and is valid for 100 years.
`_TestTCPSSLClientVerifyFalseWithHostname` switched to
`nomatch.example.com` so its "verify=false skips mismatch" intent
survives the new SAN.

Closes #49

Author: SeanTAllen

assets/cert.pem

@@ -1,20 +1,20 @@
 -----BEGIN CERTIFICATE-----
-MIIDLzCCAhegAwIBAgIJAI/o78XcM9NqMA0GCSqGSIb3DQEBBQUAMBkxFzAVBgNV
-BAoTDkZha2UgQXV0aG9yaXR5MB4XDTE1MDQxMTE3NTAwOVoXDTI1MDQwODE3NTAw
-OVowGTEXMBUGA1UEChMORmFrZSBBdXRob3JpdHkwggEiMA0GCSqGSIb3DQEBAQUA
-A4IBDwAwggEKAoIBAQDMy0Xuax1Ej1iCOemYdiLwaJ/B8UsCH2ztJVPHyw6HSxwa
-WNariJ/d24QLuF9YFx7Xq2oEJK7WJ+zQfnn+jnlQWKfDBFSagreSmOIKRYYkKya3
-JwqluKsXcqxXz//0PkL6gfRNrCsbPUVujTP3Ple5eRK1ilOxc0KaJwtRdYVEPWcU
-rv0CvuU7qDKMzBh2Lt3tPC8J6VNqvK5bsLBdhcxFU+OjL65VEGjIc33pHMGkQitl
-MpsFolqXYvMt/JPNdf3trPEg8eGHeK9+7AxmaRo4WLaFsYyV5Etwa8ox+p3gGL/I
-OpE2PDC1SqJ2HdnLgXK1I/LGRlrNQssfew/rfqdZAgMBAAGjejB4MB0GA1UdDgQW
-BBTUVbUqQanwnb1TzSj3VVOXHkPWsDBJBgNVHSMEQjBAgBTUVbUqQanwnb1TzSj3
-VVOXHkPWsKEdpBswGTEXMBUGA1UEChMORmFrZSBBdXRob3JpdHmCCQCP6O/F3DPT
-ajAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBlCZDD231UlS2FGOLK
-yesxakCcCxwuqw6rbldj0zCNNRqlZ8lPDrbbr2ECUBKj6kYVJfU93YaYVYSmSTaB
-41/GCfBWdNfPdP4q2kqpmKR5bCeiGYpFNajPLXTpmRvmIQ6NT1u86krIPYxle/02
-DgYatXMGanzcUCwrfSnkqZbyXBKRAxbhyJnLmkJ6HqIm5vs6hDw2KdtgwRw6koFJ
-+0unhRHDKjZgFuCveaFFzFFkf4tlGmei3ykR3KTLxY3f1+GPunqD7HgebrE/vLP5
-Bgc1g/KSVGuyqKt9eCnSUlJypbPbKpPjnUrtx00HChpfnKpqiAgHFuZhaxBGUBZD
-BccR
+MIIDNTCCAh2gAwIBAgIUJqPt0dWpXmZpKr8FKEpO3JvOFhswDQYJKoZIhvcNAQEL
+BQAwGzEZMBcGA1UECgwQUG9ueSBTU0wgVGVzdCBDQTAgFw0yNjAxMDEwMDAwMDBa
+GA8yMTI2MDEwMTAwMDAwMFowGzEZMBcGA1UECgwQUG9ueSBTU0wgVGVzdCBDQTCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOsuoTFDSdq+r2efmNlkMvjg
+CT5gk11LB6NUrQIiJ6ByUFn7RyL7+nSBqL06wQrrfwNmWEaWWq+CPb+t2v2XLj0/
+8GRaL9MiY69SqIJS/uMNbAn5ZKb7d1U7zx1+TVhf9x/P/vd0sjuO/76OtwxQo5jx
+6MR7hDiNPhmE7AskWA5y9Ja4JVsAv9JzlulWaImVTZt8nzOJnGqq8ElM9OgWI/JA
+dst1Y+rwwfqoJpqUZh8pns2C+JsdGBAdIZYqUpeDtiJfvOGnbN1hDFaNPbHd3b1F
+klxt+vDiIgSRCA2GGsxg4N/tp2prScebCd6FapXoUHRXla+nZ0K0xOH/2QQqBNUC
+AwEAAaNvMG0wHQYDVR0OBBYEFOceAy4+/6VvOMuVzUb4LUVW0RdOMB8GA1UdIwQY
+MBaAFOceAy4+/6VvOMuVzUb4LUVW0RdOMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcE
+fwAAATAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBJEqAdVMlk
+xd2XX+zDZH7pj6vwOen16I0fiUKNkq18Fx3lGo0QQJ6xCHQ6m63oMEYJiJhqRjP5
+CU8mIu9bAnpfkZCkRBS2BIm/qGymHyU/C8g2S9HZEh//SmtWluk5O9tG+dKq9b34
+d+xH7N6gXL51jiulkQNbawWbPthFl6NLQaPHP3WuFmYn0FmyoKYuL0JLFO3bB6CX
+RwfYIb6y1XlE6RxikzV/BJ5FkDwQVbeIELAxtKi6PX94+zrxvt76XDtxWK2Ge4Mh
+94hZRkp5cLCNlZrCqYORi3a3aCqOjzMucNqL3Ld42G0QaIHy/EfEzdiGcxEQhiTI
+0tAjVsKAywQQ
 -----END CERTIFICATE-----

assets/key.pem

@@ -1,27 +1,28 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEAzMtF7msdRI9YgjnpmHYi8GifwfFLAh9s7SVTx8sOh0scGljW
-q4if3duEC7hfWBce16tqBCSu1ifs0H55/o55UFinwwRUmoK3kpjiCkWGJCsmtycK
-pbirF3KsV8//9D5C+oH0TawrGz1Fbo0z9z5XuXkStYpTsXNCmicLUXWFRD1nFK79
-Ar7lO6gyjMwYdi7d7TwvCelTaryuW7CwXYXMRVPjoy+uVRBoyHN96RzBpEIrZTKb
-BaJal2LzLfyTzXX97azxIPHhh3ivfuwMZmkaOFi2hbGMleRLcGvKMfqd4Bi/yDqR
-NjwwtUqidh3Zy4FytSPyxkZazULLH3sP636nWQIDAQABAoIBADvxuAt8gPmjd8XO
-i8ibs8ho53JOXaVGa4zSoz5U+nCxlI1FubhF6n13FqSTmBzhz55TR1nlHuQClbfF
-fZH8RBg3iwtzRgxf/LnFVEyrYwNNOizcGaq+bh4T68xcTtBANTy8MzVVEt0LRzp/
-zFkvf2ADx20qCyti0HjsusxiONrrFBS6O7DTss9GFRN5lfsBP49FSl3/r0e+fUaO
-/6ImRVJvmAU92+dQ4VOi4c+laeFDmhw1MQSpvHOz3Vrslin9NSR6TMQ7rH9I/QKL
-+YQULz7fYINRwt8FBa/p94qjGIqlNz6UdTPGvaEMlVyYo1ziTDZlCHnAYWk3wiFW
-s13Jct0CgYEA7PxGYpZCyzntd1wvOradxh7EbUrF68lhfDt6BgOBV8Ur3/4SvcwB
-blc4nEf5/p/x9w8ICe4uyA0bsGwqGppIhptrPe0uLApidUrxNeqY5zsebriR/gE6
-mq5/cmScFTnywfAb/93qK5SMzeWKfocPozb5YqO8oJpPHPhVZYAj16MCgYEA3TnH
-14szOoQSq8ul2tFdu7s9S+sfi1l7ejqiHjZVcMST+GyEk3ox5Ns24pwkRq80cQhp
-1UYfapeeiYroW7nkVTqJUfZbilFO6eKCBfpzC7NGHMs86er3pLUrfHQKq6S5RSZr
-W9CB7+Kd9OXMOIJ2yXcF+OyEzQH5ESwxoHvrJNMCgYEAz/o6Hw01wzqsP2Mkg8d+
-QUABLNVBS0NpjWh5F0v+ODPu5F4KvoyJ+PcM1IKKUD64UBTd/jEM1z5BvZu/e6dI
-3PEKtccwDTBz5fIGLEYdOFj2xT6vyRX1A4j+ijrni+1WMYNyXyO2/dYZmBzJZW9M
-dvWo+TsvMFcb9RWvhCtnyTcCgYAyK9t9r60TlUZivdHEeX0HiWRSZmWGBeoyA0An
-F+1yoLJqQbojdDAClhCxffXgLfX3uI+/9aJEW1RyHxWpT9RP2/Guq++AxAXglyUj
-0/PpcGPzPch3yHkXWpsdI3gUC0yVOSxZ60S8salfFAqnujbUY/Dvzjwj/lGNKneq
-zM+8TwKBgHjQforDq00DhDAqzqZDDVd8OZ9PLp3wXL+TaidTMmU7Fob5spyQe0gn
-LqVIyGFYoRbW57pLgSEXRh+Zqw1AAKmMYoc3/pKM60rgOQxMXEemFAJ8zuDQ5L6y
-1dR3ak4ueRcSFpa6x8/STsgIuL38HMNXhStsJB9whHAFB3U6Wo2/
------END RSA PRIVATE KEY-----
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDrLqExQ0navq9n
+n5jZZDL44Ak+YJNdSwejVK0CIiegclBZ+0ci+/p0gai9OsEK638DZlhGllqvgj2/
+rdr9ly49P/BkWi/TImOvUqiCUv7jDWwJ+WSm+3dVO88dfk1YX/cfz/73dLI7jv++
+jrcMUKOY8ejEe4Q4jT4ZhOwLJFgOcvSWuCVbAL/Sc5bpVmiJlU2bfJ8ziZxqqvBJ
+TPToFiPyQHbLdWPq8MH6qCaalGYfKZ7NgvibHRgQHSGWKlKXg7YiX7zhp2zdYQxW
+jT2x3d29RZJcbfrw4iIEkQgNhhrMYODf7adqa0nHmwnehWqV6FB0V5Wvp2dCtMTh
+/9kEKgTVAgMBAAECggEAL76f7VEYh37CO9J/9JQ9r95FqiLvj9dJVex9EguOiWlj
+rBzR+IV4t1nSQJZSte2Qs8c9gRkJkItrj0QTivt74OXf3vObNW0MGT355TlFsyEY
+r56wgyDWfVh+x+FKAPi8gfoXLDQF8gbqHwy4lxiw2b40r9zWfyeXdZVRWUK32Li0
+fmuGUKYhSJHOQ2wtRHPVQL5eV328n93+krsJAcUpYt5OgX0WNLSNodj0Z6x+d9C8
+wbojGzZ4ohui1myRVqN5nZPyP/JlObBGzkeVv7DGJb5KnetIDMFGWKKaDKh+dBIh
+GXUir15N3Jelh9e9GaoIVSkPMkprmvBl5hbX7CorIQKBgQD/o8c+dtcBfnafhDbn
+jHO0uVrz9irGOX4x+IPsSON0DRr6mUyLdzMMAJQnHLVbhBVUwzzGI5lT6CpXmW3P
+/qP2R85bWp1kAthfx6rnFKKNsa1qLP2ca5vJC5KdLsHVZh5m7jDZkNiHTIB1K/Xh
+/OfAR4HmgGa/R5ceTaRAtqeldQKBgQDrg3inbicZXnfVp+kcKYOZOmrrL5ebE39n
+rDZ6Z2ed47gHZpNj40hLVFAmorI2HmRbAIGqWPe9svdOk9lt87/MnBXnUF88gBch
+rbS2REngaXuzrO1xV7g+gg4XOTWXHGkA8HBjuYb122RFwDi6UGl7IFW0MybHWMvt
+NuJLBmMV4QKBgBUiSxSE6p17AP+LBKb724zzTeuhTEP6+M3Ux8M++17avoI9LjDR
+d+zkF1tsainYr5LEWT/gLYrcRLPdQVDSsmdn5E11HlHoUk8IyL413IJuT/HZKlZG
+JyjlxgcsmGW1/Ylw46T47o2w62XEbp1yNQ6WWszdjKD/oCSnMo8PCqkJAoGBAOTu
+GmVePOF7I69rFbzLWeGjmHTfAVa8ADdtflNDmsQurB99hT4um4KmBXdY5TSYHGMd
+Pe2xp7gddCpMq6kmrEUfYGdGiBzOQi35pVUbUlizEIzaRsDLTQxt7XaDpOUrt6Iz
+FnzJxjfMuE7ZCAuLyMzn5IdSxZo3ZZtDo3rcTYrhAoGASNYytkqh9FG1WdCevb1y
+iZaynjYf4HbwGesCJFrB/MULfWGV8I5sazJfnAyHGNsH2w1AoB0Mg0KXiovrVx6k
+Ow8z5eB95XzIO/AcE4o2Gb1rWjCpaoEeerno/CM9AJfpM4TSMIAqc3hl0104+3bl
+QpZNekXjbdQrh/uMZHioNxc=
+-----END PRIVATE KEY-----

ssl/crypto/_test.pony

@@ -30,8 +30,10 @@ actor \nodoc\ Main is TestList
       test(Property1UnitTest[USize](_TestPbkdf2Sha256Deterministic))
     end
     ifdef "openssl_3.0.x" or "openssl_4.0.x" then
-      test(Property1UnitTest[USize](_TestShake128OutputLength))
-      test(Property1UnitTest[USize](_TestShake256OutputLength))
+      test(_TestShake128KnownAnswer)
+      test(_TestShake256KnownAnswer)
+      test(Property1UnitTest[USize](_TestShake128XofPrefixSmall))
+      test(Property1UnitTest[USize](_TestShake256XofPrefixSmall))
       test(Property1UnitTest[USize](_TestShake128XofPrefix))
       test(Property1UnitTest[USize](_TestShake256XofPrefix))
     end
@@ -446,37 +448,103 @@ class \nodoc\ iso _TestRandBytesNonConstant is Property1[USize]
     let b = RandBytes(sample)?
     h.assert_false(ConstantTimeCompare(a, b))
 
-class \nodoc\ iso _TestShake128OutputLength is Property1[USize]
-  fun name(): String => "crypto/Shake128/property/output_length"
+class \nodoc\ iso _TestShake128KnownAnswer is UnitTest
+  """
+  Known-answer tests for SHAKE128 at two non-default output lengths.
+  Anchors the XOF path against specific byte values so a silent no-op
+  (zero bytes written) cannot pass.
+  """
+  fun name(): String => "crypto/Shake128/known_answer"
 
-  fun gen(): Generator[USize] =>
-    Generators.usize(1, 256)
+  fun apply(h: TestHelper) ? =>
+    ifdef "openssl_3.0.x" or "openssl_4.0.x" then
+      let d32 = Digest.shake128(32)
+      d32.append("message1")?
+      d32.append("message2")?
+      h.assert_eq[String](
+        "0d11671f23b6356bdf4ba8dcae37419df1d0875e1a15c7859eb3ba0096aa262f",
+        ToHexString(d32.final()))
 
-  fun ref property(sample: USize, h: PropertyHelper) ? =>
+      let d64 = Digest.shake128(64)
+      d64.append("message1")?
+      d64.append("message2")?
+      h.assert_eq[String](
+        "0d11671f23b6356bdf4ba8dcae37419df1d0875e1a15c7859eb3ba0096aa262f" +
+        "3a1cfc86db5b324ac3f8220645ec0740c2171a0b935f362d0c3bfa5ab51be5d0",
+        ToHexString(d64.final()))
+    end
+
+class \nodoc\ iso _TestShake256KnownAnswer is UnitTest
+  """
+  Known-answer tests for SHAKE256 at two non-default output lengths.
+  Anchors the XOF path against specific byte values so a silent no-op
+  (zero bytes written) cannot pass.
+  """
+  fun name(): String => "crypto/Shake256/known_answer"
+
+  fun apply(h: TestHelper) ? =>
     ifdef "openssl_3.0.x" or "openssl_4.0.x" then
-      let d = Digest.shake128(sample)
-      d.append("test")?
-      h.assert_eq[USize](sample, d.final().size())
+      let d64 = Digest.shake256(64)
+      d64.append("message1")?
+      d64.append("message2")?
+      h.assert_eq[String](
+        "80e2bbb14639e3b1fc1df80b47b67fb518b0ed26a1caddfa10d68f7992c33820" +
+        "2d0b17a5ebbcef93f51247497f60bcd3f2809a967874d017ef5b51d6b08836cc",
+        ToHexString(d64.final()))
+
+      let d128 = Digest.shake256(128)
+      d128.append("message1")?
+      d128.append("message2")?
+      h.assert_eq[String](
+        "80e2bbb14639e3b1fc1df80b47b67fb518b0ed26a1caddfa10d68f7992c33820" +
+        "2d0b17a5ebbcef93f51247497f60bcd3f2809a967874d017ef5b51d6b08836cc" +
+        "af79f3db3fafdf89e7d42270472c3d1a8e55c52a30859e01b5fceba359c21c1e" +
+        "76b73180378604d46061c87e65c4740c8ff9721ed16465cef66fefc3c6f2070c",
+        ToHexString(d128.final()))
     end
 
-class \nodoc\ iso _TestShake256OutputLength is Property1[USize]
-  fun name(): String => "crypto/Shake256/property/output_length"
+class \nodoc\ iso _TestShake128XofPrefixSmall is Property1[USize]
+  """
+  SHAKE128 prefix property at small output sizes (2..15 bytes). Exercises
+  the truncation path where off-by-one partial-block bugs typically live.
+  No KAT anchor — sizes below 16 are guarded by _TestShake128XofPrefix
+  at larger sizes.
+  """
+  fun name(): String => "crypto/Shake128/property/xof_prefix_small"
 
   fun gen(): Generator[USize] =>
-    Generators.usize(1, 256)
+    Generators.usize(2, 15)
 
   fun ref property(sample: USize, h: PropertyHelper) ? =>
     ifdef "openssl_3.0.x" or "openssl_4.0.x" then
-      let d = Digest.shake256(sample)
-      d.append("test")?
-      h.assert_eq[USize](sample, d.final().size())
+      let small_size = sample / 2
+      let large_size = sample
+
+      let small = Digest.shake128(small_size)
+      small.append("test input")?
+      let small_result = small.final()
+
+      let large = Digest.shake128(large_size)
+      large.append("test input")?
+      let large_result = large.final()
+
+      h.assert_array_eq[U8](small_result,
+        large_result.trim(0, small_size))
     end
 
 class \nodoc\ iso _TestShake128XofPrefix is Property1[USize]
+  """
+  SHAKE128 prefix property: the first N bytes of output at length M (M > N)
+  are identical to the full output at length N. A KAT anchor at the full
+  length prevents any no-op or incorrect XOF implementation from satisfying
+  the prefix equality (an all-zero buffer would trivially equal its own
+  prefix).
+  """
   fun name(): String => "crypto/Shake128/property/xof_prefix"
 
   fun gen(): Generator[USize] =>
-    Generators.usize(2, 256)
+    // Minimum 16 so the 16-byte KAT anchor below always applies.
+    Generators.usize(16, 256)
 
   fun ref property(sample: USize, h: PropertyHelper) ? =>
     ifdef "openssl_3.0.x" or "openssl_4.0.x" then
@@ -491,15 +559,57 @@ class \nodoc\ iso _TestShake128XofPrefix is Property1[USize]
       large.append("test input")?
       let large_result = large.final()
 
+      h.assert_array_eq[U8](small_result,
+        large_result.trim(0, small_size))
+
+      // KAT anchor: first 16 bytes of SHAKE128("test input").
+      h.assert_eq[String](
+        "a9d2b0362d0e2e961eeb969ce9a42f2d",
+        ToHexString(large_result.trim(0, 16)))
+    end
+
+class \nodoc\ iso _TestShake256XofPrefixSmall is Property1[USize]
+  """
+  SHAKE256 prefix property at small output sizes (2..31 bytes). Exercises
+  the truncation path where off-by-one partial-block bugs typically live.
+  No KAT anchor — sizes below 32 are guarded by _TestShake256XofPrefix
+  at larger sizes.
+  """
+  fun name(): String => "crypto/Shake256/property/xof_prefix_small"
+
+  fun gen(): Generator[USize] =>
+    Generators.usize(2, 31)
+
+  fun ref property(sample: USize, h: PropertyHelper) ? =>
+    ifdef "openssl_3.0.x" or "openssl_4.0.x" then
+      let small_size = sample / 2
+      let large_size = sample
+
+      let small = Digest.shake256(small_size)
+      small.append("test input")?
+      let small_result = small.final()
+
+      let large = Digest.shake256(large_size)
+      large.append("test input")?
+      let large_result = large.final()
+
       h.assert_array_eq[U8](small_result,
         large_result.trim(0, small_size))
     end
 
 class \nodoc\ iso _TestShake256XofPrefix is Property1[USize]
+  """
+  SHAKE256 prefix property: the first N bytes of output at length M (M > N)
+  are identical to the full output at length N. A KAT anchor at the full
+  length prevents any no-op or incorrect XOF implementation from satisfying
+  the prefix equality (an all-zero buffer would trivially equal its own
+  prefix).
+  """
   fun name(): String => "crypto/Shake256/property/xof_prefix"
 
   fun gen(): Generator[USize] =>
-    Generators.usize(2, 256)
+    // Minimum 32 so the 32-byte KAT anchor below always applies.
+    Generators.usize(32, 256)
 
   fun ref property(sample: USize, h: PropertyHelper) ? =>
     ifdef "openssl_3.0.x" or "openssl_4.0.x" then
@@ -516,6 +626,11 @@ class \nodoc\ iso _TestShake256XofPrefix is Property1[USize]
 
       h.assert_array_eq[U8](small_result,
         large_result.trim(0, small_size))
+
+      // KAT anchor: first 32 bytes of SHAKE256("test input").
+      h.assert_eq[String](
+        "e952d90136cb23413ff22b266e2f5dd42294a34bc311394b04863c039011f179",
+        ToHexString(large_result.trim(0, 32)))
     end
 
 class \nodoc\ iso _TestHashFnOutputLength is Property1[USize]