eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Test unsigned replicated ops are rejected

Browse source
This commit is contained in:
Eric Wendland 2026-05-22 14:17:17 +02:00
commit 0ffc950dc6
4 changed files with 171 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
crates/geth/Cargo.toml
View file

@ -16,11 +16,13 @@ tracing-subscriber.workspace = true
geth-cli = { path = "../geth-cli" }
[dev-dependencies]
geth-auth = { path = "../geth-auth" }
geth-cas = { path = "../geth-cas" }
geth-config = { path = "../geth-config" }
geth-control = { path = "../geth-control" }
geth-discovery = { path = "../geth-discovery" }
geth-iroh = { path = "../geth-iroh" }
geth-keychain = { path = "../geth-keychain" }
geth-node = { path = "../geth-node" }
geth-ssh-identity = { path = "../geth-ssh-identity" }
geth-store = { path = "../geth-store" }

159
crates/geth/tests/bootstrap.rs
View file

@ -630,6 +630,165 @@ fn denied_remote_operations_do_not_mutate_serving_node_state() {
assert!(denied_admin_stdout.contains("ssh admin shell denied"));
}
#[test]
fn unsigned_keychain_and_auth_ops_are_rejected_during_peer_sync() {
let left_home = tempfile::tempdir().expect("left tempdir");
let right_home = tempfile::tempdir().expect("right tempdir");
if !unix_sockets_available(left_home.path()) || !unix_sockets_available(right_home.path()) {
return;
}
assert!(run_geth(left_home.path(), &["init"]).status.success());
assert!(run_geth(right_home.path(), &["init"]).status.success());
for home in [left_home.path(), right_home.path()] {
std::fs::write(
home.join("config.toml"),
"[iroh]\nrelay_mode = \"disabled\"\nlocal_discovery = false\n",
)
.expect("write config");
}
let mut left_daemon = spawn_daemon(left_home.path());
let mut right_daemon = spawn_daemon(right_home.path());
wait_for_socket(&left_home.path().join("run/geth.sock"));
wait_for_socket(&right_home.path().join("run/geth.sock"));
let left_card_path = left_home.path().join("left-peer-card.json");
let right_card_path = right_home.path().join("right-peer-card.json");
assert!(
run_geth(
left_home.path(),
&[
"peer",
"export",
"--out",
left_card_path.to_str().expect("left card path"),
],
)
.status
.success()
);
assert!(
run_geth(
right_home.path(),
&[
"peer",
"export",
"--out",
right_card_path.to_str().expect("right card path"),
],
)
.status
.success()
);
let right_card_json = std::fs::read_to_string(&right_card_path).expect("read right card");
let right_card: geth_discovery::PeerCard =
serde_json::from_str(&right_card_json).expect("decode right card");
assert!(
run_geth(
left_home.path(),
&[
"peer",
"import",
right_card_path.to_str().expect("right card path"),
],
)
.status
.success()
);
assert!(
run_geth(
right_home.path(),
&[
"peer",
"import",
left_card_path.to_str().expect("left card path"),
],
)
.status
.success()
);
let unsigned_keychain_op = geth_keychain::KeychainOp {
id: geth_types::AuthOpId::new("keychain-op:unsigned-user-add"),
created_at: geth_types::UnixMillis(10),
kind: geth_keychain::KeychainOpKind::UserAdd {
user: geth_types::UserId::new("user:unsigned"),
name: "Unsigned".to_owned(),
},
};
let unsigned_auth_op = geth_auth::AuthOp {
id: geth_types::AuthOpId::new("auth-op:unsigned-grant"),
resource: geth_types::ResourceId::new("resource:ssh-proxy:local"),
created_at: geth_types::UnixMillis(11),
kind: geth_auth::AuthOpKind::GrantCreate {
grant_id: "grant:unsigned".to_owned(),
principal: geth_types::PrincipalId::new("node:unsigned"),
capabilities: vec![geth_types::Capability::new("ssh_proxy.connect")],
},
};
let right_paths = geth_config::GethPaths::from_home(right_home.path());
let right_store =
geth_store::Store::open(&right_paths.metadata_db()).expect("open right store");
right_store
.insert_keychain_op(&geth_store::StoredKeychainOp {
op_id: unsigned_keychain_op.id.to_string(),
op_json: serde_json::to_string(&unsigned_keychain_op).expect("encode keychain op"),
created_at_ms: unsigned_keychain_op.created_at.0,
})
.expect("insert unsigned keychain op");
right_store
.insert_auth_op(&geth_store::StoredAuthOp {
op_id: unsigned_auth_op.id.to_string(),
resource_id: unsigned_auth_op.resource.to_string(),
op_json: serde_json::to_string(&unsigned_auth_op).expect("encode auth op"),
created_at_ms: unsigned_auth_op.created_at.0,
})
.expect("insert unsigned auth op");
let keychain_sync = run_geth(
left_home.path(),
&["keychain", "sync", right_card.node_id.as_str()],
);
let auth_sync = run_geth(
left_home.path(),
&["auth", "sync", right_card.node_id.as_str()],
);
let _ = left_daemon.kill();
let _ = right_daemon.kill();
let _ = left_daemon.wait();
let _ = right_daemon.wait();
assert!(
keychain_sync.status.success(),
"keychain sync stderr: {}",
String::from_utf8_lossy(&keychain_sync.stderr)
);
assert!(
auth_sync.status.success(),
"auth sync stderr: {}",
String::from_utf8_lossy(&auth_sync.stderr)
);
assert!(String::from_utf8_lossy(&keychain_sync.stdout).contains("invalid_ops_rejected: 1"));
assert!(String::from_utf8_lossy(&auth_sync.stdout).contains("invalid_ops_rejected: 1"));
let left_paths = geth_config::GethPaths::from_home(left_home.path());
let left_store = geth_store::Store::open(&left_paths.metadata_db()).expect("open left store");
assert!(
!left_store
.list_keychain_ops()
.expect("list left keychain ops")
.iter()
.any(|op| op.op_id == unsigned_keychain_op.id.as_str())
);
assert!(
!left_store
.list_auth_ops()
.expect("list left auth ops")
.iter()
.any(|op| op.op_id == unsigned_auth_op.id.as_str())
);
}
#[test]
fn peer_card_export_import_and_list_are_candidate_only() {
let source_home = tempfile::tempdir().expect("source tempdir");