eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test: cover adversarial auth diagnostics

Browse source
This commit is contained in:
Eric Wendland 2026-07-05 23:12:01 +02:00
commit f06db17066
3 changed files with 120 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

74
crates/geth/tests/bootstrap.rs
View file

@ -2616,9 +2616,45 @@ fn auth_explain_distinguishes_endpoint_binding_state() {
other => panic!("unexpected response: {other:?}"),
}
let mismatched_endpoint_op = geth_keychain::KeychainOp {
id: "op:node:endpoint:mismatch".into(),
created_at: geth_types::UnixMillis(created_at + 5),
kind: geth_keychain::KeychainOpKind::NodeEndpointAdd {
node: "node:trusted".into(),
endpoint: "endpoint:not-in-card".to_owned(),
},
};
store
.insert_keychain_op(&geth_store::StoredKeychainOp {
op_id: mismatched_endpoint_op.id.to_string(),
op_json: serde_json::to_string(&mismatched_endpoint_op).expect("endpoint op json"),
created_at_ms: mismatched_endpoint_op.created_at.0,
})
.expect("insert mismatched endpoint op");
let mismatched = geth_node::handle_request(
&node,
geth_control::ControlRequest::AuthExplain {
subject: "node:trusted".to_owned(),
resource: "resource:cas:local".to_owned(),
capability: "cas.fetch".to_owned(),
},
)
.expect("explain mismatched endpoint binding");
match mismatched {
geth_control::ControlResponse::AuthExplain(explanation) => {
assert!(!explanation.allowed);
assert!(
explanation
.diagnostics
.contains(&"endpoint-binding:missing-for-peer-card".to_owned())
);
}
other => panic!("unexpected response: {other:?}"),
}
let endpoint_op = geth_keychain::KeychainOp {
id: "op:node:endpoint:add".into(),
created_at: geth_types::UnixMillis(created_at + 5),
created_at: geth_types::UnixMillis(created_at + 6),
kind: geth_keychain::KeychainOpKind::NodeEndpointAdd {
node: "node:trusted".into(),
endpoint: "endpoint:card-only".to_owned(),
@ -2651,6 +2687,42 @@ fn auth_explain_distinguishes_endpoint_binding_state() {
}
other => panic!("unexpected response: {other:?}"),
}
let revoke_op = geth_keychain::KeychainOp {
id: "op:node:revoke".into(),
created_at: geth_types::UnixMillis(created_at + 7),
kind: geth_keychain::KeychainOpKind::NodeRevoke {
node: "node:trusted".into(),
},
};
store
.insert_keychain_op(&geth_store::StoredKeychainOp {
op_id: revoke_op.id.to_string(),
op_json: serde_json::to_string(&revoke_op).expect("revoke op json"),
created_at_ms: revoke_op.created_at.0,
})
.expect("insert revoke op");
let revoked = geth_node::handle_request(
&node,
geth_control::ControlRequest::AuthExplain {
subject: "node:trusted".to_owned(),
resource: "resource:cas:local".to_owned(),
capability: "cas.fetch".to_owned(),
},
)
.expect("explain revoked node");
match revoked {
geth_control::ControlResponse::AuthExplain(explanation) => {
assert!(!explanation.allowed);
assert!(
explanation
.diagnostics
.contains(&"subject:revoked-node".to_owned())
);
assert!(explanation.reason.contains("revoked node"));
}
other => panic!("unexpected response: {other:?}"),
}
}
#[test]