eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

test: cover adversarial auth diagnostics

Browse source
This commit is contained in:
Eric Wendland 2026-07-05 23:12:01 +02:00
commit f06db17066
3 changed files with 120 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

45
crates/geth-node/src/lib.rs
View file

@ -4328,32 +4328,49 @@ fn explain_auth_for_operator(
}
let peer_card = store.get_peer_card(subject)?;
let keychain_view = geth_keychain::reduce_keychain_ops(&load_keychain_ops(store)?);
let keychain_ops = load_keychain_ops(store)?;
let keychain_view = geth_keychain::reduce_keychain_ops(&keychain_ops);
let subject_node = NodeId::new(subject.to_owned());
let trusted_node = keychain_view.nodes.get(&subject_node);
let revoked_node = keychain_node_is_currently_revoked(&keychain_ops, &subject_node);
match (trusted_node, peer_card) {
(None, Some(_)) => {
explanation.add_diagnostic("subject:discovered-only");
if revoked_node {
explanation.add_diagnostic("subject:revoked-node");
} else {
explanation.add_diagnostic("subject:discovered-only");
}
explanation.add_diagnostic("trust:missing");
if !explanation
.reason
.contains("discovery does not grant trust or authorization")
{
let subject_state = if revoked_node {
"subject is a revoked node with only a discovered peer card remaining"
} else {
"subject is a discovered peer candidate only"
};
explanation.reason = format!(
"subject is a discovered peer candidate only; discovery does not grant trust or authorization; {}",
"{subject_state}; discovery does not grant trust or authorization; {}",
explanation.reason
);
}
}
(None, None) => {
explanation.add_diagnostic("subject:unknown");
if revoked_node {
explanation.add_diagnostic("subject:revoked-node");
} else {
explanation.add_diagnostic("subject:unknown");
}
explanation.add_diagnostic("trust:missing");
if !explanation.allowed {
explanation.reason = format!(
"subject is not present in the keychain and has no discovered peer card; {}",
explanation.reason
);
let subject_state = if revoked_node {
"subject was revoked from the active keychain"
} else {
"subject is not present in the keychain and has no discovered peer card"
};
explanation.reason = format!("{subject_state}; {}", explanation.reason);
}
}
(Some(node), None) => {
@ -4406,6 +4423,18 @@ fn explain_auth_for_operator(
Ok(explanation)
}
fn keychain_node_is_currently_revoked(ops: &[KeychainOp], node: &NodeId) -> bool {
let mut revoked = false;
for op in ops {
match &op.kind {
KeychainOpKind::NodeAdd { node: op_node, .. } if op_node == node => revoked = false,
KeychainOpKind::NodeRevoke { node: op_node } if op_node == node => revoked = true,
_ => {}
}
}
revoked
}
fn bearer_proof(
bearer_secret: Option<String>,
resource: &str,