A node is known by a key it generated
The thing I had been calling blocked for weeks, built in an afternoon once it was pointed out that it was already decided. 08-connectivity says of the overlay keys: each node generates its own keypair, the private half never leaves the machine, the public half is published -- and says outright this IS ADR 0004's "a node holds its own identity". Nobody had applied it to node identity itself. identity now holds the public half of each node's key. Only the public half, which is the property worth having: a copy of this database is a list of who to believe, not a set of credentials, so compromise of a node really is compromise of only that node. Exactly one key is live per node, and re-enrolment revokes the one it replaced in the same transaction -- two live identities is the stolen-laptop case with the replaced machine still believed. Fault injection was worth the time here. Three findings. The unique index was defended by no test at all: sequential enrolment is already safe because the code revokes before inserting, so removing the constraint changed nothing. The constraint only matters when two enrolments race, and there is now a test that runs six at once and fails without it. My injection harness also lied to me. One injection matched nothing, changed no file, and reported NO BITE identically to a real one -- so a test that defends nothing and an injection that does nothing look the same. The harness now checksums the files and says NO-OP when they did not change. And one honest NO BITE left standing: making the key lookup return a zero key for an unknown node does not fail the test, because the signature check refuses it a line later. Two independent mechanisms, not a placebo. 61 tests, none skipped.
This commit is contained in:
@@ -1,7 +1,9 @@
|
||||
package identity
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
@@ -203,3 +205,213 @@ func TestTheFingerprintIsOfThePublicHalf(t *testing.T) {
|
||||
t.Error("the fingerprint does not depend on the key")
|
||||
}
|
||||
}
|
||||
|
||||
func TestANodeIsVerifiedByAKeyItGenerated(t *testing.T) {
|
||||
// The whole of proving a node is that node. The mesh holds only the public half, so this
|
||||
// verification is the same operation the node performs on every declaration, in reverse.
|
||||
ident := fresh(t)
|
||||
public, private, err := ed25519.GenerateKey(nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
node := uuid(t)
|
||||
|
||||
if _, err := ident.RecordNodeKey(t.Context(), node, public); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
challenge := []byte("prove you are that node")
|
||||
if err := ident.VerifyNode(t.Context(), node, challenge, ed25519.Sign(private, challenge)); err != nil {
|
||||
t.Fatalf("a node signing with its own key was refused: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestAnotherMachinesKeyDoesNotIdentifyThisNode(t *testing.T) {
|
||||
ident := fresh(t)
|
||||
mine, _, err := ed25519.GenerateKey(nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, theirPrivate, err := ed25519.GenerateKey(nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
node := uuid(t)
|
||||
if _, err := ident.RecordNodeKey(t.Context(), node, mine); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
challenge := []byte("prove you are that node")
|
||||
err = ident.VerifyNode(t.Context(), node, challenge, ed25519.Sign(theirPrivate, challenge))
|
||||
if !errors.Is(err, ErrNotThisNode) {
|
||||
t.Fatalf("a different machine's signature was accepted: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestReEnrolmentRevokesTheMachineItReplaced(t *testing.T) {
|
||||
// novox/hq ADR 0004's stolen-laptop case. Two live identities for one node record means the
|
||||
// machine that was replaced goes on being believed, which is the thing revocation exists for.
|
||||
ident := fresh(t)
|
||||
node := uuid(t)
|
||||
oldPublic, oldPrivate, err := ed25519.GenerateKey(nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := ident.RecordNodeKey(t.Context(), node, oldPublic); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
newPublic, newPrivate, err := ed25519.GenerateKey(nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := ident.RecordNodeKey(t.Context(), node, newPublic); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
challenge := []byte("still me?")
|
||||
if err := ident.VerifyNode(t.Context(), node, challenge, ed25519.Sign(oldPrivate, challenge)); !errors.Is(err, ErrNotThisNode) {
|
||||
t.Error("the replaced machine is still believed")
|
||||
}
|
||||
if err := ident.VerifyNode(t.Context(), node, challenge, ed25519.Sign(newPrivate, challenge)); err != nil {
|
||||
t.Errorf("the new machine was refused: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestOnlyOneKeyIsEverLiveForANode(t *testing.T) {
|
||||
// Enforced by the database rather than by the order of two statements, because the window
|
||||
// between them is exactly when two live identities would exist.
|
||||
ident := fresh(t)
|
||||
node := uuid(t)
|
||||
for i := 0; i < 4; i++ {
|
||||
public, _, err := ed25519.GenerateKey(nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := ident.RecordNodeKey(t.Context(), node, public); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
var live int
|
||||
if err := ident.store.Pool().QueryRow(t.Context(),
|
||||
`select count(*) from node_key where node = $1 and revoked is null`, node).Scan(&live); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if live != 1 {
|
||||
t.Errorf("%d live keys for one node; exactly one may be", live)
|
||||
}
|
||||
}
|
||||
|
||||
func TestOnlyThePublicHalfIsEverStored(t *testing.T) {
|
||||
// The property that makes a copy of this database worthless to whoever takes it: it is a list
|
||||
// of who to believe, not a set of credentials.
|
||||
ident := fresh(t)
|
||||
public, private, err := ed25519.GenerateKey(nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
node := uuid(t)
|
||||
if _, err := ident.RecordNodeKey(t.Context(), node, public); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
var stored []byte
|
||||
if err := ident.store.Pool().QueryRow(t.Context(),
|
||||
`select public from node_key where node = $1`, node).Scan(&stored); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(stored) != ed25519.PublicKeySize {
|
||||
t.Errorf("stored %d bytes for a node key; a public key is %d and a private key is %d",
|
||||
len(stored), ed25519.PublicKeySize, ed25519.PrivateKeySize)
|
||||
}
|
||||
if bytes.Contains(private, stored) && bytes.Contains(stored, private[:32]) {
|
||||
t.Error("what is stored looks like part of the private key")
|
||||
}
|
||||
}
|
||||
|
||||
func TestAnUnknownNodeAndARevokedKeyAreRefusedAlike(t *testing.T) {
|
||||
ident := fresh(t)
|
||||
_, private, err := ed25519.GenerateKey(nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
challenge := []byte("hello")
|
||||
err = ident.VerifyNode(t.Context(), uuid(t), challenge, ed25519.Sign(private, challenge))
|
||||
if !errors.Is(err, ErrNotThisNode) {
|
||||
t.Fatalf("an unknown node gave %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestSomethingThatIsNotAKeyIsRefused(t *testing.T) {
|
||||
ident := fresh(t)
|
||||
if _, err := ident.RecordNodeKey(t.Context(), uuid(t), []byte("far too short")); err == nil {
|
||||
t.Fatal("a truncated key was recorded as a node's identity")
|
||||
}
|
||||
}
|
||||
|
||||
// uuid gives each test its own node id. The node records live in another context's database
|
||||
// (novox/hq ADR 0008), so there is nothing here to reference and nothing to create.
|
||||
func uuid(t *testing.T) string {
|
||||
t.Helper()
|
||||
var id string
|
||||
if err := freshConn(t).QueryRow(t.Context(), `select gen_random_uuid()`).Scan(&id); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return id
|
||||
}
|
||||
|
||||
func freshConn(t *testing.T) *pgx.Conn {
|
||||
t.Helper()
|
||||
conn, err := pgx.Connect(t.Context(), os.Getenv("MESH_TEST_POSTGRES"))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Cleanup(func() { conn.Close(context.Background()) })
|
||||
return conn
|
||||
}
|
||||
|
||||
func TestTwoEnrolmentsAtOnceStillLeaveOneLiveKey(t *testing.T) {
|
||||
// The case the database constraint is for, and the only one: sequential calls are already
|
||||
// safe because RecordNodeKey revokes before it inserts. Two at once both revoke what they
|
||||
// found and both insert, and without the partial unique index the node ends with two live
|
||||
// identities — the replaced machine still believed, which is the whole thing revocation
|
||||
// exists to prevent.
|
||||
//
|
||||
// Some of these are expected to fail. What must not happen is two of them succeeding.
|
||||
ident := fresh(t)
|
||||
node := uuid(t)
|
||||
|
||||
var wg sync.WaitGroup
|
||||
errs := make([]error, 6)
|
||||
for i := range errs {
|
||||
public, _, err := ed25519.GenerateKey(nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
wg.Add(1)
|
||||
go func(i int, public ed25519.PublicKey) {
|
||||
defer wg.Done()
|
||||
_, errs[i] = ident.RecordNodeKey(context.Background(), node, public)
|
||||
}(i, public)
|
||||
}
|
||||
wg.Wait()
|
||||
|
||||
var live int
|
||||
if err := ident.store.Pool().QueryRow(t.Context(),
|
||||
`select count(*) from node_key where node = $1 and revoked is null`, node).Scan(&live); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if live != 1 {
|
||||
t.Errorf("%d live keys after six concurrent enrolments; exactly one may be live", live)
|
||||
}
|
||||
|
||||
succeeded := 0
|
||||
for _, err := range errs {
|
||||
if err == nil {
|
||||
succeeded++
|
||||
}
|
||||
}
|
||||
if succeeded == 0 {
|
||||
t.Error("every concurrent enrolment failed; at least one must win")
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user