amadan

carlos / platform Public

edge: make the e2e's wildcard refusal load-bearing, and correct two docs

Review findings, code half.

The e2e's #180 sub-assertion was vacuous: it asked for a token cert under
an invented label with no such object in the bucket, so nil proved only
that the bucket was empty — it passed even with KnownHost deliberately
leaking through Home()'s one-label rule (verified by injecting exactly
that leak). Now the token cert is PUT first and the label is asserted
dialable, so the refusal is the gate's; with the leak injected the
subtest fails as it should.

Two doc corrections: the test's opening prose said "a member points a
custom domain's A record" — an attached custom domain lands in
route_aliases, which edgesFilePass never publishes, so no alias is in any
home map; the scene is an exactly-named registry ROUTE and now says so.
And KnownHost's own doc claimed an unlabelled box's own hosts pass
Allowed "regardless", which is true only modulo edges-file staleness.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Paul Campbell pushed by paul@keymail.dev ca44834aee69cc78a6274b5126455209fbc9f4d4 parent 2090d3b
2 files changed, +29 −10
  • internal/edge/certsync_e2e_test.go +26 −9
  • internal/edge/homemap.go +3 −1
diff --git a/internal/edge/certsync_e2e_test.go b/internal/edge/certsync_e2e_test.go
index 7eef19508..03de19a88 100644
--- a/internal/edge/certsync_e2e_test.go
+++ b/internal/edge/certsync_e2e_test.go
@@ -1163,13 +1163,19 @@ func TestCertSyncE2EConcurrentRefreshIsRaceFree(t *testing.T) {
// every host in its own route table).
const e2eRemoteHomedHost = "remote.bab.example.test"
-// The automated shadow of the dev proof that failed as #277: a member points
-// a custom domain's A record at edge B, which homes nothing for that name. B
-// backhauls to A, A (the issuer) sees the hello and orders, and the CA then
-// validates against B — the box whose registry has never heard of the host.
-// Before the widening, B refused the challenge, every authorization failed,
-// and the name's Let's Encrypt budget went in minutes. After it, B answers
-// out of the bucket, A mints, and the certificate reaches B's mirror.
+// The automated shadow of the dev proof that failed as #277: DNS for an
+// exactly-named registry ROUTE points at edge B, which homes nothing for that
+// name. B backhauls to A, A (the issuer) sees the hello and orders, and the CA
+// then validates against B — the box whose registry has never heard of the
+// host. Before the widening, B refused the challenge, every authorization
+// failed, and the name's Let's Encrypt budget went in minutes. After it, B
+// answers out of the bucket, A mints, and the certificate reaches B's mirror.
+//
+// A route, deliberately, and not an attached custom domain: an alias attach
+// lands in route_aliases (internal/domains/aliases.go), which edgesFilePass
+// never publishes — so no alias is in any home map, on any box. The spec
+// amendment records that as an open follow-up rather than a claim this test
+// could make.
//
// The backhaul leg itself is not re-proved here (homemap_test.go owns it);
// what this pins is that everything CERT-side works with the host in ONE
@@ -1249,13 +1255,24 @@ func TestNonHomeEdgeAnswersValidationForRemoteHomedHost(t *testing.T) {
// Written through a THIRD handle on the bucket, standing in for the
// issuer's publishingCache: edge B's own handle must stay write-free,
// which the last subtest asserts.
- putBucket(t, release.NewDirStore(bucket), e2eRemoteHomedHost+alpnTokenSuffix,
+ issuerHandle := release.NewDirStore(bucket)
+ putBucket(t, issuerHandle, e2eRemoteHomedHost+alpnTokenSuffix,
hostCertPEM(t, e2eRemoteHomedHost, time.Now().Add(24*time.Hour)))
if c := edgeB.mirror.alpnTokenCert(context.Background(), e2eRemoteHomedHost); c == nil {
t.Fatal("edge B refused a tls-alpn-01 validation for a host edge A homes")
}
// And the label under the mirrored catch-all is still refused (#180).
- if c := edgeB.mirror.alpnTokenCert(context.Background(), "invented.other.example.test"); c != nil {
+ // The token cert for it is PUT FIRST and the label is asserted
+ // dialable: without both, a nil answer here would prove only that the
+ // bucket is empty, and the refusal would pass even if KnownHost leaked
+ // through Home()'s one-label rule.
+ const invented = "invented.other.example.test"
+ putBucket(t, issuerHandle, invented+alpnTokenSuffix,
+ hostCertPEM(t, invented, time.Now().Add(24*time.Hour)))
+ if _, _, ok := edgeB.edge.homes.Load().Home(invented); !ok {
+ t.Fatal("test bug: the invented label is supposed to be DIALABLE through the one-label rule")
+ }
+ if c := edgeB.mirror.alpnTokenCert(context.Background(), invented); c != nil {
t.Fatal("a label under a mirrored catch-all was served a token cert")
}
})
diff --git a/internal/edge/homemap.go b/internal/edge/homemap.go
index 841d4e92a..5b115d9bd 100644
--- a/internal/edge/homemap.go
+++ b/internal/edge/homemap.go
@@ -438,7 +438,9 @@ func (m *homeMap) Home(host string) (eip, box string, ok bool) {
// a self label because it could otherwise offer this box itself as a dial
// target, and membership carries no such hazard — an unlabelled box's fold
// keeps its own file, whose hosts are its own registry rows and so pass
-// Allowed regardless.
+// Allowed anyway, modulo edges-file staleness (a route deleted from the
+// registry lingers in the published file until the next publish, minutes;
+// inherent to the design, and the widened set is registry rows either way).
//
// Nil-receiver-safe, like Home: the map may not be armed yet (or at all, on a
// box with no deployment store).