| 1 | package host |
| 2 | |
| 3 | import ( |
| 4 | "crypto/ed25519" |
| 5 | "crypto/sha256" |
| 6 | "encoding/hex" |
| 7 | "encoding/json" |
| 8 | "github.com/carlosframework/platform/internal/hostactors" |
| 9 | "github.com/carlosframework/platform/internal/hostclaim" |
| 10 | "github.com/carlosframework/platform/internal/hostevidence" |
| 11 | "github.com/carlosframework/platform/internal/release" |
| 12 | "strings" |
| 13 | "testing" |
| 14 | "time" |
| 15 | ) |
| 16 | |
| 17 | func TestPlan12RecoveryRootReceiptAlternative(t *testing.T) { |
| 18 | t.Parallel() |
| 19 | for _, bad := range []string{"", "session", "stamp", "enrollment", "signature", "operation", "region", "digest"} { |
| 20 | t.Run(bad, func(t *testing.T) { |
| 21 | f, o, h := plan12Handover(t, hostclaim.KindRestoring, "stop") |
| 22 | key := ed25519.NewKeyFromSeed([]byte(strings.Repeat("b", 32))) |
| 23 | en := strings.Repeat("a", 32) |
| 24 | d := hostactors.Directory{Store: f.claims, PublicKey: f.signer.Public().(ed25519.PublicKey), Bucket: "bucket"} |
| 25 | roster := hostactors.Roster{V: 1, Revision: 1, DeploymentBucket: "bucket", Boxes: map[string]hostactors.Box{"box-2": {Enrollment: en, BoxID: "box-2", Label: "box-2", Namespace: "platform", Region: "uk", Pool: "default", State: "active", Cloud: hostactors.Cloud{Provider: "aws", Account: "123", Region: "eu-west-2", InstanceID: "i-target"}, EvidenceSHA256: strings.Repeat("d", 64), CensusPublicKey: key.Public().(ed25519.PublicKey)}}, Consoles: map[string]hostactors.Console{}, Holds: map[string]hostactors.Reservation{}, Activations: map[string]hostactors.Reservation{}} |
| 26 | wire, _ := release.SignRootEnvelope(release.RootSigner(f.signer), roster) |
| 27 | if _, err := f.claims.Put(t.Context(), hostactors.Key, wire, ""); err != nil { |
| 28 | t.Fatal(err) |
| 29 | } |
| 30 | r := StopReceipt{V: 1, ID: "stop", Kind: "stopped", Host: o.Host, Incarnation: o.Claim.Holder.Incarnation, InstallationStamp: 2, WriterSession: 2, OperationID: "m1", Phase: "releasing", ObligationID: "writer-session-2", Box: "box-2", Region: "uk", Enrollment: en, EvidenceAt: time.Now(), RequestLimitNS: int64(2 * time.Minute), ClaimGen: 1, FenceID: "fence", InventorySHA256: strings.Repeat("e", 64), LocalJournalSHA256: strings.Repeat("f", 64), ProducerDrainDigest: strings.Repeat("a", 64), CgroupIdentities: []string{"root-role"}} |
| 31 | switch bad { |
| 32 | case "session": |
| 33 | r.WriterSession++ |
| 34 | case "stamp": |
| 35 | r.InstallationStamp++ |
| 36 | case "enrollment": |
| 37 | r.Enrollment = strings.Repeat("e", 32) |
| 38 | case "operation": |
| 39 | r.OperationID = "other" |
| 40 | case "region": |
| 41 | r.Region = "ie" |
| 42 | } |
| 43 | body, _ := json.Marshal(r) |
| 44 | receiptKey := stopEvidenceKey(o.Host, "m1", "box-2", "stop") |
| 45 | sum := sha256.Sum256(body) |
| 46 | signer := key |
| 47 | if bad == "signature" { |
| 48 | signer = f.signer |
| 49 | } |
| 50 | if err := hostevidence.Publish(t.Context(), f.claims, signer, receiptKey, body); err != nil { |
| 51 | t.Fatal(err) |
| 52 | } |
| 53 | h.Directory = d |
| 54 | o.Claim.Op.Journal["target_stop_receipt"] = receiptKey |
| 55 | o.Claim.Op.Journal["target_stop_sha256"] = hex.EncodeToString(sum[:]) |
| 56 | o.Claim.Op.Journal[hostclaim.JournalTargetStamp] = "2" |
| 57 | // Remove the unsigned report path: the receipt alone must suffice. |
| 58 | delete(o.Claim.Op.Journal, hostclaim.JournalEvidenceTarget) |
| 59 | if bad == "digest" { |
| 60 | o.Claim.Op.Journal["target_stop_sha256"] = strings.Repeat("0", 64) |
| 61 | } |
| 62 | err := h.recoveryEvidence(t.Context(), o) |
| 63 | if (err == nil) != (bad == "") { |
| 64 | t.Fatal(bad, err) |
| 65 | } |
| 66 | }) |
| 67 | } |
| 68 | } |
| 69 | |
amadan