152 lines
6.6 KiB
Python
152 lines
6.6 KiB
Python
"""Real CLI, HTTPS and persisted state for RFC 9697 and TA tiebreaker -06."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import functools
|
|
import http.server
|
|
import json
|
|
from pathlib import Path
|
|
import shutil
|
|
import ssl
|
|
import sys
|
|
import tempfile
|
|
import threading
|
|
|
|
from test_public_config import (
|
|
assert_successful_output,
|
|
free_port,
|
|
make_rsync_wrapper,
|
|
read_json,
|
|
run_checked,
|
|
write_config,
|
|
)
|
|
|
|
|
|
def run(binary: str) -> dict:
|
|
support = Path(__file__).resolve().parent
|
|
with tempfile.TemporaryDirectory(prefix="panda-rpki-security-") as tmp:
|
|
base = Path(tmp)
|
|
fixture = base / "fixture"
|
|
port = free_port()
|
|
run_checked([
|
|
sys.executable, str(support / "generate_repository.py"),
|
|
"--rrdp-host", "127.0.0.1", "--rrdp-port", str(port),
|
|
"--rsync-host", "127.0.0.1", "--strict-names", "--output", str(fixture),
|
|
])
|
|
active = base / "active"
|
|
shutil.copytree(fixture / "cases/baseline-v1/http", active)
|
|
# Prefer real HTTPS for automatic TA retrieval. Retain the rsync URI:
|
|
# the validation core uses it as the key for its offline TA projection.
|
|
tal = fixture / "tal/custom.tal"
|
|
lines = tal.read_text().splitlines()
|
|
tal.write_text("\n".join(
|
|
[line for line in lines if line.startswith("https://")]
|
|
+ [line for line in lines if line.startswith("rsync://")]
|
|
+ [line for line in lines if not line.startswith(("https://", "rsync://"))]
|
|
) + "\n", encoding="utf-8")
|
|
served_ta = active / "ta/custom-ta.cer"
|
|
served_ta.write_bytes((fixture / "ta-variants/newer.cer").read_bytes())
|
|
notification = active / "rrdp/notification.xml"
|
|
original = notification.read_text()
|
|
|
|
def advertise_hash(value: str) -> None:
|
|
reference = (
|
|
f'<delta serial="1" uri="https://127.0.0.1:{port}/rrdp/delta-1.xml" '
|
|
f'hash="{value * 32}"/>'
|
|
)
|
|
notification.write_text(original.replace("</notification>", reference + "</notification>"))
|
|
|
|
advertise_hash("11")
|
|
requests: list[str] = []
|
|
|
|
class Handler(http.server.SimpleHTTPRequestHandler):
|
|
def do_GET(self) -> None:
|
|
requests.append(self.path)
|
|
super().do_GET()
|
|
|
|
def log_message(self, format: str, *args) -> None:
|
|
pass
|
|
|
|
server = http.server.ThreadingHTTPServer(
|
|
("127.0.0.1", port), functools.partial(Handler, directory=str(active))
|
|
)
|
|
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
|
|
context.load_cert_chain(fixture / "certs/rrdp-server.pem", fixture / "certs/rrdp-server.key")
|
|
server.socket = context.wrap_socket(server.socket, server_side=True)
|
|
thread = threading.Thread(target=server.serve_forever, daemon=True)
|
|
thread.start()
|
|
try:
|
|
output, state = base / "output", base / "state"
|
|
wrapper, wrapper_log = base / "rsync.py", base / "rsync.log"
|
|
make_rsync_wrapper(wrapper, fixture, wrapper_log)
|
|
config = base / "validate.toml"
|
|
write_config(
|
|
config, fixture=fixture, output=output, state=state,
|
|
ccr=output / "result.ccr", wrapper=wrapper, mirror=base / "mirror",
|
|
sync_preference="rrdp-then-rsync", rrdp_mode="auto",
|
|
validation_time="2026-06-01T00:00:00Z",
|
|
resource_mode="rfc6487", scope="publication-point",
|
|
)
|
|
text = "\n".join(line for line in config.read_text().splitlines() if not line.startswith("ta = "))
|
|
text = text.replace("[strict]", 'ta-refresh-policy = "require-fresh"\n\n[strict]')
|
|
config.write_text(text + "\n", encoding="utf-8")
|
|
proof = {"steps": []}
|
|
|
|
def validate(name: str) -> tuple[dict, str, list[str]]:
|
|
start = len(requests)
|
|
result = run_checked([binary, "validate", "--config", str(config)])
|
|
assert_successful_output(output, "2026-06-01T00:00:00Z")
|
|
summary = read_json(output / "summary.json")
|
|
seen = requests[start:]
|
|
assert summary["taCacheFallbackCount"] == 0, summary
|
|
assert not any("delta-" in uri for uri in seen), seen
|
|
assert not wrapper_log.exists(), "unexpected rsync fallback"
|
|
proof["steps"].append({
|
|
"name": name, "requests": seen, "vrps": summary["vrps"],
|
|
"resultStatus": summary["resultStatus"],
|
|
"taCacheFallbackCount": summary["taCacheFallbackCount"],
|
|
"trustAnchors": summary["trustAnchors"],
|
|
})
|
|
return summary, result.stderr, seen
|
|
|
|
summary, _, seen = validate("initial_snapshot_newer_ta")
|
|
assert "/rrdp/snapshot.xml" in seen, seen
|
|
assert summary["trustAnchors"][0]["source"] == "download", summary
|
|
cache = next(base.joinpath("state.ta-cache").glob("*.json"))
|
|
cache_before = cache.read_bytes()
|
|
|
|
# A new process sees a mutated historical delta hash at the same
|
|
# session/serial, and a valid but older TA with the identical key.
|
|
advertise_hash("33")
|
|
served_ta.write_bytes((fixture / "ta/custom-ta.cer").read_bytes())
|
|
summary, stderr, seen = validate("restarted_hash_mutation_and_older_ta")
|
|
assert "/rrdp/snapshot.xml" in seen, seen
|
|
assert "rrdp_session_desynchronized" in stderr, stderr
|
|
anchor = summary["trustAnchors"][0]
|
|
assert anchor["source"] == "cache" and not anchor["refreshFailed"], anchor
|
|
assert anchor["selectionReason"] == "cached_newer_not_before", anchor
|
|
assert cache.read_bytes() == cache_before, "older TA replaced the preferred cache"
|
|
|
|
_, stderr, seen = validate("restarted_noop_after_recovery")
|
|
assert "/rrdp/snapshot.xml" not in seen, seen
|
|
assert "rrdp_session_desynchronized" not in stderr, stderr
|
|
assert cache.read_bytes() == cache_before
|
|
return proof
|
|
finally:
|
|
server.shutdown()
|
|
thread.join(timeout=5)
|
|
server.server_close()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("binary")
|
|
parser.add_argument("--proof", type=Path)
|
|
args = parser.parse_args()
|
|
proof = run(args.binary)
|
|
if args.proof:
|
|
args.proof.parent.mkdir(parents=True, exist_ok=True)
|
|
args.proof.write_text(json.dumps(proof, indent=2) + "\n", encoding="utf-8")
|
|
print(json.dumps(proof, indent=2))
|