mirror of
https://github.com/luxfi/kms.git
synced 2026-10-30 16:23:36 +00:00
zeekayandHanzo Dev
29c65fac41
This connection carries the key every per-secret DEK is wrapped under, and it was the one ZAP path with no session: the payload went out as bare JSON, so a reader on the pod network could take the root, and an answerer could hand back one of its own choosing. The daemon has always answered OpClientHello and sealed its own replies once a session exists — this side simply never asked. It now agrees the same hybrid session the SDK client does, X25519 with ML-KEM-768, at dial. A client that cannot agree one is not returned, and the call path refuses rather than falling back, so there is no unsealed way to reach the daemon from here. The comment claiming this already rode the sealed wire described the path next to it. Co-authored-by: Hanzo Dev <[email protected]>
70 lines
1.8 KiB
Go
70 lines
1.8 KiB
Go
package mpc
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"testing"
|
|
|
|
kmszap "github.com/luxfi/kms/pkg/zap"
|
|
)
|
|
|
|
// What this connection carries is the root key every per-secret DEK is wrapped
|
|
// under. A request must never leave in a form a reader on the path can parse.
|
|
func TestARequestDoesNotLeaveInTheClear(t *testing.T) {
|
|
c := &ZapClient{session: testSession(t)}
|
|
const keyID = "rek-prod-2026"
|
|
|
|
sealed, err := c.session.Seal(kmszap.DirClientToServer, mustJSON(t, map[string]string{"keyId": keyID}))
|
|
if err != nil {
|
|
t.Fatalf("seal: %v", err)
|
|
}
|
|
if bytes.Contains(sealed, []byte(keyID)) {
|
|
t.Fatal("the key id is readable in what goes on the wire")
|
|
}
|
|
var probe map[string]string
|
|
if json.Unmarshal(sealed, &probe) == nil {
|
|
t.Fatal("the payload still parses as JSON — it is not sealed")
|
|
}
|
|
}
|
|
|
|
// A client that could not agree a session must not be usable. If one is ever
|
|
// reachable, its call path refuses rather than sending in the clear — which is
|
|
// the behaviour this replaced.
|
|
func TestNoSessionMeansNoSend(t *testing.T) {
|
|
c := &ZapClient{}
|
|
if _, err := c.call(context.Background(), OpKeygen, map[string]string{"k": "v"}); err == nil {
|
|
t.Fatal("a sessionless client sent a request")
|
|
}
|
|
}
|
|
|
|
func testSession(t *testing.T) *kmszap.Session {
|
|
t.Helper()
|
|
state, hello, err := kmszap.NewClient(kmszap.CapMLKEM768)
|
|
if err != nil {
|
|
t.Fatalf("client hello: %v", err)
|
|
}
|
|
reply, _, err := kmszap.ServerRespond(kmszap.CapMLKEM768, hello)
|
|
if err != nil {
|
|
t.Fatalf("server respond: %v", err)
|
|
}
|
|
res, err := state.ClientFinish(reply)
|
|
if err != nil {
|
|
t.Fatalf("client finish: %v", err)
|
|
}
|
|
s, err := kmszap.NewSession(res)
|
|
if err != nil {
|
|
t.Fatalf("session: %v", err)
|
|
}
|
|
return s
|
|
}
|
|
|
|
func mustJSON(t *testing.T, v any) []byte {
|
|
t.Helper()
|
|
b, err := json.Marshal(v)
|
|
if err != nil {
|
|
t.Fatalf("marshal: %v", err)
|
|
}
|
|
return b
|
|
}
|