brokerd: state.sock answers memoryd's question about a session's state
Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>
This commit is contained in:
ornith-1.5-35b-a3b
@@ -41,6 +41,10 @@ fn sockets_and_directories_default_to_places_under_home() {
|
||||
c.admin_socket(),
|
||||
PathBuf::from("/srv/boxmaker/run/owner-broker/admin.sock")
|
||||
);
|
||||
assert_eq!(
|
||||
c.state_socket(),
|
||||
PathBuf::from("/srv/boxmaker/run/memory-broker/state.sock")
|
||||
);
|
||||
assert_eq!(c.audit_dir(), PathBuf::from("/srv/boxmaker/audit"));
|
||||
assert_eq!(
|
||||
c.state_dir(),
|
||||
@@ -57,6 +61,7 @@ fn every_key_can_be_set() {
|
||||
assert_eq!(c.paths.grants, PathBuf::from("/srv/boxmaker-grants"));
|
||||
assert_eq!(c.broker_socket(), PathBuf::from("/run/bx/broker.sock"));
|
||||
assert_eq!(c.admin_socket(), PathBuf::from("/run/bx/admin.sock"));
|
||||
assert_eq!(c.state_socket(), PathBuf::from("/run/bx/state.sock"));
|
||||
assert_eq!(c.approvals.ttl_ms, 60_000);
|
||||
// The two directories always follow home.
|
||||
assert_eq!(c.audit_dir(), PathBuf::from("/srv/boxmaker/audit"));
|
||||
@@ -75,6 +80,21 @@ fn one_socket_set_leaves_the_other_at_its_default() {
|
||||
c.broker_socket(),
|
||||
PathBuf::from("/h/run/loop-broker/broker.sock")
|
||||
);
|
||||
assert_eq!(
|
||||
c.state_socket(),
|
||||
PathBuf::from("/h/run/memory-broker/state.sock")
|
||||
);
|
||||
let c =
|
||||
Config::parse("[paths]\nhome = \"/h\"\n[sockets]\nstate = \"/x/state.sock\"\n").unwrap();
|
||||
assert_eq!(c.state_socket(), PathBuf::from("/x/state.sock"));
|
||||
assert_eq!(
|
||||
c.broker_socket(),
|
||||
PathBuf::from("/h/run/loop-broker/broker.sock")
|
||||
);
|
||||
assert_eq!(
|
||||
c.admin_socket(),
|
||||
PathBuf::from("/h/run/owner-broker/admin.sock")
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
|
||||
@@ -6,6 +6,7 @@ grants = "/srv/boxmaker-grants"
|
||||
[sockets]
|
||||
broker = "/run/bx/broker.sock"
|
||||
admin = "/run/bx/admin.sock"
|
||||
state = "/run/bx/state.sock"
|
||||
|
||||
[approvals]
|
||||
ttl_ms = 60000
|
||||
|
||||
@@ -63,7 +63,9 @@ impl Home {
|
||||
command
|
||||
}
|
||||
|
||||
/// Starts `brokerd serve` and waits until both sockets answer.
|
||||
/// Starts `brokerd serve` and waits until both sockets answer. A socket accepts connections
|
||||
/// as soon as it is bound, before `brokerd` has printed its startup notices; the admin
|
||||
/// socket's answer comes from a handler thread, which runs only after they are printed.
|
||||
fn serve(&self) -> Running {
|
||||
let child = self
|
||||
.command(&[])
|
||||
@@ -79,6 +81,11 @@ impl Home {
|
||||
assert!(Instant::now() < until, "brokerd never listened");
|
||||
std::thread::sleep(Duration::from_millis(20));
|
||||
}
|
||||
let answer = exchange(&self.admin(), 1, Message::Approvals(Empty {}));
|
||||
assert!(
|
||||
matches!(&answer[0].msg, Message::ApprovalList(_)),
|
||||
"{answer:?}"
|
||||
);
|
||||
running
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,269 @@
|
||||
//! `brokerd serve` answers `memoryd`'s session-state question on its third socket,
|
||||
//! `run/memory-broker/state.sock` or `[sockets] state` (M5c spec, section 7). Do not edit.
|
||||
|
||||
#[path = "support/tmp.rs"]
|
||||
mod tmp;
|
||||
|
||||
use std::os::unix::fs::PermissionsExt;
|
||||
use std::os::unix::net::{UnixListener, UnixStream};
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::process::{Child, Command, Stdio};
|
||||
use std::time::{Duration, Instant};
|
||||
|
||||
use bxcore::{
|
||||
DataClass, Envelope, ErrorCode, Message, PROTOCOL_VERSION, SessionId,
|
||||
SessionState as StateQuestion, SessionStateReply,
|
||||
};
|
||||
use tmp::TempDir;
|
||||
|
||||
struct Home {
|
||||
dir: TempDir,
|
||||
config: PathBuf,
|
||||
}
|
||||
|
||||
impl Home {
|
||||
/// A home whose config has `sockets` as the body of its `[sockets]` table.
|
||||
fn new(tag: &str, sockets: &str) -> Home {
|
||||
let dir = TempDir::new(tag);
|
||||
std::fs::create_dir_all(dir.path().join("grants")).unwrap();
|
||||
let text = format!(
|
||||
"[paths]\nhome = \"{home}\"\ngrants = \"{home}/grants\"\n[sockets]\n{sockets}\n",
|
||||
home = dir.path().display()
|
||||
);
|
||||
let config = dir.write("brokerd.toml", &text);
|
||||
Home { dir, config }
|
||||
}
|
||||
|
||||
fn path(&self, relative: &str) -> PathBuf {
|
||||
self.dir.path().join(relative)
|
||||
}
|
||||
|
||||
fn state(&self) -> PathBuf {
|
||||
self.path("run/memory-broker/state.sock")
|
||||
}
|
||||
|
||||
/// Writes the session's state file, as the ledger would.
|
||||
fn session(&self, id: &str, text: &str) {
|
||||
std::fs::create_dir_all(self.path("broker/sessions")).unwrap();
|
||||
std::fs::write(self.path(&format!("broker/sessions/{id}.json")), text).unwrap();
|
||||
}
|
||||
|
||||
/// Starts `brokerd serve` and waits until the tool socket, the admin socket and `state`
|
||||
/// accept a connection.
|
||||
fn serve(&self, state: &Path) -> Running {
|
||||
let child = Command::new(env!("CARGO_BIN_EXE_brokerd"))
|
||||
.args(["serve", "--config"])
|
||||
.arg(&self.config)
|
||||
.stdout(Stdio::null())
|
||||
.stderr(Stdio::piped())
|
||||
.spawn()
|
||||
.unwrap();
|
||||
let running = Running(Some(child));
|
||||
let until = Instant::now() + Duration::from_secs(10);
|
||||
for socket in [
|
||||
self.path("run/loop-broker/broker.sock"),
|
||||
self.path("run/owner-broker/admin.sock"),
|
||||
state.to_path_buf(),
|
||||
] {
|
||||
while UnixStream::connect(&socket).is_err() {
|
||||
assert!(
|
||||
Instant::now() < until,
|
||||
"brokerd never listened on {}",
|
||||
socket.display()
|
||||
);
|
||||
std::thread::sleep(Duration::from_millis(20));
|
||||
}
|
||||
}
|
||||
running
|
||||
}
|
||||
}
|
||||
|
||||
/// Kills the daemon when dropped, and waits for it; `stop` returns what it printed.
|
||||
struct Running(Option<Child>);
|
||||
|
||||
impl Running {
|
||||
fn stop(mut self) -> String {
|
||||
let mut child = self.0.take().unwrap();
|
||||
child.kill().unwrap();
|
||||
let output = child.wait_with_output().unwrap();
|
||||
String::from_utf8_lossy(&output.stderr).to_string()
|
||||
}
|
||||
}
|
||||
|
||||
impl Drop for Running {
|
||||
fn drop(&mut self) {
|
||||
if let Some(child) = &mut self.0 {
|
||||
let _ = child.kill();
|
||||
let _ = child.wait();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn mode(path: &Path) -> u32 {
|
||||
std::fs::metadata(path).unwrap().permissions().mode() & 0o777
|
||||
}
|
||||
|
||||
/// A connection with a ten-second read limit, so a daemon that never answers fails the test.
|
||||
fn connect(socket: &Path) -> UnixStream {
|
||||
let stream = UnixStream::connect(socket).unwrap();
|
||||
stream
|
||||
.set_read_timeout(Some(Duration::from_secs(10)))
|
||||
.unwrap();
|
||||
stream
|
||||
}
|
||||
|
||||
/// Sends one message under `id` and returns the one final frame that answers it.
|
||||
fn exchange(socket: &Path, id: u64, msg: Message) -> Envelope {
|
||||
let mut stream = connect(socket);
|
||||
bxcore::write_frame(
|
||||
&mut stream,
|
||||
&Envelope {
|
||||
v: PROTOCOL_VERSION,
|
||||
id,
|
||||
r#final: true,
|
||||
msg,
|
||||
},
|
||||
)
|
||||
.unwrap();
|
||||
let env = bxcore::read_frame(&mut stream).unwrap();
|
||||
assert_eq!((env.id, env.r#final), (id, true), "{env:?}");
|
||||
env
|
||||
}
|
||||
|
||||
fn question(session: &str) -> Message {
|
||||
Message::SessionState(StateQuestion {
|
||||
session: SessionId::new(session).unwrap(),
|
||||
})
|
||||
}
|
||||
|
||||
fn reply(env: &Envelope) -> SessionStateReply {
|
||||
match &env.msg {
|
||||
Message::SessionStateReply(reply) => reply.clone(),
|
||||
other => panic!("wanted a session_state_reply, got {other:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn it_answers_on_its_default_path_from_the_state_files() {
|
||||
let home = Home::new("serve-state-answers", "");
|
||||
home.session("s1", "{\"taint\":\"secret\",\"untrusted\":true}\n");
|
||||
home.session("s2", "{\"taint\":\"private\",\"untrusted\":true}\n");
|
||||
let running = home.serve(&home.state());
|
||||
for (id, session, class, untrusted) in [
|
||||
(1, "s1", DataClass::Secret, true),
|
||||
(2, "s2", DataClass::Private, true),
|
||||
(3, "unseen", DataClass::Private, false),
|
||||
] {
|
||||
assert_eq!(
|
||||
reply(&exchange(&home.state(), id, question(session))),
|
||||
SessionStateReply { class, untrusted },
|
||||
"{session}"
|
||||
);
|
||||
}
|
||||
assert!(!home.path("broker/sessions/unseen.json").exists());
|
||||
let printed = running.stop();
|
||||
assert!(
|
||||
printed.contains(&format!(
|
||||
"brokerd: serving session state on {}\n",
|
||||
home.state().display()
|
||||
)),
|
||||
"{printed}"
|
||||
);
|
||||
}
|
||||
|
||||
/// As for the other two sockets: the directory is made private even when it was there at 0755,
|
||||
/// the socket is 0600, and a stale socket left by a killed `brokerd` is replaced.
|
||||
#[test]
|
||||
fn its_directory_is_0700_its_socket_0600_and_a_stale_one_is_replaced() {
|
||||
let home = Home::new("serve-state-modes", "");
|
||||
std::fs::create_dir_all(home.path("run/memory-broker")).unwrap();
|
||||
std::fs::set_permissions(
|
||||
home.path("run/memory-broker"),
|
||||
std::fs::Permissions::from_mode(0o755),
|
||||
)
|
||||
.unwrap();
|
||||
drop(UnixListener::bind(home.state()).unwrap());
|
||||
assert!(home.state().exists(), "the stale socket file is there");
|
||||
let _running = home.serve(&home.state());
|
||||
assert_eq!(mode(&home.path("run/memory-broker")), 0o700);
|
||||
assert_eq!(mode(&home.state()), 0o600);
|
||||
assert_eq!(
|
||||
reply(&exchange(&home.state(), 9, question("s9"))),
|
||||
SessionStateReply {
|
||||
class: DataClass::Private,
|
||||
untrusted: false,
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn sockets_state_in_the_config_moves_it() {
|
||||
let dir = TempDir::new("serve-state-moved-sock");
|
||||
let moved = dir.path().join("st/state.sock");
|
||||
let home = Home::new(
|
||||
"serve-state-moved",
|
||||
&format!("state = \"{}\"", moved.display()),
|
||||
);
|
||||
home.session("s1", "{\"taint\":\"secret\",\"untrusted\":false}\n");
|
||||
let running = home.serve(&moved);
|
||||
assert_eq!(
|
||||
reply(&exchange(&moved, 1, question("s1"))),
|
||||
SessionStateReply {
|
||||
class: DataClass::Secret,
|
||||
untrusted: false,
|
||||
}
|
||||
);
|
||||
assert_eq!(mode(&dir.path().join("st")), 0o700);
|
||||
assert!(
|
||||
!home.path("run/memory-broker").exists(),
|
||||
"nothing at the default"
|
||||
);
|
||||
let printed = running.stop();
|
||||
assert!(
|
||||
printed.contains(&format!(
|
||||
"brokerd: serving session state on {}\n",
|
||||
moved.display()
|
||||
)),
|
||||
"{printed}"
|
||||
);
|
||||
}
|
||||
|
||||
/// A connection that sends nothing holds only its own thread: the next question is answered.
|
||||
#[test]
|
||||
fn a_silent_connection_does_not_hold_up_the_next() {
|
||||
let home = Home::new("serve-state-silent", "");
|
||||
let _running = home.serve(&home.state());
|
||||
let _silent = connect(&home.state());
|
||||
assert_eq!(
|
||||
reply(&exchange(&home.state(), 2, question("s2"))),
|
||||
SessionStateReply {
|
||||
class: DataClass::Private,
|
||||
untrusted: false,
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
/// The question belongs on `state.sock` only: the tool and admin sockets refuse it.
|
||||
#[test]
|
||||
fn the_other_sockets_refuse_the_question() {
|
||||
let home = Home::new("serve-state-others", "");
|
||||
let running = home.serve(&home.state());
|
||||
for (id, socket) in [
|
||||
(4, home.path("run/loop-broker/broker.sock")),
|
||||
(5, home.path("run/owner-broker/admin.sock")),
|
||||
] {
|
||||
match exchange(&socket, id, question("s1")).msg {
|
||||
Message::Error(e) => assert_eq!(e.code, ErrorCode::Forbidden, "{e:?}"),
|
||||
other => panic!("{other:?}"),
|
||||
}
|
||||
}
|
||||
let printed = running.stop();
|
||||
assert!(
|
||||
printed.contains("session_state on broker.sock\nsee docs/runbook.md#socket-forbidden"),
|
||||
"{printed}"
|
||||
);
|
||||
assert!(
|
||||
printed.contains("session_state on admin.sock\nsee docs/runbook.md#socket-forbidden"),
|
||||
"{printed}"
|
||||
);
|
||||
}
|
||||
@@ -0,0 +1,371 @@
|
||||
//! One `state.sock` connection: `memoryd` asks for a session's state, and `brokerd` answers from
|
||||
//! its state store, changing nothing (M5c spec, section 7). Every error is an error frame, never
|
||||
//! an answer. Do not edit.
|
||||
|
||||
#[path = "support/client.rs"]
|
||||
mod client;
|
||||
#[path = "support/rig.rs"]
|
||||
mod rig;
|
||||
#[path = "support/runtime.rs"]
|
||||
mod runtime;
|
||||
#[path = "support/sink.rs"]
|
||||
mod sink;
|
||||
#[path = "support/tmp.rs"]
|
||||
mod tmp;
|
||||
|
||||
use std::io::Write;
|
||||
use std::os::unix::net::UnixStream;
|
||||
use std::path::Path;
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
|
||||
use brokerd::broker::Broker;
|
||||
use brokerd::policy::{Label, SessionState};
|
||||
use brokerd::state_socket;
|
||||
use bxcore::{
|
||||
CallId, DataClass, Empty, Envelope, ErrorCode, FrameError, Message, PROTOCOL_VERSION,
|
||||
SessionId, SessionState as StateQuestion, SessionStateReply, SessionUpdated, ToolRequest,
|
||||
WireError,
|
||||
};
|
||||
use client::{Serve, next, open};
|
||||
use rig::Rig;
|
||||
use runtime::Recording;
|
||||
|
||||
fn broker(rig: &Rig) -> Arc<Broker> {
|
||||
rig.broker(&Recording::answering("x"))
|
||||
}
|
||||
|
||||
fn question(session: &str) -> Message {
|
||||
Message::SessionState(StateQuestion {
|
||||
session: SessionId::new(session).unwrap(),
|
||||
})
|
||||
}
|
||||
|
||||
/// Asks once, under `id`, and returns the one frame that comes back.
|
||||
fn ask(broker: &Arc<Broker>, id: u64, msg: Message) -> Envelope {
|
||||
let mut stream = open(broker, state_socket::handle, id, msg);
|
||||
let env = next(&mut stream);
|
||||
assert_eq!((env.id, env.r#final), (id, true), "{env:?}");
|
||||
env
|
||||
}
|
||||
|
||||
fn reply(env: &Envelope) -> SessionStateReply {
|
||||
match &env.msg {
|
||||
Message::SessionStateReply(reply) => reply.clone(),
|
||||
other => panic!("wanted a session_state_reply, got {other:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
fn error(env: &Envelope) -> WireError {
|
||||
match &env.msg {
|
||||
Message::Error(e) => e.clone(),
|
||||
other => panic!("wanted an error, got {other:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
/// Raises a session's state the way the ledger does, through the store's own `raise`.
|
||||
fn raise(rig: &Rig, session: &str, class: DataClass, untrusted: bool) {
|
||||
rig.state()
|
||||
.raise(
|
||||
&SessionId::new(session).unwrap(),
|
||||
SessionState::default(),
|
||||
Label { class, untrusted },
|
||||
)
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
/// Every file under `dir`, with its bytes, sorted; empty when `dir` does not exist.
|
||||
fn files(dir: &Path) -> Vec<(String, Vec<u8>)> {
|
||||
let mut all = Vec::new();
|
||||
if let Ok(entries) = std::fs::read_dir(dir) {
|
||||
for entry in entries {
|
||||
let entry = entry.unwrap();
|
||||
all.push((
|
||||
entry.file_name().into_string().unwrap(),
|
||||
std::fs::read(entry.path()).unwrap_or_default(),
|
||||
));
|
||||
}
|
||||
}
|
||||
all.sort();
|
||||
all
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn the_answer_is_the_stored_class_and_flag() {
|
||||
let rig = Rig::new("state-sock-stored");
|
||||
raise(&rig, "a", DataClass::Private, false);
|
||||
raise(&rig, "b", DataClass::Private, true);
|
||||
raise(&rig, "c", DataClass::Secret, false);
|
||||
raise(&rig, "d", DataClass::Secret, true);
|
||||
// A public result leaves a session at private: a session is never below private.
|
||||
raise(&rig, "e", DataClass::Public, true);
|
||||
let broker = broker(&rig);
|
||||
for (i, (session, class, untrusted)) in [
|
||||
("a", DataClass::Private, false),
|
||||
("b", DataClass::Private, true),
|
||||
("c", DataClass::Secret, false),
|
||||
("d", DataClass::Secret, true),
|
||||
("e", DataClass::Private, true),
|
||||
]
|
||||
.into_iter()
|
||||
.enumerate()
|
||||
{
|
||||
let id = 40 + i as u64;
|
||||
assert_eq!(
|
||||
reply(&ask(&broker, id, question(session))),
|
||||
SessionStateReply { class, untrusted },
|
||||
"session {session}"
|
||||
);
|
||||
}
|
||||
assert!(rig.lines.all().is_empty(), "{:?}", rig.lines.all());
|
||||
}
|
||||
|
||||
/// A file written by hand, as the runbook tells the owner to write one, is read the same way.
|
||||
#[test]
|
||||
fn a_state_file_the_owner_wrote_is_answered_as_it_says() {
|
||||
let rig = Rig::new("state-sock-owner");
|
||||
std::fs::create_dir_all(rig.cfg.state_dir()).unwrap();
|
||||
std::fs::write(
|
||||
rig.state_file("s1"),
|
||||
"{\"taint\":\"secret\",\"untrusted\":true}\n",
|
||||
)
|
||||
.unwrap();
|
||||
let env = ask(&broker(&rig), 7, question("s1"));
|
||||
assert_eq!(
|
||||
reply(&env),
|
||||
SessionStateReply {
|
||||
class: DataClass::Secret,
|
||||
untrusted: true,
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
/// A session `brokerd` has not seen has made no tool call: `private`, trusted (M5c spec, section
|
||||
/// 7). It is answered without making its file, or the directory.
|
||||
#[test]
|
||||
fn a_session_brokerd_has_not_seen_is_private_and_trusted() {
|
||||
let rig = Rig::new("state-sock-unseen");
|
||||
let broker = broker(&rig);
|
||||
let env = ask(&broker, 3, question("never-seen"));
|
||||
assert_eq!(
|
||||
reply(&env),
|
||||
SessionStateReply {
|
||||
class: DataClass::Private,
|
||||
untrusted: false,
|
||||
}
|
||||
);
|
||||
assert!(!rig.cfg.state_dir().exists(), "asking makes no directory");
|
||||
// With the directory there and another session in it, still no file for this one.
|
||||
raise(&rig, "other", DataClass::Secret, true);
|
||||
let env = ask(&broker, 4, question("never-seen"));
|
||||
assert_eq!(
|
||||
reply(&env),
|
||||
SessionStateReply {
|
||||
class: DataClass::Private,
|
||||
untrusted: false,
|
||||
}
|
||||
);
|
||||
assert!(!rig.state_file("never-seen").exists());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn asking_changes_nothing() {
|
||||
let rig = Rig::new("state-sock-nothing");
|
||||
raise(&rig, "s1", DataClass::Secret, true);
|
||||
raise(&rig, "s2", DataClass::Private, false);
|
||||
let before = files(&rig.cfg.state_dir());
|
||||
let broker = broker(&rig);
|
||||
for id in 0..3 {
|
||||
for session in ["s1", "s2", "s3"] {
|
||||
ask(&broker, id, question(session));
|
||||
}
|
||||
}
|
||||
assert_eq!(files(&rig.cfg.state_dir()), before);
|
||||
assert!(
|
||||
rig.events().is_empty(),
|
||||
"nothing is recorded for a question"
|
||||
);
|
||||
assert!(rig.lines.all().is_empty(), "{:?}", rig.lines.all());
|
||||
}
|
||||
|
||||
/// A state file that cannot be read is an `internal` error with the store's reason and runbook
|
||||
/// pointer, logged once, never an answer: `memoryd` then leaves the turn undecided.
|
||||
#[test]
|
||||
fn a_damaged_state_is_an_error_never_an_answer() {
|
||||
let cases: [(&str, Option<&str>); 5] = [
|
||||
("not json", Some("{\"taint\":")),
|
||||
(
|
||||
"public",
|
||||
Some("{\"taint\":\"public\",\"untrusted\":false}\n"),
|
||||
),
|
||||
(
|
||||
"unknown key",
|
||||
Some("{\"taint\":\"private\",\"untrusted\":false,\"x\":1}\n"),
|
||||
),
|
||||
(
|
||||
"unknown class",
|
||||
Some("{\"taint\":\"loud\",\"untrusted\":false}\n"),
|
||||
),
|
||||
("a directory", None),
|
||||
];
|
||||
for (i, (name, text)) in cases.into_iter().enumerate() {
|
||||
let rig = Rig::new("state-sock-damaged");
|
||||
std::fs::create_dir_all(rig.cfg.state_dir()).unwrap();
|
||||
match text {
|
||||
Some(text) => std::fs::write(rig.state_file("s1"), text).unwrap(),
|
||||
None => std::fs::create_dir(rig.state_file("s1")).unwrap(),
|
||||
}
|
||||
let before = files(&rig.cfg.state_dir());
|
||||
let env = ask(&broker(&rig), 60 + i as u64, question("s1"));
|
||||
let e = error(&env);
|
||||
assert_eq!(e.code, ErrorCode::Internal, "{name}: {e:?}");
|
||||
assert!(e.detail.contains("s1.json"), "{name}: {}", e.detail);
|
||||
assert!(
|
||||
e.detail
|
||||
.ends_with("see docs/runbook.md#broker-state-damaged"),
|
||||
"{name}: {}",
|
||||
e.detail
|
||||
);
|
||||
let lines = rig.lines.all();
|
||||
assert_eq!(lines.len(), 1, "{name}: {lines:?}");
|
||||
assert!(lines[0].starts_with("brokerd: "), "{name}: {lines:?}");
|
||||
assert!(lines[0].contains("s1.json"), "{name}: {lines:?}");
|
||||
assert!(
|
||||
lines[0].ends_with("see docs/runbook.md#broker-state-damaged"),
|
||||
"{name}: {lines:?}"
|
||||
);
|
||||
assert_eq!(files(&rig.cfg.state_dir()), before, "{name}");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn every_other_kind_is_forbidden_and_logged() {
|
||||
let rig = Rig::new("state-sock-forbidden");
|
||||
raise(&rig, "s1", DataClass::Secret, true);
|
||||
let broker = broker(&rig);
|
||||
let session = SessionId::new("s1").unwrap();
|
||||
let kinds = vec![
|
||||
Message::ToolRequest(ToolRequest {
|
||||
session: session.clone(),
|
||||
call: CallId(1),
|
||||
tool: "read_file".to_string(),
|
||||
arguments: "{}".to_string(),
|
||||
}),
|
||||
Message::Approvals(Empty {}),
|
||||
Message::CheckGrants(Empty {}),
|
||||
Message::Ok(Empty {}),
|
||||
Message::SessionUpdated(SessionUpdated {
|
||||
session: session.clone(),
|
||||
turn: 1,
|
||||
}),
|
||||
// An answer sent as a question is not a question.
|
||||
Message::SessionStateReply(SessionStateReply {
|
||||
class: DataClass::Private,
|
||||
untrusted: false,
|
||||
}),
|
||||
];
|
||||
let count = kinds.len();
|
||||
for (i, msg) in kinds.into_iter().enumerate() {
|
||||
let id = 100 + i as u64;
|
||||
let e = error(&ask(&broker, id, msg));
|
||||
assert_eq!(e.code, ErrorCode::Forbidden, "{e:?}");
|
||||
assert!(e.detail.ends_with("is not accepted on state.sock"), "{e:?}");
|
||||
}
|
||||
let lines = rig.lines.with("on state.sock");
|
||||
assert_eq!(lines.len(), count, "{:?}", rig.lines.all());
|
||||
for line in &lines {
|
||||
assert!(
|
||||
line.ends_with("\nsee docs/runbook.md#socket-forbidden"),
|
||||
"{line}"
|
||||
);
|
||||
}
|
||||
assert_eq!(
|
||||
rig.lines
|
||||
.with("refused the message kind session_state_reply on state.sock")
|
||||
.len(),
|
||||
1
|
||||
);
|
||||
assert!(rig.events().is_empty(), "nothing is recorded");
|
||||
}
|
||||
|
||||
/// A frame that is not a well-formed question is answered with the frame error, id 0, as on the
|
||||
/// other sockets. A session id that is not one (a path, say) is refused when the frame is read.
|
||||
#[test]
|
||||
fn a_malformed_frame_is_answered_with_an_error() {
|
||||
let rig = Rig::new("state-sock-malformed");
|
||||
raise(&rig, "s1", DataClass::Secret, true);
|
||||
let broker = broker(&rig);
|
||||
let body = |session: &str, v: u32, extra: &str| {
|
||||
format!(
|
||||
"{{\"v\":{v},\"id\":5,\"final\":true,\"msg\":{{\"kind\":\"session_state\",\
|
||||
\"body\":{{\"session\":\"{session}\"{extra}}}}}}}"
|
||||
)
|
||||
};
|
||||
let cases = [
|
||||
("not json", "{{{".to_string(), ErrorCode::BadMessage),
|
||||
("a path", body("../s1", 1, ""), ErrorCode::BadMessage),
|
||||
("upper case", body("S1", 1, ""), ErrorCode::BadMessage),
|
||||
(
|
||||
"unknown key",
|
||||
body("s1", 1, ",\"x\":1"),
|
||||
ErrorCode::BadMessage,
|
||||
),
|
||||
("version 2", body("s1", 2, ""), ErrorCode::BadVersion),
|
||||
];
|
||||
for (name, text, code) in cases {
|
||||
let (mut client, server) = UnixStream::pair().unwrap();
|
||||
let b = Arc::clone(&broker);
|
||||
std::thread::spawn(move || state_socket::handle(server, &b));
|
||||
client
|
||||
.write_all(&(text.len() as u32).to_be_bytes())
|
||||
.unwrap();
|
||||
client.write_all(text.as_bytes()).unwrap();
|
||||
let env = next(&mut client);
|
||||
assert_eq!((env.id, env.r#final), (0, true), "{name}");
|
||||
assert_eq!(error(&env).code, code, "{name}");
|
||||
}
|
||||
// The well-formed question, for contrast.
|
||||
let env = ask(&broker, 5, question("s1"));
|
||||
assert_eq!(
|
||||
reply(&env),
|
||||
SessionStateReply {
|
||||
class: DataClass::Secret,
|
||||
untrusted: true,
|
||||
}
|
||||
);
|
||||
}
|
||||
|
||||
/// One question per connection: after its answer the connection is closed, and a second question
|
||||
/// on it is never answered.
|
||||
#[test]
|
||||
fn a_second_question_on_one_connection_is_not_answered() {
|
||||
let rig = Rig::new("state-sock-once");
|
||||
raise(&rig, "s1", DataClass::Secret, true);
|
||||
let broker = broker(&rig);
|
||||
let mut stream = open(&broker, state_socket::handle, 1, question("s1"));
|
||||
assert!(matches!(
|
||||
next(&mut stream).msg,
|
||||
Message::SessionStateReply(_)
|
||||
));
|
||||
// The handler may have closed its end already, so the second frame may not be written.
|
||||
let _ = bxcore::write_frame(
|
||||
&mut stream,
|
||||
&Envelope {
|
||||
v: PROTOCOL_VERSION,
|
||||
id: 2,
|
||||
r#final: true,
|
||||
msg: question("s1"),
|
||||
},
|
||||
);
|
||||
// Once the peer has closed, macOS refuses the timeout with EINVAL (22); the read cannot block
|
||||
// then.
|
||||
if let Err(e) = stream.set_read_timeout(Some(Duration::from_secs(10))) {
|
||||
assert_eq!(e.raw_os_error(), Some(22), "set_read_timeout: {e}");
|
||||
}
|
||||
match bxcore::read_frame(&mut stream) {
|
||||
Err(FrameError::Closed) => {}
|
||||
// Linux resets a Unix socket closed with unread data in it: closed as well.
|
||||
Err(FrameError::Io(e)) if e.kind() == std::io::ErrorKind::ConnectionReset => {}
|
||||
other => panic!("wanted the connection closed, got {other:?}"),
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user