vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

derive a missing client digest from the secret that exists

Browse source 
A client with a secret in the store or in a leftover file but no digest gets the digest of that secret instead of stopping the unit. The password reaches authelia's prompt through a pty, not argv. A lost mint race takes the winner's secret. Also name the mint, not the publisher, in the remaining rust docs.
This commit is contained in:
atlas 2026-10-30 04:17:29 +01:00 • committed by mara
commit 05665c05f3
1 changed files with 127 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

42
nix/script-tests/oidc-client-secrets.sh
View file

@ -24,7 +24,7 @@ setup() {
mkdir "$dir/kv" "$dir/clients"
export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
export FAKE_AUTHELIA_LOG=$dir/authelia.log
unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE FAKE_AUTHELIA_EMPTY
unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE FAKE_AUTHELIA_EMPTY FAKE_AUTHELIA_NODIGEST
: >"$FAKE_BAO_LOG"
: >"$FAKE_AUTHELIA_LOG"
clients=$dir/clients
@ -76,8 +76,9 @@ digest_is() {
fi
}
# Whether a new secret was minted, as opposed to a digest computed.
ran_authelia() {
[ -s "$FAKE_AUTHELIA_LOG" ]
grep -q -e "--random" "$FAKE_AUTHELIA_LOG"
}
store_called() {
@ -158,14 +159,18 @@ expect 1
digest_is ""
if ran_authelia; then fail "minted although the read was refused"; fi
setup "mint: no digest but a secret in the store is for an operator, and nothing is minted"
setup "mint: no digest but a secret in the store gets the digest of that secret, and the secret is unchanged"
printf 'old-secret' >"$stored"
run mint_client_secret
expect 3
expect 0
held old-secret
digest_is ""
digest_is digest-of-old-secret
if ran_authelia; then fail "minted over the store's secret"; fi
if ! logged "<3>oidc client $id"; then fail "no err-priority line"; fi
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
if [ "$minted" != 1 ]; then fail "did not report the new digest"; fi
if [ "$(stat -c %a "$digest")" != 600 ]; then fail "digest mode is $(stat -c %a "$digest")"; fi
if ! logged "oidc client $id: wrote the digest from the secret in the store"; then fail "no info line"; fi
no_secret_in_argv
setup "mint: a plaintext file with its digest is left for the migration"
printf 'old-secret\n' >"$legacy"
@ -176,14 +181,25 @@ digest_is old-digest
if ran_authelia; then fail "minted although a file held the secret"; fi
if store_called; then fail "called the store"; fi
setup "mint: a plaintext file with no digest is for an operator, and nothing is minted"
setup "mint: a plaintext file with no digest gets the digest of the file's secret, and the file and the store are untouched"
printf 'old-secret\n' >"$legacy"
run mint_client_secret
expect 3
digest_is ""
expect 0
digest_is digest-of-old-secret
held ""
if [ "$(cat "$legacy")" != old-secret ]; then fail "changed the file"; fi
if ran_authelia; then fail "minted over the file's secret"; fi
if ! logged "<3>oidc client $id"; then fail "no err-priority line"; fi
if store_called; then fail "called the store"; fi
if ! logged "oidc client $id: wrote the digest from the secret in $legacy"; then fail "no info line"; fi
no_secret_in_argv
setup "mint: a secret whose digest cannot be computed is a failure and writes no digest"
printf 'old-secret' >"$stored"
export FAKE_AUTHELIA_NODIGEST=1
run mint_client_secret
expect 1
digest_is ""
held old-secret
setup "mint: an authelia that prints nothing writes nothing"
export FAKE_AUTHELIA_EMPTY=1
@ -199,12 +215,12 @@ expect 1
held ""
digest_is ""
setup "mint: losing the race to another run writes no digest and keeps the winner's secret"
setup "mint: losing the race to another run takes the winner's secret and writes its digest"
export FAKE_BAO_RACE=winner-secret
run mint_client_secret
expect 3
expect 0
held winner-secret
digest_is ""
digest_is digest-of-winner-secret
if [ "$(id -u)" != 0 ]; then
setup "mint: a digest that cannot be written is a failure, not a mint"