ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Validate persisted network readiness fingerprints

Browse source
This commit is contained in:
ms2k 2026-07-15 17:12:07 +09:00
commit 27bc3d835e
3 changed files with 21 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
crates/lazaret-core/src/records/network.rs
View file

@ -353,6 +353,8 @@ impl NetworkReadinessEvidence {
) -> bool { ) -> bool {
self.generation_id == generation_id self.generation_id == generation_id
&& self.readiness_fingerprint == readiness_fingerprint && self.readiness_fingerprint == readiness_fingerprint
&& crate::network::readiness_fingerprint(&self.readiness_identity)
.is_ok_and(|canonical| canonical == readiness_fingerprint)
&& self.domain_id == self.attestation.domain_id && self.domain_id == self.attestation.domain_id
&& self.domain_id == self.readiness_identity.domain_id && self.domain_id == self.readiness_identity.domain_id
&& self.domain_id == self.reachability_probe.domain_id && self.domain_id == self.reachability_probe.domain_id

11
crates/lazaret-core/tests/schema_records.rs
View file

@ -14,6 +14,7 @@ use lazaret_core::identity::{
ReadinessFingerprint, RequestDigest, RequestId, SandboxId, SelectedManifestDigest, ReadinessFingerprint, RequestDigest, RequestId, SandboxId, SelectedManifestDigest,
SessionAnchorId, SessionId, SourceIdentity, StreamDigest, TrustManifestDigest, SessionAnchorId, SessionId, SourceIdentity, StreamDigest, TrustManifestDigest,
}; };
use lazaret_core::network::readiness_fingerprint as derive_readiness_fingerprint;
use lazaret_core::records::*; use lazaret_core::records::*;
use serde::de::DeserializeOwned; use serde::de::DeserializeOwned;
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
@ -345,13 +346,14 @@ fn reachability_probe() -> NetworkReachabilityProbe {
} }
fn readiness_evidence() -> NetworkReadinessEvidence { fn readiness_evidence() -> NetworkReadinessEvidence {
let readiness_identity = readiness_identity();
NetworkReadinessEvidence { NetworkReadinessEvidence {
domain_id: domain_id(), domain_id: domain_id(),
generation_id: generation_id(), generation_id: generation_id(),
network_sidecar_id: sidecar_id(), network_sidecar_id: sidecar_id(),
readiness_fingerprint: ReadinessFingerprint::new(opaque(23)), readiness_fingerprint: derive_readiness_fingerprint(&readiness_identity).unwrap(),
attestation: readiness_attestation(), attestation: readiness_attestation(),
readiness_identity: readiness_identity(), readiness_identity,
reachability_probe: reachability_probe(), reachability_probe: reachability_probe(),
} }
} }
@ -368,10 +370,11 @@ fn prepared_ownership() -> PreparedLowerOwnership {
} }
fn network_ownership() -> NetworkOwnership { fn network_ownership() -> NetworkOwnership {
let readiness_evidence = readiness_evidence();
NetworkOwnership { NetworkOwnership {
derived_policy_digest: Some(DerivedPolicyDigest::new(opaque(20))), derived_policy_digest: Some(DerivedPolicyDigest::new(opaque(20))),
readiness_fingerprint: Some(ReadinessFingerprint::new(opaque(23))), readiness_fingerprint: Some(readiness_evidence.readiness_fingerprint),
readiness_evidence: Some(readiness_evidence()), readiness_evidence: Some(readiness_evidence),
namespace: Some(namespace()), namespace: Some(namespace()),
runtime_supervisor: owned_process(21), runtime_supervisor: owned_process(21),
} }

12
crates/lazaret-core/tests/schema_records/process_evidence.rs
View file

@ -333,6 +333,18 @@ fn active_network_rejects_every_mismatched_readiness_relation() {
ownership.readiness_fingerprint = Some(other_fingerprint); ownership.readiness_fingerprint = Some(other_fingerprint);
}), }),
), ),
(
"consistently repeated noncanonical readiness fingerprint",
generation_id(),
mutate_network_ownership(|ownership| {
ownership.readiness_fingerprint = Some(other_fingerprint);
ownership
.readiness_evidence
.as_mut()
.unwrap()
.readiness_fingerprint = other_fingerprint;
}),
),
( (
"attestation domain", "attestation domain",
generation_id(), generation_id(),