ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Add generation-bound TLS control face

Browse source 
Create ephemeral trust anchors, publish an exact-profile Unix control socket, and persist generation-authorized mTLS session registration through the Domain Store.
This commit is contained in:
ms2k 2026-07-15 17:54:46 +09:00
commit c3a76ec8c4
1 changed files with 2351 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

51
crates/lazaret-core/tests/schema_records/encoding.rs
View file

@ -190,6 +190,30 @@ fn every_schema_shape_round_trips_and_rejects_malformed_or_unknown_versions() {
},
&mut seen,
);
let enrollment_request = ClientEnrollmentRequest {
protocol_version: ProtocolVersion::V1,
generation_identity: generation_identity(),
cli_id: ClientId::new(opaque(13)),
certificate_signing_request_der: vec![56],
};
let enrollment_response = ClientEnrollmentResponse {
protocol_version: ProtocolVersion::V1,
credential: tls_credential.clone(),
};
let registration_request = SessionRegistrationRequest {
protocol_version: ProtocolVersion::V1,
session_binding: session_binding(),
};
let registration_response = SessionRegistrationResponse {
protocol_version: ProtocolVersion::V1,
session_capability: session_capability(),
};
verify_shape(enrollment_request.clone(), &mut seen);
verify_shape(enrollment_response.clone(), &mut seen);
verify_shape(registration_request.clone(), &mut seen);
verify_shape(registration_response.clone(), &mut seen);
verify_shape(ControlRequest::Enroll(enrollment_request), &mut seen);
verify_shape(ControlResponse::Enrolled(enrollment_response), &mut seen);
verify_shape(
SandboxCredentialBundle::new(
generation_identity(),
@ -841,3 +865,30 @@ fn unknown_enums_and_protocol_versions_are_rejected() {
Err(CodecError::MalformedPayload(_))
));
}
#[test]
fn control_wire_unknown_protocol_versions_are_rejected() {
assert_unknown_protocol_version(&ClientEnrollmentRequest {
protocol_version: ProtocolVersion::V1,
generation_identity: generation_identity(),
cli_id: ClientId::new(opaque(4)),
certificate_signing_request_der: vec![5],
});
assert_unknown_protocol_version(&ClientEnrollmentResponse {
protocol_version: ProtocolVersion::V1,
credential: TlsCredential::client_cli(
generation_identity(),
ClientId::new(opaque(4)),
vec![5],
CertificateDigest::new(opaque(6)),
),
});
assert_unknown_protocol_version(&SessionRegistrationRequest {
protocol_version: ProtocolVersion::V1,
session_binding: session_binding(),
});
assert_unknown_protocol_version(&SessionRegistrationResponse {
protocol_version: ProtocolVersion::V1,
session_capability: session_capability(),
});
}