clawft-kernel 0.8.3

WeftOS kernel: boot sequence, process table, service registry, and health subsystem
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

//! A remote.api node is only registered and placed on over a pinned link
//! (or an explicit lab opt-in).

use std::sync::Arc;

use clawft_types::placement::TrustTier;
use clawft_types::secret::SecretString;

use super::plane::{PlacementControlPlane, PlaneError};
use super::test_support::{anchors, exchange};
use super::transport::MeshConnector;
use crate::chain::ChainManager;
use crate::workload_governance::{NodeTrustTier, WorkloadGate};
use crate::workload_runtime::seed_tls::SeedTls;
use crate::workload_runtime::{
    HttpSeedTransport, RuntimeError, SeedApiRuntime, SeedConfig, SeedCredentials, SeedPin,
    WorkloadHost,
};

struct Creds;
impl SeedCredentials for Creds {
    fn get(&self, _: &str) -> Result<SecretString, RuntimeError> {
        Ok(SecretString::new("seed-token-link-tests".to_string()))
    }
    fn put(&self, _: &str, _: SecretString) -> Result<(), RuntimeError> {
        Ok(())
    }
}

fn host(t: HttpSeedTransport) -> Arc<WorkloadHost> {
    let rt = SeedApiRuntime::new(
        SeedConfig {
            node_id: "seed-link".into(),
            pins: vec![SeedPin::new("fall-detect", "1.0.0")],
            concurrency_cap: 3,
        },
        Arc::new(t),
        Arc::new(Creds),
    )
    .unwrap();
    Arc::new(WorkloadHost::new(
        Arc::new(rt),
        Arc::new(WorkloadGate::exempt(0.95, false, "test")),
        "operator",
        NodeTrustTier::Paired,
    ))
}

fn plane() -> PlacementControlPlane {
    let chain = Arc::new(ChainManager::new(0, 1000));
    PlacementControlPlane::new(
        ed25519_dalek::SigningKey::from_bytes(&[70; 32]),
        Arc::new(WorkloadGate::exempt(0.95, false, "test")),
        chain.clone(),
        exchange("ctl", &chain),
        anchors(),
        Arc::new(MeshConnector::new(false)),
    )
}

#[test]
fn an_unpinned_seed_link_is_refused_and_a_pinned_or_opted_in_one_is_accepted() {
    let p = plane();
    // Plain http, and https verified only by WebPKI: refused.
    for t in [
        HttpSeedTransport::new("http://169.254.42.1", SeedTls::WebPki).unwrap(),
        HttpSeedTransport::new("https://seed.example:8443", SeedTls::WebPki).unwrap(),
    ] {
        let e = p
            .add_seed("seed-link", host(t), TrustTier::Paired)
            .unwrap_err();
        assert!(matches!(e, PlaneError::Invalid(_)), "{e}");
        assert!(e.to_string().contains("pinned transport"), "{e}");
    }
    // Pinned certificate or key over https: accepted.
    for tls in [SeedTls::PinnedSha256([1; 32]), SeedTls::PinnedSpki([2; 32])] {
        let t = HttpSeedTransport::new("https://seed.example:8443", tls).unwrap();
        p.add_seed("seed-link", host(t), TrustTier::Paired).unwrap();
    }
    // The explicit lab opt-in on a USB link: accepted.
    let t = HttpSeedTransport::new("http://169.254.42.1", SeedTls::WebPki)
        .unwrap()
        .allow_unpinned_lab_link();
    p.add_seed("seed-link", host(t), TrustTier::Paired).unwrap();
}