diff options
Diffstat (limited to 'packages/meshbay-node/tests/test_quic_transport.py')
| -rw-r--r-- | packages/meshbay-node/tests/test_quic_transport.py | 134 |
1 files changed, 132 insertions, 2 deletions
diff --git a/packages/meshbay-node/tests/test_quic_transport.py b/packages/meshbay-node/tests/test_quic_transport.py index 2abd465..0c1a1cd 100644 --- a/packages/meshbay-node/tests/test_quic_transport.py +++ b/packages/meshbay-node/tests/test_quic_transport.py @@ -14,7 +14,7 @@ from cryptography.hazmat.primitives import serialization from meshbay_common.crypto import generate_gek, pk_to_b64 from meshbay_node.indexer import DirectoryIndexer, GroupIndex -from meshbay_node.transport.quic_server import QuicChunkServer +from meshbay_node.transport.quic_server import QuicChunkServer, Denylist from meshbay_node.transport.quic_client import QuicChunkClient @@ -38,7 +38,7 @@ def shared_dir(tmp_path): (d / "small.txt").write_bytes(b"hello quic " * 100) return d -def make_jwt(sk_hub, pk_node_b64, ttl=3600): +def make_jwt(sk_hub, pk_node_b64, ttl=3600, groups=None): sk_pem = sk_hub.private_bytes( serialization.Encoding.PEM, serialization.PrivateFormat.PKCS8, @@ -49,6 +49,7 @@ def make_jwt(sk_hub, pk_node_b64, ttl=3600): "iss": "test-hub", "sub": "user-001", "pk_user": pk_node_b64, "hub_id": "test-hub", "jti": "test-jti", "iat": now, "exp": now + ttl, + "groups": groups or [], }, sk_pem, algorithm="EdDSA") @@ -155,3 +156,132 @@ async def test_quic_invalid_jwt_rejected(sk_node, sk_hub, gek, shared_dir, tmp_p await client.fetch_index() await server.stop() + + +@pytest.mark.asyncio +async def test_quic_wrong_group_rejected(sk_node, sk_hub, gek, shared_dir, tmp_path): + """QUIC server rejects a client whose JWT groups don't include the requested group_id.""" + hub_pk_pem = sk_hub.public_key().public_bytes( + serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo) + + indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=gek) + await indexer.initial_scan() + + cert_path = tmp_path / "node.crt" + key_path = tmp_path / "node.key" + + server = QuicChunkServer( + sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek, + shared_root=shared_dir, index=indexer.index, + host="127.0.0.1", port=19103, + cert_path=cert_path, key_path=key_path, + ) + await server.start() + + token = make_jwt(sk_hub, pk_to_b64(sk_node.public_key()), groups=["group-a"]) + + with pytest.raises(ConnectionError, match="rejected"): + async with QuicChunkClient( + host="127.0.0.1", port=19103, + jwt_token=token, gek=gek, + pk_node_b64=pk_to_b64(sk_node.public_key()), + group_id="group-b", + ) as client: + await client.fetch_index() + + await server.stop() + + +@pytest.mark.asyncio +async def test_quic_session_resumption(sk_node, sk_hub, gek, shared_dir, tmp_path): + """QUIC 0-RTT: connect, save session ticket, reconnect with ticket.""" + hub_pk_pem = sk_hub.public_key().public_bytes( + serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo) + + indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=gek) + await indexer.initial_scan() + + cert_path = tmp_path / "node.crt" + key_path = tmp_path / "node.key" + + server = QuicChunkServer( + sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek, + shared_root=shared_dir, index=indexer.index, + host="127.0.0.1", port=19104, + cert_path=cert_path, key_path=key_path, + ) + await server.start() + + token = make_jwt(sk_hub, pk_to_b64(sk_node.public_key())) + pk_b64 = pk_to_b64(sk_node.public_key()) + + # First connection — captures session ticket + saved_ticket = None + async with QuicChunkClient( + host="127.0.0.1", port=19104, + jwt_token=token, gek=gek, pk_node_b64=pk_b64, + ) as client: + wire = await client.fetch_index() + assert GroupIndex.deserialize(wire, sk_node=sk_node, gek=gek).count == 2 + saved_ticket = client.session_ticket + + # Allow server to process the close + await asyncio.sleep(0.1) + + # Second connection — reuses session ticket (0-RTT) + async with QuicChunkClient( + host="127.0.0.1", port=19104, + jwt_token=token, gek=gek, pk_node_b64=pk_b64, + session_ticket=saved_ticket, + ) as client: + wire = await client.fetch_index() + assert GroupIndex.deserialize(wire, sk_node=sk_node, gek=gek).count == 2 + + await server.stop() + + +@pytest.mark.asyncio +async def test_quic_denylist_blocks_user(sk_node, sk_hub, gek, shared_dir, tmp_path): + """QUIC server rejects a connection when the user is on the denylist.""" + hub_pk_pem = sk_hub.public_key().public_bytes( + serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo) + + indexer = DirectoryIndexer(root=shared_dir, group_id="g", sk_node=sk_node, gek=gek) + await indexer.initial_scan() + + cert_path = tmp_path / "node.crt" + key_path = tmp_path / "node.key" + + denylist = Denylist() + server = QuicChunkServer( + sk_node=sk_node, hub_pk_pem=hub_pk_pem, gek=gek, + shared_root=shared_dir, index=indexer.index, + host="127.0.0.1", port=19105, + cert_path=cert_path, key_path=key_path, + denylist=denylist, + ) + await server.start() + + token = make_jwt(sk_hub, pk_to_b64(sk_node.public_key())) + pk_b64 = pk_to_b64(sk_node.public_key()) + + # Connection works before denylisting + async with QuicChunkClient( + host="127.0.0.1", port=19105, + jwt_token=token, gek=gek, pk_node_b64=pk_b64, + ) as client: + wire = await client.fetch_index() + assert GroupIndex.deserialize(wire, sk_node=sk_node, gek=gek).count == 2 + + # Add user to denylist + denylist.deny_user("user-001") + + # Connection now rejected + with pytest.raises(Exception): + async with QuicChunkClient( + host="127.0.0.1", port=19105, + jwt_token=token, gek=gek, pk_node_b64=pk_b64, + ) as client: + await client.fetch_index() + + await server.stop() |