def test_good_anonymous_handshake(coolorg, check_rvk):
sh = ServerHandshake()
if check_rvk:
ch = APIV1_AnonymousClientHandshake(coolorg.organization_id,
coolorg.root_verify_key)
else:
ch = APIV1_AnonymousClientHandshake(coolorg.organization_id)
assert sh.state == "stalled"
challenge_req = sh.build_challenge_req()
assert sh.state == "challenge"
answer_req = ch.process_challenge_req(challenge_req)
sh.process_answer_req(answer_req)
assert sh.state == "answer"
assert sh.answer_type == APIV1_HandshakeType.ANONYMOUS
if check_rvk:
assert sh.answer_data == {
"client_api_version": API_V1_VERSION,
"organization_id": coolorg.organization_id,
"rvk": coolorg.root_verify_key,
}
else:
assert sh.answer_data == {
"client_api_version": API_V1_VERSION,
"organization_id": coolorg.organization_id,
"rvk": None,
}
result_req = sh.build_result_req()
assert sh.state == "result"
ch.process_result_req(result_req)
assert sh.client_api_version == API_V1_VERSION
def test_good_handshake(alice):
sh = ServerHandshake()
ch = APIV1_AuthenticatedClientHandshake(alice.organization_id,
alice.device_id, alice.signing_key,
alice.root_verify_key)
assert sh.state == "stalled"
challenge_req = sh.build_challenge_req()
assert sh.state == "challenge"
answer_req = ch.process_challenge_req(challenge_req)
sh.process_answer_req(answer_req)
assert sh.state == "answer"
assert sh.answer_type == APIV1_HandshakeType.AUTHENTICATED
assert sh.answer_data == {
"answer": ANY,
"client_api_version": API_V1_VERSION,
"organization_id": alice.organization_id,
"device_id": alice.device_id,
"rvk": alice.root_verify_key,
}
result_req = sh.build_result_req(alice.verify_key)
assert sh.state == "result"
ch.process_result_req(result_req)
assert sh.client_api_version == API_V1_VERSION
def test_handshake_challenge_schema_for_client_server_api_compatibility(
mallory, alice, monkeypatch):
ash = ServerHandshake()
bch = AuthenticatedClientHandshake(mallory.organization_id,
mallory.device_id, mallory.signing_key,
mallory.root_verify_key)
challenge = b"1234567890"
# Backend API >= 2.5 and Client API < 2.5
client_version = ApiVersion(2, 4)
backend_version = ApiVersion(2, 5)
answer = {
"handshake": "answer",
"type": HandshakeType.AUTHENTICATED.value,
"client_api_version": client_version,
"organization_id": str(alice.organization_id),
"device_id": str(alice.device_id),
"rvk": alice.root_verify_key.encode(),
"answer": alice.signing_key.sign(challenge),
}
ash.build_challenge_req()
ash.challenge = challenge
ash.process_answer_req(packb(answer))
result_req = ash.build_result_req(alice.verify_key)
result = handshake_result_serializer.loads(result_req)
assert result["result"] == "ok"
# Backend API < 2.5 and Client API >= 2.5
client_version = ApiVersion(2, 5)
backend_version = ApiVersion(2, 4)
req = {
"handshake": "challenge",
"challenge": challenge,
"supported_api_versions": [backend_version],
"backend_timestamp": pendulum.now(),
"ballpark_client_early_offset": BALLPARK_CLIENT_EARLY_OFFSET,
"ballpark_client_late_offset": BALLPARK_CLIENT_LATE_OFFSET,
}
monkeypatch.setattr(bch, "SUPPORTED_API_VERSIONS", [client_version])
answer_req = bch.process_challenge_req(packb(req))
answer = handshake_answer_serializer.loads(answer_req)
assert mallory.verify_key.verify(answer["answer"]) == challenge
def test_process_answer_req_bad_format(req, alice):
for key, good_value in [
("organization_id", str(alice.organization_id)),
("device_id", str(alice.device_id)),
("rvk", alice.root_verify_key.encode()),
]:
if req.get(key) == "<good>":
req[key] = good_value
req["client_api_version"] = API_V1_VERSION
sh = ServerHandshake()
sh.build_challenge_req()
with pytest.raises(InvalidMessageError):
sh.process_answer_req(packb(req))
def test_build_result_req_bad_challenge(alice):
sh = ServerHandshake()
sh.build_challenge_req()
answer = {
"handshake": "answer",
"type": "authenticated",
"client_api_version": API_V1_VERSION,
"organization_id": alice.organization_id,
"device_id": alice.device_id,
"rvk": alice.root_verify_key.encode(),
"answer": alice.signing_key.sign(sh.challenge + b"-dummy"),
}
sh.process_answer_req(packb(answer))
with pytest.raises(HandshakeFailedChallenge):
sh.build_result_req(alice.verify_key)
def test_build_bad_outcomes(alice, method, expected_result):
sh = ServerHandshake()
sh.build_challenge_req()
answer = {
"handshake": "answer",
"type": "authenticated",
"client_api_version": API_V1_VERSION,
"organization_id": alice.organization_id,
"device_id": alice.device_id,
"rvk": alice.root_verify_key.encode(),
"answer": alice.signing_key.sign(sh.challenge),
}
sh.process_answer_req(packb(answer))
req = getattr(sh, method)()
assert unpackb(req) == {"handshake": "result", "result": expected_result, "help": ANY}
def test_build_bad_outcomes(alice, method, expected_result):
sh = ServerHandshake()
sh.build_challenge_req()
answer = {
"handshake": "answer",
"type": APIV1_HandshakeType.ANONYMOUS.value,
"client_api_version": API_V1_VERSION,
"organization_id": str(alice.organization_id),
"answer": alice.signing_key.sign(sh.challenge),
}
sh.process_answer_req(packb(answer))
req = getattr(sh, method)()
assert unpackb(req) == {
"handshake": "result",
"result": expected_result,
"help": ANY
}
def test_good_administration_handshake():
admin_token = "Xx" * 16
sh = ServerHandshake()
ch = APIV1_AdministrationClientHandshake(admin_token)
assert sh.state == "stalled"
challenge_req = sh.build_challenge_req()
assert sh.state == "challenge"
answer_req = ch.process_challenge_req(challenge_req)
sh.process_answer_req(answer_req)
assert sh.state == "answer"
assert sh.answer_type == APIV1_HandshakeType.ADMINISTRATION
assert sh.answer_data == {"client_api_version": API_V1_VERSION, "token": admin_token}
result_req = sh.build_result_req()
assert sh.state == "result"
ch.process_result_req(result_req)
assert sh.client_api_version == API_V1_VERSION