nordisk/holger

server/cli/tests/one_way_appliance_init.rs

//! **The one-way appliance's init** (lane HOL-CDS-5, owner 2026-10-30): `holger-downstream`
//! built with `pid1` is the box's PID 1 WITHOUT pairing. Its network comes from the MEDIUM
//! (`<release>/holger-net`, else the medium's `HOLGER_NET`, else `eth0:dhcp`), static or DHCP
//! on the declared NIC, with no resolver probe (it dials nothing). Its packages come in only
//! through the inbox; a USB stick labelled `HOLGERINBOX` is one way into it: the box mounts it
//! read-only and copies the signed bundles on it (`*.holger.znippy`) into `bundle.inbox`, and
//! NOTHING else — no declaration, no trust policy, no key and no `FIRST-IMPORT` marker ever
//! comes from a stick.
//!
//! The pure parts, held here; the KVM proof is `cargo xtask downstream-oneway-proof`.

use std::path::Path;

use holger::pid1::{
    copy_from_stick, fs_label, net_spec, stick_candidates, stick_wants, NET_FILE, STICK_LABEL,
};

#[test]
fn the_network_is_the_mediums_static_or_dhcp_on_the_declared_nic() {
    assert_eq!(NET_FILE, "holger-net");
    assert_eq!(
        net_spec(Some("eth0:10.0.2.15/24:10.0.2.2\n"), Some("eth0:dhcp")),
        "eth0:10.0.2.15/24:10.0.2.2",
        "the medium's file first"
    );
    assert_eq!(
        net_spec(Some("  "), Some("ens3:dhcp")),
        "ens3:dhcp",
        "then the medium's HOLGER_NET"
    );
    assert_eq!(net_spec(None, None), "eth0:dhcp", "then one NIC by DHCP");
    let plans = holger::pid1::net_plans("eth0:10.0.2.15/24:10.0.2.2").unwrap();
    assert_eq!(plans.len(), 1);
    assert!(holger::pid1::net_plans("eth0:not-an-address")
        .unwrap_err()
        .contains("[holger-net]"));
}

fn ext4_superblock(label: &str) -> Vec<u8> {
    let mut b = vec![0u8; 4096];
    b[1024 + 56] = 0x53;
    b[1024 + 57] = 0xEF;
    b[1024 + 120..1024 + 120 + label.len()].copy_from_slice(label.as_bytes());
    b
}

fn fat32_boot_sector(label: &str) -> Vec<u8> {
    let mut b = vec![0u8; 4096];
    b[510] = 0x55;
    b[511] = 0xAA;
    b[66] = 0x29;
    let mut l = [b' '; 11];
    l[..label.len()].copy_from_slice(label.as_bytes());
    b[71..82].copy_from_slice(&l);
    b[82..90].copy_from_slice(b"FAT32   ");
    b
}

#[test]
fn a_stick_is_known_by_its_label_on_ext4_or_fat() {
    assert_eq!(STICK_LABEL, "HOLGERINBOX");
    assert_eq!(
        fs_label(&ext4_superblock("HOLGERINBOX")).as_deref(),
        Some("HOLGERINBOX")
    );
    assert_eq!(
        fs_label(&fat32_boot_sector("HOLGERINBOX")).as_deref(),
        Some("HOLGERINBOX"),
        "FAT labels are 11 characters"
    );
    assert_eq!(fs_label(&vec![0u8; 4096]), None, "no filesystem");
    assert_eq!(fs_label(&[0u8; 100]), None, "too short to say");
}

#[test]
fn only_whole_devices_and_partitions_of_disks_are_looked_at() {
    let d = tempfile::tempdir().unwrap();
    for n in [
        "vda", "vda1", "vdb", "vdc", "loop0", "ram0", "sr0", "sda", "sda1", "zram0", "dm-0",
    ] {
        std::fs::create_dir(d.path().join(n)).unwrap();
    }
    let mut got = stick_candidates(d.path());
    got.sort();
    assert_eq!(got, ["dm-0", "sda", "sda1", "vda", "vda1", "vdb", "vdc"]);
}

#[test]
fn only_signed_bundles_come_off_a_stick_never_trust_or_a_marker() {
    assert!(stick_wants("upstream-on-prem-1.holger.znippy", true, 10));
    for (name, file, len) in [
        ("trust-policy.ron", true, 10),
        ("holger.ron", true, 10),
        ("upstream-root.pem", true, 10),
        ("FIRST-IMPORT", true, 0),
        (".x.holger.znippy", true, 10),
        ("x.holger.znippy.part", true, 10),
        ("dir.holger.znippy", false, 10),
        ("huge.holger.znippy", true, holger::pid1::MAX_STICK_FILE + 1),
    ] {
        assert!(
            !stick_wants(name, file, len),
            "{name} must not come off a stick"
        );
    }
    let stick = tempfile::tempdir().unwrap();
    let inbox = tempfile::tempdir().unwrap();
    for (n, body) in [
        ("a.holger.znippy", &b"bundle-a"[..]),
        ("trust-policy.ron", b"evil"),
        ("FIRST-IMPORT", b""),
        ("holger.ron", b"evil"),
    ] {
        std::fs::write(stick.path().join(n), body).unwrap();
    }
    std::fs::create_dir(stick.path().join("sub")).unwrap();
    std::fs::write(stick.path().join("sub/b.holger.znippy"), b"nested").unwrap();
    let mut seen = Default::default();
    let copied = copy_from_stick(stick.path(), inbox.path(), &mut seen).unwrap();
    assert_eq!(
        copied,
        ["a.holger.znippy"],
        "the top level's signed bundles only"
    );
    let mut there: Vec<String> = std::fs::read_dir(inbox.path())
        .unwrap()
        .flatten()
        .map(|e| e.file_name().to_string_lossy().into_owned())
        .collect();
    there.sort();
    assert_eq!(
        there,
        ["a.holger.znippy"],
        "nothing half-written, nothing else"
    );
    assert_eq!(
        std::fs::read(inbox.path().join("a.holger.znippy")).unwrap(),
        b"bundle-a"
    );
    // The same stick seen again copies nothing twice, also after the sweep moved the file away.
    std::fs::remove_file(inbox.path().join("a.holger.znippy")).unwrap();
    assert!(copy_from_stick(stick.path(), inbox.path(), &mut seen)
        .unwrap()
        .is_empty());
    assert!(!Path::new(&inbox.path().join("trust-policy.ron")).exists());
}