stroblmeandClaude Opus 5.5
cf5329e3a8
fluksio-worker now refuses ws:// and http:// engine and artifact URLs unless they are loopback or --insecure is given; the engine still accepts both. An artifact reference must be sha256: plus 64 hex digits before it is joined into a path, and node code gets the host environment through the engine's credential denylist instead of all of it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
78 lines
2.7 KiB
Python
78 lines
2.7 KiB
Python
"""The remote worker's own guards: where its token goes, and what node code gets."""
|
|
|
|
import argparse
|
|
|
|
import pytest
|
|
from fluksio_worker import agent
|
|
from fluksio_worker.worker_main import _Reporter
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("url", "trusted"),
|
|
[
|
|
("wss://engine.example.com/api/v1/workers/attach", True),
|
|
("https://engine.example.com/api/v1/artifacts", True),
|
|
("ws://127.0.0.1:8000/api/v1/workers/attach", True),
|
|
("ws://127.1.2.3:8000/api/v1/workers/attach", True),
|
|
("ws://[::1]:8000/api/v1/workers/attach", True),
|
|
("ws://localhost:8000/api/v1/workers/attach", True),
|
|
("ws://192.0.2.10:8000/api/v1/workers/attach", False),
|
|
("ws://engine.local:8000/api/v1/workers/attach", False),
|
|
("http://192.0.2.10:8000/api/v1/artifacts", False),
|
|
],
|
|
)
|
|
def test_only_tls_or_this_machine_is_handed_the_token(url: str, trusted: bool) -> None:
|
|
assert agent._encrypted_or_local(url) is trusted
|
|
|
|
|
|
def test_a_cleartext_engine_elsewhere_needs_insecure(
|
|
monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
|
|
) -> None:
|
|
url = "ws://192.0.2.10:8000/api/v1/workers/attach"
|
|
with pytest.raises(SystemExit):
|
|
agent.main(["--url", url, "--token", "t"])
|
|
assert "--insecure" in capsys.readouterr().err
|
|
|
|
async def attached(self: agent.Agent) -> None:
|
|
return None
|
|
|
|
monkeypatch.setattr(agent.Agent, "serve_forever", attached)
|
|
assert agent.main(["--url", url, "--token", "t", "--insecure"]) == 0
|
|
|
|
|
|
def test_node_code_does_not_get_the_hosts_credentials(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
monkeypatch.setenv("FLUKSIO_WORKER_TOKEN", "worker-token")
|
|
monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "not-for-nodes")
|
|
monkeypatch.setenv("CUDA_VISIBLE_DEVICES", "2")
|
|
args = argparse.Namespace(
|
|
url="wss://engine.example.com/api/v1/workers/attach",
|
|
artifact_url="",
|
|
token="worker-token",
|
|
)
|
|
|
|
env = agent.Agent(args).env
|
|
|
|
assert "FLUKSIO_WORKER_TOKEN" not in env
|
|
assert "AWS_SECRET_ACCESS_KEY" not in env
|
|
assert env["CUDA_VISIBLE_DEVICES"] == "2"
|
|
assert "PATH" in env
|
|
# Put back on purpose: the artifact store is reached with it.
|
|
assert env["FLUKSIO_ARTIFACT_URL"] == "https://engine.example.com/api/v1/artifacts"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"digest",
|
|
[
|
|
"sha256:../../../etc/passwd",
|
|
"sha256:" + "a" * 63,
|
|
"sha256:" + "A" * 64,
|
|
"md5:" + "a" * 64,
|
|
],
|
|
)
|
|
def test_only_a_whole_digest_is_opened(digest: str) -> None:
|
|
"""The digest is joined into a path, so anything else could read any file."""
|
|
with pytest.raises(ValueError, match="not an artifact reference"):
|
|
_Reporter("fluksio").load_artifact({"digest": digest})
|