(node_factory)
| 1111 | |
| 1112 | @unittest.skipIf(VALGRIND, "It does not play well with prompt and key derivation.") |
| 1113 | def test_hsmtool_secret_decryption(node_factory): |
| 1114 | l1 = node_factory.get_node() |
| 1115 | password = "reckless123#{ù}\n" |
| 1116 | hsm_path = os.path.join(l1.daemon.lightning_dir, TEST_NETWORK, "hsm_secret") |
| 1117 | # We need to simulate a terminal to use termios in `lightningd`. |
| 1118 | master_fd, slave_fd = os.openpty() |
| 1119 | |
| 1120 | # Encrypt the master seed |
| 1121 | l1.stop() |
| 1122 | l1.daemon.opts.update({"encrypted-hsm": None}) |
| 1123 | l1.daemon.start(stdin=slave_fd, wait_for_initialized=False) |
| 1124 | l1.daemon.wait_for_log(r'Enter hsm_secret password') |
| 1125 | write_all(master_fd, password.encode("utf-8")) |
| 1126 | l1.daemon.wait_for_log(r'Confirm hsm_secret password') |
| 1127 | write_all(master_fd, password.encode("utf-8")) |
| 1128 | l1.daemon.wait_for_log("Server started with public key") |
| 1129 | node_id = l1.rpc.getinfo()["id"] |
| 1130 | l1.stop() |
| 1131 | |
| 1132 | # We can't use a wrong password ! |
| 1133 | master_fd, slave_fd = os.openpty() |
| 1134 | hsmtool = HsmTool(node_factory.directory, "decrypt", hsm_path) |
| 1135 | hsmtool.start(stdin=slave_fd) |
| 1136 | hsmtool.wait_for_log(r"Enter hsm_secret password:") |
| 1137 | write_all(master_fd, "A wrong pass\n\n".encode("utf-8")) |
| 1138 | hsmtool.proc.wait(WAIT_TIMEOUT) |
| 1139 | hsmtool.is_in_log(r"Wrong password") |
| 1140 | |
| 1141 | # Decrypt it with hsmtool |
| 1142 | master_fd, slave_fd = os.openpty() |
| 1143 | hsmtool.start(stdin=slave_fd) |
| 1144 | hsmtool.wait_for_log(r"Enter hsm_secret password:") |
| 1145 | write_all(master_fd, password.encode("utf-8")) |
| 1146 | assert hsmtool.proc.wait(WAIT_TIMEOUT) == 0 |
| 1147 | |
| 1148 | # Then test we can now start it without password |
| 1149 | l1.daemon.opts.pop("encrypted-hsm") |
| 1150 | l1.daemon.start(stdin=slave_fd, wait_for_initialized=True) |
| 1151 | assert node_id == l1.rpc.getinfo()["id"] |
| 1152 | l1.stop() |
| 1153 | |
| 1154 | # Test we can encrypt it offline |
| 1155 | master_fd, slave_fd = os.openpty() |
| 1156 | hsmtool = HsmTool(node_factory.directory, "encrypt", hsm_path) |
| 1157 | hsmtool.start(stdin=slave_fd) |
| 1158 | hsmtool.wait_for_log(r"Enter hsm_secret password:") |
| 1159 | write_all(master_fd, password.encode("utf-8")) |
| 1160 | hsmtool.wait_for_log(r"Confirm hsm_secret password:") |
| 1161 | write_all(master_fd, password.encode("utf-8")) |
| 1162 | assert hsmtool.proc.wait(WAIT_TIMEOUT) == 0 |
| 1163 | # Now we need to pass the encrypted-hsm startup option |
| 1164 | l1.stop() |
| 1165 | with pytest.raises(subprocess.CalledProcessError, match=r'returned non-zero exit status {}'.format(HSM_ERROR_IS_ENCRYPT)): |
| 1166 | subprocess.check_call(l1.daemon.cmd_line) |
| 1167 | |
| 1168 | l1.daemon.opts.update({"encrypted-hsm": None}) |
| 1169 | master_fd, slave_fd = os.openpty() |
| 1170 | l1.daemon.start(stdin=slave_fd, |
nothing calls this directly
no test coverage detected