An mTLS client certificate should only be usable with its node We create two instances, each generates its own certs and keys, and then we try to cross the wires.
(node_factory)
| 237 | |
| 238 | |
| 239 | def test_grpc_wrong_auth(node_factory): |
| 240 | """An mTLS client certificate should only be usable with its node |
| 241 | |
| 242 | We create two instances, each generates its own certs and keys, |
| 243 | and then we try to cross the wires. |
| 244 | """ |
| 245 | # These only exist if we have rust! |
| 246 | l1, l2 = node_factory.get_nodes(2, opts=[{"start": False}, {"start": False}]) |
| 247 | l1.start() |
| 248 | wait_for_grpc_start(l1) |
| 249 | |
| 250 | def connect(node): |
| 251 | p = Path(node.daemon.lightning_dir) / TEST_NETWORK |
| 252 | cert, key, ca = [f.read_bytes() for f in [ |
| 253 | p / 'client.pem', |
| 254 | p / 'client-key.pem', |
| 255 | p / "ca.pem"]] |
| 256 | |
| 257 | creds = grpc.ssl_channel_credentials( |
| 258 | root_certificates=ca, |
| 259 | private_key=key, |
| 260 | certificate_chain=cert, |
| 261 | ) |
| 262 | |
| 263 | channel = grpc.secure_channel( |
| 264 | f"localhost:{node.grpc_port}", |
| 265 | creds, |
| 266 | options=(('grpc.ssl_target_name_override', 'cln'),) |
| 267 | ) |
| 268 | return clnpb.NodeStub(channel) |
| 269 | |
| 270 | stub = connect(l1) |
| 271 | # This should work, it's the correct node |
| 272 | stub.Getinfo(clnpb.GetinfoRequest()) |
| 273 | |
| 274 | l1.stop() |
| 275 | l2.start() |
| 276 | wait_for_grpc_start(l2) |
| 277 | |
| 278 | # This should not work, it's a different node |
| 279 | with pytest.raises(Exception, match=r'Socket closed|StatusCode.UNAVAILABLE'): |
| 280 | stub.Getinfo(clnpb.GetinfoRequest()) |
| 281 | |
| 282 | # Now load the correct ones and we should be good to go |
| 283 | stub = connect(l2) |
| 284 | stub.Getinfo(clnpb.GetinfoRequest()) |
| 285 | |
| 286 | |
| 287 | def test_cln_plugin_reentrant(node_factory, executor): |