This is the gap that let the capability-revision defect ship. The authenticated probe proof was the only gate that runs a configured host, and it exercised only v1 and grouped-v3. Every control-v2 gate ran without a config, which selects TestPatternProof and pins authorization_revision to 1. Neither side of that split could see a client that assumes the constant. Run control-v2 against the configured host, and enroll a second viewer so the two land on distinct revisions -- a capability check that is right for the first viewer can still be wrong for the second. Assert both admissions recorded a revision of at least 2, so the proof fails loudly if it ever regresses into a configuration where the constant would pass. Verified by reverting the client fix: the proof stops with the exact shipped failure, "capability authorization revision is stale".
- commit
- 21a5aeb2599905ada964fafd31b60314436afc98
- parent
- dfe7df56bd3dfba29aeb00d9aab38eae4620bae6
- author
- Dami <dami.etoile@gmail.com>
| M | scripts/ | 79 | ++++++++++++++++++++++++++++++- |
@@ -87,11 +87,17 @@ first_log="$temp_root/first.log"
8787 reconnect_log="$temp_root/reconnect.log"8888 compat_log="$temp_root/compat.log"8989 replay_log="$temp_root/replay.log"90+control_v2_log="$temp_root/control-v2.log"91+second_identity="$temp_root/second.key"92+second_invitation="$temp_root/second.goq-invite"93+second_v2_log="$temp_root/control-v2-second.log"9094 9195 "$host_bin" identity init --output "$host_identity" >"$temp_root/host-identity.log"9296 "$host_bin" identity init --output "$probe_identity" >"$temp_root/probe-identity.log"97+"$host_bin" identity init --output "$second_identity" >"$temp_root/second-identity.log"9398 host_node_id="$(sed -n 's/^node_id=//p' "$temp_root/host-identity.log")"9499 probe_node_id="$(sed -n 's/^node_id=//p' "$temp_root/probe-identity.log")"100+second_node_id="$(sed -n 's/^node_id=//p' "$temp_root/second-identity.log")"95101 [[ -n "$host_node_id" && -n "$probe_node_id" ]] || die 'identity output is incomplete'96102 97103 printf '%s\n' \@@ -150,6 +156,75 @@ wait_for_log_count 'MoQ control client released' 2 \
150156 wait_for_log_count 'media v3 client released' 1 \151157 || die 'grouped-v3 session did not drain'152158 159+# Enrolled control-v2 coverage. Every other control-v2 proof runs the host160+# without a config, which selects TestPatternProof and pins161+# authorization_revision to 1. A configured host mints each viewer's162+# subscription capability at that viewer's real enrollment revision, which163+# starts at 2 and climbs with every enrollment and grant change. Without this164+# case a client that assumes revision 1 passes the whole gate and then rejects165+# its own authenticated media on the appliance.166+"$probe_bin" \167+ --node-id "$host_node_id" \168+ --identity "$probe_identity" \169+ --control-v2 \170+ --frames 4 \171+ >"$control_v2_log"172+wait_for_log_count 'MoQ control v2 client released' 1 \173+ || die 'enrolled control-v2 session did not drain'174+175+# A second enrolled viewer lands on a strictly higher revision, so a capability176+# check that is right for the first viewer can still be wrong for this one.177+"$host_bin" invitation create \178+ --config "$host_config" \179+ --peer "$second_node_id" \180+ --pointer-keyboard \181+ --output "$second_invitation" \182+ >/dev/null183+"$probe_bin" \184+ --node-id "$host_node_id" \185+ --identity "$second_identity" \186+ --invitation "$second_invitation" \187+ --control-v2 \188+ --spectator \189+ --frames 4 \190+ >"$second_v2_log"191+wait_for_log_count 'MoQ control v2 client released' 2 \192+ || die 'second enrolled control-v2 session did not drain'193+194+for v2_log in "$control_v2_log" "$second_v2_log"; do195+ grep -Fxq 'probe=ok' "$v2_log" || die "control-v2 evidence is missing from $v2_log"196+ grep -Fxq 'control_alpn=sigil/control/2' "$v2_log" \197+ || die "control-v2 ALPN is missing from $v2_log"198+done199+grep -Fxq 'media_authentication=ed25519-v1' "$control_v2_log" \200+ || die 'enrolled control-v2 media was not authenticated'201+grep -Fxq 'media_generation_certified=ok' "$control_v2_log" \202+ || die 'enrolled control-v2 generation certificate was not verified'203+204+# Pin the property that made the shipped defect invisible: these revisions are205+# not the development-bypass constant.206+# The subscriber writes ANSI field separators, so strip them before matching.207+ansi_escape=$'\033'208+enrolled_revisions="$(grep -F 'MoQ control v2 client accepted' "$host_log" \209+ | sed -e "s/${ansi_escape}\[[0-9;]*m//g" \210+ | sed -n 's/.* authorization_revision=\([0-9][0-9]*\) .*/\1/p')"211+if [[ -z "$enrolled_revisions" ]]; then212+ grep -F 'control v2 client accepted' "$host_log" >&2 || true213+ die 'host did not record an authorization revision for control-v2 admission'214+fi215+observed_revisions=0216+while read -r revision; do217+ [[ -n "$revision" ]] || continue218+ observed_revisions=$((observed_revisions + 1))219+ [[ "$revision" -ge 2 ]] \220+ || die "enrolled control-v2 admission used revision $revision, so this proof could not \221+detect a client that assumes the development-bypass constant"222+done <<<"$enrolled_revisions"223+[[ "$observed_revisions" -eq 2 ]] \224+ || die "expected two enrolled control-v2 admissions, saw $observed_revisions"225+[[ "$(sort -u <<<"$enrolled_revisions" | wc -l | tr -d ' ')" -eq 2 ]] \226+ || die 'the two enrolled viewers did not land on distinct authorization revisions'227+153228 for proof_log in "$first_log" "$reconnect_log" "$compat_log"; do154229 grep -Fxq 'probe=ok' "$proof_log" || die "probe evidence is missing from $proof_log"155230 grep -Fxq 'sequence_gaps=0' "$proof_log" || die "sequence gap in $proof_log"@@ -175,7 +250,7 @@ grep -Fq 'host rejected control stream: Portal peer is not authorized' "$replay_
175250 }176251 enrollment="$($host_bin enrollment show --config "$host_config")"177252 grep -Fxq 'enrollment=active' <<<"$enrollment" || die 'probe enrollment is not active'178-grep -Fxq 'viewer_count=1' <<<"$enrollment" || die 'probe enrollment count changed'253+grep -Fxq 'viewer_count=2' <<<"$enrollment" || die 'probe enrollment count changed'179254 grep -Eq '^viewer=viewer-[0-9a-f]{16} grants=view,pointer-keyboard authorization_revision=[1-9][0-9]* enrolled_at_unix=[0-9]+$' \180255 <<<"$enrollment" || die 'opaque enrollment handle or grants changed'181256 if grep -Fq "$probe_node_id" <<<"$enrollment"; then@@ -187,3 +262,5 @@ printf 'invitation_redemption=ok\n'
187262 printf 'ticket_free_reconnect=ok\n'188263 printf 'grouped_v3_reconnect=ok\n'189264 printf 'invitation_replay=rejected\n'265+printf 'enrolled_control_v2=ok\n'266+printf 'enrolled_multi_viewer_revisions=ok\n'