ndncert: CA integrates DataStoreBuffer

Author: yoursunny

pkg/keychain-cli/src/ndncert03-ca.ts

@@ -121,7 +121,7 @@ Otherwise, please disregard this message.`,
       }
     }
 
-    const server = Server.create({
+    const server = await Server.create({
       repo,
       profile,
       signer,

pkg/ndncert/package.json

@@ -31,6 +31,7 @@
     "@ndn/naming-convention2": "workspace:*",
     "@ndn/packet": "workspace:*",
     "@ndn/rdr": "workspace:*",
+    "@ndn/repo": "workspace:*",
     "@ndn/tlv": "workspace:*",
     "@ndn/util": "workspace:*",
     "@types/imap": "^0.8.43",
@@ -48,7 +49,6 @@
   "devDependencies": {
     "@ndn/fw": "workspace:^",
     "@ndn/l3face": "workspace:^",
-    "@ndn/repo": "workspace:*",
     "@types/b64-lite": "^1.4.2",
     "@types/koa": "^3.0.3",
     "@types/mailparser": "^3.4.6",

pkg/ndncert/src/client/dns-challenge.ts

@@ -5,6 +5,8 @@ import type { ClientChallenge, ClientChallengeContext } from "./challenge";
 /** The "dns" challenge where client creates a DNS TXT record. */
 export class ClientDnsChallenge implements ClientChallenge {
   public readonly challengeId = "dns";
+  private record = "";
+  private token = "";
 
   constructor(
       private readonly domain: string,
@@ -16,15 +18,12 @@ export class ClientDnsChallenge implements ClientChallenge {
   }
 
   public async next(context: ClientChallengeContext): Promise<ParameterKV> {
-    if (context.challengeStatus !== "need-record") {
-      throw new Error(`bad challenge-status ${context.challengeStatus}`);
+    if (context.challengeStatus === "need-record") {
+      this.record = ParameterKV.getString(context.parameters, "record-name");
+      this.token = ParameterKV.getString(context.parameters, "expected-value");
     }
 
-    await this.prompt(
-      context,
-      ParameterKV.getString(context.parameters, "record-name"),
-      ParameterKV.getString(context.parameters, "expected-value"),
-    );
+    await this.prompt(context, this.record, this.token);
     return ParameterKV.from({ confirmation: "ready" });
   }
 }

pkg/ndncert/src/client/request.ts

@@ -49,7 +49,7 @@ export async function requestCertificate({
 }: ClientOptions): Promise<Certificate> {
   cOpts = {
     describe: `NDNCERT-client(${profile.prefix}, REQUEST, ${privateKey.name})`,
-    retx: 4, // XXX retransmission may cause server rejection for duplicate SigNonce
+    retx: 4,
     ...cOpts,
     verifier: profile.publicKey,
   };

pkg/ndncert/src/server/server.ts

@@ -1,7 +1,8 @@
-import { produce, type Producer, type ProducerHandler, type ProducerOptions } from "@ndn/endpoint";
+import { DataStoreBuffer, produce, type Producer, type ProducerHandler, type ProducerOptions } from "@ndn/endpoint";
 import { Certificate, CertNaming, type NamedVerifier } from "@ndn/keychain";
 import { Component, type ComponentLike, type Data, type FwHint, type Signer, type ValidityPeriod } from "@ndn/packet";
 import { Metadata, serveMetadata } from "@ndn/rdr";
+import { makeInMemoryDataStore } from "@ndn/repo";
 import { KeyMap, toHex } from "@ndn/util";
 
 import * as ndncert_crypto from "../crypto-common";
@@ -14,6 +15,8 @@ export interface ServerOptions {
    *
    * @remarks
    * - `.describe` defaults to "NDNCERT-CA" + CA prefix.
+   * - `.dataBuffer` defaults to an internal `DataStoreBuffer` (required for proper operations).
+   * - `.autoBuffer` is overridden to true (required for proper operations).
    * - `.announcement` is overridden as CA prefix + "/CA".
    */
   pOpts?: ProducerOptions;
@@ -49,7 +52,7 @@ interface RepoDataStore {
 
 /** NDNCERT server. */
 export class Server {
-  public static create({
+  public static async create({
     pOpts,
     repo,
     repoFwHint,
@@ -58,10 +61,12 @@ export class Server {
     probe,
     challenges,
     issuerId = "NDNts-NDNCERT",
-  }: ServerOptions): Server {
+  }: ServerOptions): Promise<Server> {
     return new Server(
       {
+        dataBuffer: new DataStoreBuffer(await makeInMemoryDataStore()),
         ...pOpts,
+        autoBuffer: true,
         announcement: profile.prefix.append(C.CA),
       },
       repo,

pkg/ndncert/tests/server-client.t.ts

@@ -23,6 +23,7 @@ interface Row {
   nChallengeInterest: number;
   lostChallengeData?: readonly number[];
   clientError?: unknown;
+  serverCleared?: boolean;
 }
 
 function makePinChallengeWithWrongInputs(nWrongInputs = 0): Row["makeChallengeLists"] {
@@ -130,14 +131,16 @@ const TABLE: Row[] = [
     nChallengeInterest: 2,
   },
   {
-    summary: "pin, success with 1 Data loss",
+    summary: "pin, success after 1 Data loss",
     makeChallengeLists: makePinChallengeWithWrongInputs(0),
     nChallengeInterest: 3,
     lostChallengeData: [1],
-    clientError: "3: BadSignature",
-    // XXX This test case should have succeeded but is presently an "expected failure", caused by:
-    // During the CHALLENGE step, I2's SigNonce is saved by server but D2 is lost in network.
-    // When client retransmits I2, the server would detect a duplicate SigNonce and reject the Interest.
+  },
+  {
+    summary: "pin, success after 1 wrong input and 1 Data loss",
+    makeChallengeLists: makePinChallengeWithWrongInputs(1),
+    nChallengeInterest: 4,
+    lostChallengeData: [2],
   },
   {
     summary: "pin, success after 2 wrong inputs",
@@ -219,7 +222,10 @@ const TABLE: Row[] = [
   {
     summary: "email, with IMAP",
     async makeChallengeLists() {
-      const debugEnabled = process.env.NDNCERT_IMAP_DEBUG === "1";
+      if (process.env.NDNTS_IMAP_DEBUG === "2") {
+        throw new Error("IMAP test skipped via environ");
+      }
+      const debugEnabled = process.env.NDNTS_IMAP_DEBUG === "1";
       const { user, pass, smtp, imap, web } = await createEmailAccount();
       if (debugEnabled) {
         console.log("nodemail test account:", web, user, pass);
@@ -377,8 +383,8 @@ const TABLE: Row[] = [
         })],
       ];
     },
-    nChallengeInterest: 2,
-    clientError: "wrong-record",
+    nChallengeInterest: 4,
+    clientError: "7: OutOfTries",
   },
   {
     summary: "server challenge not acceptable on client",
@@ -390,6 +396,7 @@ const TABLE: Row[] = [
     },
     nChallengeInterest: 0,
     clientError: "no acceptable challenge",
+    serverCleared: false,
   },
 ];
 
@@ -454,13 +461,13 @@ beforeEach(async () => {
   };
 });
 
-function startServer(serverOpts: Partial<ServerOptions> = {}, bridgeOpts: Bridge.CreateOptions & { bridge?: Bridge } = {}) {
+async function startServer(serverOpts: Partial<ServerOptions> = {}, bridgeOpts: Bridge.CreateOptions & { bridge?: Bridge } = {}) {
   const bridge = bridgeOpts.bridge ?? Bridge.create({
     fwA: Forwarder.getDefault(),
     routesAB: ["/fh", "/authority/CA", "/sub/CA"],
     ...bridgeOpts,
   });
-  const server = Server.create({
+  const server = await Server.create({
     pOpts: { fw: bridge.fwB },
     profile: caProfile,
     repo,
@@ -480,7 +487,7 @@ function checkCaProfile(retrieved: CaProfile, expected: CaProfile, stringContain
 }
 
 test("INFO command", async () => {
-  startServer();
+  await startServer();
 
   const retrieved = await retrieveCaProfile({
     caPrefix: new Name("/authority"),
@@ -497,7 +504,7 @@ test("INFO command", async () => {
 });
 
 test("unsupported or malformed commands", async () => {
-  startServer();
+  await startServer();
 
   const [probeErr, newErr, challengeErr] = await Promise.all([
     consume("/authority/CA/PROBE"),
@@ -510,7 +517,7 @@ test("unsupported or malformed commands", async () => {
 });
 
 test("probe no result", async () => {
-  startServer({ async probe() { return {}; } });
+  await startServer({ async probe() { return {}; } });
 
   await expect(requestProbe({
     profile: caProfile,
@@ -519,7 +526,7 @@ test("probe no result", async () => {
 });
 
 test("probe mismatch", async () => {
-  startServer({
+  await startServer({
     async probe() { expect.fail("unexpected server probe"); },
   });
 
@@ -531,7 +538,7 @@ test("probe mismatch", async () => {
 
 test("probe entries and redirects", async () => {
   const subCertFullName = await subCert.data.computeFullName();
-  const { bridge } = startServer({
+  const { bridge } = await startServer({
     async probe(parameters: ParameterKV) {
       expect(parameters.uid).toEqualUint8Array(toUtf8("my-uid"));
       return {
@@ -565,7 +572,7 @@ test("probe entries and redirects", async () => {
     },
     caCertFullName: redirects[0]!.caCertFullName,
   })).rejects.toThrow();
-  startServer({
+  await startServer({
     profile: subProfile,
     signer: subSigner,
   }, { bridge });
@@ -581,11 +588,12 @@ test.each(TABLE)("challenge $summary", { timeout: 15000 }, async ({
   nChallengeInterest,
   lostChallengeData,
   clientError = false,
+  serverCleared = true,
 }) => {
   const [serverChallenges, clientChallenges] = await makeChallengeLists();
   const challengePrefix = new Name("/authority/CA/CHALLENGE");
   let nSentChallengeInterests = 0;
-  startServer({ challenges: serverChallenges }, {
+  const { server } = await startServer({ challenges: serverChallenges }, {
     async *relayAB(it) {
       for await (const wire of it) {
         const { interest } = Bridge.RelayFunc.extract(wire);
@@ -620,4 +628,8 @@ test.each(TABLE)("challenge $summary", { timeout: 15000 }, async ({
     await expect(reqPromise).rejects.toThrow(clientError);
   }
   expect(nSentChallengeInterests).toBe(nChallengeInterest);
+
+  if (serverCleared) {
+    expect((server as any).state.size).toBe(0);
+  }
 });