'Test that flows refuse to processes unauthenticated messages.
Here we try to simulate an attacker injecting unauthenticated
messages midstream.
The current implementation actually fails to process the entire
flow since the injected messages displace the real ones if they
arrive earlier. This can be an effective DoS against legitimate
clients but would require attackers to guess session ids.'

def testAuthentication2(self):

    flow_obj = self.FlowSetup(flow_test_lib.FlowOrderTest.__name__)
    message_ids = [1, 2]
    self.SendMessages(message_ids, flow_obj.session_id, authenticated=True)
    message_ids = [3, 4, 5]
    self.SendMessages(message_ids, flow_obj.session_id, authenticated=False)
    message_ids = [5, 6]
    self.SendMessages(message_ids, flow_obj.session_id, authenticated=True)
    self.SendOKStatus(7, flow_obj.session_id)
    runner = flow_obj.GetRunner()
    notification = rdf_flows.GrrNotification(timestamp=rdfvalue.RDFDatetime.Now())
    runner.ProcessCompletedRequests(notification)
    self.assertEqual(flow_obj.messages, [1, 2, 5, 6])
