dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Resolve all 33 medium-severity architecture review findings

Browse Source 
Second slice of the 2026-09-09 whole-system review remediation
(docs/plans/2026-09-09-arch-review.md §10), on top of the High slice 146a1323.

Runtime/devices: SR-2 alarm on-trigger integration scope; SR-3 correlated NativeAlarmActor
subscribe retry; SR-4 immutable audited DB target; SR-5 ordered InstanceActor stop/flush;
SR-12 rehydration fence; SR-13 S&F gate recheck per delivery; DC-4 no OPC UA security
downgrade; DC-5 alarm snapshot for every new subscriber; ORCH-1 sync-dispose joins the pump.

Management/UI: MG-2 site scope on audit tree + Flow Debugger Replay; MG-3 stale-probe memo
removed; MG-4 server-owned bulk-deploy deadline; UI-5 sandbox runs in a killable child
process (new CentralUI.SandboxWorker project); UI-14 bounded sandbox output/IPC.

Edge/audit: EI-1 relay audit ownership; EI-2 SkipBodyCapture suppresses error text; EI-3/EI-11
error-field redaction + caps; EI-4 single relay deadline, pre-execution-only retry; EI-5
authenticated relay provenance; EI-10 body cap before audit read.

Persistence/contracts: DL-1 global Instance.UniqueName unique index + conflict translation;
DL-2 DataConnection protocol config encrypted at rest (migration
20260909203046_EnforceGlobalInstanceNamesAndProtectProtocolConfiguration — coordinated
central upgrade, old binaries cannot read protected rows); DL-3 bounded Replay paging;
DL-6 cross-site Overwrite of a deployed instance rejected; XC-4 proto descriptor contract test.

Config/hygiene: XC-1 central listener isolation by local port; XC-2/XC-3 inert SMTP + cron
keys removed from rig settings; CM-2 env2 bootstrap guard enabled; DC-6 deploy site exit code;
DC-7 notifier retries only explicit standby rejection; XC-5 ClusterClient purged from docs.

Gates recorded in the report: build 0/0, 9 397 passed / 0 failed, rig redeployed on all
eight nodes with the migration applied. 46 Low findings remain open.
This commit is contained in:
Joseph Doherty
2026-09-09 22:05:30 -04:00
parent 146a13238f
commit 9a87d7a328
136 changed files with 5441 additions and 648 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/ZB.MOM.WW.ScadaBridge.Host.Tests/CentralListenerIsolationTests.cs
+72
View File
@@ -0,0 +1,72 @@
using System.Net;
using Grpc.Net.Client;
using Google.Protobuf.WellKnownTypes;
using Grpc.Core;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Server.Kestrel.Core;
using Microsoft.AspNetCore.Hosting.Server;
using Microsoft.AspNetCore.Hosting.Server.Features;
using Microsoft.Extensions.DependencyInjection;
using ZB.MOM.WW.ScadaBridge.Communication.Grpc;
namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
public class CentralListenerIsolationTests
{
[Fact]
public async Task XC1_ActualSocketOwnsEndpoint_EvenWithForgedAuthority()
{
var builder = WebApplication.CreateBuilder();
builder.WebHost.ConfigureKestrel(k =>
{
for (var i = 0; i < 3; i++) k.Listen(IPAddress.Loopback, 0, l => l.Protocols = HttpProtocols.Http2);
});
builder.Services.AddGrpc();
await using var app = builder.Build();
var grpcPort = 0; var httpPort = 0; var metricsPort = 0;
app.UseRouting();
app.Use((context, next) =>
{
var branch = ((IApplicationBuilder)app).New();
branch.UseCentralListenerIsolation(grpcPort, metricsPort, [httpPort]);
branch.Run(next);
return branch.Build()(context);
});
app.MapGet("/metrics", () => "metrics");
app.MapGet("/health/ready", () => "ready");
app.MapGet("/management", () => "must stay on HTTP listener");
app.MapGrpcService<EchoCentral>();
await app.StartAsync();
var addresses = app.Services.GetRequiredService<IServer>().Features.Get<IServerAddressesFeature>()!.Addresses.ToArray();
httpPort = new Uri(addresses[0]).Port; grpcPort = new Uri(addresses[1]).Port; metricsPort = new Uri(addresses[2]).Port;
using var client = new HttpClient();
async Task<HttpStatusCode> Get(string address, string path, int authority)
{
using var request = new HttpRequestMessage(HttpMethod.Get, address + path)
{ Version = HttpVersion.Version20, VersionPolicy = HttpVersionPolicy.RequestVersionExact };
request.Headers.Host = $"127.0.0.1:{authority}";
using var response = await client.SendAsync(request);
return response.StatusCode;
}
Assert.Equal(HttpStatusCode.NotFound, await Get(addresses[1], "/metrics", httpPort));
Assert.Equal(HttpStatusCode.NotFound, await Get(addresses[1], "/management", httpPort));
Assert.Equal(HttpStatusCode.OK, await Get(addresses[0], "/management", grpcPort));
Assert.Equal(HttpStatusCode.OK, await Get(addresses[2], "/metrics", httpPort));
Assert.Equal(HttpStatusCode.OK, await Get(addresses[2], "/health/ready", grpcPort));
Assert.Equal(HttpStatusCode.NotFound, await Get(addresses[2], "/management", httpPort));
using var good = GrpcChannel.ForAddress(addresses[1]);
await new CentralControlService.CentralControlServiceClient(good).HeartbeatAsync(new HeartbeatDto());
using var inverseClient = new HttpClient();
inverseClient.DefaultRequestHeaders.Host = $"127.0.0.1:{grpcPort}";
using var wrong = GrpcChannel.ForAddress(addresses[0], new GrpcChannelOptions { HttpClient = inverseClient });
var rejected = await Assert.ThrowsAsync<RpcException>(async () =>
await new CentralControlService.CentralControlServiceClient(wrong).HeartbeatAsync(new HeartbeatDto()));
Assert.Equal(StatusCode.Unimplemented, rejected.StatusCode);
}
public sealed class EchoCentral : CentralControlService.CentralControlServiceBase
{
public override Task<Empty> Heartbeat(HeartbeatDto request, ServerCallContext context) => Task.FromResult(new Empty());
}
}
tests/ZB.MOM.WW.ScadaBridge.Host.Tests/InboundBodyLimitKestrelTests.cs
+61
View File
@@ -0,0 +1,61 @@
using System.Net;
using System.Text;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Hosting.Server;
using Microsoft.AspNetCore.Hosting.Server.Features;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Server.Kestrel.Core;
using Microsoft.Extensions.DependencyInjection;
using NSubstitute;
using ZB.MOM.WW.ScadaBridge.AuditLog.Configuration;
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
using ZB.MOM.WW.ScadaBridge.InboundAPI;
using ZB.MOM.WW.ScadaBridge.InboundAPI.Middleware;
namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
public class InboundBodyLimitKestrelTests
{
[Theory]
[InlineData(false, false, false)]
[InlineData(false, true, false)]
[InlineData(true, false, false)]
[InlineData(true, true, false)]
[InlineData(false, false, true)]
public async Task EI10_OverLimitBody_AuditCannotDisableKestrelCap(bool http2, bool skipCapture, bool declared)
{
var builder = WebApplication.CreateBuilder();
builder.WebHost.ConfigureKestrel(o => o.Listen(IPAddress.Loopback, 0, l => l.Protocols = http2 ? HttpProtocols.Http2 : HttpProtocols.Http1));
builder.Services.Configure<InboundApiOptions>(o => o.MaxRequestBodyBytes = 128);
builder.Services.Configure<AuditLogOptions>(o => o.PerTargetOverrides["echo"] = new PerTargetRedactionOverride { SkipBodyCapture = skipCapture });
builder.Services.AddSingleton(Substitute.For<ICentralAuditWriter>());
await using var app = builder.Build();
app.UseRouting();
app.UseAuditWriteMiddleware();
var dispatched = 0;
app.MapPost("/api/{methodName}", async (HttpContext context) =>
{
await context.Request.Body.CopyToAsync(Stream.Null);
Interlocked.Increment(ref dispatched);
return Results.Ok();
}).AddEndpointFilter<InboundApiEndpointFilter>();
await app.StartAsync();
var address = app.Services.GetRequiredService<IServer>().Features.Get<IServerAddressesFeature>()!.Addresses.Single();
using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, address + "/api/echo")
{ Version = http2 ? HttpVersion.Version20 : HttpVersion.Version11, VersionPolicy = HttpVersionPolicy.RequestVersionExact };
var bytes = Encoding.UTF8.GetBytes("{\"value\":\"" + new string('x', 1000) + "\"}");
request.Content = declared ? new ByteArrayContent(bytes) : new UnknownLengthContent(bytes);
request.Content.Headers.ContentType = new("application/json");
using var response = await client.SendAsync(request);
Assert.Equal(HttpStatusCode.RequestEntityTooLarge, response.StatusCode);
Assert.Equal(0, dispatched);
}
private sealed class UnknownLengthContent(byte[] bytes) : HttpContent
{
protected override Task SerializeToStreamAsync(Stream stream, TransportContext? context) => stream.WriteAsync(bytes).AsTask();
protected override bool TryComputeLength(out long length) { length = 0; return false; }
}
}