feat(mesh): known-cluster gate + Matches on the PSK provider
Phase 1A security register items 1 and 2, landed ahead of the command fan-out because they are independently testable and the fan-out is the first caller of TryGetPsk. Item 1 — known-cluster gate. MeshPskProvider gains SetKnownClusters, an atomic whole-set swap consulted by TryGetPsk BEFORE the config map and before the secret store. A cluster id outside the set is refused in O(1) with no store read and no audit write, which closes two things at once: the pre-auth store/audit flood an unauthenticated caller could drive with a forged x-otopcua-cluster header, and the timing oracle that defeated CentralCommandAuthInterceptor's uniform denial text (unknown clusters are never cached, so they paid a store read on every probe while known ones answered from memory). Empty or never-published leaves the gate inactive — central publishes the set from its DB contact refresh, and 'the DB told me nothing' must not become a fleet-wide authentication outage during admin boot. Item 2 — bool Matches(clusterId, presented) on IMeshPskProvider, with FixedTimeEquals inside the provider. CentralCommandAuthInterceptor now calls it and never holds key material; its two provider-side denial logs collapse into one (the provider answers both as false) and the operator hint is restated there. No production caller publishes a cluster set yet, so behaviour is unchanged until the fan-out commit wires the contact refresh. ControlPlane.Tests 190 -> 205, Host.Tests 91 -> 92.
This commit is contained in:
Joseph Doherty
+199
@@ -367,6 +367,205 @@ public sealed class MeshPskProviderTests
|
||||
resolver.CallCount.ShouldBe(0);
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------------ known-cluster gate
|
||||
//
|
||||
// Phase 1A security register item 1. Central rebuilds its cluster set from ClusterNode rows on
|
||||
// every contact refresh; a cluster id outside that set must be refused in O(1) BEFORE anything
|
||||
// touches the secret store. Two things ride on that: an unauthenticated caller can no longer
|
||||
// make central perform a store read (and an audit write) per forged x-otopcua-cluster header,
|
||||
// and the timing difference between a known cluster (cached) and an unknown one (never cached,
|
||||
// because negatives are deliberately not retained) stops being remotely measurable.
|
||||
|
||||
[Fact]
|
||||
public void UnknownCluster_WithTheGatePopulated_IsRefused_WithoutTouchingTheStore()
|
||||
{
|
||||
// THE assertion of the register item. CallCount == 0 is the whole point: the refusal must
|
||||
// cost nothing, or the gate is a comment rather than a control.
|
||||
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
||||
var provider = CreateProvider(resolver);
|
||||
provider.SetKnownClusters(["SITE-A", "SITE-B"]);
|
||||
|
||||
provider.TryGetPsk("SITE-Z", out var psk).ShouldBeFalse();
|
||||
|
||||
psk.ShouldBeNull();
|
||||
resolver.CallCount.ShouldBe(0);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void KnownCluster_WithTheGatePopulated_StillResolves()
|
||||
{
|
||||
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
||||
var provider = CreateProvider(resolver);
|
||||
provider.SetKnownClusters(["SITE-A"]);
|
||||
|
||||
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
||||
|
||||
psk.ShouldBe("stored-psk");
|
||||
resolver.CallCount.ShouldBe(1);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void TheKnownClusterSet_IsCaseInsensitive()
|
||||
{
|
||||
// ClusterId case is whatever the operator typed into the DB row; the header is whatever the
|
||||
// node was configured with. A case-sensitive gate would refuse a legitimate cluster.
|
||||
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
||||
var provider = CreateProvider(resolver);
|
||||
provider.SetKnownClusters(["SITE-A"]);
|
||||
|
||||
provider.TryGetPsk("site-a", out var psk).ShouldBeTrue();
|
||||
|
||||
psk.ShouldBe("stored-psk");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void SwappingTheKnownClusterSet_AddsAndRemovesClusters()
|
||||
{
|
||||
// The set is rebuilt from the DB every refresh, so both directions happen in production: a
|
||||
// new site appears, a retired one stops being accepted.
|
||||
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
||||
var provider = CreateProvider(resolver);
|
||||
|
||||
provider.SetKnownClusters(["SITE-A"]);
|
||||
provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
|
||||
provider.TryGetPsk("SITE-B", out _).ShouldBeFalse();
|
||||
|
||||
provider.SetKnownClusters(["SITE-B"]);
|
||||
provider.TryGetPsk("SITE-B", out _).ShouldBeTrue();
|
||||
provider.TryGetPsk("SITE-A", out _).ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AnEmptyKnownClusterSet_LeavesTheGateInactive()
|
||||
{
|
||||
// Fail-OPEN, deliberately and narrowly: central publishes the set from its contact refresh,
|
||||
// and an empty publish means "the DB told me nothing", not "no cluster is legitimate".
|
||||
// Refusing everything there would make a fleet-wide ack outage the failure mode of an empty
|
||||
// or unreadable ClusterNode table.
|
||||
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
||||
var provider = CreateProvider(resolver);
|
||||
provider.SetKnownClusters(["SITE-A"]);
|
||||
provider.SetKnownClusters([]);
|
||||
|
||||
provider.TryGetPsk("SITE-Z", out var psk).ShouldBeTrue();
|
||||
|
||||
psk.ShouldBe("stored-psk");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AnUnsetKnownClusterSet_LeavesTheGateInactive()
|
||||
{
|
||||
// Admin boot: the interceptor is live from the first request, but the first contact refresh
|
||||
// has not run yet. Gating on a set nobody has published would deny every ack in that window.
|
||||
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
||||
var provider = CreateProvider(resolver);
|
||||
|
||||
provider.TryGetPsk("SITE-Z", out var psk).ShouldBeTrue();
|
||||
|
||||
psk.ShouldBe("stored-psk");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void TheGate_IsConsultedBeforeTheConfigMap()
|
||||
{
|
||||
// Consequence worth pinning rather than discovering: a ClusterPsks entry for a cluster with
|
||||
// no enabled ClusterNode row is refused once the gate is populated. That is correct — central
|
||||
// would neither dial such a cluster nor accept an ack from it — but it is surprising enough
|
||||
// on a rig to deserve a test that names it.
|
||||
var resolver = new FakeSecretResolver();
|
||||
var provider = CreateProvider(
|
||||
resolver, new Dictionary<string, string> { ["SITE-X"] = "rig-psk-site-x" });
|
||||
provider.SetKnownClusters(["SITE-A"]);
|
||||
|
||||
provider.TryGetPsk("SITE-X", out var psk).ShouldBeFalse();
|
||||
|
||||
psk.ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void SetKnownClusters_TakesACopy_SoALaterMutationOfTheCallersList_CannotWidenTheGate()
|
||||
{
|
||||
var clusters = new List<string> { "SITE-A" };
|
||||
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
||||
var provider = CreateProvider(resolver);
|
||||
provider.SetKnownClusters(clusters);
|
||||
|
||||
clusters.Add("SITE-Z");
|
||||
|
||||
provider.TryGetPsk("SITE-Z", out _).ShouldBeFalse();
|
||||
}
|
||||
|
||||
// ------------------------------------------------------------------ Matches
|
||||
|
||||
[Fact]
|
||||
public void Matches_AcceptsTheClustersOwnKey()
|
||||
{
|
||||
var resolver = new FakeSecretResolver();
|
||||
var provider = CreateProvider(
|
||||
resolver, new Dictionary<string, string> { ["SITE-A"] = "psk-site-a" });
|
||||
|
||||
provider.Matches("SITE-A", "psk-site-a").ShouldBeTrue();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Matches_RejectsAnotherClustersKey()
|
||||
{
|
||||
// The isolation property, asserted at the provider rather than only at the interceptor:
|
||||
// choosing a cluster only changes which key you are graded against.
|
||||
var resolver = new FakeSecretResolver();
|
||||
var provider = CreateProvider(
|
||||
resolver,
|
||||
new Dictionary<string, string> { ["SITE-A"] = "psk-site-a", ["SITE-B"] = "psk-site-b" });
|
||||
|
||||
provider.Matches("SITE-A", "psk-site-b").ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Matches_IsNotAPrefixMatch()
|
||||
{
|
||||
var resolver = new FakeSecretResolver();
|
||||
var provider = CreateProvider(
|
||||
resolver, new Dictionary<string, string> { ["SITE-A"] = "psk-site-a" });
|
||||
|
||||
provider.Matches("SITE-A", "psk-site-").ShouldBeFalse();
|
||||
provider.Matches("SITE-A", "psk-site-a-and-more").ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Matches_FailsClosed_WhenTheClusterHasNoKey()
|
||||
{
|
||||
var resolver = new FakeSecretResolver { Value = null };
|
||||
var provider = CreateProvider(resolver);
|
||||
|
||||
provider.Matches("SITE-Z", "anything-at-all").ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("")]
|
||||
[InlineData(" ")]
|
||||
public void Matches_RejectsABlankPresentedToken(string presented)
|
||||
{
|
||||
// A blank key never reaches the cache (blank resolves fail closed), but a blank PRESENTED
|
||||
// token must be refused on its own terms rather than relying on that.
|
||||
var resolver = new FakeSecretResolver();
|
||||
var provider = CreateProvider(
|
||||
resolver, new Dictionary<string, string> { ["SITE-A"] = "psk-site-a" });
|
||||
|
||||
provider.Matches("SITE-A", presented).ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void Matches_IsRefusedByTheKnownClusterGate_WithoutTouchingTheStore()
|
||||
{
|
||||
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
||||
var provider = CreateProvider(resolver);
|
||||
provider.SetKnownClusters(["SITE-A"]);
|
||||
|
||||
provider.Matches("SITE-Z", "stored-psk").ShouldBeFalse();
|
||||
|
||||
resolver.CallCount.ShouldBe(0);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// An <see cref="ISecretResolver"/> whose answer the test controls between calls, so cache
|
||||
/// staleness and invalidation are observable without a real store.
|
||||
|
||||
+43
-1
@@ -242,14 +242,56 @@ public sealed class CentralCommandAuthInterceptorTests
|
||||
publicCtors.Length.ShouldBe(1);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Verification_GoesThroughMatches_AndTheInterceptorNeverHandlesTheKeyItself()
|
||||
{
|
||||
// Phase 1A security register item 2. The interceptor must not fetch the raw key and compare
|
||||
// it — that is how a constant-time comparison eventually becomes '=='. Matches owns the
|
||||
// comparison; TryGetPsk survives only for the DIAL side, which has to send the key.
|
||||
// (The provider's own default Matches calls TryGetPsk internally; this fake overrides it, so
|
||||
// a zero TryGetPsk count here means the INTERCEPTOR never asked for the key.)
|
||||
var provider = new FakeMeshPskProvider(("SITE-A", "psk-site-a"));
|
||||
var interceptor = new CentralCommandAuthInterceptor(
|
||||
provider, NullLogger<CentralCommandAuthInterceptor>.Instance);
|
||||
|
||||
await Invoke(interceptor, CreateContext(ReportApplyMethod, "Bearer psk-site-a", "SITE-A"));
|
||||
|
||||
provider.MatchesCalls.ShouldBe(1);
|
||||
provider.TryGetPskCalls.ShouldBe(0);
|
||||
}
|
||||
|
||||
/// <summary>An <see cref="IMeshPskProvider"/> over a fixed key set; unknown clusters fail closed.</summary>
|
||||
private sealed class FakeMeshPskProvider(params (string Cluster, string Psk)[] keys) : IMeshPskProvider
|
||||
{
|
||||
private readonly Dictionary<string, string> _keys =
|
||||
keys.ToDictionary(k => k.Cluster, k => k.Psk, StringComparer.OrdinalIgnoreCase);
|
||||
|
||||
/// <summary>How many times the raw key was asked for — must stay 0 on the verify path.</summary>
|
||||
public int TryGetPskCalls { get; private set; }
|
||||
|
||||
/// <summary>How many times verification went through the provider's comparison.</summary>
|
||||
public int MatchesCalls { get; private set; }
|
||||
|
||||
public bool TryGetPsk(string clusterId, [NotNullWhen(true)] out string? psk)
|
||||
=> _keys.TryGetValue(clusterId, out psk);
|
||||
{
|
||||
TryGetPskCalls++;
|
||||
return _keys.TryGetValue(clusterId, out psk);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Overrides the interface's default so the two calls are separately countable. The
|
||||
/// semantics are the default's: no key, or a key that is not exactly the presented token.
|
||||
/// </summary>
|
||||
public bool Matches(string clusterId, string presented)
|
||||
{
|
||||
MatchesCalls++;
|
||||
return !string.IsNullOrWhiteSpace(presented)
|
||||
&& _keys.TryGetValue(clusterId, out var expected)
|
||||
&& string.Equals(expected, presented, StringComparison.Ordinal);
|
||||
}
|
||||
|
||||
/// <summary>No-op: the gate is the production provider's behaviour, pinned in its own tests.</summary>
|
||||
public void SetKnownClusters(IReadOnlyCollection<string> clusterIds) { }
|
||||
|
||||
public void Invalidate(string clusterId) { }
|
||||
|
||||
|
||||
Reference in New Issue
Block a user