feat(mesh): per-cluster PSK provider + central interceptor
This commit is contained in:
Joseph Doherty
@@ -0,0 +1,199 @@
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using Grpc.Core;
|
||||
using Grpc.Core.Interceptors;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using ZB.MOM.WW.OtOpcUa.ControlPlane.Communication;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Host.Configuration;
|
||||
|
||||
/// <summary>
|
||||
/// Gates the central-side command endpoint (ClusterClient→gRPC migration). The
|
||||
/// <c>CentralCommandService.ReportApply</c> RPC is how a node tells central its deployment
|
||||
/// applied; the coordinator counts those acks, so anything able to reach central's command port
|
||||
/// could otherwise forge a fleet-wide "everything applied". This interceptor is the ONLY inbound
|
||||
/// auth on that endpoint.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <b>Scoped by method path.</b> Only calls under
|
||||
/// <c>/mesh_transport.v1.CentralCommandService/</c> are gated; every other method on the
|
||||
/// shared gRPC pipeline (config-serve, and on a fused node sync + telemetry + the node
|
||||
/// command service) passes through untouched, so this shares one <c>AddGrpc</c> registration
|
||||
/// with its siblings.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>Per-cluster key, not one server key.</b> Unlike the four sibling interceptors there is
|
||||
/// no single expected token: central talks to N site clusters, each with its own PSK. The
|
||||
/// caller names its cluster in <c>x-otopcua-cluster</c> and the bearer is verified against
|
||||
/// <i>that</i> cluster's key via <see cref="IMeshPskProvider"/>. The header is therefore a
|
||||
/// claim the caller must then prove, not a credential — choosing a different cluster only
|
||||
/// changes which key it is graded against. A single fleet-wide key would let one compromised
|
||||
/// site node forge acks on behalf of every other site.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>Fail-closed.</b> A missing or blank cluster header, and a cluster whose key cannot be
|
||||
/// established (unseeded, blank, or a secret store that is down), are both denied. There is
|
||||
/// deliberately no "try every known key" fallback: it would restore exactly the fleet-wide
|
||||
/// key this design exists to avoid.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Comparison is <see cref="CryptographicOperations.FixedTimeEquals"/> over UTF-8 bytes, so a
|
||||
/// wrong key cannot be recovered byte-by-byte from response timing. Length differences are
|
||||
/// unavoidably observable and are not sensitive.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>All three denials return the same status text</b>, unlike the sibling interceptors,
|
||||
/// which distinguish "no key configured" from "authentication failed". Here that distinction
|
||||
/// would be an enumeration oracle: the caller supplies the cluster id, so a distinguishable
|
||||
/// "no key for that cluster" reply would let an unauthenticated caller map which clusters
|
||||
/// central holds keys for. The operator-facing detail goes to the log instead.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>Exactly one public constructor.</b> <c>Grpc.AspNetCore</c> silently stops invoking an
|
||||
/// interceptor that has more than one public ctor — see
|
||||
/// <c>CentralCommandAuthInterceptorTests.HasExactlyOnePublicConstructor</c>.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class CentralCommandAuthInterceptor : Interceptor
|
||||
{
|
||||
private const string ServicePrefix = "/mesh_transport.v1.CentralCommandService/";
|
||||
private const string AuthorizationHeader = "authorization";
|
||||
private const string ClusterHeader = "x-otopcua-cluster";
|
||||
private const string BearerPrefix = "Bearer ";
|
||||
|
||||
private readonly IMeshPskProvider _pskProvider;
|
||||
private readonly ILogger<CentralCommandAuthInterceptor> _logger;
|
||||
|
||||
/// <summary>Creates the interceptor.</summary>
|
||||
/// <param name="pskProvider">Supplies the expected bearer token for a given cluster.</param>
|
||||
/// <param name="logger">Logger for denial diagnostics.</param>
|
||||
public CentralCommandAuthInterceptor(
|
||||
IMeshPskProvider pskProvider,
|
||||
ILogger<CentralCommandAuthInterceptor> logger)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(pskProvider);
|
||||
ArgumentNullException.ThrowIfNull(logger);
|
||||
|
||||
_pskProvider = pskProvider;
|
||||
_logger = logger;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public override Task<TResponse> UnaryServerHandler<TRequest, TResponse>(
|
||||
TRequest request,
|
||||
ServerCallContext context,
|
||||
UnaryServerMethod<TRequest, TResponse> continuation)
|
||||
{
|
||||
Authorize(context);
|
||||
return continuation(request, context);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public override Task DuplexStreamingServerHandler<TRequest, TResponse>(
|
||||
IAsyncStreamReader<TRequest> requestStream,
|
||||
IServerStreamWriter<TResponse> responseStream,
|
||||
ServerCallContext context,
|
||||
DuplexStreamingServerMethod<TRequest, TResponse> continuation)
|
||||
{
|
||||
Authorize(context);
|
||||
return continuation(requestStream, responseStream, context);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public override Task<TResponse> ClientStreamingServerHandler<TRequest, TResponse>(
|
||||
IAsyncStreamReader<TRequest> requestStream,
|
||||
ServerCallContext context,
|
||||
ClientStreamingServerMethod<TRequest, TResponse> continuation)
|
||||
{
|
||||
Authorize(context);
|
||||
return continuation(requestStream, context);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public override Task ServerStreamingServerHandler<TRequest, TResponse>(
|
||||
TRequest request,
|
||||
IServerStreamWriter<TResponse> responseStream,
|
||||
ServerCallContext context,
|
||||
ServerStreamingServerMethod<TRequest, TResponse> continuation)
|
||||
{
|
||||
Authorize(context);
|
||||
return continuation(request, responseStream, context);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Throws <see cref="RpcException"/> with <see cref="StatusCode.PermissionDenied"/> if this is
|
||||
/// a central-command call that does not name a cluster, names one with no resolvable key, or
|
||||
/// does not carry that cluster's bearer token. Non-command calls return immediately.
|
||||
/// </summary>
|
||||
private void Authorize(ServerCallContext context)
|
||||
{
|
||||
if (!context.Method.StartsWith(ServicePrefix, StringComparison.Ordinal))
|
||||
return;
|
||||
|
||||
var clusterId = ExtractHeader(context.RequestHeaders, ClusterHeader);
|
||||
if (string.IsNullOrWhiteSpace(clusterId))
|
||||
{
|
||||
_logger.LogWarning(
|
||||
"Rejected a central command call to {Method}: no {Header} header, so there is no "
|
||||
+ "cluster whose pre-shared key the caller could be graded against.",
|
||||
context.Method,
|
||||
ClusterHeader);
|
||||
throw new RpcException(new Status(
|
||||
StatusCode.PermissionDenied,
|
||||
"Central command authentication failed."));
|
||||
}
|
||||
|
||||
if (!_pskProvider.TryGetPsk(clusterId, out var expected))
|
||||
{
|
||||
_logger.LogWarning(
|
||||
"Rejected a central command call to {Method} claiming cluster {ClusterId}: no "
|
||||
+ "pre-shared key could be established for it. Seed the secret "
|
||||
+ "OT-MESH-PSK-<clusterId> on this node, or set "
|
||||
+ "MeshTransport:ClusterPsks:<clusterId> on a rig.",
|
||||
context.Method,
|
||||
clusterId);
|
||||
throw new RpcException(new Status(
|
||||
StatusCode.PermissionDenied,
|
||||
"Central command authentication failed."));
|
||||
}
|
||||
|
||||
var presented = ExtractBearerToken(context.RequestHeaders);
|
||||
if (presented is null || !FixedTimeEquals(presented, expected))
|
||||
{
|
||||
_logger.LogWarning(
|
||||
"Rejected a central command call to {Method} claiming cluster {ClusterId}: {Reason}.",
|
||||
context.Method,
|
||||
clusterId,
|
||||
presented is null ? "no bearer token presented" : "bearer token did not match");
|
||||
throw new RpcException(new Status(
|
||||
StatusCode.PermissionDenied,
|
||||
"Central command authentication failed."));
|
||||
}
|
||||
}
|
||||
|
||||
private static string? ExtractBearerToken(Metadata headers)
|
||||
{
|
||||
var value = ExtractHeader(headers, AuthorizationHeader);
|
||||
return value is not null && value.StartsWith(BearerPrefix, StringComparison.OrdinalIgnoreCase)
|
||||
? value[BearerPrefix.Length..]
|
||||
: null;
|
||||
}
|
||||
|
||||
private static string? ExtractHeader(Metadata headers, string name)
|
||||
{
|
||||
// gRPC lowercases header keys on the wire; compare case-insensitively anyway so a hand-built
|
||||
// Metadata in a test behaves the same as a real request.
|
||||
foreach (var entry in headers)
|
||||
{
|
||||
if (string.Equals(entry.Key, name, StringComparison.OrdinalIgnoreCase))
|
||||
return entry.Value;
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static bool FixedTimeEquals(string presented, string expected)
|
||||
=> CryptographicOperations.FixedTimeEquals(
|
||||
Encoding.UTF8.GetBytes(presented), Encoding.UTF8.GetBytes(expected));
|
||||
}
|
||||
Reference in New Issue
Block a user