feat(mesh): node-side PSK interceptor
This commit is contained in:
Joseph Doherty
@@ -0,0 +1,173 @@
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
using Grpc.Core;
|
||||
using Grpc.Core.Interceptors;
|
||||
using Microsoft.Extensions.Logging;
|
||||
using Microsoft.Extensions.Options;
|
||||
using ZB.MOM.WW.OtOpcUa.Cluster;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Host.Configuration;
|
||||
|
||||
/// <summary>
|
||||
/// Gates the node-side command endpoint (ClusterClient→gRPC migration). The
|
||||
/// <c>NodeCommandService.Execute</c> RPC is how central drives this node — restart a driver,
|
||||
/// acknowledge an alarm, dispatch a deployment — so anything able to reach a node's command port
|
||||
/// could otherwise operate the node. This interceptor is the ONLY inbound auth on that endpoint.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <b>Scoped by method path.</b> Only calls under
|
||||
/// <c>/mesh_transport.v1.NodeCommandService/</c> are gated; every other method on the shared
|
||||
/// gRPC pipeline (LocalDb sync, config-serve, telemetry) passes through untouched, so this can
|
||||
/// share one <c>AddGrpc</c> registration with <see cref="LocalDbSyncAuthInterceptor"/>,
|
||||
/// <see cref="ConfigServeAuthInterceptor"/> and <see cref="TelemetryStreamAuthInterceptor"/>.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>Fail-closed.</b> With no <c>MeshTransport:GrpcPsk</c> configured, NO command is
|
||||
/// accepted, authenticated or not. Treating "no key" as "no auth required" would expose the
|
||||
/// command plane on exactly the default shape every node ships with — and unlike the three
|
||||
/// sibling endpoints, this one is a write surface, not a read one. Central must present the
|
||||
/// same per-cluster key, so a key typo stops commands outright rather than degrading to
|
||||
/// unauthenticated.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>No <c>x-otopcua-cluster</c> requirement here, deliberately.</b> That header is a
|
||||
/// central-side routing hint — the caller's own claim about which cluster it is addressing.
|
||||
/// Requiring a node to check it would gate on a value the caller chooses, which proves
|
||||
/// nothing the key has not already proven; the key IS the cluster boundary, so a caller
|
||||
/// holding another cluster's PSK is rejected by the comparison below.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Comparison is <see cref="CryptographicOperations.FixedTimeEquals"/> over UTF-8 bytes, so a
|
||||
/// wrong key cannot be recovered byte-by-byte from response timing. Length differences are
|
||||
/// unavoidably observable and are not sensitive.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>Exactly one public constructor.</b> <c>Grpc.AspNetCore</c> silently stops invoking an
|
||||
/// interceptor that has more than one public ctor — see
|
||||
/// <c>MeshCommandAuthInterceptorTests.HasExactlyOnePublicConstructor</c>.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class MeshCommandAuthInterceptor : Interceptor
|
||||
{
|
||||
private const string ServicePrefix = "/mesh_transport.v1.NodeCommandService/";
|
||||
private const string AuthorizationHeader = "authorization";
|
||||
private const string BearerPrefix = "Bearer ";
|
||||
|
||||
private readonly IOptions<MeshTransportOptions> _options;
|
||||
private readonly ILogger<MeshCommandAuthInterceptor> _logger;
|
||||
|
||||
/// <summary>Creates the interceptor.</summary>
|
||||
/// <param name="options">Mesh transport options; <c>GrpcPsk</c> is the expected bearer token.</param>
|
||||
/// <param name="logger">Logger for denial diagnostics.</param>
|
||||
public MeshCommandAuthInterceptor(
|
||||
IOptions<MeshTransportOptions> options,
|
||||
ILogger<MeshCommandAuthInterceptor> logger)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(options);
|
||||
ArgumentNullException.ThrowIfNull(logger);
|
||||
|
||||
_options = options;
|
||||
_logger = logger;
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public override Task<TResponse> UnaryServerHandler<TRequest, TResponse>(
|
||||
TRequest request,
|
||||
ServerCallContext context,
|
||||
UnaryServerMethod<TRequest, TResponse> continuation)
|
||||
{
|
||||
Authorize(context);
|
||||
return continuation(request, context);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public override Task DuplexStreamingServerHandler<TRequest, TResponse>(
|
||||
IAsyncStreamReader<TRequest> requestStream,
|
||||
IServerStreamWriter<TResponse> responseStream,
|
||||
ServerCallContext context,
|
||||
DuplexStreamingServerMethod<TRequest, TResponse> continuation)
|
||||
{
|
||||
Authorize(context);
|
||||
return continuation(requestStream, responseStream, context);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public override Task<TResponse> ClientStreamingServerHandler<TRequest, TResponse>(
|
||||
IAsyncStreamReader<TRequest> requestStream,
|
||||
ServerCallContext context,
|
||||
ClientStreamingServerMethod<TRequest, TResponse> continuation)
|
||||
{
|
||||
Authorize(context);
|
||||
return continuation(requestStream, context);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public override Task ServerStreamingServerHandler<TRequest, TResponse>(
|
||||
TRequest request,
|
||||
IServerStreamWriter<TResponse> responseStream,
|
||||
ServerCallContext context,
|
||||
ServerStreamingServerMethod<TRequest, TResponse> continuation)
|
||||
{
|
||||
Authorize(context);
|
||||
return continuation(request, responseStream, context);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Throws <see cref="RpcException"/> with <see cref="StatusCode.PermissionDenied"/> if this is
|
||||
/// a node-command call that does not carry the configured bearer token. Non-command calls
|
||||
/// return immediately.
|
||||
/// </summary>
|
||||
private void Authorize(ServerCallContext context)
|
||||
{
|
||||
if (!context.Method.StartsWith(ServicePrefix, StringComparison.Ordinal))
|
||||
return;
|
||||
|
||||
var expected = _options.Value.GrpcPsk;
|
||||
if (string.IsNullOrWhiteSpace(expected))
|
||||
{
|
||||
_logger.LogWarning(
|
||||
"Rejected a mesh command call to {Method}: no MeshTransport:GrpcPsk is configured, so " +
|
||||
"the node command endpoint is closed. Set this node's per-cluster pre-shared key " +
|
||||
"(MeshTransport__GrpcPsk), ideally as a ${{secret:OT-MESH-PSK-<clusterId>}} reference, " +
|
||||
"and give central the same key for this cluster.",
|
||||
context.Method);
|
||||
throw new RpcException(new Status(
|
||||
StatusCode.PermissionDenied,
|
||||
"Node command service is not accepting calls: no pre-shared key is configured on this node."));
|
||||
}
|
||||
|
||||
var presented = ExtractBearerToken(context.RequestHeaders);
|
||||
if (presented is null || !FixedTimeEquals(presented, expected))
|
||||
{
|
||||
_logger.LogWarning(
|
||||
"Rejected a mesh command call to {Method}: {Reason}.",
|
||||
context.Method,
|
||||
presented is null ? "no bearer token presented" : "bearer token did not match");
|
||||
throw new RpcException(new Status(
|
||||
StatusCode.PermissionDenied,
|
||||
"Node command authentication failed."));
|
||||
}
|
||||
}
|
||||
|
||||
private static string? ExtractBearerToken(Metadata headers)
|
||||
{
|
||||
// gRPC lowercases header keys on the wire; compare case-insensitively anyway so a hand-built
|
||||
// Metadata in a test behaves the same as a real request.
|
||||
foreach (var entry in headers)
|
||||
{
|
||||
if (!string.Equals(entry.Key, AuthorizationHeader, StringComparison.OrdinalIgnoreCase))
|
||||
continue;
|
||||
|
||||
var value = entry.Value;
|
||||
if (value is not null && value.StartsWith(BearerPrefix, StringComparison.OrdinalIgnoreCase))
|
||||
return value[BearerPrefix.Length..];
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private static bool FixedTimeEquals(string presented, string expected)
|
||||
=> CryptographicOperations.FixedTimeEquals(
|
||||
Encoding.UTF8.GetBytes(presented), Encoding.UTF8.GetBytes(expected));
|
||||
}
|
||||
@@ -547,6 +547,12 @@ builder.Services.AddOtOpcUaObservability(builder.Configuration);
|
||||
// — the interceptor is the ONLY inbound auth on any endpoint (the libraries verify nothing).
|
||||
// Registered whenever either role is present so an admin-only node still serves config and a
|
||||
// driver-only node still gates sync + telemetry.
|
||||
//
|
||||
// MeshCommandAuthInterceptor (ClusterClient→gRPC migration) joins on the same terms: it gates the
|
||||
// node-side NodeCommandService and is registered NOW, a pure pass-through until Phase 1 maps that
|
||||
// service — an interceptor whose service is unmapped never sees a matching path. Registering it
|
||||
// alongside the service it gates would put a security gate's wiring in the same commit as the write
|
||||
// surface it protects; doing it here means the gate cannot be forgotten when that surface lights up.
|
||||
if (hasDriver || hasAdmin)
|
||||
{
|
||||
builder.Services.AddGrpc(o =>
|
||||
@@ -555,6 +561,7 @@ if (hasDriver || hasAdmin)
|
||||
{
|
||||
o.Interceptors.Add<LocalDbSyncAuthInterceptor>();
|
||||
o.Interceptors.Add<TelemetryStreamAuthInterceptor>();
|
||||
o.Interceptors.Add<MeshCommandAuthInterceptor>();
|
||||
}
|
||||
if (hasAdmin)
|
||||
o.Interceptors.Add<ConfigServeAuthInterceptor>();
|
||||
|
||||
Reference in New Issue
Block a user