Joseph Doherty
437 lines
17 KiB
C#
437 lines
17 KiB
C#
using Microsoft.Extensions.Configuration;
|
|
using Microsoft.Extensions.Logging;
|
|
using Microsoft.Extensions.Logging.Abstractions;
|
|
using Microsoft.Extensions.Options;
|
|
using Shouldly;
|
|
using Xunit;
|
|
using ZB.MOM.WW.OtOpcUa.Cluster;
|
|
using ZB.MOM.WW.OtOpcUa.ControlPlane.Communication;
|
|
using ZB.MOM.WW.Secrets.Abstractions;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.ControlPlane.Tests.Communication;
|
|
|
|
/// <summary>
|
|
/// ClusterClient→gRPC Phase 0 — central's per-cluster PSK lookup. Central talks to N site
|
|
/// clusters, each with its own key, so every outbound dial and every inbound ack verification
|
|
/// goes through here.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// The tests that matter are the adversarial ones: the store being down, the key being absent
|
|
/// or blank, and the cache handing back a value the store no longer agrees with. Every one of
|
|
/// those must end in "no key" — the caller then denies or skips, never proceeds unauthenticated.
|
|
/// </remarks>
|
|
public sealed class MeshPskProviderTests
|
|
{
|
|
private static MeshPskProvider CreateProvider(
|
|
ISecretResolver resolver,
|
|
Dictionary<string, string>? clusterPsks = null,
|
|
ILogger<MeshPskProvider>? logger = null)
|
|
{
|
|
var options = new MeshTransportOptions();
|
|
if (clusterPsks is not null)
|
|
{
|
|
foreach (var (key, value) in clusterPsks)
|
|
options.ClusterPsks[key] = value;
|
|
}
|
|
|
|
return new MeshPskProvider(
|
|
Options.Create(options), resolver, logger ?? NullLogger<MeshPskProvider>.Instance);
|
|
}
|
|
|
|
[Fact]
|
|
public void ConfigMapEntry_IsReturned_WithoutConsultingTheSecretStore()
|
|
{
|
|
var resolver = new FakeSecretResolver();
|
|
var provider = CreateProvider(
|
|
resolver, new Dictionary<string, string> { ["SITE-A"] = "rig-psk-site-a" });
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("rig-psk-site-a");
|
|
resolver.CallCount.ShouldBe(0);
|
|
}
|
|
|
|
[Fact]
|
|
public void ConfigMapEntry_WinsOverTheSecretStore()
|
|
{
|
|
// The map exists so a rig can supply literals without standing up a KEK. If the store also
|
|
// holds a key for that cluster the map must still win, or a stale store row would silently
|
|
// beat the value the operator just set.
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(
|
|
resolver, new Dictionary<string, string> { ["SITE-A"] = "rig-psk-site-a" });
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("rig-psk-site-a");
|
|
resolver.CallCount.ShouldBe(0);
|
|
}
|
|
|
|
[Fact]
|
|
public void ConfigMapLookup_IsCaseInsensitive()
|
|
{
|
|
// MeshTransport__ClusterPsks__site-a and __SITE-A are the same cluster. The map's comparer
|
|
// (set on MeshTransportOptions) is what makes that true; this pins the pairing.
|
|
var resolver = new FakeSecretResolver();
|
|
var provider = CreateProvider(
|
|
resolver, new Dictionary<string, string> { ["SITE-A"] = "rig-psk-site-a" });
|
|
|
|
provider.TryGetPsk("site-a", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("rig-psk-site-a");
|
|
}
|
|
|
|
[Fact]
|
|
public void BlankConfigMapEntry_FallsThroughToTheSecretStore()
|
|
{
|
|
// A blank map entry is an empty environment variable, not a decision. Treat it as absent
|
|
// rather than as an empty key that an empty bearer would satisfy.
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(
|
|
resolver, new Dictionary<string, string> { ["SITE-A"] = " " });
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("stored-psk");
|
|
resolver.CallCount.ShouldBe(1);
|
|
}
|
|
|
|
[Fact]
|
|
public void SecretStoreValue_IsReturned_UnderTheConventionalName()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("stored-psk");
|
|
// SecretName normalizes to lowercase — the same normalization ${secret:OT-MESH-PSK-SITE-A}
|
|
// goes through in the pre-host expander, so both paths address one row.
|
|
resolver.LastName.ShouldBe("ot-mesh-psk-site-a");
|
|
}
|
|
|
|
[Fact]
|
|
public void UnknownCluster_FailsClosed()
|
|
{
|
|
// Absent secret + no map entry. The caller denies; it must never fall back to "no auth".
|
|
var resolver = new FakeSecretResolver { Value = null };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-Z", out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void BlankSecretValue_FailsClosed()
|
|
{
|
|
// A row that decrypts to whitespace is a broken seed, not a key. Accepting it would make
|
|
// "Bearer " a valid credential for the whole cluster.
|
|
var resolver = new FakeSecretResolver { Value = " " };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ResolverThrow_FailsClosed()
|
|
{
|
|
// The store is a local SQLite file with an env KEK; a missing KEK throws rather than
|
|
// returning null. Any failure is "no key", never an exception escaping into the gRPC gate.
|
|
var resolver = new FakeSecretResolver { Throw = new InvalidOperationException("KEK unavailable") };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ResolverThrow_IsNotCached_SoRecoveryNeedsNoInvalidate()
|
|
{
|
|
// Caching a negative would turn a transient store fault into a permanent outage for that
|
|
// cluster, recoverable only by a restart or a hook nothing calls yet.
|
|
var resolver = new FakeSecretResolver { Throw = new InvalidOperationException("KEK unavailable") };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeFalse();
|
|
|
|
resolver.Throw = null;
|
|
resolver.Value = "stored-psk";
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
psk.ShouldBe("stored-psk");
|
|
}
|
|
|
|
[Fact]
|
|
public void ResolvedValue_IsCached_SoTheStoreIsHitOnce()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
|
|
provider.TryGetPsk("site-a", out _).ShouldBeTrue();
|
|
|
|
resolver.CallCount.ShouldBe(1);
|
|
}
|
|
|
|
[Fact]
|
|
public void Cache_ServesTheStaleValue_UntilInvalidated()
|
|
{
|
|
// Both directions matter: stale-until-invalidated is the whole reason Invalidate exists, and
|
|
// an invalidate that did not actually re-read would be indistinguishable from a no-op.
|
|
var resolver = new FakeSecretResolver { Value = "first-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out var first).ShouldBeTrue();
|
|
first.ShouldBe("first-psk");
|
|
|
|
resolver.Value = "rotated-psk";
|
|
|
|
provider.TryGetPsk("SITE-A", out var stale).ShouldBeTrue();
|
|
stale.ShouldBe("first-psk");
|
|
|
|
provider.Invalidate("SITE-A");
|
|
|
|
provider.TryGetPsk("SITE-A", out var fresh).ShouldBeTrue();
|
|
fresh.ShouldBe("rotated-psk");
|
|
}
|
|
|
|
[Fact]
|
|
public void Invalidate_IsCaseInsensitive_AndScopedToOneCluster()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "first-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
|
|
provider.TryGetPsk("SITE-B", out _).ShouldBeTrue();
|
|
|
|
resolver.Value = "rotated-psk";
|
|
provider.Invalidate("site-a");
|
|
|
|
provider.TryGetPsk("SITE-A", out var a).ShouldBeTrue();
|
|
a.ShouldBe("rotated-psk");
|
|
|
|
provider.TryGetPsk("SITE-B", out var b).ShouldBeTrue();
|
|
b.ShouldBe("first-psk");
|
|
}
|
|
|
|
[Fact]
|
|
public void Invalidate_OnACacheMiss_IsANoOp()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
Should.NotThrow(() => provider.Invalidate("never-seen"));
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
psk.ShouldBe("stored-psk");
|
|
}
|
|
|
|
[Fact]
|
|
public void InvalidateAll_DropsEveryCluster()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "first-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
|
|
provider.TryGetPsk("SITE-B", out _).ShouldBeTrue();
|
|
|
|
resolver.Value = "rotated-psk";
|
|
provider.InvalidateAll();
|
|
|
|
provider.TryGetPsk("SITE-A", out var a).ShouldBeTrue();
|
|
provider.TryGetPsk("SITE-B", out var b).ShouldBeTrue();
|
|
|
|
a.ShouldBe("rotated-psk");
|
|
b.ShouldBe("rotated-psk");
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("")]
|
|
[InlineData(" ")]
|
|
public void BlankClusterId_FailsClosed(string clusterId)
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk(clusterId, out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
resolver.CallCount.ShouldBe(0);
|
|
}
|
|
|
|
[Fact]
|
|
public void ClusterIdThatCannotFormASecretName_FailsClosed()
|
|
{
|
|
// Cluster ids are operator-authored; SecretName's allow-list is [a-z0-9._/-]. A '$' throws
|
|
// out of the SecretName ctor, and that throw must become "no key", not a 500 in the gate.
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE$A", out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
resolver.CallCount.ShouldBe(0);
|
|
}
|
|
|
|
[Fact(Timeout = 30_000)]
|
|
public async Task ConcurrentCallers_ResolveOnce_AndAllSeeTheSameValue()
|
|
{
|
|
// The gRPC gate calls this from every inbound ack, on arbitrary thread-pool threads. A
|
|
// non-atomic fill would stampede the store and could hand two callers different keys.
|
|
//
|
|
// The shape matters more than the assertion. Callers park BEFORE TryGetPsk and are released
|
|
// together, so the race is real rather than accidentally serialized by task scheduling —
|
|
// parking them INSIDE the resolver could never work, because the whole point of the Lazy is
|
|
// that only one caller ever gets in there. And the resolver's delay RETURNS rather than
|
|
// waiting on a gate: a regression that lets a second caller reach the store must drive
|
|
// CallCount to 2 (red), never sit on an exhausted semaphore (hang, which reads as a flake).
|
|
const int Callers = 16;
|
|
using var arrived = new CountdownEvent(Callers);
|
|
using var start = new ManualResetEventSlim(false);
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk", ResolveDelay = TimeSpan.FromMilliseconds(50) };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
// LongRunning gives each caller a dedicated thread: reaching the arrival gate must not
|
|
// depend on thread-pool injection, which is rate-limited and made this flake on a
|
|
// contended box (the gate timed out before all 16 pool threads existed).
|
|
var callers = Enumerable.Range(0, Callers).Select(_ => Task.Factory.StartNew(() =>
|
|
{
|
|
arrived.Signal();
|
|
start.Wait();
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
return psk;
|
|
}, CancellationToken.None, TaskCreationOptions.LongRunning, TaskScheduler.Default)).ToArray();
|
|
|
|
arrived.Wait(TimeSpan.FromSeconds(10)).ShouldBeTrue("all callers should reach the start gate");
|
|
start.Set();
|
|
var results = await Task.WhenAll(callers);
|
|
|
|
results.ShouldAllBe(r => r == "stored-psk");
|
|
resolver.CallCount.ShouldBe(1);
|
|
}
|
|
|
|
[Fact]
|
|
public void APoisonedCacheEntry_IsEvicted_RatherThanDenyingTheClusterForever()
|
|
{
|
|
// ResolveFromStore swallows what the store throws, but it LOGS while doing so — and a logger
|
|
// provider that throws escapes the factory. Lazy under ExecutionAndPublication caches that
|
|
// exception and rethrows it on every later read, so an unguarded entry.Value would deny this
|
|
// cluster for the life of the process; nothing calls Invalidate until Phase 1A.
|
|
var logger = new ThrowingLogger { ThrowOnLog = true };
|
|
var resolver = new FakeSecretResolver { Throw = new InvalidOperationException("KEK unavailable") };
|
|
var provider = CreateProvider(resolver, logger: logger);
|
|
|
|
// The logger throwing must not escape the gate either — a denial, not a 500.
|
|
provider.TryGetPsk("SITE-A", out var first).ShouldBeFalse();
|
|
first.ShouldBeNull();
|
|
resolver.CallCount.ShouldBe(1);
|
|
|
|
logger.ThrowOnLog = false;
|
|
resolver.Throw = null;
|
|
resolver.Value = "stored-psk";
|
|
|
|
provider.TryGetPsk("SITE-A", out var second).ShouldBeTrue();
|
|
second.ShouldBe("stored-psk");
|
|
resolver.CallCount.ShouldBe(2); // reached the store again — the entry was not poisoned
|
|
}
|
|
|
|
[Fact]
|
|
public void ConfigMapLookup_StaysCaseInsensitive_ThroughRealConfigurationBinding()
|
|
{
|
|
// Writing into the options object pins only the field initializer's comparer. What reaches
|
|
// production is a BOUND instance, and the binder is free to construct its own Dictionary and
|
|
// drop the comparer silently — the symptom being a rig lookup that misses on a ClusterId
|
|
// spelled the way the DB spells it. Bind for real, then go through the PROVIDER.
|
|
var configuration = new ConfigurationBuilder()
|
|
.AddInMemoryCollection(new Dictionary<string, string?>
|
|
{
|
|
["MeshTransport:ClusterPsks:SITE-A"] = "rig-psk-site-a",
|
|
})
|
|
.Build();
|
|
|
|
var options = new MeshTransportOptions();
|
|
configuration.GetSection(MeshTransportOptions.SectionName).Bind(options);
|
|
|
|
var resolver = new FakeSecretResolver();
|
|
var provider = new MeshPskProvider(
|
|
Options.Create(options), resolver, NullLogger<MeshPskProvider>.Instance);
|
|
|
|
provider.TryGetPsk("site-a", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("rig-psk-site-a");
|
|
resolver.CallCount.ShouldBe(0);
|
|
}
|
|
|
|
/// <summary>
|
|
/// An <see cref="ISecretResolver"/> whose answer the test controls between calls, so cache
|
|
/// staleness and invalidation are observable without a real store.
|
|
/// </summary>
|
|
private sealed class FakeSecretResolver : ISecretResolver
|
|
{
|
|
private int _callCount;
|
|
|
|
/// <summary>What <see cref="GetAsync"/> returns when <see cref="Throw"/> is null.</summary>
|
|
public string? Value { get; set; }
|
|
|
|
/// <summary>When set, <see cref="GetAsync"/> throws it instead of returning.</summary>
|
|
public Exception? Throw { get; set; }
|
|
|
|
/// <summary>
|
|
/// How long each call takes before answering. Widens the window a concurrent stampede
|
|
/// would have to exploit — and it RETURNS, so a second entrant shows up as a second call
|
|
/// rather than as a hang.
|
|
/// </summary>
|
|
public TimeSpan ResolveDelay { get; set; } = TimeSpan.Zero;
|
|
|
|
/// <summary>How many times the store was consulted.</summary>
|
|
public int CallCount => Volatile.Read(ref _callCount);
|
|
|
|
/// <summary>The name of the most recently requested secret.</summary>
|
|
public string? LastName { get; private set; }
|
|
|
|
public async Task<string?> GetAsync(SecretName name, CancellationToken ct)
|
|
{
|
|
LastName = name.Value;
|
|
Interlocked.Increment(ref _callCount);
|
|
|
|
if (ResolveDelay > TimeSpan.Zero)
|
|
await Task.Delay(ResolveDelay, ct).ConfigureAwait(false);
|
|
|
|
if (Throw is not null)
|
|
throw Throw;
|
|
|
|
return Value;
|
|
}
|
|
}
|
|
|
|
/// <summary>
|
|
/// An <see cref="ILogger{T}"/> that can be made to throw, standing in for a logger provider
|
|
/// that faults — the only way the provider's own catch blocks can throw.
|
|
/// </summary>
|
|
private sealed class ThrowingLogger : ILogger<MeshPskProvider>
|
|
{
|
|
/// <summary>When true, every <see cref="Log"/> call throws.</summary>
|
|
public bool ThrowOnLog { get; set; }
|
|
|
|
public IDisposable? BeginScope<TState>(TState state) where TState : notnull => null;
|
|
|
|
public bool IsEnabled(LogLevel logLevel) => true;
|
|
|
|
public void Log<TState>(
|
|
LogLevel logLevel,
|
|
EventId eventId,
|
|
TState state,
|
|
Exception? exception,
|
|
Func<TState, Exception?, string> formatter)
|
|
{
|
|
if (ThrowOnLog)
|
|
throw new InvalidOperationException("logger provider faulted");
|
|
}
|
|
}
|
|
}
|