Joseph Doherty
4a6229e4d2
env:<PREFIX><INSTANCE>_... is the per-instance convention for every prefix of a driver's scope (OTOPCUA_GALAXY_, GALAXY_MXGW_, OTOPCUA_OPCUACLIENT_, OTOPCUA_HEIDENHAIN_), INSTANCE = a driver id or name upper-cased with every other character as '_'. A variable whose part after the prefix equals or starts with (at a '_' boundary) ANOTHER same-type instance's id or name is refused with CredentialReferenceOtherInstance at save, deploy, Test Connect and browse - the same DriverCredentialPolicy.DescribeOtherInstanceProblems the secret: rule uses (now over CollectInstanceReferences / ReferenceNames). Another-instance matches win over the owner's, as for secrets. Shared variables that name no instance (GALAXY_MXGW_API_KEY) keep working. HasInstanceSegments now also gates on env:, so an env:-only browse needs the ConfigDb (fail-closed without it). Co-Authored-By: Claude <noreply@anthropic.com>
189 lines
10 KiB
C#
189 lines
10 KiB
C#
using Shouldly;
|
|
using Xunit;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests;
|
|
|
|
/// <summary>
|
|
/// lmxopcua#835: inside one namespace, a credential reference whose instance segment
|
|
/// (<c>secret:galaxy/<X>/…</c>) names ANOTHER existing instance of the same driver type is refused.
|
|
/// </summary>
|
|
[Trait("Category", "Unit")]
|
|
public sealed class CredentialInstanceScopeTests
|
|
{
|
|
private static readonly DriverInstanceIdentity[] Instances =
|
|
[
|
|
new("DRV-aaa", "PlantA", DriverTypeNames.Galaxy),
|
|
new("DRV-bbb", "PlantB", DriverTypeNames.Galaxy),
|
|
new("DRV-ccc", "UpstreamC", DriverTypeNames.OpcUaClient),
|
|
new("DRV-ddd", "UpstreamD", DriverTypeNames.OpcUaClient),
|
|
];
|
|
|
|
private static string Galaxy(string apiKeyRef) =>
|
|
"{\"Gateway\":{\"Endpoint\":\"http://evil:5001\",\"ApiKeySecretRef\":" + System.Text.Json.JsonSerializer.Serialize(apiKeyRef) + "}}";
|
|
|
|
[Theory]
|
|
[InlineData("secret:galaxy/DRV-bbb/apikey")]
|
|
[InlineData("secret:galaxy/PlantB/apikey")]
|
|
[InlineData("secret:galaxy/plantb/apikey")] // case-insensitive
|
|
[InlineData("secret:otopcua/galaxy/PlantB/apikey")] // the second namespace
|
|
[InlineData("${secret:galaxy/PlantB/apikey}")] // the token spelling
|
|
[InlineData("secret:galaxy/PlantB")] // the segment alone
|
|
public void A_reference_naming_another_instance_is_refused(string reference)
|
|
{
|
|
var problem = DriverCredentialPolicy
|
|
.DescribeOtherInstanceProblems(DriverTypeNames.Galaxy, Galaxy(reference), "DRV-aaa", Instances)
|
|
.ShouldHaveSingleItem();
|
|
problem.ShouldContain("Gateway.ApiKeySecretRef");
|
|
problem.ShouldContain("lmxopcua#835");
|
|
problem.ShouldContain("DRV-bbb");
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("secret:galaxy/DRV-aaa/apikey")] // its own id
|
|
[InlineData("secret:galaxy/PlantA/apikey")] // its own name
|
|
[InlineData("secret:galaxy/gw/apikey")] // a shared name no instance uses
|
|
[InlineData("secret:galaxy/apikey")]
|
|
[InlineData("secret:galaxy/UpstreamC/apikey")] // another TYPE's instance — not this namespace's owner
|
|
[InlineData("env:OTOPCUA_GALAXY_PLANTA_KEY")] // its own name in env form (lmxopcua#849)
|
|
[InlineData("env:OTOPCUA_GALAXY_DRV_AAA_KEY")] // its own id in env form
|
|
[InlineData("env:GALAXY_MXGW_API_KEY")] // a shared variable that names no instance
|
|
[InlineData("env:OTOPCUA_GALAXY_PLANTBX_KEY")] // 'PLANTB' only at a '_' boundary
|
|
[InlineData("dev:k")]
|
|
[InlineData("")]
|
|
public void Own_shared_and_non_secret_references_pass(string reference) =>
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(DriverTypeNames.Galaxy, Galaxy(reference), "DRV-aaa", Instances)
|
|
.ShouldBeEmpty();
|
|
|
|
[Fact]
|
|
public void A_driver_being_created_may_name_no_existing_instance() =>
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(DriverTypeNames.Galaxy, Galaxy("secret:galaxy/PlantA/apikey"), null, Instances)
|
|
.ShouldHaveSingleItem();
|
|
|
|
[Fact]
|
|
public void Renaming_ones_own_driver_after_the_victim_does_not_unlock_the_victims_secret()
|
|
{
|
|
// Attacker DRV-zzz renamed itself "PlantB" (names are unique per folder, not fleet-wide).
|
|
var withTwin = Instances.Append(new DriverInstanceIdentity("DRV-zzz", "PlantB", DriverTypeNames.Galaxy));
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(DriverTypeNames.Galaxy, Galaxy("secret:galaxy/PlantB/apikey"), "DRV-zzz", withTwin)
|
|
.ShouldHaveSingleItem();
|
|
}
|
|
|
|
[Fact]
|
|
public void The_ack_password_and_device_level_fields_are_checked_too()
|
|
{
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(
|
|
DriverTypeNames.Galaxy, """{"AlarmAck":{"FallbackPasswordSecretRef":"secret:otopcua/galaxy/DRV-bbb/ack"}}""", "DRV-aaa", Instances)
|
|
.ShouldHaveSingleItem().ShouldContain("AlarmAck.FallbackPasswordSecretRef");
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(
|
|
DriverTypeNames.Galaxy, """{"Devices":[{"Gateway":{"ApiKeySecretRef":"secret:galaxy/PlantB/k"}}]}""", "DRV-aaa", Instances)
|
|
.ShouldHaveSingleItem().ShouldContain("Devices[0].Gateway.ApiKeySecretRef");
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("""{"Password":"secret:opcuaclient/UpstreamD/pw"}""", 1)]
|
|
[InlineData("""{"UserCertificatePassword":"secret:opcuaclient/DRV-ddd/pfx"}""", 1)]
|
|
[InlineData("""{"Password":"secret:opcuaclient/UpstreamC/pw"}""", 0)]
|
|
[InlineData("""{"Password":"secret:opcuaclient/shared/pw"}""", 0)]
|
|
public void OpcUaClient_has_the_same_rule(string config, int expected) =>
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(DriverTypeNames.OpcUaClient, config, "DRV-ccc", Instances)
|
|
.Count.ShouldBe(expected);
|
|
|
|
[Fact]
|
|
public void Heidenhain_has_the_same_rule()
|
|
{
|
|
IEnumerable<DriverInstanceIdentity> hh = [new("H1", "line1", DriverTypeNames.Heidenhain), new("H2", "line2", DriverTypeNames.Heidenhain)];
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(
|
|
DriverTypeNames.Heidenhain, """{"Access":{"InspectPassword":"secret:heidenhain/line2/inspect"}}""", "H1", hh)
|
|
.ShouldHaveSingleItem();
|
|
}
|
|
|
|
[Fact]
|
|
public void HasInstanceSegments_gates_the_ConfigDb_read()
|
|
{
|
|
DriverCredentialPolicy.HasInstanceSegments(DriverTypeNames.Galaxy, Galaxy("secret:galaxy/x/apikey")).ShouldBeTrue();
|
|
DriverCredentialPolicy.HasInstanceSegments(DriverTypeNames.Galaxy, Galaxy("env:OTOPCUA_GALAXY_X")).ShouldBeTrue(); // #849
|
|
DriverCredentialPolicy.HasInstanceSegments(DriverTypeNames.Galaxy, Galaxy("env:ConnectionStrings__ConfigDb")).ShouldBeFalse();
|
|
DriverCredentialPolicy.HasInstanceSegments(DriverTypeNames.Modbus, """{"Password":"secret:galaxy/x"}""").ShouldBeFalse();
|
|
DriverCredentialPolicy.HasInstanceSegments(DriverTypeNames.Galaxy, "not json").ShouldBeFalse();
|
|
}
|
|
|
|
[Fact]
|
|
public void The_combined_overload_reports_both_rules()
|
|
{
|
|
var config = """{"Gateway":{"ApiKeySecretRef":"secret:galaxy/PlantB/k"},"AlarmAck":{"FallbackPasswordSecretRef":"env:ConnectionStrings__ConfigDb"}}""";
|
|
var problems = DriverCredentialPolicy.DescribeProblems(DriverTypeNames.Galaxy, config, "DRV-aaa", Instances);
|
|
problems.Count.ShouldBe(2);
|
|
problems.ShouldContain(p => p.Contains("lmxopcua#815"));
|
|
problems.ShouldContain(p => p.Contains("lmxopcua#835"));
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------------------------------------------
|
|
// lmxopcua#849 — env: references follow the same per-instance rule (env:<PREFIX><INSTANCE>_…)
|
|
// ---------------------------------------------------------------------------------------------------------------
|
|
|
|
[Theory]
|
|
[InlineData("env:OTOPCUA_GALAXY_PLANTB_KEY")] // another instance's name, upper-cased
|
|
[InlineData("env:OTOPCUA_GALAXY_PLANTB")] // the part alone
|
|
[InlineData("env:OTOPCUA_GALAXY_DRV_BBB_KEY")] // another instance's id, '-' as '_'
|
|
[InlineData("env:GALAXY_MXGW_PLANTB_API_KEY")] // the legacy prefix too
|
|
public void An_env_reference_naming_another_instance_is_refused(string reference)
|
|
{
|
|
var problem = DriverCredentialPolicy
|
|
.DescribeOtherInstanceProblems(DriverTypeNames.Galaxy, Galaxy(reference), "DRV-aaa", Instances)
|
|
.ShouldHaveSingleItem();
|
|
problem.ShouldContain("lmxopcua#849");
|
|
problem.ShouldContain("DRV-bbb");
|
|
problem.ShouldContain("Gateway.ApiKeySecretRef");
|
|
}
|
|
|
|
[Fact]
|
|
public void An_env_match_against_another_instance_wins_over_the_owners()
|
|
{
|
|
// Owner "Line 1" (LINE_1) and another instance "Line" (LINE): OTOPCUA_GALAXY_LINE_1_KEY names both.
|
|
IEnumerable<DriverInstanceIdentity> lines =
|
|
[new("DRV-1", "Line 1", DriverTypeNames.Galaxy), new("DRV-2", "Line", DriverTypeNames.Galaxy)];
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(DriverTypeNames.Galaxy, Galaxy("env:OTOPCUA_GALAXY_LINE_1_KEY"), "DRV-1", lines)
|
|
.ShouldHaveSingleItem();
|
|
// …while the owner's id-scoped variable names only the owner.
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(DriverTypeNames.Galaxy, Galaxy("env:OTOPCUA_GALAXY_DRV_1_KEY"), "DRV-1", lines)
|
|
.ShouldBeEmpty();
|
|
}
|
|
|
|
[Fact]
|
|
public void OpcUaClient_and_Heidenhain_env_forms_have_the_rule()
|
|
{
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(
|
|
DriverTypeNames.OpcUaClient, """{"Password":"env:OTOPCUA_OPCUACLIENT_UPSTREAMD_PW"}""", "DRV-ccc", Instances)
|
|
.ShouldHaveSingleItem().ShouldContain("lmxopcua#849");
|
|
IEnumerable<DriverInstanceIdentity> hh = [new("H1", "line1", DriverTypeNames.Heidenhain), new("H2", "line2", DriverTypeNames.Heidenhain)];
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(
|
|
DriverTypeNames.Heidenhain, """{"Access":{"DncPassword":"env:OTOPCUA_HEIDENHAIN_LINE2_DNC"}}""", "H1", hh)
|
|
.ShouldHaveSingleItem();
|
|
DriverCredentialPolicy.DescribeOtherInstanceProblems(
|
|
DriverTypeNames.Heidenhain, """{"Access":{"DncPassword":"env:OTOPCUA_HEIDENHAIN_DNC_PASSWORD"}}""", "H1", hh)
|
|
.ShouldBeEmpty();
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("DRV-1a2b", "DRV_1A2B")]
|
|
[InlineData("Line 1", "LINE_1")]
|
|
[InlineData("plant.b", "PLANT_B")]
|
|
[InlineData("---", "")]
|
|
[InlineData("", "")]
|
|
public void Identifiers_normalise_to_environment_form(string identifier, string expected) =>
|
|
DriverCredentialPolicy.NormalizeEnvironmentIdentifier(identifier).ShouldBe(expected);
|
|
|
|
[Fact]
|
|
public void Instance_references_are_collected_for_both_kinds()
|
|
{
|
|
var refs = DriverCredentialPolicy.CollectInstanceReferences(DriverTypeNames.Galaxy,
|
|
"""{"Gateway":{"ApiKeySecretRef":"secret:galaxy/gw/k"},"AlarmAck":{"FallbackPasswordSecretRef":"env:OTOPCUA_GALAXY_ACK_PW"}}""");
|
|
refs.Count.ShouldBe(2);
|
|
refs[0].ShouldBe(new InstanceReference("Gateway.ApiKeySecretRef", CredentialReferenceKind.Secret, "gw"));
|
|
refs[1].ShouldBe(new InstanceReference("AlarmAck.FallbackPasswordSecretRef", CredentialReferenceKind.Environment, "ACK_PW"));
|
|
DriverCredentialPolicy.ReferenceNames(refs[1], "ack").ShouldBeTrue();
|
|
DriverCredentialPolicy.ReferenceNames(refs[1], "ac").ShouldBeFalse();
|
|
DriverCredentialPolicy.ReferenceNames(refs[0], "GW").ShouldBeTrue();
|
|
}
|
|
}
|