Joseph Doherty
338 lines
12 KiB
C#
338 lines
12 KiB
C#
using Microsoft.Extensions.Logging.Abstractions;
|
|
using Microsoft.Extensions.Options;
|
|
using Shouldly;
|
|
using Xunit;
|
|
using ZB.MOM.WW.OtOpcUa.Cluster;
|
|
using ZB.MOM.WW.OtOpcUa.ControlPlane.Communication;
|
|
using ZB.MOM.WW.Secrets.Abstractions;
|
|
|
|
namespace ZB.MOM.WW.OtOpcUa.ControlPlane.Tests.Communication;
|
|
|
|
/// <summary>
|
|
/// ClusterClient→gRPC Phase 0 — central's per-cluster PSK lookup. Central talks to N site
|
|
/// clusters, each with its own key, so every outbound dial and every inbound ack verification
|
|
/// goes through here.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// The tests that matter are the adversarial ones: the store being down, the key being absent
|
|
/// or blank, and the cache handing back a value the store no longer agrees with. Every one of
|
|
/// those must end in "no key" — the caller then denies or skips, never proceeds unauthenticated.
|
|
/// </remarks>
|
|
public sealed class MeshPskProviderTests
|
|
{
|
|
private static MeshPskProvider CreateProvider(
|
|
ISecretResolver resolver,
|
|
Dictionary<string, string>? clusterPsks = null)
|
|
{
|
|
var options = new MeshTransportOptions();
|
|
if (clusterPsks is not null)
|
|
{
|
|
foreach (var (key, value) in clusterPsks)
|
|
options.ClusterPsks[key] = value;
|
|
}
|
|
|
|
return new MeshPskProvider(
|
|
Options.Create(options), resolver, NullLogger<MeshPskProvider>.Instance);
|
|
}
|
|
|
|
[Fact]
|
|
public void ConfigMapEntry_IsReturned_WithoutConsultingTheSecretStore()
|
|
{
|
|
var resolver = new FakeSecretResolver();
|
|
var provider = CreateProvider(
|
|
resolver, new Dictionary<string, string> { ["SITE-A"] = "rig-psk-site-a" });
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("rig-psk-site-a");
|
|
resolver.CallCount.ShouldBe(0);
|
|
}
|
|
|
|
[Fact]
|
|
public void ConfigMapEntry_WinsOverTheSecretStore()
|
|
{
|
|
// The map exists so a rig can supply literals without standing up a KEK. If the store also
|
|
// holds a key for that cluster the map must still win, or a stale store row would silently
|
|
// beat the value the operator just set.
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(
|
|
resolver, new Dictionary<string, string> { ["SITE-A"] = "rig-psk-site-a" });
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("rig-psk-site-a");
|
|
resolver.CallCount.ShouldBe(0);
|
|
}
|
|
|
|
[Fact]
|
|
public void ConfigMapLookup_IsCaseInsensitive()
|
|
{
|
|
// MeshTransport__ClusterPsks__site-a and __SITE-A are the same cluster. The map's comparer
|
|
// (set on MeshTransportOptions) is what makes that true; this pins the pairing.
|
|
var resolver = new FakeSecretResolver();
|
|
var provider = CreateProvider(
|
|
resolver, new Dictionary<string, string> { ["SITE-A"] = "rig-psk-site-a" });
|
|
|
|
provider.TryGetPsk("site-a", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("rig-psk-site-a");
|
|
}
|
|
|
|
[Fact]
|
|
public void BlankConfigMapEntry_FallsThroughToTheSecretStore()
|
|
{
|
|
// A blank map entry is an empty environment variable, not a decision. Treat it as absent
|
|
// rather than as an empty key that an empty bearer would satisfy.
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(
|
|
resolver, new Dictionary<string, string> { ["SITE-A"] = " " });
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("stored-psk");
|
|
resolver.CallCount.ShouldBe(1);
|
|
}
|
|
|
|
[Fact]
|
|
public void SecretStoreValue_IsReturned_UnderTheConventionalName()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
|
|
psk.ShouldBe("stored-psk");
|
|
// SecretName normalizes to lowercase — the same normalization ${secret:OT-MESH-PSK-SITE-A}
|
|
// goes through in the pre-host expander, so both paths address one row.
|
|
resolver.LastName.ShouldBe("ot-mesh-psk-site-a");
|
|
}
|
|
|
|
[Fact]
|
|
public void UnknownCluster_FailsClosed()
|
|
{
|
|
// Absent secret + no map entry. The caller denies; it must never fall back to "no auth".
|
|
var resolver = new FakeSecretResolver { Value = null };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-Z", out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void BlankSecretValue_FailsClosed()
|
|
{
|
|
// A row that decrypts to whitespace is a broken seed, not a key. Accepting it would make
|
|
// "Bearer " a valid credential for the whole cluster.
|
|
var resolver = new FakeSecretResolver { Value = " " };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ResolverThrow_FailsClosed()
|
|
{
|
|
// The store is a local SQLite file with an env KEK; a missing KEK throws rather than
|
|
// returning null. Any failure is "no key", never an exception escaping into the gRPC gate.
|
|
var resolver = new FakeSecretResolver { Throw = new InvalidOperationException("KEK unavailable") };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ResolverThrow_IsNotCached_SoRecoveryNeedsNoInvalidate()
|
|
{
|
|
// Caching a negative would turn a transient store fault into a permanent outage for that
|
|
// cluster, recoverable only by a restart or a hook nothing calls yet.
|
|
var resolver = new FakeSecretResolver { Throw = new InvalidOperationException("KEK unavailable") };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeFalse();
|
|
|
|
resolver.Throw = null;
|
|
resolver.Value = "stored-psk";
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
psk.ShouldBe("stored-psk");
|
|
}
|
|
|
|
[Fact]
|
|
public void ResolvedValue_IsCached_SoTheStoreIsHitOnce()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
|
|
provider.TryGetPsk("site-a", out _).ShouldBeTrue();
|
|
|
|
resolver.CallCount.ShouldBe(1);
|
|
}
|
|
|
|
[Fact]
|
|
public void Cache_ServesTheStaleValue_UntilInvalidated()
|
|
{
|
|
// Both directions matter: stale-until-invalidated is the whole reason Invalidate exists, and
|
|
// an invalidate that did not actually re-read would be indistinguishable from a no-op.
|
|
var resolver = new FakeSecretResolver { Value = "first-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out var first).ShouldBeTrue();
|
|
first.ShouldBe("first-psk");
|
|
|
|
resolver.Value = "rotated-psk";
|
|
|
|
provider.TryGetPsk("SITE-A", out var stale).ShouldBeTrue();
|
|
stale.ShouldBe("first-psk");
|
|
|
|
provider.Invalidate("SITE-A");
|
|
|
|
provider.TryGetPsk("SITE-A", out var fresh).ShouldBeTrue();
|
|
fresh.ShouldBe("rotated-psk");
|
|
}
|
|
|
|
[Fact]
|
|
public void Invalidate_IsCaseInsensitive_AndScopedToOneCluster()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "first-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
|
|
provider.TryGetPsk("SITE-B", out _).ShouldBeTrue();
|
|
|
|
resolver.Value = "rotated-psk";
|
|
provider.Invalidate("site-a");
|
|
|
|
provider.TryGetPsk("SITE-A", out var a).ShouldBeTrue();
|
|
a.ShouldBe("rotated-psk");
|
|
|
|
provider.TryGetPsk("SITE-B", out var b).ShouldBeTrue();
|
|
b.ShouldBe("first-psk");
|
|
}
|
|
|
|
[Fact]
|
|
public void Invalidate_OnACacheMiss_IsANoOp()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
Should.NotThrow(() => provider.Invalidate("never-seen"));
|
|
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
psk.ShouldBe("stored-psk");
|
|
}
|
|
|
|
[Fact]
|
|
public void InvalidateAll_DropsEveryCluster()
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "first-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE-A", out _).ShouldBeTrue();
|
|
provider.TryGetPsk("SITE-B", out _).ShouldBeTrue();
|
|
|
|
resolver.Value = "rotated-psk";
|
|
provider.InvalidateAll();
|
|
|
|
provider.TryGetPsk("SITE-A", out var a).ShouldBeTrue();
|
|
provider.TryGetPsk("SITE-B", out var b).ShouldBeTrue();
|
|
|
|
a.ShouldBe("rotated-psk");
|
|
b.ShouldBe("rotated-psk");
|
|
}
|
|
|
|
[Theory]
|
|
[InlineData("")]
|
|
[InlineData(" ")]
|
|
public void BlankClusterId_FailsClosed(string clusterId)
|
|
{
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk(clusterId, out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
resolver.CallCount.ShouldBe(0);
|
|
}
|
|
|
|
[Fact]
|
|
public void ClusterIdThatCannotFormASecretName_FailsClosed()
|
|
{
|
|
// Cluster ids are operator-authored; SecretName's allow-list is [a-z0-9._/-]. A '$' throws
|
|
// out of the SecretName ctor, and that throw must become "no key", not a 500 in the gate.
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk" };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
provider.TryGetPsk("SITE$A", out var psk).ShouldBeFalse();
|
|
|
|
psk.ShouldBeNull();
|
|
resolver.CallCount.ShouldBe(0);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ConcurrentCallers_ResolveOnce_AndAllSeeTheSameValue()
|
|
{
|
|
// The gRPC gate calls this from every inbound ack, on arbitrary thread-pool threads. A
|
|
// non-atomic fill would stampede the store and could hand two callers different keys.
|
|
var gate = new SemaphoreSlim(0, 1);
|
|
var resolver = new FakeSecretResolver { Value = "stored-psk", Gate = gate };
|
|
var provider = CreateProvider(resolver);
|
|
|
|
var callers = Enumerable.Range(0, 16).Select(_ => Task.Run(() =>
|
|
{
|
|
provider.TryGetPsk("SITE-A", out var psk).ShouldBeTrue();
|
|
return psk;
|
|
})).ToArray();
|
|
|
|
gate.Release();
|
|
var results = await Task.WhenAll(callers);
|
|
|
|
results.ShouldAllBe(r => r == "stored-psk");
|
|
resolver.CallCount.ShouldBe(1);
|
|
}
|
|
|
|
/// <summary>
|
|
/// An <see cref="ISecretResolver"/> whose answer the test controls between calls, so cache
|
|
/// staleness and invalidation are observable without a real store.
|
|
/// </summary>
|
|
private sealed class FakeSecretResolver : ISecretResolver
|
|
{
|
|
private int _callCount;
|
|
|
|
/// <summary>What <see cref="GetAsync"/> returns when <see cref="Throw"/> is null.</summary>
|
|
public string? Value { get; set; }
|
|
|
|
/// <summary>When set, <see cref="GetAsync"/> throws it instead of returning.</summary>
|
|
public Exception? Throw { get; set; }
|
|
|
|
/// <summary>When set, the first call waits on it — used to force a concurrent stampede.</summary>
|
|
public SemaphoreSlim? Gate { get; set; }
|
|
|
|
/// <summary>How many times the store was consulted.</summary>
|
|
public int CallCount => Volatile.Read(ref _callCount);
|
|
|
|
/// <summary>The name of the most recently requested secret.</summary>
|
|
public string? LastName { get; private set; }
|
|
|
|
public async Task<string?> GetAsync(SecretName name, CancellationToken ct)
|
|
{
|
|
LastName = name.Value;
|
|
Interlocked.Increment(ref _callCount);
|
|
|
|
if (Gate is not null)
|
|
await Gate.WaitAsync(ct).ConfigureAwait(false);
|
|
|
|
if (Throw is not null)
|
|
throw Throw;
|
|
|
|
return Value;
|
|
}
|
|
}
|
|
}
|