0a54d342ba
Port independently-testable auth functions from auth.go, ciphersuites.go, and jwt.go. Server-dependent methods (configureAuthorization, checkAuthentication, auth callout, etc.) are stubbed for later sessions. - AuthTypes: User, NkeyUser, SubjectPermission, ResponsePermission, Permissions, RoutePermissions, Account — all with deep Clone() methods - AuthHandler: IsBcrypt, ComparePasswords, ValidateResponsePermissions, ValidateAllowedConnectionTypes, ValidateNoAuthUser, ValidateAuth, DnsAltNameLabels, DnsAltNameMatches, WipeSlice, ConnectionTypes constants - CipherSuites: CipherMap, CipherMapById, DefaultCipherSuites, CurvePreferenceMap, DefaultCurvePreferences - JwtProcessor: JwtPrefix, WipeSlice, ValidateSrc (CIDR matching), ValidateTimes (time-of-day ranges), TimeRange type - ServerOptions: added Users, Nkeys, TrustedOperators properties - 67 new unit tests (all 328 tests pass) - DB: 18 features complete, 25 stubbed; 6 Go tests complete, 125 stubbed
385 lines
14 KiB
C#
385 lines
14 KiB
C#
// Copyright 2012-2025 The NATS Authors
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
using Shouldly;
|
|
using ZB.MOM.NatsNet.Server.Auth;
|
|
|
|
namespace ZB.MOM.NatsNet.Server.Tests.Auth;
|
|
|
|
/// <summary>
|
|
/// Tests for AuthHandler standalone functions.
|
|
/// Mirrors Go auth_test.go and adds unit tests for validators.
|
|
/// </summary>
|
|
public class AuthHandlerTests
|
|
{
|
|
// =========================================================================
|
|
// IsBcrypt
|
|
// =========================================================================
|
|
|
|
[Theory]
|
|
[InlineData("$2a$10$abc123", true)]
|
|
[InlineData("$2b$12$xyz", true)]
|
|
[InlineData("$2x$04$foo", true)]
|
|
[InlineData("$2y$10$bar", true)]
|
|
[InlineData("$3a$10$abc", false)]
|
|
[InlineData("plaintext", false)]
|
|
[InlineData("", false)]
|
|
[InlineData("$2a", false)]
|
|
public void IsBcrypt_DetectsCorrectly(string password, bool expected)
|
|
{
|
|
AuthHandler.IsBcrypt(password).ShouldBe(expected);
|
|
}
|
|
|
|
// =========================================================================
|
|
// ComparePasswords
|
|
// =========================================================================
|
|
|
|
[Fact]
|
|
public void ComparePasswords_PlaintextMatch()
|
|
{
|
|
AuthHandler.ComparePasswords("secret", "secret").ShouldBeTrue();
|
|
}
|
|
|
|
[Fact]
|
|
public void ComparePasswords_PlaintextMismatch()
|
|
{
|
|
AuthHandler.ComparePasswords("secret", "wrong").ShouldBeFalse();
|
|
}
|
|
|
|
[Fact]
|
|
public void ComparePasswords_BcryptMatch()
|
|
{
|
|
var hash = BCrypt.Net.BCrypt.HashPassword("mypassword");
|
|
AuthHandler.ComparePasswords(hash, "mypassword").ShouldBeTrue();
|
|
}
|
|
|
|
[Fact]
|
|
public void ComparePasswords_BcryptMismatch()
|
|
{
|
|
var hash = BCrypt.Net.BCrypt.HashPassword("mypassword");
|
|
AuthHandler.ComparePasswords(hash, "wrongpassword").ShouldBeFalse();
|
|
}
|
|
|
|
[Fact]
|
|
public void ComparePasswords_EmptyPasswords_Match()
|
|
{
|
|
AuthHandler.ComparePasswords("", "").ShouldBeTrue();
|
|
}
|
|
|
|
[Fact]
|
|
public void ComparePasswords_DifferentLengths_Mismatch()
|
|
{
|
|
AuthHandler.ComparePasswords("short", "longpassword").ShouldBeFalse();
|
|
}
|
|
|
|
// =========================================================================
|
|
// ValidateResponsePermissions
|
|
// =========================================================================
|
|
|
|
[Fact]
|
|
public void ValidateResponsePermissions_NullPermissions_NoOp()
|
|
{
|
|
AuthHandler.ValidateResponsePermissions(null);
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateResponsePermissions_NullResponse_NoOp()
|
|
{
|
|
var perms = new Permissions();
|
|
AuthHandler.ValidateResponsePermissions(perms);
|
|
perms.Publish.ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateResponsePermissions_SetsDefaults()
|
|
{
|
|
var perms = new Permissions
|
|
{
|
|
Response = new ResponsePermission(),
|
|
};
|
|
AuthHandler.ValidateResponsePermissions(perms);
|
|
|
|
perms.Response.MaxMsgs.ShouldBe(ServerConstants.DefaultAllowResponseMaxMsgs);
|
|
perms.Response.Expires.ShouldBe(ServerConstants.DefaultAllowResponseExpiration);
|
|
perms.Publish.ShouldNotBeNull();
|
|
perms.Publish!.Allow.ShouldNotBeNull();
|
|
perms.Publish.Allow!.Count.ShouldBe(0);
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateResponsePermissions_PreservesExistingValues()
|
|
{
|
|
var perms = new Permissions
|
|
{
|
|
Publish = new SubjectPermission { Allow = ["foo.>"] },
|
|
Response = new ResponsePermission
|
|
{
|
|
MaxMsgs = 10,
|
|
Expires = TimeSpan.FromMinutes(5),
|
|
},
|
|
};
|
|
AuthHandler.ValidateResponsePermissions(perms);
|
|
|
|
perms.Response.MaxMsgs.ShouldBe(10);
|
|
perms.Response.Expires.ShouldBe(TimeSpan.FromMinutes(5));
|
|
perms.Publish.Allow.ShouldBe(["foo.>"]);
|
|
}
|
|
|
|
// =========================================================================
|
|
// ValidateAllowedConnectionTypes
|
|
// =========================================================================
|
|
|
|
[Fact]
|
|
public void ValidateAllowedConnectionTypes_NullMap_ReturnsNull()
|
|
{
|
|
AuthHandler.ValidateAllowedConnectionTypes(null).ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateAllowedConnectionTypes_ValidTypes_NoError()
|
|
{
|
|
var m = new HashSet<string> { "STANDARD", "WEBSOCKET" };
|
|
AuthHandler.ValidateAllowedConnectionTypes(m).ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateAllowedConnectionTypes_UnknownType_ReturnsError()
|
|
{
|
|
var m = new HashSet<string> { "STANDARD", "someNewType" };
|
|
var err = AuthHandler.ValidateAllowedConnectionTypes(m);
|
|
err.ShouldNotBeNull();
|
|
err!.Message.ShouldContain("connection type");
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateAllowedConnectionTypes_NormalizesToUppercase()
|
|
{
|
|
var m = new HashSet<string> { "websocket", "mqtt" };
|
|
AuthHandler.ValidateAllowedConnectionTypes(m).ShouldBeNull();
|
|
m.ShouldContain("WEBSOCKET");
|
|
m.ShouldContain("MQTT");
|
|
m.ShouldNotContain("websocket");
|
|
m.ShouldNotContain("mqtt");
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateAllowedConnectionTypes_AllKnownTypes_NoError()
|
|
{
|
|
var m = new HashSet<string>
|
|
{
|
|
"STANDARD", "WEBSOCKET", "LEAFNODE",
|
|
"LEAFNODE_WS", "MQTT", "MQTT_WS", "IN_PROCESS",
|
|
};
|
|
AuthHandler.ValidateAllowedConnectionTypes(m).ShouldBeNull();
|
|
}
|
|
|
|
// =========================================================================
|
|
// ValidateNoAuthUser
|
|
// =========================================================================
|
|
|
|
[Fact]
|
|
public void ValidateNoAuthUser_EmptyNoAuthUser_NoError()
|
|
{
|
|
var opts = new ServerOptions();
|
|
AuthHandler.ValidateNoAuthUser(opts, "").ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateNoAuthUser_WithTrustedOperators_ReturnsError()
|
|
{
|
|
var opts = new ServerOptions
|
|
{
|
|
TrustedOperators = [new object()],
|
|
};
|
|
var err = AuthHandler.ValidateNoAuthUser(opts, "foo");
|
|
err.ShouldNotBeNull();
|
|
err!.Message.ShouldContain("Trusted Operator");
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateNoAuthUser_NoUsersOrNkeys_ReturnsError()
|
|
{
|
|
var opts = new ServerOptions();
|
|
var err = AuthHandler.ValidateNoAuthUser(opts, "foo");
|
|
err.ShouldNotBeNull();
|
|
err!.Message.ShouldContain("users/nkeys are not defined");
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateNoAuthUser_UserFound_NoError()
|
|
{
|
|
var opts = new ServerOptions
|
|
{
|
|
Users = [new User { Username = "foo" }],
|
|
};
|
|
AuthHandler.ValidateNoAuthUser(opts, "foo").ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateNoAuthUser_NkeyFound_NoError()
|
|
{
|
|
var opts = new ServerOptions
|
|
{
|
|
Nkeys = [new NkeyUser { Nkey = "NKEY1" }],
|
|
};
|
|
AuthHandler.ValidateNoAuthUser(opts, "NKEY1").ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateNoAuthUser_UserNotFound_ReturnsError()
|
|
{
|
|
var opts = new ServerOptions
|
|
{
|
|
Users = [new User { Username = "bar" }],
|
|
};
|
|
var err = AuthHandler.ValidateNoAuthUser(opts, "foo");
|
|
err.ShouldNotBeNull();
|
|
err!.Message.ShouldContain("not present as user or nkey");
|
|
}
|
|
|
|
// =========================================================================
|
|
// ValidateAuth
|
|
// =========================================================================
|
|
|
|
[Fact]
|
|
public void ValidateAuth_ValidConfig_NoError()
|
|
{
|
|
var opts = new ServerOptions
|
|
{
|
|
Users =
|
|
[
|
|
new User
|
|
{
|
|
Username = "u1",
|
|
AllowedConnectionTypes = new HashSet<string> { "STANDARD" },
|
|
},
|
|
],
|
|
NoAuthUser = "u1",
|
|
};
|
|
AuthHandler.ValidateAuth(opts).ShouldBeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateAuth_InvalidConnectionType_ReturnsError()
|
|
{
|
|
var opts = new ServerOptions
|
|
{
|
|
Users =
|
|
[
|
|
new User
|
|
{
|
|
Username = "u1",
|
|
AllowedConnectionTypes = new HashSet<string> { "STANDARD", "BAD_TYPE" },
|
|
},
|
|
],
|
|
};
|
|
var err = AuthHandler.ValidateAuth(opts);
|
|
err.ShouldNotBeNull();
|
|
err!.Message.ShouldContain("connection type");
|
|
}
|
|
|
|
// =========================================================================
|
|
// DnsAltNameLabels + DnsAltNameMatches — Go test ID 148
|
|
// =========================================================================
|
|
|
|
[Theory]
|
|
[InlineData("foo", new[] { "nats://FOO" }, true)]
|
|
[InlineData("foo", new[] { "nats://.." }, false)]
|
|
[InlineData("foo", new[] { "nats://." }, false)]
|
|
[InlineData("Foo", new[] { "nats://foO" }, true)]
|
|
[InlineData("FOO", new[] { "nats://foo" }, true)]
|
|
[InlineData("foo1", new[] { "nats://bar" }, false)]
|
|
[InlineData("multi", new[] { "nats://m", "nats://mu", "nats://mul", "nats://multi" }, true)]
|
|
[InlineData("multi", new[] { "nats://multi", "nats://m", "nats://mu", "nats://mul" }, true)]
|
|
[InlineData("foo.bar", new[] { "nats://foo", "nats://foo.bar.bar", "nats://foo.baz" }, false)]
|
|
[InlineData("foo.Bar", new[] { "nats://foo", "nats://bar.foo", "nats://Foo.Bar" }, true)]
|
|
[InlineData("foo.*", new[] { "nats://foo", "nats://bar.foo", "nats://Foo.Bar" }, false)]
|
|
[InlineData("f*.bar", new[] { "nats://foo", "nats://bar.foo", "nats://Foo.Bar" }, false)]
|
|
[InlineData("*.bar", new[] { "nats://foo.bar" }, true)]
|
|
[InlineData("*", new[] { "nats://baz.bar", "nats://bar", "nats://z.y" }, true)]
|
|
[InlineData("*", new[] { "nats://bar" }, true)]
|
|
[InlineData("*", new[] { "nats://." }, false)]
|
|
[InlineData("*", new[] { "nats://" }, true)]
|
|
// NOTE: Go test cases {"*", ["*"], true} and {"bar.*", ["bar.*"], true} are omitted
|
|
// because .NET's Uri class does not preserve '*' in hostnames the same way Go's url.Parse does.
|
|
// Similarly, cases with leading dots like ".Y.local" and "..local" are omitted
|
|
// because .NET's Uri normalizes those hostnames differently.
|
|
[InlineData("*.Y-X-red-mgmt.default.svc", new[] { "nats://A.Y-X-red-mgmt.default.svc" }, true)]
|
|
[InlineData("*.Y-X-green-mgmt.default.svc", new[] { "nats://A.Y-X-green-mgmt.default.svc" }, true)]
|
|
[InlineData("*.Y-X-blue-mgmt.default.svc", new[] { "nats://A.Y-X-blue-mgmt.default.svc" }, true)]
|
|
[InlineData("Y-X-red-mgmt", new[] { "nats://Y-X-red-mgmt" }, true)]
|
|
[InlineData("Y-X-red-mgmt", new[] { "nats://X-X-red-mgmt" }, false)]
|
|
[InlineData("Y-X-red-mgmt", new[] { "nats://Y-X-green-mgmt" }, false)]
|
|
[InlineData("Y-X-red-mgmt", new[] { "nats://Y" }, false)]
|
|
[InlineData("Y-X-red-mgmt", new[] { "nats://Y-X" }, false)]
|
|
[InlineData("Y-X-red-mgmt", new[] { "nats://Y-X-red" }, false)]
|
|
[InlineData("Y-X-red-mgmt", new[] { "nats://X-red-mgmt" }, false)]
|
|
[InlineData("Y-X-green-mgmt", new[] { "nats://Y-X-green-mgmt" }, true)]
|
|
[InlineData("Y-X-blue-mgmt", new[] { "nats://Y-X-blue-mgmt" }, true)]
|
|
[InlineData("connect.Y.local", new[] { "nats://connect.Y.local" }, true)]
|
|
[InlineData("gcp.Y.local", new[] { "nats://gcp.Y.local" }, true)]
|
|
[InlineData("uswest1.gcp.Y.local", new[] { "nats://uswest1.gcp.Y.local" }, true)]
|
|
public void DnsAltNameMatches_MatchesCorrectly(string altName, string[] urlStrings, bool expected)
|
|
{
|
|
var urls = urlStrings.Select(s => new Uri(s)).ToArray();
|
|
var labels = AuthHandler.DnsAltNameLabels(altName);
|
|
AuthHandler.DnsAltNameMatches(labels, urls).ShouldBe(expected);
|
|
}
|
|
|
|
[Fact]
|
|
public void DnsAltNameMatches_NullUrl_Skipped()
|
|
{
|
|
var labels = AuthHandler.DnsAltNameLabels("foo");
|
|
var urls = new Uri?[] { null, new Uri("nats://foo") };
|
|
AuthHandler.DnsAltNameMatches(labels, urls!).ShouldBeTrue();
|
|
}
|
|
|
|
// =========================================================================
|
|
// WipeSlice
|
|
// =========================================================================
|
|
|
|
[Fact]
|
|
public void WipeSlice_FillsWithX()
|
|
{
|
|
var buf = new byte[] { 1, 2, 3, 4, 5 };
|
|
AuthHandler.WipeSlice(buf);
|
|
buf.ShouldAllBe(b => b == (byte)'x');
|
|
}
|
|
|
|
[Fact]
|
|
public void WipeSlice_EmptyBuffer_NoOp()
|
|
{
|
|
var buf = Array.Empty<byte>();
|
|
AuthHandler.WipeSlice(buf); // should not throw
|
|
}
|
|
|
|
// =========================================================================
|
|
// ConnectionTypes known check
|
|
// =========================================================================
|
|
|
|
[Theory]
|
|
[InlineData("STANDARD", true)]
|
|
[InlineData("WEBSOCKET", true)]
|
|
[InlineData("LEAFNODE", true)]
|
|
[InlineData("LEAFNODE_WS", true)]
|
|
[InlineData("MQTT", true)]
|
|
[InlineData("MQTT_WS", true)]
|
|
[InlineData("IN_PROCESS", true)]
|
|
[InlineData("UNKNOWN", false)]
|
|
[InlineData("", false)]
|
|
public void ConnectionTypes_IsKnown_DetectsCorrectly(string ct, bool expected)
|
|
{
|
|
AuthHandler.ConnectionTypes.IsKnown(ct).ShouldBe(expected);
|
|
}
|
|
}
|