mesh-tools
5eb5ea1774
mesh/merge-gate head 5eb5ea177482 merged into trunk 18c58b4903ad — pass: builds mesh-controller → novox; no bus step; every machine composes with the chang…
mesh/repo-check head 5eb5ea177482 merged into trunk 18c58b4903ad — fail: its merge-check.sh failed: 1 store test(s) listed in testdata/store-tests did not …
mesh/delivery superseded: a newer head of the same pull request
245 lines
10 KiB
Go
245 lines
10 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"reflect"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/novox/mesh-controller/internal/broker"
|
|
"github.com/novox/mesh-controller/internal/catalogue"
|
|
"github.com/novox/mesh-controller/internal/conditions"
|
|
"github.com/novox/mesh-controller/internal/inventory"
|
|
"github.com/novox/mesh-controller/internal/link"
|
|
)
|
|
|
|
// The core's own credentials travel sealed by the vault to their machine (novox/hq ADR 0349 §16, issue 755; the lead's
|
|
// decision, issue 755 notes 4 and 5): to an engine that opens the vault's box, the send carries the box the vault
|
|
// answered the controller and never the controller's own seal; when the vault does not answer, a kept box is carried
|
|
// again and a module with none is sealed by the controller (ADR 0396, issue 908), with a condition naming the vault and the machine. An engine below the
|
|
// contract composes exactly as before, and the vault is not asked.
|
|
|
|
// coreStandIn answers `get` with a box per name and generation, or its silence.
|
|
type coreStandIn struct {
|
|
asked []string
|
|
keys []string
|
|
generation int
|
|
silent error
|
|
}
|
|
|
|
func (v *coreStandIn) ask(name, key string) (coreAnswer, error) {
|
|
v.asked, v.keys = append(v.asked, name), append(v.keys, key)
|
|
if v.silent != nil {
|
|
return coreAnswer{}, v.silent
|
|
}
|
|
box := `{"v":1,"eph":"ZQ==","iv":"aQ==","tag":"dA==","ct":"` + strings.Repeat("c", len(v.asked)) + `"}`
|
|
return coreAnswer{Name: name, Generation: v.generation, Sealed: json.RawMessage(box)}, nil
|
|
}
|
|
|
|
func withVault(t *testing.T, v *coreStandIn) {
|
|
t.Helper()
|
|
before := coreVault
|
|
coreVault = func(context.Context) coreAsk { return v.ask }
|
|
t.Cleanup(func() { coreVault = before })
|
|
}
|
|
|
|
func aCoreMesh(t *testing.T, contract int) (*stores, *coreStandIn) {
|
|
t.Helper()
|
|
open := aMesh(t)
|
|
ctx := t.Context()
|
|
client := aClientModule()
|
|
register(t, open, client)
|
|
if _, err := assign(ctx, open, "laptop", client.Module); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := issueProvisionerClient(ctx, open.inventory, client, "laptop", broker.Broker{Fingerprint: "ab"},
|
|
"10.0.0.1:4222"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := open.inventory.RecordHealth(ctx, inventory.NodeHealth{Node: "laptop", Contract: contract,
|
|
SaidAt: time.Now()}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
v := &coreStandIn{generation: 1}
|
|
withVault(t, v)
|
|
return open, v
|
|
}
|
|
|
|
func clientsBroker(resources []map[string]any) map[string]any {
|
|
for _, r := range resources {
|
|
if r["id"] == "mesh-provisioner-client.needs-"+broker.ProvisionerSecret {
|
|
return r
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func vaultSilence(t *testing.T, node string) (conditions.Condition, bool) {
|
|
t.Helper()
|
|
c, found, err := conditionsFrom.Get(t.Context(), vaultSilentObservation(node, coreBoxes{}).Key())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return c, found
|
|
}
|
|
|
|
func TestTheSendCarriesTheVaultsBoxForACoreCredentialAndKeepsIt(t *testing.T) {
|
|
open, vault := aCoreMesh(t, link.VaultBoxContract)
|
|
key, err := open.inventory.SealingKeyOf(t.Context(), "laptop")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
f := clientsBroker(sentTo(t, open, "laptop"))
|
|
if f == nil || f["sealed"] != nil || f[catalogue.VaultSealedField] == nil {
|
|
t.Fatalf("the core credential is sent as %v: the vault's box, never the controller's seal", f)
|
|
}
|
|
if want := []string{"own/laptop/mesh-provisioner-client/" + broker.ProvisionerSecret}; !reflect.DeepEqual(vault.asked, want) {
|
|
t.Fatalf("the vault was asked %v", vault.asked)
|
|
}
|
|
if want, _ := sealingKeyPEM(key); vault.keys[0] != want {
|
|
t.Fatalf("the vault was asked to seal to %q, not the machine's key", vault.keys[0])
|
|
}
|
|
first, _ := json.Marshal(f[catalogue.VaultSealedField])
|
|
|
|
// The vault answers afresh with the same generation: the kept box is carried again, so the declaration is stable.
|
|
again, _ := json.Marshal(clientsBroker(sentTo(t, open, "laptop"))[catalogue.VaultSealedField])
|
|
if string(again) != string(first) {
|
|
t.Fatalf("a fresh box of the same generation changed the declaration: %s, then %s", first, again)
|
|
}
|
|
// A rotation in the vault (a newer generation) is carried.
|
|
vault.generation = 2
|
|
rotated, _ := json.Marshal(clientsBroker(sentTo(t, open, "laptop"))[catalogue.VaultSealedField])
|
|
if string(rotated) == string(first) {
|
|
t.Fatal("a newer generation was not carried")
|
|
}
|
|
if _, found := vaultSilence(t, "laptop"); found {
|
|
t.Fatal("a send the vault answered raised its silence")
|
|
}
|
|
}
|
|
|
|
func TestASilentVaultHoldsTheKeptBoxAndSaysSo(t *testing.T) {
|
|
open, vault := aCoreMesh(t, link.VaultBoxContract)
|
|
first, _ := json.Marshal(clientsBroker(sentTo(t, open, "laptop"))[catalogue.VaultSealedField])
|
|
vault.silent = errors.New("no responders")
|
|
held := clientsBroker(sentTo(t, open, "laptop"))
|
|
got, _ := json.Marshal(held[catalogue.VaultSealedField])
|
|
if held == nil || held["sealed"] != nil || string(got) != string(first) {
|
|
t.Fatalf("a silent vault's credential is sent as %v: the box kept, never the controller's seal", held)
|
|
}
|
|
c, found := vaultSilence(t, "laptop")
|
|
if !found || !strings.Contains(c.Summary, "vault") || !strings.Contains(c.Summary, "laptop") {
|
|
t.Fatalf("no condition names the vault and the machine: %+v", c)
|
|
}
|
|
// The vault answers again: the condition clears.
|
|
vault.silent = nil
|
|
sentTo(t, open, "laptop")
|
|
if _, found := vaultSilence(t, "laptop"); found {
|
|
t.Fatal("the condition stayed after the vault answered")
|
|
}
|
|
}
|
|
|
|
func TestACoreModuleFirstPlacedWhileTheVaultIsSilentIsSealedByTheController(t *testing.T) {
|
|
open, vault := aCoreMesh(t, link.VaultBoxContract)
|
|
vault.silent = errors.New("no responders")
|
|
plan, settings, err := planFor(t.Context(), open, "laptop")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
declared, err := declarationFor(t.Context(), open, "laptop", plan, settings)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
f := clientsBroker(declared.Resources)
|
|
if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
|
|
t.Fatalf("the core credential is composed as %v: the controller's own seal, until the vault holds it", f)
|
|
}
|
|
if why, left := declared.leftOutWhy["mesh-provisioner-client"]; left {
|
|
t.Fatalf("the core module was left out: %v", why)
|
|
}
|
|
c, found := vaultSilence(t, "laptop")
|
|
if !found || !strings.Contains(c.Summary, "sealed by the controller until the vault holds it") {
|
|
t.Fatalf("the condition does not say why: %+v", c)
|
|
}
|
|
}
|
|
|
|
// Issue 908: a machine at the vault-box contract, the vault silent, no kept box: nats is composed with the
|
|
// controller's own seal, never left out, and the vault-silent condition names it.
|
|
func TestReplay908(t *testing.T) {
|
|
key := "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
|
|
core := map[string][]string{"nats": {"password"}}
|
|
ask := func(name, publicKey string) (coreAnswer, error) { return coreAnswer{}, errors.New("no responders") }
|
|
got := coreBoxesOf("novox", key, core, nil, Allocating, ask)
|
|
if _, sealed := got.sealed["nats"]; sealed || len(got.notPlaced) != 0 {
|
|
t.Fatalf("nats is vault-sealed %v or not placed %v", got.sealed, got.notPlaced)
|
|
}
|
|
if !reflect.DeepEqual(got.byController, []string{"nats"}) {
|
|
t.Fatalf("nats is not left to the controller's seal: %+v", got)
|
|
}
|
|
o := vaultSilentObservation("novox", got)
|
|
if o.Severity != conditions.Warning || !strings.Contains(o.Summary, "sealed by the controller until the vault holds it: nats") {
|
|
t.Fatalf("the condition does not name nats: %+v", o)
|
|
}
|
|
// A kept box is still carried while the vault is silent.
|
|
kept := map[string]map[string]inventory.CoreBox{"nats": {"password": {SealedTo: key, Box: json.RawMessage(`{"v":1}`)}}}
|
|
got = coreBoxesOf("novox", key, core, kept, Allocating, ask)
|
|
if string(got.sealed["nats"]["password"]) != `{"v":1}` || len(got.byController) != 0 {
|
|
t.Fatalf("the kept box was not held: %+v", got)
|
|
}
|
|
}
|
|
|
|
// An engine below VaultBoxContract is sent the controller's own seal, as before, and the vault is not asked.
|
|
func TestAnEngineBelowTheContractIsSentTheControllersSealAsBefore(t *testing.T) {
|
|
open, vault := aCoreMesh(t, link.HandedContract)
|
|
f := clientsBroker(sentTo(t, open, "laptop"))
|
|
if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
|
|
t.Fatalf("an older engine is sent %v", f)
|
|
}
|
|
if len(vault.asked) != 0 {
|
|
t.Fatalf("the vault was asked %v for an older engine", vault.asked)
|
|
}
|
|
}
|
|
|
|
// Every question but a send reads the kept box and asks nothing; with none kept, a stand-in the next send asks for.
|
|
func TestOnlyASendAsksTheVault(t *testing.T) {
|
|
core := map[string][]string{"nats": {"broker"}}
|
|
key := aPublicKey(t)
|
|
kept := map[string]map[string]inventory.CoreBox{"nats": {"broker": {Module: "nats", Name: "broker",
|
|
Generation: 1, SealedTo: key, Box: json.RawMessage(`{"v":1}`)}}}
|
|
never := func(string, string) (coreAnswer, error) {
|
|
t.Fatal("the vault was asked by a question that is not a send")
|
|
return coreAnswer{}, nil
|
|
}
|
|
for _, choosing := range []Choosing{Reading, Foreseeing} {
|
|
if got := coreBoxesOf("anchor", key, core, kept, choosing, never); string(got.sealed["nats"]["broker"]) != `{"v":1}` {
|
|
t.Errorf("read %s", got.sealed["nats"]["broker"])
|
|
}
|
|
if got := coreBoxesOf("anchor", key, core, nil, choosing, never); string(got.sealed["nats"]["broker"]) !=
|
|
string(catalogue.ForeseenVaultBox) {
|
|
t.Errorf("with none kept, read %s", got.sealed["nats"]["broker"])
|
|
}
|
|
}
|
|
// A box kept for another key of the machine is never carried.
|
|
other := coreBoxesOf("anchor", aPublicKey(t), core, kept, Allocating,
|
|
func(string, string) (coreAnswer, error) { return coreAnswer{}, errors.New("silent") })
|
|
if _, vaultSealed := other.sealed["nats"]; vaultSealed || !reflect.DeepEqual(other.byController, []string{"nats"}) {
|
|
t.Fatalf("a box sealed to the machine's old key was carried: %+v", other)
|
|
}
|
|
}
|
|
|
|
// The core's modules on a machine: on the list, not handed, with their own secrets but one issued outside.
|
|
func TestTheCoresModulesAreTheListsWithTheirOwnSecrets(t *testing.T) {
|
|
modules := []catalogue.Manifest{
|
|
{Module: "nats", OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/a"}, "given": {Path: "/b",
|
|
IssuedBy: catalogue.IssuedOutside}}},
|
|
{Module: "postgres", OwnSecrets: catalogue.OwnSecrets{"superuser": {Path: "/c"}}},
|
|
{Module: "mesh-provisioner", OwnSecrets: catalogue.OwnSecrets{"broker": {Path: "/d"}}},
|
|
}
|
|
got := coreModulesOf(modules, func(m catalogue.Manifest) bool { return m.Module == "mesh-provisioner" })
|
|
if want := map[string][]string{"nats": {"broker"}}; !reflect.DeepEqual(got, want) {
|
|
t.Fatalf("got %v, want %v", got, want)
|
|
}
|
|
}
|