105 lines
3.3 KiB
Go
105 lines
3.3 KiB
Go
//go:build integration
|
|
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/novox/mesh-controller/internal/inventory"
|
|
)
|
|
|
|
// aMachineJoining is a machine with a live token issued for a tunnel key, given its address — what
|
|
// `token issue --overlay-key` records before it pushes the hub (novox/hq ADR 0169).
|
|
func aMachineJoining(t *testing.T, ctx context.Context, inv *inventory.Inventory, name string,
|
|
validFor time.Duration) string {
|
|
t.Helper()
|
|
record, err := inv.AddNode(ctx, name)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := inv.IssueToken(ctx, name, validFor); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
key := aPublicKey(t)
|
|
if err := inv.RecordOverlayKey(ctx, record.ID, key); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := inv.BindTokenToKey(ctx, record.ID, key); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
cidr, err := overlayRange(ctx, inv)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := inv.AssignAddress(ctx, record.ID, cidr); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return key
|
|
}
|
|
|
|
// hubPeers are the keys the hub's composed tunnel carries.
|
|
func hubPeers(t *testing.T, ctx context.Context, inv *inventory.Inventory) map[string]bool {
|
|
t.Helper()
|
|
g, err := network(ctx, inv, map[string]bool{"anchor": true, "laptop": true}, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
out := map[string]bool{}
|
|
for _, p := range g.Graph()["anchor"] {
|
|
out[p.Key] = true
|
|
}
|
|
return out
|
|
}
|
|
|
|
// **A machine joining is a peer of the hub while its token can be used, and not after** (novox/hq
|
|
// ADR 0169): the hub's composed tunnel carries a machine whose token was issued for its key, so the
|
|
// tunnel answers the first time it knocks; a token that expired unused takes the peer with it at the
|
|
// hub's next composition.
|
|
func TestAMachineJoiningIsAPeerOfTheHubUntilItsTokenExpires(t *testing.T) {
|
|
open := aMesh(t)
|
|
ctx := t.Context()
|
|
inv := open.inventory
|
|
|
|
joining := aMachineJoining(t, ctx, inv, "joiner", time.Hour)
|
|
expired := aMachineJoining(t, ctx, inv, "late", 2*time.Second)
|
|
time.Sleep(2100 * time.Millisecond)
|
|
|
|
peers := hubPeers(t, ctx, inv)
|
|
if !peers[joining] {
|
|
t.Fatalf("the hub does not carry the machine its live token was issued for: %v", peers)
|
|
}
|
|
if peers[expired] {
|
|
t.Fatalf("the hub still carries a machine whose token expired unused: %v", peers)
|
|
}
|
|
|
|
// A token issued without a key gives the hub nothing to carry: there is no key to carry.
|
|
if _, err := inv.AddNode(ctx, "keyless"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := inv.IssueToken(ctx, "keyless", time.Hour); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if after := hubPeers(t, ctx, inv); len(after) != len(peers) {
|
|
t.Fatalf("a token issued without a key changed the hub's peers: %v, was %v", after, peers)
|
|
}
|
|
}
|
|
|
|
// **A tunnel key that is not one is refused before anything is recorded** (novox/hq ADR 0169): a
|
|
// token issued for it would be a tunnel the hub could never answer.
|
|
func TestATokenIsNotIssuedForSomethingThatIsNotATunnelKey(t *testing.T) {
|
|
open := aMesh(t)
|
|
ctx := t.Context()
|
|
record, err := open.inventory.AddNode(ctx, "joiner")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, _, err := throughTheTunnel(ctx, open, record, "not-a-key", "10.77.0.1:4222"); err == nil {
|
|
t.Fatal("a token was issued for something that is not a tunnel key")
|
|
}
|
|
if held := placementOf(t, ctx, open.inventory, "joiner"); held.Key != "" || held.Address != "" {
|
|
t.Fatalf("a refused key left a record behind: %+v", held)
|
|
}
|
|
}
|