mesh-controller/internal/catalogue/adoption_test.go

package catalogue

import (
	"encoding/json"
	"reflect"
	"strings"
	"testing"
)

// novox/hq ADR 0100: on an adopted node the found firewall stays in force. The mesh declares
// openings where it would have loaded a filter, and guards its own ports in a table that only
// refuses.

// hub is the private network's generator on the hub: it opens the hub's port from anywhere.
type hub struct{}

func (hub) Resources(string) ([]map[string]any, bool, error) {
	return []map[string]any{{"id": "config", "type": "file", "path": "/etc/wireguard/mesh0.conf",
		"content": "[Interface]\n"}}, true, nil
}
func (hub) Listens(string) ([]Listening, error) {
	return []Listening{{Port: 51820, Protocol: "udp", From: FromEverywhere}}, nil
}

// anAdoptedAnchor is the control-node's set: the store, the bus, the registry, the private network,
// a served module and the filter module.
func anAdoptedAnchor() Resolution {
	return Resolution{Node: "anchor", Modules: []Manifest{
		{Module: "network", Computed: "overlay"},
		{Module: "postgres", Guards: []int{5432},
			Listens: []Listening{{Port: 5432, From: FromMesh}},
			Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-store",
				"ports": []any{"5432:5432"}}}},
		{Module: "lavinmq", Guards: []int{15672},
			Listens: []Listening{{Port: 5671, From: FromMesh}, {Port: 5672, From: FromMesh}},
			Resources: []map[string]any{{"id": "server", "type": "container", "name": "mesh-broker",
				"ports": []any{"5671:5671", "5672:5672", "127.0.0.1:15672:15672"}}}},
		{Module: "distribution",
			Listens: []Listening{{Port: 5000, From: FromMesh}},
			Resources: []map[string]any{{"id": "store", "type": "container", "name": "registry",
				"ports": []any{"5000"}}}},
		{Module: "hello-web",
			Listens: []Listening{{Port: 8080, From: FromEverywhere}},
			Resources: []map[string]any{{"id": "server", "type": "container", "name": "hello-web",
				"ports": []any{"8080"}}}},
		{Module: "helper", Listens: []Listening{{Port: 9000, From: FromMachine}}},
		{Module: "nftables", Filtering: &Filtering{Into: "/etc/nftables.conf"},
			Resources: []map[string]any{{"id": "load", "type": "service", "unit": "mesh-filter.service",
				"state": "running", "restart-on": []any{"filtering"}}}},
	}}
}

func anchorRendering(adopted bool) Rendering {
	return Rendering{
		Generators: map[string]Generator{"overlay": hub{}},
		Ports:      map[string]map[int]int{"distribution": {5000: 5000}, "hello-web": {8080: 20001}},
		Settings: SettingsBy{"distribution": {{From: "node anchor",
			Values: map[string]any{ExposeSetting: map[string]any{"5000": FromEverywhere}}}}},
		Mesh:       []string{"10.42.0.1"},
		Foundation: []int{5671},
		Adopted:    adopted,
	}
}

func byID(resources []map[string]any) map[string]map[string]any {
	out := map[string]map[string]any{}
	for _, r := range resources {
		out[r["id"].(string)] = r
	}
	return out
}

func TestAnAdoptedNodeIsDeclaredOpeningsFromTheSameInputsAsTheFilter(t *testing.T) {
	composed, err := anAdoptedAnchor().Compose(anchorRendering(true))
	if err != nil {
		t.Fatal(err)
	}
	got := byID(composed.Resources)
	want := map[string]map[string]any{
		// The hub's port, from anywhere, received.
		"adoption.opening-udp-51820-incoming": {"port": 51820, "protocol": "udp",
			"from": "everywhere", "path": "incoming"},
		// The store's port from the private network only, and forwarded: a container publishes it.
		"adoption.opening-tcp-5432-forwarded": {"port": 5432, "protocol": "tcp", "from": "mesh",
			"path": "forwarded", "to": 5432},
		// The bus from anywhere: a node enrols over it before it has a private address.
		"adoption.opening-tcp-5671-forwarded": {"port": 5671, "protocol": "tcp",
			"from": "everywhere", "path": "forwarded", "to": 5671},
		"adoption.opening-tcp-5672-forwarded": {"port": 5672, "protocol": "tcp", "from": "mesh",
			"path": "forwarded", "to": 5672},
		// The registry from anywhere, by its node's exposure setting.
		"adoption.opening-tcp-5000-forwarded": {"port": 5000, "protocol": "tcp",
			"from": "everywhere", "path": "forwarded", "to": 5000},
		// A published port names the machine port and the container port it is forwarded to.
		"adoption.opening-tcp-20001-forwarded": {"port": 20001, "protocol": "tcp",
			"from": "everywhere", "path": "forwarded", "to": 8080},
	}
	for id, fields := range want {
		opening, ok := got[id]
		if !ok {
			t.Errorf("no %s among %v", id, keys(got))
			continue
		}
		if opening["type"] != "opening" {
			t.Errorf("%s is a %v", id, opening["type"])
		}
		for k, v := range fields {
			if opening[k] != v {
				t.Errorf("%s: %s is %v, want %v", id, k, opening[k], v)
			}
		}
	}
	for id := range got {
		if strings.HasPrefix(id, "adoption.opening-") && want[id] == nil {
			t.Errorf("an opening nothing asked for: %s", id)
		}
	}
	// A port for this machine only opens nothing, and the management port is not opened at all.
	for id := range got {
		if strings.Contains(id, "-9000-") || strings.Contains(id, "-15672-") {
			t.Errorf("%s is opened", id)
		}
	}

	// And openings come first, in the order the machine applies them.
	if !strings.HasPrefix(composed.Resources[0]["id"].(string), "adoption.opening-") {
		t.Errorf("openings are not first: %v", composed.Resources[0]["id"])
	}
}

func TestAnAdoptedNodeLoadsNoFilterOfTheMeshs(t *testing.T) {
	composed, err := anAdoptedAnchor().Compose(anchorRendering(true))
	if err != nil {
		t.Fatal(err)
	}
	for _, r := range composed.Resources {
		if r["path"] == "/etc/nftables.conf" || strings.HasPrefix(r["id"].(string), "nftables.") {
			t.Fatalf("an adopted node is declared the filter module's %v", r["id"])
		}
		if content, _ := r["content"].(string); strings.Contains(content, "policy drop") {
			t.Fatalf("an adopted node is declared a table that drops by default: %v", r["id"])
		}
		// Nothing but refusals: the only accept in the guard is its policy.
		if content, _ := r["content"].(string); r["id"] == GuardID() &&
			strings.Count(content, "accept") != 1 {
			t.Fatalf("the guard holds an accept:\n%s", content)
		}
	}
	got := byID(composed.Resources)
	guard := got[GuardID()]
	if guard == nil || got[GuardUnitID()] == nil || got[GuardRunningID()] == nil {
		t.Fatalf("no guard: %v", keys(got))
	}
	if guard["content"] != AsGuard([]int{5432, 15672}) {
		t.Fatalf("the guard does not guard the store and the management port:\n%s", guard["content"])
	}
	if !reflect.DeepEqual(got[GuardRunningID()]["restart-on"], []any{GuardID(), GuardUnitID()}) {
		t.Fatalf("the guard is not reloaded when its table changes: %v", got[GuardRunningID()])
	}
	// Nothing of the mesh's own is anybody's to hold.
	for id, module := range composed.Owner {
		if strings.HasPrefix(id, AdoptionPrefix) {
			t.Fatalf("%s is owned by %s", id, module)
		}
	}
}

func TestAConvergedNodeIsDeclaredItsFilterAndNoOpenings(t *testing.T) {
	composed, err := anAdoptedAnchor().Compose(anchorRendering(false))
	if err != nil {
		t.Fatal(err)
	}
	got := byID(composed.Resources)
	if got["nftables.filtering"] == nil || got["nftables.load"] == nil {
		t.Fatalf("a converged node lost its filter: %v", keys(got))
	}
	for id := range got {
		if strings.HasPrefix(id, AdoptionPrefix) {
			t.Fatalf("a converged node is declared %s", id)
		}
	}
	plain, err := anAdoptedAnchor().Declaration(anchorRendering(false))
	if err != nil {
		t.Fatal(err)
	}
	a, _ := json.Marshal(plain)
	b, _ := json.Marshal(composed.Resources)
	if string(a) != string(b) {
		t.Fatal("Compose and Declaration disagree on a converged node")
	}
}

// The table the installer raises and the controller declares, character for character.
func TestTheGuardIsExactlyThisTable(t *testing.T) {
	const golden = `table inet mesh_guard {}
delete table inet mesh_guard
table inet mesh_guard {
	chain prerouting {
		type filter hook prerouting priority raw; policy accept;
		iifname != "lo" iifname != "docker0" iifname != "br-*" iifname != "mesh0" tcp dport { 5432, 15672 } drop
	}
}
`
	if got := AsGuard([]int{15672, 5432}); got != golden {
		t.Fatalf("the guard changed:\n%s", got)
	}
	if GuardResources(nil) != nil {
		t.Fatal("a guard with nothing to guard is an empty set nft refuses to load")
	}
}

func TestAGuardedPortMustBeAPort(t *testing.T) {
	if _, err := ParseManifest([]byte(`{"module":"postgres","guards":[5432]}`)); err != nil {
		t.Fatalf("guards is refused: %v", err)
	}
	if _, err := ParseManifest([]byte(`{"module":"postgres","guards":[0]}`)); err == nil {
		t.Fatal("guarding port 0 was accepted")
	}
}

func keys[V any](m map[string]V) []string {
	return sortedKeys(m)
}