The node-engine owns the composition it alone runs (H1, H2)
ADR 0593 §1 and §7: compose, its bus reader and runtime reader, takein, validate, the overlay generator, the composer's run and mesh-compose, and the judgement of a move leave mesh-sdk for the node-engine's internal packages, so no other module composes and a change to them rebuilds only the node-engine. The shapes others read (the composer's request and verdict, the overlay's names, compositions and answers) stay in mesh-sdk. The node's grant is now a golden file of what the grants part composes, since the composer of the bus's user list leaves mesh-sdk too. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
This commit is contained in:
@@ -0,0 +1,311 @@
|
||||
package overlay
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func declarationFor(t *testing.T, node Node, peers []Peer) (string, []map[string]any) {
|
||||
t.Helper()
|
||||
raw, err := Declaration(node, peers, "")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var d struct {
|
||||
Declaration int `json:"declaration"`
|
||||
Resources []map[string]any `json:"resources"`
|
||||
}
|
||||
if err := json.Unmarshal(raw, &d); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if d.Declaration != 1 {
|
||||
t.Fatalf("declaration version %d", d.Declaration)
|
||||
}
|
||||
for _, r := range d.Resources {
|
||||
if r["type"] == "file" {
|
||||
return r["content"].(string), d.Resources
|
||||
}
|
||||
}
|
||||
t.Fatal("the declaration has no configuration file in it")
|
||||
return "", nil
|
||||
}
|
||||
|
||||
func TestNoPrivateKeyEverTravels(t *testing.T) {
|
||||
// The property the whole design rests on: the node generated its keypair and kept the private
|
||||
// half, so the mesh composes a configuration for a node it cannot impersonate. A private key
|
||||
// appearing here would mean the control plane had one — and a copy of its database would then
|
||||
// be every node's network identity.
|
||||
config, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"},
|
||||
[]Peer{{Name: "anchor", Key: "HUB", Allowed: "10.42.0.0/16", Endpoint: "198.51.100.1:51820"}})
|
||||
|
||||
if strings.Contains(config, "PrivateKey") {
|
||||
t.Error("the configuration carries a PrivateKey line; the mesh must never hold one")
|
||||
}
|
||||
if !strings.Contains(config, "private-key "+DefaultKeyPath) {
|
||||
t.Error("the configuration does not point at the key file the node wrote, so the " +
|
||||
"interface would come up with no key at all")
|
||||
}
|
||||
}
|
||||
|
||||
func TestTheDeclarationUsesOnlyShapesTheHostAlreadyHas(t *testing.T) {
|
||||
// Connectivity needs nothing new from tier 0, and that is worth holding: the host does not
|
||||
// know what a private network is, and should not learn.
|
||||
_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
|
||||
|
||||
allowed := map[string]bool{"package": true, "file": true, "service": true,
|
||||
"directory": true, "container": true, "action": true}
|
||||
for _, r := range resources {
|
||||
if !allowed[r["type"].(string)] {
|
||||
t.Errorf("the overlay declaration uses %q, which the host does not have", r["type"])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestTheInterfaceComesBackAfterAReboot(t *testing.T) {
|
||||
// A node whose overlay only exists while something is watching is not a node that survives
|
||||
// being switched off and on — and it would come back unreachable, which is the worst way to
|
||||
// come back.
|
||||
_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
|
||||
for _, r := range resources {
|
||||
if r["type"] == "service" {
|
||||
if r["boot"] != "enabled" {
|
||||
t.Error("the overlay interface is not enabled at boot")
|
||||
}
|
||||
if r["state"] != "running" {
|
||||
t.Error("the overlay interface is not asked to be running")
|
||||
}
|
||||
return
|
||||
}
|
||||
}
|
||||
t.Error("nothing in the declaration brings the interface up")
|
||||
}
|
||||
|
||||
func TestTheConfigurationIsNotWorldReadable(t *testing.T) {
|
||||
// It lists every peer's key and endpoint, which is a map of the mesh. Not secret the way a
|
||||
// private key is, and not something to leave readable on a machine somebody else also uses.
|
||||
// The peer list specifically, not every file. `/etc/hosts` is in here too and must be
|
||||
// world-readable, or nothing on the machine resolves anything — a check that swept all files
|
||||
// would force it to 0600 and break the machine to protect a file that is not secret.
|
||||
_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
|
||||
for _, r := range resources {
|
||||
if r["id"] == "overlay-config" && r["mode"] != "0600" {
|
||||
t.Errorf("the peer list is mode %v", r["mode"])
|
||||
}
|
||||
if r["id"] == "mesh-names" && r["mode"] != "0644" {
|
||||
t.Errorf("the name file is mode %v; nothing on the machine could read it", r["mode"])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPeerThatCannotBeDialledSaysSo(t *testing.T) {
|
||||
// A [Peer] with no Endpoint is correct and looks like a mistake. Saying why stops somebody
|
||||
// helpfully adding one that cannot work.
|
||||
config, _ := declarationFor(t, Node{Name: "anchor", Key: "HUB", Address: "10.42.0.1",
|
||||
Endpoint: "198.51.100.1:51820", Hub: true},
|
||||
[]Peer{{Name: "laptop", Key: "PUB", Allowed: "10.42.0.2/32", Why: "routes through this hub"}})
|
||||
|
||||
if strings.Contains(config, "Endpoint =") {
|
||||
t.Error("an endpoint was written for a peer that has none")
|
||||
}
|
||||
if !strings.Contains(config, "cannot be dialled") {
|
||||
t.Error("the file does not say why that peer has no endpoint")
|
||||
}
|
||||
}
|
||||
|
||||
func TestTheFileSaysNotToEditIt(t *testing.T) {
|
||||
// It is replaced whenever the graph changes. An edit survives until then and vanishes, which
|
||||
// is worse than never being applied — the machine works, then stops, and nothing changed
|
||||
// that anybody remembers.
|
||||
config, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
|
||||
if !strings.Contains(config, "Do not edit") {
|
||||
t.Error("a generated file does not say it is generated")
|
||||
}
|
||||
}
|
||||
|
||||
func TestANodeWithNoAddressIsRefused(t *testing.T) {
|
||||
// Rather than a configuration with a blank address, which wg-quick would reject on the
|
||||
// machine, at boot, where the failure is much harder to see.
|
||||
if _, err := Declaration(Node{Name: "laptop", Key: "PUB"}, nil, ""); err == nil {
|
||||
t.Fatal("a node with no overlay address was given a configuration")
|
||||
}
|
||||
}
|
||||
|
||||
func TestOnlyAReachableNodeListens(t *testing.T) {
|
||||
// A ListenPort on a node nothing can dial is a port open for no reason.
|
||||
config, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
|
||||
if strings.Contains(config, "ListenPort") {
|
||||
t.Error("a node that cannot be dialled was told to listen")
|
||||
}
|
||||
config, _ = declarationFor(t, Node{Name: "anchor", Key: "HUB", Address: "10.42.0.1",
|
||||
Endpoint: "198.51.100.1:51820"}, nil)
|
||||
if !strings.Contains(config, "ListenPort = 51820") {
|
||||
t.Error("a reachable node does not listen on the port its endpoint names")
|
||||
}
|
||||
}
|
||||
|
||||
func TestTheServiceIsRestartedWhenThePeerListChanges(t *testing.T) {
|
||||
// The fault this exists to catch, found in the lab the moment a third node arrived: a running
|
||||
// WireGuard interface does not re-read its configuration. The file was replaced, the service
|
||||
// was already running so nothing reloaded it, and every existing node kept a network that no
|
||||
// longer matched the mesh — while looking entirely successful.
|
||||
//
|
||||
// So the declaration has to verify what the interface is *carrying*, not what the file says.
|
||||
//
|
||||
// And it must be declared state rather than a command: the host refuses an action arriving
|
||||
// over the link (novox/hq ADR 0005), correctly, which is how this shape was arrived at. There
|
||||
// is a test below that no action is ever in here.
|
||||
_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"},
|
||||
[]Peer{{Name: "anchor", Key: "HUBKEY", Allowed: "10.42.0.0/16"}})
|
||||
|
||||
for _, r := range resources {
|
||||
if r["type"] != "service" {
|
||||
continue
|
||||
}
|
||||
reflects := fmt.Sprint(r["restart-on"])
|
||||
if !strings.Contains(reflects, "overlay-config") {
|
||||
t.Errorf("the interface does not restart when its configuration changes: %v", reflects)
|
||||
}
|
||||
return
|
||||
}
|
||||
t.Error("nothing in the declaration brings the interface up")
|
||||
}
|
||||
|
||||
func TestTheOverlayDeclarationCarriesNoAction(t *testing.T) {
|
||||
// The link may not carry an action, and the host refuses a declaration containing one — whole,
|
||||
// not in part. An overlay declaration with an action in it does not half-apply: it leaves the
|
||||
// node with no network at all.
|
||||
_, resources := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
|
||||
for _, r := range resources {
|
||||
if r["type"] == "action" {
|
||||
t.Errorf("the declaration contains an action (%v); the host will refuse the whole "+
|
||||
"thing and the node will have no network", r["id"])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestTheHubForwardsAndNobodyElseDoes(t *testing.T) {
|
||||
// A hub carries traffic between its spokes, and Linux does not forward packets unless told
|
||||
// to. Without it every spoke reaches the hub perfectly and no spoke reaches any other — which
|
||||
// is how it failed in the lab, and it presents as a peering problem rather than a kernel
|
||||
// setting, so it is worth being sure of.
|
||||
hub, _ := declarationFor(t, Node{Name: "anchor", Key: "HUB", Address: "10.42.0.1",
|
||||
Endpoint: "198.51.100.1:51820", Hub: true}, nil)
|
||||
if !strings.Contains(hub, "ip_forward=1") {
|
||||
t.Error("the hub does not enable forwarding, so its spokes cannot reach each other")
|
||||
}
|
||||
if !strings.Contains(hub, "ip_forward=0") {
|
||||
t.Error("the hub never stops forwarding; a machine that stops being the hub would keep " +
|
||||
"passing traffic it is no longer part of")
|
||||
}
|
||||
|
||||
// And past the machine's own firewall. Any node with a container runtime has FORWARD set to
|
||||
// DROP by Docker, so enabling ip_forward alone changes nothing — which is exactly how it
|
||||
// failed, with every spoke reaching the hub and no spoke reaching any other.
|
||||
// Checked as PostUp specifically. "contains FORWARD" passes on the PostDown line alone,
|
||||
// which would leave a hub that tears down rules it never put up.
|
||||
if !strings.Contains(hub, "PostUp = command -v iptables") {
|
||||
t.Error("the hub does not open its own firewall, so a container runtime's DROP policy " +
|
||||
"silently eats everything it was supposed to carry")
|
||||
}
|
||||
if !strings.Contains(hub, "PostDown = command -v iptables") {
|
||||
t.Error("the hub never removes those rules, so a machine that stops being the hub keeps " +
|
||||
"passing traffic it is no longer part of")
|
||||
}
|
||||
|
||||
spoke, _ := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "10.42.0.2"}, nil)
|
||||
if strings.Contains(spoke, "FORWARD") {
|
||||
t.Error("a spoke was given forwarding rules it has no use for")
|
||||
}
|
||||
if strings.Contains(spoke, "ip_forward") {
|
||||
t.Error("a spoke was told to forward packets, which is not its job and widens what a " +
|
||||
"compromised one could do")
|
||||
}
|
||||
}
|
||||
|
||||
// novox/hq ADR 0105: a node whose private network takes over the tunnel it found is told so on
|
||||
// the interface's service, and nothing else about the declaration changes — the key is already
|
||||
// the found one, taken at enrolment.
|
||||
func TestTakingOverAFoundTunnelIsSaidOnTheInterfacesService(t *testing.T) {
|
||||
node := Node{Name: "anchor", Key: "PUB", Address: "192.0.2.1", Hub: true,
|
||||
Endpoint: "198.51.100.1:51900",
|
||||
TakesOver: &TakeOver{Interface: "wg0", Unit: "wg-quick@wg0", Config: "/etc/wireguard/wg0.conf"}}
|
||||
config, resources := declarationFor(t, node, nil)
|
||||
|
||||
var up map[string]any
|
||||
for _, r := range resources {
|
||||
if r["type"] == "service" {
|
||||
up = r
|
||||
}
|
||||
}
|
||||
takes, ok := up["takes-over"].(map[string]any)
|
||||
if !ok {
|
||||
t.Fatalf("the interface's service does not say what it takes over: %+v", up)
|
||||
}
|
||||
if takes["unit"] != "wg-quick@wg0" || takes["config"] != "/etc/wireguard/wg0.conf" || takes["interface"] != "wg0" {
|
||||
t.Errorf("the takeover names the wrong tunnel: %+v", takes)
|
||||
}
|
||||
if !strings.Contains(config, "ListenPort = 51900") {
|
||||
t.Errorf("the hub's interface does not listen on the tunnel's port:\n%s", config)
|
||||
}
|
||||
if strings.Contains(config, "PrivateKey") {
|
||||
t.Error("the found key travelled in the configuration; it is the node's own, set from its key file")
|
||||
}
|
||||
|
||||
_, plain := declarationFor(t, Node{Name: "laptop", Key: "PUB", Address: "192.0.2.4"}, nil)
|
||||
for _, r := range plain {
|
||||
if _, says := r["takes-over"]; says {
|
||||
t.Error("a node taking over nothing was told to take something over")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestATakenTunnelBringsItsListenPortEvenWhenNotDialable(t *testing.T) {
|
||||
// A home node behind NAT (no Endpoint, so not Reachable) that took over a tunnel must still
|
||||
// listen on that tunnel's port, because its LAN peers dial it there (novox/hq: a taken tunnel
|
||||
// brings its port). Without this the takeover guard refuses overlay-up.
|
||||
config, _ := declarationFor(t, Node{
|
||||
Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
|
||||
TakesOver: &TakeOver{Interface: "wg0", Unit: "wg-quick@wg0", Port: 51820},
|
||||
}, nil)
|
||||
|
||||
if !strings.Contains(config, "ListenPort = 51820") {
|
||||
t.Fatalf("a taken tunnel's port must be the mesh interface's ListenPort:\n%s", config)
|
||||
}
|
||||
if strings.Contains(config, "Endpoint =") {
|
||||
t.Error("a node that only listens for LAN peers must not advertise an endpoint")
|
||||
}
|
||||
}
|
||||
|
||||
func TestANodeWithNoTunnelAndNoEndpointStillListensOnNothing(t *testing.T) {
|
||||
// The guard against over-emitting: a plain spoke with neither an endpoint nor a taken tunnel
|
||||
// writes no ListenPort — it purely dials out.
|
||||
config, _ := declarationFor(t, Node{Name: "laptop", Key: "K", Address: "10.10.0.9"}, nil)
|
||||
if strings.Contains(config, "ListenPort") {
|
||||
t.Fatalf("a dial-only node needs no ListenPort:\n%s", config)
|
||||
}
|
||||
}
|
||||
|
||||
func TestATakenTunnelCarriesItsMTU(t *testing.T) {
|
||||
// A path tuned to a smaller MTU (1380 here) must survive the takeover — the mesh interface
|
||||
// comes up with the same MTU, or transfers hang silently (novox/hq: a taken tunnel carries
|
||||
// its MTU).
|
||||
config, _ := declarationFor(t, Node{
|
||||
Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
|
||||
TakesOver: &TakeOver{Interface: "wg0", Port: 51820, MTU: 1380},
|
||||
}, nil)
|
||||
if !strings.Contains(config, "MTU = 1380") {
|
||||
t.Fatalf("the tuned MTU was dropped:\n%s", config)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNoMTULineWhenTheTunnelSetNone(t *testing.T) {
|
||||
config, _ := declarationFor(t, Node{
|
||||
Name: "shanks", Key: "SPOKE", Address: "10.10.0.3",
|
||||
TakesOver: &TakeOver{Interface: "wg0", Port: 51820},
|
||||
}, nil)
|
||||
if strings.Contains(config, "MTU") {
|
||||
t.Fatalf("no MTU was found, so none should be written:\n%s", config)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user