Give route-proxy its state on the bus and three tools, so a site's route, certificate and last answer are read from the mesh instead of with curl (issue 774)

The web front kept nothing on the bus: whether grafana or drive was routed, where to, with which certificate, and what it last answered could only be learned with curl or the container's log. The proxy now keeps `routes` and `unrouted` (announced readable, keyed <node>.<name>), written on change by one writer: route set changes, certificates stored by autocert's cache or failing at a handshake, upstream answers that differ from the last written (or are a minute old), and names refused in a request or a handshake. The provider helper's bundle serves route_proxy_routes, route_proxy_route and route_proxy_unrouted from those states. Quick: log the routes at start and grep the journal. Thorough: the state on the bus and the tools that read it, mesh-wide, in one call. Chose thorough: the operator's question is mesh-wide and recurs, and the log says nothing about certificates or answers. Tests: two table tests added (the ledger, the tools), both failing without the change; four authority tests and four skipped-route tests merged into two, so the module has four fewer.
2026-10-30 22:58:04 +01:00
parent 4a90e698aa
commit 3e14a13b1a
13 changed files with 1392 additions and 118 deletions
@@ -0,0 +1,245 @@
+package main
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"math/big"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"sort"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/acme/autocert"
+
+	stdio "git.novox.be/novox/mesh-sdk/go"
+
+	"route-proxy/internal/routestate"
+)
+
+// fakeState is a state on the bus, in memory, counting what was written to it.
+type fakeState struct {
+	values map[string]json.RawMessage
+	puts   int
+}
+
+func newFakeState() *fakeState { return &fakeState{values: map[string]json.RawMessage{}} }
+
+func (f *fakeState) Put(key string, value any) (uint64, error) {
+	raw, err := json.Marshal(value)
+	if err != nil {
+		return 0, err
+	}
+	f.values[key] = raw
+	f.puts++
+	return uint64(f.puts), nil
+}
+func (f *fakeState) Delete(key string) error { delete(f.values, key); return nil }
+func (f *fakeState) Keys() ([]string, error) {
+	out := []string{}
+	for k := range f.values {
+		out = append(out, k)
+	}
+	sort.Strings(out)
+	return out, nil
+}
+func (f *fakeState) Get(key string) (*stdio.StateEntry, error) {
+	v, ok := f.values[key]
+	if !ok {
+		return nil, nil
+	}
+	return &stdio.StateEntry{Key: key, Value: v}, nil
+}
+
+func (f *fakeState) route(t *testing.T, key string) *routestate.Route {
+	t.Helper()
+	raw, ok := f.values[key]
+	if !ok {
+		return nil
+	}
+	var r routestate.Route
+	if err := json.Unmarshal(raw, &r); err != nil {
+		t.Fatal(err)
+	}
+	return &r
+}
+
+// issuedPEM is what autocert stores for a name: the key, then the certificate, signed by an issuer named here.
+func issuedPEM(t *testing.T, name string, notAfter time.Time) []byte {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	template := &x509.Certificate{SerialNumber: big.NewInt(1), DNSNames: []string{name},
+		Subject: pkix.Name{CommonName: name}, Issuer: pkix.Name{CommonName: "R11", Organization: []string{"Let's Encrypt"}},
+		NotBefore: notAfter.Add(-90 * 24 * time.Hour), NotAfter: notAfter}
+	issuer := &x509.Certificate{SerialNumber: big.NewInt(2), Subject: template.Issuer, NotBefore: template.NotBefore,
+		NotAfter: notAfter, IsCA: true, BasicConstraintsValid: true}
+	der, err := x509.CreateCertificate(rand.Reader, template, issuer, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	keyDER, _ := x509.MarshalECPrivateKey(key)
+	out := pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
+	return append(out, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})...)
+}
+
+// What the proxy tells the bus (issue 774): each served name with where it goes, its certificate and the last
+// upstream answer; each name refused; and only on change. Without the ledger nothing reaches the bus, and the
+// operator's question "is grafana reachable" is answered with curl.
+func TestTheBusIsToldWhatIsServedAndRefused(t *testing.T) {
+	notAfter := time.Date(2027, 1, 28, 12, 0, 0, 0, time.UTC)
+	gone := func() string { // an address nothing listens on: the upstream that does not answer
+		l, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer l.Close()
+		return l.Addr().String()
+	}()
+	_, port, _ := net.SplitHostPort(gone)
+	contributions := []contribution{
+		{From: "grafana", Node: "anchor", At: "127.0.0.1", Values: map[string]any{"name": "grafana.example", "port": mustFloat(t, port)}},
+		{From: "drive", Node: "home-server", At: "10.0.0.2", Values: map[string]any{"internal-name": "drive.internal", "port": 8080.0}},
+	}
+
+	for _, row := range []struct {
+		name  string
+		act   func(t *testing.T, held *table)
+		check func(t *testing.T, routes, unrouted *fakeState)
+	}{
+		{"a served name is written with the module and node it forwards to",
+			func(t *testing.T, held *table) {},
+			func(t *testing.T, routes, _ *fakeState) {
+				r := routes.route(t, "anchor.grafana.example")
+				if r == nil || r.Proxy != "anchor" || r.Reach != routestate.ReachPublic || len(r.Targets) != 1 ||
+					r.Targets[0].Module != "grafana" || r.Targets[0].Node != "anchor" || r.Targets[0].Target != "http://127.0.0.1:"+port {
+					t.Fatalf("grafana's route is not on the bus as served: %+v", r)
+				}
+				if d := routes.route(t, "anchor.drive.internal"); d == nil || d.Reach != routestate.ReachInternal ||
+					d.Certificate.Authority != routestate.ReachInternal {
+					t.Fatalf("an internal-only name is not on the bus as internal: %+v", d)
+				}
+			}},
+		{"a withdrawn route is deleted",
+			func(t *testing.T, held *table) {
+				routes, public := routesOf(contributions[1:])
+				held.set(routes, public)
+			},
+			func(t *testing.T, routes, _ *fakeState) {
+				if routes.route(t, "anchor.grafana.example") != nil {
+					t.Fatal("a route no longer served is still on the bus")
+				}
+			}},
+		{"an upstream that does not answer is written as a 502 with why, once a minute",
+			func(t *testing.T, held *table) {
+				for range 3 {
+					req := httptest.NewRequest(http.MethodGet, "http://grafana.example/login", nil)
+					handler(held).ServeHTTP(httptest.NewRecorder(), req)
+				}
+			},
+			func(t *testing.T, routes, _ *fakeState) {
+				r := routes.route(t, "anchor.grafana.example")
+				if r == nil || r.LastAnswer == nil || r.LastAnswer.Status != http.StatusBadGateway ||
+					r.LastAnswer.Error == "" || r.LastAnswer.Path != "/login" {
+					t.Fatalf("the failed answer is not on the bus: %+v", r)
+				}
+				if routes.puts != 3 { // the two routes, then the first answer; the same answer again is not written
+					t.Fatalf("the same answer was written %d times in all, want 3 writes", routes.puts)
+				}
+			}},
+		{"a name not served is written as asked, and leaves when it is served",
+			func(t *testing.T, held *table) {
+				req := httptest.NewRequest(http.MethodGet, "http://grafana.other.example/", nil)
+				req.RemoteAddr = "192.0.2.7:51000"
+				handler(held).ServeHTTP(httptest.NewRecorder(), req)
+				held.ledger.flush()
+				var a routestate.Unrouted
+				raw := held.ledger.unrouted.(*fakeState).values["anchor.grafana.other.example"]
+				if err := json.Unmarshal(raw, &a); err != nil || a.From != "192.0.2.7" || a.Times != 1 || a.AskedAt.IsZero() {
+					t.Fatalf("the refused name is not on the bus as asked: %s", raw)
+				}
+				routes, public := routesOf(append(contributions, contribution{From: "grafana", Node: "anchor",
+					Values: map[string]any{"name": "grafana.other.example", "port": 3000.0}}))
+				held.set(routes, public)
+			},
+			func(t *testing.T, _, unrouted *fakeState) {
+				if len(unrouted.values) != 0 {
+					t.Fatalf("a name now served is still written as unrouted: %v", unrouted.values)
+				}
+			}},
+		{"a handshake for a name not routed is written as asked",
+			func(t *testing.T, held *table) {
+				pick := certificateFor(held, func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+					return nil, errors.New("no public route for \"forgotten.example\" in this mesh, so no certificate is asked for")
+				}, nil)
+				_, _ = pick(&tls.ClientHelloInfo{ServerName: "forgotten.example"})
+			},
+			func(t *testing.T, _, unrouted *fakeState) {
+				var a routestate.Unrouted
+				if err := json.Unmarshal(unrouted.values["anchor.forgotten.example"], &a); err != nil || !a.Handshake {
+					t.Fatalf("a handshake refused for its name is not on the bus: %v", unrouted.values)
+				}
+			}},
+		{"a certificate an authority issued is written with its issuer, expiry and renewal",
+			func(t *testing.T, held *table) {
+				cache := recordingCache{Cache: autocert.DirCache(t.TempDir()), held: held}
+				if err := cache.Put(context.Background(), "grafana.example", issuedPEM(t, "grafana.example", notAfter)); err != nil {
+					t.Fatal(err)
+				}
+				_ = cache.Put(context.Background(), "acme_account+key", []byte("not a certificate"))
+			},
+			func(t *testing.T, routes, _ *fakeState) {
+				c := routes.route(t, "anchor.grafana.example").Certificate
+				if c.Outcome != routestate.Issued || c.Issuer != "Let's Encrypt R11" || c.NotAfter == nil ||
+					!c.NotAfter.Equal(notAfter) || c.RenewedAt == nil {
+					t.Fatalf("the issued certificate is not on the bus: %+v", c)
+				}
+			}},
+		{"a certificate that cannot be had is written with why",
+			func(t *testing.T, held *table) {
+				pick := certificateFor(held, func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
+					return nil, errors.New("acme: urn:ietf:params:acme:error:rateLimited")
+				}, nil)
+				_, _ = pick(&tls.ClientHelloInfo{ServerName: "grafana.example"})
+			},
+			func(t *testing.T, routes, _ *fakeState) {
+				c := routes.route(t, "anchor.grafana.example").Certificate
+				if c.Outcome != routestate.Failed || c.Error != "acme: urn:ietf:params:acme:error:rateLimited" {
+					t.Fatalf("the failed certificate is not on the bus: %+v", c)
+				}
+			}},
+	} {
+		t.Run(row.name, func(t *testing.T) {
+			held := newTable()
+			held.ledger = newLedger()
+			routes, unrouted := newFakeState(), newFakeState()
+			held.ledger.attach("anchor", routes, unrouted)
+			table, public := routesOf(contributions)
+			held.set(table, public)
+			held.ledger.flush()
+			row.act(t, held)
+			held.ledger.flush()
+			row.check(t, routes, unrouted)
+		})
+	}
+}
+
+func mustFloat(t *testing.T, port string) float64 {
+	t.Helper()
+	var n float64
+	if err := json.Unmarshal([]byte(port), &n); err != nil {
+		t.Fatal(err)
+	}
+	return n
+}