package connectca import ( "context" "errors" "io" "testing" "time" "github.com/stretchr/testify/mock" "github.com/stretchr/testify/require" "google.golang.org/grpc/codes" "google.golang.org/grpc/status" "github.com/hashicorp/go-uuid" "github.com/hashicorp/consul/acl" resolver "github.com/hashicorp/consul/acl/resolver" "github.com/hashicorp/consul/agent/connect" external "github.com/hashicorp/consul/agent/grpc-external" "github.com/hashicorp/consul/agent/grpc-external/testutils" "github.com/hashicorp/consul/agent/structs" "github.com/hashicorp/consul/proto-public/pbconnectca" "github.com/hashicorp/consul/sdk/testutil" ) const testACLToken = "acl-token" func TestWatchRoots_ConnectDisabled(t *testing.T) { server := NewServer(Config{ConnectEnabled: false}) // Begin the stream. client := testClient(t, server) stream, err := client.WatchRoots(context.Background(), &pbconnectca.WatchRootsRequest{}) require.NoError(t, err) rspCh := handleRootsStream(t, stream) err = mustGetError(t, rspCh) require.Equal(t, codes.FailedPrecondition.String(), status.Code(err).String()) require.Contains(t, status.Convert(err).Message(), "Connect") } func TestWatchRoots_Success(t *testing.T) { fsm, publisher := setupFSMAndPublisher(t) // Set the initial roots and CA configuration. rootA := connect.TestCA(t, nil) _, err := fsm.GetStore().CARootSetCAS(1, 0, structs.CARoots{rootA}) require.NoError(t, err) err = fsm.GetStore().CASetConfig(0, &structs.CAConfiguration{ClusterID: "cluster-id"}) require.NoError(t, err) // Mock the ACL Resolver to return an authorizer with `service:write`. aclResolver := &MockACLResolver{} aclResolver.On("ResolveTokenAndDefaultMeta", testACLToken, mock.Anything, mock.Anything). Return(testutils.TestAuthorizerServiceWriteAny(t), nil) ctx := external.ContextWithToken(context.Background(), testACLToken) server := NewServer(Config{ Publisher: publisher, GetStore: func() StateStore { return fsm.GetStore() }, Logger: testutil.Logger(t), ACLResolver: aclResolver, ConnectEnabled: true, }) // Begin the stream. client := testClient(t, server) stream, err := client.WatchRoots(ctx, &pbconnectca.WatchRootsRequest{}) require.NoError(t, err) rspCh := handleRootsStream(t, stream) // Expect an initial message containing current roots (provided by the snapshot). roots := mustGetRoots(t, rspCh) require.Equal(t, "cluster-id.consul", roots.TrustDomain) require.Equal(t, rootA.ID, roots.ActiveRootId) require.Len(t, roots.Roots, 1) require.Equal(t, rootA.ID, roots.Roots[0].Id) // Rotate the roots. rootB := connect.TestCA(t, nil) _, err = fsm.GetStore().CARootSetCAS(2, 1, structs.CARoots{rootB}) require.NoError(t, err) // Expect another event containing the new roots. roots = mustGetRoots(t, rspCh) require.Equal(t, "cluster-id.consul", roots.TrustDomain) require.Equal(t, rootB.ID, roots.ActiveRootId) require.Len(t, roots.Roots, 1) require.Equal(t, rootB.ID, roots.Roots[0].Id) } func TestWatchRoots_InvalidACLToken(t *testing.T) { fsm, publisher := setupFSMAndPublisher(t) // Set the initial CA configuration. err := fsm.GetStore().CASetConfig(0, &structs.CAConfiguration{ClusterID: "cluster-id"}) require.NoError(t, err) // Mock the ACL resolver to return ErrNotFound. aclResolver := &MockACLResolver{} aclResolver.On("ResolveTokenAndDefaultMeta", mock.Anything, mock.Anything, mock.Anything). Return(resolver.Result{}, acl.ErrNotFound) ctx := external.ContextWithToken(context.Background(), testACLToken) server := NewServer(Config{ Publisher: publisher, GetStore: func() StateStore { return fsm.GetStore() }, Logger: testutil.Logger(t), ACLResolver: aclResolver, ConnectEnabled: true, }) // Start the stream. client := testClient(t, server) stream, err := client.WatchRoots(ctx, &pbconnectca.WatchRootsRequest{}) require.NoError(t, err) rspCh := handleRootsStream(t, stream) // Expect to get an Unauthenticated error immediately. err = mustGetError(t, rspCh) require.Equal(t, codes.Unauthenticated.String(), status.Code(err).String()) } func TestWatchRoots_ACLTokenInvalidated(t *testing.T) { fsm, publisher := setupFSMAndPublisher(t) // Set the initial roots and CA configuration. rootA := connect.TestCA(t, nil) _, err := fsm.GetStore().CARootSetCAS(1, 0, structs.CARoots{rootA}) require.NoError(t, err) err = fsm.GetStore().CASetConfig(2, &structs.CAConfiguration{ClusterID: "cluster-id"}) require.NoError(t, err) // Mock the ACL Resolver to return an authorizer with `service:write` the // first two times it is called (initial connect and first re-auth). aclResolver := &MockACLResolver{} aclResolver.On("ResolveTokenAndDefaultMeta", testACLToken, mock.Anything, mock.Anything). Return(testutils.TestAuthorizerServiceWriteAny(t), nil).Twice() ctx := external.ContextWithToken(context.Background(), testACLToken) server := NewServer(Config{ Publisher: publisher, GetStore: func() StateStore { return fsm.GetStore() }, Logger: testutil.Logger(t), ACLResolver: aclResolver, ConnectEnabled: true, }) // Start the stream. client := testClient(t, server) stream, err := client.WatchRoots(ctx, &pbconnectca.WatchRootsRequest{}) require.NoError(t, err) rspCh := handleRootsStream(t, stream) // Consume the initial response. mustGetRoots(t, rspCh) // Update the ACL token to cause the subscription to be force-closed. accessorID, err := uuid.GenerateUUID() require.NoError(t, err) err = fsm.GetStore().ACLTokenSet(1, &structs.ACLToken{ AccessorID: accessorID, SecretID: testACLToken, }) require.NoError(t, err) // Update the roots. rootB := connect.TestCA(t, nil) _, err = fsm.GetStore().CARootSetCAS(3, 1, structs.CARoots{rootB}) require.NoError(t, err) // Expect the stream to remain open and to receive the new roots. mustGetRoots(t, rspCh) // Simulate removing the `service:write` permission. aclResolver.On("ResolveTokenAndDefaultMeta", testACLToken, mock.Anything, mock.Anything). Return(testutils.TestAuthorizerDenyAll(t), nil) // Update the ACL token to cause the subscription to be force-closed. err = fsm.GetStore().ACLTokenSet(1, &structs.ACLToken{ AccessorID: accessorID, SecretID: testACLToken, }) require.NoError(t, err) // Expect the stream to be terminated. err = mustGetError(t, rspCh) require.Equal(t, codes.PermissionDenied.String(), status.Code(err).String()) } func TestWatchRoots_StateStoreAbandoned(t *testing.T) { fsm, publisher := setupFSMAndPublisher(t) // Set the initial roots and CA configuration. rootA := connect.TestCA(t, nil) _, err := fsm.GetStore().CARootSetCAS(1, 0, structs.CARoots{rootA}) require.NoError(t, err) err = fsm.GetStore().CASetConfig(0, &structs.CAConfiguration{ClusterID: "cluster-a"}) require.NoError(t, err) // Mock the ACL Resolver to return an authorizer with `service:write`. aclResolver := &MockACLResolver{} aclResolver.On("ResolveTokenAndDefaultMeta", testACLToken, mock.Anything, mock.Anything). Return(testutils.TestAuthorizerServiceWriteAny(t), nil) ctx := external.ContextWithToken(context.Background(), testACLToken) server := NewServer(Config{ Publisher: publisher, GetStore: func() StateStore { return fsm.GetStore() }, Logger: testutil.Logger(t), ACLResolver: aclResolver, ConnectEnabled: true, }) // Begin the stream. client := testClient(t, server) stream, err := client.WatchRoots(ctx, &pbconnectca.WatchRootsRequest{}) require.NoError(t, err) rspCh := handleRootsStream(t, stream) // Consume the initial roots. mustGetRoots(t, rspCh) // Simulate a snapshot restore. storeB := testutils.TestStateStore(t, publisher) rootB := connect.TestCA(t, nil) _, err = storeB.CARootSetCAS(1, 0, structs.CARoots{rootB}) require.NoError(t, err) err = storeB.CASetConfig(0, &structs.CAConfiguration{ClusterID: "cluster-b"}) require.NoError(t, err) fsm.ReplaceStore(storeB) // Expect to get the new store's roots. newRoots := mustGetRoots(t, rspCh) require.Equal(t, "cluster-b.consul", newRoots.TrustDomain) require.Len(t, newRoots.Roots, 1) require.Equal(t, rootB.ID, newRoots.ActiveRootId) } func mustGetRoots(t *testing.T, ch <-chan rootsOrError) *pbconnectca.WatchRootsResponse { t.Helper() select { case rsp := <-ch: require.NoError(t, rsp.err) return rsp.rsp case <-time.After(1 * time.Second): t.Fatal("timeout waiting for WatchRootsResponse") return nil } } func mustGetError(t *testing.T, ch <-chan rootsOrError) error { t.Helper() select { case rsp := <-ch: require.Error(t, rsp.err) return rsp.err case <-time.After(1 * time.Second): t.Fatal("timeout waiting for WatchRootsResponse") return nil } } func handleRootsStream(t *testing.T, stream pbconnectca.ConnectCAService_WatchRootsClient) <-chan rootsOrError { t.Helper() rspCh := make(chan rootsOrError) go func() { for { rsp, err := stream.Recv() if errors.Is(err, io.EOF) || errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) { return } rspCh <- rootsOrError{ rsp: rsp, err: err, } } }() return rspCh } type rootsOrError struct { rsp *pbconnectca.WatchRootsResponse err error }