| 1 | package hostbox |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "crypto" |
| 6 | "crypto/rand" |
| 7 | "crypto/rsa" |
| 8 | "crypto/sha256" |
| 9 | "crypto/x509" |
| 10 | "encoding/base64" |
| 11 | "encoding/json" |
| 12 | "errors" |
| 13 | "github.com/carlosframework/platform/internal/boxid" |
| 14 | "testing" |
| 15 | ) |
| 16 | |
| 17 | func TestIdentitySeparatesPlacementAndCloudRegion(t *testing.T) { |
| 18 | p := IdentityProvider{Account: "123", Box: "box", Region: "ie", AWSRegion: "eu-west-1", Bucket: "data", Namespace: "platform"} |
| 19 | a := Actor{Box: "box", Enrollment: "en", Revision: 1, Binding: "binding", Region: "ie", Bucket: "data", Namespace: "platform", Eligible: true, Cloud: CloudIdentity{Provider: "aws", Account: "123", Region: "eu-west-1", InstanceID: "i-box"}} |
| 20 | if !p.actorMatches(a) { |
| 21 | t.Fatal("placement and AWS regions were conflated") |
| 22 | } |
| 23 | a.Cloud.Region = "us-east-1" |
| 24 | if p.actorMatches(a) { |
| 25 | t.Fatal("foreign cloud region admitted") |
| 26 | } |
| 27 | } |
| 28 | |
| 29 | type enrollmentRoster struct{ actor Actor } |
| 30 | |
| 31 | func (r enrollmentRoster) Actor(context.Context, string) (Actor, error) { return r.actor, nil } |
| 32 | |
| 33 | type enrollmentEvidence []byte |
| 34 | |
| 35 | func (e enrollmentEvidence) Load(context.Context, string) ([]byte, error) { return e, nil } |
| 36 | |
| 37 | func TestIdentityEnrollmentBindsSignedCloudAndPlacement(t *testing.T) { |
| 38 | key, err := rsa.GenerateKey(rand.Reader, 2048) |
| 39 | if err != nil { |
| 40 | t.Fatal(err) |
| 41 | } |
| 42 | cert := &x509.Certificate{PublicKey: &key.PublicKey, PublicKeyAlgorithm: x509.RSA} |
| 43 | actor := Actor{Box: "annie-welding", Enrollment: "en", Revision: 1, Binding: "binding", Region: "ie", Bucket: "data", Namespace: "platform", Eligible: true, Cloud: CloudIdentity{Provider: "aws", Account: "111122223333", Region: "eu-west-1", InstanceID: "i-0abc"}} |
| 44 | p := IdentityProvider{Account: actor.Cloud.Account, Box: actor.Box, Region: actor.Region, AWSRegion: actor.Cloud.Region, Bucket: actor.Bucket, Namespace: actor.Namespace, Roster: enrollmentRoster{actor}, Certs: map[string]*x509.Certificate{"eu-west-1": cert}} |
| 45 | record := func(box, account, region, instance string) []byte { |
| 46 | t.Helper() |
| 47 | doc, err := json.Marshal(map[string]string{"accountId": account, "region": region, "instanceId": instance}) |
| 48 | if err != nil { |
| 49 | t.Fatal(err) |
| 50 | } |
| 51 | sum := sha256.Sum256(doc) |
| 52 | sig, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, sum[:]) |
| 53 | if err != nil { |
| 54 | t.Fatal(err) |
| 55 | } |
| 56 | raw, err := json.Marshal(boxid.Record{V: 1, Box: box, IdentityDocument: base64.StdEncoding.EncodeToString(doc), IdentitySignature: base64.StdEncoding.EncodeToString(sig)}) |
| 57 | if err != nil { |
| 58 | t.Fatal(err) |
| 59 | } |
| 60 | return raw |
| 61 | } |
| 62 | good := record(actor.Box, actor.Cloud.Account, actor.Cloud.Region, actor.Cloud.InstanceID) |
| 63 | p.Evidence = enrollmentEvidence(good) |
| 64 | if got, err := p.Verify(t.Context()); err != nil || got != actor { |
| 65 | t.Fatalf("enrollment: got=%+v err=%v", got, err) |
| 66 | } |
| 67 | for name, raw := range map[string][]byte{ |
| 68 | "other instance": record(actor.Box, actor.Cloud.Account, actor.Cloud.Region, "i-other"), |
| 69 | "other box": record("bert-sawing", actor.Cloud.Account, actor.Cloud.Region, actor.Cloud.InstanceID), |
| 70 | "other account": record(actor.Box, "999999999999", actor.Cloud.Region, actor.Cloud.InstanceID), |
| 71 | "other region": record(actor.Box, actor.Cloud.Account, "eu-west-2", actor.Cloud.InstanceID), |
| 72 | "malformed": []byte("{}"), |
| 73 | } { |
| 74 | t.Run(name, func(t *testing.T) { |
| 75 | q := p |
| 76 | q.Evidence = enrollmentEvidence(raw) |
| 77 | if _, err := q.Verify(t.Context()); !errors.Is(err, boxid.ErrUnverified) { |
| 78 | t.Fatalf("unbound evidence accepted: %v", err) |
| 79 | } |
| 80 | }) |
| 81 | } |
| 82 | q := p |
| 83 | q.AWSRegion = "eu-west-2" |
| 84 | if _, err := q.Verify(t.Context()); !errors.Is(err, ErrChanged) { |
| 85 | t.Fatalf("wrong cloud placement accepted: %v", err) |
| 86 | } |
| 87 | } |
| 88 | |
amadan