1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
|
package com.yahoo.vespa.hosted.athenz.instanceproviderservice.instanceconfirmation;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.yahoo.config.model.api.ApplicationInfo;
import com.yahoo.config.model.api.HostInfo;
import com.yahoo.config.model.api.Model;
import com.yahoo.config.model.api.ServiceInfo;
import com.yahoo.config.model.api.SuperModel;
import com.yahoo.config.model.api.SuperModelProvider;
import com.yahoo.config.provision.ApplicationId;
import com.yahoo.vespa.hosted.athenz.instanceproviderservice.AutoGeneratedKeyProvider;
import com.yahoo.vespa.hosted.athenz.instanceproviderservice.KeyProvider;
import com.yahoo.vespa.hosted.athenz.instanceproviderservice.impl.Utils;
import com.yahoo.vespa.hosted.athenz.instanceproviderservice.identitydocument.IdentityDocument;
import com.yahoo.vespa.hosted.athenz.instanceproviderservice.identitydocument.ProviderUniqueId;
import com.yahoo.vespa.hosted.athenz.instanceproviderservice.identitydocument.SignedIdentityDocument;
import org.junit.Test;
import java.security.PrivateKey;
import java.security.Signature;
import java.time.Instant;
import java.util.Base64;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.function.Function;
import java.util.stream.Collectors;
import java.util.stream.IntStream;
import java.util.stream.Stream;
import static com.yahoo.vespa.hosted.athenz.instanceproviderservice.instanceconfirmation.InstanceValidator.SERVICE_PROPERTIES_DOMAIN_KEY;
import static com.yahoo.vespa.hosted.athenz.instanceproviderservice.instanceconfirmation.InstanceValidator.SERVICE_PROPERTIES_SERVICE_KEY;
import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
/**
* @author valerijf
*/
public class InstanceValidatorTest {
private final ApplicationId applicationId = ApplicationId.from("tenant", "application", "instance");
private final String domain = "domain";
private final String service = "service";
@Test
public void valid_signature() throws Exception {
KeyProvider keyProvider = new AutoGeneratedKeyProvider();
InstanceValidator instanceValidator = new InstanceValidator(keyProvider, null);
InstanceConfirmation instanceConfirmation = createInstanceConfirmation(
keyProvider.getPrivateKey(0), applicationId, domain, service);
assertTrue(instanceValidator.isInstanceSignatureValid(instanceConfirmation));
}
@Test
public void invalid_signature() throws Exception {
KeyProvider keyProvider = new AutoGeneratedKeyProvider();
InstanceValidator instanceValidator = new InstanceValidator(keyProvider, null);
KeyProvider fakeKeyProvider = new AutoGeneratedKeyProvider();
InstanceConfirmation instanceConfirmation = createInstanceConfirmation(
fakeKeyProvider.getPrivateKey(0), applicationId, domain, service);
assertFalse(instanceValidator.isInstanceSignatureValid(instanceConfirmation));
}
@Test
public void application_does_not_exist() {
SuperModelProvider superModelProvider = mockSuperModelProvider();
InstanceValidator instanceValidator = new InstanceValidator(null, superModelProvider);
assertFalse(instanceValidator.isSameIdentityAsInServicesXml(applicationId, domain, service));
}
@Test
public void application_does_not_have_domain_set() {
SuperModelProvider superModelProvider = mockSuperModelProvider(
mockApplicationInfo(applicationId, 5, Collections.emptyList()));
InstanceValidator instanceValidator = new InstanceValidator(null, superModelProvider);
assertFalse(instanceValidator.isSameIdentityAsInServicesXml(applicationId, domain, service));
}
@Test
public void application_has_wrong_domain() {
ServiceInfo serviceInfo = new ServiceInfo("serviceName", "type", Collections.emptyList(),
Collections.singletonMap(SERVICE_PROPERTIES_DOMAIN_KEY, "not-domain"), "confId", "hostName");
SuperModelProvider superModelProvider = mockSuperModelProvider(
mockApplicationInfo(applicationId, 5, Collections.singletonList(serviceInfo)));
InstanceValidator instanceValidator = new InstanceValidator(null, superModelProvider);
assertFalse(instanceValidator.isSameIdentityAsInServicesXml(applicationId, domain, service));
}
@Test
public void application_has_same_domain_and_service() {
Map<String, String> properties = new HashMap<>();
properties.put(SERVICE_PROPERTIES_DOMAIN_KEY, domain);
properties.put(SERVICE_PROPERTIES_SERVICE_KEY, service);
ServiceInfo serviceInfo = new ServiceInfo("serviceName", "type", Collections.emptyList(),
properties, "confId", "hostName");
SuperModelProvider superModelProvider = mockSuperModelProvider(
mockApplicationInfo(applicationId, 5, Collections.singletonList(serviceInfo)));
InstanceValidator instanceValidator = new InstanceValidator(null, superModelProvider);
assertTrue(instanceValidator.isSameIdentityAsInServicesXml(applicationId, domain, service));
}
private static InstanceConfirmation createInstanceConfirmation(PrivateKey privateKey, ApplicationId applicationId,
String domain, String service) {
IdentityDocument identityDocument = new IdentityDocument(
new ProviderUniqueId(applicationId.tenant().value(), applicationId.application().value(),
"environment", "region", applicationId.instance().value(), "cluster-id", 0),
"hostname",
"instance-hostname",
Instant.now());
try {
ObjectMapper mapper = Utils.getMapper();
String encodedIdentityDocument =
Base64.getEncoder().encodeToString(mapper.writeValueAsString(identityDocument).getBytes());
Signature sigGenerator = Signature.getInstance("SHA512withRSA");
sigGenerator.initSign(privateKey);
sigGenerator.update(encodedIdentityDocument.getBytes());
return new InstanceConfirmation(
"provider", domain, service,
new SignedIdentityDocument(encodedIdentityDocument,
Base64.getEncoder().encodeToString(sigGenerator.sign()),
0,
identityDocument.providerUniqueId.asString(),
"dnssuffix",
"service",
"localhost/zts",
1));
} catch (Exception e) {
throw new RuntimeException(e);
}
}
private SuperModelProvider mockSuperModelProvider(ApplicationInfo... appInfos) {
SuperModel superModel = new SuperModel(Stream.of(appInfos)
.collect(Collectors.groupingBy(
appInfo -> appInfo.getApplicationId().tenant(),
Collectors.toMap(
ApplicationInfo::getApplicationId,
Function.identity()
)
)));
SuperModelProvider superModelProvider = mock(SuperModelProvider.class);
when(superModelProvider.getSuperModel()).thenReturn(superModel);
return superModelProvider;
}
private ApplicationInfo mockApplicationInfo(ApplicationId appId, int numHosts, List<ServiceInfo> serviceInfo) {
List<HostInfo> hosts = IntStream.range(0, numHosts)
.mapToObj(i -> new HostInfo("host-" + i + "." + appId.toShortString() + ".yahoo.com", serviceInfo))
.collect(Collectors.toList());
Model model = mock(Model.class);
when(model.getHosts()).thenReturn(hosts);
return new ApplicationInfo(appId, 0, model);
}
}
|
