Jon Chery
dfacfea377
---ci--- project: orca phase: 3 milestone: v0.12 status: execute ---/ci--- apply.sh python heredoc now validates every path in desired-state.json against a prefix allowlist (/etc/orca/, /etc/traefik/orca*, /etc/systemd/system/orca-*, /etc/nftables.d/orca*, /etc/syncthing/orca*). Rejects with exit 7 on mismatch. Also rejects .. traversal and relative paths. HMAC-signed manifest unchanged. 8 regression tests including /etc/orca/../../shadow traversal attempt.
470 lines
13 KiB
Go
470 lines
13 KiB
Go
package txn
|
|
|
|
import (
|
|
"context"
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
|
|
"git.cloudinit.dev/coreci/orca/internal/sshpush"
|
|
)
|
|
|
|
func testKey() []byte {
|
|
return []byte("0123456789abcdef0123456789abcdef")
|
|
}
|
|
|
|
func mustRender(t *testing.T, desired any) *Bundle {
|
|
t.Helper()
|
|
b, err := RenderBundle(desired, testKey())
|
|
if err != nil {
|
|
t.Fatalf("RenderBundle: %v", err)
|
|
}
|
|
return b
|
|
}
|
|
|
|
func TestRenderBundleValidIDAndSignature(t *testing.T) {
|
|
desired := []map[string]any{
|
|
{"path": "/etc/orca/x.conf", "content": "hello", "mode": "0644"},
|
|
}
|
|
b := mustRender(t, desired)
|
|
|
|
if !strings.HasPrefix(string(b.ID), "T-") {
|
|
t.Fatalf("ID %q missing T- prefix", b.ID)
|
|
}
|
|
if len(strings.TrimPrefix(string(b.ID), "T-")) != txnIDHexLen {
|
|
t.Fatalf("ID %q suffix not %d hex chars", b.ID, txnIDHexLen)
|
|
}
|
|
|
|
// Deterministic: same input => same ID.
|
|
b2 := mustRender(t, desired)
|
|
if b.ID != b2.ID {
|
|
t.Fatalf("non-deterministic ID: %s vs %s", b.ID, b2.ID)
|
|
}
|
|
|
|
// Manifest signature verifies.
|
|
if err := VerifyManifestSignature(b.Manifest, b.ManifestSig, testKey()); err != nil {
|
|
t.Fatalf("VerifyManifestSignature: %v", err)
|
|
}
|
|
|
|
// Manifest lists all four bundle files + desired-state.
|
|
var m Manifest
|
|
if err := json.Unmarshal(b.Manifest, &m); err != nil {
|
|
t.Fatalf("unmarshal manifest: %v", err)
|
|
}
|
|
if m.TxnID != b.ID {
|
|
t.Errorf("manifest TxnID %q != bundle ID %q", m.TxnID, b.ID)
|
|
}
|
|
names := map[string]bool{}
|
|
for _, e := range m.Files {
|
|
names[e.Name] = true
|
|
if e.SHA256 == "" {
|
|
t.Errorf("manifest entry %s missing sha256", e.Name)
|
|
}
|
|
}
|
|
for _, want := range []string{fileDesiredState, fileApply, fileVerify, fileRollback} {
|
|
if !names[want] {
|
|
t.Errorf("manifest missing file %s", want)
|
|
}
|
|
}
|
|
|
|
// Scripts are bash.
|
|
if !strings.HasPrefix(string(b.ApplyScript), "#!/usr/bin/env bash") {
|
|
t.Errorf("apply.sh not bash")
|
|
}
|
|
if !strings.HasPrefix(string(b.VerifyScript), "#!/usr/bin/env bash") {
|
|
t.Errorf("verify.sh not bash")
|
|
}
|
|
if !strings.HasPrefix(string(b.RollbackScript), "#!/usr/bin/env bash") {
|
|
t.Errorf("rollback.sh not bash")
|
|
}
|
|
}
|
|
|
|
func TestRenderBundleContentAddressed(t *testing.T) {
|
|
a := mustRender(t, []map[string]any{{"path": "/a"}})
|
|
b := mustRender(t, []map[string]any{{"path": "/b"}})
|
|
if a.ID == b.ID {
|
|
t.Fatalf("distinct desired states yielded same TxnID %s", a.ID)
|
|
}
|
|
}
|
|
|
|
func TestRenderBundleRejectsEmptyKey(t *testing.T) {
|
|
_, err := RenderBundle([]string{"x"}, nil)
|
|
if err == nil {
|
|
t.Fatal("RenderBundle with empty key should fail")
|
|
}
|
|
}
|
|
|
|
func TestVerifyManifestSignatureTampered(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/x"}})
|
|
|
|
// Tamper the manifest content.
|
|
tampered := make([]byte, len(b.Manifest))
|
|
copy(tampered, b.Manifest)
|
|
tampered[0] ^= 0xff
|
|
err := VerifyManifestSignature(tampered, b.ManifestSig, testKey())
|
|
if !errors.Is(err, ErrSignatureMismatch) {
|
|
t.Fatalf("tampered manifest: got %v, want ErrSignatureMismatch", err)
|
|
}
|
|
|
|
// Tamper the signature (flip a hex char so the digest changes
|
|
// but stays valid hex).
|
|
badSig := make([]byte, len(b.ManifestSig))
|
|
copy(badSig, b.ManifestSig)
|
|
if len(badSig) > 0 {
|
|
// Flip the first hex char between 0 and 1.
|
|
if badSig[0] == '0' {
|
|
badSig[0] = '1'
|
|
} else {
|
|
badSig[0] = '0'
|
|
}
|
|
}
|
|
err = VerifyManifestSignature(b.Manifest, badSig, testKey())
|
|
if !errors.Is(err, ErrSignatureMismatch) {
|
|
t.Fatalf("tampered sig: got %v, want ErrSignatureMismatch", err)
|
|
}
|
|
|
|
// Wrong key.
|
|
wrongKey := []byte("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
|
|
err = VerifyManifestSignature(b.Manifest, b.ManifestSig, wrongKey)
|
|
if !errors.Is(err, ErrSignatureMismatch) {
|
|
t.Fatalf("wrong key: got %v, want ErrSignatureMismatch", err)
|
|
}
|
|
}
|
|
|
|
// mockTransport records all operations against an in-memory file map.
|
|
type mockTransport struct {
|
|
mu sync.Mutex
|
|
files map[string][]byte
|
|
execOut map[string][]byte
|
|
execErr map[string]error
|
|
writes []string
|
|
execs []string
|
|
}
|
|
|
|
func newMockTransport() *mockTransport {
|
|
return &mockTransport{
|
|
files: make(map[string][]byte),
|
|
execOut: make(map[string][]byte),
|
|
execErr: make(map[string]error),
|
|
}
|
|
}
|
|
|
|
func (m *mockTransport) WriteFileIdempotent(_ context.Context, _ string, path string, content []byte, _ os.FileMode) (bool, error) {
|
|
m.mu.Lock()
|
|
defer m.mu.Unlock()
|
|
m.writes = append(m.writes, path)
|
|
if existing, ok := m.files[path]; ok && string(existing) == string(content) {
|
|
return false, nil
|
|
}
|
|
cp := make([]byte, len(content))
|
|
copy(cp, content)
|
|
m.files[path] = cp
|
|
return true, nil
|
|
}
|
|
|
|
func (m *mockTransport) Exec(_ context.Context, _ string, cmd string) ([]byte, error) {
|
|
m.mu.Lock()
|
|
defer m.mu.Unlock()
|
|
m.execs = append(m.execs, cmd)
|
|
// Match by substring key in execOut/execErr maps.
|
|
for key, out := range m.execOut {
|
|
if strings.Contains(cmd, key) {
|
|
if err, ok := m.execErr[key]; ok {
|
|
return out, err
|
|
}
|
|
return out, nil
|
|
}
|
|
}
|
|
for key, err := range m.execErr {
|
|
if strings.Contains(cmd, key) {
|
|
return m.execOut[key], err
|
|
}
|
|
}
|
|
return nil, nil
|
|
}
|
|
|
|
func (m *mockTransport) hasFile(path string) bool {
|
|
m.mu.Lock()
|
|
defer m.mu.Unlock()
|
|
_, ok := m.files[path]
|
|
return ok
|
|
}
|
|
|
|
func TestStageWritesBundleFiles(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/etc/orca/x.conf", "content": "hello"}})
|
|
mt := newMockTransport()
|
|
|
|
if err := Stage(b, "lead:22", mt); err != nil {
|
|
t.Fatalf("Stage: %v", err)
|
|
}
|
|
|
|
dir := remoteTxnDir(b.ID)
|
|
for _, name := range []string{fileDesiredState, fileApply, fileVerify, fileRollback, fileManifest, fileManifestSig} {
|
|
if !mt.hasFile(dir + "/" + name) {
|
|
t.Errorf("staged file missing: %s", name)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestStageNilBundle(t *testing.T) {
|
|
mt := newMockTransport()
|
|
if err := Stage(nil, "lead:22", mt); err == nil {
|
|
t.Fatal("Stage(nil) should fail")
|
|
}
|
|
}
|
|
|
|
func TestStageNilTransport(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/x"}})
|
|
if err := Stage(b, "lead:22", nil); err == nil {
|
|
t.Fatal("Stage with nil transport should fail")
|
|
}
|
|
}
|
|
|
|
func TestApplyClusterWideSuccess(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/etc/orca/x.conf", "content": "hello"}})
|
|
mt := newMockTransport()
|
|
if err := Stage(b, "lead:22", mt); err != nil {
|
|
t.Fatalf("Stage: %v", err)
|
|
}
|
|
|
|
mt.execOut["orca-pull.sh"] = []byte("applied")
|
|
err := Apply(context.Background(), b.ID, "lead:22", mt, ApplyOptions{
|
|
Force: true,
|
|
AcknowledgeRisk: true,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("Apply: %v", err)
|
|
}
|
|
if len(mt.execs) != 1 {
|
|
t.Fatalf("expected 1 exec, got %d", len(mt.execs))
|
|
}
|
|
cmd := mt.execs[0]
|
|
if !strings.Contains(cmd, "--force") {
|
|
t.Errorf("cmd missing --force: %s", cmd)
|
|
}
|
|
if !strings.Contains(cmd, "--i-understand-the-risk") {
|
|
t.Errorf("cmd missing --i-understand-the-risk: %s", cmd)
|
|
}
|
|
if strings.Contains(cmd, "--namespace") {
|
|
t.Errorf("cluster-wide cmd should not have --namespace: %s", cmd)
|
|
}
|
|
}
|
|
|
|
func TestApplyClusterWideYes(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/x"}})
|
|
mt := newMockTransport()
|
|
_ = Stage(b, "lead:22", mt)
|
|
mt.execOut["orca-pull.sh"] = []byte("applied")
|
|
err := Apply(context.Background(), b.ID, "lead:22", mt, ApplyOptions{
|
|
Force: true,
|
|
Yes: true,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("Apply --yes: %v", err)
|
|
}
|
|
if !strings.Contains(mt.execs[0], "--yes") {
|
|
t.Errorf("cmd missing --yes: %s", mt.execs[0])
|
|
}
|
|
}
|
|
|
|
func TestApplyNamespaceScopedSuccess(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/x"}})
|
|
mt := newMockTransport()
|
|
_ = Stage(b, "lead:22", mt)
|
|
mt.execOut["orca-pull.sh"] = []byte("applied")
|
|
|
|
err := Apply(context.Background(), b.ID, "lead:22", mt, ApplyOptions{
|
|
Namespace: "default",
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("Apply ns-scoped: %v", err)
|
|
}
|
|
cmd := mt.execs[0]
|
|
if !strings.Contains(cmd, "--namespace") {
|
|
t.Errorf("ns-scoped cmd missing --namespace: %s", cmd)
|
|
}
|
|
if strings.Contains(cmd, "--force") {
|
|
t.Errorf("ns-scoped cmd should not have --force: %s", cmd)
|
|
}
|
|
}
|
|
|
|
func TestApplyClusterWideRefusesWithoutForce(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/x"}})
|
|
mt := newMockTransport()
|
|
_ = Stage(b, "lead:22", mt)
|
|
|
|
err := Apply(context.Background(), b.ID, "lead:22", mt, ApplyOptions{})
|
|
if !errors.Is(err, ErrClusterWideRequiresForce) {
|
|
t.Fatalf("expected ErrClusterWideRequiresForce, got %v", err)
|
|
}
|
|
if len(mt.execs) != 0 {
|
|
t.Errorf("should not exec when --force missing")
|
|
}
|
|
}
|
|
|
|
func TestApplyClusterWideRefusesWithoutAck(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/x"}})
|
|
mt := newMockTransport()
|
|
_ = Stage(b, "lead:22", mt)
|
|
|
|
err := Apply(context.Background(), b.ID, "lead:22", mt, ApplyOptions{Force: true})
|
|
if !errors.Is(err, ErrClusterWideRequiresAck) {
|
|
t.Fatalf("expected ErrClusterWideRequiresAck, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestApplyIdempotentNoOp(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/x"}})
|
|
mt := newMockTransport()
|
|
_ = Stage(b, "lead:22", mt)
|
|
|
|
// Lead returns exit 5 = already-applied no-op.
|
|
mt.execErr["orca-pull.sh"] = fmt.Errorf("%w: exit 5", sshpush.ErrPermanent)
|
|
mt.execOut["orca-pull.sh"] = []byte("already-applied")
|
|
|
|
err := Apply(context.Background(), b.ID, "lead:22", mt, ApplyOptions{
|
|
Force: true,
|
|
AcknowledgeRisk: true,
|
|
})
|
|
if !errors.Is(err, ErrAlreadyApplied) {
|
|
t.Fatalf("expected ErrAlreadyApplied, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestApplyFailureReturnsError(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/x"}})
|
|
mt := newMockTransport()
|
|
_ = Stage(b, "lead:22", mt)
|
|
|
|
mt.execErr["orca-pull.sh"] = fmt.Errorf("%w: exit 1", sshpush.ErrPermanent)
|
|
mt.execOut["orca-pull.sh"] = []byte("apply failure")
|
|
|
|
err := Apply(context.Background(), b.ID, "lead:22", mt, ApplyOptions{
|
|
Force: true,
|
|
AcknowledgeRisk: true,
|
|
})
|
|
if err == nil {
|
|
t.Fatal("Apply should fail on exit 1")
|
|
}
|
|
if errors.Is(err, ErrAlreadyApplied) {
|
|
t.Fatal("exit 1 should not be treated as already-applied")
|
|
}
|
|
}
|
|
|
|
func TestApplyNilTransport(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": "/x"}})
|
|
err := Apply(context.Background(), b.ID, "lead:22", nil, ApplyOptions{
|
|
Force: true,
|
|
AcknowledgeRisk: true,
|
|
})
|
|
if err == nil {
|
|
t.Fatal("Apply with nil transport should fail")
|
|
}
|
|
}
|
|
|
|
func TestSignManifestDeterministic(t *testing.T) {
|
|
manifest := []byte(`{"txn_id":"T-abc"}`)
|
|
sig := signManifest(manifest, testKey())
|
|
|
|
mac := hmac.New(sha256.New, testKey())
|
|
mac.Write(manifest)
|
|
want := hex.EncodeToString(mac.Sum(nil))
|
|
if string(sig) != want {
|
|
t.Fatalf("signManifest: got %q want %q", sig, want)
|
|
}
|
|
}
|
|
|
|
func TestComputeTxnIDStable(t *testing.T) {
|
|
data := []byte(`{"x":1}`)
|
|
id, err := computeTxnID(data)
|
|
if err != nil {
|
|
t.Fatalf("computeTxnID: %v", err)
|
|
}
|
|
sum := sha256.Sum256(data)
|
|
h := hex.EncodeToString(sum[:])
|
|
want := TxnID("T-" + h[:txnIDHexLen])
|
|
if id != want {
|
|
t.Fatalf("computeTxnID: got %q want %q", id, want)
|
|
}
|
|
}
|
|
|
|
// --- REQ-121 / F5 txn apply path allowlist tests ---
|
|
|
|
// TestApplyScriptRejectsDisallowedPath verifies the generated apply.sh
|
|
// refuses to write paths outside the allowlist. We render a bundle
|
|
// with a disallowed path, extract the apply.sh, run it with a crafted
|
|
// desired-state.json, and assert it exits 7 (the refusal code) without
|
|
// writing the file.
|
|
func TestApplyScriptRejectsDisallowedPath(t *testing.T) {
|
|
if testing.Short() {
|
|
t.Skip("apply.sh exec test skipped in -short mode")
|
|
}
|
|
disallowed := []string{
|
|
"/etc/shadow",
|
|
"/root/.ssh/authorized_keys",
|
|
"/etc/passwd",
|
|
"/tmp/pwned",
|
|
"/etc/orca/../../shadow",
|
|
"relative/path",
|
|
}
|
|
for _, p := range disallowed {
|
|
t.Run(p, func(t *testing.T) {
|
|
b := mustRender(t, []map[string]any{{"path": p, "content": "pwned"}})
|
|
// Write apply.sh + desired-state.json to a temp dir.
|
|
dir := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(dir, fileDesiredState), b.DesiredState, 0o600); err != nil {
|
|
t.Fatalf("write desired-state: %v", err)
|
|
}
|
|
if err := os.WriteFile(filepath.Join(dir, fileApply), b.ApplyScript, 0o755); err != nil {
|
|
t.Fatalf("write apply.sh: %v", err)
|
|
}
|
|
cmd := exec.Command("bash", filepath.Join(dir, fileApply))
|
|
out, err := cmd.CombinedOutput()
|
|
if err == nil {
|
|
t.Fatalf("apply.sh should fail for path %s, got success; output: %s", p, out)
|
|
}
|
|
if !strings.Contains(string(out), "refusing to write disallowed path") {
|
|
t.Errorf("apply.sh output should mention refusal: %s", out)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestApplyScriptAllowsOrcaPaths verifies the allowed prefixes work.
|
|
func TestApplyScriptAllowsOrcaPaths(t *testing.T) {
|
|
if testing.Short() {
|
|
t.Skip("apply.sh exec test skipped in -short mode")
|
|
}
|
|
// We can't actually write to /etc/ in a test, so we verify the
|
|
// allowlist logic in the generated script by checking the script
|
|
// content contains the allowlist and the path_allowed function.
|
|
b := mustRender(t, []map[string]any{{"path": "/etc/orca/test"}})
|
|
script := string(b.ApplyScript)
|
|
if !strings.Contains(script, "ALLOWED_PREFIXES") {
|
|
t.Error("apply.sh missing ALLOWED_PREFIXES")
|
|
}
|
|
if !strings.Contains(script, "path_allowed") {
|
|
t.Error("apply.sh missing path_allowed function")
|
|
}
|
|
for _, prefix := range []string{
|
|
"/etc/orca/",
|
|
"/etc/traefik/orca",
|
|
"/etc/systemd/system/orca-",
|
|
"/etc/nftables.d/orca",
|
|
"/etc/syncthing/orca",
|
|
} {
|
|
if !strings.Contains(script, prefix) {
|
|
t.Errorf("apply.sh missing allowed prefix %s", prefix)
|
|
}
|
|
}
|
|
}
|