195 lines
7.5 KiB
Go
195 lines
7.5 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"net"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
agentpb "git.ipao.vip/rogee/go-sip/gen/agent"
|
|
"git.ipao.vip/rogee/go-sip/internal/rpc"
|
|
"google.golang.org/grpc"
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/credentials"
|
|
"google.golang.org/grpc/status"
|
|
)
|
|
|
|
func TestCurrentAgentCommandRejectsRealModesAndObsoleteCallEntry(t *testing.T) {
|
|
for _, tc := range []struct {
|
|
name string
|
|
args []string
|
|
want string
|
|
}{
|
|
{"real", []string{"--mode", "real"}, "Mock"},
|
|
{"mixed", []string{"--mode", "mixed"}, "Mock"},
|
|
{"old call-once", []string{"--call-once"}, "unknown flag"},
|
|
{"no deployment identity", []string{"--mode", "mock"}, "AGENT_ID"},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
state := filepath.Join(t.TempDir(), "session.json")
|
|
t.Setenv("AGENT_ID", "")
|
|
t.Setenv("AGENT_SESSION_PATH", state)
|
|
command := newCurrentAgentCommand()
|
|
command.SetOut(io.Discard)
|
|
command.SetErr(io.Discard)
|
|
command.SetArgs(tc.args)
|
|
if err := command.Execute(); err == nil || !strings.Contains(err.Error(), tc.want) {
|
|
t.Fatalf("unsafe current Agent command was admitted: %v", err)
|
|
}
|
|
if _, err := os.Stat(state); !os.IsNotExist(err) {
|
|
t.Fatalf("rejected command opened durable Agent state: %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestLoadMockAppliedSIPAcceptsOnlyExplicitLocalFacts(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "applied-sip.json")
|
|
if err := os.WriteFile(path, []byte(`{"trunks":{"trunk-mock":8}}`), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
applied, err := loadMockAppliedSIP(path)
|
|
if err != nil || len(applied) != 1 || applied["trunk-mock"] != 8 {
|
|
t.Fatalf("explicit isolated applied SIP facts were changed: %v %v", applied, err)
|
|
}
|
|
if _, err := loadMockAppliedSIP(""); err == nil {
|
|
t.Fatal("missing applied SIP facts were defaulted")
|
|
}
|
|
for _, data := range []string{
|
|
`{"trunks":{}}`, `{"trunks":{"trunk-mock":0}}`, `{"trunks":{"":8}}`,
|
|
`{"trunks":{"trunk-mock":8},"schema_version":"v3"}`,
|
|
`{"trunks":{"trunk-mock":8}} {}`,
|
|
} {
|
|
if err := os.WriteFile(path, []byte(data), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := loadMockAppliedSIP(path); err == nil {
|
|
t.Fatalf("unapproved Mock SIP fixture was admitted: %s", data)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCurrentAgentCommandServesPinnedMutualTLSOnly(t *testing.T) {
|
|
ca, agentCert, agentKey, dispatcherCert, dispatcherKey, dispatcherLeaf := localCommandCertificates(t)
|
|
settings, _ := currentAgentSetupFixture(t)
|
|
for path, body := range map[string][]byte{
|
|
settings.CAFile: ca, settings.CertFile: agentCert, settings.KeyFile: agentKey,
|
|
} {
|
|
if err := os.WriteFile(path, body, 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
scenarioFile := filepath.Join(settings.RecoveryRoot, "scenario.json")
|
|
appliedFile := filepath.Join(settings.RecoveryRoot, "applied-sip.json")
|
|
if err := os.WriteFile(scenarioFile, []byte(`{"inbound_pcm16":"AQABAA==","script":{"Turns":[{"Transcript":"synthetic fixture"}]},"max_wav_bytes":4096,"expected_recording":false,"outcome":"no_answer","reason_message":"synthetic no answer"}`), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := os.WriteFile(appliedFile, []byte(`{"trunks":{"trunk-mock":8}}`), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
reserved, err := net.Listen("tcp", "127.0.0.1:0")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
settings.Listen = reserved.Addr().String()
|
|
_ = reserved.Close()
|
|
for name, value := range map[string]string{
|
|
"AGENT_ID": settings.AgentID, "CELL_ID": settings.CellID,
|
|
"AGENT_GRPC_LISTEN": settings.Listen, "AGENT_SESSION_PATH": settings.SessionPath,
|
|
"AGENT_RECOVERY_ROOT": settings.RecoveryRoot,
|
|
"DISPATCHER_ID": settings.DispatcherID,
|
|
"DISPATCHER_GRPC_ENDPOINT": settings.DispatcherEndpoint,
|
|
"DISPATCHER_GRPC_SERVER_NAME": settings.DispatcherServerName,
|
|
"MTLS_CA_FILE": settings.CAFile, "MTLS_CERT_FILE": settings.CertFile,
|
|
"MTLS_KEY_FILE": settings.KeyFile,
|
|
"MTLS_PEER_CERT_FINGERPRINTS": rpc.CertificateFingerprint(dispatcherLeaf),
|
|
"AGENT_MOCK_SCENARIO_FILE": scenarioFile, "AGENT_MOCK_APPLIED_SIP_FILE": appliedFile,
|
|
} {
|
|
t.Setenv(name, value)
|
|
}
|
|
process, cancel := context.WithCancel(context.Background())
|
|
command := newCurrentAgentCommand()
|
|
command.SetOut(io.Discard)
|
|
command.SetErr(io.Discard)
|
|
command.SetContext(process)
|
|
command.SetArgs([]string{"--mode", "mock"})
|
|
finished := make(chan error, 1)
|
|
go func() { finished <- command.Execute() }()
|
|
finishedConsumed := false
|
|
t.Cleanup(func() {
|
|
cancel()
|
|
if finishedConsumed {
|
|
return
|
|
}
|
|
select {
|
|
case err := <-finished:
|
|
if err != nil {
|
|
t.Errorf("isolated Agent shutdown failed: %v", err)
|
|
}
|
|
case <-time.After(5 * time.Second):
|
|
t.Error("isolated Agent did not stop after process cancellation")
|
|
}
|
|
})
|
|
trustedTLS, err := rpc.NewClientTLSConfig(ca, dispatcherCert, dispatcherKey, "agent.local")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
dial, stopDial := context.WithTimeout(context.Background(), 6*time.Second)
|
|
defer stopDial()
|
|
trusted, err := grpc.DialContext(dial, settings.Listen, grpc.WithTransportCredentials(credentials.NewTLS(trustedTLS)), grpc.WithBlock())
|
|
if err != nil {
|
|
select {
|
|
case startupErr := <-finished:
|
|
finishedConsumed = true
|
|
t.Fatalf("Agent startup failed: %v (dial: %v)", startupErr, err)
|
|
default:
|
|
t.Fatalf("isolated Agent mTLS listener unavailable: %v", err)
|
|
}
|
|
}
|
|
defer trusted.Close()
|
|
probe := &agentpb.GetAgentStatusRequest{
|
|
Meta: &agentpb.RequestMeta{ProtocolVersion: "agent.v1", RequestId: "mock-status", TraceId: "mock-status", OperationId: "mock-status", AgentId: settings.AgentID, CellId: settings.CellID},
|
|
Target: &agentpb.AgentBinding{AgentId: settings.AgentID, CellId: settings.CellID},
|
|
}
|
|
trustedClient := agentpb.NewAgentControlServiceClient(trusted)
|
|
response, err := trustedClient.GetAgentStatus(dial, probe)
|
|
if err != nil || response.GetStatus().GetAgentId() != settings.AgentID || response.GetStatus().GetCellId() != settings.CellID {
|
|
t.Fatalf("trusted D could not probe the actual Agent command: response=%v err=%v", response, err)
|
|
}
|
|
activation := &agentpb.ActivateAgentRequest{
|
|
Meta: &agentpb.RequestMeta{ProtocolVersion: "agent.v1", RequestId: "bind-dispatcher", TraceId: "bind-dispatcher",
|
|
OperationId: "bind-dispatcher", AgentId: settings.AgentID, CellId: settings.CellID,
|
|
BootId: response.GetStatus().GetBootId(), DispatcherEpoch: "epoch-test"},
|
|
Binding: &agentpb.AgentBinding{AgentId: settings.AgentID, CellId: settings.CellID,
|
|
ExpectedBootId: response.GetStatus().GetBootId(), DispatcherEpoch: "epoch-test",
|
|
DispatcherId: "22222222-2222-4222-8222-222222222222"},
|
|
ActivationOperationId: "bind-dispatcher",
|
|
}
|
|
if _, err := trustedClient.ActivateAgent(dial, activation); status.Code(err) != codes.PermissionDenied {
|
|
t.Fatalf("pinned certificate could claim another Dispatcher identity: %v", err)
|
|
}
|
|
if _, err := os.Stat(settings.SessionPath); !os.IsNotExist(err) {
|
|
t.Fatalf("unapproved Dispatcher wrote a session: %v", err)
|
|
}
|
|
activation.Binding.DispatcherId = settings.DispatcherID
|
|
if _, err := trustedClient.ActivateAgent(dial, activation); err != nil {
|
|
t.Fatalf("approved Dispatcher could not activate the Agent: %v", err)
|
|
}
|
|
untrustedTLS, err := rpc.NewClientTLSConfig(ca, agentCert, agentKey, "agent.local")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
untrusted, err := grpc.NewClient(settings.Listen, grpc.WithTransportCredentials(credentials.NewTLS(untrustedTLS)))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer untrusted.Close()
|
|
if _, err := agentpb.NewAgentControlServiceClient(untrusted).GetAgentStatus(dial, probe); status.Code(err) != codes.PermissionDenied {
|
|
t.Fatalf("unpinned but CA-valid client could probe Agent: %v", err)
|
|
}
|
|
}
|