mirror of
https://github.com/status-im/consul.git
synced 2025-01-09 13:26:07 +00:00
5fb9df1640
* Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * add missing license headers * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>
105 lines
2.8 KiB
Go
105 lines
2.8 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package proxycfgglue
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/hashicorp/consul/acl"
|
|
"github.com/hashicorp/consul/agent/consul/state"
|
|
"github.com/hashicorp/consul/agent/proxycfg"
|
|
"github.com/hashicorp/consul/agent/structs"
|
|
)
|
|
|
|
func TestServerIntentionUpstreams(t *testing.T) {
|
|
const serviceName = "web"
|
|
|
|
var index uint64
|
|
getIndex := func() uint64 {
|
|
index++
|
|
return index
|
|
}
|
|
|
|
ctx, cancel := context.WithCancel(context.Background())
|
|
t.Cleanup(cancel)
|
|
|
|
store := state.NewStateStore(nil)
|
|
disableLegacyIntentions(t, store)
|
|
|
|
// Register api and db services.
|
|
for _, service := range []string{"api", "db"} {
|
|
err := store.EnsureRegistration(getIndex(), &structs.RegisterRequest{
|
|
Node: "node-1",
|
|
Service: &structs.NodeService{
|
|
Service: service,
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
}
|
|
|
|
createIntention := func(destination string) {
|
|
t.Helper()
|
|
|
|
err := store.EnsureConfigEntry(getIndex(), &structs.ServiceIntentionsConfigEntry{
|
|
Name: destination,
|
|
Sources: []*structs.SourceIntention{
|
|
{
|
|
Name: serviceName,
|
|
Action: structs.IntentionActionAllow,
|
|
Type: structs.IntentionSourceConsul,
|
|
},
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
}
|
|
|
|
// Create an allow intention for the api service. This should be filtered out
|
|
// because the ACL token doesn't have read access on it.
|
|
createIntention("api")
|
|
|
|
authz := policyAuthorizer(t, `service "db" { policy = "read" }`)
|
|
|
|
dataSource := ServerIntentionUpstreams(ServerDataSourceDeps{
|
|
ACLResolver: newStaticResolver(authz),
|
|
GetStore: func() Store { return store },
|
|
})
|
|
|
|
ch := make(chan proxycfg.UpdateEvent)
|
|
err := dataSource.Notify(ctx, &structs.ServiceSpecificRequest{ServiceName: serviceName}, "", ch)
|
|
require.NoError(t, err)
|
|
|
|
result := getEventResult[*structs.IndexedServiceList](t, ch)
|
|
require.Len(t, result.Services, 0)
|
|
|
|
// Create an allow intention for the db service. This should *not* be filtered
|
|
// out because the ACL token *does* have read access on it.
|
|
createIntention("db")
|
|
|
|
result = getEventResult[*structs.IndexedServiceList](t, ch)
|
|
require.Len(t, result.Services, 1)
|
|
require.Equal(t, "db", result.Services[0].Name)
|
|
}
|
|
|
|
func disableLegacyIntentions(t *testing.T, store *state.Store) {
|
|
t.Helper()
|
|
|
|
require.NoError(t, store.SystemMetadataSet(0, &structs.SystemMetadataEntry{
|
|
Key: structs.SystemMetadataIntentionFormatKey,
|
|
Value: structs.SystemMetadataIntentionFormatConfigValue,
|
|
}))
|
|
}
|
|
|
|
func policyAuthorizer(t *testing.T, policyHCL string) acl.Authorizer {
|
|
policy, err := acl.NewPolicyFromSource(policyHCL, nil, nil)
|
|
require.NoError(t, err)
|
|
|
|
authz, err := acl.NewPolicyAuthorizerWithDefaults(acl.DenyAll(), []*acl.Policy{policy}, nil)
|
|
require.NoError(t, err)
|
|
|
|
return authz
|
|
}
|