mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-11-13 09:00:38 -05:00
AB#2260 Refactor disk-mapper recovery (#82)
* Refactor disk-mapper recovery * Adapt constellation recover command to use new disk-mapper recovery API * Fix Cilium connectivity on rebooting nodes (#89) * Lower CoreDNS reschedule timeout to 10 seconds (#93) Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße
GitHub
parent
a7b20b2a11
commit
8cb155d5c5
40 changed files with 1600 additions and 1130 deletions
65
disk-mapper/internal/setup/interface.go
Normal file
65
disk-mapper/internal/setup/interface.go
Normal file
|
|
@ -0,0 +1,65 @@
|
|||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
package setup
|
||||
|
||||
import (
|
||||
"io/fs"
|
||||
"os"
|
||||
"syscall"
|
||||
|
||||
"github.com/edgelesssys/constellation/internal/cloud/metadata"
|
||||
)
|
||||
|
||||
// Mounter is an interface for mount and unmount operations.
|
||||
type Mounter interface {
|
||||
Mount(source string, target string, fstype string, flags uintptr, data string) error
|
||||
Unmount(target string, flags int) error
|
||||
MkdirAll(path string, perm fs.FileMode) error
|
||||
}
|
||||
|
||||
// DeviceMapper is an interface for device mapping operations.
|
||||
type DeviceMapper interface {
|
||||
DiskUUID() string
|
||||
FormatDisk(passphrase string) error
|
||||
MapDisk(target string, passphrase string) error
|
||||
UnmapDisk(target string) error
|
||||
}
|
||||
|
||||
// ConfigurationGenerator is an interface for generating systemd-cryptsetup@.service unit files.
|
||||
type ConfigurationGenerator interface {
|
||||
Generate(volumeName, encryptedDevice, keyFile, options string) error
|
||||
}
|
||||
|
||||
// MetadataAPI is an interface for accessing cloud metadata.
|
||||
type MetadataAPI interface {
|
||||
metadata.InstanceSelfer
|
||||
metadata.InstanceLister
|
||||
}
|
||||
|
||||
// RecoveryDoer is an interface to perform key recovery operations.
|
||||
// Calls to Do may be blocking, and if successful return a passphrase and measurementSecret.
|
||||
type RecoveryDoer interface {
|
||||
Do(uuid, endpoint string) (passphrase, measurementSecret []byte, err error)
|
||||
}
|
||||
|
||||
// DiskMounter uses the syscall package to mount disks.
|
||||
type DiskMounter struct{}
|
||||
|
||||
// Mount performs a mount syscall.
|
||||
func (m DiskMounter) Mount(source string, target string, fstype string, flags uintptr, data string) error {
|
||||
return syscall.Mount(source, target, fstype, flags, data)
|
||||
}
|
||||
|
||||
// Unmount performs an unmount syscall.
|
||||
func (m DiskMounter) Unmount(target string, flags int) error {
|
||||
return syscall.Unmount(target, flags)
|
||||
}
|
||||
|
||||
// MkdirAll uses os.MkdirAll to create the directory.
|
||||
func (m DiskMounter) MkdirAll(path string, perm fs.FileMode) error {
|
||||
return os.MkdirAll(path, perm)
|
||||
}
|
||||
226
disk-mapper/internal/setup/setup.go
Normal file
226
disk-mapper/internal/setup/setup.go
Normal file
|
|
@ -0,0 +1,226 @@
|
|||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
package setup
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"sync"
|
||||
"syscall"
|
||||
|
||||
"github.com/edgelesssys/constellation/disk-mapper/internal/systemd"
|
||||
"github.com/edgelesssys/constellation/internal/attestation"
|
||||
"github.com/edgelesssys/constellation/internal/attestation/vtpm"
|
||||
"github.com/edgelesssys/constellation/internal/constants"
|
||||
"github.com/edgelesssys/constellation/internal/crypto"
|
||||
"github.com/edgelesssys/constellation/internal/file"
|
||||
"github.com/edgelesssys/constellation/internal/logger"
|
||||
"github.com/edgelesssys/constellation/internal/nodestate"
|
||||
"github.com/spf13/afero"
|
||||
)
|
||||
|
||||
const (
|
||||
keyPath = "/run/cryptsetup-keys.d"
|
||||
keyFile = "state.key"
|
||||
stateDiskMappedName = "state"
|
||||
stateDiskMountPath = "/var/run/state"
|
||||
cryptsetupOptions = "cipher=aes-xts-plain64,integrity=hmac-sha256"
|
||||
stateInfoPath = stateDiskMountPath + "/constellation/node_state.json"
|
||||
)
|
||||
|
||||
// SetupManager handles formatting, mapping, mounting and unmounting of state disks.
|
||||
type SetupManager struct {
|
||||
log *logger.Logger
|
||||
csp string
|
||||
diskPath string
|
||||
fs afero.Afero
|
||||
mapper DeviceMapper
|
||||
mounter Mounter
|
||||
config ConfigurationGenerator
|
||||
openTPM vtpm.TPMOpenFunc
|
||||
}
|
||||
|
||||
// New initializes a SetupManager with the given parameters.
|
||||
func New(log *logger.Logger, csp string, diskPath string, fs afero.Afero,
|
||||
mapper DeviceMapper, mounter Mounter, openTPM vtpm.TPMOpenFunc,
|
||||
) *SetupManager {
|
||||
return &SetupManager{
|
||||
log: log,
|
||||
csp: csp,
|
||||
diskPath: diskPath,
|
||||
fs: fs,
|
||||
mapper: mapper,
|
||||
mounter: mounter,
|
||||
config: systemd.New(fs),
|
||||
openTPM: openTPM,
|
||||
}
|
||||
}
|
||||
|
||||
// PrepareExistingDisk requests and waits for a decryption key to remap the encrypted state disk.
|
||||
// Once the disk is mapped, the function taints the node as initialized by updating it's PCRs.
|
||||
func (s *SetupManager) PrepareExistingDisk(recover RecoveryDoer) error {
|
||||
s.log.Infof("Preparing existing state disk")
|
||||
uuid := s.mapper.DiskUUID()
|
||||
|
||||
endpoint := net.JoinHostPort("0.0.0.0", strconv.Itoa(constants.RecoveryPort))
|
||||
|
||||
passphrase, measurementSecret, err := recover.Do(uuid, endpoint)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to perform recovery: %w", err)
|
||||
}
|
||||
|
||||
if err := s.mapper.MapDisk(stateDiskMappedName, string(passphrase)); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err := s.mounter.MkdirAll(stateDiskMountPath, os.ModePerm); err != nil {
|
||||
return err
|
||||
}
|
||||
// we do not care about cleaning up the mount point on error, since any errors returned here should cause a boot failure
|
||||
if err := s.mounter.Mount(filepath.Join("/dev/mapper/", stateDiskMappedName), stateDiskMountPath, "ext4", syscall.MS_RDONLY, ""); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
measurementSalt, err := s.readMeasurementSalt(stateInfoPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
clusterID, err := attestation.DeriveClusterID(measurementSecret, measurementSalt)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// taint the node as initialized
|
||||
if err := vtpm.MarkNodeAsBootstrapped(s.openTPM, clusterID); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err := s.saveConfiguration(passphrase); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return s.mounter.Unmount(stateDiskMountPath, 0)
|
||||
}
|
||||
|
||||
// PrepareNewDisk prepares an instances state disk by formatting the disk as a LUKS device using a random passphrase.
|
||||
func (s *SetupManager) PrepareNewDisk() error {
|
||||
s.log.Infof("Preparing new state disk")
|
||||
|
||||
// generate and save temporary passphrase
|
||||
passphrase := make([]byte, crypto.RNGLengthDefault)
|
||||
if _, err := rand.Read(passphrase); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.saveConfiguration(passphrase); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if err := s.mapper.FormatDisk(string(passphrase)); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return s.mapper.MapDisk(stateDiskMappedName, string(passphrase))
|
||||
}
|
||||
|
||||
func (s *SetupManager) readMeasurementSalt(path string) ([]byte, error) {
|
||||
handler := file.NewHandler(s.fs)
|
||||
var state nodestate.NodeState
|
||||
if err := handler.ReadJSON(path, &state); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if len(state.MeasurementSalt) != crypto.RNGLengthDefault {
|
||||
return nil, errors.New("missing state information to retaint node")
|
||||
}
|
||||
|
||||
return state.MeasurementSalt, nil
|
||||
}
|
||||
|
||||
// saveConfiguration saves the given passphrase and cryptsetup mapping configuration to disk.
|
||||
func (s *SetupManager) saveConfiguration(passphrase []byte) error {
|
||||
// passphrase
|
||||
if err := s.fs.MkdirAll(keyPath, os.ModePerm); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.fs.WriteFile(filepath.Join(keyPath, keyFile), passphrase, 0o400); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// systemd cryptsetup unit
|
||||
return s.config.Generate(stateDiskMappedName, s.diskPath, filepath.Join(keyPath, keyFile), cryptsetupOptions)
|
||||
}
|
||||
|
||||
type recoveryServer interface {
|
||||
Serve(context.Context, net.Listener, string) (key, secret []byte, err error)
|
||||
}
|
||||
|
||||
type rejoinClient interface {
|
||||
Start(context.Context, string) (key, secret []byte)
|
||||
}
|
||||
|
||||
type nodeRecoverer struct {
|
||||
recoveryServer recoveryServer
|
||||
rejoinClient rejoinClient
|
||||
}
|
||||
|
||||
// NewNodeRecoverer initializes a new nodeRecoverer.
|
||||
func NewNodeRecoverer(recoveryServer recoveryServer, rejoinClient rejoinClient) *nodeRecoverer {
|
||||
return &nodeRecoverer{
|
||||
recoveryServer: recoveryServer,
|
||||
rejoinClient: rejoinClient,
|
||||
}
|
||||
}
|
||||
|
||||
// Do performs a recovery procedure on the given state disk.
|
||||
// The method starts a gRPC server to allow manual recovery by a user.
|
||||
// At the same time it tries to request a decryption key from all available Constellation control-plane nodes.
|
||||
func (r *nodeRecoverer) Do(uuid, endpoint string) (passphrase, measurementSecret []byte, err error) {
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
defer cancel()
|
||||
lis, err := net.Listen("tcp", endpoint)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
defer lis.Close()
|
||||
|
||||
var once sync.Once
|
||||
var wg sync.WaitGroup
|
||||
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
key, secret, serveErr := r.recoveryServer.Serve(ctx, lis, uuid)
|
||||
once.Do(func() {
|
||||
cancel()
|
||||
passphrase = key
|
||||
measurementSecret = secret
|
||||
})
|
||||
if serveErr != nil && !errors.Is(serveErr, context.Canceled) {
|
||||
err = serveErr
|
||||
}
|
||||
}()
|
||||
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
key, secret := r.rejoinClient.Start(ctx, uuid)
|
||||
once.Do(func() {
|
||||
cancel()
|
||||
passphrase = key
|
||||
measurementSecret = secret
|
||||
})
|
||||
}()
|
||||
|
||||
wg.Wait()
|
||||
return passphrase, measurementSecret, err
|
||||
}
|
||||
454
disk-mapper/internal/setup/setup_test.go
Normal file
454
disk-mapper/internal/setup/setup_test.go
Normal file
|
|
@ -0,0 +1,454 @@
|
|||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
package setup
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"io"
|
||||
"io/fs"
|
||||
"net"
|
||||
"path/filepath"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"github.com/edgelesssys/constellation/internal/attestation/vtpm"
|
||||
"github.com/edgelesssys/constellation/internal/crypto"
|
||||
"github.com/edgelesssys/constellation/internal/file"
|
||||
"github.com/edgelesssys/constellation/internal/logger"
|
||||
"github.com/edgelesssys/constellation/internal/nodestate"
|
||||
"github.com/spf13/afero"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"go.uber.org/goleak"
|
||||
)
|
||||
|
||||
func TestMain(m *testing.M) {
|
||||
goleak.VerifyTestMain(m)
|
||||
}
|
||||
|
||||
func TestPrepareExistingDisk(t *testing.T) {
|
||||
someErr := errors.New("error")
|
||||
testRecoveryDoer := &stubRecoveryDoer{
|
||||
passphrase: []byte("passphrase"),
|
||||
secret: []byte("secret"),
|
||||
}
|
||||
|
||||
testCases := map[string]struct {
|
||||
recoveryDoer *stubRecoveryDoer
|
||||
mapper *stubMapper
|
||||
mounter *stubMounter
|
||||
configGenerator *stubConfigurationGenerator
|
||||
openTPM vtpm.TPMOpenFunc
|
||||
missingState bool
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
recoveryDoer: testRecoveryDoer,
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
mounter: &stubMounter{},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
openTPM: vtpm.OpenNOPTPM,
|
||||
},
|
||||
"WaitForDecryptionKey fails": {
|
||||
recoveryDoer: &stubRecoveryDoer{recoveryErr: someErr},
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
mounter: &stubMounter{},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
openTPM: vtpm.OpenNOPTPM,
|
||||
wantErr: true,
|
||||
},
|
||||
"MapDisk fails": {
|
||||
recoveryDoer: testRecoveryDoer,
|
||||
mapper: &stubMapper{
|
||||
uuid: "test",
|
||||
mapDiskErr: someErr,
|
||||
},
|
||||
mounter: &stubMounter{},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
openTPM: vtpm.OpenNOPTPM,
|
||||
wantErr: true,
|
||||
},
|
||||
"MkdirAll fails": {
|
||||
recoveryDoer: testRecoveryDoer,
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
mounter: &stubMounter{mkdirAllErr: someErr},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
openTPM: vtpm.OpenNOPTPM,
|
||||
wantErr: true,
|
||||
},
|
||||
"Mount fails": {
|
||||
recoveryDoer: testRecoveryDoer,
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
mounter: &stubMounter{mountErr: someErr},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
openTPM: vtpm.OpenNOPTPM,
|
||||
wantErr: true,
|
||||
},
|
||||
"Unmount fails": {
|
||||
recoveryDoer: testRecoveryDoer,
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
mounter: &stubMounter{unmountErr: someErr},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
openTPM: vtpm.OpenNOPTPM,
|
||||
wantErr: true,
|
||||
},
|
||||
"MarkNodeAsBootstrapped fails": {
|
||||
recoveryDoer: testRecoveryDoer,
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
mounter: &stubMounter{unmountErr: someErr},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
openTPM: failOpener,
|
||||
wantErr: true,
|
||||
},
|
||||
"Generating config fails": {
|
||||
recoveryDoer: testRecoveryDoer,
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
mounter: &stubMounter{},
|
||||
configGenerator: &stubConfigurationGenerator{generateErr: someErr},
|
||||
openTPM: failOpener,
|
||||
wantErr: true,
|
||||
},
|
||||
"no state file": {
|
||||
recoveryDoer: testRecoveryDoer,
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
mounter: &stubMounter{},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
openTPM: vtpm.OpenNOPTPM,
|
||||
missingState: true,
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
fs := afero.Afero{Fs: afero.NewMemMapFs()}
|
||||
salt := []byte("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
|
||||
if !tc.missingState {
|
||||
handler := file.NewHandler(fs)
|
||||
require.NoError(t, handler.WriteJSON(stateInfoPath, nodestate.NodeState{MeasurementSalt: salt}, file.OptMkdirAll))
|
||||
}
|
||||
|
||||
setupManager := &SetupManager{
|
||||
log: logger.NewTest(t),
|
||||
csp: "test",
|
||||
diskPath: "disk-path",
|
||||
fs: fs,
|
||||
mapper: tc.mapper,
|
||||
mounter: tc.mounter,
|
||||
config: tc.configGenerator,
|
||||
openTPM: tc.openTPM,
|
||||
}
|
||||
|
||||
err := setupManager.PrepareExistingDisk(tc.recoveryDoer)
|
||||
if tc.wantErr {
|
||||
assert.Error(err)
|
||||
} else {
|
||||
assert.NoError(err)
|
||||
assert.True(tc.mapper.mapDiskCalled)
|
||||
assert.True(tc.mounter.mountCalled)
|
||||
assert.True(tc.mounter.unmountCalled)
|
||||
assert.False(tc.mapper.formatDiskCalled)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func failOpener() (io.ReadWriteCloser, error) {
|
||||
return nil, errors.New("error")
|
||||
}
|
||||
|
||||
func TestPrepareNewDisk(t *testing.T) {
|
||||
someErr := errors.New("error")
|
||||
testCases := map[string]struct {
|
||||
fs afero.Afero
|
||||
mapper *stubMapper
|
||||
configGenerator *stubConfigurationGenerator
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
fs: afero.Afero{Fs: afero.NewMemMapFs()},
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
},
|
||||
"creating directory fails": {
|
||||
fs: afero.Afero{Fs: afero.NewReadOnlyFs(afero.NewMemMapFs())},
|
||||
mapper: &stubMapper{},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
wantErr: true,
|
||||
},
|
||||
"FormatDisk fails": {
|
||||
fs: afero.Afero{Fs: afero.NewMemMapFs()},
|
||||
mapper: &stubMapper{
|
||||
uuid: "test",
|
||||
formatDiskErr: someErr,
|
||||
},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
wantErr: true,
|
||||
},
|
||||
"MapDisk fails": {
|
||||
fs: afero.Afero{Fs: afero.NewMemMapFs()},
|
||||
mapper: &stubMapper{
|
||||
uuid: "test",
|
||||
mapDiskErr: someErr,
|
||||
},
|
||||
configGenerator: &stubConfigurationGenerator{},
|
||||
wantErr: true,
|
||||
},
|
||||
"Generating config fails": {
|
||||
fs: afero.Afero{Fs: afero.NewMemMapFs()},
|
||||
mapper: &stubMapper{uuid: "test"},
|
||||
configGenerator: &stubConfigurationGenerator{generateErr: someErr},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
setupManager := &SetupManager{
|
||||
log: logger.NewTest(t),
|
||||
csp: "test",
|
||||
diskPath: "disk-path",
|
||||
fs: tc.fs,
|
||||
mapper: tc.mapper,
|
||||
config: tc.configGenerator,
|
||||
}
|
||||
|
||||
err := setupManager.PrepareNewDisk()
|
||||
if tc.wantErr {
|
||||
assert.Error(err)
|
||||
} else {
|
||||
assert.NoError(err)
|
||||
assert.True(tc.mapper.formatDiskCalled)
|
||||
assert.True(tc.mapper.mapDiskCalled)
|
||||
|
||||
data, err := tc.fs.ReadFile(filepath.Join(keyPath, keyFile))
|
||||
require.NoError(t, err)
|
||||
assert.Len(data, crypto.RNGLengthDefault)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestReadMeasurementSalt(t *testing.T) {
|
||||
salt := []byte("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
|
||||
testCases := map[string]struct {
|
||||
salt []byte
|
||||
writeFile bool
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
salt: salt,
|
||||
writeFile: true,
|
||||
},
|
||||
"no state file": {
|
||||
wantErr: true,
|
||||
},
|
||||
"missing salt": {
|
||||
writeFile: true,
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
require := require.New(t)
|
||||
|
||||
fs := afero.Afero{Fs: afero.NewMemMapFs()}
|
||||
if tc.writeFile {
|
||||
handler := file.NewHandler(fs)
|
||||
state := nodestate.NodeState{MeasurementSalt: tc.salt}
|
||||
require.NoError(handler.WriteJSON("test-state.json", state, file.OptMkdirAll))
|
||||
}
|
||||
|
||||
setupManager := New(logger.NewTest(t), "test", "disk-path", fs, nil, nil, nil)
|
||||
|
||||
measurementSalt, err := setupManager.readMeasurementSalt("test-state.json")
|
||||
if tc.wantErr {
|
||||
assert.Error(err)
|
||||
} else {
|
||||
assert.NoError(err)
|
||||
assert.Equal(tc.salt, measurementSalt)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestRecoveryDoer(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
rejoinClientKey := []byte("rejoinClientKey")
|
||||
rejoinClientSecret := []byte("rejoinClientSecret")
|
||||
recoveryServerKey := []byte("recoveryServerKey")
|
||||
recoveryServerSecret := []byte("recoveryServerSecret")
|
||||
|
||||
recoveryServerErr := errors.New("error")
|
||||
recoveryServer := &stubRecoveryServer{
|
||||
key: recoveryServerKey,
|
||||
secret: recoveryServerSecret,
|
||||
sendKeys: make(chan struct{}, 1),
|
||||
err: recoveryServerErr,
|
||||
}
|
||||
rejoinClient := &stubRejoinClient{
|
||||
key: rejoinClientKey,
|
||||
secret: rejoinClientSecret,
|
||||
sendKeys: make(chan struct{}, 1),
|
||||
}
|
||||
recoverer := NewNodeRecoverer(recoveryServer, rejoinClient)
|
||||
|
||||
var wg sync.WaitGroup
|
||||
var key, secret []byte
|
||||
var err error
|
||||
|
||||
// error from recovery server
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
key, secret, err = recoverer.Do("", "")
|
||||
}()
|
||||
recoveryServer.sendKeys <- struct{}{}
|
||||
wg.Wait()
|
||||
assert.ErrorIs(err, recoveryServerErr)
|
||||
|
||||
recoveryServer.err = nil
|
||||
recoveryServer.sendKeys = make(chan struct{}, 1)
|
||||
|
||||
// recovery server returns its key and secret
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
key, secret, err = recoverer.Do("", "")
|
||||
}()
|
||||
recoveryServer.sendKeys <- struct{}{}
|
||||
wg.Wait()
|
||||
assert.NoError(err)
|
||||
assert.Equal(recoveryServerKey, key)
|
||||
assert.Equal(recoveryServerSecret, secret)
|
||||
|
||||
recoveryServer.sendKeys = make(chan struct{}, 1)
|
||||
|
||||
// rejoin client returns its key and secret
|
||||
wg.Add(1)
|
||||
go func() {
|
||||
defer wg.Done()
|
||||
key, secret, err = recoverer.Do("", "")
|
||||
}()
|
||||
rejoinClient.sendKeys <- struct{}{}
|
||||
wg.Wait()
|
||||
assert.NoError(err)
|
||||
assert.Equal(rejoinClientKey, key)
|
||||
assert.Equal(rejoinClientSecret, secret)
|
||||
}
|
||||
|
||||
type stubRecoveryServer struct {
|
||||
key []byte
|
||||
secret []byte
|
||||
sendKeys chan struct{}
|
||||
err error
|
||||
}
|
||||
|
||||
func (s *stubRecoveryServer) Serve(ctx context.Context, _ net.Listener, _ string) ([]byte, []byte, error) {
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return nil, nil, ctx.Err()
|
||||
case <-s.sendKeys:
|
||||
return s.key, s.secret, s.err
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
type stubRejoinClient struct {
|
||||
key []byte
|
||||
secret []byte
|
||||
sendKeys chan struct{}
|
||||
}
|
||||
|
||||
func (s *stubRejoinClient) Start(ctx context.Context, _ string) ([]byte, []byte) {
|
||||
for {
|
||||
select {
|
||||
case <-ctx.Done():
|
||||
return nil, nil
|
||||
case <-s.sendKeys:
|
||||
return s.key, s.secret
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
type stubMapper struct {
|
||||
formatDiskCalled bool
|
||||
formatDiskErr error
|
||||
mapDiskCalled bool
|
||||
mapDiskErr error
|
||||
unmapDiskCalled bool
|
||||
unmapDiskErr error
|
||||
uuid string
|
||||
}
|
||||
|
||||
func (s *stubMapper) DiskUUID() string {
|
||||
return s.uuid
|
||||
}
|
||||
|
||||
func (s *stubMapper) FormatDisk(string) error {
|
||||
s.formatDiskCalled = true
|
||||
return s.formatDiskErr
|
||||
}
|
||||
|
||||
func (s *stubMapper) MapDisk(string, string) error {
|
||||
s.mapDiskCalled = true
|
||||
return s.mapDiskErr
|
||||
}
|
||||
|
||||
func (s *stubMapper) UnmapDisk(string) error {
|
||||
s.unmapDiskCalled = true
|
||||
return s.unmapDiskErr
|
||||
}
|
||||
|
||||
type stubMounter struct {
|
||||
mountCalled bool
|
||||
mountErr error
|
||||
unmountCalled bool
|
||||
unmountErr error
|
||||
mkdirAllErr error
|
||||
}
|
||||
|
||||
func (s *stubMounter) Mount(source string, target string, fstype string, flags uintptr, data string) error {
|
||||
s.mountCalled = true
|
||||
return s.mountErr
|
||||
}
|
||||
|
||||
func (s *stubMounter) Unmount(target string, flags int) error {
|
||||
s.unmountCalled = true
|
||||
return s.unmountErr
|
||||
}
|
||||
|
||||
func (s *stubMounter) MkdirAll(path string, perm fs.FileMode) error {
|
||||
return s.mkdirAllErr
|
||||
}
|
||||
|
||||
type stubRecoveryDoer struct {
|
||||
passphrase []byte
|
||||
secret []byte
|
||||
recoveryErr error
|
||||
}
|
||||
|
||||
func (s *stubRecoveryDoer) Do(uuid, endpoint string) (passphrase, measurementSecret []byte, err error) {
|
||||
return s.passphrase, s.secret, s.recoveryErr
|
||||
}
|
||||
|
||||
type stubConfigurationGenerator struct {
|
||||
generateErr error
|
||||
}
|
||||
|
||||
func (s *stubConfigurationGenerator) Generate(volumeName, encryptedDevice, keyFile, options string) error {
|
||||
return s.generateErr
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue