connection_manager_test.go 9.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289
  1. package nebula
  2. import (
  3. "context"
  4. "crypto/ed25519"
  5. "crypto/rand"
  6. "net"
  7. "testing"
  8. "time"
  9. "github.com/flynn/noise"
  10. "github.com/slackhq/nebula/cert"
  11. "github.com/slackhq/nebula/config"
  12. "github.com/slackhq/nebula/iputil"
  13. "github.com/slackhq/nebula/test"
  14. "github.com/slackhq/nebula/udp"
  15. "github.com/stretchr/testify/assert"
  16. )
  17. var vpnIp iputil.VpnIp
  18. func newTestLighthouse() *LightHouse {
  19. lh := &LightHouse{
  20. l: test.NewLogger(),
  21. addrMap: map[iputil.VpnIp]*RemoteList{},
  22. }
  23. lighthouses := map[iputil.VpnIp]struct{}{}
  24. staticList := map[iputil.VpnIp]struct{}{}
  25. lh.lighthouses.Store(&lighthouses)
  26. lh.staticList.Store(&staticList)
  27. return lh
  28. }
  29. func Test_NewConnectionManagerTest(t *testing.T) {
  30. l := test.NewLogger()
  31. //_, tuncidr, _ := net.ParseCIDR("1.1.1.1/24")
  32. _, vpncidr, _ := net.ParseCIDR("172.1.1.1/24")
  33. _, localrange, _ := net.ParseCIDR("10.1.1.1/24")
  34. vpnIp = iputil.Ip2VpnIp(net.ParseIP("172.1.1.2"))
  35. preferredRanges := []*net.IPNet{localrange}
  36. // Very incomplete mock objects
  37. hostMap := NewHostMap(l, "test", vpncidr, preferredRanges)
  38. cs := &CertState{
  39. rawCertificate: []byte{},
  40. privateKey: []byte{},
  41. certificate: &cert.NebulaCertificate{},
  42. rawCertificateNoKey: []byte{},
  43. }
  44. lh := newTestLighthouse()
  45. ifce := &Interface{
  46. hostMap: hostMap,
  47. inside: &test.NoopTun{},
  48. outside: &udp.Conn{},
  49. firewall: &Firewall{},
  50. lightHouse: lh,
  51. handshakeManager: NewHandshakeManager(l, vpncidr, preferredRanges, hostMap, lh, &udp.Conn{}, defaultHandshakeConfig),
  52. l: l,
  53. }
  54. ifce.certState.Store(cs)
  55. // Create manager
  56. ctx, cancel := context.WithCancel(context.Background())
  57. defer cancel()
  58. punchy := NewPunchyFromConfig(l, config.NewC(l))
  59. nc := newConnectionManager(ctx, l, ifce, 5, 10, punchy)
  60. p := []byte("")
  61. nb := make([]byte, 12, 12)
  62. out := make([]byte, mtu)
  63. // Add an ip we have established a connection w/ to hostmap
  64. hostinfo := &HostInfo{
  65. vpnIp: vpnIp,
  66. localIndexId: 1099,
  67. remoteIndexId: 9901,
  68. }
  69. hostinfo.ConnectionState = &ConnectionState{
  70. certState: cs,
  71. H: &noise.HandshakeState{},
  72. }
  73. nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
  74. // We saw traffic out to vpnIp
  75. nc.Out(hostinfo.localIndexId)
  76. nc.In(hostinfo.localIndexId)
  77. assert.NotContains(t, nc.pendingDeletion, hostinfo.localIndexId)
  78. assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnIp)
  79. assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
  80. assert.Contains(t, nc.out, hostinfo.localIndexId)
  81. // Do a traffic check tick, should not be pending deletion but should not have any in/out packets recorded
  82. nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
  83. assert.NotContains(t, nc.pendingDeletion, hostinfo.localIndexId)
  84. assert.NotContains(t, nc.out, hostinfo.localIndexId)
  85. assert.NotContains(t, nc.in, hostinfo.localIndexId)
  86. // Do another traffic check tick, this host should be pending deletion now
  87. nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
  88. assert.Contains(t, nc.pendingDeletion, hostinfo.localIndexId)
  89. assert.NotContains(t, nc.out, hostinfo.localIndexId)
  90. assert.NotContains(t, nc.in, hostinfo.localIndexId)
  91. assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
  92. assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnIp)
  93. // Do a final traffic check tick, the host should now be removed
  94. nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
  95. assert.NotContains(t, nc.pendingDeletion, hostinfo.localIndexId)
  96. assert.NotContains(t, nc.hostMap.Hosts, hostinfo.vpnIp)
  97. assert.NotContains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
  98. }
  99. func Test_NewConnectionManagerTest2(t *testing.T) {
  100. l := test.NewLogger()
  101. //_, tuncidr, _ := net.ParseCIDR("1.1.1.1/24")
  102. _, vpncidr, _ := net.ParseCIDR("172.1.1.1/24")
  103. _, localrange, _ := net.ParseCIDR("10.1.1.1/24")
  104. preferredRanges := []*net.IPNet{localrange}
  105. // Very incomplete mock objects
  106. hostMap := NewHostMap(l, "test", vpncidr, preferredRanges)
  107. cs := &CertState{
  108. rawCertificate: []byte{},
  109. privateKey: []byte{},
  110. certificate: &cert.NebulaCertificate{},
  111. rawCertificateNoKey: []byte{},
  112. }
  113. lh := newTestLighthouse()
  114. ifce := &Interface{
  115. hostMap: hostMap,
  116. inside: &test.NoopTun{},
  117. outside: &udp.Conn{},
  118. firewall: &Firewall{},
  119. lightHouse: lh,
  120. handshakeManager: NewHandshakeManager(l, vpncidr, preferredRanges, hostMap, lh, &udp.Conn{}, defaultHandshakeConfig),
  121. l: l,
  122. }
  123. ifce.certState.Store(cs)
  124. // Create manager
  125. ctx, cancel := context.WithCancel(context.Background())
  126. defer cancel()
  127. punchy := NewPunchyFromConfig(l, config.NewC(l))
  128. nc := newConnectionManager(ctx, l, ifce, 5, 10, punchy)
  129. p := []byte("")
  130. nb := make([]byte, 12, 12)
  131. out := make([]byte, mtu)
  132. // Add an ip we have established a connection w/ to hostmap
  133. hostinfo := &HostInfo{
  134. vpnIp: vpnIp,
  135. localIndexId: 1099,
  136. remoteIndexId: 9901,
  137. }
  138. hostinfo.ConnectionState = &ConnectionState{
  139. certState: cs,
  140. H: &noise.HandshakeState{},
  141. }
  142. nc.hostMap.unlockedAddHostInfo(hostinfo, ifce)
  143. // We saw traffic out to vpnIp
  144. nc.Out(hostinfo.localIndexId)
  145. nc.In(hostinfo.localIndexId)
  146. assert.NotContains(t, nc.pendingDeletion, hostinfo.vpnIp)
  147. assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnIp)
  148. assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
  149. // Do a traffic check tick, should not be pending deletion but should not have any in/out packets recorded
  150. nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
  151. assert.NotContains(t, nc.pendingDeletion, hostinfo.localIndexId)
  152. assert.NotContains(t, nc.out, hostinfo.localIndexId)
  153. assert.NotContains(t, nc.in, hostinfo.localIndexId)
  154. // Do another traffic check tick, this host should be pending deletion now
  155. nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
  156. assert.Contains(t, nc.pendingDeletion, hostinfo.localIndexId)
  157. assert.NotContains(t, nc.out, hostinfo.localIndexId)
  158. assert.NotContains(t, nc.in, hostinfo.localIndexId)
  159. assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
  160. assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnIp)
  161. // We saw traffic, should no longer be pending deletion
  162. nc.In(hostinfo.localIndexId)
  163. nc.doTrafficCheck(hostinfo.localIndexId, p, nb, out, time.Now())
  164. assert.NotContains(t, nc.pendingDeletion, hostinfo.localIndexId)
  165. assert.NotContains(t, nc.out, hostinfo.localIndexId)
  166. assert.NotContains(t, nc.in, hostinfo.localIndexId)
  167. assert.Contains(t, nc.hostMap.Indexes, hostinfo.localIndexId)
  168. assert.Contains(t, nc.hostMap.Hosts, hostinfo.vpnIp)
  169. }
  170. // Check if we can disconnect the peer.
  171. // Validate if the peer's certificate is invalid (expired, etc.)
  172. // Disconnect only if disconnectInvalid: true is set.
  173. func Test_NewConnectionManagerTest_DisconnectInvalid(t *testing.T) {
  174. now := time.Now()
  175. l := test.NewLogger()
  176. ipNet := net.IPNet{
  177. IP: net.IPv4(172, 1, 1, 2),
  178. Mask: net.IPMask{255, 255, 255, 0},
  179. }
  180. _, vpncidr, _ := net.ParseCIDR("172.1.1.1/24")
  181. _, localrange, _ := net.ParseCIDR("10.1.1.1/24")
  182. preferredRanges := []*net.IPNet{localrange}
  183. hostMap := NewHostMap(l, "test", vpncidr, preferredRanges)
  184. // Generate keys for CA and peer's cert.
  185. pubCA, privCA, _ := ed25519.GenerateKey(rand.Reader)
  186. caCert := cert.NebulaCertificate{
  187. Details: cert.NebulaCertificateDetails{
  188. Name: "ca",
  189. NotBefore: now,
  190. NotAfter: now.Add(1 * time.Hour),
  191. IsCA: true,
  192. PublicKey: pubCA,
  193. },
  194. }
  195. caCert.Sign(privCA)
  196. ncp := &cert.NebulaCAPool{
  197. CAs: cert.NewCAPool().CAs,
  198. }
  199. ncp.CAs["ca"] = &caCert
  200. pubCrt, _, _ := ed25519.GenerateKey(rand.Reader)
  201. peerCert := cert.NebulaCertificate{
  202. Details: cert.NebulaCertificateDetails{
  203. Name: "host",
  204. Ips: []*net.IPNet{&ipNet},
  205. Subnets: []*net.IPNet{},
  206. NotBefore: now,
  207. NotAfter: now.Add(60 * time.Second),
  208. PublicKey: pubCrt,
  209. IsCA: false,
  210. Issuer: "ca",
  211. },
  212. }
  213. peerCert.Sign(privCA)
  214. cs := &CertState{
  215. rawCertificate: []byte{},
  216. privateKey: []byte{},
  217. certificate: &cert.NebulaCertificate{},
  218. rawCertificateNoKey: []byte{},
  219. }
  220. lh := newTestLighthouse()
  221. ifce := &Interface{
  222. hostMap: hostMap,
  223. inside: &test.NoopTun{},
  224. outside: &udp.Conn{},
  225. firewall: &Firewall{},
  226. lightHouse: lh,
  227. handshakeManager: NewHandshakeManager(l, vpncidr, preferredRanges, hostMap, lh, &udp.Conn{}, defaultHandshakeConfig),
  228. l: l,
  229. disconnectInvalid: true,
  230. caPool: ncp,
  231. }
  232. ifce.certState.Store(cs)
  233. // Create manager
  234. ctx, cancel := context.WithCancel(context.Background())
  235. defer cancel()
  236. punchy := NewPunchyFromConfig(l, config.NewC(l))
  237. nc := newConnectionManager(ctx, l, ifce, 5, 10, punchy)
  238. ifce.connectionManager = nc
  239. hostinfo, _ := nc.hostMap.AddVpnIp(vpnIp, nil)
  240. hostinfo.ConnectionState = &ConnectionState{
  241. certState: cs,
  242. peerCert: &peerCert,
  243. H: &noise.HandshakeState{},
  244. }
  245. // Move ahead 45s.
  246. // Check if to disconnect with invalid certificate.
  247. // Should be alive.
  248. nextTick := now.Add(45 * time.Second)
  249. destroyed := nc.handleInvalidCertificate(nextTick, hostinfo)
  250. assert.False(t, destroyed)
  251. // Move ahead 61s.
  252. // Check if to disconnect with invalid certificate.
  253. // Should be disconnected.
  254. nextTick = now.Add(61 * time.Second)
  255. destroyed = nc.handleInvalidCertificate(nextTick, hostinfo)
  256. assert.True(t, destroyed)
  257. }