mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-20 16:07:11 +08:00
517 lines
15 KiB
JavaScript
517 lines
15 KiB
JavaScript
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const os = require('node:os');
|
|
const path = require('node:path');
|
|
const { test } = require('node:test');
|
|
|
|
const {
|
|
PluginPackageManagementLiveEvidenceCollectionError,
|
|
buildLiveEvidenceReport,
|
|
collectDatabaseSnapshot,
|
|
collectKubernetesSnapshot,
|
|
collectOidcSnapshot,
|
|
parseArguments,
|
|
policyIsBounded,
|
|
validateExercise,
|
|
} = require('../../scripts/ql3-plugin-package-management-live-evidence-collect.cjs');
|
|
const {
|
|
validatePluginPackageManagementLiveEvidence,
|
|
} = require('../../scripts/ql3-plugin-package-management-live-evidence-audit.cjs');
|
|
|
|
function sha(character) {
|
|
return `sha256:${character.repeat(64)}`;
|
|
}
|
|
|
|
function conditionReady() {
|
|
return [{ type: 'Ready', status: 'True' }];
|
|
}
|
|
|
|
function node(name, uid, role) {
|
|
return {
|
|
metadata: {
|
|
name,
|
|
uid,
|
|
labels: {
|
|
'kubernetes.io/arch': 'arm64',
|
|
...(role === 'control-plane'
|
|
? { 'node-role.kubernetes.io/control-plane': '' }
|
|
: {}),
|
|
},
|
|
},
|
|
spec: {},
|
|
status: { conditions: conditionReady() },
|
|
};
|
|
}
|
|
|
|
function pod(name, uid, nodeName, imageId, containerName = 'management') {
|
|
return {
|
|
metadata: { name, uid },
|
|
spec: {
|
|
nodeName,
|
|
serviceAccountName: 'ql3-plugin-package-management',
|
|
automountServiceAccountToken: false,
|
|
},
|
|
status: {
|
|
conditions: conditionReady(),
|
|
containerStatuses: [
|
|
{
|
|
name: containerName,
|
|
ready: true,
|
|
imageID: `containerd://${imageId}`,
|
|
},
|
|
],
|
|
},
|
|
};
|
|
}
|
|
|
|
function validExercise() {
|
|
return {
|
|
schemaVersion: 1,
|
|
fixture: 'qinglong/plugin-package-management-live-exercise@v1',
|
|
observedAt: '2026-07-25T12:00:00.000Z',
|
|
identity: {
|
|
issuer: 'https://login.example.com/',
|
|
audience: 'qinglong3-package-management',
|
|
requesterSubject: 'tenant-a/requester-42',
|
|
reviewerSubject: 'tenant-a/reviewer-17',
|
|
requesterAssurance: 'multi_factor',
|
|
reviewerAssurance: 'hardware',
|
|
keysetGenerations: [7, 8, 9],
|
|
},
|
|
ceremony: {
|
|
proposalAuditEventId: '123e4567-e89b-42d3-a456-426614174000',
|
|
approvalAuditEventId: '123e4567-e89b-42d3-a456-426614174001',
|
|
decisionAuditEventId: '123e4567-e89b-42d3-a456-426614174002',
|
|
proposeStatus: 200,
|
|
proposeOperation: 'plugin-package.propose',
|
|
selfDecisionStatus: 403,
|
|
selfDecisionError: 'forbidden',
|
|
reviewerDecisionStatus: 200,
|
|
reviewerDecisionOperation: 'plugin-package.decide',
|
|
inspectionStatus: 200,
|
|
inspectionOperation: 'plugin-package.inspect',
|
|
},
|
|
isolation: {
|
|
labelledClientOutcome: 'tls13_connected',
|
|
unlabelledClientOutcome: 'timeout',
|
|
wrongPortOutcome: 'timeout',
|
|
kubernetesApiEgressOutcome: 'timeout',
|
|
publicInternetEgressOutcome: 'timeout',
|
|
postgresEgressOutcome: 'postgres_ready',
|
|
},
|
|
rotation: {
|
|
overlapOldStatus: 200,
|
|
newStatus: 200,
|
|
revokedOldStatus: 401,
|
|
revokedOldError: 'authentication_required',
|
|
previousTlsSerial: '01:A2:03',
|
|
currentTlsSerial: '09:B8:07',
|
|
previousTlsSecretResourceVersion: '48192',
|
|
currentTlsSecretResourceVersion: '49201',
|
|
readinessSamples: ['before', 'overlap', 'revoked'].map((phase) => ({
|
|
phase,
|
|
replicas: 2,
|
|
readyReplicas: 2,
|
|
unavailableReplicas: 0,
|
|
tlsProtocol: 'TLSv1.3',
|
|
})),
|
|
},
|
|
};
|
|
}
|
|
|
|
function migrationIds() {
|
|
return Array.from({ length: 25 }, (_, index) =>
|
|
index === 24
|
|
? 'pg-0025-plugin-package-materialized-revisions'
|
|
: `pg-${String(index + 1).padStart(4, '0')}-migration`,
|
|
);
|
|
}
|
|
|
|
function databaseSnapshot() {
|
|
return {
|
|
currentRole: 'ql3_package_manager',
|
|
serverVersionNumber: 180004,
|
|
migrationIds: migrationIds(),
|
|
controlCoreCapability: 24,
|
|
tableCount: 38,
|
|
auditRows: 3,
|
|
ledger: {
|
|
generation: 9,
|
|
issuer: 'https://login.example.com/',
|
|
audience: 'qinglong3-package-management',
|
|
revokedKeyCount: 2,
|
|
},
|
|
};
|
|
}
|
|
|
|
function kubernetesSnapshot() {
|
|
return {
|
|
kubernetesVersion: 'v1.34.2',
|
|
architecture: 'arm64',
|
|
managementImageId: sha('1'),
|
|
postgresImageId: sha('2'),
|
|
cniName: 'cilium',
|
|
cniVersion: '1.17.1',
|
|
controlPlaneNodes: 3,
|
|
workerNodes: 2,
|
|
replicas: 2,
|
|
readyReplicas: 2,
|
|
podIdentitySha256: [sha('3'), sha('4')],
|
|
nodeIdentitySha256: [sha('5'), sha('6')],
|
|
serviceAccount: 'ql3-plugin-package-management',
|
|
automountServiceAccountToken: false,
|
|
boundedNetworkPolicy: true,
|
|
managerSecretReadDenied: true,
|
|
managerExecutorMutationDenied: true,
|
|
};
|
|
}
|
|
|
|
function kubectlFixture() {
|
|
const nodes = [
|
|
node('cp-a', 'node-cp-a', 'control-plane'),
|
|
node('cp-b', 'node-cp-b', 'control-plane'),
|
|
node('cp-c', 'node-cp-c', 'control-plane'),
|
|
node('worker-a', 'node-worker-a', 'worker'),
|
|
node('worker-b', 'node-worker-b', 'worker'),
|
|
];
|
|
const managementImage = sha('1');
|
|
const postgresImage = sha('2');
|
|
const values = new Map([
|
|
[
|
|
'version -o json',
|
|
{ clientVersion: {}, serverVersion: { gitVersion: 'v1.34.2' } },
|
|
],
|
|
['get nodes -o json', { items: nodes }],
|
|
[
|
|
'-n qinglong3-system get deployment ql3-plugin-package-management -o json',
|
|
{
|
|
spec: { replicas: 2 },
|
|
status: { readyReplicas: 2, unavailableReplicas: 0 },
|
|
},
|
|
],
|
|
[
|
|
'-n qinglong3-system get service ql3-plugin-package-management -o json',
|
|
{
|
|
spec: { ports: [{ port: 8443, protocol: 'TCP' }] },
|
|
},
|
|
],
|
|
[
|
|
'-n qinglong3-system get serviceaccount ql3-plugin-package-management -o json',
|
|
{
|
|
metadata: { name: 'ql3-plugin-package-management' },
|
|
automountServiceAccountToken: false,
|
|
},
|
|
],
|
|
[
|
|
'-n qinglong3-system get networkpolicy ql3-plugin-package-management -o json',
|
|
{
|
|
spec: {
|
|
podSelector: {
|
|
matchLabels: {
|
|
'app.kubernetes.io/name': 'ql3-plugin-package-management',
|
|
'app.kubernetes.io/component': 'plugin-package-management',
|
|
},
|
|
},
|
|
policyTypes: ['Ingress', 'Egress'],
|
|
ingress: [
|
|
{
|
|
from: [
|
|
{
|
|
podSelector: {
|
|
matchLabels: {
|
|
'qinglong.io/plugin-package-management-client': 'true',
|
|
},
|
|
},
|
|
},
|
|
],
|
|
ports: [{ port: 8443, protocol: 'TCP' }],
|
|
},
|
|
],
|
|
egress: [
|
|
{
|
|
to: [
|
|
{
|
|
namespaceSelector: {
|
|
matchLabels: {
|
|
'kubernetes.io/metadata.name': 'kube-system',
|
|
},
|
|
},
|
|
podSelector: { matchLabels: { 'k8s-app': 'kube-dns' } },
|
|
},
|
|
],
|
|
ports: [
|
|
{ port: 53, protocol: 'UDP' },
|
|
{ port: 53, protocol: 'TCP' },
|
|
],
|
|
},
|
|
{
|
|
to: [
|
|
{
|
|
podSelector: {
|
|
matchLabels: { 'cnpg.io/cluster': 'ql3-postgres' },
|
|
},
|
|
},
|
|
],
|
|
ports: [{ port: 5432, protocol: 'TCP' }],
|
|
},
|
|
],
|
|
},
|
|
},
|
|
],
|
|
[
|
|
'-n qinglong3-system get pods -l app.kubernetes.io/name=ql3-plugin-package-management,app.kubernetes.io/component=plugin-package-management -o json',
|
|
{
|
|
items: [
|
|
pod('management-a', 'pod-a', 'worker-a', managementImage),
|
|
pod('management-b', 'pod-b', 'worker-b', managementImage),
|
|
],
|
|
},
|
|
],
|
|
[
|
|
'-n kube-system get daemonset cilium -o json',
|
|
{
|
|
spec: {
|
|
template: {
|
|
spec: {
|
|
containers: [
|
|
{
|
|
name: 'cilium-agent',
|
|
image: 'quay.io/cilium/cilium:v1.17.1',
|
|
},
|
|
],
|
|
},
|
|
},
|
|
},
|
|
status: { desiredNumberScheduled: 5, numberReady: 5 },
|
|
},
|
|
],
|
|
[
|
|
'-n qinglong3-system get pods -l cnpg.io/cluster=ql3-postgres -o json',
|
|
{
|
|
items: [
|
|
pod('postgres-a', 'pg-a', 'worker-a', postgresImage, 'postgres'),
|
|
pod('postgres-b', 'pg-b', 'worker-b', postgresImage, 'postgres'),
|
|
pod('postgres-c', 'pg-c', 'worker-a', postgresImage, 'postgres'),
|
|
],
|
|
},
|
|
],
|
|
]);
|
|
return (args) => {
|
|
const command = args.join(' ');
|
|
if (command.startsWith('auth can-i ')) {
|
|
return { status: 0, stdout: 'no\n', stderr: '' };
|
|
}
|
|
const value = values.get(command);
|
|
assert.ok(value, `unexpected kubectl command: ${command}`);
|
|
return { status: 0, stdout: JSON.stringify(value), stderr: '' };
|
|
};
|
|
}
|
|
|
|
test('collects immutable Kubernetes topology, images, CNI and denied authority', () => {
|
|
const result = collectKubernetesSnapshot(
|
|
{
|
|
cniDaemonSet: { namespace: 'kube-system', name: 'cilium' },
|
|
cniContainer: 'cilium-agent',
|
|
cniName: 'cilium',
|
|
},
|
|
kubectlFixture(),
|
|
);
|
|
assert.equal(result.kubernetesVersion, 'v1.34.2');
|
|
assert.equal(result.controlPlaneNodes, 3);
|
|
assert.equal(result.workerNodes, 2);
|
|
assert.equal(result.managementImageId, sha('1'));
|
|
assert.equal(result.postgresImageId, sha('2'));
|
|
assert.equal(result.cniVersion, '1.17.1');
|
|
assert.equal(result.managerSecretReadDenied, true);
|
|
assert.equal(result.managerExecutorMutationDenied, true);
|
|
assert.equal(new Set(result.podIdentitySha256).size, 2);
|
|
assert.equal(new Set(result.nodeIdentitySha256).size, 2);
|
|
});
|
|
|
|
test('rejects empty selectors and any live NetworkPolicy widening', () => {
|
|
assert.equal(
|
|
policyIsBounded({
|
|
spec: {
|
|
podSelector: {
|
|
matchLabels: {
|
|
'app.kubernetes.io/name': 'ql3-plugin-package-management',
|
|
'app.kubernetes.io/component': 'plugin-package-management',
|
|
},
|
|
},
|
|
policyTypes: ['Ingress', 'Egress'],
|
|
ingress: [
|
|
{
|
|
from: [{ podSelector: {} }],
|
|
ports: [{ port: 8443, protocol: 'TCP' }],
|
|
},
|
|
],
|
|
egress: [
|
|
{
|
|
to: [{}],
|
|
ports: [{ port: 443, protocol: 'TCP' }],
|
|
},
|
|
],
|
|
},
|
|
}),
|
|
false,
|
|
);
|
|
});
|
|
|
|
test('queries PostgreSQL through the manager role and binds audit plus ledger', () => {
|
|
const exercise = validateExercise(
|
|
validExercise(),
|
|
Date.parse('2026-07-25T12:01:00.000Z'),
|
|
);
|
|
let invocation;
|
|
const result = collectDatabaseSnapshot(
|
|
exercise,
|
|
{ pgService: 'ql3_evidence' },
|
|
(args) => {
|
|
invocation = args;
|
|
return {
|
|
status: 0,
|
|
stdout: JSON.stringify(databaseSnapshot()),
|
|
stderr: '',
|
|
};
|
|
},
|
|
);
|
|
assert.equal(result.currentRole, 'ql3_package_manager');
|
|
assert.equal(result.auditRows, 3);
|
|
assert.ok(invocation.includes('--dbname=service=ql3_evidence'));
|
|
const sql = invocation.find((value) => value.startsWith('--command='));
|
|
assert.match(sql, /plugin_package_identity_keyset_ledger/);
|
|
assert.doesNotMatch(sql, /password|postgres(?:ql)?:\/\//i);
|
|
});
|
|
|
|
test('fetches and hashes the exercised external OIDC discovery and JWKS', async () => {
|
|
const calls = [];
|
|
const documents = new Map([
|
|
[
|
|
'https://login.example.com/.well-known/openid-configuration',
|
|
JSON.stringify({
|
|
issuer: 'https://login.example.com/',
|
|
jwks_uri: 'https://login.example.com/keys',
|
|
}),
|
|
],
|
|
[
|
|
'https://login.example.com/keys',
|
|
JSON.stringify({ keys: [{ kid: 'production-key-1', kty: 'OKP' }] }),
|
|
],
|
|
]);
|
|
const result = await collectOidcSnapshot(
|
|
validExercise().identity,
|
|
async (url, options) => {
|
|
calls.push({ url, options });
|
|
const body = Buffer.from(documents.get(url));
|
|
return {
|
|
status: 200,
|
|
async arrayBuffer() {
|
|
return body;
|
|
},
|
|
};
|
|
},
|
|
);
|
|
assert.equal(calls.length, 2);
|
|
assert.ok(result.discoveryDocumentSha256.startsWith('sha256:'));
|
|
assert.ok(result.jwksSha256.startsWith('sha256:'));
|
|
assert.notEqual(result.discoveryDocumentSha256, result.jwksSha256);
|
|
});
|
|
|
|
test('rejects OIDC SSRF targets and oversized streamed metadata before accepting evidence', async () => {
|
|
let calls = 0;
|
|
await assert.rejects(
|
|
collectOidcSnapshot(
|
|
{
|
|
...validExercise().identity,
|
|
issuer: 'https://127.0.0.1/',
|
|
},
|
|
async () => {
|
|
calls += 1;
|
|
},
|
|
),
|
|
PluginPackageManagementLiveEvidenceCollectionError,
|
|
);
|
|
assert.equal(calls, 0);
|
|
|
|
await assert.rejects(
|
|
collectOidcSnapshot(validExercise().identity, async () => ({
|
|
status: 200,
|
|
headers: { get: () => null },
|
|
body: {
|
|
async *[Symbol.asyncIterator]() {
|
|
yield Buffer.alloc(1024 * 1024);
|
|
yield Buffer.from('x');
|
|
},
|
|
},
|
|
})),
|
|
/exceeds 1 MiB/,
|
|
);
|
|
});
|
|
|
|
test('derives a compatible report without leaking raw subjects, event IDs or TLS identities', () => {
|
|
const exercise = validateExercise(
|
|
validExercise(),
|
|
Date.parse('2026-07-25T12:01:00.000Z'),
|
|
);
|
|
const report = buildLiveEvidenceReport({
|
|
kubernetes: kubernetesSnapshot(),
|
|
database: databaseSnapshot(),
|
|
oidc: {
|
|
discoveryDocumentSha256: sha('7'),
|
|
jwksSha256: sha('8'),
|
|
},
|
|
exercise,
|
|
observedAt: '2026-07-25T12:02:00.000Z',
|
|
});
|
|
assert.equal(
|
|
validatePluginPackageManagementLiveEvidence(report).compatible,
|
|
true,
|
|
);
|
|
const serialized = JSON.stringify(report);
|
|
assert.doesNotMatch(serialized, /tenant-a\/requester-42/);
|
|
assert.doesNotMatch(serialized, /123e4567-e89b-42d3-a456-426614174000/);
|
|
assert.doesNotMatch(serialized, /01:A2:03/);
|
|
assert.doesNotMatch(serialized, /48192/);
|
|
});
|
|
|
|
test('rejects claimed gates and non-private collection inputs', () => {
|
|
const claimed = validExercise();
|
|
claimed.gates = { passed: true };
|
|
assert.throws(
|
|
() => validateExercise(claimed, Date.parse('2026-07-25T12:01:00.000Z')),
|
|
PluginPackageManagementLiveEvidenceCollectionError,
|
|
);
|
|
|
|
const directory = fs.mkdtempSync(
|
|
path.join(os.tmpdir(), 'ql3-live-evidence-collector-'),
|
|
);
|
|
try {
|
|
const files = ['kubeconfig', 'exercise.json', 'pg-service.conf'];
|
|
for (const name of files) {
|
|
fs.writeFileSync(
|
|
path.join(directory, name),
|
|
name === 'exercise.json' ? '{}' : 'private',
|
|
{ mode: 0o600 },
|
|
);
|
|
}
|
|
fs.chmodSync(path.join(directory, 'exercise.json'), 0o640);
|
|
assert.throws(
|
|
() =>
|
|
parseArguments([
|
|
`--kubeconfig=${path.join(directory, 'kubeconfig')}`,
|
|
'--context=production',
|
|
'--cni-daemonset=kube-system/cilium',
|
|
'--cni-container=cilium-agent',
|
|
'--cni-name=cilium',
|
|
`--exercise=${path.join(directory, 'exercise.json')}`,
|
|
`--pg-service-file=${path.join(directory, 'pg-service.conf')}`,
|
|
'--pg-service=ql3_evidence',
|
|
`--output=${path.join(directory, 'report.json')}`,
|
|
]),
|
|
PluginPackageManagementLiveEvidenceCollectionError,
|
|
);
|
|
} finally {
|
|
fs.rmSync(directory, { recursive: true, force: true });
|
|
}
|
|
});
|