InstanceValidator { public boolean isValidInstance(InstanceConfirmation instanceConfirmation) { SignedIdentityDocument signedIdentityDocument = EntityBindingsMapper.toSignedIdentityDocument(instanceConfirmation.signedIdentityDocument); VespaUniqueInstanceId providerUniqueId = signedIdentityDocument.providerUniqueId(); ApplicationId applicationId = ApplicationId.from( providerUniqueId.tenant(), providerUniqueId.application(), providerUniqueId.instance()); VespaUniqueInstanceId csrProviderUniqueId = getVespaUniqueInstanceId(instanceConfirmation); if(! providerUniqueId.equals(csrProviderUniqueId)) { log.log(Level.WARNING, String.format("Instance %s has invalid provider unique ID in CSR (%s)", providerUniqueId, csrProviderUniqueId)); return false; } if (! isSameIdentityAsInServicesXml(applicationId, instanceConfirmation.domain, instanceConfirmation.service)) { return false; } log.log(Level.FINE, () -> String.format("Validating instance %s.", providerUniqueId)); PublicKey publicKey = keyProvider.getPublicKey(signedIdentityDocument.signingKeyVersion()); if (signer.hasValidSignature(signedIdentityDocument, publicKey)) { log.log(Level.FINE, () -> String.format("Instance %s is valid.", providerUniqueId)); return true; } log.log(Level.SEVERE, () -> String.format("Instance %s has invalid signature.", providerUniqueId)); return false; } @Inject  InstanceValidator(KeyProvider keyProvider,
                             SuperModelProvider superModelProvider,
                             NodeRepository nodeRepository,
                             AthenzProviderServiceConfig config);  InstanceValidator(KeyProvider keyProvider,
                             SuperModelProvider superModelProvider,
                             NodeRepository nodeRepository,
                             IdentityDocumentSigner identityDocumentSigner,
                             AthenzService tenantIdentity); boolean isValidInstance(InstanceConfirmation instanceConfirmation); boolean isValidRefresh(InstanceConfirmation confirmation); static final String SAN_IPS_ATTRNAME; static final String SAN_DNS_ATTRNAME; }
@Test public void application_does_not_exist() { SuperModelProvider superModelProvider = mockSuperModelProvider(); InstanceValidator instanceValidator = new InstanceValidator(null, superModelProvider, null, null, vespaTenantDomain); assertFalse(instanceValidator.isValidInstance(createRegisterInstanceConfirmation(applicationId, domain, service))); }
@Test public void application_does_not_have_domain_set() { SuperModelProvider superModelProvider = mockSuperModelProvider( mockApplicationInfo(applicationId, 5, Collections.emptyList())); InstanceValidator instanceValidator = new InstanceValidator(null, superModelProvider, null, new IdentityDocumentSigner(), vespaTenantDomain); assertFalse(instanceValidator.isValidInstance(createRegisterInstanceConfirmation(applicationId, domain, service))); }
@Test public void application_has_wrong_domain() { ServiceInfo serviceInfo = new ServiceInfo("serviceName", "type", Collections.emptyList(), Collections.singletonMap(SERVICE_PROPERTIES_DOMAIN_KEY, "not-domain"), "confId", "hostName"); SuperModelProvider superModelProvider = mockSuperModelProvider( mockApplicationInfo(applicationId, 5, Collections.singletonList(serviceInfo))); InstanceValidator instanceValidator = new InstanceValidator(null, superModelProvider, null, null, vespaTenantDomain); assertFalse(instanceValidator.isValidInstance(createRegisterInstanceConfirmation(applicationId, domain, service))); }
@Test public void application_has_same_domain_and_service() { Map<String, String> properties = new HashMap<>(); properties.put(SERVICE_PROPERTIES_DOMAIN_KEY, domain); properties.put(SERVICE_PROPERTIES_SERVICE_KEY, service); ServiceInfo serviceInfo = new ServiceInfo("serviceName", "type", Collections.emptyList(), properties, "confId", "hostName"); SuperModelProvider superModelProvider = mockSuperModelProvider( mockApplicationInfo(applicationId, 5, Collections.singletonList(serviceInfo))); IdentityDocumentSigner signer = mock(IdentityDocumentSigner.class); when(signer.hasValidSignature(any(), any())).thenReturn(true); InstanceValidator instanceValidator = new InstanceValidator(mock(KeyProvider.class), superModelProvider, null, signer, vespaTenantDomain); assertTrue(instanceValidator.isValidInstance(createRegisterInstanceConfirmation(applicationId, domain, service))); }
@Test public void rejects_invalid_provider_unique_id_in_csr() { SuperModelProvider superModelProvider = mockSuperModelProvider(); InstanceValidator instanceValidator = new InstanceValidator(null, superModelProvider, null, null, vespaTenantDomain); InstanceConfirmation instanceConfirmation = createRegisterInstanceConfirmation(applicationId, domain, service); VespaUniqueInstanceId tamperedId = new VespaUniqueInstanceId(0, "default", "instance", "app", "tenant", "us-north-1", "dev", IdentityType.NODE); instanceConfirmation.set("sanDNS", tamperedId.asDottedString() + ".instanceid.athenz.dev-us-north-1.vespa.yahoo.cloud"); assertFalse(instanceValidator.isValidInstance(instanceConfirmation)); }