1 //
2 //
3 // Copyright 2023 gRPC authors.
4 //
5 // Licensed under the Apache License, Version 2.0 (the "License");
6 // you may not use this file except in compliance with the License.
7 // You may obtain a copy of the License at
8 //
9 // http://www.apache.org/licenses/LICENSE-2.0
10 //
11 // Unless required by applicable law or agreed to in writing, software
12 // distributed under the License is distributed on an "AS IS" BASIS,
13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 // See the License for the specific language governing permissions and
15 // limitations under the License.
16 //
17 //
18
19 #include <memory>
20 #include <string>
21
22 #include <gtest/gtest.h>
23
24 #include "absl/status/status.h"
25 #include "absl/status/statusor.h"
26 #include "absl/strings/numbers.h"
27 #include "absl/strings/string_view.h"
28 #include "absl/time/clock.h"
29 #include "absl/time/time.h"
30
31 #include <grpc/grpc_audit_logging.h>
32 #include <grpc/support/port_platform.h>
33
34 #include "src/core/lib/json/json.h"
35 #include "src/core/lib/json/json_reader.h"
36 #include "src/core/lib/json/json_writer.h"
37 #include "src/core/lib/security/authorization/audit_logging.h"
38 #include "test/core/util/test_config.h"
39 #include "test/core/util/tls_utils.h"
40
41 namespace grpc_core {
42 namespace testing {
43
44 constexpr absl::string_view kName = "test_logger";
45
46 using experimental::AuditContext;
47 using experimental::AuditLogger;
48 using experimental::AuditLoggerFactory;
49 using experimental::AuditLoggerRegistry;
50 using experimental::RegisterAuditLoggerFactory;
51
52 namespace {
53
54 class TestAuditLogger : public AuditLogger {
55 public:
name() const56 absl::string_view name() const override { return "test_logger"; }
Log(const AuditContext &)57 void Log(const AuditContext&) override {}
58 };
59
60 class TestAuditLoggerFactory : public AuditLoggerFactory {
61 public:
62 class TestConfig : public Config {
63 public:
name() const64 absl::string_view name() const override { return kName; }
ToString() const65 std::string ToString() const override { return "test_config"; }
66 };
67
name() const68 absl::string_view name() const override { return kName; }
CreateAuditLogger(std::unique_ptr<AuditLoggerFactory::Config>)69 std::unique_ptr<AuditLogger> CreateAuditLogger(
70 std::unique_ptr<AuditLoggerFactory::Config>) override {
71 return std::make_unique<TestAuditLogger>();
72 }
ParseAuditLoggerConfig(const Json &)73 absl::StatusOr<std::unique_ptr<Config>> ParseAuditLoggerConfig(
74 const Json&) override {
75 return std::make_unique<TestConfig>();
76 }
77 };
78
79 class AuditLoggerRegistryTest : public ::testing::Test {
80 protected:
SetUp()81 void SetUp() override {
82 RegisterAuditLoggerFactory(std::make_unique<TestAuditLoggerFactory>());
83 }
TearDown()84 void TearDown() override { AuditLoggerRegistry::TestOnlyResetRegistry(); }
85 };
86
87 } // namespace
88
89 //
90 // AuditLoggerRegistryTest
91 //
92
TEST_F(AuditLoggerRegistryTest,SuccessfulLoggerCreation)93 TEST_F(AuditLoggerRegistryTest, SuccessfulLoggerCreation) {
94 auto result = AuditLoggerRegistry::ParseConfig(kName, Json());
95 ASSERT_TRUE(result.ok());
96 ASSERT_NE(AuditLoggerRegistry::CreateAuditLogger(std::move(result.value())),
97 nullptr);
98 }
99
TEST_F(AuditLoggerRegistryTest,UnknownLogger)100 TEST_F(AuditLoggerRegistryTest, UnknownLogger) {
101 auto result = AuditLoggerRegistry::ParseConfig("unknown_logger", Json());
102 EXPECT_EQ(result.status().code(), absl::StatusCode::kNotFound);
103 EXPECT_EQ(result.status().message(),
104 "audit logger factory for unknown_logger does not exist")
105 << result.status();
106 }
107
TEST_F(AuditLoggerRegistryTest,LoggerFactoryExistenceChecks)108 TEST_F(AuditLoggerRegistryTest, LoggerFactoryExistenceChecks) {
109 EXPECT_TRUE(AuditLoggerRegistry::FactoryExists(kName));
110 EXPECT_FALSE(AuditLoggerRegistry::FactoryExists("unknown_logger"));
111 }
112
113 //
114 // StdoutLoggerTest
115 //
116
TEST(StdoutLoggerTest,LoggerFactoryExistenceChecks)117 TEST(StdoutLoggerTest, LoggerFactoryExistenceChecks) {
118 EXPECT_TRUE(AuditLoggerRegistry::FactoryExists("stdout_logger"));
119 }
120
TEST(StdoutLoggerTest,StdoutLoggerCreationAndLogInvocation)121 TEST(StdoutLoggerTest, StdoutLoggerCreationAndLogInvocation) {
122 auto result =
123 AuditLoggerRegistry::ParseConfig("stdout_logger", Json::FromObject({}));
124 ASSERT_TRUE(result.ok());
125 auto logger =
126 AuditLoggerRegistry::CreateAuditLogger(std::move(result.value()));
127 AuditContext context("method", "spiffe", "policy", "rule", true);
128 ::testing::internal::CaptureStdout();
129 absl::Time time_before_log = absl::Now();
130 logger->Log(context);
131 absl::Time time_after_log = absl::Now();
132 auto log_or = JsonParse(::testing::internal::GetCapturedStdout());
133 ASSERT_TRUE(log_or.ok());
134 ASSERT_EQ(log_or->type(), Json::Type::kObject);
135 auto it = log_or->object().find("grpc_audit_log");
136 ASSERT_NE(it, log_or->object().end());
137 ASSERT_EQ(it->second.type(), Json::Type::kObject);
138 auto& object = it->second.object();
139 ASSERT_NE(object.find("timestamp"), object.end());
140 EXPECT_EQ(object.find("timestamp")->second.type(), Json::Type::kString);
141 absl::Time time_at_log;
142 ASSERT_TRUE(absl::ParseTime(absl::RFC3339_full,
143 object.find("timestamp")->second.string(),
144 &time_at_log, nullptr));
145 // Check if the recorded timestamp is in between the recorded interval.
146 EXPECT_GE(time_at_log, time_before_log);
147 EXPECT_LE(time_at_log, time_after_log);
148 // Check exact values of everything else.
149 Json::Object json_object = object;
150 json_object.erase("timestamp");
151 EXPECT_EQ(JsonDump(Json::FromObject(json_object)),
152 "{\"authorized\":true,\"matched_rule\":\"rule\",\"policy_name\":"
153 "\"policy\",\"principal\":\"spiffe\",\"rpc_method\":\"method\"}");
154 }
155
156 } // namespace testing
157 } // namespace grpc_core
158
main(int argc,char ** argv)159 int main(int argc, char** argv) {
160 grpc::testing::TestEnvironment env(&argc, argv);
161 ::testing::InitGoogleTest(&argc, argv);
162 grpc_init();
163 int ret = RUN_ALL_TESTS();
164 grpc_shutdown();
165 return ret;
166 }
167