jetstream_tpm_test.go

// Copyright 2024 The NATS Authors
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//go:build windows

package server

import (
"fmt"
"os"
"strings"
"testing"
"time"

"github.com/nats-io/nats.go"
)

// The tests in this file are not complete, but are a start to test the TPM
// with default settings. For a complete test we would need to use a TPM
// configured with an owner password and a SRK password. This is not
// typically the default or setup in CI/CD environments.

varjsTPMConfigPassword=`
 listen: 127.0.0.1:-1
 jetstream: {
 store_dir: %q
 tpm {
 keys_file: %q
 encryption_password: "s3cr3t!"
 }
 }`

varjsTPMConfigBadPassword=`
 listen: 127.0.0.1:-1
 jetstream: {
 store_dir: %q
 tpm {
 keys_file: %q
 encryption_password: "garbage"
 }
 }`

varjsTPMConfigPasswordPcr=`
 listen: 127.0.0.1:-1
 jetstream: {
 store_dir: %q
 tpm {
 keys_file: %q
 encryption_password: "s3cr3t!"
 pcr: %d
 }
 }`

varjsTPMConfigAllFields=`
 listen: 127.0.0.1:-1
 jetstream: {
 store_dir: %q
 tpm {
 keys_file: %q
 encryption_password: "s3cr3t!"
 pcr: %d
 srk_password: %q
 cipher: "aes"
 }
 }`

varjsTPMConfigInvalidBothOptionsSet=`
 listen: 127.0.0.1:-1
 jetstream: {
 store_dir: %q
 encryption_key: "foo"
 tpm {
 keys_file: "bar.json"
 encryption_password: "s3cr3t!"
 }
 }`

funcgetTPMFileName(t*testing.T) string {
returnt.TempDir() +"/"+t.Name() +"/jskeys.json"
}

funccheckSendMessage(t*testing.T, s*Server) {
nc, js:=jsClientConnect(t, s)
defernc.Close()

_, err:=js.AddStream(&nats.StreamConfig{
Name: "tpm_test",
Subjects: []string{"tpm_test"},
 })
require_NoError(t, err)

_, err=js.Publish("tpm_test", []byte("hello"))
require_NoError(t, err)
}

funccheckReceiveMessage(t*testing.T, s*Server) {
// reconnect and get the message
nc, js:=jsClientConnect(t, s)
defernc.Close()

// get the message
sub, err:=js.PullSubscribe("tpm_test", "cls")
iferr!=nil {
t.Fatalf("Unexpected error: %v", err)
 }
m:=fetchMsgs(t, sub, 1, 5*time.Second)
ifm==nil {
t.Fatalf("Did not receive the message")
 }
iflen(m) !=1 {
t.Fatalf("Expected 1 message, got %d", len(m))
 }
}

funcTestJetStreamTPMBasic(t*testing.T) {
fileName:=getTPMFileName(t)
cf:=createConfFile(t, []byte(fmt.Sprintf(jsTPMConfigPassword, t.TempDir(), fileName)))

s, _:=RunServerWithConfig(cf)
defers.Shutdown()

// Note, actual encryption is tested elsewhere. This just tests that the key is generated.
key:=s.opts.JetStreamKey
if!strings.HasPrefix(key, "SU") {
t.Fatalf("expected a TPM key to be generated. Key = %q", key)
 }

if_, err:=os.Stat(fileName); err!=nil {
t.Fatalf("keys file was not created")
 }

checkSendMessage(t, s)

// restart the server.
s.Shutdown()
s, _=RunServerWithConfig(cf)
ifs.Running() ==false {
t.Fatalf("Server should be running")
 }
defers.Shutdown()

// double check we're encrypted with the same key.
ifs.opts.JetStreamKey!=key {
t.Fatalf("expected same key")
 }
checkReceiveMessage(t, s)
}

// Warning: Running this test too frequently will considerably slow down
// these tests and eventually lock out the TPM.
//
// Depending on the environment this varies from 10 failures per day with
// a 24 hour lockout (Dell) to 32 failures per day with a 10
// minute healing time (decrementing one failure every 10 minutes).
funcTestJetStreamTPMKeyBadPassword(t*testing.T) {
fileName:=getTPMFileName(t)
cf:=createConfFile(t, []byte(fmt.Sprintf(jsTPMConfigPassword,
t.TempDir(), fileName)))

s, _:=RunServerWithConfig(cf)
defers.Shutdown()

checkSendMessage(t, s)
s.Shutdown()

// restart the server.
deferfunc() {
r:=recover()
ifr==nil {
t.Fatalf("Expected server panic, unexpected start.")
 }
 }()
cf2:=createConfFile(t, []byte(fmt.Sprintf(jsTPMConfigBadPassword,
t.TempDir(), fileName)))
s, _=RunServerWithConfig(cf2)
time.Sleep(3*time.Second)
ifs.Running() {
s.Shutdown()
t.Fatalf("Server should NOT be running")
 }
}

funcTestJetStreamTPMKeyWithPCR(t*testing.T) {
cf:=createConfFile(t, []byte(fmt.Sprintf(jsTPMConfigPasswordPcr,
t.TempDir(), getTPMFileName(t), 18)))

s, _:=RunServerWithConfig(cf)
defers.Shutdown()

checkSendMessage(t, s)
s.Shutdown()

// restart the server
s, _=RunServerWithConfig(cf)
if!s.Running() {
t.Fatalf("Server should be running")
 }
}

funcTestJetStreamTPMAll(t*testing.T) {
fileName:=getTPMFileName(t)

// TODO: When the CI/CD environment supports updating the TPM,
// expand this test with the SRK password.
cf:=createConfFile(t, []byte(fmt.Sprintf(jsTPMConfigAllFields,
getTPMFileName(t), fileName, 19, "")))

s, _:=RunServerWithConfig(cf)
defers.Shutdown()

checkSendMessage(t, s)
s.Shutdown()

// restart the server.
s, _=RunServerWithConfig(cf)
ifs.Running() ==false {
t.Fatalf("Server should be running")
 }
defers.Shutdown()
checkReceiveMessage(t, s)
}

funcTestJetStreamInvalidConfig(t*testing.T) {
cf:=createConfFile(t, []byte(fmt.Sprintf(jsTPMConfigInvalidBothOptionsSet,
getTPMFileName(t))))

deferfunc() {
r:=recover()
ifr==nil {
t.Fatalf("Expected server panic, unexpected start.")
 }
 }()
s, _:=RunServerWithConfig(cf)
ifs.Running() ==true {
s.Shutdown()
t.Fatalf("Server should NOT be running")
 }
}