1 //
2 //
3 // Copyright 2023 gRPC authors.
4 //
5 // Licensed under the Apache License, Version 2.0 (the "License");
6 // you may not use this file except in compliance with the License.
7 // You may obtain a copy of the License at
8 //
9 // http://www.apache.org/licenses/LICENSE-2.0
10 //
11 // Unless required by applicable law or agreed to in writing, software
12 // distributed under the License is distributed on an "AS IS" BASIS,
13 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 // See the License for the specific language governing permissions and
15 // limitations under the License.
16 //
17 //
18
19 #include <grpc/grpc_audit_logging.h>
20 #include <grpc/support/port_platform.h>
21 #include <gtest/gtest.h>
22
23 #include <memory>
24 #include <string>
25
26 #include "absl/status/status.h"
27 #include "absl/status/statusor.h"
28 #include "absl/strings/numbers.h"
29 #include "absl/strings/string_view.h"
30 #include "absl/time/clock.h"
31 #include "absl/time/time.h"
32 #include "src/core/lib/security/authorization/audit_logging.h"
33 #include "src/core/util/json/json.h"
34 #include "src/core/util/json/json_reader.h"
35 #include "src/core/util/json/json_writer.h"
36 #include "test/core/test_util/test_config.h"
37 #include "test/core/test_util/tls_utils.h"
38
39 namespace grpc_core {
40 namespace testing {
41
42 constexpr absl::string_view kName = "test_logger";
43
44 using experimental::AuditContext;
45 using experimental::AuditLogger;
46 using experimental::AuditLoggerFactory;
47 using experimental::AuditLoggerRegistry;
48 using experimental::RegisterAuditLoggerFactory;
49
50 namespace {
51
52 class TestAuditLogger : public AuditLogger {
53 public:
name() const54 absl::string_view name() const override { return "test_logger"; }
Log(const AuditContext &)55 void Log(const AuditContext&) override {}
56 };
57
58 class TestAuditLoggerFactory : public AuditLoggerFactory {
59 public:
60 class TestConfig : public Config {
61 public:
name() const62 absl::string_view name() const override { return kName; }
ToString() const63 std::string ToString() const override { return "test_config"; }
64 };
65
name() const66 absl::string_view name() const override { return kName; }
CreateAuditLogger(std::unique_ptr<AuditLoggerFactory::Config>)67 std::unique_ptr<AuditLogger> CreateAuditLogger(
68 std::unique_ptr<AuditLoggerFactory::Config>) override {
69 return std::make_unique<TestAuditLogger>();
70 }
ParseAuditLoggerConfig(const Json &)71 absl::StatusOr<std::unique_ptr<Config>> ParseAuditLoggerConfig(
72 const Json&) override {
73 return std::make_unique<TestConfig>();
74 }
75 };
76
77 class AuditLoggerRegistryTest : public ::testing::Test {
78 protected:
SetUp()79 void SetUp() override {
80 RegisterAuditLoggerFactory(std::make_unique<TestAuditLoggerFactory>());
81 }
TearDown()82 void TearDown() override { AuditLoggerRegistry::TestOnlyResetRegistry(); }
83 };
84
85 } // namespace
86
87 //
88 // AuditLoggerRegistryTest
89 //
90
TEST_F(AuditLoggerRegistryTest,SuccessfulLoggerCreation)91 TEST_F(AuditLoggerRegistryTest, SuccessfulLoggerCreation) {
92 auto result = AuditLoggerRegistry::ParseConfig(kName, Json());
93 ASSERT_TRUE(result.ok());
94 ASSERT_NE(AuditLoggerRegistry::CreateAuditLogger(std::move(result.value())),
95 nullptr);
96 }
97
TEST_F(AuditLoggerRegistryTest,UnknownLogger)98 TEST_F(AuditLoggerRegistryTest, UnknownLogger) {
99 auto result = AuditLoggerRegistry::ParseConfig("unknown_logger", Json());
100 EXPECT_EQ(result.status().code(), absl::StatusCode::kNotFound);
101 EXPECT_EQ(result.status().message(),
102 "audit logger factory for unknown_logger does not exist")
103 << result.status();
104 }
105
TEST_F(AuditLoggerRegistryTest,LoggerFactoryExistenceChecks)106 TEST_F(AuditLoggerRegistryTest, LoggerFactoryExistenceChecks) {
107 EXPECT_TRUE(AuditLoggerRegistry::FactoryExists(kName));
108 EXPECT_FALSE(AuditLoggerRegistry::FactoryExists("unknown_logger"));
109 }
110
111 //
112 // StdoutLoggerTest
113 //
114
TEST(StdoutLoggerTest,LoggerFactoryExistenceChecks)115 TEST(StdoutLoggerTest, LoggerFactoryExistenceChecks) {
116 EXPECT_TRUE(AuditLoggerRegistry::FactoryExists("stdout_logger"));
117 }
118
TEST(StdoutLoggerTest,StdoutLoggerCreationAndLogInvocation)119 TEST(StdoutLoggerTest, StdoutLoggerCreationAndLogInvocation) {
120 auto result =
121 AuditLoggerRegistry::ParseConfig("stdout_logger", Json::FromObject({}));
122 ASSERT_TRUE(result.ok());
123 auto logger =
124 AuditLoggerRegistry::CreateAuditLogger(std::move(result.value()));
125 AuditContext context("method", "spiffe", "policy", "rule", true);
126 ::testing::internal::CaptureStdout();
127 absl::Time time_before_log = absl::Now();
128 logger->Log(context);
129 absl::Time time_after_log = absl::Now();
130 auto log_or = JsonParse(::testing::internal::GetCapturedStdout());
131 ASSERT_TRUE(log_or.ok());
132 ASSERT_EQ(log_or->type(), Json::Type::kObject);
133 auto it = log_or->object().find("grpc_audit_log");
134 ASSERT_NE(it, log_or->object().end());
135 ASSERT_EQ(it->second.type(), Json::Type::kObject);
136 auto& object = it->second.object();
137 ASSERT_NE(object.find("timestamp"), object.end());
138 EXPECT_EQ(object.find("timestamp")->second.type(), Json::Type::kString);
139 absl::Time time_at_log;
140 ASSERT_TRUE(absl::ParseTime(absl::RFC3339_full,
141 object.find("timestamp")->second.string(),
142 &time_at_log, nullptr));
143 // Check if the recorded timestamp is in between the recorded interval.
144 EXPECT_GE(time_at_log, time_before_log);
145 EXPECT_LE(time_at_log, time_after_log);
146 // Check exact values of everything else.
147 Json::Object json_object = object;
148 json_object.erase("timestamp");
149 EXPECT_EQ(JsonDump(Json::FromObject(json_object)),
150 "{\"authorized\":true,\"matched_rule\":\"rule\",\"policy_name\":"
151 "\"policy\",\"principal\":\"spiffe\",\"rpc_method\":\"method\"}");
152 }
153
154 } // namespace testing
155 } // namespace grpc_core
156
main(int argc,char ** argv)157 int main(int argc, char** argv) {
158 grpc::testing::TestEnvironment env(&argc, argv);
159 ::testing::InitGoogleTest(&argc, argv);
160 grpc_init();
161 int ret = RUN_ALL_TESTS();
162 grpc_shutdown();
163 return ret;
164 }
165