xds: RBAC `Authenticated` principal without `principal_name` is rejected ("Unknown StringMatcher match pattern: MATCHPATTERN_NOT_SET")

/*
 * Copyright 2021 The gRPC Authors
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package io.grpc.xds;

import static com.google.common.truth.Truth.assertThat;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;

import io.envoyproxy.envoy.config.rbac.v3.Permission;
import io.envoyproxy.envoy.config.rbac.v3.Policy;
import io.envoyproxy.envoy.config.rbac.v3.Principal;
import io.envoyproxy.envoy.config.rbac.v3.Principal.Authenticated;
import io.envoyproxy.envoy.config.rbac.v3.RBAC;
import io.envoyproxy.envoy.config.rbac.v3.RBAC.Action;
import io.grpc.Attributes;
import io.grpc.Grpc;
import io.grpc.Metadata;
import io.grpc.MethodDescriptor;
import io.grpc.MethodDescriptor.MethodType;
import io.grpc.ServerCall;
import io.grpc.testing.TestMethodDescriptors;
import io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine;
import io.grpc.xds.internal.rbac.engine.GrpcAuthorizationEngine.AuthDecision;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import javax.net.ssl.SSLSession;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.junit.runners.JUnit4;

/**
 * Tests for {@link RbacFilter} authenticated matcher with unset PrincipalName.
 */
@RunWith(JUnit4.class)
public class RbacFilterAuthenticatedMatcherTest {

  private static final RbacFilter.Provider FILTER_PROVIDER = new RbacFilter.Provider();

  /**
   * Per the RBAC spec, an Authenticated principal with no PrincipalName set should match
   * any authenticated user (i.e. any connection with a valid TLS certificate).
   * This test verifies that parsing such a configuration succeeds.
   */
  @Test
  public void authenticatedMatcherWithoutPrincipalName_shouldParseSuccessfully() {
    // Create an Authenticated principal without setting PrincipalName.
    // Per the RBAC spec: "If unset, it applies to any user that is authenticated."
    List<Permission> permissionList = Arrays.asList(
        Permission.newBuilder().setAny(true).build());
    List<Principal> principalList = Arrays.asList(
        Principal.newBuilder().setAuthenticated(
            Authenticated.newBuilder().build()).build());

    io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC rbac =
        io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC.newBuilder()
            .setRules(RBAC.newBuilder().setAction(Action.ALLOW)
                .putPolicies("any-authenticated-user",
                    Policy.newBuilder()
                        .addAllPermissions(permissionList)
                        .addAllPrincipals(principalList).build())
                .build())
            .build();

    ConfigOrError<RbacConfig> result = RbacFilter.Provider.parseRbacConfig(rbac);
    // The config should parse successfully without error.
    assertThat(result.errorDetail).isNull();
    assertThat(result.config).isNotNull();
    assertThat(result.config.authConfig()).isNotNull();
  }

  /**
   * An Authenticated principal with no PrincipalName should match any authenticated
   * connection (one with an SSL session and peer certificates).
   */
  @Test
  @SuppressWarnings("unchecked")
  public void authenticatedMatcherWithoutPrincipalName_shouldMatchAuthenticatedConnection()
      throws Exception {
    List<Permission> permissionList = Arrays.asList(
        Permission.newBuilder().setAny(true).build());
    List<Principal> principalList = Arrays.asList(
        Principal.newBuilder().setAuthenticated(
            Authenticated.newBuilder().build()).build());

    io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC rbac =
        io.envoyproxy.envoy.extensions.filters.http.rbac.v3.RBAC.newBuilder()
            .setRules(RBAC.newBuilder().setAction(Action.ALLOW)
                .putPolicies("any-authenticated-user",
                    Policy.newBuilder()
                        .addAllPermissions(permissionList)
                        .addAllPrincipals(principalList).build())
                .build())
            .build();

    ConfigOrError<RbacConfig> result = RbacFilter.Provider.parseRbacConfig(rbac);
    // Parsing must succeed first.
    assertThat(result.errorDetail).isNull();

    // Set up an authenticated connection with a mock SSL session and certificate.
    SSLSession sslSession = mock(SSLSession.class);
    X509Certificate mockCert = mock(X509Certificate.class);
    when(sslSession.getPeerCertificates()).thenReturn(new X509Certificate[]{mockCert});
    when(mockCert.getSubjectAlternativeNames()).thenReturn(
        Collections.<List<?>>singletonList(Arrays.asList(6, "spiffe://example.com/service")));

    ServerCall<Void, Void> serverCall = mock(ServerCall.class);
    Attributes attributes = Attributes.newBuilder()
        .set(Grpc.TRANSPORT_ATTR_SSL_SESSION, sslSession)
        .build();
    when(serverCall.getAttributes()).thenReturn(attributes);
    when(serverCall.getMethodDescriptor()).thenReturn(
        MethodDescriptor.<Void, Void>newBuilder()
            .setType(MethodType.BIDI_STREAMING)
            .setFullMethodName("test/method")
            .setRequestMarshaller(TestMethodDescriptors.voidMarshaller())
            .setResponseMarshaller(TestMethodDescriptors.voidMarshaller())
            .build());

    GrpcAuthorizationEngine engine =
        new GrpcAuthorizationEngine(result.config.authConfig());
    AuthDecision decision = engine.evaluate(new Metadata(), serverCall);
    // An authenticated connection should be allowed by this policy.
    assertThat(decision.decision()).isEqualTo(GrpcAuthorizationEngine.Action.ALLOW);
  }
}