ferrix/crates/integration-tests/tests/rpki.rs

//! Route origin validation, end to end: a server that validates against a
//! cache, a peer that announces routes, and the validation data changing
//! under both.

use std::collections::BTreeSet;
use std::net::Ipv4Addr;
use std::time::Duration;

use bgp_integration_tests::test_cache::TestCache;
use bgp_integration_tests::test_peer::TestPeer;
use bgp_integration_tests::test_server::TestServer;
use bgp_packet::message::{
    AsPathAttribute, Message, NextHopPathAttribute, OriginPathAttribute, PathAttribute,
    UpdateMessage,
};
use bgp_primitives::ip_prefix::IpPrefix;
use bgp_rpki::{CacheState, RpkiConfig, Vrp};
use bgp_server::config::PeerConfig;
use bgp_server::family::FamilySet;
use bgp_server::policy::ImportPolicy;
use eyre::Result;
use serde_json::Value;
use tokio::net::TcpListener;

const LOCAL_ASN: u32 = 1299;
const PEER_ASN: u32 = 3333;
const TIMEOUT: Duration = Duration::from_secs(5);

fn prefix(s: &str) -> IpPrefix {
    IpPrefix::try_from(s).unwrap()
}

fn vrp(p: &str, max_length: u8, asn: u32) -> Vrp {
    Vrp {
        prefix: prefix(p),
        max_length,
        asn,
    }
}

/// What a test holds on to: the server, and the listener its dialling
/// goes to.
struct Setup {
    server: TestServer,
    _listener: TcpListener,
}

/// A server that validates against `cache`, with one configured peer at
/// the address the test connects from. Returns once the server has the
/// cache's data.
async fn server_with(
    cache: &TestCache,
    expire: Option<Duration>,
    import: ImportPolicy,
) -> Result<Setup> {
    let listener = TcpListener::bind((Ipv4Addr::LOCALHOST, 0)).await?;
    let endpoint = listener.local_addr()?;
    let cache = cache.address();
    let server = TestServer::start_with(LOCAL_ASN, |c| {
        c.accept_unconfigured_peers = false;
        c.rpki = Some(RpkiConfig {
            caches: vec![cache],
            retry: Some(Duration::from_millis(100)),
            expire,
            ..RpkiConfig::default()
        });
        c.peers = vec![PeerConfig {
            name: "r1".into(),
            endpoint,
            remote_asn: PEER_ASN,
            hold_time_secs: 90,
            local_address: None,
            families: FamilySet::supported(),
            add_path: None,
            import,
            role: None,
            require_role: false,
        }];
    })
    .await?;
    let rpki = server.rpki.clone().expect("validation is configured");
    tokio::time::timeout(TIMEOUT, async {
        while rpki.status().state != CacheState::Synchronised {
            tokio::time::sleep(Duration::from_millis(5)).await;
        }
    })
    .await?;
    Ok(Setup {
        server,
        _listener: listener,
    })
}

async fn established(server: &TestServer) -> Result<TestPeer> {
    let mut peer = TestPeer::connect(server.addr).await?;
    peer.handshake(PEER_ASN, Ipv4Addr::new(10, 0, 0, 2), 90)
        .await?;
    tokio::time::timeout(TIMEOUT, async {
        while server.registry.list().is_empty() {
            tokio::time::sleep(Duration::from_millis(5)).await;
        }
    })
    .await?;
    Ok(peer)
}

/// Announces `prefixes` as originated by `origin`, reached through the
/// peer.
async fn announce(peer: &mut TestPeer, prefixes: &[&str], origin: u32) -> Result<()> {
    let path = if origin == PEER_ASN {
        vec![PEER_ASN]
    } else {
        vec![PEER_ASN, origin]
    };
    peer.send(&Message::Update(UpdateMessage {
        withdrawn_routes: vec![],
        path_attributes: vec![
            PathAttribute::Origin(OriginPathAttribute::IGP),
            AsPathAttribute::from_asns(path),
            PathAttribute::NextHop(NextHopPathAttribute(Ipv4Addr::new(192, 0, 2, 1))),
        ],
        announced_routes: prefixes.iter().map(|p| prefix(p).into()).collect(),
    }))
    .await
}

fn set(prefixes: &[&str]) -> BTreeSet<String> {
    prefixes.iter().map(|p| p.to_string()).collect()
}

/// Waits until the table holds exactly `expected` and the peer has `held`
/// routes held aside.
async fn table_becomes(server: &TestServer, expected: &[&str], held: u64) -> Result<()> {
    let expected = set(expected);
    let table = || -> BTreeSet<String> {
        server
            .received_routes()
            .iter()
            .map(|route| route.prefix.to_string())
            .collect()
    };
    let held_now = || {
        server
            .registry
            .list()
            .first()
            .map_or(0, |session| session.counters.held())
    };
    tokio::time::timeout(TIMEOUT, async {
        while table() != expected || held_now() != held {
            tokio::time::sleep(Duration::from_millis(5)).await;
        }
    })
    .await
    .map_err(|_| {
        eyre::eyre!(
            "the table has {:?} with {} held; expected {expected:?} with {held} held",
            table(),
            held_now()
        )
    })
}

/// A route whose origin is not the one the holder of the addresses
/// authorised is refused. One that is authorised is taken, and so is one
/// that nothing is known about.
#[tokio::test]
async fn test_an_invalid_route_is_refused_and_the_rest_are_taken() -> Result<()> {
    let cache = TestCache::start(vec![vrp("193.0.0.0/21", 24, PEER_ASN)]).await;
    let Setup { server, .. } = server_with(&cache, None, ImportPolicy::default()).await?;
    let (base, _http) = server.serve_http().await?;
    let mut peer = established(&server).await?;

    announce(&mut peer, &["193.0.0.0/21", "194.0.0.0/24"], PEER_ASN).await?;
    // Someone else's AS as the origin of a covered prefix; and the right
    // AS, more specific than it may announce.
    announce(&mut peer, &["193.0.4.0/24"], 15169).await?;
    announce(&mut peer, &["193.0.6.0/25"], PEER_ASN).await?;
    table_becomes(&server, &["193.0.0.0/21", "194.0.0.0/24"], 1).await?;

    let client = reqwest::Client::new();
    let get = |path: &str| {
        let request = client.get(format!("{base}{path}"));
        async move { Ok::<Value, eyre::Report>(request.send().await?.error_for_status()?.json().await?) }
    };
    // Each route says how it stands.
    let routes = get("/api/routes/received").await?;
    let validity: Vec<(&str, &str)> = routes
        .as_array()
        .unwrap()
        .iter()
        .map(|r| (r["prefix"].as_str().unwrap(), r["rpki"].as_str().unwrap()))
        .collect();
    assert_eq!(
        validity,
        [("193.0.0.0/21", "valid"), ("194.0.0.0/24", "not found")]
    );
    // The refused one is on record with its reason. The too-specific one
    // was refused before validation came to it.
    let refused = get("/api/routes/rejected").await?;
    assert_eq!(
        refused[0]["by_reason"],
        serde_json::json!({"RPKI invalid": 1, "prefix too specific": 1})
    );
    let peers = get("/api/peers").await?;
    assert_eq!(peers[0]["routes"], 2);
    assert_eq!(peers[0]["held_routes"], 1);

    let rpki = get("/api/rpki").await?;
    assert_eq!(rpki["enabled"], true);
    assert_eq!(rpki["state"], "synchronised");
    assert_eq!(rpki["vrps_ipv4"], 1);
    assert_eq!(rpki["cache"], cache.address().to_string());
    Ok(())
}

/// Validity changes with the validation data, and the routes follow: one
/// that was taken goes when it becomes invalid, and one that was refused
/// as invalid is taken when it no longer is. The peer sends nothing more
/// meanwhile; it has said all it has to say.
#[tokio::test]
async fn test_routes_follow_the_validation_data() -> Result<()> {
    let ripe = vrp("193.0.0.0/21", 24, PEER_ASN);
    let cache = TestCache::start(vec![ripe]).await;
    let Setup { server, .. } = server_with(&cache, None, ImportPolicy::default()).await?;
    let mut peer = established(&server).await?;

    // Nothing is known about 8.8.8.0/24, so it is taken. 193.0.4.0/24 is
    // covered, and not for this origin.
    announce(&mut peer, &["8.8.8.0/24", "193.0.4.0/24"], 15169).await?;
    table_becomes(&server, &["8.8.8.0/24"], 1).await?;

    // The holder of 8.8.8.0/24 authorises another AS: the route in the
    // table is now invalid, and goes.
    cache.set(vec![ripe, vrp("8.8.8.0/24", 24, 13335)]);
    table_becomes(&server, &[], 2).await?;
    let refused = &server.refusals.peers()[0].1;
    assert_eq!(refused.total(), 2);
    assert_eq!(refused.recent()[0].prefix, prefix("8.8.8.0/24"));
    assert_eq!(&refused.recent()[0].as_path[..], [PEER_ASN, 15169]);

    // Both are authorised for the origin they have: both come back, with
    // the attributes they were announced with.
    cache.set(vec![
        ripe,
        vrp("8.8.8.0/24", 24, 15169),
        vrp("193.0.4.0/24", 24, 15169),
    ]);
    table_becomes(&server, &["8.8.8.0/24", "193.0.4.0/24"], 0).await?;
    for route in server.received_routes() {
        assert!(
            route
                .attributes
                .contains(&AsPathAttribute::from_asns(vec![PEER_ASN, 15169])),
            "{route:?}"
        );
    }
    assert_eq!(server.registry.list()[0].counters.routes(), 2);
    Ok(())
}

/// A held route is the peer's to withdraw or replace like any other. One
/// it has withdrawn does not appear when it would have become valid.
#[tokio::test]
async fn test_a_held_route_the_peer_withdrew_does_not_come_back() -> Result<()> {
    let ripe = vrp("193.0.0.0/21", 24, PEER_ASN);
    let cache = TestCache::start(vec![ripe]).await;
    let Setup { server, .. } = server_with(&cache, None, ImportPolicy::default()).await?;
    let mut peer = established(&server).await?;

    announce(&mut peer, &["193.0.4.0/24", "193.0.5.0/24"], 15169).await?;
    table_becomes(&server, &[], 2).await?;

    // One is withdrawn, the other announced again with the right origin.
    peer.send(&Message::Update(UpdateMessage {
        withdrawn_routes: vec![prefix("193.0.4.0/24").into()],
        path_attributes: vec![],
        announced_routes: vec![],
    }))
    .await?;
    announce(&mut peer, &["193.0.5.0/24"], PEER_ASN).await?;
    table_becomes(&server, &["193.0.5.0/24"], 0).await?;

    // Now the old origin would be valid for both. Neither old route is
    // there to be brought back.
    cache.set(vec![ripe, vrp("193.0.4.0/23", 24, 15169)]);
    tokio::time::sleep(Duration::from_millis(500)).await;
    table_becomes(&server, &["193.0.5.0/24"], 0).await?;
    assert!(
        server.received_routes()[0]
            .attributes
            .contains(&AsPathAttribute::from_asns(vec![PEER_ASN])),
        "the route the peer has now"
    );
    Ok(())
}

/// A peer can be exempt: its invalid routes are taken, and shown for what
/// they are.
#[tokio::test]
async fn test_a_peer_can_be_exempt_from_validation() -> Result<()> {
    let cache = TestCache::start(vec![vrp("193.0.0.0/21", 24, PEER_ASN)]).await;
    let import = ImportPolicy {
        accept_rpki_invalid: true,
        ..ImportPolicy::default()
    };
    let Setup { server, .. } = server_with(&cache, None, import).await?;
    let (base, _http) = server.serve_http().await?;
    let mut peer = established(&server).await?;

    announce(&mut peer, &["193.0.4.0/24"], 15169).await?;
    table_becomes(&server, &["193.0.4.0/24"], 0).await?;
    let routes: Value = reqwest::get(format!("{base}/api/routes/received"))
        .await?
        .json()
        .await?;
    assert_eq!(routes[0]["rpki"], "invalid");
    assert!(server.refusals.peers().is_empty());
    Ok(())
}

/// Validation data that no cache has confirmed for too long is dropped,
/// and with it every verdict: routes held as invalid are taken. Refusing
/// routes on the word of data that may be long out of date would be worse.
#[tokio::test]
async fn test_held_routes_are_taken_when_the_validation_data_expires() -> Result<()> {
    let cache = TestCache::start(vec![vrp("193.0.0.0/21", 24, PEER_ASN)]).await;
    let Setup { server, .. } = server_with(
        &cache,
        Some(Duration::from_millis(1500)),
        ImportPolicy::default(),
    )
    .await?;
    let mut peer = established(&server).await?;
    announce(&mut peer, &["193.0.4.0/24"], 15169).await?;
    table_becomes(&server, &[], 1).await?;

    drop(cache);
    table_becomes(&server, &["193.0.4.0/24"], 0).await?;
    assert!(server.rpki.as_ref().unwrap().current().vrps.is_empty());
    Ok(())
}