Accountz-3.1 (#3391)

* Accountz-3.1

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

* Refactor code

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

* Refactor code

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

* Address review comments

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

feature/security/gnsi/acctz/README.md

@@ -35,7 +35,7 @@ Create a library of device configuration to be used for all of the gNSI.acctz.v1
 ## gNSI Accounting (acctz) Tests:
 - [ACCTZ-1.1 Record Subscribe Full](tests/record_subscribe_full)
 - [ACCTZ-2.1 Record Subscribe Partial](tests/record_subscribe_partial)
-- [ACCTZ-3.1 Record Subscribe Non-gRPC](RecordSubscribeNongrpc)
+- [ACCTZ-3.1 Record Subscribe Non-gRPC](tests/record_subscribe_non_grpc)
 - [ACCTZ-4.1 Record History Truncation](tests/record_history_truncation)
 - [ACCTZ-4.2 Record Payload Truncation](tests/record_payload_truncation)
 - [ACCTZ-5.1 Record Subscribe Idle Timeout](RecordSubscribeIdleTimeout/)

feature/security/gnsi/acctz/RecordSubscribeNongrpc/README.md → feature/security/gnsi/acctz/tests/record_subscribe_non_grpc/README.md

@@ -1,4 +1,4 @@
-# ACCTZ-3.1 - gNSI.acctz.v1 (Accounting) Test Record Subscribe Non-gRPC
+# ACCTZ-3.1: Record Subscribe Non-gRPC
 
 ## Summary
 Test Accounting for non-gRPC records

feature/security/gnsi/acctz/tests/record_subscribe_non_grpc/metadata.textproto

@@ -0,0 +1,7 @@
+# proto-file: github.com/openconfig/featureprofiles/proto/metadata.proto
+# proto-message: Metadata
+
+uuid:  "036d3d49-00dd-46ff-abe6-afc20768db6f"
+plan_id:  "ACCTZ-3.1"
+description:  "Record Subscribe Non-gRPC"
+testbed:  TESTBED_DUT

feature/security/gnsi/acctz/tests/record_subscribe_non_grpc/record_subscribe_non_grpc_test.go

@@ -0,0 +1,186 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package recordsubscribenongrpc
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/openconfig/featureprofiles/internal/fptest"
+	"github.com/openconfig/featureprofiles/internal/security/acctz"
+	acctzpb "github.com/openconfig/gnsi/acctz"
+	"github.com/openconfig/ondatra"
+)
+
+type recordRequestResult struct {
+	record *acctzpb.RecordResponse
+	err    error
+}
+
+func TestMain(m *testing.M) {
+	fptest.RunTests(m)
+}
+
+func prettyPrint(i interface{}) string {
+	s, _ := json.MarshalIndent(i, "", "\t")
+	return string(s)
+}
+
+func TestAccountzRecordSubscribeNonGRPC(t *testing.T) {
+	dut := ondatra.DUT(t, "dut")
+	acctz.SetupUsers(t, dut, true)
+	var records []*acctzpb.RecordResponse
+
+	// Put enough time between the test starting and any prior events so we can easily know where
+	// our records start.
+	time.Sleep(5 * time.Second)
+
+	startTime := time.Now()
+	newRecords := acctz.SendSuccessCliCommand(t, dut)
+	records = append(records, newRecords...)
+	newRecords = acctz.SendFailCliCommand(t, dut)
+	records = append(records, newRecords...)
+	newRecords = acctz.SendShellCommand(t, dut)
+	records = append(records, newRecords...)
+
+	// Quick sleep to ensure all the records have been processed/ready for us.
+	time.Sleep(5 * time.Second)
+
+	// Get gNSI record subscribe client.
+	requestTimestamp := &timestamppb.Timestamp{
+		Seconds: 0,
+		Nanos:   0,
+	}
+	acctzClient := dut.RawAPIs().GNSI(t).AcctzStream()
+	acctzSubClient, err := acctzClient.RecordSubscribe(context.Background(), &acctzpb.RecordRequest{Timestamp: requestTimestamp})
+	if err != nil {
+		t.Fatalf("Failed sending accountz record request, error: %s", err)
+	}
+	defer acctzSubClient.CloseSend()
+
+	var recordIdx int
+	var lastTimestampUnixMillis int64
+	var lastTaskID string
+	r := make(chan recordRequestResult)
+
+	// Ignore proto fields which are set internally by the DUT (cannot be matched exactly)
+	// and compare them manually later.
+	popts := []cmp.Option{protocmp.Transform(),
+		protocmp.IgnoreFields(&acctzpb.RecordResponse{}, "timestamp", "task_ids"),
+		protocmp.IgnoreFields(&acctzpb.AuthzDetail{}, "detail"),
+		protocmp.IgnoreFields(&acctzpb.SessionInfo{}, "channel_id", "tty"),
+	}
+
+	for {
+		if recordIdx >= len(records) {
+			t.Log("Out of records to process...")
+			break
+		}
+
+		// Read single acctz record from stream into channel.
+		go func(r chan recordRequestResult) {
+			var response *acctzpb.RecordResponse
+			response, err = acctzSubClient.Recv()
+			r <- recordRequestResult{
+				record: response,
+				err:    err,
+			}
+		}(r)
+
+		var done bool
+		var resp recordRequestResult
+
+		// Read acctz record from channel for evaluation.
+		// Timeout and exit if no records received on the channel for some time.
+		select {
+		case rr := <-r:
+			resp = rr
+		case <-time.After(10 * time.Second):
+			done = true
+		}
+
+		if done {
+			t.Log("Done receiving records...")
+			break
+		}
+
+		if resp.err != nil {
+			t.Fatalf("Failed receiving record response, error: %s", resp.err)
+		}
+
+		if !resp.record.Timestamp.AsTime().After(startTime) {
+			// Skipping record if it happened before test start time.
+			continue
+		}
+
+		// Some task ids may be tracked multiple times (for start/stop accounting). If we see two in
+		// a row that are the same task, we can skip this record and continue.
+		currentTaskID := resp.record.TaskIds[0]
+		if currentTaskID == lastTaskID {
+			continue
+		}
+		lastTaskID = currentTaskID
+
+		timestamp := resp.record.Timestamp.AsTime()
+		if timestamp.UnixMilli() == lastTimestampUnixMillis {
+			// This ensures that timestamps are actually changing for each record.
+			t.Errorf("Timestamp is the same as the previous timestamp, this shouldn't be possible!, Record Details: %s", prettyPrint(resp.record))
+		}
+		lastTimestampUnixMillis = timestamp.UnixMilli()
+
+		// Verify acctz proto bits.
+		if diff := cmp.Diff(resp.record, records[recordIdx], popts...); diff != "" {
+			t.Errorf("got diff in got/want: %s", diff)
+		}
+
+		// Verify record timestamp is after request timestamp.
+		if !timestamp.After(requestTimestamp.AsTime()) {
+			t.Errorf("Record timestamp is before record request timestamp %v, Record Details: %v", requestTimestamp.AsTime(), prettyPrint(resp.record))
+		}
+
+		// This channel check maybe should just go away entirely -- see:
+		// https://github.com/openconfig/gnsi/issues/98
+		// In case of Nokia this is being set to the aaa session id just to have some hopefully
+		// useful info in this field to identify a "session" (even if it isn't necessarily ssh/grpc
+		// directly).
+		if resp.record.GetSessionInfo().GetChannelId() == "" {
+			t.Errorf("Channel Id is not populated for record: %v", prettyPrint(resp.record))
+		}
+
+		// Tty only set for ssh records.
+		if resp.record.GetSessionInfo().GetTty() == "" {
+			t.Errorf("Should have tty allocated but not set, Record Details: %s", prettyPrint(resp.record))
+		}
+
+		// Verify authz detail is populated for denied cmds.
+		authzInfo := resp.record.GetCmdService().GetAuthz()
+		if authzInfo.Status == acctzpb.AuthzDetail_AUTHZ_STATUS_DENY && authzInfo.GetDetail() == "" {
+			t.Errorf("Authorization detail is not populated for record: %v", prettyPrint(resp.record))
+		}
+
+		t.Logf("Processed Record: %s", prettyPrint(resp.record))
+		recordIdx++
+	}
+
+	if recordIdx != len(records) {
+		t.Fatal("Did not process all records.")
+	}
+}