Accountz-1.1 (#3389)

* Accountz-1.1

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

* Refactor code

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

* Acctz library for grpc/ssh setup

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

* Fix static check

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

* Fix static check

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

* Address review comments

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

* Use AcctzStream

"This code is a Contribution to the OpenConfig Feature Profiles project ("Work") made under the Google Software Grant and Corporate Contributor License Agreement ("CLA") and governed by the Apache License 2.0. No other rights or licenses in or to any of Nokia's intellectual property are granted for any other purpose. This code is provided on an "as is" basis without any warranties of any kind."

feature/security/gnsi/acctz/README.md

@@ -33,7 +33,7 @@ Create a library of device configuration to be used for all of the gNSI.acctz.v1
 	- A User permitted to run some commands in each of the service classes of gnsi.acctz.v1.CommandService.CmdServiceType & gnsi.acctz.v1.GrpcService.GrpcServiceType, but not all
 
 ## gNSI Accounting (acctz) Tests:
-- [ACCTZ-1.1 Record Subscribe Full](RecordSubscribeFull)
+- [ACCTZ-1.1 Record Subscribe Full](tests/record_subscribe_full)
 - [ACCTZ-2.1 Record Subscribe Partial](tests/record_subscribe_partial)
 - [ACCTZ-3.1 Record Subscribe Non-gRPC](RecordSubscribeNongrpc)
 - [ACCTZ-4.1 Record History Truncation](RecordHistoryTruncation/)

feature/security/gnsi/acctz/RecordSubscribeFull/README.md → feature/security/gnsi/acctz/tests/record_subscribe_full/README.md

@@ -1,4 +1,4 @@
-# ACCTZ-1.1 - gNSI.acctz.v1 (Accounting) Test Record Subscribe Full
+# ACCTZ-1.1: Record Subscribe Full
 
 ## Summary
 Test RecordSubscribe for all (since epoch) records

feature/security/gnsi/acctz/tests/record_subscribe_full/metadata.textproto

@@ -0,0 +1,7 @@
+# proto-file: github.com/openconfig/featureprofiles/proto/metadata.proto
+# proto-message: Metadata
+
+uuid:  "c1352e24-e45c-4f6d-9b16-d28cc1a5093a"
+plan_id:  "ACCTZ-1.1"
+description:  "Record Subscribe Full"
+testbed:  TESTBED_DUT

feature/security/gnsi/acctz/tests/record_subscribe_full/record_subscribe_full_test.go

@@ -0,0 +1,181 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package recordsubscribefull
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	"github.com/openconfig/featureprofiles/internal/fptest"
+	"github.com/openconfig/featureprofiles/internal/security/acctz"
+	acctzpb "github.com/openconfig/gnsi/acctz"
+	"github.com/openconfig/ondatra"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+type recordRequestResult struct {
+	record *acctzpb.RecordResponse
+	err    error
+}
+
+func TestMain(m *testing.M) {
+	fptest.RunTests(m)
+}
+
+func prettyPrint(i interface{}) string {
+	s, _ := json.MarshalIndent(i, "", "\t")
+	return string(s)
+}
+
+func TestAccountzRecordSubscribeFull(t *testing.T) {
+	dut := ondatra.DUT(t, "dut")
+	acctz.SetupUsers(t, dut, false)
+	var records []*acctzpb.RecordResponse
+
+	// Put enough time between the test starting and any prior events so we can easily know where
+	// our records start.
+	time.Sleep(5 * time.Second)
+
+	startTime := time.Now()
+	newRecords := acctz.SendGnmiRPCs(t, dut)
+	records = append(records, newRecords...)
+	newRecords = acctz.SendGnoiRPCs(t, dut)
+	records = append(records, newRecords...)
+	newRecords = acctz.SendGnsiRPCs(t, dut)
+	records = append(records, newRecords...)
+	newRecords = acctz.SendGribiRPCs(t, dut)
+	records = append(records, newRecords...)
+	newRecords = acctz.SendP4rtRPCs(t, dut)
+	records = append(records, newRecords...)
+
+	// Quick sleep to ensure all the records have been processed/ready for us.
+	time.Sleep(5 * time.Second)
+
+	// Get gNSI record subscribe client.
+	requestTimestamp := &timestamppb.Timestamp{
+		Seconds: 0,
+		Nanos:   0,
+	}
+	acctzClient := dut.RawAPIs().GNSI(t).AcctzStream()
+	acctzSubClient, err := acctzClient.RecordSubscribe(context.Background(), &acctzpb.RecordRequest{Timestamp: requestTimestamp})
+	if err != nil {
+		t.Fatalf("Failed sending accountz record request, error: %s", err)
+	}
+	defer acctzSubClient.CloseSend()
+
+	var recordIdx int
+	var lastTimestampUnixMillis int64
+	r := make(chan recordRequestResult)
+
+	// Ignore proto fields which are set internally by the DUT (cannot be matched exactly)
+	// and compare them manually later.
+	popts := []cmp.Option{
+		protocmp.Transform(),
+		protocmp.IgnoreFields(&acctzpb.RecordResponse{}, "timestamp", "task_ids"),
+		protocmp.IgnoreFields(&acctzpb.AuthzDetail{}, "detail"),
+		protocmp.IgnoreFields(&acctzpb.SessionInfo{}, "channel_id"),
+	}
+
+	for {
+		if recordIdx >= len(records) {
+			t.Log("Out of records to process...")
+			break
+		}
+
+		// Read single acctz record from stream into channel.
+		go func(r chan recordRequestResult) {
+			var response *acctzpb.RecordResponse
+			response, err = acctzSubClient.Recv()
+			r <- recordRequestResult{
+				record: response,
+				err:    err,
+			}
+		}(r)
+
+		var done bool
+		var resp recordRequestResult
+
+		// Read acctz record from channel for evaluation.
+		// Timeout and exit if no records received on the channel for some time.
+		select {
+		case rr := <-r:
+			resp = rr
+		case <-time.After(10 * time.Second):
+			done = true
+		}
+
+		if done {
+			t.Log("Done receiving records...")
+			break
+		}
+
+		if resp.err != nil {
+			t.Fatalf("Failed receiving record response, error: %s", resp.err)
+		}
+
+		if resp.record.GetHistoryIstruncated() {
+			t.Errorf("History is truncated but it shouldn't be, Record Details: %s", prettyPrint(resp.record))
+		}
+
+		if !resp.record.Timestamp.AsTime().After(startTime) {
+			// Skipping record if it happened before test start time.
+			continue
+		}
+
+		timestamp := resp.record.Timestamp.AsTime()
+		if timestamp.UnixMilli() == lastTimestampUnixMillis {
+			// This ensures that timestamps are actually changing for each record.
+			t.Errorf("Timestamp is the same as the previous timestamp, this shouldn't be possible!, Record Details: %s", prettyPrint(resp.record))
+		}
+		lastTimestampUnixMillis = timestamp.UnixMilli()
+
+		// Verify acctz proto bits.
+		if diff := cmp.Diff(resp.record, records[recordIdx], popts...); diff != "" {
+			t.Errorf("Got diff in got/want: %s", diff)
+		}
+
+		// Verify record timestamp is after request timestamp.
+		if !timestamp.After(requestTimestamp.AsTime()) {
+			t.Errorf("Record timestamp is before record request timestamp %v, Record Details: %v", requestTimestamp.AsTime(), prettyPrint(resp.record))
+		}
+
+		// This channel check maybe should just go away entirely -- see:
+		// https://github.com/openconfig/gnsi/issues/98
+		// In case of Nokia this is being set to the aaa session id just to have some hopefully
+		// useful info in this field to identify a "session" (even if it isn't necessarily ssh/grpc
+		// directly).
+		if resp.record.GetSessionInfo().GetChannelId() == "" {
+			t.Errorf("Channel Id is not populated for record: %v", prettyPrint(resp.record))
+		}
+
+		// Verify authz detail is populated for denied rpcs.
+		authzInfo := resp.record.GetGrpcService().GetAuthz()
+		if authzInfo.Status == acctzpb.AuthzDetail_AUTHZ_STATUS_DENY && authzInfo.GetDetail() == "" {
+			t.Errorf("Authorization detail is not populated for record: %v", prettyPrint(resp.record))
+		}
+
+		t.Logf("Processed Record: %s", prettyPrint(resp.record))
+		recordIdx++
+	}
+
+	if recordIdx != len(records) {
+		t.Fatal("Did not process all records.")
+	}
+}