2023-03-28 18:39:22 +00:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
2023-08-11 13:12:13 +00:00
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
2023-03-28 18:39:22 +00:00
|
|
|
|
2013-12-23 21:52:10 +00:00
|
|
|
package agent
|
|
|
|
|
|
|
|
import (
|
2013-12-24 00:20:51 +00:00
|
|
|
"bytes"
|
2017-02-11 02:29:42 +00:00
|
|
|
"context"
|
2020-07-02 21:51:25 +00:00
|
|
|
"crypto/tls"
|
2013-12-24 00:20:51 +00:00
|
|
|
"encoding/json"
|
2014-05-21 19:31:22 +00:00
|
|
|
"fmt"
|
2013-12-24 00:20:51 +00:00
|
|
|
"io"
|
2015-01-16 17:58:37 +00:00
|
|
|
"net"
|
2014-02-05 22:47:42 +00:00
|
|
|
"net/http"
|
|
|
|
"net/http/httptest"
|
2022-12-14 15:24:22 +00:00
|
|
|
"net/netip"
|
2023-02-21 13:28:13 +00:00
|
|
|
"net/url"
|
2014-04-17 18:38:14 +00:00
|
|
|
"os"
|
2014-04-23 19:57:06 +00:00
|
|
|
"path/filepath"
|
2015-01-16 17:58:37 +00:00
|
|
|
"runtime"
|
2014-04-21 20:11:05 +00:00
|
|
|
"strconv"
|
2015-04-12 18:17:31 +00:00
|
|
|
"strings"
|
2013-12-23 21:52:10 +00:00
|
|
|
"testing"
|
2014-02-05 22:47:42 +00:00
|
|
|
"time"
|
2014-09-02 19:47:40 +00:00
|
|
|
|
2020-06-08 08:10:08 +00:00
|
|
|
"github.com/NYTimes/gziphandler"
|
2022-10-27 13:25:18 +00:00
|
|
|
"github.com/hashicorp/go-cleanhttp"
|
2022-02-03 22:07:39 +00:00
|
|
|
"github.com/hashicorp/go-hclog"
|
2021-06-08 23:11:34 +00:00
|
|
|
"github.com/stretchr/testify/assert"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"golang.org/x/net/http2"
|
|
|
|
|
2020-09-23 11:37:33 +00:00
|
|
|
"github.com/hashicorp/consul/agent/config"
|
2022-12-14 15:24:22 +00:00
|
|
|
"github.com/hashicorp/consul/agent/consul"
|
2017-07-06 10:34:00 +00:00
|
|
|
"github.com/hashicorp/consul/agent/structs"
|
2019-02-27 19:28:31 +00:00
|
|
|
tokenStore "github.com/hashicorp/consul/agent/token"
|
2017-11-07 23:06:59 +00:00
|
|
|
"github.com/hashicorp/consul/api"
|
2019-03-27 12:54:56 +00:00
|
|
|
"github.com/hashicorp/consul/sdk/testutil"
|
2020-01-31 16:19:37 +00:00
|
|
|
"github.com/hashicorp/consul/sdk/testutil/retry"
|
2018-10-17 20:20:35 +00:00
|
|
|
"github.com/hashicorp/consul/testrpc"
|
2013-12-23 21:52:10 +00:00
|
|
|
)
|
|
|
|
|
2015-01-16 17:58:37 +00:00
|
|
|
func TestHTTPServer_UnixSocket(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2015-01-16 17:58:37 +00:00
|
|
|
if runtime.GOOS == "windows" {
|
|
|
|
t.SkipNow()
|
|
|
|
}
|
|
|
|
|
2017-05-12 13:41:13 +00:00
|
|
|
tempDir := testutil.TempDir(t, "consul")
|
|
|
|
socket := filepath.Join(tempDir, "test.sock")
|
2015-01-16 17:58:37 +00:00
|
|
|
|
2017-05-21 07:11:09 +00:00
|
|
|
// Only testing mode, since uid/gid might not be settable
|
|
|
|
// from test environment.
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, `
|
2017-09-25 18:40:42 +00:00
|
|
|
addresses {
|
|
|
|
http = "unix://`+socket+`"
|
|
|
|
}
|
|
|
|
unix_sockets {
|
|
|
|
mode = "0777"
|
|
|
|
}
|
|
|
|
`)
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-16 17:58:37 +00:00
|
|
|
|
|
|
|
// Ensure the socket was created
|
|
|
|
if _, err := os.Stat(socket); err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
|
2015-01-20 22:32:15 +00:00
|
|
|
// Ensure the mode was set properly
|
|
|
|
fi, err := os.Stat(socket)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if fi.Mode().String() != "Srwxrwxrwx" {
|
|
|
|
t.Fatalf("bad permissions: %s", fi.Mode())
|
|
|
|
}
|
|
|
|
|
2015-01-16 17:58:37 +00:00
|
|
|
// Ensure we can get a response from the socket.
|
2015-10-22 14:47:50 +00:00
|
|
|
trans := cleanhttp.DefaultTransport()
|
2017-02-11 02:29:42 +00:00
|
|
|
trans.DialContext = func(_ context.Context, _, _ string) (net.Conn, error) {
|
2017-09-25 18:40:42 +00:00
|
|
|
return net.Dial("unix", socket)
|
2015-10-22 14:47:50 +00:00
|
|
|
}
|
2015-01-16 17:58:37 +00:00
|
|
|
client := &http.Client{
|
2015-10-22 14:47:50 +00:00
|
|
|
Transport: trans,
|
2015-01-16 17:58:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// This URL doesn't look like it makes sense, but the scheme (http://) and
|
|
|
|
// the host (127.0.0.1) are required by the HTTP client library. In reality
|
|
|
|
// this will just use the custom dialer and talk to the socket.
|
|
|
|
resp, err := client.Get("http://127.0.0.1/v1/agent/self")
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
defer resp.Body.Close()
|
|
|
|
|
2022-11-10 16:26:01 +00:00
|
|
|
if body, err := io.ReadAll(resp.Body); err != nil || len(body) == 0 {
|
2015-01-16 17:58:37 +00:00
|
|
|
t.Fatalf("bad: %s %v", body, err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-01-16 20:39:15 +00:00
|
|
|
func TestHTTPServer_UnixSocket_FileExists(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2015-01-16 18:37:13 +00:00
|
|
|
if runtime.GOOS == "windows" {
|
|
|
|
t.SkipNow()
|
|
|
|
}
|
|
|
|
|
2017-05-12 13:41:13 +00:00
|
|
|
tempDir := testutil.TempDir(t, "consul")
|
|
|
|
socket := filepath.Join(tempDir, "test.sock")
|
2015-01-16 18:37:13 +00:00
|
|
|
|
|
|
|
// Create a regular file at the socket path
|
2022-11-10 16:26:01 +00:00
|
|
|
if err := os.WriteFile(socket, []byte("hello world"), 0644); err != nil {
|
2015-01-16 18:37:13 +00:00
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
fi, err := os.Stat(socket)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if !fi.Mode().IsRegular() {
|
|
|
|
t.Fatalf("not a regular file: %s", socket)
|
|
|
|
}
|
|
|
|
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, `
|
2017-09-25 18:40:42 +00:00
|
|
|
addresses {
|
|
|
|
http = "unix://`+socket+`"
|
|
|
|
}
|
|
|
|
`)
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-16 20:39:15 +00:00
|
|
|
|
2015-01-20 22:13:36 +00:00
|
|
|
// Ensure the file was replaced by the socket
|
|
|
|
fi, err = os.Stat(socket)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if fi.Mode()&os.ModeSocket == 0 {
|
|
|
|
t.Fatalf("expected socket to replace file")
|
2015-01-16 18:37:13 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-02-21 13:28:13 +00:00
|
|
|
func TestHTTPSServer_UnixSocket(t *testing.T) {
|
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
|
|
|
t.Parallel()
|
|
|
|
if runtime.GOOS == "windows" {
|
|
|
|
t.SkipNow()
|
|
|
|
}
|
|
|
|
|
|
|
|
tempDir := testutil.TempDir(t, "consul")
|
|
|
|
socket := filepath.Join(tempDir, "test.sock")
|
|
|
|
|
|
|
|
a := StartTestAgent(t, TestAgent{
|
|
|
|
UseHTTPS: true,
|
|
|
|
HCL: `
|
|
|
|
addresses {
|
|
|
|
https = "unix://` + socket + `"
|
|
|
|
}
|
|
|
|
unix_sockets {
|
|
|
|
mode = "0777"
|
|
|
|
}
|
|
|
|
tls {
|
|
|
|
defaults {
|
|
|
|
ca_file = "../test/client_certs/rootca.crt"
|
|
|
|
cert_file = "../test/client_certs/server.crt"
|
|
|
|
key_file = "../test/client_certs/server.key"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`,
|
|
|
|
})
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Ensure the socket was created
|
|
|
|
if _, err := os.Stat(socket); err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ensure the mode was set properly
|
|
|
|
fi, err := os.Stat(socket)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
if fi.Mode().String() != "Srwxrwxrwx" {
|
|
|
|
t.Fatalf("bad permissions: %s", fi.Mode())
|
|
|
|
}
|
|
|
|
|
|
|
|
// Make an HTTP/2-enabled client, using the API helpers to set
|
|
|
|
// up TLS to be as normal as possible for Consul.
|
|
|
|
tlscfg := &api.TLSConfig{
|
|
|
|
Address: "consul.test",
|
|
|
|
KeyFile: "../test/client_certs/client.key",
|
|
|
|
CertFile: "../test/client_certs/client.crt",
|
|
|
|
CAFile: "../test/client_certs/rootca.crt",
|
|
|
|
}
|
|
|
|
tlsccfg, err := api.SetupTLSConfig(tlscfg)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
transport := api.DefaultConfig().Transport
|
|
|
|
transport.TLSHandshakeTimeout = 30 * time.Second
|
|
|
|
transport.TLSClientConfig = tlsccfg
|
|
|
|
if err := http2.ConfigureTransport(transport); err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
transport.DialContext = func(_ context.Context, _, _ string) (net.Conn, error) {
|
|
|
|
return net.Dial("unix", socket)
|
|
|
|
}
|
|
|
|
client := &http.Client{Transport: transport}
|
|
|
|
|
|
|
|
u, err := url.Parse("https://unix" + socket)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
u.Path = "/v1/agent/self"
|
|
|
|
u.Scheme = "https"
|
|
|
|
resp, err := client.Get(u.String())
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
defer resp.Body.Close()
|
|
|
|
|
|
|
|
if body, err := io.ReadAll(resp.Body); err != nil || len(body) == 0 {
|
|
|
|
t.Fatalf("bad: %s %v", body, err)
|
|
|
|
} else if !strings.Contains(string(body), "NodeName") {
|
|
|
|
t.Fatalf("NodeName not found in results: %s", string(body))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-07-02 21:51:25 +00:00
|
|
|
func TestSetupHTTPServer_HTTP2(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-11-07 23:06:59 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
// Fire up an agent with TLS enabled.
|
2020-03-31 20:24:39 +00:00
|
|
|
a := StartTestAgent(t, TestAgent{
|
2022-08-19 17:07:22 +00:00
|
|
|
UseHTTPS: true,
|
2017-11-07 23:06:59 +00:00
|
|
|
HCL: `
|
2023-02-21 13:28:13 +00:00
|
|
|
tls {
|
|
|
|
defaults {
|
|
|
|
ca_file = "../test/client_certs/rootca.crt"
|
|
|
|
cert_file = "../test/client_certs/server.crt"
|
|
|
|
key_file = "../test/client_certs/server.key"
|
|
|
|
}
|
|
|
|
}
|
2017-11-07 23:06:59 +00:00
|
|
|
`,
|
2019-09-05 17:24:36 +00:00
|
|
|
})
|
2017-11-07 23:06:59 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Make an HTTP/2-enabled client, using the API helpers to set
|
|
|
|
// up TLS to be as normal as possible for Consul.
|
|
|
|
tlscfg := &api.TLSConfig{
|
|
|
|
Address: "consul.test",
|
|
|
|
KeyFile: "../test/client_certs/client.key",
|
|
|
|
CertFile: "../test/client_certs/client.crt",
|
|
|
|
CAFile: "../test/client_certs/rootca.crt",
|
|
|
|
}
|
|
|
|
tlsccfg, err := api.SetupTLSConfig(tlscfg)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
transport := api.DefaultConfig().Transport
|
2019-12-05 12:20:07 +00:00
|
|
|
transport.TLSHandshakeTimeout = 30 * time.Second
|
2017-11-07 23:06:59 +00:00
|
|
|
transport.TLSClientConfig = tlsccfg
|
|
|
|
if err := http2.ConfigureTransport(transport); err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
2020-07-02 20:47:54 +00:00
|
|
|
httpClient := &http.Client{Transport: transport}
|
2017-11-07 23:06:59 +00:00
|
|
|
|
|
|
|
// Hook a handler that echoes back the protocol.
|
|
|
|
handler := func(resp http.ResponseWriter, req *http.Request) {
|
|
|
|
resp.WriteHeader(http.StatusOK)
|
|
|
|
fmt.Fprint(resp, req.Proto)
|
|
|
|
}
|
2020-07-02 20:47:54 +00:00
|
|
|
|
2020-07-02 21:51:25 +00:00
|
|
|
// Create an httpServer to be configured with setupHTTPS, and add our
|
|
|
|
// custom handler.
|
|
|
|
httpServer := &http.Server{}
|
|
|
|
noopConnState := func(net.Conn, http.ConnState) {}
|
|
|
|
err = setupHTTPS(httpServer, noopConnState, time.Second)
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
srvHandler := a.srv.handler()
|
2020-07-02 21:51:25 +00:00
|
|
|
mux, ok := srvHandler.(*wrappedMux)
|
|
|
|
require.True(t, ok, "expected a *wrappedMux, got %T", handler)
|
|
|
|
mux.mux.HandleFunc("/echo", handler)
|
|
|
|
httpServer.Handler = mux
|
|
|
|
|
|
|
|
listener, err := net.Listen("tcp", "127.0.0.1:0")
|
|
|
|
require.NoError(t, err)
|
|
|
|
tlsListener := tls.NewListener(listener, a.tlsConfigurator.IncomingHTTPSConfig())
|
|
|
|
|
|
|
|
go httpServer.Serve(tlsListener)
|
|
|
|
defer httpServer.Shutdown(context.Background())
|
2017-11-07 23:06:59 +00:00
|
|
|
|
|
|
|
// Call it and make sure we see HTTP/2.
|
2020-07-02 21:51:25 +00:00
|
|
|
url := fmt.Sprintf("https://%s/echo", listener.Addr().String())
|
2020-07-02 20:47:54 +00:00
|
|
|
resp, err := httpClient.Get(url)
|
2017-11-07 23:06:59 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
defer resp.Body.Close()
|
2022-11-10 16:26:01 +00:00
|
|
|
body, err := io.ReadAll(resp.Body)
|
2017-11-07 23:06:59 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if !bytes.Equal(body, []byte("HTTP/2.0")) {
|
|
|
|
t.Fatalf("bad: %v", body)
|
|
|
|
}
|
|
|
|
|
|
|
|
// This doesn't have a closed-loop way to verify HTTP/2 support for
|
|
|
|
// some other endpoint, but configure an API client and make a call
|
|
|
|
// just as a sanity check.
|
|
|
|
cfg := &api.Config{
|
2020-07-02 21:51:25 +00:00
|
|
|
Address: listener.Addr().String(),
|
2017-11-07 23:06:59 +00:00
|
|
|
Scheme: "https",
|
2020-07-02 20:47:54 +00:00
|
|
|
HttpClient: httpClient,
|
2017-11-07 23:06:59 +00:00
|
|
|
}
|
|
|
|
client, err := api.NewClient(cfg)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
if _, err := client.Agent().Self(); err != nil {
|
|
|
|
t.Fatalf("err: %v", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-02-05 22:47:42 +00:00
|
|
|
func TestSetIndex(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2014-02-05 22:47:42 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
setIndex(resp, 1000)
|
|
|
|
header := resp.Header().Get("X-Consul-Index")
|
|
|
|
if header != "1000" {
|
|
|
|
t.Fatalf("Bad: %v", header)
|
|
|
|
}
|
2014-10-14 00:53:54 +00:00
|
|
|
setIndex(resp, 2000)
|
|
|
|
if v := resp.Header()["X-Consul-Index"]; len(v) != 1 {
|
|
|
|
t.Fatalf("bad: %#v", v)
|
|
|
|
}
|
2014-02-05 22:47:42 +00:00
|
|
|
}
|
|
|
|
|
2014-04-21 20:19:18 +00:00
|
|
|
func TestSetKnownLeader(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2014-04-21 20:19:18 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
setKnownLeader(resp, true)
|
|
|
|
header := resp.Header().Get("X-Consul-KnownLeader")
|
|
|
|
if header != "true" {
|
|
|
|
t.Fatalf("Bad: %v", header)
|
|
|
|
}
|
|
|
|
resp = httptest.NewRecorder()
|
|
|
|
setKnownLeader(resp, false)
|
|
|
|
header = resp.Header().Get("X-Consul-KnownLeader")
|
|
|
|
if header != "false" {
|
|
|
|
t.Fatalf("Bad: %v", header)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-12-03 17:11:26 +00:00
|
|
|
func TestSetFilteredByACLs(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
setResultsFilteredByACLs(resp, true)
|
|
|
|
header := resp.Header().Get("X-Consul-Results-Filtered-By-ACLs")
|
|
|
|
if header != "true" {
|
|
|
|
t.Fatalf("Bad: %v", header)
|
|
|
|
}
|
|
|
|
resp = httptest.NewRecorder()
|
|
|
|
setResultsFilteredByACLs(resp, false)
|
|
|
|
header = resp.Header().Get("X-Consul-Results-Filtered-By-ACLs")
|
|
|
|
if header != "" {
|
|
|
|
t.Fatalf("Bad: %v", header)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-04-21 20:19:18 +00:00
|
|
|
func TestSetLastContact(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2017-06-01 11:53:27 +00:00
|
|
|
tests := []struct {
|
|
|
|
desc string
|
|
|
|
d time.Duration
|
|
|
|
h string
|
|
|
|
}{
|
|
|
|
{"neg", -1, "0"},
|
|
|
|
{"zero", 0, "0"},
|
|
|
|
{"pos", 123 * time.Millisecond, "123"},
|
|
|
|
{"pos ms only", 123456 * time.Microsecond, "123"},
|
|
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.desc, func(t *testing.T) {
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
setLastContact(resp, tt.d)
|
|
|
|
header := resp.Header().Get("X-Consul-LastContact")
|
|
|
|
if got, want := header, tt.h; got != want {
|
|
|
|
t.Fatalf("got X-Consul-LastContact header %q want %q", got, want)
|
|
|
|
}
|
|
|
|
})
|
2014-04-21 20:19:18 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestSetMeta(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2014-04-21 20:19:18 +00:00
|
|
|
meta := structs.QueryMeta{
|
2021-12-03 17:11:26 +00:00
|
|
|
Index: 1000,
|
|
|
|
KnownLeader: true,
|
|
|
|
LastContact: 123456 * time.Microsecond,
|
|
|
|
ResultsFilteredByACLs: true,
|
2014-04-21 20:19:18 +00:00
|
|
|
}
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
setMeta(resp, &meta)
|
2021-12-03 17:11:26 +00:00
|
|
|
|
|
|
|
testCases := map[string]string{
|
|
|
|
"X-Consul-Index": "1000",
|
|
|
|
"X-Consul-KnownLeader": "true",
|
|
|
|
"X-Consul-LastContact": "123",
|
|
|
|
"X-Consul-Results-Filtered-By-ACLs": "true",
|
2014-04-21 20:19:18 +00:00
|
|
|
}
|
2021-12-03 17:11:26 +00:00
|
|
|
for header, expectedValue := range testCases {
|
|
|
|
if v := resp.Header().Get(header); v != expectedValue {
|
|
|
|
t.Fatalf("expected %q for header %s got %q", expectedValue, header, v)
|
|
|
|
}
|
2014-04-21 20:19:18 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-07-10 20:51:25 +00:00
|
|
|
func TestHTTPAPI_BlockEndpoints(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-07-10 20:51:25 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, `
|
2017-09-25 18:40:42 +00:00
|
|
|
http_config {
|
|
|
|
block_endpoints = ["/v1/agent/self"]
|
|
|
|
}
|
|
|
|
`)
|
2017-07-10 20:51:25 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
handler := func(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Try a blocked endpoint, which should get a 403.
|
|
|
|
{
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/self", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2018-02-12 05:28:20 +00:00
|
|
|
a.srv.wrap(handler, []string{"GET"})(resp, req)
|
2017-07-10 20:51:25 +00:00
|
|
|
if got, want := resp.Code, http.StatusForbidden; got != want {
|
|
|
|
t.Fatalf("bad response code got %d want %d", got, want)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Make sure some other endpoint still works.
|
|
|
|
{
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/checks", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2018-02-12 05:28:20 +00:00
|
|
|
a.srv.wrap(handler, []string{"GET"})(resp, req)
|
2017-07-10 20:51:25 +00:00
|
|
|
if got, want := resp.Code, http.StatusOK; got != want {
|
|
|
|
t.Fatalf("bad response code got %d want %d", got, want)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-12-20 23:47:53 +00:00
|
|
|
func TestHTTPAPI_Ban_Nonprintable_Characters(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2017-12-20 23:47:53 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
2020-05-14 18:41:20 +00:00
|
|
|
_, err := http.NewRequest("GET", "/v1/kv/bad\x00ness", nil)
|
2019-03-26 21:04:58 +00:00
|
|
|
if err == nil {
|
|
|
|
t.Fatal("expected error")
|
|
|
|
}
|
2020-05-14 18:41:20 +00:00
|
|
|
req, err := http.NewRequest("GET", "/v1/kv/bad%00ness", nil)
|
2019-03-26 21:04:58 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2017-12-20 23:47:53 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
a.srv.handler().ServeHTTP(resp, req)
|
2017-12-20 23:47:53 +00:00
|
|
|
if got, want := resp.Code, http.StatusBadRequest; got != want {
|
|
|
|
t.Fatalf("bad response code got %d want %d", got, want)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-07-26 12:53:39 +00:00
|
|
|
func TestHTTPAPI_Allow_Nonprintable_Characters_With_Flag(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "disable_http_unprintable_char_filter = true")
|
2018-07-26 12:53:39 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
2020-05-14 18:41:20 +00:00
|
|
|
_, err := http.NewRequest("GET", "/v1/kv/bad\x00ness", nil)
|
2019-03-26 21:04:58 +00:00
|
|
|
if err == nil {
|
|
|
|
t.Fatal("expected error")
|
|
|
|
}
|
2020-05-14 18:41:20 +00:00
|
|
|
req, err := http.NewRequest("GET", "/v1/kv/bad%00ness", nil)
|
2019-03-26 21:04:58 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
2018-07-26 12:53:39 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
a.srv.handler().ServeHTTP(resp, req)
|
2018-07-26 12:53:39 +00:00
|
|
|
// Key doesn't actually exist so we should get 404
|
|
|
|
if got, want := resp.Code, http.StatusNotFound; got != want {
|
|
|
|
t.Fatalf("bad response code got %d want %d", got, want)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2016-08-16 18:31:41 +00:00
|
|
|
func TestHTTPAPI_TranslateAddrHeader(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2016-08-16 18:31:41 +00:00
|
|
|
// Header should not be present if address translation is off.
|
|
|
|
{
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2016-08-16 18:31:41 +00:00
|
|
|
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
handler := func(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/self", nil)
|
2018-02-12 05:28:20 +00:00
|
|
|
a.srv.wrap(handler, []string{"GET"})(resp, req)
|
2016-08-16 18:31:41 +00:00
|
|
|
|
|
|
|
translate := resp.Header().Get("X-Consul-Translate-Addresses")
|
|
|
|
if translate != "" {
|
|
|
|
t.Fatalf("bad: expected %q, got %q", "", translate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Header should be set to true if it's turned on.
|
|
|
|
{
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, `
|
2017-09-25 18:40:42 +00:00
|
|
|
translate_wan_addrs = true
|
|
|
|
`)
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2016-08-16 18:31:41 +00:00
|
|
|
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
handler := func(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/self", nil)
|
2018-02-12 05:28:20 +00:00
|
|
|
a.srv.wrap(handler, []string{"GET"})(resp, req)
|
2016-08-16 18:31:41 +00:00
|
|
|
|
|
|
|
translate := resp.Header().Get("X-Consul-Translate-Addresses")
|
|
|
|
if translate != "true" {
|
|
|
|
t.Fatalf("bad: expected %q, got %q", "true", translate)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-11-12 16:38:32 +00:00
|
|
|
func TestHTTPAPI_DefaultACLPolicy(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2020-11-12 16:38:32 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
type testcase struct {
|
|
|
|
name string
|
|
|
|
hcl string
|
|
|
|
expect string
|
|
|
|
}
|
|
|
|
|
|
|
|
cases := []testcase{
|
|
|
|
{
|
|
|
|
name: "default is allow",
|
|
|
|
hcl: ``,
|
|
|
|
expect: "allow",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "explicit allow",
|
|
|
|
hcl: `acl { default_policy = "allow" }`,
|
|
|
|
expect: "allow",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "explicit deny",
|
|
|
|
hcl: `acl { default_policy = "deny" }`,
|
|
|
|
expect: "deny",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tc := range cases {
|
|
|
|
tc := tc
|
|
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
a := NewTestAgent(t, tc.hcl)
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
handler := func(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/agent/self", nil)
|
|
|
|
a.srv.wrap(handler, []string{"GET"})(resp, req)
|
|
|
|
|
|
|
|
require.Equal(t, tc.expect, resp.Header().Get("X-Consul-Default-ACL-Policy"))
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2014-12-28 04:53:19 +00:00
|
|
|
func TestHTTPAPIResponseHeaders(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, `
|
2020-09-23 11:37:33 +00:00
|
|
|
ui_config {
|
|
|
|
# Explicitly disable UI so we can ensure the index replacement gets headers too.
|
|
|
|
enabled = false
|
|
|
|
}
|
2017-09-25 18:40:42 +00:00
|
|
|
http_config {
|
|
|
|
response_headers = {
|
|
|
|
"Access-Control-Allow-Origin" = "*"
|
|
|
|
"X-XSS-Protection" = "1; mode=block"
|
2020-09-23 11:37:33 +00:00
|
|
|
"X-Frame-Options" = "SAMEORIGIN"
|
2017-09-25 18:40:42 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
`)
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-12-28 04:53:19 +00:00
|
|
|
|
2024-09-11 19:23:21 +00:00
|
|
|
requireHasHeadersSet(t, a, "/v1/agent/self", "application/json")
|
2014-12-28 04:53:19 +00:00
|
|
|
|
2020-09-23 11:37:33 +00:00
|
|
|
// Check the Index page that just renders a simple message with UI disabled
|
|
|
|
// also gets the right headers.
|
2024-09-11 19:23:21 +00:00
|
|
|
requireHasHeadersSet(t, a, "/", "text/plain; charset=utf-8")
|
2020-09-23 11:37:33 +00:00
|
|
|
}
|
2014-12-28 04:53:19 +00:00
|
|
|
|
2024-11-27 17:30:14 +00:00
|
|
|
func TestHTTPAPIValidateContentTypeHeaders(t *testing.T) {
|
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
|
|
|
t.Parallel()
|
|
|
|
type testcase struct {
|
|
|
|
name string
|
|
|
|
endpoint string
|
|
|
|
method string
|
|
|
|
requestBody io.Reader
|
|
|
|
expectedContentType string
|
|
|
|
}
|
|
|
|
|
|
|
|
cases := []testcase{
|
|
|
|
{
|
|
|
|
name: "snapshot endpoint expect non-default content type",
|
|
|
|
method: http.MethodPut,
|
|
|
|
endpoint: "/v1/snapshot",
|
|
|
|
requestBody: bytes.NewBuffer([]byte("test")),
|
|
|
|
expectedContentType: "application/octet-stream",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "kv endpoint expect non-default content type",
|
|
|
|
method: http.MethodPut,
|
|
|
|
endpoint: "/v1/kv",
|
|
|
|
requestBody: bytes.NewBuffer([]byte("test")),
|
|
|
|
expectedContentType: "application/octet-stream",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "event/fire endpoint expect default content type",
|
|
|
|
method: http.MethodPut,
|
|
|
|
endpoint: "/v1/event/fire",
|
|
|
|
requestBody: bytes.NewBuffer([]byte("test")),
|
|
|
|
expectedContentType: "application/octet-stream",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "peering/token endpoint expect default content type",
|
|
|
|
method: http.MethodPost,
|
|
|
|
endpoint: "/v1/peering/token",
|
|
|
|
requestBody: bytes.NewBuffer([]byte("test")),
|
|
|
|
expectedContentType: "application/json",
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tc := range cases {
|
|
|
|
tc := tc
|
|
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
a := NewTestAgent(t, "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
requireContentTypeHeadersSet(t, a, tc.method, tc.endpoint, tc.requestBody, tc.expectedContentType)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func requireContentTypeHeadersSet(t *testing.T, a *TestAgent, method, path string, body io.Reader, contentType string) {
|
|
|
|
t.Helper()
|
|
|
|
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
req, _ := http.NewRequest(method, path, body)
|
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
a.srv.handler().ServeHTTP(resp, req)
|
|
|
|
|
|
|
|
reqHdrs := req.Header
|
|
|
|
respHdrs := resp.Header()
|
|
|
|
|
|
|
|
// require request content-type
|
|
|
|
require.NotEmpty(t, reqHdrs.Get("Content-Type"))
|
|
|
|
require.Equal(t, contentType, reqHdrs.Get("Content-Type"),
|
|
|
|
"Request Header Content-Type value incorrect")
|
|
|
|
|
|
|
|
// require response content-type
|
|
|
|
require.NotEmpty(t, respHdrs.Get("Content-Type"))
|
|
|
|
require.Equal(t, contentType, respHdrs.Get("Content-Type"),
|
|
|
|
"Response Header Content-Type value incorrect")
|
|
|
|
}
|
|
|
|
|
2024-09-11 19:23:21 +00:00
|
|
|
func requireHasHeadersSet(t *testing.T, a *TestAgent, path string, contentType string) {
|
2020-09-23 11:37:33 +00:00
|
|
|
t.Helper()
|
2014-12-28 04:53:19 +00:00
|
|
|
|
2020-09-23 11:37:33 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
req, _ := http.NewRequest("GET", path, nil)
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
a.srv.handler().ServeHTTP(resp, req)
|
2020-09-23 11:37:33 +00:00
|
|
|
|
|
|
|
hdrs := resp.Header()
|
|
|
|
require.Equal(t, "*", hdrs.Get("Access-Control-Allow-Origin"),
|
|
|
|
"Access-Control-Allow-Origin header value incorrect")
|
|
|
|
|
|
|
|
require.Equal(t, "1; mode=block", hdrs.Get("X-XSS-Protection"),
|
|
|
|
"X-XSS-Protection header value incorrect")
|
2024-09-11 19:23:21 +00:00
|
|
|
|
|
|
|
require.Equal(t, contentType, hdrs.Get("Content-Type"),
|
2024-11-27 17:30:14 +00:00
|
|
|
"Response Content-Type header value incorrect")
|
2014-12-28 04:53:19 +00:00
|
|
|
}
|
2020-09-23 11:37:33 +00:00
|
|
|
|
2020-03-03 13:18:35 +00:00
|
|
|
func TestUIResponseHeaders(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2020-03-03 13:18:35 +00:00
|
|
|
t.Parallel()
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, `
|
2020-03-03 13:18:35 +00:00
|
|
|
http_config {
|
|
|
|
response_headers = {
|
|
|
|
"Access-Control-Allow-Origin" = "*"
|
2020-09-23 11:37:33 +00:00
|
|
|
"X-XSS-Protection" = "1; mode=block"
|
2020-03-03 13:18:35 +00:00
|
|
|
"X-Frame-Options" = "SAMEORIGIN"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`)
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
2024-09-11 19:23:21 +00:00
|
|
|
//response header for the UI appears to be being handled by the UI itself.
|
|
|
|
requireHasHeadersSet(t, a, "/ui", "text/plain; charset=utf-8")
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestErrorContentTypeHeaderSet(t *testing.T) {
|
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
|
|
|
t.Parallel()
|
|
|
|
a := NewTestAgent(t, `
|
|
|
|
http_config {
|
|
|
|
response_headers = {
|
|
|
|
"Access-Control-Allow-Origin" = "*"
|
|
|
|
"X-XSS-Protection" = "1; mode=block"
|
|
|
|
"X-Frame-Options" = "SAMEORIGIN"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
`)
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
2024-11-27 17:30:14 +00:00
|
|
|
requireHasHeadersSet(t, a, "/fake-path-doesn't-exist", "application/json")
|
2020-03-03 13:18:35 +00:00
|
|
|
}
|
2014-12-28 04:53:19 +00:00
|
|
|
|
2020-06-08 08:10:08 +00:00
|
|
|
func TestAcceptEncodingGzip(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2020-06-08 08:10:08 +00:00
|
|
|
t.Parallel()
|
|
|
|
a := NewTestAgent(t, "")
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Setting up the KV to store a short and a long value
|
|
|
|
buf := bytes.NewBuffer([]byte("short"))
|
|
|
|
req, _ := http.NewRequest("PUT", "/v1/kv/short", buf)
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
_, err := a.srv.KVSEndpoint(resp, req)
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
// this generates a string which is longer than
|
|
|
|
// gziphandler.DefaultMinSize to trigger compression.
|
|
|
|
long := fmt.Sprintf(fmt.Sprintf("%%0%dd", gziphandler.DefaultMinSize+1), 1)
|
|
|
|
buf = bytes.NewBuffer([]byte(long))
|
|
|
|
req, _ = http.NewRequest("PUT", "/v1/kv/long", buf)
|
|
|
|
resp = httptest.NewRecorder()
|
|
|
|
_, err = a.srv.KVSEndpoint(resp, req)
|
|
|
|
require.NoError(t, err)
|
|
|
|
|
|
|
|
resp = httptest.NewRecorder()
|
|
|
|
req, _ = http.NewRequest("GET", "/v1/kv/short", nil)
|
|
|
|
// Usually this would be automatically set by transport content
|
|
|
|
// negotiation, but since this call doesn't go through a real
|
|
|
|
// transport, the header has to be set manually
|
|
|
|
req.Header["Accept-Encoding"] = []string{"gzip"}
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
a.srv.handler().ServeHTTP(resp, req)
|
2020-06-08 08:10:08 +00:00
|
|
|
require.Equal(t, 200, resp.Code)
|
|
|
|
require.Equal(t, "", resp.Header().Get("Content-Encoding"))
|
|
|
|
|
|
|
|
resp = httptest.NewRecorder()
|
|
|
|
req, _ = http.NewRequest("GET", "/v1/kv/long", nil)
|
|
|
|
req.Header["Accept-Encoding"] = []string{"gzip"}
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
a.srv.handler().ServeHTTP(resp, req)
|
2020-06-08 08:10:08 +00:00
|
|
|
require.Equal(t, 200, resp.Code)
|
|
|
|
require.Equal(t, "gzip", resp.Header().Get("Content-Encoding"))
|
|
|
|
}
|
|
|
|
|
2014-04-17 18:38:14 +00:00
|
|
|
func TestContentTypeIsJSON(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2014-04-17 18:38:14 +00:00
|
|
|
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
handler := func(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
|
|
|
|
// stub out a DirEntry so that it will be encoded as JSON
|
|
|
|
return &structs.DirEntry{Key: "key"}, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("GET", "/v1/kv/key", nil)
|
2018-02-12 05:28:20 +00:00
|
|
|
a.srv.wrap(handler, []string{"GET"})(resp, req)
|
2014-04-17 18:38:14 +00:00
|
|
|
|
|
|
|
contentType := resp.Header().Get("Content-Type")
|
|
|
|
|
|
|
|
if contentType != "application/json" {
|
|
|
|
t.Fatalf("Content-Type header was not 'application/json'")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-04-12 18:17:31 +00:00
|
|
|
func TestHTTP_wrap_obfuscateLog(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2021-06-08 23:11:34 +00:00
|
|
|
buf := &syncBuffer{b: new(bytes.Buffer)}
|
2022-02-03 22:07:39 +00:00
|
|
|
a := StartTestAgent(t, TestAgent{
|
|
|
|
LogOutput: buf,
|
|
|
|
LogLevel: hclog.Debug,
|
|
|
|
})
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-04-12 18:17:31 +00:00
|
|
|
|
|
|
|
handler := func(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
|
|
|
|
return nil, nil
|
|
|
|
}
|
|
|
|
|
2017-07-15 07:07:08 +00:00
|
|
|
for _, pair := range [][]string{
|
|
|
|
{
|
|
|
|
"/some/url?token=secret1&token=secret2",
|
|
|
|
"/some/url?token=<hidden>&token=<hidden>",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"/v1/acl/clone/secret1",
|
|
|
|
"/v1/acl/clone/<hidden>",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"/v1/acl/clone/secret1?token=secret2",
|
|
|
|
"/v1/acl/clone/<hidden>?token=<hidden>",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"/v1/acl/destroy/secret1",
|
|
|
|
"/v1/acl/destroy/<hidden>",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"/v1/acl/destroy/secret1?token=secret2",
|
|
|
|
"/v1/acl/destroy/<hidden>?token=<hidden>",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"/v1/acl/info/secret1",
|
|
|
|
"/v1/acl/info/<hidden>",
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"/v1/acl/info/secret1?token=secret2",
|
|
|
|
"/v1/acl/info/<hidden>?token=<hidden>",
|
|
|
|
},
|
|
|
|
} {
|
|
|
|
url, want := pair[0], pair[1]
|
|
|
|
t.Run(url, func(t *testing.T) {
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
req, _ := http.NewRequest("GET", url, nil)
|
2018-02-12 05:28:20 +00:00
|
|
|
a.srv.wrap(handler, []string{"GET"})(resp, req)
|
2020-01-28 23:50:41 +00:00
|
|
|
bufout := buf.String()
|
2022-02-03 22:07:39 +00:00
|
|
|
require.Contains(t, bufout, want)
|
2017-07-15 07:07:08 +00:00
|
|
|
})
|
2015-04-12 18:17:31 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-01-01 22:27:10 +00:00
|
|
|
func TestPrettyPrint(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2015-01-02 08:14:44 +00:00
|
|
|
testPrettyPrint("pretty=1", t)
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestPrettyPrintBare(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2015-01-02 08:14:44 +00:00
|
|
|
testPrettyPrint("pretty", t)
|
|
|
|
}
|
|
|
|
|
|
|
|
func testPrettyPrint(pretty string, t *testing.T) {
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-01-01 22:27:10 +00:00
|
|
|
|
|
|
|
r := &structs.DirEntry{Key: "key"}
|
|
|
|
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
handler := func(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
|
|
|
|
return r, nil
|
|
|
|
}
|
|
|
|
|
2015-01-02 08:14:44 +00:00
|
|
|
urlStr := "/v1/kv/key?" + pretty
|
|
|
|
req, _ := http.NewRequest("GET", urlStr, nil)
|
2018-02-12 05:28:20 +00:00
|
|
|
a.srv.wrap(handler, []string{"GET"})(resp, req)
|
2015-01-01 22:27:10 +00:00
|
|
|
|
|
|
|
expected, _ := json.MarshalIndent(r, "", " ")
|
2016-05-10 21:37:05 +00:00
|
|
|
expected = append(expected, "\n"...)
|
2022-11-10 16:26:01 +00:00
|
|
|
actual, err := io.ReadAll(resp.Body)
|
2015-01-01 22:27:10 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("err: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
if !bytes.Equal(expected, actual) {
|
|
|
|
t.Fatalf("bad: %q", string(actual))
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-06-30 21:25:40 +00:00
|
|
|
func TestParseSource(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2017-05-21 07:11:09 +00:00
|
|
|
defer a.Shutdown()
|
2015-06-30 21:25:40 +00:00
|
|
|
|
|
|
|
// Default is agent's DC and no node (since the user didn't care, then
|
|
|
|
// just give them the cheapest possible query).
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
2015-06-30 21:25:40 +00:00
|
|
|
source := structs.QuerySource{}
|
2017-05-21 07:11:09 +00:00
|
|
|
a.srv.parseSource(req, &source)
|
2015-06-30 21:25:40 +00:00
|
|
|
if source.Datacenter != "dc1" || source.Node != "" {
|
|
|
|
t.Fatalf("bad: %v", source)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Adding the source parameter should set that node.
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ = http.NewRequest("GET", "/v1/catalog/nodes?near=bob", nil)
|
2015-06-30 21:25:40 +00:00
|
|
|
source = structs.QuerySource{}
|
2017-05-21 07:11:09 +00:00
|
|
|
a.srv.parseSource(req, &source)
|
2015-06-30 21:25:40 +00:00
|
|
|
if source.Datacenter != "dc1" || source.Node != "bob" {
|
|
|
|
t.Fatalf("bad: %v", source)
|
|
|
|
}
|
|
|
|
|
|
|
|
// We should follow whatever dc parameter was given so that the node is
|
|
|
|
// looked up correctly on the receiving end.
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ = http.NewRequest("GET", "/v1/catalog/nodes?near=bob&dc=foo", nil)
|
2015-06-30 21:25:40 +00:00
|
|
|
source = structs.QuerySource{}
|
2017-05-21 07:11:09 +00:00
|
|
|
a.srv.parseSource(req, &source)
|
2015-06-30 21:25:40 +00:00
|
|
|
if source.Datacenter != "foo" || source.Node != "bob" {
|
|
|
|
t.Fatalf("bad: %v", source)
|
|
|
|
}
|
2015-07-24 21:30:53 +00:00
|
|
|
|
Accept ap, datacenter, and namespace query params (#17525)
This commit only contains the OSS PR (datacenter query param support).
A separate enterprise PR adds support for ap and namespace query params.
Resources in Consul can exists within scopes such as datacenters, cluster
peers, admin partitions, and namespaces. You can refer to those resources from
interfaces such as the CLI, HTTP API, DNS, and configuration files.
Some scope levels have consistent naming: cluster peers are always referred to
as "peer".
Other scope levels use a short-hand in DNS lookups...
- "ns" for namespace
- "ap" for admin partition
- "dc" for datacenter
...But use long-hand in CLI commands:
- "namespace" for namespace
- "partition" for admin partition
- and "datacenter"
However, HTTP API query parameters do not follow a consistent pattern,
supporting short-hand for some scopes but long-hand for others:
- "ns" for namespace
- "partition" for admin partition
- and "dc" for datacenter.
This inconsistency is confusing, especially for users who have been exposed to
providing scope names through another interface such as CLI or DNS queries.
This commit improves UX by consistently supporting both short-hand and
long-hand forms of the namespace, partition, and datacenter scopes in HTTP API
query parameters.
2023-05-31 15:50:24 +00:00
|
|
|
// We should follow whatever datacenter parameter was given so that the node is
|
|
|
|
// looked up correctly on the receiving end.
|
|
|
|
req, _ = http.NewRequest("GET", "/v1/catalog/nodes?near=bob&datacenter=foo", nil)
|
|
|
|
source = structs.QuerySource{}
|
|
|
|
a.srv.parseSource(req, &source)
|
|
|
|
if source.Datacenter != "foo" || source.Node != "bob" {
|
|
|
|
t.Fatalf("bad: %v", source)
|
|
|
|
}
|
|
|
|
|
2015-07-28 17:39:37 +00:00
|
|
|
// The magic "_agent" node name will use the agent's local node name.
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ = http.NewRequest("GET", "/v1/catalog/nodes?near=_agent", nil)
|
2015-07-24 21:30:53 +00:00
|
|
|
source = structs.QuerySource{}
|
2017-05-21 07:11:09 +00:00
|
|
|
a.srv.parseSource(req, &source)
|
|
|
|
if source.Datacenter != "dc1" || source.Node != a.Config.NodeName {
|
2015-07-24 21:30:53 +00:00
|
|
|
t.Fatalf("bad: %v", source)
|
|
|
|
}
|
2015-06-30 21:25:40 +00:00
|
|
|
}
|
|
|
|
|
2018-09-06 10:34:28 +00:00
|
|
|
func TestParseCacheControl(t *testing.T) {
|
|
|
|
|
|
|
|
tests := []struct {
|
|
|
|
name string
|
|
|
|
headerVal string
|
|
|
|
want structs.QueryOptions
|
|
|
|
wantErr bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
name: "empty header",
|
|
|
|
headerVal: "",
|
|
|
|
want: structs.QueryOptions{},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "simple max-age",
|
|
|
|
headerVal: "max-age=30",
|
|
|
|
want: structs.QueryOptions{
|
|
|
|
MaxAge: 30 * time.Second,
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "zero max-age",
|
|
|
|
headerVal: "max-age=0",
|
|
|
|
want: structs.QueryOptions{
|
|
|
|
MustRevalidate: true,
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "must-revalidate",
|
|
|
|
headerVal: "must-revalidate",
|
|
|
|
want: structs.QueryOptions{
|
|
|
|
MustRevalidate: true,
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "mixes age, must-revalidate",
|
|
|
|
headerVal: "max-age=123, must-revalidate",
|
|
|
|
want: structs.QueryOptions{
|
|
|
|
MaxAge: 123 * time.Second,
|
|
|
|
MustRevalidate: true,
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "quoted max-age",
|
|
|
|
headerVal: "max-age=\"30\"",
|
|
|
|
want: structs.QueryOptions{},
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "mixed case max-age",
|
|
|
|
headerVal: "Max-Age=30",
|
|
|
|
want: structs.QueryOptions{
|
|
|
|
MaxAge: 30 * time.Second,
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "simple stale-if-error",
|
|
|
|
headerVal: "stale-if-error=300",
|
|
|
|
want: structs.QueryOptions{
|
|
|
|
StaleIfError: 300 * time.Second,
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "combined with space",
|
|
|
|
headerVal: "max-age=30, stale-if-error=300",
|
|
|
|
want: structs.QueryOptions{
|
|
|
|
MaxAge: 30 * time.Second,
|
|
|
|
StaleIfError: 300 * time.Second,
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "combined no space",
|
|
|
|
headerVal: "stale-IF-error=300,max-age=30",
|
|
|
|
want: structs.QueryOptions{
|
|
|
|
MaxAge: 30 * time.Second,
|
|
|
|
StaleIfError: 300 * time.Second,
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "unsupported directive",
|
|
|
|
headerVal: "no-cache",
|
|
|
|
want: structs.QueryOptions{},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "mixed unsupported directive",
|
|
|
|
headerVal: "no-cache, max-age=120",
|
|
|
|
want: structs.QueryOptions{
|
|
|
|
MaxAge: 120 * time.Second,
|
|
|
|
},
|
|
|
|
wantErr: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "garbage value",
|
|
|
|
headerVal: "max-age=\"I'm not, an int\"",
|
|
|
|
want: structs.QueryOptions{},
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
name: "garbage value with quotes",
|
|
|
|
headerVal: "max-age=\"I'm \\\"not an int\"",
|
|
|
|
want: structs.QueryOptions{},
|
|
|
|
wantErr: true,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tt := range tests {
|
|
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
|
|
|
|
|
|
r, _ := http.NewRequest("GET", "/foo/bar", nil)
|
|
|
|
if tt.headerVal != "" {
|
|
|
|
r.Header.Set("Cache-Control", tt.headerVal)
|
|
|
|
}
|
|
|
|
|
|
|
|
rr := httptest.NewRecorder()
|
|
|
|
var got structs.QueryOptions
|
|
|
|
|
|
|
|
failed := parseCacheControl(rr, r, &got)
|
|
|
|
if tt.wantErr {
|
bulk rewrite using this script
set -euo pipefail
unset CDPATH
cd "$(dirname "$0")"
for f in $(git grep '\brequire := require\.New(' | cut -d':' -f1 | sort -u); do
echo "=== require: $f ==="
sed -i '/require := require.New(t)/d' $f
# require.XXX(blah) but not require.XXX(tblah) or require.XXX(rblah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\([^tr]\)/require.\1(t,\2/g' $f
# require.XXX(tblah) but not require.XXX(t, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/require.\1(t,\2/g' $f
# require.XXX(rblah) but not require.XXX(r, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/require.\1(t,\2/g' $f
gofmt -s -w $f
done
for f in $(git grep '\bassert := assert\.New(' | cut -d':' -f1 | sort -u); do
echo "=== assert: $f ==="
sed -i '/assert := assert.New(t)/d' $f
# assert.XXX(blah) but not assert.XXX(tblah) or assert.XXX(rblah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\([^tr]\)/assert.\1(t,\2/g' $f
# assert.XXX(tblah) but not assert.XXX(t, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/assert.\1(t,\2/g' $f
# assert.XXX(rblah) but not assert.XXX(r, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/assert.\1(t,\2/g' $f
gofmt -s -w $f
done
2022-01-20 16:46:23 +00:00
|
|
|
require.True(t, failed)
|
|
|
|
require.Equal(t, http.StatusBadRequest, rr.Code)
|
2018-09-06 10:34:28 +00:00
|
|
|
} else {
|
bulk rewrite using this script
set -euo pipefail
unset CDPATH
cd "$(dirname "$0")"
for f in $(git grep '\brequire := require\.New(' | cut -d':' -f1 | sort -u); do
echo "=== require: $f ==="
sed -i '/require := require.New(t)/d' $f
# require.XXX(blah) but not require.XXX(tblah) or require.XXX(rblah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\([^tr]\)/require.\1(t,\2/g' $f
# require.XXX(tblah) but not require.XXX(t, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/require.\1(t,\2/g' $f
# require.XXX(rblah) but not require.XXX(r, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/require.\1(t,\2/g' $f
gofmt -s -w $f
done
for f in $(git grep '\bassert := assert\.New(' | cut -d':' -f1 | sort -u); do
echo "=== assert: $f ==="
sed -i '/assert := assert.New(t)/d' $f
# assert.XXX(blah) but not assert.XXX(tblah) or assert.XXX(rblah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\([^tr]\)/assert.\1(t,\2/g' $f
# assert.XXX(tblah) but not assert.XXX(t, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/assert.\1(t,\2/g' $f
# assert.XXX(rblah) but not assert.XXX(r, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/assert.\1(t,\2/g' $f
gofmt -s -w $f
done
2022-01-20 16:46:23 +00:00
|
|
|
require.False(t, failed)
|
2018-09-06 10:34:28 +00:00
|
|
|
}
|
|
|
|
|
bulk rewrite using this script
set -euo pipefail
unset CDPATH
cd "$(dirname "$0")"
for f in $(git grep '\brequire := require\.New(' | cut -d':' -f1 | sort -u); do
echo "=== require: $f ==="
sed -i '/require := require.New(t)/d' $f
# require.XXX(blah) but not require.XXX(tblah) or require.XXX(rblah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\([^tr]\)/require.\1(t,\2/g' $f
# require.XXX(tblah) but not require.XXX(t, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/require.\1(t,\2/g' $f
# require.XXX(rblah) but not require.XXX(r, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/require.\1(t,\2/g' $f
gofmt -s -w $f
done
for f in $(git grep '\bassert := assert\.New(' | cut -d':' -f1 | sort -u); do
echo "=== assert: $f ==="
sed -i '/assert := assert.New(t)/d' $f
# assert.XXX(blah) but not assert.XXX(tblah) or assert.XXX(rblah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\([^tr]\)/assert.\1(t,\2/g' $f
# assert.XXX(tblah) but not assert.XXX(t, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/assert.\1(t,\2/g' $f
# assert.XXX(rblah) but not assert.XXX(r, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/assert.\1(t,\2/g' $f
gofmt -s -w $f
done
2022-01-20 16:46:23 +00:00
|
|
|
require.Equal(t, tt.want, got)
|
2018-09-06 10:34:28 +00:00
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-02-05 22:47:42 +00:00
|
|
|
func TestParseWait(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2014-02-05 22:47:42 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2014-04-21 20:11:05 +00:00
|
|
|
var b structs.QueryOptions
|
2014-02-05 22:47:42 +00:00
|
|
|
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/catalog/nodes?wait=60s&index=1000", nil)
|
2014-02-05 22:47:42 +00:00
|
|
|
if d := parseWait(resp, req, &b); d {
|
|
|
|
t.Fatalf("unexpected done")
|
|
|
|
}
|
|
|
|
|
|
|
|
if b.MinQueryIndex != 1000 {
|
|
|
|
t.Fatalf("Bad: %v", b)
|
|
|
|
}
|
|
|
|
if b.MaxQueryTime != 60*time.Second {
|
|
|
|
t.Fatalf("Bad: %v", b)
|
|
|
|
}
|
|
|
|
}
|
2019-08-27 21:16:41 +00:00
|
|
|
|
2020-07-02 20:47:54 +00:00
|
|
|
func TestHTTPServer_PProfHandlers_EnableDebug(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2018-10-17 20:20:35 +00:00
|
|
|
t.Parallel()
|
2020-07-02 20:47:54 +00:00
|
|
|
a := NewTestAgent(t, ``)
|
2018-10-17 20:20:35 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
resp := httptest.NewRecorder()
|
2019-08-29 17:06:50 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/debug/pprof/profile?seconds=1", nil)
|
2018-10-17 20:20:35 +00:00
|
|
|
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
2020-09-04 18:42:15 +00:00
|
|
|
httpServer := &HTTPHandlers{agent: a.Agent}
|
2023-06-30 03:00:29 +00:00
|
|
|
httpServer.handler().ServeHTTP(resp, req)
|
2018-10-17 20:20:35 +00:00
|
|
|
|
2020-07-02 20:47:54 +00:00
|
|
|
require.Equal(t, http.StatusOK, resp.Code)
|
2018-10-17 20:20:35 +00:00
|
|
|
}
|
2019-08-27 21:16:41 +00:00
|
|
|
|
2020-07-02 20:47:54 +00:00
|
|
|
func TestHTTPServer_PProfHandlers_DisableDebugNoACLs(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2018-10-17 20:20:35 +00:00
|
|
|
t.Parallel()
|
2020-07-02 20:47:54 +00:00
|
|
|
a := NewTestAgent(t, ``)
|
2018-10-17 20:20:35 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
req, _ := http.NewRequest("GET", "/debug/pprof/profile", nil)
|
|
|
|
|
2020-09-04 18:42:15 +00:00
|
|
|
httpServer := &HTTPHandlers{agent: a.Agent}
|
2023-06-30 03:00:29 +00:00
|
|
|
httpServer.handler().ServeHTTP(resp, req)
|
2018-10-17 20:20:35 +00:00
|
|
|
|
2022-10-27 13:25:18 +00:00
|
|
|
require.Equal(t, http.StatusNotFound, resp.Code)
|
2018-10-17 20:20:35 +00:00
|
|
|
}
|
|
|
|
|
2020-07-02 20:47:54 +00:00
|
|
|
func TestHTTPServer_PProfHandlers_ACLs(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2018-10-17 20:20:35 +00:00
|
|
|
t.Parallel()
|
|
|
|
dc1 := "dc1"
|
|
|
|
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, `
|
2021-12-07 12:48:50 +00:00
|
|
|
primary_datacenter = "`+dc1+`"
|
|
|
|
|
|
|
|
acl {
|
|
|
|
enabled = true
|
|
|
|
default_policy = "deny"
|
|
|
|
|
|
|
|
tokens {
|
|
|
|
initial_management = "root"
|
|
|
|
agent = "agent"
|
|
|
|
agent_recovery = "towel"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
enable_debug = false
|
|
|
|
`)
|
2018-10-17 20:20:35 +00:00
|
|
|
|
|
|
|
cases := []struct {
|
|
|
|
code int
|
|
|
|
token string
|
|
|
|
endpoint string
|
|
|
|
nilResponse bool
|
|
|
|
}{
|
|
|
|
{
|
|
|
|
code: http.StatusOK,
|
2021-12-07 12:48:50 +00:00
|
|
|
token: "root",
|
2018-10-17 20:20:35 +00:00
|
|
|
endpoint: "/debug/pprof/heap",
|
|
|
|
nilResponse: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
code: http.StatusForbidden,
|
|
|
|
token: "agent",
|
|
|
|
endpoint: "/debug/pprof/heap",
|
|
|
|
nilResponse: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
code: http.StatusForbidden,
|
|
|
|
token: "agent",
|
|
|
|
endpoint: "/debug/pprof/",
|
|
|
|
nilResponse: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
code: http.StatusForbidden,
|
|
|
|
token: "",
|
|
|
|
endpoint: "/debug/pprof/",
|
|
|
|
nilResponse: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
code: http.StatusOK,
|
2021-12-07 12:48:50 +00:00
|
|
|
token: "root",
|
2018-10-17 20:20:35 +00:00
|
|
|
endpoint: "/debug/pprof/heap",
|
|
|
|
nilResponse: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
code: http.StatusForbidden,
|
|
|
|
token: "towel",
|
|
|
|
endpoint: "/debug/pprof/heap",
|
|
|
|
nilResponse: true,
|
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
defer a.Shutdown()
|
|
|
|
testrpc.WaitForLeader(t, a.RPC, "dc1")
|
|
|
|
|
|
|
|
for i, c := range cases {
|
|
|
|
t.Run(fmt.Sprintf("case %d (%#v)", i, c), func(t *testing.T) {
|
|
|
|
req, _ := http.NewRequest("GET", fmt.Sprintf("%s?token=%s", c.endpoint, c.token), nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
a.srv.handler().ServeHTTP(resp, req)
|
bulk rewrite using this script
set -euo pipefail
unset CDPATH
cd "$(dirname "$0")"
for f in $(git grep '\brequire := require\.New(' | cut -d':' -f1 | sort -u); do
echo "=== require: $f ==="
sed -i '/require := require.New(t)/d' $f
# require.XXX(blah) but not require.XXX(tblah) or require.XXX(rblah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\([^tr]\)/require.\1(t,\2/g' $f
# require.XXX(tblah) but not require.XXX(t, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/require.\1(t,\2/g' $f
# require.XXX(rblah) but not require.XXX(r, blah)
sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/require.\1(t,\2/g' $f
gofmt -s -w $f
done
for f in $(git grep '\bassert := assert\.New(' | cut -d':' -f1 | sort -u); do
echo "=== assert: $f ==="
sed -i '/assert := assert.New(t)/d' $f
# assert.XXX(blah) but not assert.XXX(tblah) or assert.XXX(rblah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\([^tr]\)/assert.\1(t,\2/g' $f
# assert.XXX(tblah) but not assert.XXX(t, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/assert.\1(t,\2/g' $f
# assert.XXX(rblah) but not assert.XXX(r, blah)
sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/assert.\1(t,\2/g' $f
gofmt -s -w $f
done
2022-01-20 16:46:23 +00:00
|
|
|
assert.Equal(t, c.code, resp.Code)
|
2018-10-17 20:20:35 +00:00
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2014-02-05 22:47:42 +00:00
|
|
|
|
|
|
|
func TestParseWait_InvalidTime(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2014-02-05 22:47:42 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2014-04-21 20:11:05 +00:00
|
|
|
var b structs.QueryOptions
|
2014-02-05 22:47:42 +00:00
|
|
|
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/catalog/nodes?wait=60foo&index=1000", nil)
|
2014-02-05 22:47:42 +00:00
|
|
|
if d := parseWait(resp, req, &b); !d {
|
|
|
|
t.Fatalf("expected done")
|
|
|
|
}
|
|
|
|
|
|
|
|
if resp.Code != 400 {
|
|
|
|
t.Fatalf("bad code: %v", resp.Code)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestParseWait_InvalidIndex(t *testing.T) {
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2014-02-05 22:47:42 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2014-04-21 20:11:05 +00:00
|
|
|
var b structs.QueryOptions
|
2014-02-05 22:47:42 +00:00
|
|
|
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/catalog/nodes?wait=60s&index=foo", nil)
|
2014-02-05 22:47:42 +00:00
|
|
|
if d := parseWait(resp, req, &b); !d {
|
|
|
|
t.Fatalf("expected done")
|
|
|
|
}
|
|
|
|
|
|
|
|
if resp.Code != 400 {
|
|
|
|
t.Fatalf("bad code: %v", resp.Code)
|
|
|
|
}
|
|
|
|
}
|
2014-04-21 20:11:05 +00:00
|
|
|
|
2014-04-21 20:19:18 +00:00
|
|
|
func TestParseConsistency(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2014-04-21 20:19:18 +00:00
|
|
|
resp := httptest.NewRecorder()
|
2017-06-27 05:04:55 +00:00
|
|
|
var b structs.QueryOptions
|
2014-04-21 20:19:18 +00:00
|
|
|
|
2017-06-27 05:04:55 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/catalog/nodes?stale", nil)
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2018-03-30 15:14:44 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
if d := a.srv.parseConsistency(resp, req, &b); d {
|
2017-06-27 05:04:55 +00:00
|
|
|
t.Fatalf("unexpected done")
|
2014-04-21 20:19:18 +00:00
|
|
|
}
|
|
|
|
|
2017-06-27 05:04:55 +00:00
|
|
|
if !b.AllowStale {
|
|
|
|
t.Fatalf("Bad: %v", b)
|
|
|
|
}
|
|
|
|
if b.RequireConsistent {
|
|
|
|
t.Fatalf("Bad: %v", b)
|
|
|
|
}
|
|
|
|
|
|
|
|
b = structs.QueryOptions{}
|
|
|
|
req, _ = http.NewRequest("GET", "/v1/catalog/nodes?consistent", nil)
|
2018-03-30 15:14:44 +00:00
|
|
|
if d := a.srv.parseConsistency(resp, req, &b); d {
|
2017-06-27 05:04:55 +00:00
|
|
|
t.Fatalf("unexpected done")
|
|
|
|
}
|
|
|
|
|
|
|
|
if b.AllowStale {
|
|
|
|
t.Fatalf("Bad: %v", b)
|
|
|
|
}
|
|
|
|
if !b.RequireConsistent {
|
|
|
|
t.Fatalf("Bad: %v", b)
|
2014-04-21 20:19:18 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-03-30 15:14:44 +00:00
|
|
|
// ensureConsistency check if consistency modes are correctly applied
|
|
|
|
// if maxStale < 0 => stale, without MaxStaleDuration
|
|
|
|
// if maxStale == 0 => no stale
|
|
|
|
// if maxStale > 0 => stale + check duration
|
|
|
|
func ensureConsistency(t *testing.T, a *TestAgent, path string, maxStale time.Duration, requireConsistent bool) {
|
|
|
|
t.Helper()
|
|
|
|
req, _ := http.NewRequest("GET", path, nil)
|
|
|
|
var b structs.QueryOptions
|
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
if d := a.srv.parseConsistency(resp, req, &b); d {
|
|
|
|
t.Fatalf("unexpected done")
|
|
|
|
}
|
|
|
|
allowStale := maxStale.Nanoseconds() != 0
|
|
|
|
if b.AllowStale != allowStale {
|
|
|
|
t.Fatalf("Bad Allow Stale")
|
|
|
|
}
|
|
|
|
if maxStale > 0 && b.MaxStaleDuration != maxStale {
|
|
|
|
t.Fatalf("Bad MaxStaleDuration: %d VS expected %d", b.MaxStaleDuration, maxStale)
|
|
|
|
}
|
|
|
|
if b.RequireConsistent != requireConsistent {
|
|
|
|
t.Fatal("Bad Consistent")
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestParseConsistencyAndMaxStale(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2018-03-30 15:14:44 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
// Default => Consistent
|
|
|
|
a.config.DiscoveryMaxStale = time.Duration(0)
|
|
|
|
ensureConsistency(t, a, "/v1/catalog/nodes", 0, false)
|
|
|
|
// Stale, without MaxStale
|
|
|
|
ensureConsistency(t, a, "/v1/catalog/nodes?stale", -1, false)
|
|
|
|
// Override explicitly
|
|
|
|
ensureConsistency(t, a, "/v1/catalog/nodes?max_stale=3s", 3*time.Second, false)
|
|
|
|
ensureConsistency(t, a, "/v1/catalog/nodes?stale&max_stale=3s", 3*time.Second, false)
|
|
|
|
|
|
|
|
// stale by defaul on discovery
|
2020-04-16 17:35:28 +00:00
|
|
|
a.config.DiscoveryMaxStale = 7 * time.Second
|
2018-03-30 15:14:44 +00:00
|
|
|
ensureConsistency(t, a, "/v1/catalog/nodes", a.config.DiscoveryMaxStale, false)
|
|
|
|
// Not in KV
|
|
|
|
ensureConsistency(t, a, "/v1/kv/my/path", 0, false)
|
|
|
|
|
|
|
|
// DiscoveryConsistencyLevel should apply
|
|
|
|
ensureConsistency(t, a, "/v1/health/service/one", a.config.DiscoveryMaxStale, false)
|
|
|
|
ensureConsistency(t, a, "/v1/catalog/service/one", a.config.DiscoveryMaxStale, false)
|
|
|
|
ensureConsistency(t, a, "/v1/catalog/services", a.config.DiscoveryMaxStale, false)
|
|
|
|
|
|
|
|
// Query path should be taken into account
|
|
|
|
ensureConsistency(t, a, "/v1/catalog/services?consistent", 0, true)
|
|
|
|
// Since stale is added, no MaxStale should be applied
|
|
|
|
ensureConsistency(t, a, "/v1/catalog/services?stale", -1, false)
|
|
|
|
ensureConsistency(t, a, "/v1/catalog/services?leader", 0, false)
|
|
|
|
}
|
|
|
|
|
2014-04-21 20:19:18 +00:00
|
|
|
func TestParseConsistency_Invalid(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2014-04-21 20:19:18 +00:00
|
|
|
resp := httptest.NewRecorder()
|
|
|
|
var b structs.QueryOptions
|
|
|
|
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/catalog/nodes?stale&consistent", nil)
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2018-03-30 15:14:44 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
if d := a.srv.parseConsistency(resp, req, &b); !d {
|
2014-04-21 20:19:18 +00:00
|
|
|
t.Fatalf("expected done")
|
|
|
|
}
|
|
|
|
|
|
|
|
if resp.Code != 400 {
|
|
|
|
t.Fatalf("bad code: %v", resp.Code)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2015-02-06 22:38:01 +00:00
|
|
|
// Test ACL token is resolved in correct order
|
|
|
|
func TestACLResolution(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2015-02-06 22:38:01 +00:00
|
|
|
var token string
|
|
|
|
// Request without token
|
2017-05-09 11:38:05 +00:00
|
|
|
req, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
2015-02-06 22:38:01 +00:00
|
|
|
// Request with explicit token
|
2017-05-09 11:38:05 +00:00
|
|
|
reqToken, _ := http.NewRequest("GET", "/v1/catalog/nodes?token=foo", nil)
|
2015-10-19 13:59:24 +00:00
|
|
|
// Request with header token only
|
2017-05-09 11:38:05 +00:00
|
|
|
reqHeaderToken, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
2015-10-19 13:59:24 +00:00
|
|
|
reqHeaderToken.Header.Add("X-Consul-Token", "bar")
|
|
|
|
|
|
|
|
// Request with header and querystring tokens
|
2017-05-09 11:38:05 +00:00
|
|
|
reqBothTokens, _ := http.NewRequest("GET", "/v1/catalog/nodes?token=baz", nil)
|
2015-10-19 13:59:24 +00:00
|
|
|
reqBothTokens.Header.Add("X-Consul-Token", "zap")
|
|
|
|
|
2018-08-17 20:18:42 +00:00
|
|
|
// Request with Authorization Bearer token
|
|
|
|
reqAuthBearerToken, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
|
|
|
reqAuthBearerToken.Header.Add("Authorization", "Bearer bearer-token")
|
|
|
|
|
|
|
|
// Request with invalid Authorization scheme
|
|
|
|
reqAuthBearerInvalidScheme, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
|
|
|
reqAuthBearerInvalidScheme.Header.Add("Authorization", "Beer")
|
|
|
|
|
|
|
|
// Request with empty Authorization Bearer token
|
|
|
|
reqAuthBearerTokenEmpty, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
|
|
|
reqAuthBearerTokenEmpty.Header.Add("Authorization", "Bearer")
|
|
|
|
|
|
|
|
// Request with empty Authorization Bearer token
|
|
|
|
reqAuthBearerTokenInvalid, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
|
|
|
reqAuthBearerTokenInvalid.Header.Add("Authorization", "Bearertoken")
|
|
|
|
|
|
|
|
// Request with more than one space between Bearer and token
|
|
|
|
reqAuthBearerTokenMultiSpaces, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
|
|
|
reqAuthBearerTokenMultiSpaces.Header.Add("Authorization", "Bearer bearer-token")
|
|
|
|
|
|
|
|
// Request with Authorization Bearer token containing spaces
|
|
|
|
reqAuthBearerTokenSpaces, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
|
|
|
reqAuthBearerTokenSpaces.Header.Add("Authorization", "Bearer bearer-token "+
|
|
|
|
" the rest is discarded ")
|
|
|
|
|
|
|
|
// Request with Authorization Bearer and querystring token
|
|
|
|
reqAuthBearerAndQsToken, _ := http.NewRequest("GET", "/v1/catalog/nodes?token=qstoken", nil)
|
|
|
|
reqAuthBearerAndQsToken.Header.Add("Authorization", "Bearer bearer-token")
|
|
|
|
|
|
|
|
// Request with Authorization Bearer and X-Consul-Token header token
|
|
|
|
reqAuthBearerAndXToken, _ := http.NewRequest("GET", "/v1/catalog/nodes", nil)
|
|
|
|
reqAuthBearerAndXToken.Header.Add("X-Consul-Token", "xtoken")
|
|
|
|
reqAuthBearerAndXToken.Header.Add("Authorization", "Bearer bearer-token")
|
|
|
|
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2017-05-21 18:31:20 +00:00
|
|
|
defer a.Shutdown()
|
2015-02-06 22:38:01 +00:00
|
|
|
|
2017-05-21 18:31:20 +00:00
|
|
|
// Check when no token is set
|
2019-02-27 19:28:31 +00:00
|
|
|
a.tokens.UpdateUserToken("", tokenStore.TokenSourceConfig)
|
2017-05-21 18:31:20 +00:00
|
|
|
a.srv.parseToken(req, &token)
|
|
|
|
if token != "" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
2015-02-06 22:38:01 +00:00
|
|
|
|
2017-05-21 18:31:20 +00:00
|
|
|
// Check when ACLToken set
|
2019-02-27 19:28:31 +00:00
|
|
|
a.tokens.UpdateUserToken("agent", tokenStore.TokenSourceAPI)
|
2017-05-21 18:31:20 +00:00
|
|
|
a.srv.parseToken(req, &token)
|
|
|
|
if token != "agent" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
2015-10-19 13:59:24 +00:00
|
|
|
|
2017-05-21 18:31:20 +00:00
|
|
|
// Explicit token has highest precedence
|
|
|
|
a.srv.parseToken(reqToken, &token)
|
|
|
|
if token != "foo" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
2015-10-19 13:59:24 +00:00
|
|
|
|
2017-05-21 18:31:20 +00:00
|
|
|
// Header token has precedence over agent token
|
|
|
|
a.srv.parseToken(reqHeaderToken, &token)
|
|
|
|
if token != "bar" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Querystring token has precedence over header and agent tokens
|
|
|
|
a.srv.parseToken(reqBothTokens, &token)
|
|
|
|
if token != "baz" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
2018-08-17 20:18:42 +00:00
|
|
|
|
|
|
|
//
|
|
|
|
// Authorization Bearer token tests
|
|
|
|
//
|
|
|
|
|
|
|
|
// Check if Authorization bearer token header is parsed correctly
|
|
|
|
a.srv.parseToken(reqAuthBearerToken, &token)
|
|
|
|
if token != "bearer-token" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check Authorization Bearer scheme invalid
|
|
|
|
a.srv.parseToken(reqAuthBearerInvalidScheme, &token)
|
|
|
|
if token != "agent" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check if Authorization Bearer token is empty
|
|
|
|
a.srv.parseToken(reqAuthBearerTokenEmpty, &token)
|
|
|
|
if token != "agent" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check if the Authorization Bearer token is invalid
|
|
|
|
a.srv.parseToken(reqAuthBearerTokenInvalid, &token)
|
|
|
|
if token != "agent" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check multi spaces between Authorization Bearer and token value
|
|
|
|
a.srv.parseToken(reqAuthBearerTokenMultiSpaces, &token)
|
|
|
|
if token != "bearer-token" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check if Authorization Bearer token with spaces is parsed correctly
|
|
|
|
a.srv.parseToken(reqAuthBearerTokenSpaces, &token)
|
|
|
|
if token != "bearer-token" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check if explicit token has precedence over Authorization bearer token
|
|
|
|
a.srv.parseToken(reqAuthBearerAndQsToken, &token)
|
|
|
|
if token != "qstoken" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check if X-Consul-Token has precedence over Authorization bearer token
|
|
|
|
a.srv.parseToken(reqAuthBearerAndXToken, &token)
|
|
|
|
if token != "xtoken" {
|
|
|
|
t.Fatalf("bad: %s", token)
|
|
|
|
}
|
2015-02-06 22:38:01 +00:00
|
|
|
}
|
|
|
|
|
2015-12-22 17:30:19 +00:00
|
|
|
func TestEnableWebUI(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2017-05-21 07:54:40 +00:00
|
|
|
t.Parallel()
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, `
|
2020-09-16 12:30:42 +00:00
|
|
|
ui_config {
|
|
|
|
enabled = true
|
|
|
|
}
|
2017-09-25 18:40:42 +00:00
|
|
|
`)
|
2017-05-21 18:31:20 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
|
|
|
|
req, _ := http.NewRequest("GET", "/ui/", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
a.srv.handler().ServeHTTP(resp, req)
|
2020-09-16 12:30:42 +00:00
|
|
|
require.Equal(t, http.StatusOK, resp.Code)
|
|
|
|
|
|
|
|
// Validate that it actually sent the index page we expect since an error
|
2020-09-23 11:37:33 +00:00
|
|
|
// during serving the special intercepted index.html can result in an empty
|
|
|
|
// response but a 200 status.
|
2020-09-16 12:30:42 +00:00
|
|
|
require.Contains(t, resp.Body.String(), `<!-- CONSUL_VERSION:`)
|
|
|
|
|
2020-09-23 11:37:33 +00:00
|
|
|
// Verify that we injected the variables we expected. The rest of injection
|
|
|
|
// behavior is tested in the uiserver package, this just ensures it's plumbed
|
|
|
|
// in correctly.
|
|
|
|
require.NotContains(t, resp.Body.String(), `__RUNTIME_BOOL`)
|
2020-09-16 12:30:42 +00:00
|
|
|
|
2020-09-23 11:37:33 +00:00
|
|
|
// Reload the config with changed metrics provider options and verify that
|
|
|
|
// they are present in the output.
|
|
|
|
newHCL := `
|
|
|
|
data_dir = "` + a.DataDir + `"
|
|
|
|
ui_config {
|
|
|
|
enabled = true
|
|
|
|
metrics_provider = "valid-but-unlikely-metrics-provider-name"
|
|
|
|
}
|
|
|
|
`
|
|
|
|
c := TestConfig(testutil.Logger(t), config.FileSource{Name: t.Name(), Format: "hcl", Data: newHCL})
|
|
|
|
require.NoError(t, a.reloadConfigInternal(c))
|
2020-09-16 12:30:42 +00:00
|
|
|
|
2020-09-23 11:37:33 +00:00
|
|
|
// Now index requests should contain that metrics provider name.
|
|
|
|
{
|
|
|
|
req, _ := http.NewRequest("GET", "/ui/", nil)
|
|
|
|
resp := httptest.NewRecorder()
|
2023-06-30 03:00:29 +00:00
|
|
|
a.enableDebug.Store(true)
|
|
|
|
|
|
|
|
a.srv.handler().ServeHTTP(resp, req)
|
2020-09-23 11:37:33 +00:00
|
|
|
require.Equal(t, http.StatusOK, resp.Code)
|
|
|
|
require.Contains(t, resp.Body.String(), `<!-- CONSUL_VERSION:`)
|
|
|
|
require.Contains(t, resp.Body.String(), `valid-but-unlikely-metrics-provider-name`)
|
|
|
|
}
|
2015-12-22 17:30:19 +00:00
|
|
|
}
|
|
|
|
|
2019-01-10 14:27:26 +00:00
|
|
|
func TestAllowedNets(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2019-01-10 14:27:26 +00:00
|
|
|
type testVal struct {
|
|
|
|
nets []string
|
|
|
|
ip string
|
|
|
|
expected bool
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, v := range []testVal{
|
|
|
|
{
|
|
|
|
ip: "156.124.222.351",
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
ip: "[::2]",
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
nets: []string{"0.0.0.0/0"},
|
|
|
|
ip: "115.124.32.64",
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
nets: []string{"::0/0"},
|
|
|
|
ip: "[::3]",
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
nets: []string{"127.0.0.1/8"},
|
|
|
|
ip: "127.0.0.1",
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
nets: []string{"127.0.0.1/8"},
|
|
|
|
ip: "128.0.0.1",
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
nets: []string{"::1/8"},
|
|
|
|
ip: "[::1]",
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
nets: []string{"255.255.255.255/32"},
|
|
|
|
ip: "127.0.0.1",
|
|
|
|
expected: false,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
nets: []string{"255.255.255.255/32", "127.0.0.1/8"},
|
|
|
|
ip: "127.0.0.1",
|
|
|
|
expected: true,
|
|
|
|
},
|
|
|
|
} {
|
|
|
|
var nets []*net.IPNet
|
|
|
|
for _, n := range v.nets {
|
|
|
|
_, in, err := net.ParseCIDR(n)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatal(err)
|
|
|
|
}
|
|
|
|
nets = append(nets, in)
|
|
|
|
}
|
|
|
|
|
2020-03-31 19:59:56 +00:00
|
|
|
a := NewTestAgent(t, "")
|
2019-01-10 14:27:26 +00:00
|
|
|
defer a.Shutdown()
|
|
|
|
testrpc.WaitForTestAgent(t, a.RPC, "dc1")
|
|
|
|
|
|
|
|
a.config.AllowWriteHTTPFrom = nets
|
|
|
|
|
|
|
|
err := a.srv.checkWriteAccess(&http.Request{
|
|
|
|
Method: http.MethodPost,
|
|
|
|
RemoteAddr: fmt.Sprintf("%s:16544", v.ip),
|
|
|
|
})
|
|
|
|
actual := err == nil
|
|
|
|
|
|
|
|
if actual != v.expected {
|
|
|
|
t.Fatalf("bad checkWriteAccess for values %+v, got %v", v, err)
|
|
|
|
}
|
|
|
|
|
2022-04-29 17:42:49 +00:00
|
|
|
if err != nil {
|
|
|
|
if err, ok := err.(HTTPError); ok {
|
|
|
|
if err.StatusCode != 403 {
|
|
|
|
t.Fatalf("expected 403 but got %d", err.StatusCode)
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
t.Fatalf("expected HTTP Error but got %v", err)
|
|
|
|
}
|
2019-01-10 14:27:26 +00:00
|
|
|
}
|
2022-04-29 17:42:49 +00:00
|
|
|
|
2019-01-10 14:27:26 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-04-21 20:11:05 +00:00
|
|
|
// assertIndex tests that X-Consul-Index is set and non-zero
|
2023-12-06 17:11:32 +00:00
|
|
|
func assertIndex(t testutil.TestingTB, resp *httptest.ResponseRecorder) {
|
|
|
|
t.Helper()
|
2020-08-13 22:39:58 +00:00
|
|
|
require.NoError(t, checkIndex(resp))
|
2014-04-21 20:11:05 +00:00
|
|
|
}
|
|
|
|
|
2014-05-21 19:31:22 +00:00
|
|
|
// checkIndex is like assertIndex but returns an error
|
|
|
|
func checkIndex(resp *httptest.ResponseRecorder) error {
|
|
|
|
header := resp.Header().Get("X-Consul-Index")
|
|
|
|
if header == "" || header == "0" {
|
|
|
|
return fmt.Errorf("Bad: %v", header)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2014-04-21 20:11:05 +00:00
|
|
|
// getIndex parses X-Consul-Index
|
|
|
|
func getIndex(t *testing.T, resp *httptest.ResponseRecorder) uint64 {
|
|
|
|
header := resp.Header().Get("X-Consul-Index")
|
|
|
|
if header == "" {
|
|
|
|
t.Fatalf("Bad: %v", header)
|
|
|
|
}
|
|
|
|
val, err := strconv.Atoi(header)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Bad: %v", header)
|
|
|
|
}
|
|
|
|
return uint64(val)
|
|
|
|
}
|
2014-05-19 18:29:50 +00:00
|
|
|
|
2017-05-09 16:58:12 +00:00
|
|
|
func jsonReader(v interface{}) io.Reader {
|
|
|
|
if v == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
b := new(bytes.Buffer)
|
|
|
|
if err := json.NewEncoder(b).Encode(v); err != nil {
|
|
|
|
panic(err)
|
|
|
|
}
|
|
|
|
return b
|
|
|
|
}
|
2020-01-31 16:19:37 +00:00
|
|
|
|
|
|
|
func TestHTTPServer_HandshakeTimeout(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2020-01-31 16:19:37 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
// Fire up an agent with TLS enabled.
|
2020-03-31 20:24:39 +00:00
|
|
|
a := StartTestAgent(t, TestAgent{
|
2022-08-19 17:07:22 +00:00
|
|
|
UseHTTPS: true,
|
2020-01-31 16:19:37 +00:00
|
|
|
HCL: `
|
|
|
|
key_file = "../test/client_certs/server.key"
|
|
|
|
cert_file = "../test/client_certs/server.crt"
|
|
|
|
ca_file = "../test/client_certs/rootca.crt"
|
|
|
|
|
|
|
|
limits {
|
|
|
|
https_handshake_timeout = "10ms"
|
|
|
|
}
|
|
|
|
`,
|
|
|
|
})
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
2020-09-04 18:53:02 +00:00
|
|
|
addr, err := firstAddr(a.Agent.apiServers, "https")
|
|
|
|
require.NoError(t, err)
|
2020-01-31 16:19:37 +00:00
|
|
|
// Connect to it with a plain TCP client that doesn't attempt to send HTTP or
|
|
|
|
// complete a TLS handshake.
|
2020-09-04 18:53:02 +00:00
|
|
|
conn, err := net.Dial("tcp", addr.String())
|
2020-01-31 16:19:37 +00:00
|
|
|
require.NoError(t, err)
|
|
|
|
defer conn.Close()
|
|
|
|
|
|
|
|
// Wait for more than the timeout. This is timing dependent so could fail if
|
|
|
|
// the CPU is super overloaded so the handler goroutine so I'm using a retry
|
|
|
|
// loop below to be sure but this feels like a pretty generous margin for
|
|
|
|
// error (10x the timeout and 100ms of scheduling time).
|
|
|
|
time.Sleep(100 * time.Millisecond)
|
|
|
|
|
|
|
|
// Set a read deadline on the Conn in case the timeout is not working we don't
|
|
|
|
// want the read below to block forever. Needs to be much longer than what we
|
|
|
|
// expect and the error should be different too.
|
|
|
|
conn.SetReadDeadline(time.Now().Add(3 * time.Second))
|
|
|
|
|
|
|
|
retry.Run(t, func(r *retry.R) {
|
|
|
|
// Sanity check the conn was closed by attempting to read from it (a write
|
|
|
|
// might not detect the close).
|
|
|
|
buf := make([]byte, 10)
|
|
|
|
_, err = conn.Read(buf)
|
|
|
|
require.Error(r, err)
|
|
|
|
require.Contains(r, err.Error(), "EOF")
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestRPC_HTTPSMaxConnsPerClient(t *testing.T) {
|
2020-12-07 18:42:55 +00:00
|
|
|
if testing.Short() {
|
|
|
|
t.Skip("too slow for testing.Short")
|
|
|
|
}
|
|
|
|
|
2020-01-31 16:19:37 +00:00
|
|
|
t.Parallel()
|
|
|
|
|
|
|
|
cases := []struct {
|
|
|
|
name string
|
|
|
|
tlsEnabled bool
|
|
|
|
}{
|
|
|
|
{"HTTP", false},
|
|
|
|
{"HTTPS", true},
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, tc := range cases {
|
|
|
|
tc := tc
|
|
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
|
|
|
|
|
|
hclPrefix := ""
|
|
|
|
if tc.tlsEnabled {
|
|
|
|
hclPrefix = `
|
|
|
|
key_file = "../test/client_certs/server.key"
|
|
|
|
cert_file = "../test/client_certs/server.crt"
|
|
|
|
ca_file = "../test/client_certs/rootca.crt"
|
|
|
|
`
|
|
|
|
}
|
|
|
|
|
|
|
|
// Fire up an agent with TLS enabled.
|
2020-03-31 20:24:39 +00:00
|
|
|
a := StartTestAgent(t, TestAgent{
|
2022-08-19 17:07:22 +00:00
|
|
|
UseHTTPS: tc.tlsEnabled,
|
2020-01-31 16:19:37 +00:00
|
|
|
HCL: hclPrefix + `
|
|
|
|
limits {
|
|
|
|
http_max_conns_per_client = 2
|
|
|
|
}
|
|
|
|
`,
|
|
|
|
})
|
|
|
|
defer a.Shutdown()
|
|
|
|
|
2020-09-04 18:53:02 +00:00
|
|
|
addr, err := firstAddr(a.Agent.apiServers, strings.ToLower(tc.name))
|
|
|
|
require.NoError(t, err)
|
2020-01-31 16:19:37 +00:00
|
|
|
|
|
|
|
assertConn := func(conn net.Conn, wantOpen bool) {
|
|
|
|
retry.Run(t, func(r *retry.R) {
|
|
|
|
// Don't wait around as server won't be sending data but the read will fail
|
|
|
|
// immediately if the conn is closed.
|
|
|
|
conn.SetReadDeadline(time.Now().Add(1 * time.Millisecond))
|
|
|
|
buf := make([]byte, 10)
|
|
|
|
_, err := conn.Read(buf)
|
|
|
|
require.Error(r, err)
|
|
|
|
if wantOpen {
|
|
|
|
require.Contains(r, err.Error(), "i/o timeout",
|
|
|
|
"wanted an open conn (read timeout)")
|
|
|
|
} else {
|
|
|
|
require.Contains(r, err.Error(), "EOF", "wanted a closed conn")
|
|
|
|
}
|
|
|
|
})
|
|
|
|
}
|
|
|
|
|
|
|
|
// Connect to the server with bare TCP
|
2020-09-04 18:53:02 +00:00
|
|
|
conn1, err := net.DialTimeout("tcp", addr.String(), time.Second)
|
2020-01-31 16:19:37 +00:00
|
|
|
require.NoError(t, err)
|
|
|
|
defer conn1.Close()
|
|
|
|
|
|
|
|
assertConn(conn1, true)
|
|
|
|
|
|
|
|
// Two conns should succeed
|
2020-09-04 18:53:02 +00:00
|
|
|
conn2, err := net.DialTimeout("tcp", addr.String(), time.Second)
|
2020-01-31 16:19:37 +00:00
|
|
|
require.NoError(t, err)
|
|
|
|
defer conn2.Close()
|
|
|
|
|
|
|
|
assertConn(conn2, true)
|
|
|
|
|
|
|
|
// Third should succeed negotiating TCP handshake...
|
2020-09-04 18:53:02 +00:00
|
|
|
conn3, err := net.DialTimeout("tcp", addr.String(), time.Second)
|
2020-01-31 16:19:37 +00:00
|
|
|
require.NoError(t, err)
|
|
|
|
defer conn3.Close()
|
|
|
|
|
|
|
|
// But then be closed.
|
|
|
|
assertConn(conn3, false)
|
|
|
|
|
|
|
|
// Reload config with higher limit
|
|
|
|
newCfg := *a.config
|
|
|
|
newCfg.HTTPMaxConnsPerClient = 10
|
2020-06-10 20:47:35 +00:00
|
|
|
require.NoError(t, a.reloadConfigInternal(&newCfg))
|
2020-01-31 16:19:37 +00:00
|
|
|
|
|
|
|
// Now another conn should be allowed
|
2020-09-04 18:53:02 +00:00
|
|
|
conn4, err := net.DialTimeout("tcp", addr.String(), time.Second)
|
2020-01-31 16:19:37 +00:00
|
|
|
require.NoError(t, err)
|
|
|
|
defer conn4.Close()
|
|
|
|
|
|
|
|
assertConn(conn4, true)
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
2022-12-14 15:24:22 +00:00
|
|
|
|
|
|
|
func TestWithRemoteAddrHandler_ValidAddr(t *testing.T) {
|
|
|
|
expected := net.TCPAddrFromAddrPort(netip.MustParseAddrPort("1.2.3.4:8080"))
|
|
|
|
nextHandlerCalled := false
|
|
|
|
|
|
|
|
assertionHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
nextHandlerCalled = true
|
|
|
|
remoteAddr, ok := consul.RemoteAddrFromContext(r.Context())
|
|
|
|
if !ok || remoteAddr.String() != expected.String() {
|
|
|
|
t.Errorf("remote addr not present but expected %v", expected)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
|
|
|
remoteAddrHandler := withRemoteAddrHandler(assertionHandler)
|
|
|
|
req := httptest.NewRequest("GET", "http://ignoreme", nil)
|
|
|
|
req.RemoteAddr = expected.String()
|
|
|
|
remoteAddrHandler.ServeHTTP(httptest.NewRecorder(), req)
|
|
|
|
|
|
|
|
assert.True(t, nextHandlerCalled, "expected next handler to be called")
|
|
|
|
}
|
|
|
|
|
|
|
|
func TestWithRemoteAddrHandler_InvalidAddr(t *testing.T) {
|
|
|
|
nextHandlerCalled := false
|
|
|
|
|
|
|
|
assertionHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
|
|
nextHandlerCalled = true
|
|
|
|
remoteAddr, ok := consul.RemoteAddrFromContext(r.Context())
|
|
|
|
if ok || remoteAddr != nil {
|
|
|
|
t.Errorf("remote addr %v present but not expected", remoteAddr)
|
|
|
|
}
|
|
|
|
})
|
|
|
|
|
|
|
|
remoteAddrHandler := withRemoteAddrHandler(assertionHandler)
|
|
|
|
req := httptest.NewRequest("GET", "http://ignoreme", nil)
|
|
|
|
req.RemoteAddr = "i.am.not.a.valid.ipaddr:port"
|
|
|
|
remoteAddrHandler.ServeHTTP(httptest.NewRecorder(), req)
|
|
|
|
|
|
|
|
assert.True(t, nextHandlerCalled, "expected next handler to be called")
|
|
|
|
}
|