21720: added react-scripts@5.0.0
[arvados.git] / services / keepstore / proxy_remote_test.go
1 // Copyright (C) The Arvados Authors. All rights reserved.
2 //
3 // SPDX-License-Identifier: AGPL-3.0
4
5 package keepstore
6
7 import (
8         "crypto/md5"
9         "encoding/json"
10         "fmt"
11         "net"
12         "net/http"
13         "net/http/httptest"
14         "strconv"
15         "strings"
16         "sync/atomic"
17         "time"
18
19         "git.arvados.org/arvados.git/sdk/go/arvados"
20         "git.arvados.org/arvados.git/sdk/go/arvadostest"
21         "git.arvados.org/arvados.git/sdk/go/auth"
22         "git.arvados.org/arvados.git/sdk/go/ctxlog"
23         "git.arvados.org/arvados.git/sdk/go/httpserver"
24         "git.arvados.org/arvados.git/sdk/go/keepclient"
25         "github.com/prometheus/client_golang/prometheus"
26         check "gopkg.in/check.v1"
27 )
28
29 var _ = check.Suite(&proxyRemoteSuite{})
30
31 type proxyRemoteSuite struct {
32         cluster *arvados.Cluster
33         handler *router
34
35         remoteClusterID      string
36         remoteBlobSigningKey []byte
37         remoteKeepLocator    string
38         remoteKeepData       []byte
39         remoteKeepproxy      *httptest.Server
40         remoteKeepRequests   int64
41         remoteAPI            *httptest.Server
42 }
43
44 func (s *proxyRemoteSuite) remoteKeepproxyHandler(w http.ResponseWriter, r *http.Request) {
45         expectToken, err := auth.SaltToken(arvadostest.ActiveTokenV2, s.remoteClusterID)
46         if err != nil {
47                 panic(err)
48         }
49         atomic.AddInt64(&s.remoteKeepRequests, 1)
50         var token string
51         if auth := strings.Split(r.Header.Get("Authorization"), " "); len(auth) == 2 && (auth[0] == "OAuth2" || auth[0] == "Bearer") {
52                 token = auth[1]
53         }
54         if r.Method == "GET" && r.URL.Path == "/"+s.remoteKeepLocator && token == expectToken {
55                 w.Write(s.remoteKeepData)
56                 return
57         }
58         http.Error(w, "404", 404)
59 }
60
61 func (s *proxyRemoteSuite) remoteAPIHandler(w http.ResponseWriter, r *http.Request) {
62         host, port, _ := net.SplitHostPort(strings.Split(s.remoteKeepproxy.URL, "//")[1])
63         portnum, _ := strconv.Atoi(port)
64         if r.URL.Path == "/arvados/v1/discovery/v1/rest" {
65                 json.NewEncoder(w).Encode(arvados.DiscoveryDocument{})
66                 return
67         }
68         if r.URL.Path == "/arvados/v1/keep_services/accessible" {
69                 json.NewEncoder(w).Encode(arvados.KeepServiceList{
70                         Items: []arvados.KeepService{
71                                 {
72                                         UUID:           s.remoteClusterID + "-bi6l4-proxyproxyproxy",
73                                         ServiceType:    "proxy",
74                                         ServiceHost:    host,
75                                         ServicePort:    portnum,
76                                         ServiceSSLFlag: false,
77                                 },
78                         },
79                 })
80                 return
81         }
82         http.Error(w, "404", 404)
83 }
84
85 func (s *proxyRemoteSuite) SetUpTest(c *check.C) {
86         s.remoteClusterID = "z0000"
87         s.remoteBlobSigningKey = []byte("3b6df6fb6518afe12922a5bc8e67bf180a358bc8")
88         s.remoteKeepproxy = httptest.NewServer(httpserver.LogRequests(http.HandlerFunc(s.remoteKeepproxyHandler)))
89         s.remoteAPI = httptest.NewUnstartedServer(http.HandlerFunc(s.remoteAPIHandler))
90         s.remoteAPI.StartTLS()
91         s.cluster = testCluster(c)
92         s.cluster.RemoteClusters = map[string]arvados.RemoteCluster{
93                 s.remoteClusterID: {
94                         Host:     strings.Split(s.remoteAPI.URL, "//")[1],
95                         Proxy:    true,
96                         Scheme:   "http",
97                         Insecure: true,
98                 },
99         }
100         s.cluster.Volumes = map[string]arvados.Volume{"zzzzz-nyw5e-000000000000000": {Driver: "stub"}}
101 }
102
103 func (s *proxyRemoteSuite) TearDownTest(c *check.C) {
104         s.remoteAPI.Close()
105         s.remoteKeepproxy.Close()
106 }
107
108 func (s *proxyRemoteSuite) TestProxyRemote(c *check.C) {
109         reg := prometheus.NewRegistry()
110         router, cancel := testRouter(c, s.cluster, reg)
111         defer cancel()
112         instrumented := httpserver.Instrument(reg, ctxlog.TestLogger(c), router)
113         handler := httpserver.LogRequests(instrumented.ServeAPI(s.cluster.ManagementToken, instrumented))
114
115         data := []byte("foo bar")
116         s.remoteKeepData = data
117         locator := fmt.Sprintf("%x+%d", md5.Sum(data), len(data))
118         s.remoteKeepLocator = keepclient.SignLocator(locator, arvadostest.ActiveTokenV2, time.Now().Add(time.Minute), time.Minute, s.remoteBlobSigningKey)
119
120         path := "/" + strings.Replace(s.remoteKeepLocator, "+A", "+R"+s.remoteClusterID+"-", 1)
121
122         for _, trial := range []struct {
123                 label            string
124                 method           string
125                 token            string
126                 xKeepSignature   string
127                 expectRemoteReqs int64
128                 expectCode       int
129                 expectSignature  bool
130         }{
131                 {
132                         label:            "GET only",
133                         method:           "GET",
134                         token:            arvadostest.ActiveTokenV2,
135                         expectRemoteReqs: 1,
136                         expectCode:       http.StatusOK,
137                 },
138                 {
139                         label:            "obsolete token",
140                         method:           "GET",
141                         token:            arvadostest.ActiveToken,
142                         expectRemoteReqs: 0,
143                         expectCode:       http.StatusBadRequest,
144                 },
145                 {
146                         label:            "bad token",
147                         method:           "GET",
148                         token:            arvadostest.ActiveTokenV2[:len(arvadostest.ActiveTokenV2)-3] + "xxx",
149                         expectRemoteReqs: 1,
150                         expectCode:       http.StatusNotFound,
151                 },
152                 {
153                         label:            "HEAD only",
154                         method:           "HEAD",
155                         token:            arvadostest.ActiveTokenV2,
156                         expectRemoteReqs: 1,
157                         expectCode:       http.StatusOK,
158                 },
159                 {
160                         label:            "HEAD with local signature",
161                         method:           "HEAD",
162                         xKeepSignature:   "local, time=" + time.Now().Format(time.RFC3339),
163                         token:            arvadostest.ActiveTokenV2,
164                         expectRemoteReqs: 1,
165                         expectCode:       http.StatusOK,
166                         expectSignature:  true,
167                 },
168                 {
169                         label:            "GET with local signature",
170                         method:           "GET",
171                         xKeepSignature:   "local, time=" + time.Now().Format(time.RFC3339),
172                         token:            arvadostest.ActiveTokenV2,
173                         expectRemoteReqs: 1,
174                         expectCode:       http.StatusOK,
175                         expectSignature:  true,
176                 },
177         } {
178                 c.Logf("=== trial: %s", trial.label)
179
180                 s.remoteKeepRequests = 0
181
182                 var req *http.Request
183                 var resp *httptest.ResponseRecorder
184                 req = httptest.NewRequest(trial.method, path, nil)
185                 req.Header.Set("Authorization", "Bearer "+trial.token)
186                 if trial.xKeepSignature != "" {
187                         req.Header.Set("X-Keep-Signature", trial.xKeepSignature)
188                 }
189                 resp = httptest.NewRecorder()
190                 handler.ServeHTTP(resp, req)
191                 c.Check(s.remoteKeepRequests, check.Equals, trial.expectRemoteReqs)
192                 if !c.Check(resp.Code, check.Equals, trial.expectCode) {
193                         c.Logf("resp.Code %d came with resp.Body %q", resp.Code, resp.Body.String())
194                 }
195                 if resp.Code == http.StatusOK {
196                         if trial.method == "HEAD" {
197                                 c.Check(resp.Body.String(), check.Equals, "")
198                                 c.Check(resp.Result().ContentLength, check.Equals, int64(len(data)))
199                         } else {
200                                 c.Check(resp.Body.String(), check.Equals, string(data))
201                         }
202                 } else {
203                         c.Check(resp.Body.String(), check.Not(check.Equals), string(data))
204                 }
205
206                 c.Check(resp.Header().Get("Vary"), check.Matches, `(.*, )?X-Keep-Signature(, .*)?`)
207
208                 locHdr := resp.Header().Get("X-Keep-Locator")
209                 if !trial.expectSignature {
210                         c.Check(locHdr, check.Equals, "")
211                         continue
212                 }
213
214                 c.Check(locHdr, check.Not(check.Equals), "")
215                 c.Check(locHdr, check.Not(check.Matches), `.*\+R.*`)
216                 c.Check(arvados.VerifySignature(locHdr, trial.token, s.cluster.Collections.BlobSigningTTL.Duration(), []byte(s.cluster.Collections.BlobSigningKey)), check.IsNil)
217
218                 // Ensure block can be requested using new signature
219                 req = httptest.NewRequest("GET", "/"+locHdr, nil)
220                 req.Header.Set("Authorization", "Bearer "+trial.token)
221                 resp = httptest.NewRecorder()
222                 handler.ServeHTTP(resp, req)
223                 c.Check(resp.Code, check.Equals, http.StatusOK)
224                 c.Check(s.remoteKeepRequests, check.Equals, trial.expectRemoteReqs)
225         }
226 }