65 lines
2.1 KiB
Go
65 lines
2.1 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"net/http"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestAgentEndpointValidation(t *testing.T) {
|
|
for _, endpoint := range []string{"http://127.0.0.1:9105", "https://10.10.0.2:9105", "http://[fd00::1]:9105"} {
|
|
if err := validateAgentEndpoint(endpoint); err != nil {
|
|
t.Fatalf("%s: %v", endpoint, err)
|
|
}
|
|
}
|
|
for _, endpoint := range []string{"http://0.0.0.0:9105", "http://8.8.8.8:9105", "https://agent.example:9105", "file:///etc/passwd", "http://127.0.0.1:9105/path"} {
|
|
if validateAgentEndpoint(endpoint) == nil {
|
|
t.Fatalf("unsafe endpoint accepted: %s", endpoint)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCredentialReferences(t *testing.T) {
|
|
if !validCredentialRef("agent_primary.token") {
|
|
t.Fatal("valid ref rejected")
|
|
}
|
|
for _, value := range []string{"", "../secret", "path/name", ".", "bad ref"} {
|
|
if validCredentialRef(value) {
|
|
t.Fatalf("invalid ref accepted: %q", value)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestAgentClientAuthenticatesAndBoundsPath(t *testing.T) {
|
|
token := strings.Repeat("a", 32)
|
|
dir := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(dir, "agent"), []byte(token), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
client := NewAgentClient(dir)
|
|
client.http.Transport = roundTripFunc(func(request *http.Request) (*http.Response, error) {
|
|
if request.Header.Get("Authorization") != "Bearer "+token {
|
|
t.Error("missing token")
|
|
}
|
|
return &http.Response{StatusCode: 200, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`{"ok":true}`))}, nil
|
|
})
|
|
server := Server{AgentEndpoint: "http://127.0.0.1:9105", CredentialRef: "agent"}
|
|
status, _, err := client.Do(context.Background(), server, http.MethodGet, "/v1/version", nil)
|
|
if err != nil || status != 200 {
|
|
t.Fatalf("agent request failed: status=%d err=%v", status, err)
|
|
}
|
|
if _, _, err = client.Do(context.Background(), server, http.MethodGet, "/private", nil); err == nil {
|
|
t.Fatal("out-of-contract path accepted")
|
|
}
|
|
}
|
|
|
|
type roundTripFunc func(*http.Request) (*http.Response, error)
|
|
|
|
func (function roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) {
|
|
return function(request)
|
|
}
|