sneak
76a6518282
All checks were successful
check / check (push) Successful in 3m28s
The SSRF blocklist had no escape hatch, so the thing webhooker is mostly for — taking a public webhook and forwarding it to something on your own network — could not be configured at all. Every private address, Docker sibling and loopback service was permanently unreachable as a delivery destination. ALLOWED_EGRESS_CIDRS (default empty) names blocks that delivery targets may reach despite the default blocklist. It is an allowlist and only ever adds destinations: there is no boolean, and no value disables SSRF protection wholesale. Empty, the guard behaves exactly as before. A fixed set of addresses is refused before the allowlist is consulted, so no supplied CIDR opens one — not the exact address, not a supernet, not 0.0.0.0/0 or ::/0. It is the two link-local blocks (169.254.0.0/16, fe80::/10) plus host routes for the cloud metadata endpoints that sit outside them: AWS's IPv6 IMDS at fd00:ec2::254, which lives in ordinary ULA space, and Alibaba's 100.100.100.200, which lives in CGNAT. Allowlisting fd00::/8 or 100.64.0.0/10 (Tailscale's range) is an ordinary thing for an operator to do and must not reopen instance-credential theft. The IPv4-compatible (::a9fe:a9fe) and NAT64 (64:ff9b::a9fe:a9fe) spellings of 169.254.169.254 are listed too, because To4() does not normalise them into the link-local block the way it does the IPv4-mapped form. Reaching any of these is credential theft rather than delivery to an internal service. The policy now lives in one function, Guard.checkIP, which both target-creation validation and the delivery dialer call. The two paths previously decided separately, which is how they came to disagree about a destination. The guard is built once from config and injected via fx into both the handlers and the delivery engine, so there is a single instance and a single answer. A set-but-unparseable value aborts startup naming the variable, reusing the existing envPrefixList parser. A non-empty list is logged at startup with the blocks spelled out, not counted, so the hole is visible in the log of any deployment that has one. Tests: an allowlisted loopback CIDR both validates and delivers to a live server (and the same URL still fails without the allowlist); a private address outside the listed block stays refused on both paths; every unconditionally blocked address stays refused on both paths under an allowlist that covers it, and the set itself is pinned entry by entry; public addresses are unaffected either way; and config coverage for parsing, startup abort, and the warning's contents.
1077 lines
24 KiB
Go
1077 lines
24 KiB
Go
package config_test
|
|
|
|
import (
|
|
"bytes"
|
|
"log/slog"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"go.uber.org/fx"
|
|
"go.uber.org/fx/fxtest"
|
|
"sneak.berlin/go/webhooker/internal/config"
|
|
"sneak.berlin/go/webhooker/internal/globals"
|
|
"sneak.berlin/go/webhooker/internal/logger"
|
|
)
|
|
|
|
// Shared subtest names for the env-parsing tables below, which all
|
|
// exercise the same three cases against different variables.
|
|
const (
|
|
caseUnsetUsesDefault = "unset uses default"
|
|
caseValidValueParsed = "valid value is parsed"
|
|
caseUnparseableFails = "unparseable value fails startup"
|
|
|
|
// cidrPrivateV4 is the sample trusted-proxy block the
|
|
// TRUSTED_PROXIES cases are built from.
|
|
cidrPrivateV4 = "10.0.0.0/8"
|
|
|
|
// metricsAuthValue is the sample METRICS_PASSWORD the metrics
|
|
// credential cases are built from. It is asserted absent from
|
|
// the startup error, so it must not be a substring of either
|
|
// variable name that error prints.
|
|
metricsAuthValue = "s3cret"
|
|
)
|
|
|
|
func TestEnvironmentConfig(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
envValue string
|
|
envVars map[string]string
|
|
expectError bool
|
|
isDev bool
|
|
isProd bool
|
|
}{
|
|
{
|
|
name: "default is dev",
|
|
isDev: true,
|
|
isProd: false,
|
|
},
|
|
{
|
|
name: "explicit dev",
|
|
envValue: "dev",
|
|
isDev: true,
|
|
isProd: false,
|
|
},
|
|
{
|
|
name: "explicit prod",
|
|
envValue: "prod",
|
|
isDev: false,
|
|
isProd: true,
|
|
},
|
|
{
|
|
name: "invalid environment",
|
|
envValue: "staging",
|
|
expectError: true,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
if tt.envValue != "" {
|
|
t.Setenv(
|
|
"WEBHOOKER_ENVIRONMENT", tt.envValue,
|
|
)
|
|
} else {
|
|
require.NoError(t, os.Unsetenv(
|
|
"WEBHOOKER_ENVIRONMENT",
|
|
))
|
|
}
|
|
|
|
for k, v := range tt.envVars {
|
|
t.Setenv(k, v)
|
|
}
|
|
|
|
if tt.expectError {
|
|
testEnvironmentConfigError(t)
|
|
} else {
|
|
testEnvironmentConfigSuccess(
|
|
t, tt.isDev, tt.isProd,
|
|
)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func testEnvironmentConfigError(t *testing.T) {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fx.New(
|
|
fx.NopLogger,
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
),
|
|
fx.Populate(&cfg),
|
|
)
|
|
|
|
assert.Error(t, app.Err())
|
|
}
|
|
|
|
func testEnvironmentConfigSuccess(
|
|
t *testing.T,
|
|
isDev, isProd bool,
|
|
) {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fxtest.New(
|
|
t,
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
),
|
|
fx.Populate(&cfg),
|
|
)
|
|
require.NoError(t, app.Err())
|
|
|
|
app.RequireStart()
|
|
|
|
defer app.RequireStop()
|
|
|
|
assert.Equal(t, isDev, cfg.IsDev())
|
|
assert.Equal(t, isProd, cfg.IsProd())
|
|
}
|
|
|
|
func TestRetentionSweepInterval(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
set bool
|
|
value string
|
|
expectError bool
|
|
// sentinel, when set, must be wrapped by the startup
|
|
// error; every error case must additionally name the
|
|
// variable in its message.
|
|
sentinel error
|
|
expected time.Duration
|
|
}{
|
|
{
|
|
name: caseUnsetUsesDefault,
|
|
set: false,
|
|
expected: time.Hour,
|
|
},
|
|
{
|
|
name: caseValidValueParsed,
|
|
set: true,
|
|
value: "15m",
|
|
expected: 15 * time.Minute,
|
|
},
|
|
{
|
|
name: caseUnparseableFails,
|
|
set: true,
|
|
value: "not-a-duration",
|
|
expectError: true,
|
|
},
|
|
{
|
|
// A non-positive period panics the ticker in the
|
|
// reaper and archive-sweeper goroutines, long after
|
|
// startup has reported success, so it has to fail
|
|
// here instead.
|
|
name: "zero fails startup",
|
|
set: true,
|
|
value: "0s",
|
|
expectError: true,
|
|
sentinel: config.ErrNonPositiveValue,
|
|
},
|
|
{
|
|
name: "negative fails startup",
|
|
set: true,
|
|
value: "-1h",
|
|
expectError: true,
|
|
sentinel: config.ErrNonPositiveValue,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
|
|
|
|
if tt.set {
|
|
t.Setenv("RETENTION_SWEEP_INTERVAL", tt.value)
|
|
} else {
|
|
require.NoError(t, os.Unsetenv(
|
|
"RETENTION_SWEEP_INTERVAL",
|
|
))
|
|
}
|
|
|
|
if tt.expectError {
|
|
expectStartupErrorFor(
|
|
t, "RETENTION_SWEEP_INTERVAL", tt.sentinel,
|
|
)
|
|
} else {
|
|
testRetentionSweepIntervalSuccess(t, tt.expected)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// startupError builds the app config.New belongs to and returns
|
|
// the error fx reports, which is non-nil whenever an environment
|
|
// value is set but invalid.
|
|
func startupError(t *testing.T) error {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fx.New(
|
|
fx.NopLogger,
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
),
|
|
fx.Populate(&cfg),
|
|
)
|
|
|
|
return app.Err()
|
|
}
|
|
|
|
// expectStartupError asserts that fx refuses to build the app,
|
|
// which is what a set-but-invalid environment value must cause.
|
|
func expectStartupError(t *testing.T) {
|
|
t.Helper()
|
|
|
|
assert.Error(t, startupError(t))
|
|
}
|
|
|
|
// expectStartupErrorFor asserts that startup fails, that the error
|
|
// names the offending variable so an operator can find it, and,
|
|
// when sentinel is non-nil, that it wraps that sentinel.
|
|
func expectStartupErrorFor(
|
|
t *testing.T,
|
|
key string,
|
|
sentinel error,
|
|
) {
|
|
t.Helper()
|
|
|
|
err := startupError(t)
|
|
require.ErrorContains(t, err, key)
|
|
|
|
if sentinel != nil {
|
|
require.ErrorIs(t, err, sentinel)
|
|
}
|
|
}
|
|
|
|
func testRetentionSweepIntervalSuccess(
|
|
t *testing.T,
|
|
expected time.Duration,
|
|
) {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fxtest.New(
|
|
t,
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
),
|
|
fx.Populate(&cfg),
|
|
)
|
|
require.NoError(t, app.Err())
|
|
|
|
app.RequireStart()
|
|
|
|
defer app.RequireStop()
|
|
|
|
assert.Equal(t, expected, cfg.RetentionSweepInterval)
|
|
}
|
|
|
|
func TestSessionIdleTimeout(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
set bool
|
|
value string
|
|
expectError bool
|
|
expected time.Duration
|
|
}{
|
|
{
|
|
name: caseUnsetUsesDefault,
|
|
set: false,
|
|
expected: 24 * time.Hour,
|
|
},
|
|
{
|
|
name: caseValidValueParsed,
|
|
set: true,
|
|
value: "30m",
|
|
expected: 30 * time.Minute,
|
|
},
|
|
{
|
|
name: caseUnparseableFails,
|
|
set: true,
|
|
value: "not-a-duration",
|
|
expectError: true,
|
|
},
|
|
{
|
|
// Non-positive is "idle expiry disabled" for this
|
|
// variable, not a configuration error: unlike
|
|
// RETENTION_SWEEP_INTERVAL it never becomes a ticker
|
|
// period.
|
|
name: "zero disables idle expiry",
|
|
set: true,
|
|
value: "0s",
|
|
expected: 0,
|
|
},
|
|
{
|
|
name: "negative disables idle expiry",
|
|
set: true,
|
|
value: "-1h",
|
|
expected: -time.Hour,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
|
|
|
|
if tt.set {
|
|
t.Setenv("SESSION_IDLE_TIMEOUT", tt.value)
|
|
} else {
|
|
require.NoError(t, os.Unsetenv(
|
|
"SESSION_IDLE_TIMEOUT",
|
|
))
|
|
}
|
|
|
|
if tt.expectError {
|
|
expectStartupError(t)
|
|
} else {
|
|
testSessionIdleTimeoutSuccess(t, tt.expected)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func testSessionIdleTimeoutSuccess(
|
|
t *testing.T,
|
|
expected time.Duration,
|
|
) {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fxtest.New(
|
|
t,
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
),
|
|
fx.Populate(&cfg),
|
|
)
|
|
require.NoError(t, app.Err())
|
|
|
|
app.RequireStart()
|
|
|
|
defer app.RequireStop()
|
|
|
|
assert.Equal(t, expected, cfg.SessionIdleTimeout)
|
|
}
|
|
|
|
func TestDefaultDataDir(t *testing.T) {
|
|
for _, env := range []string{"", "dev", "prod"} {
|
|
name := env
|
|
if name == "" {
|
|
name = "unset"
|
|
}
|
|
|
|
t.Run("env="+name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
if env != "" {
|
|
t.Setenv("WEBHOOKER_ENVIRONMENT", env)
|
|
} else {
|
|
require.NoError(t, os.Unsetenv(
|
|
"WEBHOOKER_ENVIRONMENT",
|
|
))
|
|
}
|
|
|
|
require.NoError(t, os.Unsetenv("DATA_DIR"))
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fxtest.New(
|
|
t,
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
),
|
|
fx.Populate(&cfg),
|
|
)
|
|
require.NoError(t, app.Err())
|
|
|
|
app.RequireStart()
|
|
|
|
defer app.RequireStop()
|
|
|
|
assert.Equal(
|
|
t, "/var/lib/webhooker", cfg.DataDir,
|
|
)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestReceiverRateLimit(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
set bool
|
|
value string
|
|
expectError bool
|
|
// sentinel, when set, must be wrapped by the startup
|
|
// error; every error case must additionally name the
|
|
// variable in its message.
|
|
sentinel error
|
|
expected int
|
|
}{
|
|
{
|
|
name: caseUnsetUsesDefault,
|
|
set: false,
|
|
expected: 120,
|
|
},
|
|
{
|
|
name: caseValidValueParsed,
|
|
set: true,
|
|
value: "30",
|
|
expected: 30,
|
|
},
|
|
{
|
|
name: caseUnparseableFails,
|
|
set: true,
|
|
value: "not-a-number",
|
|
expectError: true,
|
|
},
|
|
{
|
|
name: "zero fails startup",
|
|
set: true,
|
|
value: "0",
|
|
expectError: true,
|
|
sentinel: config.ErrNonPositiveValue,
|
|
},
|
|
{
|
|
name: "negative fails startup",
|
|
set: true,
|
|
value: "-5",
|
|
expectError: true,
|
|
sentinel: config.ErrNonPositiveValue,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
|
|
|
|
if tt.set {
|
|
t.Setenv("RECEIVER_RATE_LIMIT", tt.value)
|
|
} else {
|
|
require.NoError(t, os.Unsetenv(
|
|
"RECEIVER_RATE_LIMIT",
|
|
))
|
|
}
|
|
|
|
if tt.expectError {
|
|
expectStartupErrorFor(
|
|
t, "RECEIVER_RATE_LIMIT", tt.sentinel,
|
|
)
|
|
} else {
|
|
testReceiverRateLimitSuccess(t, tt.expected)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func testReceiverRateLimitSuccess(
|
|
t *testing.T,
|
|
expected int,
|
|
) {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fxtest.New(
|
|
t,
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
),
|
|
fx.Populate(&cfg),
|
|
)
|
|
require.NoError(t, app.Err())
|
|
|
|
app.RequireStart()
|
|
|
|
defer app.RequireStop()
|
|
|
|
assert.Equal(t, expected, cfg.ReceiverRateLimit)
|
|
}
|
|
|
|
func TestTrustedProxies(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
set bool
|
|
value string
|
|
expectError bool
|
|
expected []string
|
|
}{
|
|
{
|
|
// The default must be "trust nobody": an empty list
|
|
// means forwarded headers are ignored, never that
|
|
// every peer may speak for the client.
|
|
name: caseUnsetUsesDefault,
|
|
set: false,
|
|
expected: []string{},
|
|
},
|
|
{
|
|
name: "blank value trusts nothing",
|
|
set: true,
|
|
value: " ",
|
|
expected: []string{},
|
|
},
|
|
{
|
|
name: caseValidValueParsed,
|
|
set: true,
|
|
value: cidrPrivateV4 + ", 192.168.1.7 ,2001:db8::/32",
|
|
expected: []string{
|
|
cidrPrivateV4, "192.168.1.7/32", "2001:db8::/32",
|
|
},
|
|
},
|
|
{
|
|
name: "host bits are masked off",
|
|
set: true,
|
|
value: "10.1.2.3/8",
|
|
expected: []string{cidrPrivateV4},
|
|
},
|
|
{
|
|
// Peer addresses are unmapped before they are
|
|
// matched, so an IPv4-mapped prefix kept in that
|
|
// form could never match anything.
|
|
name: "IPv4-mapped prefix is unmapped",
|
|
set: true,
|
|
value: "::ffff:10.0.0.0/104",
|
|
expected: []string{cidrPrivateV4},
|
|
},
|
|
{
|
|
name: caseUnparseableFails,
|
|
set: true,
|
|
value: cidrPrivateV4 + ",not-an-address",
|
|
expectError: true,
|
|
},
|
|
{
|
|
name: "out-of-range prefix length fails startup",
|
|
set: true,
|
|
value: "10.0.0.0/33",
|
|
expectError: true,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
|
|
|
|
if tt.set {
|
|
t.Setenv("TRUSTED_PROXIES", tt.value)
|
|
} else {
|
|
require.NoError(t, os.Unsetenv("TRUSTED_PROXIES"))
|
|
}
|
|
|
|
if tt.expectError {
|
|
expectStartupErrorFor(
|
|
t, "TRUSTED_PROXIES", config.ErrInvalidCIDR,
|
|
)
|
|
} else {
|
|
testTrustedProxiesSuccess(t, tt.expected)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func testTrustedProxiesSuccess(
|
|
t *testing.T,
|
|
expected []string,
|
|
) {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fxtest.New(
|
|
t,
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
),
|
|
fx.Populate(&cfg),
|
|
)
|
|
require.NoError(t, app.Err())
|
|
|
|
app.RequireStart()
|
|
|
|
defer app.RequireStop()
|
|
|
|
got := make([]string, 0, len(cfg.TrustedProxies))
|
|
for _, prefix := range cfg.TrustedProxies {
|
|
got = append(got, prefix.String())
|
|
}
|
|
|
|
assert.Equal(t, expected, got)
|
|
}
|
|
|
|
// TestAllowedEgressCIDRs covers ALLOWED_EGRESS_CIDRS, the escape
|
|
// hatch that lets a self-hosted deployment forward to its own
|
|
// network. Unset it must stay empty, so the SSRF guard keeps
|
|
// refusing every private/reserved range; a set-but-unparseable
|
|
// value must abort startup naming the variable rather than
|
|
// silently running with a list the operator did not write.
|
|
func TestAllowedEgressCIDRs(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
set bool
|
|
value string
|
|
expected []string
|
|
expectError bool
|
|
}{
|
|
{
|
|
name: caseUnsetUsesDefault,
|
|
set: false,
|
|
expected: []string{},
|
|
},
|
|
{
|
|
name: "empty value yields empty list",
|
|
set: true,
|
|
value: "",
|
|
expected: []string{},
|
|
},
|
|
{
|
|
name: caseValidValueParsed,
|
|
set: true,
|
|
value: cidrPrivateV4,
|
|
expected: []string{cidrPrivateV4},
|
|
},
|
|
{
|
|
name: "multiple blocks with whitespace",
|
|
set: true,
|
|
value: " 10.0.0.0/8 , 127.0.0.0/8 ",
|
|
expected: []string{cidrPrivateV4, "127.0.0.0/8"},
|
|
},
|
|
{
|
|
name: "bare address becomes a single host",
|
|
set: true,
|
|
value: "172.17.0.5",
|
|
expected: []string{"172.17.0.5/32"},
|
|
},
|
|
{
|
|
name: caseUnparseableFails,
|
|
set: true,
|
|
value: cidrPrivateV4 + ",not-an-address",
|
|
expectError: true,
|
|
},
|
|
{
|
|
name: "out-of-range prefix length fails startup",
|
|
set: true,
|
|
value: "10.0.0.0/33",
|
|
expectError: true,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
t.Setenv("WEBHOOKER_ENVIRONMENT", "dev")
|
|
|
|
if tt.set {
|
|
t.Setenv("ALLOWED_EGRESS_CIDRS", tt.value)
|
|
} else {
|
|
require.NoError(
|
|
t, os.Unsetenv("ALLOWED_EGRESS_CIDRS"),
|
|
)
|
|
}
|
|
|
|
if tt.expectError {
|
|
expectStartupErrorFor(
|
|
t, "ALLOWED_EGRESS_CIDRS", config.ErrInvalidCIDR,
|
|
)
|
|
} else {
|
|
testAllowedEgressCIDRsSuccess(t, tt.expected)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func testAllowedEgressCIDRsSuccess(
|
|
t *testing.T,
|
|
expected []string,
|
|
) {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fxtest.New(
|
|
t,
|
|
fx.Provide(
|
|
globals.New,
|
|
logger.New,
|
|
config.New,
|
|
),
|
|
fx.Populate(&cfg),
|
|
)
|
|
require.NoError(t, app.Err())
|
|
|
|
app.RequireStart()
|
|
|
|
defer app.RequireStop()
|
|
|
|
assert.Equal(
|
|
t, expected, config.PrefixStrings(cfg.AllowedEgressCIDRs),
|
|
)
|
|
}
|
|
|
|
// TestEgressAllowlistWarning covers the startup log that shows an
|
|
// operator the hole ALLOWED_EGRESS_CIDRS opened. It must stay
|
|
// silent on the default (empty) list and, when set, print the
|
|
// blocks themselves rather than a count.
|
|
func TestEgressAllowlistWarning(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
allowed string
|
|
expectWarning bool
|
|
}{
|
|
{
|
|
name: "empty allowlist is quiet",
|
|
expectWarning: false,
|
|
},
|
|
{
|
|
name: "non-empty allowlist warns",
|
|
allowed: "10.0.0.0/8,127.0.0.0/8",
|
|
expectWarning: true,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
t.Setenv("WEBHOOKER_ENVIRONMENT", config.EnvironmentDev)
|
|
|
|
if tt.allowed == "" {
|
|
require.NoError(
|
|
t, os.Unsetenv("ALLOWED_EGRESS_CIDRS"),
|
|
)
|
|
} else {
|
|
t.Setenv("ALLOWED_EGRESS_CIDRS", tt.allowed)
|
|
}
|
|
|
|
var buf bytes.Buffer
|
|
|
|
log := slog.New(slog.NewJSONHandler(
|
|
&buf, &slog.HandlerOptions{
|
|
Level: slog.LevelDebug,
|
|
},
|
|
))
|
|
|
|
require.NoError(
|
|
t, config.WarnEgressAllowlistForTest(log),
|
|
)
|
|
|
|
if !tt.expectWarning {
|
|
assert.Empty(t, buf.String())
|
|
|
|
return
|
|
}
|
|
|
|
logged := buf.String()
|
|
|
|
assert.Contains(t, logged, `"level":"WARN"`)
|
|
assert.Contains(t, logged, "ALLOWED_EGRESS_CIDRS")
|
|
// The blocks themselves, not a count: the operator has
|
|
// to be able to read back which networks are open.
|
|
assert.Contains(t, logged, "10.0.0.0/8")
|
|
assert.Contains(t, logged, "127.0.0.0/8")
|
|
// The warning must keep saying what stays shut.
|
|
assert.Contains(t, logged, "Link-local")
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestSharedRateLimitBucketWarning covers the startup warning that
|
|
// tells an operator a deployment behind a reverse proxy shares one
|
|
// rate-limit bucket between every client, which turns the receiver
|
|
// limits into service-wide ceilings and collapses login failure
|
|
// counting. It must fire whenever TRUSTED_PROXIES is empty,
|
|
// in any environment: WEBHOOKER_ENVIRONMENT defaults to dev, so gating
|
|
// on it would silence the warning for exactly the operator who never
|
|
// configured the deployment. It stays quiet once proxies are named.
|
|
func TestSharedRateLimitBucketWarning(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
environment string
|
|
trustedProxies string
|
|
expectWarning bool
|
|
}{
|
|
{
|
|
name: "prod without trusted proxies warns",
|
|
environment: config.EnvironmentProd,
|
|
expectWarning: true,
|
|
},
|
|
{
|
|
name: "prod with trusted proxies is quiet",
|
|
environment: config.EnvironmentProd,
|
|
trustedProxies: cidrPrivateV4,
|
|
expectWarning: false,
|
|
},
|
|
{
|
|
// The default environment. An internet-exposed
|
|
// deployment whose operator never set
|
|
// WEBHOOKER_ENVIRONMENT lands here and has exactly
|
|
// the exposure the warning announces.
|
|
name: "dev without trusted proxies warns",
|
|
environment: config.EnvironmentDev,
|
|
expectWarning: true,
|
|
},
|
|
{
|
|
name: "dev with trusted proxies is quiet",
|
|
environment: config.EnvironmentDev,
|
|
trustedProxies: cidrPrivateV4,
|
|
expectWarning: false,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
t.Setenv("WEBHOOKER_ENVIRONMENT", tt.environment)
|
|
|
|
if tt.trustedProxies == "" {
|
|
require.NoError(
|
|
t, os.Unsetenv("TRUSTED_PROXIES"),
|
|
)
|
|
} else {
|
|
t.Setenv("TRUSTED_PROXIES", tt.trustedProxies)
|
|
}
|
|
|
|
var buf bytes.Buffer
|
|
|
|
log := slog.New(slog.NewJSONHandler(
|
|
&buf, &slog.HandlerOptions{
|
|
Level: slog.LevelDebug,
|
|
},
|
|
))
|
|
|
|
require.NoError(
|
|
t,
|
|
config.WarnSharedRateLimitBucketForTest(log),
|
|
)
|
|
|
|
if !tt.expectWarning {
|
|
assert.Empty(t, buf.String())
|
|
|
|
return
|
|
}
|
|
|
|
logged := buf.String()
|
|
|
|
assert.Contains(t, logged, `"level":"WARN"`)
|
|
assert.Contains(t, logged, "TRUSTED_PROXIES")
|
|
assert.Contains(t, logged, "share one bucket")
|
|
assert.Contains(
|
|
t, logged, "throttle every other client's failed logins",
|
|
)
|
|
// The warning must not claim a lockout the login
|
|
// endpoint no longer permits: credentials are verified
|
|
// before any budget is spent.
|
|
assert.Contains(
|
|
t, logged, "a correct password still gets in",
|
|
)
|
|
// The text must stay accurate for a developer with
|
|
// nothing in front of the process, where an empty
|
|
// list costs nothing.
|
|
assert.Contains(
|
|
t, logged, "nothing proxying to this process",
|
|
)
|
|
})
|
|
}
|
|
}
|
|
|
|
// metricsEnv describes what one subtest below puts in the
|
|
// environment for a single METRICS_ variable. A variable that is
|
|
// set to the empty string and one that is not set at all are
|
|
// distinct inputs here, because the reported bug arrived through
|
|
// the first of them.
|
|
type metricsEnv struct {
|
|
set bool
|
|
value string
|
|
}
|
|
|
|
// unset leaves the variable out of the environment entirely.
|
|
func unset() metricsEnv {
|
|
return metricsEnv{set: false, value: ""}
|
|
}
|
|
|
|
// setTo sets the variable, including to the empty string.
|
|
func setTo(value string) metricsEnv {
|
|
return metricsEnv{set: true, value: value}
|
|
}
|
|
|
|
// metricsAuthCase is one row of the table in TestMetricsAuthConfig,
|
|
// named so the table can live in its own function and keep the test
|
|
// itself short.
|
|
type metricsAuthCase struct {
|
|
name string
|
|
username metricsEnv
|
|
password metricsEnv
|
|
expectError bool
|
|
expectAuth bool
|
|
}
|
|
|
|
// metricsAuthCases enumerates every combination of the two
|
|
// credentials, counting "set to the empty string" and "not set at
|
|
// all" as separate inputs on each side.
|
|
func metricsAuthCases() []metricsAuthCase {
|
|
return []metricsAuthCase{
|
|
{
|
|
name: "both unset leaves metrics unmounted",
|
|
username: unset(),
|
|
password: unset(),
|
|
},
|
|
{
|
|
name: "both empty leaves metrics unmounted",
|
|
username: setTo(""),
|
|
password: setTo(""),
|
|
},
|
|
{
|
|
name: "both set enables metrics auth",
|
|
username: setTo("metrics"),
|
|
password: setTo(metricsAuthValue),
|
|
expectAuth: true,
|
|
},
|
|
{
|
|
name: "username with unset password fails",
|
|
username: setTo("metrics"),
|
|
password: unset(),
|
|
expectError: true,
|
|
},
|
|
{
|
|
name: "username with empty password fails",
|
|
username: setTo("metrics"),
|
|
password: setTo(""),
|
|
expectError: true,
|
|
},
|
|
{
|
|
name: "password with unset username fails",
|
|
username: unset(),
|
|
password: setTo(metricsAuthValue),
|
|
expectError: true,
|
|
},
|
|
{
|
|
name: "password with empty username fails",
|
|
username: setTo(""),
|
|
password: setTo(metricsAuthValue),
|
|
expectError: true,
|
|
},
|
|
}
|
|
}
|
|
|
|
// TestMetricsAuthConfig covers every combination of METRICS_USERNAME
|
|
// and METRICS_PASSWORD. Either both carry a value, in which case
|
|
// /metrics is served behind basic auth, or neither does, in which
|
|
// case the route is never mounted. One without the other is a
|
|
// startup error rather than a fallback: mounting on the username
|
|
// alone published /metrics behind a credential map that accepted an
|
|
// empty password, which is the defect this test exists to pin. See
|
|
// https://git.eeqj.de/sneak/webhooker/issues/205.
|
|
func TestMetricsAuthConfig(t *testing.T) {
|
|
for _, tt := range metricsAuthCases() {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
// Cannot use t.Parallel() here because t.Setenv
|
|
// is incompatible with parallel subtests.
|
|
if tt.username.set {
|
|
t.Setenv("METRICS_USERNAME", tt.username.value)
|
|
} else {
|
|
require.NoError(
|
|
t, os.Unsetenv("METRICS_USERNAME"),
|
|
)
|
|
}
|
|
|
|
if tt.password.set {
|
|
t.Setenv("METRICS_PASSWORD", tt.password.value)
|
|
} else {
|
|
require.NoError(
|
|
t, os.Unsetenv("METRICS_PASSWORD"),
|
|
)
|
|
}
|
|
|
|
if tt.expectError {
|
|
assertMetricsAuthRejected(t)
|
|
|
|
return
|
|
}
|
|
|
|
assertMetricsAuthAccepted(t, tt.expectAuth)
|
|
})
|
|
}
|
|
}
|
|
|
|
// assertMetricsAuthRejected requires that fx refused to build the
|
|
// graph, that the failure is ErrIncompleteMetricsAuth, and that the
|
|
// operator is told both variable names — the point of failing here
|
|
// rather than degrading is that the message says what to fix.
|
|
func assertMetricsAuthRejected(t *testing.T) {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fx.New(
|
|
fx.NopLogger,
|
|
fx.Provide(globals.New, logger.New, config.New),
|
|
fx.Populate(&cfg),
|
|
)
|
|
|
|
err := app.Err()
|
|
require.Error(t, err)
|
|
require.ErrorIs(t, err, config.ErrIncompleteMetricsAuth)
|
|
assert.Contains(t, err.Error(), "METRICS_USERNAME")
|
|
assert.Contains(t, err.Error(), "METRICS_PASSWORD")
|
|
// The password is a secret and must not reach a startup error.
|
|
assert.NotContains(t, err.Error(), metricsAuthValue)
|
|
}
|
|
|
|
// assertMetricsAuthAccepted requires that startup succeeded and that
|
|
// MetricsAuthEnabled — the single value the /metrics mount and the
|
|
// startup log both read — reports what the environment asked for.
|
|
func assertMetricsAuthAccepted(t *testing.T, expectAuth bool) {
|
|
t.Helper()
|
|
|
|
var cfg *config.Config
|
|
|
|
app := fxtest.New(
|
|
t,
|
|
fx.Provide(globals.New, logger.New, config.New),
|
|
fx.Populate(&cfg),
|
|
)
|
|
require.NoError(t, app.Err())
|
|
|
|
app.RequireStart()
|
|
|
|
defer app.RequireStop()
|
|
|
|
assert.Equal(t, expectAuth, cfg.MetricsAuthEnabled())
|
|
}
|