Skip to content

Commit c2d26c5

Browse files
ellemoutonellemouton
committed
itest: add test for Status server endpoint
1 parent b26bd5a commit c2d26c5

File tree

2 files changed

+101
-19
lines changed

2 files changed

+101
-19
lines changed

‎itest/litd_mode_integrated_test.go‎

Lines changed: 90 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,9 @@ var (
138138
loopMacaroonFn = func(cfg *LitNodeConfig) string {
139139
return cfg.LoopMacPath
140140
}
141+
emptyMacaroonFn = func(_ *LitNodeConfig) string {
142+
return ""
143+
}
141144
poolRequestFn = func(ctx context.Context,
142145
c grpc.ClientConnInterface) (proto.Message, error) {
143146

@@ -182,6 +185,14 @@ var (
182185
litConn := litrpc.NewProxyClient(c)
183186
return litConn.GetInfo(ctx, &litrpc.GetInfoRequest{})
184187
}
188+
statusRequestFn = func(ctx context.Context,
189+
c grpc.ClientConnInterface) (proto.Message, error) {
190+
191+
litConn := litrpc.NewStatusClient(c)
192+
return litConn.SubServerStatus(
193+
ctx, &litrpc.SubServerStatusReq{},
194+
)
195+
}
185196
litMacaroonFn = func(cfg *LitNodeConfig) string {
186197
return cfg.LitMacPath
187198
}
@@ -197,6 +208,7 @@ var (
197208
restPOST bool
198209
canDisable bool
199210
litOnly bool
211+
noAuth bool
200212
}{{
201213
name: "lnrpc",
202214
macaroonFn: lndMacaroonFn,
@@ -294,6 +306,16 @@ var (
294306
grpcWebURI: "/litrpc.Proxy/GetInfo",
295307
restWebURI: "/v1/proxy/info",
296308
litOnly: true,
309+
}, {
310+
name: "litrpc-status",
311+
macaroonFn: emptyMacaroonFn,
312+
requestFn: statusRequestFn,
313+
successPattern: "\"sub_servers\":",
314+
allowedThroughLNC: false,
315+
grpcWebURI: "/litrpc.Status/SubServerStatus",
316+
restWebURI: "/v1/status",
317+
litOnly: true,
318+
noAuth: true,
297319
}}
298320

299321
// customURIs is a map of endpoint URIs that we want to allow via a
@@ -416,6 +438,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
416438
runGRPCAuthTest(
417439
ttt, cfg.RPCAddr(), cfg.TLSCertPath,
418440
endpoint.macaroonFn(cfg),
441+
endpoint.noAuth,
419442
endpoint.requestFn,
420443
endpoint.successPattern,
421444
endpointDisabled || endpoint.litOnly,
@@ -427,6 +450,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
427450
runGRPCAuthTest(
428451
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
429452
endpoint.macaroonFn(cfg),
453+
endpoint.noAuth,
430454
endpoint.requestFn,
431455
endpoint.successPattern,
432456
endpointDisabled,
@@ -448,7 +472,8 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
448472
runUIPasswordCheck(
449473
ttt, cfg.RPCAddr(), cfg.TLSCertPath,
450474
cfg.UIPassword, endpoint.requestFn,
451-
true, endpoint.successPattern,
475+
endpoint.noAuth, true,
476+
endpoint.successPattern,
452477
endpointDisabled || endpoint.litOnly,
453478
"Unimplemented desc = unknown service",
454479
)
@@ -463,6 +488,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
463488
runUIPasswordCheck(
464489
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
465490
cfg.UIPassword, endpoint.requestFn,
491+
endpoint.noAuth,
466492
shouldFailWithoutMacaroon,
467493
endpoint.successPattern,
468494
endpointDisabled,
@@ -492,6 +518,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
492518
endpoint.grpcWebURI,
493519
withoutUIPassword, endpointDisabled,
494520
"unknown gRPC web request",
521+
endpoint.noAuth,
495522
)
496523
})
497524
}
@@ -515,7 +542,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
515542
tt.Run(endpoint.name+" lnd port", func(ttt *testing.T) {
516543
runGRPCAuthTest(
517544
ttt, cfg.RPCAddr(), cfg.TLSCertPath,
518-
superMacFile,
545+
superMacFile, endpoint.noAuth,
519546
endpoint.requestFn,
520547
endpoint.successPattern,
521548
endpointDisabled || endpoint.litOnly,
@@ -526,7 +553,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
526553
tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
527554
runGRPCAuthTest(
528555
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
529-
superMacFile,
556+
superMacFile, endpoint.noAuth,
530557
endpoint.requestFn,
531558
endpoint.successPattern,
532559
endpointDisabled,
@@ -552,6 +579,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
552579
endpoint.successPattern,
553580
endpoint.restPOST,
554581
withoutUIPassword, endpointDisabled,
582+
endpoint.noAuth,
555583
)
556584
})
557585
}
@@ -642,12 +670,18 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
642670
endpointDisabled := subServersDisabled &&
643671
endpoint.canDisable
644672

673+
expectedErr := "permission denied"
674+
if endpoint.noAuth {
675+
expectedErr = "unknown service"
676+
}
677+
645678
tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
646679
allowed := customURIs[endpoint.grpcWebURI]
680+
647681
runLNCAuthTest(
648682
ttt, rawLNCConn, endpoint.requestFn,
649683
endpoint.successPattern,
650-
allowed, "permission denied",
684+
allowed, expectedErr,
651685
endpointDisabled,
652686
)
653687
})
@@ -713,7 +747,7 @@ func runCertificateCheck(t *testing.T, node *HarnessNode) {
713747

714748
// runGRPCAuthTest tests authentication of the given gRPC interface.
715749
func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
716-
makeRequest requestFn, successContent string, disabled bool,
750+
noMac bool, makeRequest requestFn, successContent string, disabled bool,
717751
disabledErr string) {
718752

719753
ctxb := context.Background()
@@ -724,6 +758,21 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
724758
require.NoError(t, err)
725759
defer rawConn.Close()
726760

761+
if noMac {
762+
resp, err := makeRequest(ctxt, rawConn)
763+
if disabled {
764+
require.ErrorContains(t, err, disabledErr)
765+
return
766+
}
767+
require.NoError(t, err)
768+
769+
json, err := marshalOptions.Marshal(resp)
770+
require.NoError(t, err)
771+
require.Contains(t, string(json), successContent)
772+
773+
return
774+
}
775+
727776
// We have a connection without any macaroon. A call should fail.
728777
_, err = makeRequest(ctxt, rawConn)
729778
if disabled {
@@ -765,9 +814,9 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
765814
resp, err := makeRequest(ctxm, rawConn)
766815
if disabled {
767816
require.ErrorContains(t, err, disabledErr)
768-
} else {
769-
require.NoError(t, err)
817+
return
770818
}
819+
require.NoError(t, err)
771820

772821
json, err := marshalOptions.Marshal(resp)
773822
require.NoError(t, err)
@@ -776,7 +825,7 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
776825

777826
// runUIPasswordCheck tests UI password authentication.
778827
func runUIPasswordCheck(t *testing.T, hostPort, tlsCertPath, uiPassword string,
779-
makeRequest requestFn, shouldFailWithoutMacaroon bool,
828+
makeRequest requestFn, noAuth, shouldFailWithoutMacaroon bool,
780829
successContent string, disabled bool, disabledErr string) {
781830

782831
ctxb := context.Background()
@@ -787,11 +836,19 @@ func runUIPasswordCheck(t *testing.T, hostPort, tlsCertPath, uiPassword string,
787836
require.NoError(t, err)
788837
defer rawConn.Close()
789838

790-
// Make sure that a call without any metadata results in an error.
839+
// Make sure that a call without any metadata results in an error unless
840+
// this is a call that is allowed to be un-authenticated in which case
841+
// we expect it to succeed.
791842
_, err = makeRequest(ctxt, rawConn)
792-
if disabled {
843+
switch {
844+
case disabled:
793845
require.ErrorContains(t, err, disabledErr)
794-
} else {
846+
case noAuth:
847+
require.NoError(t, err)
848+
849+
return
850+
851+
default:
795852
require.ErrorContains(t, err, "expected 1 macaroon, got 0")
796853
}
797854

@@ -902,7 +959,8 @@ func runIndexPageCheck(t *testing.T, hostPort string, uiDisabled bool) {
902959

903960
// runGRPCWebAuthTest tests authentication of the given gRPC interface.
904961
func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
905-
shouldFailWithUIPassword, disabled bool, disableErr string) {
962+
shouldFailWithUIPassword, disabled bool, disableErr string,
963+
noAuth bool) {
906964

907965
basicAuth := base64.StdEncoding.EncodeToString(
908966
[]byte(fmt.Sprintf("%s:%s", uiPassword, uiPassword)),
@@ -915,15 +973,23 @@ func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
915973

916974
url := fmt.Sprintf("https://%s%s", hostPort, grpcWebURI)
917975

918-
// First test a grpc-web call without authorization, which should fail.
976+
// First test a grpc-web call without authorization, which should fail
977+
// unless this call does not require authentication.
919978
_, responseHeader, err := postURL(url, emptyGrpcWebRequest, header)
920979
require.NoError(t, err)
921980

922-
if disabled {
981+
switch {
982+
case disabled:
923983
require.Contains(
924984
t, responseHeader.Get("grpc-message"), disableErr,
925985
)
926-
} else {
986+
987+
case noAuth:
988+
require.Equal(t, "", responseHeader.Get("grpc-message"))
989+
990+
return
991+
992+
default:
927993
require.Equal(
928994
t, "expected 1 macaroon, got 0",
929995
responseHeader.Get("grpc-message"),
@@ -972,7 +1038,7 @@ func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
9721038
// runRESTAuthTest tests authentication of the given REST interface.
9731039
func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
9741040
successPattern string, usePOST, shouldFailWithUIPassword,
975-
disabled bool) {
1041+
disabled, noMac bool) {
9761042

9771043
basicAuth := base64.StdEncoding.EncodeToString(
9781044
[]byte(fmt.Sprintf("%s:%s", uiPassword, uiPassword)),
@@ -987,7 +1053,9 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
9871053
method = "POST"
9881054
}
9891055

990-
// First test a REST call without authorization, which should fail.
1056+
// First test a REST call without authorization, which should fail
1057+
// unless this is a call for an endpoint that does not require
1058+
// authorization.
9911059
body, responseHeader, err := callURL(url, method, nil, nil, false)
9921060
require.NoError(t, err)
9931061

@@ -996,6 +1064,11 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
9961064
responseHeader.Get("content-type"),
9971065
)
9981066

1067+
if noMac {
1068+
require.Contains(t, body, successPattern)
1069+
return
1070+
}
1071+
9991072
if disabled {
10001073
require.Empty(
10011074
t, responseHeader.Get("grpc-metadata-content-type"),
@@ -1025,7 +1098,6 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
10251098

10261099
default:
10271100
require.Contains(t, body, successPattern)
1028-
10291101
}
10301102

10311103
// And finally, try with the given macaroon.

‎itest/litd_mode_remote_test.go‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
6363
runGRPCAuthTest(
6464
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
6565
endpoint.macaroonFn(cfg),
66+
endpoint.noAuth,
6667
endpoint.requestFn,
6768
endpoint.successPattern,
6869
endpointEnabled,
@@ -89,6 +90,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
8990
runUIPasswordCheck(
9091
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
9192
cfg.UIPassword, endpoint.requestFn,
93+
endpoint.noAuth,
9294
shouldFailWithoutMacaroon,
9395
endpoint.successPattern,
9496
endpointEnabled,
@@ -116,6 +118,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
116118
endpoint.grpcWebURI, withoutUIPassword,
117119
endpointEnabled,
118120
"unknown gRPC web request",
121+
endpoint.noAuth,
119122
)
120123
})
121124
}
@@ -140,6 +143,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
140143
runGRPCAuthTest(
141144
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
142145
superMacFile,
146+
endpoint.noAuth,
143147
endpoint.requestFn,
144148
endpoint.successPattern,
145149
endpointEnabled,
@@ -165,6 +169,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
165169
endpoint.successPattern,
166170
endpoint.restPOST, withoutUIPassword,
167171
endpointDisabled,
172+
endpoint.noAuth,
168173
)
169174
})
170175
}
@@ -234,12 +239,17 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
234239
endpointDisabled := subServersDisabled &&
235240
endpoint.canDisable
236241

242+
expectedErr := "permission denied"
243+
if endpoint.noAuth {
244+
expectedErr = "unknown service"
245+
}
246+
237247
tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
238248
allowed := customURIs[endpoint.grpcWebURI]
239249
runLNCAuthTest(
240250
ttt, rawLNCConn, endpoint.requestFn,
241251
endpoint.successPattern,
242-
allowed, "permission denied",
252+
allowed, expectedErr,
243253
endpointDisabled,
244254
)
245255
})

0 commit comments

Comments
 (0)