Skip to content

Commit 081db5f

Browse files
ellemoutonellemouton
committed
itest: add test for Status server endpoint
1 parent 963d154 commit 081db5f

File tree

2 files changed

+100
-19
lines changed

2 files changed

+100
-19
lines changed

‎itest/litd_mode_integrated_test.go‎

Lines changed: 89 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,9 @@ var (
138138
loopMacaroonFn = func(cfg *LitNodeConfig) string {
139139
return cfg.LoopMacPath
140140
}
141+
emptyMacaroonFn = func(_ *LitNodeConfig) string {
142+
return ""
143+
}
141144
poolRequestFn = func(ctx context.Context,
142145
c grpc.ClientConnInterface) (proto.Message, error) {
143146

@@ -182,6 +185,14 @@ var (
182185
litConn := litrpc.NewProxyClient(c)
183186
return litConn.GetInfo(ctx, &litrpc.GetInfoRequest{})
184187
}
188+
statusRequestFn = func(ctx context.Context,
189+
c grpc.ClientConnInterface) (proto.Message, error) {
190+
191+
litConn := litrpc.NewStatusClient(c)
192+
return litConn.SubServerStatus(
193+
ctx, &litrpc.SubServerStatusReq{},
194+
)
195+
}
185196
litMacaroonFn = func(cfg *LitNodeConfig) string {
186197
return cfg.LitMacPath
187198
}
@@ -197,6 +208,7 @@ var (
197208
restPOST bool
198209
canDisable bool
199210
litOnly bool
211+
noAuth bool
200212
}{{
201213
name: "lnrpc",
202214
macaroonFn: lndMacaroonFn,
@@ -294,6 +306,15 @@ var (
294306
grpcWebURI: "/litrpc.Proxy/GetInfo",
295307
restWebURI: "/v1/proxy/info",
296308
litOnly: true,
309+
}, {
310+
name: "litrpc-status",
311+
macaroonFn: emptyMacaroonFn,
312+
requestFn: statusRequestFn,
313+
successPattern: "\"sub_servers\":",
314+
allowedThroughLNC: true,
315+
grpcWebURI: "/litrpc.Status/SubServerStatus",
316+
restWebURI: "/v1/status",
317+
noAuth: true,
297318
}}
298319

299320
// customURIs is a map of endpoint URIs that we want to allow via a
@@ -416,6 +437,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
416437
runGRPCAuthTest(
417438
ttt, cfg.RPCAddr(), cfg.TLSCertPath,
418439
endpoint.macaroonFn(cfg),
440+
endpoint.noAuth,
419441
endpoint.requestFn,
420442
endpoint.successPattern,
421443
endpointDisabled || endpoint.litOnly,
@@ -427,6 +449,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
427449
runGRPCAuthTest(
428450
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
429451
endpoint.macaroonFn(cfg),
452+
endpoint.noAuth,
430453
endpoint.requestFn,
431454
endpoint.successPattern,
432455
endpointDisabled,
@@ -448,7 +471,8 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
448471
runUIPasswordCheck(
449472
ttt, cfg.RPCAddr(), cfg.TLSCertPath,
450473
cfg.UIPassword, endpoint.requestFn,
451-
true, endpoint.successPattern,
474+
endpoint.noAuth, true,
475+
endpoint.successPattern,
452476
endpointDisabled || endpoint.litOnly,
453477
"Unimplemented desc = unknown service",
454478
)
@@ -463,6 +487,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
463487
runUIPasswordCheck(
464488
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
465489
cfg.UIPassword, endpoint.requestFn,
490+
endpoint.noAuth,
466491
shouldFailWithoutMacaroon,
467492
endpoint.successPattern,
468493
endpointDisabled,
@@ -492,6 +517,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
492517
endpoint.grpcWebURI,
493518
withoutUIPassword, endpointDisabled,
494519
"unknown gRPC web request",
520+
endpoint.noAuth,
495521
)
496522
})
497523
}
@@ -515,7 +541,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
515541
tt.Run(endpoint.name+" lnd port", func(ttt *testing.T) {
516542
runGRPCAuthTest(
517543
ttt, cfg.RPCAddr(), cfg.TLSCertPath,
518-
superMacFile,
544+
superMacFile, endpoint.noAuth,
519545
endpoint.requestFn,
520546
endpoint.successPattern,
521547
endpointDisabled || endpoint.litOnly,
@@ -526,7 +552,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
526552
tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
527553
runGRPCAuthTest(
528554
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
529-
superMacFile,
555+
superMacFile, endpoint.noAuth,
530556
endpoint.requestFn,
531557
endpoint.successPattern,
532558
endpointDisabled,
@@ -552,6 +578,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
552578
endpoint.successPattern,
553579
endpoint.restPOST,
554580
withoutUIPassword, endpointDisabled,
581+
endpoint.noAuth,
555582
)
556583
})
557584
}
@@ -642,12 +669,18 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
642669
endpointDisabled := subServersDisabled &&
643670
endpoint.canDisable
644671

672+
expectedErr := "permission denied"
673+
if endpoint.noAuth {
674+
expectedErr = "unknown service"
675+
}
676+
645677
tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
646678
allowed := customURIs[endpoint.grpcWebURI]
679+
647680
runLNCAuthTest(
648681
ttt, rawLNCConn, endpoint.requestFn,
649682
endpoint.successPattern,
650-
allowed, "permission denied",
683+
allowed, expectedErr,
651684
endpointDisabled,
652685
)
653686
})
@@ -713,7 +746,7 @@ func runCertificateCheck(t *testing.T, node *HarnessNode) {
713746

714747
// runGRPCAuthTest tests authentication of the given gRPC interface.
715748
func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
716-
makeRequest requestFn, successContent string, disabled bool,
749+
noMac bool, makeRequest requestFn, successContent string, disabled bool,
717750
disabledErr string) {
718751

719752
ctxb := context.Background()
@@ -724,6 +757,21 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
724757
require.NoError(t, err)
725758
defer rawConn.Close()
726759

760+
if noMac {
761+
resp, err := makeRequest(ctxt, rawConn)
762+
if disabled {
763+
require.ErrorContains(t, err, disabledErr)
764+
return
765+
}
766+
require.NoError(t, err)
767+
768+
json, err := marshalOptions.Marshal(resp)
769+
require.NoError(t, err)
770+
require.Contains(t, string(json), successContent)
771+
772+
return
773+
}
774+
727775
// We have a connection without any macaroon. A call should fail.
728776
_, err = makeRequest(ctxt, rawConn)
729777
if disabled {
@@ -765,9 +813,9 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
765813
resp, err := makeRequest(ctxm, rawConn)
766814
if disabled {
767815
require.ErrorContains(t, err, disabledErr)
768-
} else {
769-
require.NoError(t, err)
816+
return
770817
}
818+
require.NoError(t, err)
771819

772820
json, err := marshalOptions.Marshal(resp)
773821
require.NoError(t, err)
@@ -776,7 +824,7 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
776824

777825
// runUIPasswordCheck tests UI password authentication.
778826
func runUIPasswordCheck(t *testing.T, hostPort, tlsCertPath, uiPassword string,
779-
makeRequest requestFn, shouldFailWithoutMacaroon bool,
827+
makeRequest requestFn, noAuth, shouldFailWithoutMacaroon bool,
780828
successContent string, disabled bool, disabledErr string) {
781829

782830
ctxb := context.Background()
@@ -787,11 +835,19 @@ func runUIPasswordCheck(t *testing.T, hostPort, tlsCertPath, uiPassword string,
787835
require.NoError(t, err)
788836
defer rawConn.Close()
789837

790-
// Make sure that a call without any metadata results in an error.
838+
// Make sure that a call without any metadata results in an error unless
839+
// this is a call that is allowed to be un-authenticated in which case
840+
// we expect it to succeed.
791841
_, err = makeRequest(ctxt, rawConn)
792-
if disabled {
842+
switch {
843+
case disabled:
793844
require.ErrorContains(t, err, disabledErr)
794-
} else {
845+
case noAuth:
846+
require.NoError(t, err)
847+
848+
return
849+
850+
default:
795851
require.ErrorContains(t, err, "expected 1 macaroon, got 0")
796852
}
797853

@@ -902,7 +958,8 @@ func runIndexPageCheck(t *testing.T, hostPort string, uiDisabled bool) {
902958

903959
// runGRPCWebAuthTest tests authentication of the given gRPC interface.
904960
func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
905-
shouldFailWithUIPassword, disabled bool, disableErr string) {
961+
shouldFailWithUIPassword, disabled bool, disableErr string,
962+
noAuth bool) {
906963

907964
basicAuth := base64.StdEncoding.EncodeToString(
908965
[]byte(fmt.Sprintf("%s:%s", uiPassword, uiPassword)),
@@ -915,15 +972,23 @@ func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
915972

916973
url := fmt.Sprintf("https://%s%s", hostPort, grpcWebURI)
917974

918-
// First test a grpc-web call without authorization, which should fail.
975+
// First test a grpc-web call without authorization, which should fail
976+
// unless this call does not require authentication.
919977
_, responseHeader, err := postURL(url, emptyGrpcWebRequest, header)
920978
require.NoError(t, err)
921979

922-
if disabled {
980+
switch {
981+
case disabled:
923982
require.Contains(
924983
t, responseHeader.Get("grpc-message"), disableErr,
925984
)
926-
} else {
985+
986+
case noAuth:
987+
require.Equal(t, "", responseHeader.Get("grpc-message"))
988+
989+
return
990+
991+
default:
927992
require.Equal(
928993
t, "expected 1 macaroon, got 0",
929994
responseHeader.Get("grpc-message"),
@@ -972,7 +1037,7 @@ func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
9721037
// runRESTAuthTest tests authentication of the given REST interface.
9731038
func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
9741039
successPattern string, usePOST, shouldFailWithUIPassword,
975-
disabled bool) {
1040+
disabled, noMac bool) {
9761041

9771042
basicAuth := base64.StdEncoding.EncodeToString(
9781043
[]byte(fmt.Sprintf("%s:%s", uiPassword, uiPassword)),
@@ -987,7 +1052,9 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
9871052
method = "POST"
9881053
}
9891054

990-
// First test a REST call without authorization, which should fail.
1055+
// First test a REST call without authorization, which should fail
1056+
// unless this is a call for an endpoint that does not require
1057+
// authorization.
9911058
body, responseHeader, err := callURL(url, method, nil, nil, false)
9921059
require.NoError(t, err)
9931060

@@ -996,6 +1063,11 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
9961063
responseHeader.Get("content-type"),
9971064
)
9981065

1066+
if noMac {
1067+
require.Contains(t, body, successPattern)
1068+
return
1069+
}
1070+
9991071
if disabled {
10001072
require.Empty(
10011073
t, responseHeader.Get("grpc-metadata-content-type"),
@@ -1025,7 +1097,6 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
10251097

10261098
default:
10271099
require.Contains(t, body, successPattern)
1028-
10291100
}
10301101

10311102
// And finally, try with the given macaroon.

‎itest/litd_mode_remote_test.go‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
6363
runGRPCAuthTest(
6464
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
6565
endpoint.macaroonFn(cfg),
66+
endpoint.noAuth,
6667
endpoint.requestFn,
6768
endpoint.successPattern,
6869
endpointEnabled,
@@ -89,6 +90,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
8990
runUIPasswordCheck(
9091
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
9192
cfg.UIPassword, endpoint.requestFn,
93+
endpoint.noAuth,
9294
shouldFailWithoutMacaroon,
9395
endpoint.successPattern,
9496
endpointEnabled,
@@ -116,6 +118,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
116118
endpoint.grpcWebURI, withoutUIPassword,
117119
endpointEnabled,
118120
"unknown gRPC web request",
121+
endpoint.noAuth,
119122
)
120123
})
121124
}
@@ -140,6 +143,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
140143
runGRPCAuthTest(
141144
ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
142145
superMacFile,
146+
endpoint.noAuth,
143147
endpoint.requestFn,
144148
endpoint.successPattern,
145149
endpointEnabled,
@@ -165,6 +169,7 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
165169
endpoint.successPattern,
166170
endpoint.restPOST, withoutUIPassword,
167171
endpointDisabled,
172+
endpoint.noAuth,
168173
)
169174
})
170175
}
@@ -234,12 +239,17 @@ func remoteTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
234239
endpointDisabled := subServersDisabled &&
235240
endpoint.canDisable
236241

242+
expectedErr := "permission denied"
243+
if endpoint.noAuth {
244+
expectedErr = "unknown service"
245+
}
246+
237247
tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
238248
allowed := customURIs[endpoint.grpcWebURI]
239249
runLNCAuthTest(
240250
ttt, rawLNCConn, endpoint.requestFn,
241251
endpoint.successPattern,
242-
allowed, "permission denied",
252+
allowed, expectedErr,
243253
endpointDisabled,
244254
)
245255
})

0 commit comments

Comments
 (0)