itest: add test for Status server endpoint

Author: ellemouton

itest/litd_mode_integrated_test.go

@@ -138,6 +138,9 @@ var (
 	loopMacaroonFn = func(cfg *LitNodeConfig) string {
 		return cfg.LoopMacPath
 	}
+	emptyMacaroonFn = func(_ *LitNodeConfig) string {
+		return ""
+	}
 	poolRequestFn = func(ctx context.Context,
 		c grpc.ClientConnInterface) (proto.Message, error) {
 
@@ -182,6 +185,14 @@ var (
 		litConn := litrpc.NewProxyClient(c)
 		return litConn.GetInfo(ctx, &litrpc.GetInfoRequest{})
 	}
+	statusRequestFn = func(ctx context.Context,
+		c grpc.ClientConnInterface) (proto.Message, error) {
+
+		litConn := litrpc.NewStatusClient(c)
+		return litConn.SubServerStatus(
+			ctx, &litrpc.SubServerStatusReq{},
+		)
+	}
 	litMacaroonFn = func(cfg *LitNodeConfig) string {
 		return cfg.LitMacPath
 	}
@@ -201,6 +212,9 @@ var (
 		// Lit's grpc server and so will never be accessible via the
 		// LND port.
 		litOnly bool
+
+		// noAuth is true if the call does not require a macaroon.
+		noAuth bool
 	}{{
 		name:              "lnrpc",
 		macaroonFn:        lndMacaroonFn,
@@ -298,6 +312,16 @@ var (
 		grpcWebURI:        "/litrpc.Proxy/GetInfo",
 		restWebURI:        "/v1/proxy/info",
 		litOnly:           true,
+	}, {
+		name:              "litrpc-status",
+		macaroonFn:        emptyMacaroonFn,
+		requestFn:         statusRequestFn,
+		successPattern:    "\"sub_servers\":",
+		allowedThroughLNC: true,
+		grpcWebURI:        "/litrpc.Status/SubServerStatus",
+		restWebURI:        "/v1/status",
+		noAuth:            true,
+		litOnly:           true,
 	}}
 
 	// customURIs is a map of endpoint URIs that we want to allow via a
@@ -420,6 +444,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 				runGRPCAuthTest(
 					ttt, cfg.RPCAddr(), cfg.TLSCertPath,
 					endpoint.macaroonFn(cfg),
+					endpoint.noAuth,
 					endpoint.requestFn,
 					endpoint.successPattern,
 					endpointDisabled || endpoint.litOnly,
@@ -431,6 +456,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 				runGRPCAuthTest(
 					ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
 					endpoint.macaroonFn(cfg),
+					endpoint.noAuth,
 					endpoint.requestFn,
 					endpoint.successPattern,
 					endpointDisabled,
@@ -452,7 +478,8 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 				runUIPasswordCheck(
 					ttt, cfg.RPCAddr(), cfg.TLSCertPath,
 					cfg.UIPassword, endpoint.requestFn,
-					true, endpoint.successPattern,
+					endpoint.noAuth, true,
+					endpoint.successPattern,
 					endpointDisabled || endpoint.litOnly,
 					"Unimplemented desc = unknown service",
 				)
@@ -467,6 +494,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 				runUIPasswordCheck(
 					ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
 					cfg.UIPassword, endpoint.requestFn,
+					endpoint.noAuth,
 					shouldFailWithoutMacaroon,
 					endpoint.successPattern,
 					endpointDisabled,
@@ -496,6 +524,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 					endpoint.grpcWebURI,
 					withoutUIPassword, endpointDisabled,
 					"unknown gRPC web request",
+					endpoint.noAuth,
 				)
 			})
 		}
@@ -519,7 +548,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 			tt.Run(endpoint.name+" lnd port", func(ttt *testing.T) {
 				runGRPCAuthTest(
 					ttt, cfg.RPCAddr(), cfg.TLSCertPath,
-					superMacFile,
+					superMacFile, endpoint.noAuth,
 					endpoint.requestFn,
 					endpoint.successPattern,
 					endpointDisabled || endpoint.litOnly,
@@ -530,7 +559,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 			tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
 				runGRPCAuthTest(
 					ttt, cfg.LitAddr(), cfg.LitTLSCertPath,
-					superMacFile,
+					superMacFile, endpoint.noAuth,
 					endpoint.requestFn,
 					endpoint.successPattern,
 					endpointDisabled,
@@ -556,6 +585,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 					endpoint.successPattern,
 					endpoint.restPOST,
 					withoutUIPassword, endpointDisabled,
+					endpoint.noAuth,
 				)
 			})
 		}
@@ -587,6 +617,7 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 					endpoint.allowedThroughLNC,
 					"unknown service",
 					endpointDisabled,
+					endpoint.noAuth,
 				)
 			})
 		}
@@ -646,13 +677,20 @@ func integratedTestSuite(ctx context.Context, net *NetworkHarness, t *testing.T,
 			endpointDisabled := subServersDisabled &&
 				endpoint.canDisable
 
+			expectedErr := "permission denied"
+			if endpoint.noAuth {
+				expectedErr = "unknown service"
+			}
+
 			tt.Run(endpoint.name+" lit port", func(ttt *testing.T) {
 				allowed := customURIs[endpoint.grpcWebURI]
+
 				runLNCAuthTest(
 					ttt, rawLNCConn, endpoint.requestFn,
 					endpoint.successPattern,
-					allowed, "permission denied",
+					allowed, expectedErr,
 					endpointDisabled,
+					endpoint.noAuth,
 				)
 			})
 		}
@@ -717,7 +755,7 @@ func runCertificateCheck(t *testing.T, node *HarnessNode) {
 
 // runGRPCAuthTest tests authentication of the given gRPC interface.
 func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
-	makeRequest requestFn, successContent string, disabled bool,
+	noMac bool, makeRequest requestFn, successContent string, disabled bool,
 	disabledErr string) {
 
 	ctxb := context.Background()
@@ -728,6 +766,21 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
 	require.NoError(t, err)
 	defer rawConn.Close()
 
+	if noMac {
+		resp, err := makeRequest(ctxt, rawConn)
+		if disabled {
+			require.ErrorContains(t, err, disabledErr)
+			return
+		}
+		require.NoError(t, err)
+
+		json, err := marshalOptions.Marshal(resp)
+		require.NoError(t, err)
+		require.Contains(t, string(json), successContent)
+
+		return
+	}
+
 	// We have a connection without any macaroon. A call should fail.
 	_, err = makeRequest(ctxt, rawConn)
 	if disabled {
@@ -769,9 +822,9 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
 	resp, err := makeRequest(ctxm, rawConn)
 	if disabled {
 		require.ErrorContains(t, err, disabledErr)
-	} else {
-		require.NoError(t, err)
+		return
 	}
+	require.NoError(t, err)
 
 	json, err := marshalOptions.Marshal(resp)
 	require.NoError(t, err)
@@ -780,7 +833,7 @@ func runGRPCAuthTest(t *testing.T, hostPort, tlsCertPath, macPath string,
 
 // runUIPasswordCheck tests UI password authentication.
 func runUIPasswordCheck(t *testing.T, hostPort, tlsCertPath, uiPassword string,
-	makeRequest requestFn, shouldFailWithoutMacaroon bool,
+	makeRequest requestFn, noAuth, shouldFailWithoutMacaroon bool,
 	successContent string, disabled bool, disabledErr string) {
 
 	ctxb := context.Background()
@@ -791,11 +844,23 @@ func runUIPasswordCheck(t *testing.T, hostPort, tlsCertPath, uiPassword string,
 	require.NoError(t, err)
 	defer rawConn.Close()
 
-	// Make sure that a call without any metadata results in an error.
-	_, err = makeRequest(ctxt, rawConn)
-	if disabled {
+	// Make sure that a call without any metadata results in an error unless
+	// this is a call that is allowed to be un-authenticated in which case
+	// we expect it to succeed.
+	resp, err := makeRequest(ctxt, rawConn)
+	switch {
+	case disabled:
 		require.ErrorContains(t, err, disabledErr)
-	} else {
+	case noAuth:
+		require.NoError(t, err)
+
+		json, err := marshalOptions.Marshal(resp)
+		require.NoError(t, err)
+		require.Contains(t, string(json), successContent)
+
+		return
+
+	default:
 		require.ErrorContains(t, err, "expected 1 macaroon, got 0")
 	}
 
@@ -834,7 +899,7 @@ func runUIPasswordCheck(t *testing.T, hostPort, tlsCertPath, uiPassword string,
 	// Using the correct UI password should work for all requests unless the
 	// request is for a disabled sub-server.
 	ctxm = uiPasswordContext(ctxt, uiPassword, false)
-	resp, err := makeRequest(ctxm, rawConn)
+	resp, err = makeRequest(ctxm, rawConn)
 
 	// On lnd's gRPC interface we don't support using the UI password.
 	if shouldFailWithoutMacaroon {
@@ -906,7 +971,8 @@ func runIndexPageCheck(t *testing.T, hostPort string, uiDisabled bool) {
 
 // runGRPCWebAuthTest tests authentication of the given gRPC interface.
 func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
-	shouldFailWithUIPassword, disabled bool, disableErr string) {
+	shouldFailWithUIPassword, disabled bool, disableErr string,
+	noAuth bool) {
 
 	basicAuth := base64.StdEncoding.EncodeToString(
 		[]byte(fmt.Sprintf("%s:%s", uiPassword, uiPassword)),
@@ -919,15 +985,27 @@ func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
 
 	url := fmt.Sprintf("https://%s%s", hostPort, grpcWebURI)
 
-	// First test a grpc-web call without authorization, which should fail.
-	_, responseHeader, err := postURL(url, emptyGrpcWebRequest, header)
+	// First test a grpc-web call without authorization, which should fail
+	// unless this call does not require authentication.
+	body, responseHeader, err := postURL(url, emptyGrpcWebRequest, header)
 	require.NoError(t, err)
 
-	if disabled {
+	switch {
+	case disabled:
 		require.Contains(
 			t, responseHeader.Get("grpc-message"), disableErr,
 		)
-	} else {
+
+	case noAuth:
+		require.Empty(t, responseHeader.Get("grpc-message"))
+		require.Empty(t, responseHeader.Get("grpc-status"))
+
+		// We get the status encoded as trailer in the response.
+		require.Contains(t, body, "grpc-status: 0")
+
+		return
+
+	default:
 		require.Equal(
 			t, "expected 1 macaroon, got 0",
 			responseHeader.Get("grpc-message"),
@@ -941,7 +1019,7 @@ func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
 
 	// Now add the basic auth and try again.
 	header["authorization"] = []string{fmt.Sprintf("Basic %s", basicAuth)}
-	body, responseHeader, err := postURL(url, emptyGrpcWebRequest, header)
+	body, responseHeader, err = postURL(url, emptyGrpcWebRequest, header)
 	require.NoError(t, err)
 
 	if shouldFailWithUIPassword {
@@ -976,7 +1054,7 @@ func runGRPCWebAuthTest(t *testing.T, hostPort, uiPassword, grpcWebURI string,
 // runRESTAuthTest tests authentication of the given REST interface.
 func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
 	successPattern string, usePOST, shouldFailWithUIPassword,
-	disabled bool) {
+	disabled, noMac bool) {
 
 	basicAuth := base64.StdEncoding.EncodeToString(
 		[]byte(fmt.Sprintf("%s:%s", uiPassword, uiPassword)),
@@ -991,7 +1069,9 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
 		method = "POST"
 	}
 
-	// First test a REST call without authorization, which should fail.
+	// First test a REST call without authorization, which should fail
+	// unless this is a call for an endpoint that does not require
+	// authorization.
 	body, responseHeader, err := callURL(url, method, nil, nil, false)
 	require.NoError(t, err)
 
@@ -1000,6 +1080,11 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
 		responseHeader.Get("content-type"),
 	)
 
+	if noMac {
+		require.Contains(t, body, successPattern)
+		return
+	}
+
 	if disabled {
 		require.Empty(
 			t, responseHeader.Get("grpc-metadata-content-type"),
@@ -1029,7 +1114,6 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
 
 	default:
 		require.Contains(t, body, successPattern)
-
 	}
 
 	// And finally, try with the given macaroon.
@@ -1057,7 +1141,7 @@ func runRESTAuthTest(t *testing.T, hostPort, uiPassword, macaroonPath, restURI,
 // through Lightning Node Connect.
 func runLNCAuthTest(t *testing.T, rawLNCConn grpc.ClientConnInterface,
 	makeRequest requestFn, successContent string, callAllowed bool,
-	expectErrContains string, disabled bool) {
+	expectErrContains string, disabled, noMac bool) {
 
 	ctxt, cancel := context.WithTimeout(
 		context.Background(), defaultTimeout,
@@ -1070,6 +1154,21 @@ func runLNCAuthTest(t *testing.T, rawLNCConn grpc.ClientConnInterface,
 	// macaroon permissions properly set up).
 	resp, err := makeRequest(ctxt, rawLNCConn)
 
+	if noMac {
+		if disabled {
+			require.ErrorContains(t, err, "unknown gRPC web "+
+				"request")
+			return
+		}
+		require.NoError(t, err)
+
+		json, err := marshalOptions.Marshal(resp)
+		require.NoError(t, err)
+		require.Contains(t, string(json), successContent)
+
+		return
+	}
+
 	// Is this a disallowed call?
 	if !callAllowed {
 		if disabled {