feature/increase_test_coverage #112

Merged
alexvanin merged 1 commit from r.loginov/frostfs-http-gw:feature/increase_test_coverage into master 2024-09-04 19:50:57 +00:00
Member
  • Increasing the test coverage of the token package

  • Adding integration tests using bearer token

Coverage:

  • tokens = 87.5 % -> 100 %
- Increasing the test coverage of the token package - Adding integration tests using bearer token Coverage: - tokens = 87.5 % -> 100 %
r.loginov self-assigned this 2024-05-06 17:54:11 +00:00
r.loginov force-pushed feature/increase_test_coverage from bc558e1d4e to 2cbd9f47f6 2024-05-06 18:02:27 +00:00 Compare
Author
Member

I also wanted to keep the aio version 1.2.7, however, in this case, when the impersonate flag is set, the bearer token frostfs-node will give an error code = 1024 message = invalid signature (I understand that at that time there was not yet this flag). If I don't use this flag, I get an error from frostfs-node of the following type: code = 2048 message = access to object operation denied: access to operation OBJECT_PUT is denied by extended ACL check: bearer token owner differs from the request sender.
I form the token as follows:

diff --git a/cmd/http-gw/integration_test.go b/cmd/http-gw/integration_test.go  
index c22551c..44a2717 100644  
--- a/cmd/http-gw/integration_test.go  
+++ b/cmd/http-gw/integration_test.go  
@@ -1,5 +1,3 @@  
-//go:build integration  
-  
 package main  
   
 import (  
@@ -9,6 +7,7 @@ import (  
    "encoding/base64"  
    "encoding/json"  
    "fmt"  
+   "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/eacl"  
    "io"  
    "mime/multipart"  
    "net/http"  
@@ -49,6 +48,7 @@ func TestIntegration(t *testing.T) {  
    rootCtx := context.Background()  
    aioImage := "truecloudlab/frostfs-aio:"  
    versions := []string{  
+      "1.2.7",  
       "1.3.0",  
    }  
    key, err := keys.NewPrivateKeyFromHex("1dd37fba80fec4e6a6f13fd708d8dcb3b29def768017052f6c930fa1c5d90bbb")  
@@ -66,7 +66,7 @@ func TestIntegration(t *testing.T) {  
       CID, err := createContainer(ctx, t, clientPool, ownerID, version)  
       require.NoError(t, err, version)  
   
-      token := makeBearerToken(t, key, ownerID)  
+      token := makeBearerToken(t, key, ownerID, version)  
   
       t.Run("simple put "+version, func(t *testing.T) { simplePut(ctx, t, clientPool, CID, version) })  
       t.Run("put with bearer token in header"+version, func(t *testing.T) { putWithBearerTokenInHeader(ctx, t, clientPool, CID, token) })  
@@ -515,11 +515,15 @@ func putObject(ctx context.Context, t *testing.T, clientPool *pool.Pool, ownerID  
    return id  
 }  
   
-func makeBearerToken(t *testing.T, key *keys.PrivateKey, ownerID user.ID) string {  
+func makeBearerToken(t *testing.T, key *keys.PrivateKey, ownerID user.ID, version string) string {  
    tkn := new(bearer.Token)  
    tkn.ForUser(ownerID)  
    tkn.SetExp(10000)  
-   tkn.SetImpersonate(true)  
+   if version == "1.2.7" {  
+      tkn.SetEACLTable(*eacl.NewTable())  
+   } else {  
+      tkn.SetImpersonate(true)  
+   }  
   
    err := tkn.Sign(key.PrivateKey)  
    require.NoError(t, err)
I also wanted to keep the aio version 1.2.7, however, in this case, when the impersonate flag is set, the bearer token frostfs-node will give an error `code = 1024 message = invalid signature` (I understand that at that time there was not yet this flag). If I don't use this flag, I get an error from frostfs-node of the following type: `code = 2048 message = access to object operation denied: access to operation OBJECT_PUT is denied by extended ACL check: bearer token owner differs from the request sender`. I form the token as follows: ```diff diff --git a/cmd/http-gw/integration_test.go b/cmd/http-gw/integration_test.go index c22551c..44a2717 100644 --- a/cmd/http-gw/integration_test.go +++ b/cmd/http-gw/integration_test.go @@ -1,5 +1,3 @@ -//go:build integration - package main import ( @@ -9,6 +7,7 @@ import ( "encoding/base64" "encoding/json" "fmt" + "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/eacl" "io" "mime/multipart" "net/http" @@ -49,6 +48,7 @@ func TestIntegration(t *testing.T) { rootCtx := context.Background() aioImage := "truecloudlab/frostfs-aio:" versions := []string{ + "1.2.7", "1.3.0", } key, err := keys.NewPrivateKeyFromHex("1dd37fba80fec4e6a6f13fd708d8dcb3b29def768017052f6c930fa1c5d90bbb") @@ -66,7 +66,7 @@ func TestIntegration(t *testing.T) { CID, err := createContainer(ctx, t, clientPool, ownerID, version) require.NoError(t, err, version) - token := makeBearerToken(t, key, ownerID) + token := makeBearerToken(t, key, ownerID, version) t.Run("simple put "+version, func(t *testing.T) { simplePut(ctx, t, clientPool, CID, version) }) t.Run("put with bearer token in header"+version, func(t *testing.T) { putWithBearerTokenInHeader(ctx, t, clientPool, CID, token) }) @@ -515,11 +515,15 @@ func putObject(ctx context.Context, t *testing.T, clientPool *pool.Pool, ownerID return id } -func makeBearerToken(t *testing.T, key *keys.PrivateKey, ownerID user.ID) string { +func makeBearerToken(t *testing.T, key *keys.PrivateKey, ownerID user.ID, version string) string { tkn := new(bearer.Token) tkn.ForUser(ownerID) tkn.SetExp(10000) - tkn.SetImpersonate(true) + if version == "1.2.7" { + tkn.SetEACLTable(*eacl.NewTable()) + } else { + tkn.SetImpersonate(true) + } err := tkn.Sign(key.PrivateKey) require.NoError(t, err) ```
r.loginov requested review from storage-services-committers 2024-05-06 18:08:26 +00:00
r.loginov requested review from storage-services-developers 2024-05-06 18:08:27 +00:00
Member

You've got

code = 2048 message = access to object operation denied: access to operation OBJECT_PUT is denied by extended ACL check: bearer token owner differs from the request sender

because of server starts with random key rather than that key for which you create bearer token.
Log says this:

2024-05-07T15:33:30.072+0300	info	http-gw/app.go:331	no wallet path specified, creating ephemeral key automatically for this run

You should start server (runServer function) with this key (you can create tmp wallet file and remove it after test passed, see example creation of tmp file here )

You've got ``` code = 2048 message = access to object operation denied: access to operation OBJECT_PUT is denied by extended ACL check: bearer token owner differs from the request sender ``` because of server starts with random key rather than that key for which you create bearer token. Log says this: ``` 2024-05-07T15:33:30.072+0300 info http-gw/app.go:331 no wallet path specified, creating ephemeral key automatically for this run ``` You should start server (`runServer` function) with [this key](https://git.frostfs.info/r.loginov/frostfs-http-gw/src/commit/2cbd9f47f67770f33de8d6f86e81d9a31aff07e2/cmd/http-gw/integration_test.go#L54) (you can create tmp wallet file and remove it after test passed, see example creation of tmp file [here](https://git.frostfs.info/TrueCloudLab/frostfs-http-gw/src/commit/11965deb4188e78bdbe92b5d4b17e41620f2a86d/internal/handler/multipart_test.go#L33-L36) )
Member

Can you also bump golang.org/x/net to v0.23.0?

Can you also bump ` golang.org/x/net` to `v0.23.0`?
r.loginov force-pushed feature/increase_test_coverage from 2cbd9f47f6 to 5b7b872dcd 2024-05-08 06:58:29 +00:00 Compare
Member

Can you also bump golang.org/x/net to v0.23.0?

There is another problem with vulncheck

> Can you also bump golang.org/x/net to v0.23.0? There is another problem with vulncheck
dkirillov approved these changes 2024-05-08 08:09:55 +00:00
Author
Member

Can you also bump golang.org/x/net to v0.23.0?

There is another problem with vulncheck

Yes, the problem there is that there is a vulnerability in the net package when using version 1.21.9. At the moment, the current version 1.21.9, not 1.21.10, is downloaded during the vulncheck workflow. Perhaps this is due to the fact that version 1.21.10 was released only 6 hours ago (May 8 at 6:32 AM). Do I understand correctly that at the moment we cannot influence the download of a more up-to-date version?

ps. I checked locally with the go version 1.21.10 - everything is OK, there are no vulnerabilities.

> > Can you also bump golang.org/x/net to v0.23.0? > > There is another problem with vulncheck Yes, the problem there is that there is a vulnerability in the net package when using version 1.21.9. At the moment, the current version 1.21.9, not 1.21.10, is downloaded during the vulncheck workflow. Perhaps this is due to the fact that version 1.21.10 [was released](https://github.com/actions/go-versions/releases/tag/1.21.10-8995788853) only 6 hours ago (May 8 at 6:32 AM). Do I understand correctly that at the moment we cannot influence the download of a more up-to-date version? ps. I checked locally with the go version 1.21.10 - everything is OK, there are no vulnerabilities.
Author
Member

I restarted the vulncheck workflow again, this time the correct version was used, and there are no more vulnerabilities.

I restarted the vulncheck workflow again, this time the correct version was used, and there are no more vulnerabilities.
alexvanin approved these changes 2024-05-14 11:31:54 +00:00
alexvanin merged commit 5b7b872dcd into master 2024-05-14 11:32:47 +00:00
alexvanin deleted branch feature/increase_test_coverage 2024-05-14 11:32:47 +00:00
alexvanin referenced this pull request from a commit 2024-05-14 11:32:48 +00:00
alexvanin referenced this pull request from a commit 2024-05-14 11:32:48 +00:00
alexvanin added this to the v0.30.0 milestone 2024-07-16 11:52:36 +00:00
Sign in to join this conversation.
No reviewers
TrueCloudLab/storage-services-developers
No milestone
No project
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: TrueCloudLab/frostfs-http-gw#112
No description provided.