Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 api.go package ec2metadata import ( "encoding/json" "fmt" "net/http" "strconv" "strings" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/internal/sdkuri" ) // getToken uses the duration to return a token for EC2 metadata service, // or an error if the request failed. func (c EC2Metadata) getToken(ctx aws.Context, duration time.Duration) (tokenOutput, error) { op := &request.Operation{ Name: "GetToken", HTTPMethod: "PUT", HTTPPath: "/latest/api/token", } var output tokenOutput req := c.NewRequest(op, nil, &output) req.SetContext(ctx) // remove the fetch token handler from the request handlers to avoid infinite recursion req.Handlers.Sign.RemoveByName(fetchTokenHandlerName) // Swap the unmarshalMetadataHandler with unmarshalTokenHandler on this request. req.Handlers.Unmarshal.Swap(unmarshalMetadataHandlerName, unmarshalTokenHandler) ttl := strconv.FormatInt(int64(duration/time.Second), 10) req.HTTPRequest.Header.Set(ttlHeader, ttl) err := req.Send() // Errors with bad request status should be returned. if err != nil { err = awserr.NewRequestFailure( awserr.New(req.HTTPResponse.Status, http.StatusText(req.HTTPResponse.StatusCode), err), req.HTTPResponse.StatusCode, req.RequestID) } return output, err } // GetMetadata uses the path provided to request information from the EC2 // instance metadata service. The content will be returned as a string, or // error if the request failed. func (c EC2Metadata) GetMetadata(p string) (string, error) { return c.GetMetadataWithContext(aws.BackgroundContext(), p) } // GetMetadataWithContext uses the path provided to request information from the EC2 // instance metadata service. The content will be returned as a string, or // error if the request failed. func (c EC2Metadata) GetMetadataWithContext(ctx aws.Context, p string) (string, error) { op := &request.Operation{ Name: "GetMetadata", HTTPMethod: "GET", HTTPPath: sdkuri.PathJoin("/latest/meta-data", p), } output := &metadataOutput{} req := c.NewRequest(op, nil, output) req.SetContext(ctx) err := req.Send() return output.Content, err } // GetUserData returns the userdata that was configured for the service. If // there is no user-data setup for the EC2 instance a "NotFoundError" error // code will be returned. func (c EC2Metadata) GetUserData() (string, error) { return c.GetUserDataWithContext(aws.BackgroundContext()) } // GetUserDataWithContext returns the userdata that was configured for the service. If // there is no user-data setup for the EC2 instance a "NotFoundError" error // code will be returned. func (c EC2Metadata) GetUserDataWithContext(ctx aws.Context) (string, error) { op := &request.Operation{ Name: "GetUserData", HTTPMethod: "GET", HTTPPath: "/latest/user-data", } output := &metadataOutput{} req := c.NewRequest(op, nil, output) req.SetContext(ctx) err := req.Send() return output.Content, err } // GetDynamicData uses the path provided to request information from the EC2 // instance metadata service for dynamic data. The content will be returned // as a string, or error if the request failed. func (c EC2Metadata) GetDynamicData(p string) (string, error) { return c.GetDynamicDataWithContext(aws.BackgroundContext(), p) } // GetDynamicDataWithContext uses the path provided to request information from the EC2 // instance metadata service for dynamic data. The content will be returned // as a string, or error if the request failed. func (c EC2Metadata) GetDynamicDataWithContext(ctx aws.Context, p string) (string, error) { op := &request.Operation{ Name: "GetDynamicData", HTTPMethod: "GET", HTTPPath: sdkuri.PathJoin("/latest/dynamic", p), } output := &metadataOutput{} req := c.NewRequest(op, nil, output) req.SetContext(ctx) err := req.Send() return output.Content, err } // GetInstanceIdentityDocument retrieves an identity document describing an // instance. Error is returned if the request fails or is unable to parse // the response. func (c EC2Metadata) GetInstanceIdentityDocument() (EC2InstanceIdentityDocument, error) { return c.GetInstanceIdentityDocumentWithContext(aws.BackgroundContext()) } // GetInstanceIdentityDocumentWithContext retrieves an identity document describing an // instance. Error is returned if the request fails or is unable to parse // the response. func (c EC2Metadata) GetInstanceIdentityDocumentWithContext(ctx aws.Context) (EC2InstanceIdentityDocument, error) { resp, err := c.GetDynamicDataWithContext(ctx, "instance-identity/document") if err != nil { return EC2InstanceIdentityDocument{}, awserr.New("EC2MetadataRequestError", "failed to get EC2 instance identity document", err) } doc := EC2InstanceIdentityDocument{} if err := json.NewDecoder(strings.NewReader(resp)).Decode(&doc); err != nil { return EC2InstanceIdentityDocument{}, awserr.New(request.ErrCodeSerialization, "failed to decode EC2 instance identity document", err) } return doc, nil } // IAMInfo retrieves IAM info from the metadata API func (c EC2Metadata) IAMInfo() (EC2IAMInfo, error) { return c.IAMInfoWithContext(aws.BackgroundContext()) } // IAMInfoWithContext retrieves IAM info from the metadata API func (c EC2Metadata) IAMInfoWithContext(ctx aws.Context) (EC2IAMInfo, error) { resp, err := c.GetMetadataWithContext(ctx, "iam/info") if err != nil { return EC2IAMInfo{}, awserr.New("EC2MetadataRequestError", "failed to get EC2 IAM info", err) } info := EC2IAMInfo{} if err := json.NewDecoder(strings.NewReader(resp)).Decode(&info); err != nil { return EC2IAMInfo{}, awserr.New(request.ErrCodeSerialization, "failed to decode EC2 IAM info", err) } if info.Code != "Success" { errMsg := fmt.Sprintf("failed to get EC2 IAM Info (%s)", info.Code) return EC2IAMInfo{}, awserr.New("EC2MetadataError", errMsg, nil) } return info, nil } // Region returns the region the instance is running in. func (c EC2Metadata) Region() (string, error) { return c.RegionWithContext(aws.BackgroundContext()) } // RegionWithContext returns the region the instance is running in. func (c EC2Metadata) RegionWithContext(ctx aws.Context) (string, error) { ec2InstanceIdentityDocument, err := c.GetInstanceIdentityDocumentWithContext(ctx) if err != nil { return "", err } // extract region from the ec2InstanceIdentityDocument region := ec2InstanceIdentityDocument.Region if len(region) == 0 { return "", awserr.New("EC2MetadataError", "invalid region received for ec2metadata instance", nil) } // returns region return region, nil } // Available returns if the application has access to the EC2 Metadata service. // Can be used to determine if application is running within an EC2 Instance and // the metadata service is available. func (c EC2Metadata) Available() bool { return c.AvailableWithContext(aws.BackgroundContext()) } // AvailableWithContext returns if the application has access to the EC2 Metadata service. // Can be used to determine if application is running within an EC2 Instance and // the metadata service is available. func (c *EC2Metadata) AvailableWithContext(ctx aws.Context) bool { if _, err := c.GetMetadataWithContext(ctx, "instance-id"); err != nil { return false } return true } // An EC2IAMInfo provides the shape for unmarshaling // an IAM info from the metadata API type EC2IAMInfo struct { Code string LastUpdated time.Time InstanceProfileArn string InstanceProfileID string } // An EC2InstanceIdentityDocument provides the shape for unmarshaling // an instance identity document type EC2InstanceIdentityDocument struct { DevpayProductCodes []string `json:"devpayProductCodes"` MarketplaceProductCodes []string `json:"marketplaceProductCodes"` AvailabilityZone string `json:"availabilityZone"` PrivateIP string `json:"privateIp"` Version string `json:"version"` Region string `json:"region"` InstanceID string `json:"instanceId"` BillingProducts []string `json:"billingProducts"` InstanceType string `json:"instanceType"` AccountID string `json:"accountId"` PendingTime time.Time `json:"pendingTime"` ImageID string `json:"imageId"` KernelID string `json:"kernelId"` RamdiskID string `json:"ramdiskId"` Architecture string `json:"architecture"` }	8.41 KB	2025-05-25 12:27
📄 api_test.go //go:build go1.7 // +build go1.7 package ec2metadata_test import ( "bytes" "fmt" "io" "io/ioutil" "net/http" "net/http/httptest" "path" "reflect" "strings" "sync" "sync/atomic" "testing" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/ec2metadata" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/internal/sdktesting" ) const instanceIdentityDocument = `{ "devpayProductCodes" : null, "marketplaceProductCodes" : [ "1abc2defghijklm3nopqrs4tu" ], "availabilityZone" : "us-east-1d", "privateIp" : "10.158.112.84", "version" : "2010-08-31", "region" : "us-east-1", "instanceId" : "i-1234567890abcdef0", "billingProducts" : null, "instanceType" : "t1.micro", "accountId" : "123456789012", "pendingTime" : "2015-11-19T16:32:11Z", "imageId" : "ami-5fb8c835", "kernelId" : "aki-919dcaf8", "ramdiskId" : null, "architecture" : "x86_64" }` const validIamInfo = `{ "Code" : "Success", "LastUpdated" : "2016-03-17T12:27:32Z", "InstanceProfileArn" : "arn:aws:iam::123456789012:instance-profile/my-instance-profile", "InstanceProfileId" : "AIPAABCDEFGHIJKLMN123" }` const unsuccessfulIamInfo = `{ "Code" : "Failed", "LastUpdated" : "2016-03-17T12:27:32Z", "InstanceProfileArn" : "arn:aws:iam::123456789012:instance-profile/my-instance-profile", "InstanceProfileId" : "AIPAABCDEFGHIJKLMN123" }` const ( ttlHeader = "x-aws-ec2-metadata-token-ttl-seconds" tokenHeader = "x-aws-ec2-metadata-token" ) type testType int const ( SecureTestType testType = iota InsecureTestType BadRequestTestType NotFoundRequestTestType InvalidTokenRequestTestType ServerErrorForTokenTestType PageNotFoundForTokenTestType PageNotFoundWith401TestType ThrottleErrorForTokenNoFallbackTestType ) type testServer struct { t testing.T tokens []string activeToken atomic.Value data string } type operationListProvider struct { operationsPerformed []string } func getTokenRequiredParams(t testing.T, fn http.HandlerFunc) http.HandlerFunc { return func(w http.ResponseWriter, r http.Request) { if e, a := "PUT", r.Method; e != a { t.Errorf("expect %v, http method got %v", e, a) http.Error(w, "wrong method", 400) return } if len(r.Header.Get(ttlHeader)) == 0 { t.Errorf("expect ttl header to be present in the request headers, got none") http.Error(w, "wrong method", 400) return } fn(w, r) } } func newTestServer(t testing.T, testType testType, testServer testServer) httptest.Server { mux := http.NewServeMux() switch testType { case SecureTestType: mux.HandleFunc("/latest/api/token", getTokenRequiredParams(t, testServer.secureGetTokenHandler)) mux.HandleFunc("/", testServer.secureGetLatestHandler) case InsecureTestType: mux.HandleFunc("/latest/api/token", testServer.insecureGetTokenHandler) mux.HandleFunc("/", testServer.insecureGetLatestHandler) case BadRequestTestType: mux.HandleFunc("/latest/api/token", getTokenRequiredParams(t, testServer.badRequestGetTokenHandler)) mux.HandleFunc("/", testServer.badRequestGetLatestHandler) case NotFoundRequestTestType: mux.HandleFunc("/latest/api/token", getTokenRequiredParams(t, testServer.secureGetTokenHandler)) mux.HandleFunc("/", testServer.notFoundRequestGetLatestHandler) case InvalidTokenRequestTestType: mux.HandleFunc("/latest/api/token", getTokenRequiredParams(t, testServer.secureGetTokenHandler)) mux.HandleFunc("/", testServer.unauthorizedGetLatestHandler) case ServerErrorForTokenTestType: mux.HandleFunc("/latest/api/token", getTokenRequiredParams(t, testServer.serverErrorGetTokenHandler)) mux.HandleFunc("/", testServer.insecureGetLatestHandler) case PageNotFoundForTokenTestType: mux.HandleFunc("/latest/api/token", getTokenRequiredParams(t, testServer.pageNotFoundGetTokenHandler)) mux.HandleFunc("/", testServer.insecureGetLatestHandler) case PageNotFoundWith401TestType: mux.HandleFunc("/latest/api/token", getTokenRequiredParams(t, testServer.pageNotFoundGetTokenHandler)) mux.HandleFunc("/", testServer.unauthorizedGetLatestHandler) case ThrottleErrorForTokenNoFallbackTestType: mux.HandleFunc("/latest/api/token", getTokenRequiredParams(t, testServer.throtleErrorGetTokenHandler)) mux.HandleFunc("/", testServer.unauthorizedGetLatestHandler) } return httptest.NewServer(mux) } func (s testServer) secureGetTokenHandler(w http.ResponseWriter, r http.Request) { token := s.tokens[0] // set the active token s.activeToken.Store(token) // rotate the token if len(s.tokens) > 1 { s.tokens = s.tokens[1:] } // set the header and response body w.Header().Set(ttlHeader, r.Header.Get(ttlHeader)) if activeToken, ok := s.activeToken.Load().(string); ok { w.Write([]byte(activeToken)) } else { s.t.Fatalf("Expected activeToken to be of type string, got %v", activeToken) } } func (s testServer) secureGetLatestHandler(w http.ResponseWriter, r http.Request) { if s.activeToken.Load() == nil { s.t.Errorf("expect token to have been requested, was not") http.Error(w, "", 401) return } if e, a := s.activeToken.Load(), r.Header.Get(tokenHeader); e != a { s.t.Errorf("expect %v token, got %v", e, a) http.Error(w, "", 401) return } w.Header().Set(ttlHeader, r.Header.Get(ttlHeader)) w.Write([]byte(s.data)) } func (s testServer) insecureGetTokenHandler(w http.ResponseWriter, r http.Request) { http.Error(w, "", 404) } func (s testServer) insecureGetLatestHandler(w http.ResponseWriter, r http.Request) { if len(r.Header.Get(tokenHeader)) != 0 { s.t.Errorf("Request token found, expected none") http.Error(w, "", 400) return } w.Write([]byte(s.data)) } func (s testServer) badRequestGetTokenHandler(w http.ResponseWriter, r http.Request) { http.Error(w, "", 400) } func (s testServer) badRequestGetLatestHandler(w http.ResponseWriter, r http.Request) { s.t.Errorf("Expected no call to this handler, incorrect behavior found") } func (s testServer) notFoundRequestGetLatestHandler(w http.ResponseWriter, r http.Request) { http.Error(w, "not found error", 404) } func (s testServer) serverErrorGetTokenHandler(w http.ResponseWriter, r http.Request) { http.Error(w, "", 403) } func (s testServer) pageNotFoundGetTokenHandler(w http.ResponseWriter, r http.Request) { http.Error(w, "Page not found error", 404) } func (s testServer) unauthorizedGetLatestHandler(w http.ResponseWriter, r http.Request) { http.Error(w, "", 401) } func (s testServer) throtleErrorGetTokenHandler(w http.ResponseWriter, r http.Request) { http.Error(w, "", 429) } func (opListProvider operationListProvider) addToOperationPerformedList(r request.Request) { opListProvider.operationsPerformed = append(opListProvider.operationsPerformed, r.Operation.Name) } func TestEndpoint(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() c := ec2metadata.New(unit.Session) op := &request.Operation{ Name: "GetMetadata", HTTPMethod: "GET", HTTPPath: path.Join("/latest", "meta-data", "testpath"), } req := c.NewRequest(op, nil, nil) if e, a := "http://169.254.169.254/latest/meta-data/testpath", req.HTTPRequest.URL.String(); e != a { t.Errorf("expect %v, got %v", e, a) } } func TestGetMetadata(t testing.T) { cases := map[string]struct { tokens []string NewServer func(t testing.T, tokens []string) httptest.Server expectedData string expectedError string expectedOperationsAttempted []string enableImdsFallback bool }{ "Insecure server success case": { NewServer: func(t testing.T, tokens []string) httptest.Server { testType := InsecureTestType Ts := &testServer{ t: t, tokens: tokens, data: "IMDSProfileForGoSDK", } return newTestServer(t, testType, Ts) }, expectedData: "IMDSProfileForGoSDK", expectedOperationsAttempted: []string{"GetToken", "GetMetadata", "GetMetadata"}, }, "Secure server success case": { tokens: []string{"firstToken", "secondToken", "thirdToken"}, NewServer: func(t testing.T, tokens []string) httptest.Server { testType := SecureTestType Ts := &testServer{ t: t, tokens: tokens, data: "IMDSProfileForGoSDK", } return newTestServer(t, testType, Ts) }, expectedData: "IMDSProfileForGoSDK", expectedError: "", expectedOperationsAttempted: []string{"GetToken", "GetMetadata", "GetMetadata"}, }, "Bad token request case": { tokens: []string{"firstToken", "secondToken", "thirdToken"}, NewServer: func(t testing.T, tokens []string) httptest.Server { testType := BadRequestTestType Ts := &testServer{ t: t, tokens: tokens, data: "IMDSProfileForGoSDK", } return newTestServer(t, testType, Ts) }, expectedError: "400", expectedOperationsAttempted: []string{"GetToken", "GetToken"}, }, "Not found no retry request case": { tokens: []string{"firstToken", "secondToken", "thirdToken"}, NewServer: func(t testing.T, tokens []string) httptest.Server { testType := NotFoundRequestTestType Ts := &testServer{ t: t, tokens: tokens, data: "IMDSProfileForGoSDK", } return newTestServer(t, testType, Ts) }, expectedError: "404", expectedOperationsAttempted: []string{"GetToken", "GetMetadata", "GetMetadata"}, }, "invalid token request case": { tokens: []string{"firstToken", "secondToken", "thirdToken"}, NewServer: func(t testing.T, tokens []string) httptest.Server { testType := InvalidTokenRequestTestType Ts := &testServer{ t: t, tokens: tokens, data: "IMDSProfileForGoSDK", } return newTestServer(t, testType, Ts) }, expectedError: "401", expectedOperationsAttempted: []string{"GetToken", "GetMetadata", "GetToken", "GetMetadata"}, }, "ServerErrorForTokenTestType": { NewServer: func(t testing.T, tokens []string) httptest.Server { testType := ServerErrorForTokenTestType Ts := &testServer{ t: t, tokens: []string{}, data: "IMDSProfileForGoSDK", } return newTestServer(t, testType, Ts) }, expectedData: "IMDSProfileForGoSDK", expectedOperationsAttempted: []string{"GetToken", "GetMetadata", "GetMetadata"}, }, "No fallback to IMDSv1": { NewServer: func(t testing.T, tokens []string) httptest.Server { testType := ThrottleErrorForTokenNoFallbackTestType Ts := &testServer{ t: t, tokens: []string{}, data: "IMDSProfileForGoSDK", } return newTestServer(t, testType, Ts) }, expectedError: "failed to get IMDSv2 token and fallback to IMDSv1 is disabled", // 2 attempts + 2 retries per/attempt expectedOperationsAttempted: []string{"GetToken", "GetToken", "GetToken", "GetToken", "GetToken", "GetToken"}, enableImdsFallback: aws.Bool(false), }, } for name, x := range cases { t.Run(name, func(t testing.T) { server := x.NewServer(t, x.tokens) defer server.Close() op := &operationListProvider{} c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), EC2MetadataEnableFallback: x.enableImdsFallback, }) c.Handlers.CompleteAttempt.PushBack(op.addToOperationPerformedList) tokenCounter := -1 c.Handlers.Send.PushBack(func(r request.Request) { switch r.Operation.Name { case "GetToken": tokenCounter++ case "GetMetadata": curToken := r.HTTPRequest.Header.Get("x-aws-ec2-metadata-token") if len(curToken) != 0 && curToken != x.tokens[tokenCounter] { t.Errorf("expect %v token, got %v", x.tokens[tokenCounter], curToken) } } }) resp, err := c.GetMetadata("some/path") // token should stay alive, since default duration is 26000 seconds resp, err = c.GetMetadata("some/path") if len(x.expectedError) != 0 { if err == nil { t.Fatalf("expect %v error, got none", x.expectedError) } if e, a := x.expectedError, err.Error(); !strings.Contains(a, e) { t.Fatalf("expect %v error, got %v", e, a) } } else if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := x.expectedData, resp; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := x.expectedOperationsAttempted, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Errorf("expect %v operations, got %v", e, a) } }) } } func TestGetUserData_Error(t testing.T) { server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { reader := strings.NewReader(`<?xml version="1.0" encoding="iso-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body> </html>`) w.Header().Set("Content-Type", "text/html") w.Header().Set("Content-Length", fmt.Sprintf("%d", reader.Len())) w.WriteHeader(http.StatusNotFound) io.Copy(w, reader) })) defer server.Close() c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) resp, err := c.GetUserData() if err == nil { t.Fatalf("expect error") } if len(resp) != 0 { t.Fatalf("expect empty, got %v", resp) } if requestFailedError, ok := err.(awserr.RequestFailure); ok { if e, a := http.StatusNotFound, requestFailedError.StatusCode(); e != a { t.Fatalf("expect %v, got %v", e, a) } } } func TestGetRegion(t testing.T) { cases := map[string]struct { NewServer func(t testing.T) httptest.Server expectedData string expectedError string expectedOperationsPerformed []string }{ "Insecure server success case": { NewServer: func(t testing.T) httptest.Server { testType := InsecureTestType Ts := &testServer{ t: t, data: instanceIdentityDocument, } return newTestServer(t, testType, Ts) }, expectedData: "us-east-1", expectedOperationsPerformed: []string{"GetToken", "GetDynamicData"}, }, "Secure server success case": { NewServer: func(t testing.T) httptest.Server { testType := SecureTestType Ts := &testServer{ t: t, tokens: []string{"firstToken", "secondToken", "thirdToken"}, data: instanceIdentityDocument, } return newTestServer(t, testType, Ts) }, expectedData: "us-east-1", expectedOperationsPerformed: []string{"GetToken", "GetDynamicData"}, }, "Bad request case": { NewServer: func(t testing.T) httptest.Server { testType := BadRequestTestType Ts := &testServer{ t: t, tokens: []string{"firstToken", "secondToken", "thirdToken"}, data: instanceIdentityDocument, } return newTestServer(t, testType, Ts) }, expectedError: "400", expectedOperationsPerformed: []string{"GetToken", "GetDynamicData"}, }, "ServerErrorForTokenTestType": { NewServer: func(t testing.T) httptest.Server { testType := ServerErrorForTokenTestType Ts := &testServer{ t: t, tokens: []string{}, data: instanceIdentityDocument, } return newTestServer(t, testType, Ts) }, expectedData: "us-east-1", expectedOperationsPerformed: []string{"GetToken", "GetDynamicData"}, }, } for name, x := range cases { t.Run(name, func(t testing.T) { server := x.NewServer(t) defer server.Close() op := &operationListProvider{} c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) c.Handlers.Complete.PushBack(op.addToOperationPerformedList) resp, err := c.Region() if len(x.expectedError) != 0 { if err == nil { t.Fatalf("expect %v error, got none", x.expectedError) } if e, a := x.expectedError, err.Error(); !strings.Contains(a, e) { t.Fatalf("expect %v error, got %v", e, a) } } else if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := x.expectedData, resp; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := x.expectedOperationsPerformed, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Fatalf("expect %v operations, got %v", e, a) } }) } } func TestMetadataIAMInfo_success(t testing.T) { cases := map[string]struct { NewServer func(t testing.T) httptest.Server expectedData string expectedError string expectedOperationsPerformed []string }{ "Insecure server success case": { NewServer: func(t testing.T) httptest.Server { testType := InsecureTestType Ts := &testServer{ t: t, data: validIamInfo, } return newTestServer(t, testType, Ts) }, expectedData: validIamInfo, expectedOperationsPerformed: []string{"GetToken", "GetMetadata"}, }, "Secure server success case": { NewServer: func(t testing.T) httptest.Server { testType := SecureTestType Ts := &testServer{ t: t, tokens: []string{"firstToken", "secondToken", "thirdToken"}, data: validIamInfo, } return newTestServer(t, testType, Ts) }, expectedData: validIamInfo, expectedOperationsPerformed: []string{"GetToken", "GetMetadata"}, }, } for name, x := range cases { t.Run(name, func(t testing.T) { server := x.NewServer(t) defer server.Close() op := &operationListProvider{} c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) c.Handlers.Complete.PushBack(op.addToOperationPerformedList) iamInfo, err := c.IAMInfo() if len(x.expectedError) != 0 { if err == nil { t.Fatalf("expect %v error, got none", x.expectedError) } if e, a := x.expectedError, err.Error(); !strings.Contains(a, e) { t.Fatalf("expect %v error, got %v", e, a) } } else if err != nil { t.Fatalf("expect no error, got %v", err) } if e, a := "Success", iamInfo.Code; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := "arn:aws:iam::123456789012:instance-profile/my-instance-profile", iamInfo.InstanceProfileArn; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := "AIPAABCDEFGHIJKLMN123", iamInfo.InstanceProfileID; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := x.expectedOperationsPerformed, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Fatalf("expect %v operations, got %v", e, a) } }) } } func TestMetadataIAMInfo_failure(t testing.T) { cases := map[string]struct { NewServer func(t testing.T) httptest.Server expectedData string expectedError string expectedOperationsPerformed []string }{ "Insecure server success case": { NewServer: func(t testing.T) httptest.Server { testType := InsecureTestType Ts := &testServer{ t: t, tokens: nil, data: unsuccessfulIamInfo, } return newTestServer(t, testType, Ts) }, expectedData: unsuccessfulIamInfo, expectedOperationsPerformed: []string{"GetToken", "GetMetadata"}, }, "Secure server success case": { NewServer: func(t testing.T) httptest.Server { testType := SecureTestType Ts := &testServer{ t: t, tokens: []string{"firstToken", "secondToken", "thirdToken"}, data: unsuccessfulIamInfo, } return newTestServer(t, testType, Ts) }, expectedData: unsuccessfulIamInfo, expectedOperationsPerformed: []string{"GetToken", "GetMetadata"}, }, } for name, x := range cases { t.Run(name, func(t testing.T) { server := x.NewServer(t) defer server.Close() op := &operationListProvider{} c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) c.Handlers.Complete.PushBack(op.addToOperationPerformedList) iamInfo, err := c.IAMInfo() if err == nil { t.Fatalf("expect error") } if e, a := "", iamInfo.Code; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := "", iamInfo.InstanceProfileArn; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := "", iamInfo.InstanceProfileID; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := x.expectedOperationsPerformed, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Fatalf("expect %v operations, got %v", e, a) } }) } } func TestMetadataNotAvailable(t testing.T) { c := ec2metadata.New(unit.Session) c.Handlers.Send.Clear() c.Handlers.Send.PushBack(func(r request.Request) { r.HTTPResponse = &http.Response{ StatusCode: int(0), Status: http.StatusText(int(0)), Body: ioutil.NopCloser(bytes.NewReader([]byte{})), } r.Error = awserr.New(request.ErrCodeRequestError, "send request failed", nil) r.Retryable = aws.Bool(true) // network errors are retryable }) if c.Available() { t.Fatalf("expect not available") } } func TestMetadataErrorResponse(t testing.T) { c := ec2metadata.New(unit.Session) c.Handlers.Send.Clear() c.Handlers.Send.PushBack(func(r request.Request) { r.HTTPResponse = &http.Response{ StatusCode: http.StatusBadRequest, Status: http.StatusText(http.StatusBadRequest), Body: ioutil.NopCloser(strings.NewReader("error message text")), } r.Retryable = aws.Bool(false) // network errors are retryable }) data, err := c.GetMetadata("uri/path") if e, a := "error message text", err.Error(); !strings.Contains(a, e) { t.Fatalf("expect %v to be in %v", e, a) } if len(data) != 0 { t.Fatalf("expect empty, got %v", data) } } func TestEC2RoleProviderInstanceIdentity(t testing.T) { cases := map[string]struct { NewServer func(t testing.T) httptest.Server expectedData string expectedOperationsPerformed []string }{ "Insecure server success case": { NewServer: func(t testing.T) httptest.Server { testType := InsecureTestType Ts := &testServer{ t: t, tokens: nil, data: instanceIdentityDocument, } return newTestServer(t, testType, Ts) }, expectedData: instanceIdentityDocument, expectedOperationsPerformed: []string{"GetToken", "GetDynamicData"}, }, "Secure server success case": { NewServer: func(t testing.T) httptest.Server { testType := SecureTestType Ts := &testServer{ t: t, tokens: []string{"firstToken", "secondToken", "thirdToken"}, data: instanceIdentityDocument, } return newTestServer(t, testType, Ts) }, expectedData: instanceIdentityDocument, expectedOperationsPerformed: []string{"GetToken", "GetDynamicData"}, }, } for name, x := range cases { t.Run(name, func(t testing.T) { server := x.NewServer(t) defer server.Close() op := &operationListProvider{} c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) c.Handlers.Complete.PushBack(op.addToOperationPerformedList) doc, err := c.GetInstanceIdentityDocument() if err != nil { t.Fatalf("expected no error, got %v", err) } if e, a := doc.AccountID, "123456789012"; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := doc.AvailabilityZone, "us-east-1d"; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := doc.Region, "us-east-1"; e != a { t.Fatalf("expect %v, got %v", e, a) } if e, a := x.expectedOperationsPerformed, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Fatalf("expect %v operations, got %v", e, a) } }) } } func TestEC2MetadataRetryFailure(t testing.T) { mux := http.NewServeMux() mux.HandleFunc("/latest/api/token", func(w http.ResponseWriter, r http.Request) { if r.Method == "PUT" && r.Header.Get(ttlHeader) != "" { w.Header().Set(ttlHeader, "200") http.Error(w, "service unavailable", http.StatusServiceUnavailable) return } http.Error(w, "bad request", http.StatusBadRequest) }) // meta-data endpoint for this test, just returns the token mux.HandleFunc("/latest/meta-data/", func(w http.ResponseWriter, r http.Request) { w.Write([]byte("profile_name")) }) server := httptest.NewServer(mux) defer server.Close() c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) c.Handlers.AfterRetry.PushBack(func(i request.Request) { t.Logf("%v received, retrying operation %v", i.HTTPResponse.StatusCode, i.Operation.Name) }) c.Handlers.Complete.PushBack(func(i request.Request) { t.Logf("%v operation exited with status %v", i.Operation.Name, i.HTTPResponse.StatusCode) }) resp, err := c.GetMetadata("some/path") if err != nil { t.Fatalf("Expected none, got error %v", err) } if resp != "profile_name" { t.Fatalf("Expected response to be profile_name, got %v", resp) } resp, err = c.GetMetadata("some/path") if err != nil { t.Fatalf("Expected none, got error %v", err) } if resp != "profile_name" { t.Fatalf("Expected response to be profile_name, got %v", resp) } } func TestEC2MetadataRetryOnce(t testing.T) { var secureDataFlow bool var retry = true mux := http.NewServeMux() mux.HandleFunc("/latest/api/token", func(w http.ResponseWriter, r http.Request) { if r.Method == "PUT" && r.Header.Get(ttlHeader) != "" { w.Header().Set(ttlHeader, "200") for retry { retry = false http.Error(w, "service unavailable", http.StatusServiceUnavailable) return } w.Write([]byte("token")) secureDataFlow = true return } http.Error(w, "bad request", http.StatusBadRequest) }) // meta-data endpoint for this test, just returns the token mux.HandleFunc("/latest/meta-data/", func(w http.ResponseWriter, r http.Request) { w.Write([]byte(r.Header.Get(tokenHeader))) }) var tokenRetryCount int server := httptest.NewServer(mux) defer server.Close() c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) // Handler on client that logs if retried c.Handlers.AfterRetry.PushBack(func(i request.Request) { t.Logf("%v received, retrying operation %v", i.HTTPResponse.StatusCode, i.Operation.Name) tokenRetryCount++ }) _, err := c.GetMetadata("some/path") if tokenRetryCount != 1 { t.Fatalf("Expected number of retries for fetching token to be 1, got %v", tokenRetryCount) } if !secureDataFlow { t.Fatalf("Expected secure data flow to be %v, got %v", secureDataFlow, !secureDataFlow) } if err != nil { t.Fatalf("Expected none, got error %v", err) } } func TestEC2Metadata_Concurrency(t testing.T) { ts := &testServer{ t: t, tokens: []string{"firstToken"}, data: "IMDSProfileForSDKGo", } server := newTestServer(t, SecureTestType, ts) defer server.Close() c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) var wg sync.WaitGroup wg.Add(10) for i := 0; i < 10; i++ { go func() { defer wg.Done() for j := 0; j < 10; j++ { resp, err := c.GetMetadata("some/data") if err != nil { t.Errorf("expect no error, got %v", err) } if e, a := "IMDSProfileForSDKGo", resp; e != a { t.Errorf("expect %v, got %v", e, a) } } }() } wg.Wait() } func TestRequestOnMetadata(t testing.T) { ts := &testServer{ t: t, tokens: []string{"firstToken", "secondToken"}, data: "profile_name", } server := newTestServer(t, SecureTestType, ts) defer server.Close() c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) req := c.NewRequest(&request.Operation{ Name: "Ec2Metadata request", HTTPMethod: "GET", HTTPPath: "/latest/foo", Paginator: nil, BeforePresignFn: nil, }, nil, nil) op := &operationListProvider{} c.Handlers.Complete.PushBack(op.addToOperationPerformedList) err := req.Send() if err != nil { t.Fatalf("expect no error, got %v", err) } if len(op.operationsPerformed) < 1 { t.Fatalf("Expected atleast one operation GetToken to be called on EC2Metadata client") return } if op.operationsPerformed[0] != "GetToken" { t.Fatalf("Expected GetToken operation to be called") } } func TestExhaustiveRetryToFetchToken(t testing.T) { ts := &testServer{ t: t, tokens: []string{"firstToken", "secondToken"}, data: "IMDSProfileForSDKGo", } server := newTestServer(t, PageNotFoundForTokenTestType, ts) defer server.Close() op := &operationListProvider{} c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) c.Handlers.Complete.PushBack(op.addToOperationPerformedList) resp, err := c.GetMetadata("/some/path") if err != nil { t.Fatalf("Expected no error, got %v", err) } if e, a := "IMDSProfileForSDKGo", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } resp, err = c.GetMetadata("/some/path") if err != nil { t.Fatalf("Expected no error, got %v", err) } if e, a := "IMDSProfileForSDKGo", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } resp, err = c.GetMetadata("/some/path") if err != nil { t.Fatalf("Expected no error, got %v", err) } if e, a := "IMDSProfileForSDKGo", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } resp, err = c.GetMetadata("/some/path") expectedOperationsPerformed := []string{"GetToken", "GetMetadata", "GetMetadata", "GetMetadata", "GetMetadata"} if err != nil { t.Fatalf("Expected no error, got %v", err) } if e, a := "IMDSProfileForSDKGo", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } if e, a := expectedOperationsPerformed, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Fatalf("expect %v operations, got %v", e, a) } } func TestExhaustiveRetryWith401(t testing.T) { ts := &testServer{ t: t, tokens: []string{"firstToken", "secondToken"}, data: "IMDSProfileForSDKGo", } server := newTestServer(t, PageNotFoundWith401TestType, ts) defer server.Close() op := &operationListProvider{} c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) c.Handlers.Complete.PushBack(op.addToOperationPerformedList) resp, err := c.GetMetadata("/some/path") if err == nil { t.Fatalf("Expected %v error, got none", err) } if e, a := "", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } resp, err = c.GetMetadata("/some/path") if err == nil { t.Fatalf("Expected %v error, got none", err) } if e, a := "", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } resp, err = c.GetMetadata("/some/path") if err == nil { t.Fatalf("Expected %v error, got none", err) } if e, a := "", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } resp, err = c.GetMetadata("/some/path") expectedOperationsPerformed := []string{"GetToken", "GetMetadata", "GetToken", "GetMetadata", "GetToken", "GetMetadata", "GetToken", "GetMetadata"} if err == nil { t.Fatalf("Expected %v error, got none", err) } if e, a := "", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } if e, a := expectedOperationsPerformed, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Fatalf("expect %v operations, got %v", e, a) } } func TestRequestTimeOut(t testing.T) { mux := http.NewServeMux() done := make(chan bool) mux.HandleFunc("/latest/api/token", func(w http.ResponseWriter, r http.Request) { // wait to read from channel done <-done }) mux.HandleFunc("/latest/", func(w http.ResponseWriter, r http.Request) { if len(r.Header.Get(tokenHeader)) != 0 { http.Error(w, "", 400) return } w.Write([]byte("IMDSProfileForSDKGo")) }) server := httptest.NewServer(mux) defer server.Close() defer close(done) op := &operationListProvider{} c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) // for test, change the timeout to 100 ms c.Config.HTTPClient.Timeout = 100 time.Millisecond c.Handlers.Complete.PushBack(op.addToOperationPerformedList) start := time.Now() resp, err := c.GetMetadata("/some/path") if e, a := 1time.Second, time.Since(start); e < a { t.Fatalf("expected duration of test to be less than %v, got %v", e, a) } if e, a := "IMDSProfileForSDKGo", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } if err != nil { t.Fatalf("Expected no error, got %v", err) } expectedOperationsPerformed := []string{"GetToken", "GetMetadata"} if e, a := expectedOperationsPerformed, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Fatalf("expect %v operations, got %v", e, a) } start = time.Now() resp, err = c.GetMetadata("/some/path") if e, a := 1time.Second, time.Since(start); e < a { t.Fatalf("expected duration of test to be less than %v, got %v", e, a) } if e, a := "IMDSProfileForSDKGo", resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } if err != nil { t.Fatalf("Expected no error, got %v", err) } expectedOperationsPerformed = []string{"GetToken", "GetMetadata", "GetToken", "GetMetadata"} if e, a := expectedOperationsPerformed, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Fatalf("expect %v operations, got %v", e, a) } } func TestTokenExpiredBehavior(t testing.T) { tokens := []string{"firstToken", "secondToken", "thirdToken"} var activeToken string mux := http.NewServeMux() mux.HandleFunc("/latest/api/token", func(w http.ResponseWriter, r http.Request) { if r.Method == "PUT" && r.Header.Get(ttlHeader) != "" { // set ttl to 0, so TTL is expired. w.Header().Set(ttlHeader, "0") activeToken = tokens[0] if len(tokens) > 1 { tokens = tokens[1:] } w.Write([]byte(activeToken)) return } http.Error(w, "bad request", http.StatusBadRequest) }) // meta-data endpoint for this test, just returns the token mux.HandleFunc("/latest/meta-data/", func(w http.ResponseWriter, r *http.Request) { w.Header().Set(ttlHeader, r.Header.Get(ttlHeader)) w.Write([]byte(r.Header.Get(tokenHeader))) }) server := httptest.NewServer(mux) defer server.Close() op := &operationListProvider{} c := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(server.URL), }) c.Handlers.Complete.PushBack(op.addToOperationPerformedList) resp, err := c.GetMetadata("/some/path") if err != nil { t.Fatalf("Expected no error, got %v", err) } if e, a := activeToken, resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } // store the token received before var firstToken = activeToken resp, err = c.GetMetadata("/some/path") if err != nil { t.Fatalf("Expected no error, got %v", err) } if e, a := activeToken, resp; e != a { t.Fatalf("Expected %v, got %v", e, a) } // Since TTL is 0, we should have received a new token if firstToken == activeToken { t.Fatalf("Expected token should have expired, and not the same") } expectedOperationsPerformed := []string{"GetToken", "GetMetadata", "GetToken", "GetMetadata"} if e, a := expectedOperationsPerformed, op.operationsPerformed; !reflect.DeepEqual(e, a) { t.Fatalf("expect %v operations, got %v", e, a) } }	34.54 KB	2025-05-25 12:27
📄 service.go // Package ec2metadata provides the client for making API calls to the // EC2 Metadata service. // // This package's client can be disabled completely by setting the environment // variable "AWS_EC2_METADATA_DISABLED=true". This environment variable set to // true instructs the SDK to disable the EC2 Metadata client. The client cannot // be used while the environment variable is set to true, (case insensitive). // // The endpoint of the EC2 IMDS client can be configured via the environment // variable, AWS_EC2_METADATA_SERVICE_ENDPOINT when creating the client with a // Session. See aws/session#Options.EC2IMDSEndpoint for more details. package ec2metadata import ( "bytes" "io" "net/http" "net/url" "os" "strconv" "strings" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/client" "github.com/aws/aws-sdk-go/aws/client/metadata" "github.com/aws/aws-sdk-go/aws/corehandlers" "github.com/aws/aws-sdk-go/aws/request" ) const ( // ServiceName is the name of the service. ServiceName = "ec2metadata" disableServiceEnvVar = "AWS_EC2_METADATA_DISABLED" // Headers for Token and TTL ttlHeader = "x-aws-ec2-metadata-token-ttl-seconds" tokenHeader = "x-aws-ec2-metadata-token" // Named Handler constants fetchTokenHandlerName = "FetchTokenHandler" unmarshalMetadataHandlerName = "unmarshalMetadataHandler" unmarshalTokenHandlerName = "unmarshalTokenHandler" enableTokenProviderHandlerName = "enableTokenProviderHandler" // TTL constants defaultTTL = 21600 * time.Second ttlExpirationWindow = 30 * time.Second ) // A EC2Metadata is an EC2 Metadata service Client. type EC2Metadata struct { client.Client } // New creates a new instance of the EC2Metadata client with a session. // This client is safe to use across multiple goroutines. // // Example: // // // Create a EC2Metadata client from just a session. // svc := ec2metadata.New(mySession) // // // Create a EC2Metadata client with additional configuration // svc := ec2metadata.New(mySession, aws.NewConfig().WithLogLevel(aws.LogDebugHTTPBody)) func New(p client.ConfigProvider, cfgs ...aws.Config) EC2Metadata { c := p.ClientConfig(ServiceName, cfgs...) return NewClient(c.Config, c.Handlers, c.Endpoint, c.SigningRegion) } // NewClient returns a new EC2Metadata client. Should be used to create // a client when not using a session. Generally using just New with a session // is preferred. // // Will remove the URL path from the endpoint provided to ensure the EC2 IMDS // client is able to communicate with the EC2 IMDS API. // // If an unmodified HTTP client is provided from the stdlib default, or no client // the EC2RoleProvider's EC2Metadata HTTP client's timeout will be shortened. // To disable this set Config.EC2MetadataDisableTimeoutOverride to false. Enabled by default. func NewClient(cfg aws.Config, handlers request.Handlers, endpoint, signingRegion string, opts ...func(client.Client)) EC2Metadata { if !aws.BoolValue(cfg.EC2MetadataDisableTimeoutOverride) && httpClientZero(cfg.HTTPClient) { // If the http client is unmodified and this feature is not disabled // set custom timeouts for EC2Metadata requests. cfg.HTTPClient = &http.Client{ // use a shorter timeout than default because the metadata // service is local if it is running, and to fail faster // if not running on an ec2 instance. Timeout: 1 * time.Second, } // max number of retries on the client operation cfg.MaxRetries = aws.Int(2) } if u, err := url.Parse(endpoint); err == nil { // Remove path from the endpoint since it will be added by requests. // This is an artifact of the SDK adding `/latest` to the endpoint for // EC2 IMDS, but this is now moved to the operation definition. u.Path = "" u.RawPath = "" endpoint = u.String() } svc := &EC2Metadata{ Client: client.New( cfg, metadata.ClientInfo{ ServiceName: ServiceName, ServiceID: ServiceName, Endpoint: endpoint, APIVersion: "latest", }, handlers, ), } // token provider instance tp := newTokenProvider(svc, defaultTTL) // NamedHandler for fetching token svc.Handlers.Sign.PushBackNamed(request.NamedHandler{ Name: fetchTokenHandlerName, Fn: tp.fetchTokenHandler, }) // NamedHandler for enabling token provider svc.Handlers.Complete.PushBackNamed(request.NamedHandler{ Name: enableTokenProviderHandlerName, Fn: tp.enableTokenProviderHandler, }) svc.Handlers.Unmarshal.PushBackNamed(unmarshalHandler) svc.Handlers.UnmarshalError.PushBack(unmarshalError) svc.Handlers.Validate.Clear() svc.Handlers.Validate.PushBack(validateEndpointHandler) // Disable the EC2 Metadata service if the environment variable is set. // This short-circuits the service's functionality to always fail to send // requests. if strings.ToLower(os.Getenv(disableServiceEnvVar)) == "true" { svc.Handlers.Send.SwapNamed(request.NamedHandler{ Name: corehandlers.SendHandler.Name, Fn: func(r request.Request) { r.HTTPResponse = &http.Response{ Header: http.Header{}, } r.Error = awserr.New( request.CanceledErrorCode, "EC2 IMDS access disabled via "+disableServiceEnvVar+" env var", nil) }, }) } // Add additional options to the service config for _, option := range opts { option(svc.Client) } return svc } func httpClientZero(c http.Client) bool { return c == nil \|\| (c.Transport == nil && c.CheckRedirect == nil && c.Jar == nil && c.Timeout == 0) } type metadataOutput struct { Content string } type tokenOutput struct { Token string TTL time.Duration } // unmarshal token handler is used to parse the response of a getToken operation var unmarshalTokenHandler = request.NamedHandler{ Name: unmarshalTokenHandlerName, Fn: func(r request.Request) { defer r.HTTPResponse.Body.Close() var b bytes.Buffer if _, err := io.Copy(&b, r.HTTPResponse.Body); err != nil { r.Error = awserr.NewRequestFailure(awserr.New(request.ErrCodeSerialization, "unable to unmarshal EC2 metadata response", err), r.HTTPResponse.StatusCode, r.RequestID) return } v := r.HTTPResponse.Header.Get(ttlHeader) data, ok := r.Data.(tokenOutput) if !ok { return } data.Token = b.String() // TTL is in seconds i, err := strconv.ParseInt(v, 10, 64) if err != nil { r.Error = awserr.NewRequestFailure(awserr.New(request.ParamFormatErrCode, "unable to parse EC2 token TTL response", err), r.HTTPResponse.StatusCode, r.RequestID) return } t := time.Duration(i) * time.Second data.TTL = t }, } var unmarshalHandler = request.NamedHandler{ Name: unmarshalMetadataHandlerName, Fn: func(r request.Request) { defer r.HTTPResponse.Body.Close() var b bytes.Buffer if _, err := io.Copy(&b, r.HTTPResponse.Body); err != nil { r.Error = awserr.NewRequestFailure(awserr.New(request.ErrCodeSerialization, "unable to unmarshal EC2 metadata response", err), r.HTTPResponse.StatusCode, r.RequestID) return } if data, ok := r.Data.(metadataOutput); ok { data.Content = b.String() } }, } func unmarshalError(r request.Request) { defer r.HTTPResponse.Body.Close() var b bytes.Buffer if _, err := io.Copy(&b, r.HTTPResponse.Body); err != nil { r.Error = awserr.NewRequestFailure( awserr.New(request.ErrCodeSerialization, "unable to unmarshal EC2 metadata error response", err), r.HTTPResponse.StatusCode, r.RequestID) return } // Response body format is not consistent between metadata endpoints. // Grab the error message as a string and include that as the source error r.Error = awserr.NewRequestFailure( awserr.New("EC2MetadataError", "failed to make EC2Metadata request\n"+b.String(), nil), r.HTTPResponse.StatusCode, r.RequestID) } func validateEndpointHandler(r request.Request) { if r.ClientInfo.Endpoint == "" { r.Error = aws.ErrMissingEndpoint } }	7.73 KB	2025-05-25 12:27
📄 service_test.go //go:build go1.7 // +build go1.7 package ec2metadata_test import ( "net/http" "net/http/httptest" "os" "strings" "sync" "testing" "time" "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/ec2metadata" "github.com/aws/aws-sdk-go/aws/request" "github.com/aws/aws-sdk-go/awstesting/unit" "github.com/aws/aws-sdk-go/internal/sdktesting" ) func TestClientOverrideDefaultHTTPClientTimeout(t testing.T) { svc := ec2metadata.New(unit.Session) if e, a := http.DefaultClient, svc.Config.HTTPClient; e == a { t.Errorf("expect %v, not to equal %v", e, a) } if e, a := 1time.Second, svc.Config.HTTPClient.Timeout; e != a { t.Errorf("expect %v to be %v", e, a) } } func TestClientNotOverrideDefaultHTTPClientTimeout(t testing.T) { http.DefaultClient.Transport = &http.Transport{} defer func() { http.DefaultClient.Transport = nil }() svc := ec2metadata.New(unit.Session) if e, a := http.DefaultClient, svc.Config.HTTPClient; e != a { t.Errorf("expect %v, got %v", e, a) } tr := svc.Config.HTTPClient.Transport.(http.Transport) if tr == nil { t.Fatalf("expect transport not to be nil") } if tr.Dial != nil { t.Errorf("expect dial to be nil, was not") } } func TestClientDisableOverrideDefaultHTTPClientTimeout(t testing.T) { svc := ec2metadata.New(unit.Session, aws.NewConfig().WithEC2MetadataDisableTimeoutOverride(true)) if e, a := http.DefaultClient, svc.Config.HTTPClient; e != a { t.Errorf("expect %v, got %v", e, a) } } func TestClientOverrideDefaultHTTPClientTimeoutRace(t testing.T) { server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Write([]byte("us-east-1a")) })) defer server.Close() cfg := aws.NewConfig().WithEndpoint(server.URL) runEC2MetadataClients(t, cfg, 50) } func TestClientOverrideDefaultHTTPClientTimeoutRaceWithTransport(t testing.T) { server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { w.Write([]byte("us-east-1a")) })) defer server.Close() cfg := aws.NewConfig().WithEndpoint(server.URL).WithHTTPClient(&http.Client{ Transport: &http.Transport{ DisableKeepAlives: true, }, }) runEC2MetadataClients(t, cfg, 50) } func TestClientDisableIMDS(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() os.Setenv("AWS_EC2_METADATA_DISABLED", "true") svc := ec2metadata.New(unit.Session) resp, err := svc.GetUserData() if err == nil { t.Fatalf("expect error, got none") } if len(resp) != 0 { t.Errorf("expect no response, got %v", resp) } aerr := err.(awserr.Error) if e, a := request.CanceledErrorCode, aerr.Code(); e != a { t.Errorf("expect %v error code, got %v", e, a) } if e, a := "AWS_EC2_METADATA_DISABLED", aerr.Message(); !strings.Contains(a, e) { t.Errorf("expect %v in error message, got %v", e, a) } } func TestClientStripPath(t testing.T) { cases := map[string]struct { Endpoint string Expect string }{ "no change": { Endpoint: "http://example.aws", Expect: "http://example.aws", }, "strip path": { Endpoint: "http://example.aws/foo", Expect: "http://example.aws", }, } for name, c := range cases { t.Run(name, func(t testing.T) { restoreEnvFn := sdktesting.StashEnv() defer restoreEnvFn() svc := ec2metadata.New(unit.Session, &aws.Config{ Endpoint: aws.String(c.Endpoint), }) if e, a := c.Expect, svc.ClientInfo.Endpoint; e != a { t.Errorf("expect %v endpoint, got %v", e, a) } }) } } func runEC2MetadataClients(t testing.T, cfg aws.Config, atOnce int) { var wg sync.WaitGroup wg.Add(atOnce) svc := ec2metadata.New(unit.Session, cfg) for i := 0; i < atOnce; i++ { go func() { defer wg.Done() _, err := svc.GetUserData() if err != nil { t.Errorf("expect no error, got %v", err) } }() } wg.Wait() }	3.8 KB	2025-05-25 12:27
📄 token_provider.go package ec2metadata import ( "fmt" "github.com/aws/aws-sdk-go/aws" "net/http" "sync/atomic" "time" "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/request" ) // A tokenProvider struct provides access to EC2Metadata client // and atomic instance of a token, along with configuredTTL for it. // tokenProvider also provides an atomic flag to disable the // fetch token operation. // The disabled member will use 0 as false, and 1 as true. type tokenProvider struct { client EC2Metadata token atomic.Value configuredTTL time.Duration disabled uint32 } // A ec2Token struct helps use of token in EC2 Metadata service ops type ec2Token struct { token string credentials.Expiry } // newTokenProvider provides a pointer to a tokenProvider instance func newTokenProvider(c EC2Metadata, duration time.Duration) tokenProvider { return &tokenProvider{client: c, configuredTTL: duration} } // check if fallback is enabled func (t tokenProvider) fallbackEnabled() bool { return t.client.Config.EC2MetadataEnableFallback == nil \|\| t.client.Config.EC2MetadataEnableFallback } // fetchTokenHandler fetches token for EC2Metadata service client by default. func (t tokenProvider) fetchTokenHandler(r request.Request) { // short-circuits to insecure data flow if tokenProvider is disabled. if v := atomic.LoadUint32(&t.disabled); v == 1 && t.fallbackEnabled() { return } if ec2Token, ok := t.token.Load().(ec2Token); ok && !ec2Token.IsExpired() { r.HTTPRequest.Header.Set(tokenHeader, ec2Token.token) return } output, err := t.client.getToken(r.Context(), t.configuredTTL) if err != nil { // only attempt fallback to insecure data flow if IMDSv1 is enabled if !t.fallbackEnabled() { r.Error = awserr.New("EC2MetadataError", "failed to get IMDSv2 token and fallback to IMDSv1 is disabled", err) return } // change the disabled flag on token provider to true and fallback if requestFailureError, ok := err.(awserr.RequestFailure); ok { switch requestFailureError.StatusCode() { case http.StatusForbidden, http.StatusNotFound, http.StatusMethodNotAllowed: atomic.StoreUint32(&t.disabled, 1) if t.client.Config.LogLevel.Matches(aws.LogDebugWithDeprecated) { t.client.Config.Logger.Log(fmt.Sprintf("WARN: failed to get session token, falling back to IMDSv1: %v", requestFailureError)) } case http.StatusBadRequest: r.Error = requestFailureError } } return } newToken := ec2Token{ token: output.Token, } newToken.SetExpiration(time.Now().Add(output.TTL), ttlExpirationWindow) t.token.Store(newToken) // Inject token header to the request. if ec2Token, ok := t.token.Load().(ec2Token); ok { r.HTTPRequest.Header.Set(tokenHeader, ec2Token.token) } } // enableTokenProviderHandler enables the token provider func (t tokenProvider) enableTokenProviderHandler(r *request.Request) { // If the error code status is 401, we enable the token provider if e, ok := r.Error.(awserr.RequestFailure); ok && e != nil && e.StatusCode() == http.StatusUnauthorized { t.token.Store(ec2Token{}) atomic.StoreUint32(&t.disabled, 0) } }	3.12 KB	2025-05-25 12:27

Terminal