Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2025-05-25 12:27
📄 config.go // Copyright 2016 The Prometheus Authors // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. // This package no longer handles safe yaml parsing. In order to // ensure correct yaml unmarshalling, use "yaml.UnmarshalStrict()". package config import ( "encoding/json" "net/http" "path/filepath" ) const secretToken = "<secret>" // Secret special type for storing secrets. type Secret string // MarshalSecretValue if set to true will expose Secret type // through the marshal interfaces. Useful for outside projects // that load and marshal the Prometheus config. var MarshalSecretValue bool = false // MarshalYAML implements the yaml.Marshaler interface for Secrets. func (s Secret) MarshalYAML() (interface{}, error) { if MarshalSecretValue { return string(s), nil } if s != "" { return secretToken, nil } return nil, nil } // UnmarshalYAML implements the yaml.Unmarshaler interface for Secrets. func (s Secret) UnmarshalYAML(unmarshal func(interface{}) error) error { type plain Secret return unmarshal((plain)(s)) } // MarshalJSON implements the json.Marshaler interface for Secret. func (s Secret) MarshalJSON() ([]byte, error) { if MarshalSecretValue { return json.Marshal(string(s)) } if len(s) == 0 { return json.Marshal("") } return json.Marshal(secretToken) } type ProxyHeader map[string][]Secret func (h ProxyHeader) HTTPHeader() http.Header { if h == nil \|\| h == nil { return nil } header := make(http.Header) for name, values := range *h { var s []string if values != nil { s = make([]string, 0, len(values)) for _, value := range values { s = append(s, string(value)) } } header[name] = s } return header } // DirectorySetter is a config type that contains file paths that may // be relative to the file containing the config. type DirectorySetter interface { // SetDirectory joins any relative file paths with dir. // Any paths that are empty or absolute remain unchanged. SetDirectory(dir string) } // JoinDir joins dir and path if path is relative. // If path is empty or absolute, it is returned unchanged. func JoinDir(dir, path string) string { if path == "" \|\| filepath.IsAbs(path) { return path } return filepath.Join(dir, path) }	2.67 KB	2025-05-25 12:27
📄 config_test.go // Copyright 2021 The Prometheus Authors // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package config import ( "bytes" "encoding/json" "net/http" "reflect" "testing" "github.com/stretchr/testify/require" "gopkg.in/yaml.v2" ) func TestJSONMarshalSecret(t testing.T) { type tmp struct { S Secret } for _, tc := range []struct { desc string data tmp expected string marshalSecret bool testYAML bool }{ { desc: "inhabited", // u003c -> "<" // u003e -> ">" data: tmp{"test"}, expected: "{\"S\":\"\\u003csecret\\u003e\"}", }, { desc: "true value in JSON", data: tmp{"test"}, expected: `{"S":"test"}`, marshalSecret: true, }, { desc: "true value in YAML", data: tmp{"test"}, expected: `s: test `, marshalSecret: true, testYAML: true, }, { desc: "empty", data: tmp{}, expected: "{\"S\":\"\"}", }, } { t.Run(tc.desc, func(t testing.T) { MarshalSecretValue = tc.marshalSecret var marshalFN func(any) ([]byte, error) if tc.testYAML { marshalFN = yaml.Marshal } else { marshalFN = json.Marshal } c, err := marshalFN(tc.data) require.NoError(t, err) require.Equalf(t, tc.expected, string(c), "Secret not marshaled correctly, got '%s'", string(c)) }) } } func TestHeaderHTTPHeader(t testing.T) { testcases := map[string]struct { header ProxyHeader expected http.Header }{ "basic": { header: ProxyHeader{ "single": []Secret{"v1"}, "multi": []Secret{"v1", "v2"}, "empty": []Secret{}, "nil": nil, }, expected: http.Header{ "single": []string{"v1"}, "multi": []string{"v1", "v2"}, "empty": []string{}, "nil": nil, }, }, "nil": { header: nil, expected: nil, }, } for name, tc := range testcases { t.Run(name, func(t testing.T) { actual := tc.header.HTTPHeader() require.Truef(t, reflect.DeepEqual(actual, tc.expected), "expecting: %#v, actual: %#v", tc.expected, actual) }) } } func TestHeaderYamlUnmarshal(t testing.T) { testcases := map[string]struct { input string expected ProxyHeader }{ "void": { input: ``, }, "simple": { input: "single:\n- a\n", expected: ProxyHeader{"single": []Secret{"a"}}, }, "multi": { input: "multi:\n- a\n- b\n", expected: ProxyHeader{"multi": []Secret{"a", "b"}}, }, "empty": { input: "{}", expected: ProxyHeader{}, }, "empty value": { input: "empty:\n", expected: ProxyHeader{"empty": nil}, }, } for name, tc := range testcases { t.Run(name, func(t testing.T) { var actual ProxyHeader err := yaml.Unmarshal([]byte(tc.input), &actual) require.NoErrorf(t, err, "error unmarshaling %s: %s", tc.input, err) require.Truef(t, reflect.DeepEqual(actual, tc.expected), "expecting: %#v, actual: %#v", tc.expected, actual) }) } } func TestHeaderYamlMarshal(t testing.T) { testcases := map[string]struct { input ProxyHeader expected []byte }{ "void": { input: nil, expected: []byte("{}\n"), }, "simple": { input: ProxyHeader{"single": []Secret{"a"}}, expected: []byte("single:\n- <secret>\n"), }, "multi": { input: ProxyHeader{"multi": []Secret{"a", "b"}}, expected: []byte("multi:\n- <secret>\n- <secret>\n"), }, "empty": { input: ProxyHeader{"empty": nil}, expected: []byte("empty: []\n"), }, } for name, tc := range testcases { t.Run(name, func(t testing.T) { actual, err := yaml.Marshal(tc.input) require.NoErrorf(t, err, "error unmarshaling %#v: %s", tc.input, err) require.Truef(t, bytes.Equal(actual, tc.expected), "expecting: %q, actual: %q", tc.expected, actual) }) } } func TestHeaderJsonUnmarshal(t testing.T) { testcases := map[string]struct { input string expected ProxyHeader }{ "void": { input: `null`, }, "simple": { input: `{"single": ["a"]}`, expected: ProxyHeader{"single": []Secret{"a"}}, }, "multi": { input: `{"multi": ["a", "b"]}`, expected: ProxyHeader{"multi": []Secret{"a", "b"}}, }, "empty": { input: `{}`, expected: ProxyHeader{}, }, "empty value": { input: `{"empty":null}`, expected: ProxyHeader{"empty": nil}, }, } for name, tc := range testcases { t.Run(name, func(t testing.T) { var actual ProxyHeader err := json.Unmarshal([]byte(tc.input), &actual) require.NoErrorf(t, err, "error unmarshaling %s: %s", tc.input, err) require.Truef(t, reflect.DeepEqual(actual, tc.expected), "expecting: %#v, actual: %#v", tc.expected, actual) }) } } func TestHeaderJsonMarshal(t testing.T) { testcases := map[string]struct { input ProxyHeader expected []byte }{ "void": { input: nil, expected: []byte("null"), }, "simple": { input: ProxyHeader{"single": []Secret{"a"}}, expected: []byte("{\"single\":[\"\\u003csecret\\u003e\"]}"), }, "multi": { input: ProxyHeader{"multi": []Secret{"a", "b"}}, expected: []byte("{\"multi\":[\"\\u003csecret\\u003e\",\"\\u003csecret\\u003e\"]}"), }, "empty": { input: ProxyHeader{"empty": nil}, expected: []byte(`{"empty":null}`), }, } for name, tc := range testcases { t.Run(name, func(t testing.T) { actual, err := json.Marshal(tc.input) require.NoErrorf(t, err, "error marshaling %#v: %s", tc.input, err) require.Truef(t, bytes.Equal(actual, tc.expected), "expecting: %q, actual: %q", tc.expected, actual) }) } }	5.88 KB	2025-05-25 12:27
📄 generate.go // Copyright 2020 The Prometheus-operator Authors // Copyright 2022 The Prometheus Authors // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. //go:build ignore // +build ignore // Program generating TLS certificates and keys for the tests. package main import ( "bytes" "crypto/rand" "crypto/rsa" "crypto/x509" "crypto/x509/pkix" "encoding/pem" "fmt" "io" "log" "math/big" "net" "os" "time" ) const ( validityPeriod = 50 * 365 * 24 * time.Hour ) func EncodeCertificate(w io.Writer, cert x509.Certificate) error { return pem.Encode(w, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw}) } func EncodeKey(w io.Writer, priv rsa.PrivateKey) error { b, err := x509.MarshalPKCS8PrivateKey(priv) if err != nil { return fmt.Errorf("failed to marshal private key: %v", err) } return pem.Encode(w, &pem.Block{Type: "PRIVATE KEY", Bytes: b}) } var serialNumber big.Int func init() { serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128) var err error serialNumber, err = rand.Int(rand.Reader, serialNumberLimit) if err != nil { panic(fmt.Errorf("failed to generate serial number: %v", err)) } } func SerialNumber() big.Int { var serial big.Int serial.Set(serialNumber) serialNumber.Add(&serial, big.NewInt(1)) return &serial } func GenerateCertificateAuthority(commonName string, parentCert x509.Certificate, parentKey rsa.PrivateKey) (x509.Certificate, rsa.PrivateKey, error) { now := time.Now() caKey, err := rsa.GenerateKey(rand.Reader, 4096) if err != nil { return nil, nil, fmt.Errorf("failed to generate CA private key: %v", err) } caCert := &x509.Certificate{ SerialNumber: SerialNumber(), Subject: pkix.Name{ Country: []string{"US"}, Organization: []string{"Prometheus"}, OrganizationalUnit: []string{"Prometheus Certificate Authority"}, CommonName: commonName, }, NotBefore: now, NotAfter: now.Add(validityPeriod), KeyUsage: x509.KeyUsageDigitalSignature \| x509.KeyUsageKeyEncipherment \| x509.KeyUsageCertSign, IsCA: true, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageAny}, BasicConstraintsValid: true, } if parentCert == nil && parentKey == nil { parentCert = caCert parentKey = caKey } b, err := x509.CreateCertificate(rand.Reader, caCert, parentCert, &caKey.PublicKey, parentKey) if err != nil { return nil, nil, fmt.Errorf("failed to create CA certificate: %v", err) } caCert, err = x509.ParseCertificate(b) if err != nil { return nil, nil, fmt.Errorf("failed to decode CA certificate: %v", err) } return caCert, caKey, nil } func GenerateCertificate(caCert x509.Certificate, caKey rsa.PrivateKey, server bool, name string, ipAddresses ...net.IP) (x509.Certificate, rsa.PrivateKey, error) { now := time.Now() key, err := rsa.GenerateKey(rand.Reader, 4096) if err != nil { return nil, nil, fmt.Errorf("failed to generate private key: %v", err) } cert := &x509.Certificate{ SerialNumber: SerialNumber(), Subject: pkix.Name{ Country: []string{"US"}, Organization: []string{"Prometheus"}, CommonName: name, }, NotBefore: now, NotAfter: now.Add(validityPeriod), KeyUsage: x509.KeyUsageKeyEncipherment, BasicConstraintsValid: true, } if server { cert.DNSNames = []string{name} cert.IPAddresses = ipAddresses cert.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth} } else { cert.ExtKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth} } if caCert == nil && caKey == nil { caCert = cert caKey = key } b, err := x509.CreateCertificate(rand.Reader, cert, caCert, &key.PublicKey, caKey) if err != nil { return nil, nil, fmt.Errorf("failed to create certificate: %v", err) } cert, err = x509.ParseCertificate(b) if err != nil { return nil, nil, fmt.Errorf("failed to decode certificate: %v", err) } return cert, key, nil } func writeCertificateAndKey(path string, cert x509.Certificate, key rsa.PrivateKey) error { var b bytes.Buffer if err := EncodeCertificate(&b, cert); err != nil { return err } if err := os.WriteFile(fmt.Sprintf("%s.crt", path), b.Bytes(), 0o644); err != nil { return err } b.Reset() if err := EncodeKey(&b, key); err != nil { return err } if err := os.WriteFile(fmt.Sprintf("%s.key", path), b.Bytes(), 0o644); err != nil { return err } return nil } func main() { log.Println("Generating root CA") rootCert, rootKey, err := GenerateCertificateAuthority("Prometheus Root CA", nil, nil) if err != nil { log.Fatal(err) } log.Println("Generating CA") caCert, caKey, err := GenerateCertificateAuthority("Prometheus TLS CA", rootCert, rootKey) if err != nil { log.Fatal(err) } log.Println("Generating server certificate") cert, key, err := GenerateCertificate(caCert, caKey, true, "localhost", net.IPv4(127, 0, 0, 1), net.IPv4(127, 0, 0, 0)) if err != nil { log.Fatal(err) } if err := writeCertificateAndKey("testdata/server", cert, key); err != nil { log.Fatal(err) } log.Println("Generating client certificate") cert, key, err = GenerateCertificate(caCert, caKey, false, "localhost") if err != nil { log.Fatal(err) } if err := writeCertificateAndKey("testdata/client", cert, key); err != nil { log.Fatal(err) } log.Println("Generating self-signed client certificate") cert, key, err = GenerateCertificate(nil, nil, false, "localhost") if err != nil { log.Fatal(err) } if err := writeCertificateAndKey("testdata/self-signed-client", cert, key); err != nil { log.Fatal(err) } log.Println("Generating CA bundle") var b bytes.Buffer if err := EncodeCertificate(&b, caCert); err != nil { log.Fatal(err) } if err := EncodeCertificate(&b, rootCert); err != nil { log.Fatal(err) } if err := os.WriteFile("testdata/tls-ca-chain.pem", b.Bytes(), 0o644); err != nil { log.Fatal(err) } }	6.3 KB	2025-05-25 12:27
📄 headers.go // Copyright 2024 The Prometheus Authors // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. // This package no longer handles safe yaml parsing. In order to // ensure correct yaml unmarshalling, use "yaml.UnmarshalStrict()". package config import ( "encoding/json" "fmt" "net/http" "os" "strings" ) // reservedHeaders that change the connection, are set by Prometheus, or can // be changed otherwise. var reservedHeaders = map[string]struct{}{ "Authorization": {}, "Host": {}, "Content-Encoding": {}, "Content-Length": {}, "Content-Type": {}, "User-Agent": {}, "Connection": {}, "Keep-Alive": {}, "Proxy-Authenticate": {}, "Proxy-Authorization": {}, "Www-Authenticate": {}, "Accept-Encoding": {}, "X-Prometheus-Remote-Write-Version": {}, "X-Prometheus-Remote-Read-Version": {}, "X-Prometheus-Scrape-Timeout-Seconds": {}, // Added by SigV4. "X-Amz-Date": {}, "X-Amz-Security-Token": {}, "X-Amz-Content-Sha256": {}, } // Headers represents the configuration for HTTP headers. type Headers struct { Headers map[string]Header `yaml:",inline"` } func (h Headers) MarshalJSON() ([]byte, error) { // Inline the Headers map when serializing JSON because json encoder doesn't support "inline" directive. return json.Marshal(h.Headers) } // SetDirectory make headers file relative to the configuration file. func (h Headers) SetDirectory(dir string) { if h == nil { return } for _, h := range h.Headers { h.SetDirectory(dir) } } // Validate validates the Headers config. func (h Headers) Validate() error { for n := range h.Headers { if _, ok := reservedHeaders[http.CanonicalHeaderKey(n)]; ok { return fmt.Errorf("setting header %q is not allowed", http.CanonicalHeaderKey(n)) } } return nil } // Header represents the configuration for a single HTTP header. type Header struct { Values []string `yaml:"values,omitempty" json:"values,omitempty"` Secrets []Secret `yaml:"secrets,omitempty" json:"secrets,omitempty"` Files []string `yaml:"files,omitempty" json:"files,omitempty"` } // SetDirectory makes headers file relative to the configuration file. func (h Header) SetDirectory(dir string) { for i := range h.Files { h.Files[i] = JoinDir(dir, h.Files[i]) } } // NewHeadersRoundTripper returns a RoundTripper that sets HTTP headers on // requests as configured. func NewHeadersRoundTripper(config Headers, next http.RoundTripper) http.RoundTripper { if len(config.Headers) == 0 { return next } return &headersRoundTripper{ config: config, next: next, } } type headersRoundTripper struct { next http.RoundTripper config Headers } // RoundTrip implements http.RoundTripper. func (rt headersRoundTripper) RoundTrip(req http.Request) (http.Response, error) { req = cloneRequest(req) for n, h := range rt.config.Headers { for _, v := range h.Values { req.Header.Add(n, v) } for _, v := range h.Secrets { req.Header.Add(n, string(v)) } for _, v := range h.Files { b, err := os.ReadFile(v) if err != nil { return nil, fmt.Errorf("unable to read headers file %s: %w", v, err) } req.Header.Add(n, strings.TrimSpace(string(b))) } } return rt.next.RoundTrip(req) } // CloseIdleConnections implements closeIdler. func (rt *headersRoundTripper) CloseIdleConnections() { if ci, ok := rt.next.(closeIdler); ok { ci.CloseIdleConnections() } }	4.04 KB	2025-05-25 12:27
📄 headers_test.go // Copyright 2024 The Prometheus Authors // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. // This package no longer handles safe yaml parsing. In order to // ensure correct yaml unmarshalling, use "yaml.UnmarshalStrict()". package config import ( "net/http" "testing" ) func TestReservedHeaders(t *testing.T) { for k := range reservedHeaders { l := http.CanonicalHeaderKey(k) if k != l { t.Errorf("reservedHeaders keys should be lowercase: got %q, expected %q", k, http.CanonicalHeaderKey(k)) } } }	1018 B	2025-05-25 12:27
📄 http_config.go // Copyright 2016 The Prometheus Authors // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package config import ( "bytes" "context" "crypto/sha256" "crypto/tls" "crypto/x509" "encoding/json" "errors" "fmt" "net" "net/http" "net/url" "os" "path/filepath" "strings" "sync" "time" conntrack "github.com/mwitkow/go-conntrack" "golang.org/x/net/http/httpproxy" "golang.org/x/net/http2" "golang.org/x/oauth2" "golang.org/x/oauth2/clientcredentials" "gopkg.in/yaml.v2" ) var ( // DefaultHTTPClientConfig is the default HTTP client configuration. DefaultHTTPClientConfig = HTTPClientConfig{ FollowRedirects: true, EnableHTTP2: true, } // defaultHTTPClientOptions holds the default HTTP client options. defaultHTTPClientOptions = httpClientOptions{ keepAlivesEnabled: true, http2Enabled: true, // 5 minutes is typically above the maximum sane scrape interval. So we can // use keepalive for all configurations. idleConnTimeout: 5 * time.Minute, } ) type closeIdler interface { CloseIdleConnections() } type TLSVersion uint16 var TLSVersions = map[string]TLSVersion{ "TLS13": (TLSVersion)(tls.VersionTLS13), "TLS12": (TLSVersion)(tls.VersionTLS12), "TLS11": (TLSVersion)(tls.VersionTLS11), "TLS10": (TLSVersion)(tls.VersionTLS10), } func (tv TLSVersion) UnmarshalYAML(unmarshal func(interface{}) error) error { var s string err := unmarshal((string)(&s)) if err != nil { return err } if v, ok := TLSVersions[s]; ok { tv = v return nil } return fmt.Errorf("unknown TLS version: %s", s) } func (tv TLSVersion) MarshalYAML() (interface{}, error) { for s, v := range TLSVersions { if tv == v { return s, nil } } return nil, fmt.Errorf("unknown TLS version: %d", tv) } // MarshalJSON implements the json.Unmarshaler interface for TLSVersion. func (tv TLSVersion) UnmarshalJSON(data []byte) error { var s string if err := json.Unmarshal(data, &s); err != nil { return err } if v, ok := TLSVersions[s]; ok { tv = v return nil } return fmt.Errorf("unknown TLS version: %s", s) } // MarshalJSON implements the json.Marshaler interface for TLSVersion. func (tv TLSVersion) MarshalJSON() ([]byte, error) { for s, v := range TLSVersions { if tv == v { return json.Marshal(s) } } return nil, fmt.Errorf("unknown TLS version: %d", tv) } // String implements the fmt.Stringer interface for TLSVersion. func (tv TLSVersion) String() string { if tv == nil \|\| tv == 0 { return "" } for s, v := range TLSVersions { if tv == v { return s } } return fmt.Sprintf("%d", tv) } // BasicAuth contains basic HTTP authentication credentials. type BasicAuth struct { Username string `yaml:"username" json:"username"` UsernameFile string `yaml:"username_file,omitempty" json:"username_file,omitempty"` // UsernameRef is the name of the secret within the secret manager to use as the username. UsernameRef string `yaml:"username_ref,omitempty" json:"username_ref,omitempty"` Password Secret `yaml:"password,omitempty" json:"password,omitempty"` PasswordFile string `yaml:"password_file,omitempty" json:"password_file,omitempty"` // PasswordRef is the name of the secret within the secret manager to use as the password. PasswordRef string `yaml:"password_ref,omitempty" json:"password_ref,omitempty"` } // SetDirectory joins any relative file paths with dir. func (a BasicAuth) SetDirectory(dir string) { if a == nil { return } a.PasswordFile = JoinDir(dir, a.PasswordFile) a.UsernameFile = JoinDir(dir, a.UsernameFile) } // Authorization contains HTTP authorization credentials. type Authorization struct { Type string `yaml:"type,omitempty" json:"type,omitempty"` Credentials Secret `yaml:"credentials,omitempty" json:"credentials,omitempty"` CredentialsFile string `yaml:"credentials_file,omitempty" json:"credentials_file,omitempty"` // CredentialsRef is the name of the secret within the secret manager to use as credentials. CredentialsRef string `yaml:"credentials_ref,omitempty" json:"credentials_ref,omitempty"` } // SetDirectory joins any relative file paths with dir. func (a Authorization) SetDirectory(dir string) { if a == nil { return } a.CredentialsFile = JoinDir(dir, a.CredentialsFile) } // URL is a custom URL type that allows validation at configuration load time. type URL struct { url.URL } // UnmarshalYAML implements the yaml.Unmarshaler interface for URLs. func (u URL) UnmarshalYAML(unmarshal func(interface{}) error) error { var s string if err := unmarshal(&s); err != nil { return err } urlp, err := url.Parse(s) if err != nil { return err } u.URL = urlp return nil } // MarshalYAML implements the yaml.Marshaler interface for URLs. func (u URL) MarshalYAML() (interface{}, error) { if u.URL != nil { return u.Redacted(), nil } return nil, nil } // Redacted returns the URL but replaces any password with "xxxxx". func (u URL) Redacted() string { if u.URL == nil { return "" } ru := u.URL if _, ok := ru.User.Password(); ok { // We can not use secretToken because it would be escaped. ru.User = url.UserPassword(ru.User.Username(), "xxxxx") } return ru.String() } // UnmarshalJSON implements the json.Marshaler interface for URL. func (u URL) UnmarshalJSON(data []byte) error { var s string if err := json.Unmarshal(data, &s); err != nil { return err } urlp, err := url.Parse(s) if err != nil { return err } u.URL = urlp return nil } // MarshalJSON implements the json.Marshaler interface for URL. func (u URL) MarshalJSON() ([]byte, error) { if u.URL != nil { return json.Marshal(u.URL.String()) } return []byte("null"), nil } // OAuth2 is the oauth2 client configuration. type OAuth2 struct { ClientID string `yaml:"client_id" json:"client_id"` ClientSecret Secret `yaml:"client_secret" json:"client_secret"` ClientSecretFile string `yaml:"client_secret_file" json:"client_secret_file"` // ClientSecretRef is the name of the secret within the secret manager to use as the client // secret. ClientSecretRef string `yaml:"client_secret_ref" json:"client_secret_ref"` Scopes []string `yaml:"scopes,omitempty" json:"scopes,omitempty"` TokenURL string `yaml:"token_url" json:"token_url"` EndpointParams map[string]string `yaml:"endpoint_params,omitempty" json:"endpoint_params,omitempty"` TLSConfig TLSConfig `yaml:"tls_config,omitempty"` ProxyConfig `yaml:",inline"` } // UnmarshalYAML implements the yaml.Unmarshaler interface func (o OAuth2) UnmarshalYAML(unmarshal func(interface{}) error) error { type plain OAuth2 if err := unmarshal((plain)(o)); err != nil { return err } return o.ProxyConfig.Validate() } // UnmarshalJSON implements the json.Marshaler interface for URL. func (o OAuth2) UnmarshalJSON(data []byte) error { type plain OAuth2 if err := json.Unmarshal(data, (plain)(o)); err != nil { return err } return o.ProxyConfig.Validate() } // SetDirectory joins any relative file paths with dir. func (o OAuth2) SetDirectory(dir string) { if o == nil { return } o.ClientSecretFile = JoinDir(dir, o.ClientSecretFile) o.TLSConfig.SetDirectory(dir) } // LoadHTTPConfig parses the YAML input s into a HTTPClientConfig. func LoadHTTPConfig(s string) (HTTPClientConfig, error) { cfg := &HTTPClientConfig{} err := yaml.UnmarshalStrict([]byte(s), cfg) if err != nil { return nil, err } return cfg, nil } // LoadHTTPConfigFile parses the given YAML file into a HTTPClientConfig. func LoadHTTPConfigFile(filename string) (HTTPClientConfig, []byte, error) { content, err := os.ReadFile(filename) if err != nil { return nil, nil, err } cfg, err := LoadHTTPConfig(string(content)) if err != nil { return nil, nil, err } cfg.SetDirectory(filepath.Dir(filepath.Dir(filename))) return cfg, content, nil } // HTTPClientConfig configures an HTTP client. type HTTPClientConfig struct { // The HTTP basic authentication credentials for the targets. BasicAuth BasicAuth `yaml:"basic_auth,omitempty" json:"basic_auth,omitempty"` // The HTTP authorization credentials for the targets. Authorization Authorization `yaml:"authorization,omitempty" json:"authorization,omitempty"` // The OAuth2 client credentials used to fetch a token for the targets. OAuth2 OAuth2 `yaml:"oauth2,omitempty" json:"oauth2,omitempty"` // The bearer token for the targets. Deprecated in favour of // Authorization.Credentials. BearerToken Secret `yaml:"bearer_token,omitempty" json:"bearer_token,omitempty"` // The bearer token file for the targets. Deprecated in favour of // Authorization.CredentialsFile. BearerTokenFile string `yaml:"bearer_token_file,omitempty" json:"bearer_token_file,omitempty"` // TLSConfig to use to connect to the targets. TLSConfig TLSConfig `yaml:"tls_config,omitempty" json:"tls_config,omitempty"` // FollowRedirects specifies whether the client should follow HTTP 3xx redirects. // The omitempty flag is not set, because it would be hidden from the // marshalled configuration when set to false. FollowRedirects bool `yaml:"follow_redirects" json:"follow_redirects"` // EnableHTTP2 specifies whether the client should configure HTTP2. // The omitempty flag is not set, because it would be hidden from the // marshalled configuration when set to false. EnableHTTP2 bool `yaml:"enable_http2" json:"enable_http2"` // Proxy configuration. ProxyConfig `yaml:",inline"` // HTTPHeaders specify headers to inject in the requests. Those headers // could be marshalled back to the users. HTTPHeaders Headers `yaml:"http_headers,omitempty" json:"http_headers,omitempty"` } // SetDirectory joins any relative file paths with dir. func (c HTTPClientConfig) SetDirectory(dir string) { if c == nil { return } c.TLSConfig.SetDirectory(dir) c.BasicAuth.SetDirectory(dir) c.Authorization.SetDirectory(dir) c.OAuth2.SetDirectory(dir) c.HTTPHeaders.SetDirectory(dir) c.BearerTokenFile = JoinDir(dir, c.BearerTokenFile) } // nonZeroCount returns the amount of values that are non-zero. func nonZeroCount[T comparable](values ...T) int { count := 0 var zero T for _, value := range values { if value != zero { count += 1 } } return count } // Validate validates the HTTPClientConfig to check only one of BearerToken, // BasicAuth and BearerTokenFile is configured. It also validates that ProxyURL // is set if ProxyConnectHeader is set. func (c HTTPClientConfig) Validate() error { // Backwards compatibility with the bearer_token field. if len(c.BearerToken) > 0 && len(c.BearerTokenFile) > 0 { return errors.New("at most one of bearer_token & bearer_token_file must be configured") } if (c.BasicAuth != nil \|\| c.OAuth2 != nil) && (len(c.BearerToken) > 0 \|\| len(c.BearerTokenFile) > 0) { return errors.New("at most one of basic_auth, oauth2, bearer_token & bearer_token_file must be configured") } if c.BasicAuth != nil && nonZeroCount(string(c.BasicAuth.Username) != "", c.BasicAuth.UsernameFile != "", c.BasicAuth.UsernameRef != "") > 1 { return errors.New("at most one of basic_auth username, username_file & username_ref must be configured") } if c.BasicAuth != nil && nonZeroCount(string(c.BasicAuth.Password) != "", c.BasicAuth.PasswordFile != "", c.BasicAuth.PasswordRef != "") > 1 { return errors.New("at most one of basic_auth password, password_file & password_ref must be configured") } if c.Authorization != nil { if len(c.BearerToken) > 0 \|\| len(c.BearerTokenFile) > 0 { return errors.New("authorization is not compatible with bearer_token & bearer_token_file") } if nonZeroCount(string(c.Authorization.Credentials) != "", c.Authorization.CredentialsFile != "", c.Authorization.CredentialsRef != "") > 1 { return errors.New("at most one of authorization credentials & credentials_file must be configured") } c.Authorization.Type = strings.TrimSpace(c.Authorization.Type) if len(c.Authorization.Type) == 0 { c.Authorization.Type = "Bearer" } if strings.ToLower(c.Authorization.Type) == "basic" { return errors.New(`authorization type cannot be set to "basic", use "basic_auth" instead`) } if c.BasicAuth != nil \|\| c.OAuth2 != nil { return errors.New("at most one of basic_auth, oauth2 & authorization must be configured") } } else { if len(c.BearerToken) > 0 { c.Authorization = &Authorization{Credentials: c.BearerToken} c.Authorization.Type = "Bearer" c.BearerToken = "" } if len(c.BearerTokenFile) > 0 { c.Authorization = &Authorization{CredentialsFile: c.BearerTokenFile} c.Authorization.Type = "Bearer" c.BearerTokenFile = "" } } if c.OAuth2 != nil { if c.BasicAuth != nil { return errors.New("at most one of basic_auth, oauth2 & authorization must be configured") } if len(c.OAuth2.ClientID) == 0 { return errors.New("oauth2 client_id must be configured") } if len(c.OAuth2.TokenURL) == 0 { return errors.New("oauth2 token_url must be configured") } if nonZeroCount(len(c.OAuth2.ClientSecret) > 0, len(c.OAuth2.ClientSecretFile) > 0, len(c.OAuth2.ClientSecretRef) > 0) > 1 { return errors.New("at most one of oauth2 client_secret, client_secret_file & client_secret_ref must be configured") } } if err := c.ProxyConfig.Validate(); err != nil { return err } if c.HTTPHeaders != nil { if err := c.HTTPHeaders.Validate(); err != nil { return err } } return nil } // UnmarshalYAML implements the yaml.Unmarshaler interface func (c HTTPClientConfig) UnmarshalYAML(unmarshal func(interface{}) error) error { type plain HTTPClientConfig c = DefaultHTTPClientConfig if err := unmarshal((plain)(c)); err != nil { return err } return c.Validate() } // UnmarshalJSON implements the json.Marshaler interface for URL. func (c HTTPClientConfig) UnmarshalJSON(data []byte) error { type plain HTTPClientConfig c = DefaultHTTPClientConfig if err := json.Unmarshal(data, (plain)(c)); err != nil { return err } return c.Validate() } // UnmarshalYAML implements the yaml.Unmarshaler interface. func (a BasicAuth) UnmarshalYAML(unmarshal func(interface{}) error) error { type plain BasicAuth return unmarshal((plain)(a)) } // DialContextFunc defines the signature of the DialContext() function implemented // by net.Dialer. type DialContextFunc func(context.Context, string, string) (net.Conn, error) type httpClientOptions struct { dialContextFunc DialContextFunc keepAlivesEnabled bool http2Enabled bool idleConnTimeout time.Duration userAgent string host string secretManager SecretManager } // HTTPClientOption defines an option that can be applied to the HTTP client. type HTTPClientOption interface { applyToHTTPClientOptions(options httpClientOptions) } type httpClientOptionFunc func(options httpClientOptions) func (f httpClientOptionFunc) applyToHTTPClientOptions(options httpClientOptions) { f(options) } // WithDialContextFunc allows you to override func gets used for the actual dialing. The default is `net.Dialer.DialContext`. func WithDialContextFunc(fn DialContextFunc) HTTPClientOption { return httpClientOptionFunc(func(opts httpClientOptions) { opts.dialContextFunc = fn }) } // WithKeepAlivesDisabled allows to disable HTTP keepalive. func WithKeepAlivesDisabled() HTTPClientOption { return httpClientOptionFunc(func(opts httpClientOptions) { opts.keepAlivesEnabled = false }) } // WithHTTP2Disabled allows to disable HTTP2. func WithHTTP2Disabled() HTTPClientOption { return httpClientOptionFunc(func(opts httpClientOptions) { opts.http2Enabled = false }) } // WithIdleConnTimeout allows setting the idle connection timeout. func WithIdleConnTimeout(timeout time.Duration) HTTPClientOption { return httpClientOptionFunc(func(opts httpClientOptions) { opts.idleConnTimeout = timeout }) } // WithUserAgent allows setting the user agent. func WithUserAgent(ua string) HTTPClientOption { return httpClientOptionFunc(func(opts httpClientOptions) { opts.userAgent = ua }) } // WithHost allows setting the host header. func WithHost(host string) HTTPClientOption { return httpClientOptionFunc(func(opts httpClientOptions) { opts.host = host }) } type secretManagerOption struct { secretManager SecretManager } func (s secretManagerOption) applyToHTTPClientOptions(opts httpClientOptions) { opts.secretManager = s.secretManager } func (s secretManagerOption) applyToTLSConfigOptions(opts tlsConfigOptions) { opts.secretManager = s.secretManager } // WithSecretManager allows setting the secret manager. func WithSecretManager(manager SecretManager) secretManagerOption { return &secretManagerOption{ secretManager: manager, } } // NewClient returns a http.Client using the specified http.RoundTripper. func newClient(rt http.RoundTripper) http.Client { return &http.Client{Transport: rt} } // NewClientFromConfig returns a new HTTP client configured for the // given config.HTTPClientConfig and config.HTTPClientOption. // The name is used as go-conntrack metric label. func NewClientFromConfig(cfg HTTPClientConfig, name string, optFuncs ...HTTPClientOption) (http.Client, error) { rt, err := NewRoundTripperFromConfig(cfg, name, optFuncs...) if err != nil { return nil, err } client := newClient(rt) if !cfg.FollowRedirects { client.CheckRedirect = func(http.Request, []http.Request) error { return http.ErrUseLastResponse } } return client, nil } // NewRoundTripperFromConfig returns a new HTTP RoundTripper configured for the // given config.HTTPClientConfig and config.HTTPClientOption. // The name is used as go-conntrack metric label. func NewRoundTripperFromConfig(cfg HTTPClientConfig, name string, optFuncs ...HTTPClientOption) (http.RoundTripper, error) { return NewRoundTripperFromConfigWithContext(context.Background(), cfg, name, optFuncs...) } // NewRoundTripperFromConfigWithContext returns a new HTTP RoundTripper configured for the // given config.HTTPClientConfig and config.HTTPClientOption. // The name is used as go-conntrack metric label. func NewRoundTripperFromConfigWithContext(ctx context.Context, cfg HTTPClientConfig, name string, optFuncs ...HTTPClientOption) (http.RoundTripper, error) { opts := defaultHTTPClientOptions for _, opt := range optFuncs { opt.applyToHTTPClientOptions(&opts) } var dialContext func(ctx context.Context, network, addr string) (net.Conn, error) if opts.dialContextFunc != nil { dialContext = conntrack.NewDialContextFunc( conntrack.DialWithDialContextFunc((func(context.Context, string, string) (net.Conn, error))(opts.dialContextFunc)), conntrack.DialWithTracing(), conntrack.DialWithName(name)) } else { dialContext = conntrack.NewDialContextFunc( conntrack.DialWithTracing(), conntrack.DialWithName(name)) } newRT := func(tlsConfig tls.Config) (http.RoundTripper, error) { // The only timeout we care about is the configured scrape timeout. // It is applied on request. So we leave out any timings here. var rt http.RoundTripper = &http.Transport{ Proxy: cfg.ProxyConfig.Proxy(), ProxyConnectHeader: cfg.ProxyConfig.GetProxyConnectHeader(), MaxIdleConns: 20000, MaxIdleConnsPerHost: 1000, // see https://github.com/golang/go/issues/13801 DisableKeepAlives: !opts.keepAlivesEnabled, TLSClientConfig: tlsConfig, DisableCompression: true, IdleConnTimeout: opts.idleConnTimeout, TLSHandshakeTimeout: 10 * time.Second, ExpectContinueTimeout: 1 * time.Second, DialContext: dialContext, } if opts.http2Enabled && cfg.EnableHTTP2 { // HTTP/2 support is golang had many problematic cornercases where // dead connections would be kept and used in connection pools. // https://github.com/golang/go/issues/32388 // https://github.com/golang/go/issues/39337 // https://github.com/golang/go/issues/39750 http2t, err := http2.ConfigureTransports(rt.(http.Transport)) if err != nil { return nil, err } http2t.ReadIdleTimeout = time.Minute } // If a authorization_credentials is provided, create a round tripper that will set the // Authorization header correctly on each request. if cfg.Authorization != nil { credentialsSecret, err := toSecret(opts.secretManager, cfg.Authorization.Credentials, cfg.Authorization.CredentialsFile, cfg.Authorization.CredentialsRef) if err != nil { return nil, fmt.Errorf("unable to use credentials: %w", err) } rt = NewAuthorizationCredentialsRoundTripper(cfg.Authorization.Type, credentialsSecret, rt) } // Backwards compatibility, be nice with importers who would not have // called Validate(). if len(cfg.BearerToken) > 0 \|\| len(cfg.BearerTokenFile) > 0 { bearerSecret, err := toSecret(opts.secretManager, cfg.BearerToken, cfg.BearerTokenFile, "") if err != nil { return nil, fmt.Errorf("unable to use bearer token: %w", err) } rt = NewAuthorizationCredentialsRoundTripper("Bearer", bearerSecret, rt) } if cfg.BasicAuth != nil { usernameSecret, err := toSecret(opts.secretManager, Secret(cfg.BasicAuth.Username), cfg.BasicAuth.UsernameFile, cfg.BasicAuth.UsernameRef) if err != nil { return nil, fmt.Errorf("unable to use username: %w", err) } passwordSecret, err := toSecret(opts.secretManager, cfg.BasicAuth.Password, cfg.BasicAuth.PasswordFile, cfg.BasicAuth.PasswordRef) if err != nil { return nil, fmt.Errorf("unable to use password: %w", err) } rt = NewBasicAuthRoundTripper(usernameSecret, passwordSecret, rt) } if cfg.OAuth2 != nil { clientSecret, err := toSecret(opts.secretManager, cfg.OAuth2.ClientSecret, cfg.OAuth2.ClientSecretFile, cfg.OAuth2.ClientSecretRef) if err != nil { return nil, fmt.Errorf("unable to use client secret: %w", err) } rt = NewOAuth2RoundTripper(clientSecret, cfg.OAuth2, rt, &opts) } if cfg.HTTPHeaders != nil { rt = NewHeadersRoundTripper(cfg.HTTPHeaders, rt) } if opts.userAgent != "" { rt = NewUserAgentRoundTripper(opts.userAgent, rt) } if opts.host != "" { rt = NewHostRoundTripper(opts.host, rt) } // Return a new configured RoundTripper. return rt, nil } tlsConfig, err := NewTLSConfig(&cfg.TLSConfig, WithSecretManager(opts.secretManager)) if err != nil { return nil, err } tlsSettings, err := cfg.TLSConfig.roundTripperSettings(opts.secretManager) if err != nil { return nil, err } if tlsSettings.immutable() { // No need for a RoundTripper that reloads the files automatically. return newRT(tlsConfig) } return NewTLSRoundTripperWithContext(ctx, tlsConfig, tlsSettings, newRT) } // SecretManager manages secret data mapped to names known as "references" or "refs". type SecretManager interface { // Fetch returns the secret data given a secret name indicated by `secretRef`. Fetch(ctx context.Context, secretRef string) (string, error) } type SecretReader interface { Fetch(ctx context.Context) (string, error) Description() string Immutable() bool } type InlineSecret struct { text string } func NewInlineSecret(text string) InlineSecret { return &InlineSecret{text: text} } func (s InlineSecret) Fetch(context.Context) (string, error) { return s.text, nil } func (s InlineSecret) Description() string { return "inline" } func (s InlineSecret) Immutable() bool { return true } type FileSecret struct { file string } func NewFileSecret(file string) FileSecret { return &FileSecret{file: file} } func (s FileSecret) Fetch(ctx context.Context) (string, error) { fileBytes, err := os.ReadFile(s.file) if err != nil { return "", fmt.Errorf("unable to read file %s: %w", s.file, err) } return strings.TrimSpace(string(fileBytes)), nil } func (s FileSecret) Description() string { return "file " + s.file } func (s FileSecret) Immutable() bool { return false } // refSecret fetches a single secret from a SecretManager. type refSecret struct { ref string manager SecretManager // manager is expected to be not nil. } func (s refSecret) Fetch(ctx context.Context) (string, error) { return s.manager.Fetch(ctx, s.ref) } func (s refSecret) Description() string { return "ref " + s.ref } func (s refSecret) Immutable() bool { return false } // toSecret returns a SecretReader from one of the given sources, assuming exactly // one or none of the sources are provided. func toSecret(secretManager SecretManager, text Secret, file, ref string) (SecretReader, error) { if text != "" { return NewInlineSecret(string(text)), nil } if file != "" { return NewFileSecret(file), nil } if ref != "" { if secretManager == nil { return nil, errors.New("cannot use secret ref without manager") } return &refSecret{ ref: ref, manager: secretManager, }, nil } return nil, nil } type authorizationCredentialsRoundTripper struct { authType string authCredentials SecretReader rt http.RoundTripper } // NewAuthorizationCredentialsRoundTripper adds the authorization credentials // read from the provided SecretReader to a request unless the authorization header // has already been set. func NewAuthorizationCredentialsRoundTripper(authType string, authCredentials SecretReader, rt http.RoundTripper) http.RoundTripper { return &authorizationCredentialsRoundTripper{authType, authCredentials, rt} } func (rt authorizationCredentialsRoundTripper) RoundTrip(req http.Request) (http.Response, error) { if len(req.Header.Get("Authorization")) != 0 { return rt.rt.RoundTrip(req) } var authCredentials string if rt.authCredentials != nil { var err error authCredentials, err = rt.authCredentials.Fetch(req.Context()) if err != nil { return nil, fmt.Errorf("unable to read authorization credentials: %w", err) } } req = cloneRequest(req) req.Header.Set("Authorization", fmt.Sprintf("%s %s", rt.authType, authCredentials)) return rt.rt.RoundTrip(req) } func (rt authorizationCredentialsRoundTripper) CloseIdleConnections() { if ci, ok := rt.rt.(closeIdler); ok { ci.CloseIdleConnections() } } type basicAuthRoundTripper struct { username SecretReader password SecretReader rt http.RoundTripper } // NewBasicAuthRoundTripper will apply a BASIC auth authorization header to a request unless it has // already been set. func NewBasicAuthRoundTripper(username, password SecretReader, rt http.RoundTripper) http.RoundTripper { return &basicAuthRoundTripper{username, password, rt} } func (rt basicAuthRoundTripper) RoundTrip(req http.Request) (http.Response, error) { if len(req.Header.Get("Authorization")) != 0 { return rt.rt.RoundTrip(req) } var username string var password string if rt.username != nil { var err error username, err = rt.username.Fetch(req.Context()) if err != nil { return nil, fmt.Errorf("unable to read basic auth username: %w", err) } } if rt.password != nil { var err error password, err = rt.password.Fetch(req.Context()) if err != nil { return nil, fmt.Errorf("unable to read basic auth password: %w", err) } } req = cloneRequest(req) req.SetBasicAuth(username, password) return rt.rt.RoundTrip(req) } func (rt basicAuthRoundTripper) CloseIdleConnections() { if ci, ok := rt.rt.(closeIdler); ok { ci.CloseIdleConnections() } } type oauth2RoundTripper struct { mtx sync.RWMutex lastRT oauth2.Transport lastSecret string // Required for interaction with Oauth2 server. config OAuth2 clientSecret SecretReader opts httpClientOptions client http.Client } func NewOAuth2RoundTripper(clientSecret SecretReader, config OAuth2, next http.RoundTripper, opts httpClientOptions) http.RoundTripper { if clientSecret == nil { clientSecret = NewInlineSecret("") } return &oauth2RoundTripper{ config: config, // A correct tokenSource will be added later on. lastRT: &oauth2.Transport{Base: next}, opts: opts, clientSecret: clientSecret, } } func (rt oauth2RoundTripper) newOauth2TokenSource(req http.Request, secret string) (client http.Client, source oauth2.TokenSource, err error) { tlsConfig, err := NewTLSConfig(&rt.config.TLSConfig, WithSecretManager(rt.opts.secretManager)) if err != nil { return nil, nil, err } tlsTransport := func(tlsConfig tls.Config) (http.RoundTripper, error) { return &http.Transport{ TLSClientConfig: tlsConfig, Proxy: rt.config.ProxyConfig.Proxy(), ProxyConnectHeader: rt.config.ProxyConfig.GetProxyConnectHeader(), DisableKeepAlives: !rt.opts.keepAlivesEnabled, MaxIdleConns: 20, MaxIdleConnsPerHost: 1, // see https://github.com/golang/go/issues/13801 IdleConnTimeout: 10 * time.Second, TLSHandshakeTimeout: 10 * time.Second, ExpectContinueTimeout: 1 * time.Second, }, nil } var t http.RoundTripper tlsSettings, err := rt.config.TLSConfig.roundTripperSettings(rt.opts.secretManager) if err != nil { return nil, nil, err } if tlsSettings.immutable() { t, _ = tlsTransport(tlsConfig) } else { t, err = NewTLSRoundTripperWithContext(req.Context(), tlsConfig, tlsSettings, tlsTransport) if err != nil { return nil, nil, err } } if ua := req.UserAgent(); ua != "" { t = NewUserAgentRoundTripper(ua, t) } config := &clientcredentials.Config{ ClientID: rt.config.ClientID, ClientSecret: secret, Scopes: rt.config.Scopes, TokenURL: rt.config.TokenURL, EndpointParams: mapToValues(rt.config.EndpointParams), } client = &http.Client{Transport: t} ctx := context.WithValue(context.Background(), oauth2.HTTPClient, client) return client, config.TokenSource(ctx), nil } func (rt oauth2RoundTripper) RoundTrip(req http.Request) (http.Response, error) { var ( secret string needsInit bool ) rt.mtx.RLock() secret = rt.lastSecret needsInit = rt.lastRT.Source == nil rt.mtx.RUnlock() // Fetch the secret if it's our first run or always if the secret can change. if !rt.clientSecret.Immutable() \|\| needsInit { newSecret, err := rt.clientSecret.Fetch(req.Context()) if err != nil { return nil, fmt.Errorf("unable to read oauth2 client secret: %w", err) } if newSecret != secret \|\| needsInit { // Secret changed or it's a first run. Rebuilt oauth2 setup. client, source, err := rt.newOauth2TokenSource(req, newSecret) if err != nil { return nil, err } rt.mtx.Lock() rt.lastSecret = newSecret rt.lastRT.Source = source if rt.client != nil { rt.client.CloseIdleConnections() } rt.client = client rt.mtx.Unlock() } } rt.mtx.RLock() currentRT := rt.lastRT rt.mtx.RUnlock() return currentRT.RoundTrip(req) } func (rt oauth2RoundTripper) CloseIdleConnections() { if rt.client != nil { rt.client.CloseIdleConnections() } if ci, ok := rt.lastRT.Base.(closeIdler); ok { ci.CloseIdleConnections() } } func mapToValues(m map[string]string) url.Values { v := url.Values{} for name, value := range m { v.Set(name, value) } return v } // cloneRequest returns a clone of the provided http.Request. // The clone is a shallow copy of the struct and its Header map. func cloneRequest(r http.Request) http.Request { // Shallow copy of the struct. r2 := new(http.Request) r2 = r // Deep copy of the Header. r2.Header = make(http.Header) for k, s := range r.Header { r2.Header[k] = s } return r2 } type tlsConfigOptions struct { secretManager SecretManager } // TLSConfigOption defines an option that can be applied to the HTTP client. type TLSConfigOption interface { applyToTLSConfigOptions(options tlsConfigOptions) } // NewTLSConfig creates a new tls.Config from the given TLSConfig. func NewTLSConfig(cfg TLSConfig, optFuncs ...TLSConfigOption) (tls.Config, error) { return NewTLSConfigWithContext(context.Background(), cfg, optFuncs...) } // NewTLSConfigWithContext creates a new tls.Config from the given TLSConfig. func NewTLSConfigWithContext(ctx context.Context, cfg TLSConfig, optFuncs ...TLSConfigOption) (tls.Config, error) { opts := tlsConfigOptions{} for _, opt := range optFuncs { opt.applyToTLSConfigOptions(&opts) } if err := cfg.Validate(); err != nil { return nil, err } tlsConfig := &tls.Config{ InsecureSkipVerify: cfg.InsecureSkipVerify, MinVersion: uint16(cfg.MinVersion), MaxVersion: uint16(cfg.MaxVersion), } if cfg.MaxVersion != 0 && cfg.MinVersion != 0 { if cfg.MaxVersion < cfg.MinVersion { return nil, errors.New("tls_config.max_version must be greater than or equal to tls_config.min_version if both are specified") } } // If a CA cert is provided then let's read it in so we can validate the // scrape target's certificate properly. caSecret, err := toSecret(opts.secretManager, Secret(cfg.CA), cfg.CAFile, cfg.CARef) if err != nil { return nil, fmt.Errorf("unable to use CA cert: %w", err) } if caSecret != nil { ca, err := caSecret.Fetch(ctx) if err != nil { return nil, fmt.Errorf("unable to read CA cert: %w", err) } if !updateRootCA(tlsConfig, []byte(ca)) { return nil, fmt.Errorf("unable to use specified CA cert %s", caSecret.Description()) } } if len(cfg.ServerName) > 0 { tlsConfig.ServerName = cfg.ServerName } // If a client cert & key is provided then configure TLS config accordingly. if cfg.usingClientCert() && cfg.usingClientKey() { // Verify that client cert and key are valid. if _, err := cfg.getClientCertificate(ctx, opts.secretManager); err != nil { return nil, err } tlsConfig.GetClientCertificate = func(cri tls.CertificateRequestInfo) (tls.Certificate, error) { var ctx context.Context if cri != nil { ctx = cri.Context() } return cfg.getClientCertificate(ctx, opts.secretManager) } } return tlsConfig, nil } // TLSConfig configures the options for TLS connections. type TLSConfig struct { // Text of the CA cert to use for the targets. CA string `yaml:"ca,omitempty" json:"ca,omitempty"` // Text of the client cert file for the targets. Cert string `yaml:"cert,omitempty" json:"cert,omitempty"` // Text of the client key file for the targets. Key Secret `yaml:"key,omitempty" json:"key,omitempty"` // The CA cert to use for the targets. CAFile string `yaml:"ca_file,omitempty" json:"ca_file,omitempty"` // The client cert file for the targets. CertFile string `yaml:"cert_file,omitempty" json:"cert_file,omitempty"` // The client key file for the targets. KeyFile string `yaml:"key_file,omitempty" json:"key_file,omitempty"` // CARef is the name of the secret within the secret manager to use as the CA cert for the // targets. CARef string `yaml:"ca_ref,omitempty" json:"ca_ref,omitempty"` // CertRef is the name of the secret within the secret manager to use as the client cert for // the targets. CertRef string `yaml:"cert_ref,omitempty" json:"cert_ref,omitempty"` // KeyRef is the name of the secret within the secret manager to use as the client key for // the targets. KeyRef string `yaml:"key_ref,omitempty" json:"key_ref,omitempty"` // Used to verify the hostname for the targets. ServerName string `yaml:"server_name,omitempty" json:"server_name,omitempty"` // Disable target certificate validation. InsecureSkipVerify bool `yaml:"insecure_skip_verify" json:"insecure_skip_verify"` // Minimum TLS version. MinVersion TLSVersion `yaml:"min_version,omitempty" json:"min_version,omitempty"` // Maximum TLS version. MaxVersion TLSVersion `yaml:"max_version,omitempty" json:"max_version,omitempty"` } // SetDirectory joins any relative file paths with dir. func (c TLSConfig) SetDirectory(dir string) { if c == nil { return } c.CAFile = JoinDir(dir, c.CAFile) c.CertFile = JoinDir(dir, c.CertFile) c.KeyFile = JoinDir(dir, c.KeyFile) } // UnmarshalYAML implements the yaml.Unmarshaler interface. func (c TLSConfig) UnmarshalYAML(unmarshal func(interface{}) error) error { type plain TLSConfig if err := unmarshal((plain)(c)); err != nil { return err } return c.Validate() } // Validate validates the TLSConfig to check that only one of the inlined or // file-based fields for the TLS CA, client certificate, and client key are // used. func (c TLSConfig) Validate() error { if nonZeroCount(len(c.CA) > 0, len(c.CAFile) > 0, len(c.CARef) > 0) > 1 { return errors.New("at most one of ca, ca_file & ca_ref must be configured") } if nonZeroCount(len(c.Cert) > 0, len(c.CertFile) > 0, len(c.CertRef) > 0) > 1 { return errors.New("at most one of cert, cert_file & cert_ref must be configured") } if nonZeroCount(len(c.Key) > 0, len(c.KeyFile) > 0, len(c.KeyRef) > 0) > 1 { return errors.New("at most one of key and key_file must be configured") } if c.usingClientCert() && !c.usingClientKey() { return errors.New("exactly one of key or key_file must be configured when a client certificate is configured") } else if c.usingClientKey() && !c.usingClientCert() { return errors.New("exactly one of cert or cert_file must be configured when a client key is configured") } return nil } func (c TLSConfig) usingClientCert() bool { return len(c.Cert) > 0 \|\| len(c.CertFile) > 0 \|\| len(c.CertRef) > 0 } func (c TLSConfig) usingClientKey() bool { return len(c.Key) > 0 \|\| len(c.KeyFile) > 0 \|\| len(c.KeyRef) > 0 } func (c TLSConfig) roundTripperSettings(secretManager SecretManager) (TLSRoundTripperSettings, error) { ca, err := toSecret(secretManager, Secret(c.CA), c.CAFile, c.CARef) if err != nil { return TLSRoundTripperSettings{}, err } cert, err := toSecret(secretManager, Secret(c.Cert), c.CertFile, c.CertRef) if err != nil { return TLSRoundTripperSettings{}, err } key, err := toSecret(secretManager, c.Key, c.KeyFile, c.KeyRef) if err != nil { return TLSRoundTripperSettings{}, err } return TLSRoundTripperSettings{ CA: ca, Cert: cert, Key: key, }, nil } // getClientCertificate reads the pair of client cert and key and returns a tls.Certificate. func (c TLSConfig) getClientCertificate(ctx context.Context, secretManager SecretManager) (tls.Certificate, error) { var ( certData, keyData string err error ) certSecret, err := toSecret(secretManager, Secret(c.Cert), c.CertFile, c.CertRef) if err != nil { return nil, fmt.Errorf("unable to use client cert: %w", err) } if certSecret != nil { certData, err = certSecret.Fetch(ctx) if err != nil { return nil, fmt.Errorf("unable to read specified client cert: %w", err) } } keySecret, err := toSecret(secretManager, Secret(c.Key), c.KeyFile, c.KeyRef) if err != nil { return nil, fmt.Errorf("unable to use client key: %w", err) } if keySecret != nil { keyData, err = keySecret.Fetch(ctx) if err != nil { return nil, fmt.Errorf("unable to read specified client key: %w", err) } } cert, err := tls.X509KeyPair([]byte(certData), []byte(keyData)) if err != nil { return nil, fmt.Errorf("unable to use specified client cert (%s) & key (%s): %w", certSecret.Description(), keySecret.Description(), err) } return &cert, nil } // updateRootCA parses the given byte slice as a series of PEM encoded certificates and updates tls.Config.RootCAs. func updateRootCA(cfg tls.Config, b []byte) bool { caCertPool := x509.NewCertPool() if !caCertPool.AppendCertsFromPEM(b) { return false } cfg.RootCAs = caCertPool return true } // tlsRoundTripper is a RoundTripper that updates automatically its TLS // configuration whenever the content of the CA file changes. type tlsRoundTripper struct { settings TLSRoundTripperSettings // newRT returns a new RoundTripper. newRT func(tls.Config) (http.RoundTripper, error) mtx sync.RWMutex rt http.RoundTripper hashCAData []byte hashCertData []byte hashKeyData []byte tlsConfig tls.Config } type TLSRoundTripperSettings struct { CA SecretReader Cert SecretReader Key SecretReader } func (t TLSRoundTripperSettings) immutable() bool { return (t.CA == nil \|\| t.CA.Immutable()) && (t.Cert == nil \|\| t.Cert.Immutable()) && (t.Key == nil \|\| t.Key.Immutable()) } func NewTLSRoundTripper( cfg tls.Config, settings TLSRoundTripperSettings, newRT func(tls.Config) (http.RoundTripper, error), ) (http.RoundTripper, error) { return NewTLSRoundTripperWithContext(context.Background(), cfg, settings, newRT) } func NewTLSRoundTripperWithContext( ctx context.Context, cfg tls.Config, settings TLSRoundTripperSettings, newRT func(tls.Config) (http.RoundTripper, error), ) (http.RoundTripper, error) { t := &tlsRoundTripper{ settings: settings, newRT: newRT, tlsConfig: cfg, } rt, err := t.newRT(t.tlsConfig) if err != nil { return nil, err } t.rt = rt _, t.hashCAData, t.hashCertData, t.hashKeyData, err = t.getTLSDataWithHash(ctx) if err != nil { return nil, err } return t, nil } func (t tlsRoundTripper) getTLSDataWithHash(ctx context.Context) ([]byte, []byte, []byte, []byte, error) { var caBytes, certBytes, keyBytes []byte if t.settings.CA != nil { ca, err := t.settings.CA.Fetch(ctx) if err != nil { return nil, nil, nil, nil, fmt.Errorf("unable to read CA cert: %w", err) } caBytes = []byte(ca) } if t.settings.Cert != nil { cert, err := t.settings.Cert.Fetch(ctx) if err != nil { return nil, nil, nil, nil, fmt.Errorf("unable to read client cert: %w", err) } certBytes = []byte(cert) } if t.settings.Key != nil { key, err := t.settings.Key.Fetch(ctx) if err != nil { return nil, nil, nil, nil, fmt.Errorf("unable to read client key: %w", err) } keyBytes = []byte(key) } var caHash, certHash, keyHash [32]byte if len(caBytes) > 0 { caHash = sha256.Sum256(caBytes) } if len(certBytes) > 0 { certHash = sha256.Sum256(certBytes) } if len(keyBytes) > 0 { keyHash = sha256.Sum256(keyBytes) } return caBytes, caHash[:], certHash[:], keyHash[:], nil } // RoundTrip implements the http.RoundTrip interface. func (t tlsRoundTripper) RoundTrip(req http.Request) (http.Response, error) { caData, caHash, certHash, keyHash, err := t.getTLSDataWithHash(req.Context()) if err != nil { return nil, err } t.mtx.RLock() equal := bytes.Equal(caHash[:], t.hashCAData) && bytes.Equal(certHash[:], t.hashCertData) && bytes.Equal(keyHash[:], t.hashKeyData) rt := t.rt t.mtx.RUnlock() if equal { // The CA cert hasn't changed, use the existing RoundTripper. return rt.RoundTrip(req) } // Create a new RoundTripper. // The cert and key files are read separately by the client // using GetClientCertificate. tlsConfig := t.tlsConfig.Clone() if !updateRootCA(tlsConfig, caData) { return nil, fmt.Errorf("unable to use specified CA cert %s", t.settings.CA.Description()) } rt, err = t.newRT(tlsConfig) if err != nil { return nil, err } t.CloseIdleConnections() t.mtx.Lock() t.rt = rt t.hashCAData = caHash[:] t.hashCertData = certHash[:] t.hashKeyData = keyHash[:] t.mtx.Unlock() return rt.RoundTrip(req) } func (t tlsRoundTripper) CloseIdleConnections() { t.mtx.RLock() defer t.mtx.RUnlock() if ci, ok := t.rt.(closeIdler); ok { ci.CloseIdleConnections() } } type userAgentRoundTripper struct { userAgent string rt http.RoundTripper } type hostRoundTripper struct { host string rt http.RoundTripper } // NewUserAgentRoundTripper adds the user agent every request header. func NewUserAgentRoundTripper(userAgent string, rt http.RoundTripper) http.RoundTripper { return &userAgentRoundTripper{userAgent, rt} } // NewHostRoundTripper sets the [http.Request.Host] of every request. func NewHostRoundTripper(host string, rt http.RoundTripper) http.RoundTripper { return &hostRoundTripper{host, rt} } func (rt userAgentRoundTripper) RoundTrip(req http.Request) (http.Response, error) { req = cloneRequest(req) req.Header.Set("User-Agent", rt.userAgent) return rt.rt.RoundTrip(req) } func (rt userAgentRoundTripper) CloseIdleConnections() { if ci, ok := rt.rt.(closeIdler); ok { ci.CloseIdleConnections() } } func (rt hostRoundTripper) RoundTrip(req http.Request) (http.Response, error) { req = cloneRequest(req) req.Host = rt.host req.Header.Set("Host", rt.host) return rt.rt.RoundTrip(req) } func (rt hostRoundTripper) CloseIdleConnections() { if ci, ok := rt.rt.(closeIdler); ok { ci.CloseIdleConnections() } } func (c HTTPClientConfig) String() string { b, err := yaml.Marshal(c) if err != nil { return fmt.Sprintf("<error creating http client config string: %s>", err) } return string(b) } type ProxyConfig struct { // HTTP proxy server to use to connect to the targets. ProxyURL URL `yaml:"proxy_url,omitempty" json:"proxy_url,omitempty"` // NoProxy contains addresses that should not use a proxy. NoProxy string `yaml:"no_proxy,omitempty" json:"no_proxy,omitempty"` // ProxyFromEnvironment makes use of net/http ProxyFromEnvironment function // to determine proxies. ProxyFromEnvironment bool `yaml:"proxy_from_environment,omitempty" json:"proxy_from_environment,omitempty"` // ProxyConnectHeader optionally specifies headers to send to // proxies during CONNECT requests. Assume that at least _some_ of // these headers are going to contain secrets and use Secret as the // value type instead of string. ProxyConnectHeader ProxyHeader `yaml:"proxy_connect_header,omitempty" json:"proxy_connect_header,omitempty"` proxyFunc func(http.Request) (url.URL, error) } // UnmarshalYAML implements the yaml.Unmarshaler interface. func (c ProxyConfig) Validate() error { if len(c.ProxyConnectHeader) > 0 && (!c.ProxyFromEnvironment && (c.ProxyURL.URL == nil \|\| c.ProxyURL.String() == "")) { return errors.New("if proxy_connect_header is configured, proxy_url or proxy_from_environment must also be configured") } if c.ProxyFromEnvironment && c.ProxyURL.URL != nil && c.ProxyURL.String() != "" { return errors.New("if proxy_from_environment is configured, proxy_url must not be configured") } if c.ProxyFromEnvironment && c.NoProxy != "" { return errors.New("if proxy_from_environment is configured, no_proxy must not be configured") } if c.ProxyURL.URL == nil && c.NoProxy != "" { return errors.New("if no_proxy is configured, proxy_url must also be configured") } return nil } // Proxy returns the Proxy URL for a request. func (c ProxyConfig) Proxy() (fn func(http.Request) (url.URL, error)) { if c == nil { return nil } defer func() { fn = c.proxyFunc }() if c.proxyFunc != nil { return } if c.ProxyFromEnvironment { proxyFn := httpproxy.FromEnvironment().ProxyFunc() c.proxyFunc = func(req http.Request) (url.URL, error) { return proxyFn(req.URL) } return } if c.ProxyURL.URL != nil && c.ProxyURL.URL.String() != "" { if c.NoProxy == "" { c.proxyFunc = http.ProxyURL(c.ProxyURL.URL) return } proxy := &httpproxy.Config{ HTTPProxy: c.ProxyURL.String(), HTTPSProxy: c.ProxyURL.String(), NoProxy: c.NoProxy, } proxyFn := proxy.ProxyFunc() c.proxyFunc = func(req http.Request) (url.URL, error) { return proxyFn(req.URL) } } return } // ProxyConnectHeader() return the Proxy Connext Headers. func (c *ProxyConfig) GetProxyConnectHeader() http.Header { return c.ProxyConnectHeader.HTTPHeader() }	46.52 KB	2025-05-25 12:27
📄 http_config_test.go // Copyright 2015 The Prometheus Authors // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package config import ( "context" "crypto/tls" "crypto/x509" "encoding/json" "errors" "fmt" "io" "net" "net/http" "net/http/httptest" "net/url" "os" "path/filepath" "reflect" "strconv" "strings" "sync" "sync/atomic" "testing" "time" "github.com/stretchr/testify/require" "gopkg.in/yaml.v2" ) const ( TLSCAChainPath = "testdata/tls-ca-chain.pem" ServerCertificatePath = "testdata/server.crt" ServerKeyPath = "testdata/server.key" ClientCertificatePath = "testdata/client.crt" ClientKeyNoPassPath = "testdata/client.key" InvalidCA = "testdata/client.key" WrongClientCertPath = "testdata/self-signed-client.crt" WrongClientKeyPath = "testdata/self-signed-client.key" EmptyFile = "testdata/empty" MissingCA = "missing/ca.crt" MissingCert = "missing/cert.crt" MissingKey = "missing/secret.key" ExpectedMessage = "I'm here to serve you!!!" ExpectedError = "expected error" AuthorizationCredentials = "theanswertothegreatquestionoflifetheuniverseandeverythingisfortytwo" AuthorizationCredentialsFile = "testdata/bearer.token" AuthorizationType = "APIKEY" BearerToken = AuthorizationCredentials BearerTokenFile = AuthorizationCredentialsFile MissingBearerTokenFile = "missing/bearer.token" ExpectedBearer = "Bearer " + BearerToken ExpectedAuthenticationCredentials = AuthorizationType + " " + BearerToken ExpectedUsername = "arthurdent" ExpectedPassword = "42" ExpectedAccessToken = "12345" ) var invalidHTTPClientConfigs = []struct { httpClientConfigFile string errMsg string }{ { httpClientConfigFile: "testdata/http.conf.bearer-token-and-file-set.bad.yml", errMsg: "at most one of bearer_token & bearer_token_file must be configured", }, { httpClientConfigFile: "testdata/http.conf.empty.bad.yml", errMsg: "at most one of basic_auth, oauth2, bearer_token & bearer_token_file must be configured", }, { httpClientConfigFile: "testdata/http.conf.basic-auth.too-much.bad.yaml", errMsg: "at most one of basic_auth password, password_file & password_ref must be configured", }, { httpClientConfigFile: "testdata/http.conf.basic-auth.bad-username.yaml", errMsg: "at most one of basic_auth username, username_file & username_ref must be configured", }, { httpClientConfigFile: "testdata/http.conf.mix-bearer-and-creds.bad.yaml", errMsg: "authorization is not compatible with bearer_token & bearer_token_file", }, { httpClientConfigFile: "testdata/http.conf.auth-creds-and-file-set.too-much.bad.yaml", errMsg: "at most one of authorization credentials & credentials_file must be configured", }, { httpClientConfigFile: "testdata/http.conf.basic-auth-and-auth-creds.too-much.bad.yaml", errMsg: "at most one of basic_auth, oauth2 & authorization must be configured", }, { httpClientConfigFile: "testdata/http.conf.basic-auth-and-oauth2.too-much.bad.yaml", errMsg: "at most one of basic_auth, oauth2 & authorization must be configured", }, { httpClientConfigFile: "testdata/http.conf.auth-creds-no-basic.bad.yaml", errMsg: `authorization type cannot be set to "basic", use "basic_auth" instead`, }, { httpClientConfigFile: "testdata/http.conf.oauth2-secret-and-file-set.bad.yml", errMsg: "at most one of oauth2 client_secret, client_secret_file & client_secret_ref must be configured", }, { httpClientConfigFile: "testdata/http.conf.oauth2-no-client-id.bad.yaml", errMsg: "oauth2 client_id must be configured", }, { httpClientConfigFile: "testdata/http.conf.oauth2-no-token-url.bad.yaml", errMsg: "oauth2 token_url must be configured", }, { httpClientConfigFile: "testdata/http.conf.proxy-from-env.bad.yaml", errMsg: "if proxy_from_environment is configured, proxy_url must not be configured", }, { httpClientConfigFile: "testdata/http.conf.no-proxy.bad.yaml", errMsg: "if proxy_from_environment is configured, no_proxy must not be configured", }, { httpClientConfigFile: "testdata/http.conf.no-proxy-without-proxy-url.bad.yaml", errMsg: "if no_proxy is configured, proxy_url must also be configured", }, { httpClientConfigFile: "testdata/http.conf.headers-reserved.bad.yaml", errMsg: `setting header "User-Agent" is not allowed`, }, } func newTestServer(handler func(w http.ResponseWriter, r http.Request)) (httptest.Server, error) { testServer := httptest.NewUnstartedServer(http.HandlerFunc(handler)) tlsCAChain, err := os.ReadFile(TLSCAChainPath) if err != nil { return nil, fmt.Errorf("Can't read %s", TLSCAChainPath) } serverCertificate, err := tls.LoadX509KeyPair(ServerCertificatePath, ServerKeyPath) if err != nil { return nil, fmt.Errorf("Can't load X509 key pair %s - %s", ServerCertificatePath, ServerKeyPath) } rootCAs := x509.NewCertPool() rootCAs.AppendCertsFromPEM(tlsCAChain) testServer.TLS = &tls.Config{ Certificates: make([]tls.Certificate, 1), RootCAs: rootCAs, ClientAuth: tls.RequireAndVerifyClientCert, ClientCAs: rootCAs, } testServer.TLS.Certificates[0] = serverCertificate testServer.StartTLS() return testServer, nil } func TestNewClientFromConfig(t testing.T) { newClientValidConfig := []struct { clientConfig HTTPClientConfig handler func(w http.ResponseWriter, r http.Request) }{ { clientConfig: HTTPClientConfig{ TLSConfig: TLSConfig{ CAFile: "", CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: true, }, }, handler: func(w http.ResponseWriter, r http.Request) { fmt.Fprint(w, ExpectedMessage) }, }, { clientConfig: HTTPClientConfig{ TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { fmt.Fprint(w, ExpectedMessage) }, }, { clientConfig: HTTPClientConfig{ BearerToken: BearerToken, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { bearer := r.Header.Get("Authorization") if bearer != ExpectedBearer { fmt.Fprintf(w, "The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", ExpectedBearer, bearer) } else { fmt.Fprint(w, ExpectedMessage) } }, }, { clientConfig: HTTPClientConfig{ BearerTokenFile: BearerTokenFile, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { bearer := r.Header.Get("Authorization") if bearer != ExpectedBearer { fmt.Fprintf(w, "The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", ExpectedBearer, bearer) } else { fmt.Fprint(w, ExpectedMessage) } }, }, { clientConfig: HTTPClientConfig{ Authorization: &Authorization{Credentials: BearerToken}, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { bearer := r.Header.Get("Authorization") if bearer != ExpectedBearer { fmt.Fprintf(w, "The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", ExpectedBearer, bearer) } else { fmt.Fprint(w, ExpectedMessage) } }, }, { clientConfig: HTTPClientConfig{ Authorization: &Authorization{CredentialsFile: AuthorizationCredentialsFile, Type: AuthorizationType}, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { bearer := r.Header.Get("Authorization") if bearer != ExpectedAuthenticationCredentials { fmt.Fprintf(w, "The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", ExpectedAuthenticationCredentials, bearer) } else { fmt.Fprint(w, ExpectedMessage) } }, }, { clientConfig: HTTPClientConfig{ Authorization: &Authorization{ Type: AuthorizationType, }, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { bearer := r.Header.Get("Authorization") if strings.TrimSpace(bearer) != AuthorizationType { fmt.Fprintf(w, "The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", AuthorizationType, bearer) } else { fmt.Fprint(w, ExpectedMessage) } }, }, { clientConfig: HTTPClientConfig{ Authorization: &Authorization{ Credentials: AuthorizationCredentials, Type: AuthorizationType, }, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { bearer := r.Header.Get("Authorization") if bearer != ExpectedAuthenticationCredentials { fmt.Fprintf(w, "The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", ExpectedAuthenticationCredentials, bearer) } else { fmt.Fprint(w, ExpectedMessage) } }, }, { clientConfig: HTTPClientConfig{ Authorization: &Authorization{ CredentialsFile: BearerTokenFile, }, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { bearer := r.Header.Get("Authorization") if bearer != ExpectedBearer { fmt.Fprintf(w, "The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", ExpectedBearer, bearer) } else { fmt.Fprint(w, ExpectedMessage) } }, }, { clientConfig: HTTPClientConfig{ BasicAuth: &BasicAuth{ Username: ExpectedUsername, Password: ExpectedPassword, }, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { username, password, ok := r.BasicAuth() if !ok { fmt.Fprintf(w, "The Authorization header wasn't set") } else if ExpectedUsername != username { fmt.Fprintf(w, "The expected username (%s) differs from the obtained username (%s).", ExpectedUsername, username) } else if ExpectedPassword != password { fmt.Fprintf(w, "The expected password (%s) differs from the obtained password (%s).", ExpectedPassword, password) } else { fmt.Fprint(w, ExpectedMessage) } }, }, { clientConfig: HTTPClientConfig{ FollowRedirects: true, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { switch r.URL.Path { case "/redirected": fmt.Fprint(w, ExpectedMessage) default: w.Header().Set("Location", "/redirected") w.WriteHeader(http.StatusFound) fmt.Fprint(w, "It should follow the redirect.") } }, }, { clientConfig: HTTPClientConfig{ FollowRedirects: false, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { switch r.URL.Path { case "/redirected": fmt.Fprint(w, "The redirection was followed.") default: w.Header().Set("Location", "/redirected") w.WriteHeader(http.StatusFound) fmt.Fprint(w, ExpectedMessage) } }, }, { clientConfig: HTTPClientConfig{ OAuth2: &OAuth2{ ClientID: "ExpectedUsername", TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { switch r.URL.Path { case "/token": res, _ := json.Marshal(oauth2TestServerResponse{ AccessToken: ExpectedAccessToken, TokenType: "Bearer", }) w.Header().Add("Content-Type", "application/json") _, _ = w.Write(res) default: authorization := r.Header.Get("Authorization") if authorization != "Bearer "+ExpectedAccessToken { fmt.Fprintf(w, "Expected Authorization header %q, got %q", "Bearer "+ExpectedAccessToken, authorization) } else { fmt.Fprint(w, ExpectedMessage) } } }, }, { clientConfig: HTTPClientConfig{ OAuth2: &OAuth2{ ClientID: "ExpectedUsername", ClientSecret: "ExpectedPassword", TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, }, handler: func(w http.ResponseWriter, r http.Request) { switch r.URL.Path { case "/token": res, _ := json.Marshal(oauth2TestServerResponse{ AccessToken: ExpectedAccessToken, TokenType: "Bearer", }) w.Header().Add("Content-Type", "application/json") _, _ = w.Write(res) default: authorization := r.Header.Get("Authorization") if authorization != "Bearer "+ExpectedAccessToken { fmt.Fprintf(w, "Expected Authorization header %q, got %q", "Bearer "+ExpectedAccessToken, authorization) } else { fmt.Fprint(w, ExpectedMessage) } } }, }, } for _, validConfig := range newClientValidConfig { t.Run("", func(t testing.T) { testServer, err := newTestServer(validConfig.handler) require.NoError(t, err) defer testServer.Close() if validConfig.clientConfig.OAuth2 != nil { // We don't have access to the test server's URL when configuring the test cases, // so it has to be specified here. validConfig.clientConfig.OAuth2.TokenURL = testServer.URL + "/token" } err = validConfig.clientConfig.Validate() require.NoError(t, err) client, err := NewClientFromConfig(validConfig.clientConfig, "test") if err != nil { t.Errorf("Can't create a client from this config: %+v", validConfig.clientConfig) return } response, err := client.Get(testServer.URL) if err != nil { t.Errorf("Can't connect to the test server using this config: %+v: %v", validConfig.clientConfig, err) return } message, err := io.ReadAll(response.Body) response.Body.Close() if err != nil { t.Errorf("Can't read the server response body using this config: %+v", validConfig.clientConfig) return } trimMessage := strings.TrimSpace(string(message)) if ExpectedMessage != trimMessage { t.Errorf("The expected message (%s) differs from the obtained message (%s) using this config: %+v", ExpectedMessage, trimMessage, validConfig.clientConfig) } }) } } func TestProxyConfiguration(t testing.T) { testcases := map[string]struct { testFn string loader func(string) (HTTPClientConfig, []byte, error) isValid bool }{ "good yaml": { testFn: "testdata/http.conf.proxy-headers.good.yml", loader: LoadHTTPConfigFile, isValid: true, }, "bad yaml": { testFn: "testdata/http.conf.proxy-headers.bad.yml", loader: LoadHTTPConfigFile, isValid: false, }, "good json": { testFn: "testdata/http.conf.proxy-headers.good.json", loader: loadHTTPConfigJSONFile, isValid: true, }, "bad json": { testFn: "testdata/http.conf.proxy-headers.bad.json", loader: loadHTTPConfigJSONFile, isValid: false, }, } for name, tc := range testcases { t.Run(name, func(t testing.T) { _, _, err := tc.loader(tc.testFn) if tc.isValid { require.NoErrorf(t, err, "Error validating %s: %s", tc.testFn, err) } else { require.Errorf(t, err, "Expecting error validating %s but got %s", tc.testFn, err) } }) } } func TestNewClientFromInvalidConfig(t testing.T) { newClientInvalidConfig := []struct { clientConfig HTTPClientConfig errorMsg string }{ { clientConfig: HTTPClientConfig{ TLSConfig: TLSConfig{ CAFile: MissingCA, InsecureSkipVerify: true, }, }, errorMsg: "unable to read CA cert: unable to read file " + MissingCA, }, { clientConfig: HTTPClientConfig{ TLSConfig: TLSConfig{ CAFile: InvalidCA, InsecureSkipVerify: true, }, }, errorMsg: "unable to use specified CA cert file " + InvalidCA, }, } for _, invalidConfig := range newClientInvalidConfig { client, err := NewClientFromConfig(invalidConfig.clientConfig, "test") if client != nil { t.Errorf("A client instance was returned instead of nil using this config: %+v", invalidConfig.clientConfig) } if err == nil { t.Errorf("No error was returned using this config: %+v", invalidConfig.clientConfig) } if !strings.Contains(err.Error(), invalidConfig.errorMsg) { t.Errorf("Expected error %q does not contain %q", err.Error(), invalidConfig.errorMsg) } } } func TestCustomDialContextFunc(t testing.T) { dialFn := func(_ context.Context, _, _ string) (net.Conn, error) { return nil, errors.New(ExpectedError) } cfg := HTTPClientConfig{} client, err := NewClientFromConfig(cfg, "test", WithDialContextFunc(dialFn)) require.NoErrorf(t, err, "Can't create a client from this config: %+v", cfg) _, err = client.Get("http://localhost") if err == nil \|\| !strings.Contains(err.Error(), ExpectedError) { t.Errorf("Expected error %q but got %q", ExpectedError, err) } } func TestCustomIdleConnTimeout(t testing.T) { timeout := time.Second 5 cfg := HTTPClientConfig{} rt, err := NewRoundTripperFromConfig(cfg, "test", WithIdleConnTimeout(timeout)) require.NoErrorf(t, err, "Can't create a round-tripper from this config: %+v", cfg) transport, ok := rt.(http.Transport) require.Truef(t, ok, "Unexpected transport: %+v", transport) require.Equalf(t, transport.IdleConnTimeout, timeout, "Unexpected idle connection timeout: %+v", timeout) } func TestMissingBearerAuthFile(t testing.T) { cfg := HTTPClientConfig{ BearerTokenFile: MissingBearerTokenFile, TLSConfig: TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, } handler := func(w http.ResponseWriter, r http.Request) { bearer := r.Header.Get("Authorization") if bearer != ExpectedBearer { fmt.Fprintf(w, "The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", ExpectedBearer, bearer) } else { fmt.Fprint(w, ExpectedMessage) } } testServer, err := newTestServer(handler) require.NoError(t, err) defer testServer.Close() client, err := NewClientFromConfig(cfg, "test") require.NoError(t, err) _, err = client.Get(testServer.URL) require.Errorf(t, err, "No error is returned here") require.ErrorContainsf(t, err, "unable to read authorization credentials: unable to read file missing/bearer.token: open missing/bearer.token: no such file or directory", "wrong error message being returned") } func TestBearerAuthRoundTripper(t testing.T) { const ( newBearerToken = "goodbyeandthankyouforthefish" ) fakeRoundTripper := NewRoundTripCheckRequest(func(req http.Request) { bearer := req.Header.Get("Authorization") if bearer != ExpectedBearer { t.Errorf("The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", ExpectedBearer, bearer) } }, nil, nil) // Normal flow. bearerAuthRoundTripper := NewAuthorizationCredentialsRoundTripper("Bearer", NewInlineSecret(BearerToken), fakeRoundTripper) request, _ := http.NewRequest("GET", "/hitchhiker", nil) request.Header.Set("User-Agent", "Douglas Adams mind") _, err := bearerAuthRoundTripper.RoundTrip(request) if err != nil { t.Errorf("unexpected error while executing RoundTrip: %s", err.Error()) } // Should honor already Authorization header set. bearerAuthRoundTripperShouldNotModifyExistingAuthorization := NewAuthorizationCredentialsRoundTripper("Bearer", NewInlineSecret(newBearerToken), fakeRoundTripper) request, _ = http.NewRequest("GET", "/hitchhiker", nil) request.Header.Set("Authorization", ExpectedBearer) _, err = bearerAuthRoundTripperShouldNotModifyExistingAuthorization.RoundTrip(request) if err != nil { t.Errorf("unexpected error while executing RoundTrip: %s", err.Error()) } } func TestBearerAuthFileRoundTripper(t testing.T) { fakeRoundTripper := NewRoundTripCheckRequest(func(req http.Request) { bearer := req.Header.Get("Authorization") if bearer != ExpectedBearer { t.Errorf("The expected Bearer Authorization (%s) differs from the obtained Bearer Authorization (%s)", ExpectedBearer, bearer) } }, nil, nil) // Normal flow. bearerAuthRoundTripper := NewAuthorizationCredentialsRoundTripper("Bearer", &FileSecret{file: BearerTokenFile}, fakeRoundTripper) request, _ := http.NewRequest("GET", "/hitchhiker", nil) request.Header.Set("User-Agent", "Douglas Adams mind") _, err := bearerAuthRoundTripper.RoundTrip(request) if err != nil { t.Errorf("unexpected error while executing RoundTrip: %s", err.Error()) } // Should honor already Authorization header set. bearerAuthRoundTripperShouldNotModifyExistingAuthorization := NewAuthorizationCredentialsRoundTripper("Bearer", &FileSecret{file: MissingBearerTokenFile}, fakeRoundTripper) request, _ = http.NewRequest("GET", "/hitchhiker", nil) request.Header.Set("Authorization", ExpectedBearer) _, err = bearerAuthRoundTripperShouldNotModifyExistingAuthorization.RoundTrip(request) if err != nil { t.Errorf("unexpected error while executing RoundTrip: %s", err.Error()) } } func TestTLSConfig(t testing.T) { configTLSConfig := TLSConfig{ CAFile: TLSCAChainPath, CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "localhost", InsecureSkipVerify: false, } tlsCAChain, err := os.ReadFile(TLSCAChainPath) require.NoErrorf(t, err, "Can't read the CA certificate chain (%s)", TLSCAChainPath) rootCAs := x509.NewCertPool() rootCAs.AppendCertsFromPEM(tlsCAChain) expectedTLSConfig := &tls.Config{ RootCAs: rootCAs, ServerName: configTLSConfig.ServerName, InsecureSkipVerify: configTLSConfig.InsecureSkipVerify, } tlsConfig, err := NewTLSConfig(&configTLSConfig) require.NoErrorf(t, err, "Can't create a new TLS Config from a configuration (%s).", err) clientCertificate, err := tls.LoadX509KeyPair(ClientCertificatePath, ClientKeyNoPassPath) require.NoErrorf(t, err, "Can't load the client key pair ('%s' and '%s'). Reason: %s", ClientCertificatePath, ClientKeyNoPassPath, err) cert, err := tlsConfig.GetClientCertificate(nil) require.NoErrorf(t, err, "unexpected error returned by tlsConfig.GetClientCertificate(): %s", err) require.Truef(t, reflect.DeepEqual(cert, &clientCertificate), "Unexpected client certificate result: \n\n%+v\n expected\n\n%+v", cert, clientCertificate) // tlsConfig.rootCAs.LazyCerts contains functions getCert() in go 1.16, which are // never equal. Compare the Subjects instead. //nolint:staticcheck // Ignore SA1019. (CertPool).Subjects is deprecated because it may not include the system certs but it isn't the case here. require.Truef(t, reflect.DeepEqual(tlsConfig.RootCAs.Subjects(), expectedTLSConfig.RootCAs.Subjects()), "Unexpected RootCAs result: \n\n%+v\n expected\n\n%+v", tlsConfig.RootCAs.Subjects(), expectedTLSConfig.RootCAs.Subjects()) tlsConfig.RootCAs = nil expectedTLSConfig.RootCAs = nil // Non-nil functions are never equal. tlsConfig.GetClientCertificate = nil require.Truef(t, reflect.DeepEqual(tlsConfig, expectedTLSConfig), "Unexpected TLS Config result: \n\n%+v\n expected\n\n%+v", tlsConfig, expectedTLSConfig) } func TestTLSConfigEmpty(t testing.T) { configTLSConfig := TLSConfig{ InsecureSkipVerify: true, } expectedTLSConfig := &tls.Config{ InsecureSkipVerify: configTLSConfig.InsecureSkipVerify, } tlsConfig, err := NewTLSConfig(&configTLSConfig) require.NoErrorf(t, err, "Can't create a new TLS Config from a configuration (%s).", err) require.Truef(t, reflect.DeepEqual(tlsConfig, expectedTLSConfig), "Unexpected TLS Config result: \n\n%+v\n expected\n\n%+v", tlsConfig, expectedTLSConfig) } func TestTLSConfigInvalidCA(t testing.T) { invalidTLSConfig := []struct { configTLSConfig TLSConfig errorMessage string }{ { configTLSConfig: TLSConfig{ CAFile: MissingCA, CertFile: "", KeyFile: "", ServerName: "", InsecureSkipVerify: false, }, errorMessage: "unable to read CA cert: unable to read file " + MissingCA, }, { configTLSConfig: TLSConfig{ CAFile: "", CertFile: MissingCert, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, errorMessage: "unable to read specified client cert: unable to read file " + MissingCert, }, { configTLSConfig: TLSConfig{ CAFile: "", CertFile: ClientCertificatePath, KeyFile: MissingKey, ServerName: "", InsecureSkipVerify: false, }, errorMessage: "unable to read specified client key: unable to read file " + MissingKey, }, { configTLSConfig: TLSConfig{ CAFile: "", Cert: readFile(t, ClientCertificatePath), CertFile: ClientCertificatePath, KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, errorMessage: "at most one of cert, cert_file & cert_ref must be configured", }, { configTLSConfig: TLSConfig{ CAFile: "", CertFile: ClientCertificatePath, Key: Secret(readFile(t, ClientKeyNoPassPath)), KeyFile: ClientKeyNoPassPath, ServerName: "", InsecureSkipVerify: false, }, errorMessage: "at most one of key and key_file must be configured", }, } for _, anInvalididTLSConfig := range invalidTLSConfig { tlsConfig, err := NewTLSConfig(&anInvalididTLSConfig.configTLSConfig) if tlsConfig != nil && err == nil { t.Errorf("The TLS Config could be created even with this %+v", anInvalididTLSConfig.configTLSConfig) continue } if !strings.Contains(err.Error(), anInvalididTLSConfig.errorMessage) { t.Errorf("The expected error should contain %s, but got %s", anInvalididTLSConfig.errorMessage, err) } } } func TestBasicAuthNoPassword(t testing.T) { cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.basic-auth.no-password.yaml") require.NoErrorf(t, err, "Error loading HTTP client config: %v", err) client, err := NewClientFromConfig(cfg, "test") require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) rt, ok := client.Transport.(basicAuthRoundTripper) require.Truef(t, ok, "Error casting to basic auth transport, %v", client.Transport) username, _ := rt.username.Fetch(context.Background()) require.Equalf(t, "user", username, "Bad HTTP client username: %s", username) require.Nilf(t, rt.password, "Expected empty HTTP client password") } func TestBasicAuthNoUsername(t testing.T) { cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.basic-auth.no-username.yaml") require.NoErrorf(t, err, "Error loading HTTP client config: %v", err) client, err := NewClientFromConfig(cfg, "test") require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) rt, ok := client.Transport.(basicAuthRoundTripper) require.Truef(t, ok, "Error casting to basic auth transport, %v", client.Transport) if rt.username != nil { t.Errorf("Got unexpected username") } if password, _ := rt.password.Fetch(context.Background()); password != "secret" { t.Errorf("Unexpected HTTP client password: %s", password) } } func TestBasicAuthPasswordFile(t testing.T) { cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.basic-auth.good.yaml") require.NoErrorf(t, err, "Error loading HTTP client config: %v", err) client, err := NewClientFromConfig(cfg, "test") require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) rt, ok := client.Transport.(basicAuthRoundTripper) require.Truef(t, ok, "Error casting to basic auth transport, %v", client.Transport) if username, _ := rt.username.Fetch(context.Background()); username != "user" { t.Errorf("Bad HTTP client username: %s", username) } if password, _ := rt.password.Fetch(context.Background()); password != "foobar" { t.Errorf("Bad HTTP client password: %s", password) } } type secretManager struct { data map[string]string } func (m secretManager) Fetch(ctx context.Context, secretRef string) (string, error) { secretData, ok := m.data[secretRef] if !ok { return "", fmt.Errorf("unknown secret %s", secretRef) } return secretData, nil } func TestBasicAuthSecretManager(t testing.T) { cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.basic-auth.ref.yaml") require.NoErrorf(t, err, "Error loading HTTP client config: %v", err) manager := secretManager{ data: map[string]string{ "admin": "user", "pass": "foobar", }, } client, err := NewClientFromConfig(cfg, "test", WithSecretManager(&manager)) require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) rt, ok := client.Transport.(basicAuthRoundTripper) require.Truef(t, ok, "Error casting to basic auth transport, %v", client.Transport) if username, _ := rt.username.Fetch(context.Background()); username != "user" { t.Errorf("Bad HTTP client username: %s", username) } if password, _ := rt.password.Fetch(context.Background()); password != "foobar" { t.Errorf("Bad HTTP client password: %s", password) } } func TestBasicAuthSecretManagerNotFound(t testing.T) { cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.basic-auth.ref.yaml") require.NoErrorf(t, err, "Error loading HTTP client config: %v", err) manager := secretManager{ data: map[string]string{ "admin1": "user", "foobar": "pass", }, } client, err := NewClientFromConfig(cfg, "test", WithSecretManager(&manager)) require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) rt, ok := client.Transport.(basicAuthRoundTripper) require.Truef(t, ok, "Error casting to basic auth transport, %v", client.Transport) if _, err := rt.username.Fetch(context.Background()); !strings.Contains(err.Error(), "unknown secret admin") { t.Errorf("Unexpected error message: %s", err) } if _, err := rt.password.Fetch(context.Background()); !strings.Contains(err.Error(), "unknown secret pass") { t.Errorf("Unexpected error message: %s", err) } } func TestBasicUsernameFile(t testing.T) { cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.basic-auth.username-file.good.yaml") require.NoErrorf(t, err, "Error loading HTTP client config: %v", err) client, err := NewClientFromConfig(cfg, "test") require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) rt, ok := client.Transport.(basicAuthRoundTripper) require.Truef(t, ok, "Error casting to basic auth transport, %v", client.Transport) if username, _ := rt.username.Fetch(context.Background()); username != "testuser" { t.Errorf("Bad HTTP client username: %s", username) } if password, _ := rt.password.Fetch(context.Background()); password != "foobar" { t.Errorf("Bad HTTP client passwordFile: %s", password) } } func getCertificateBlobs(t testing.T) map[string][]byte { files := []string{ TLSCAChainPath, ClientCertificatePath, ClientKeyNoPassPath, ServerCertificatePath, ServerKeyPath, WrongClientCertPath, WrongClientKeyPath, EmptyFile, } bs := make(map[string][]byte, len(files)+1) for _, f := range files { b, err := os.ReadFile(f) require.NoError(t, err) bs[f] = b } return bs } func writeCertificate(bs map[string][]byte, src, dst string) { b, ok := bs[src] if !ok { panic(fmt.Sprintf("Couldn't find %q in bs", src)) } if err := os.WriteFile(dst, b, 0o664); err != nil { panic(err) } } func TestTLSRoundTripper(t testing.T) { bs := getCertificateBlobs(t) tmpDir, err := os.MkdirTemp("", "tlsroundtripper") require.NoErrorf(t, err, "Failed to create tmp dir") defer os.RemoveAll(tmpDir) ca, cert, key := filepath.Join(tmpDir, "ca"), filepath.Join(tmpDir, "cert"), filepath.Join(tmpDir, "key") handler := func(w http.ResponseWriter, r http.Request) { fmt.Fprint(w, ExpectedMessage) } testServer, err := newTestServer(handler) require.NoError(t, err) defer testServer.Close() testCases := []struct { ca string cert string key string errMsg string }{ { // Valid certs. ca: TLSCAChainPath, cert: ClientCertificatePath, key: ClientKeyNoPassPath, }, { // CA not matching. ca: ClientCertificatePath, cert: ClientCertificatePath, key: ClientKeyNoPassPath, errMsg: "certificate signed by unknown authority", }, { // Invalid client cert+key. ca: TLSCAChainPath, cert: WrongClientCertPath, key: WrongClientKeyPath, errMsg: "remote error: tls", }, { // CA file empty ca: EmptyFile, cert: ClientCertificatePath, key: ClientKeyNoPassPath, errMsg: "unable to use specified CA cert", }, { // cert file empty ca: TLSCAChainPath, cert: EmptyFile, key: ClientKeyNoPassPath, errMsg: "failed to find any PEM data in certificate input", }, { // key file empty ca: TLSCAChainPath, cert: ClientCertificatePath, key: EmptyFile, errMsg: "failed to find any PEM data in key input", }, { // Valid certs again. ca: TLSCAChainPath, cert: ClientCertificatePath, key: ClientKeyNoPassPath, }, } cfg := HTTPClientConfig{ TLSConfig: TLSConfig{ CAFile: ca, CertFile: cert, KeyFile: key, InsecureSkipVerify: false, }, } var c http.Client for i, tc := range testCases { tc := tc t.Run(strconv.Itoa(i), func(t testing.T) { writeCertificate(bs, tc.ca, ca) writeCertificate(bs, tc.cert, cert) writeCertificate(bs, tc.key, key) if c == nil { c, err = NewClientFromConfig(cfg, "test") require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) } req, err := http.NewRequest(http.MethodGet, testServer.URL, nil) require.NoErrorf(t, err, "Error creating HTTP request: %v", err) r, err := c.Do(req) if len(tc.errMsg) > 0 { if err == nil { r.Body.Close() t.Fatalf("Could connect to the test server.") } require.ErrorContainsf(t, err, tc.errMsg, "Expected error message to contain %q, got %q", tc.errMsg, err) return } require.NoErrorf(t, err, "Can't connect to the test server") b, err := io.ReadAll(r.Body) r.Body.Close() if err != nil { t.Errorf("Can't read the server response body") } got := strings.TrimSpace(string(b)) if ExpectedMessage != got { t.Errorf("The expected message %q differs from the obtained message %q", ExpectedMessage, got) } }) } } func TestTLSRoundTripper_Inline(t testing.T) { handler := func(w http.ResponseWriter, r http.Request) { fmt.Fprint(w, ExpectedMessage) } testServer, err := newTestServer(handler) require.NoError(t, err) defer testServer.Close() testCases := []struct { caText, caFile string certText, certFile string keyText, keyFile string errMsg string }{ { // File-based everything. caFile: TLSCAChainPath, certFile: ClientCertificatePath, keyFile: ClientKeyNoPassPath, }, { // Inline CA. caText: readFile(t, TLSCAChainPath), certFile: ClientCertificatePath, keyFile: ClientKeyNoPassPath, }, { // Inline cert. caFile: TLSCAChainPath, certText: readFile(t, ClientCertificatePath), keyFile: ClientKeyNoPassPath, }, { // Inline key. caFile: TLSCAChainPath, certFile: ClientCertificatePath, keyText: readFile(t, ClientKeyNoPassPath), }, { // Inline everything. caText: readFile(t, TLSCAChainPath), certText: readFile(t, ClientCertificatePath), keyText: readFile(t, ClientKeyNoPassPath), }, { // Invalid inline CA. caText: "badca", certText: readFile(t, ClientCertificatePath), keyText: readFile(t, ClientKeyNoPassPath), errMsg: "unable to use specified CA cert inline", }, { // Invalid cert. caText: readFile(t, TLSCAChainPath), certText: "badcert", keyText: readFile(t, ClientKeyNoPassPath), errMsg: "failed to find any PEM data in certificate input", }, { // Invalid key. caText: readFile(t, TLSCAChainPath), certText: readFile(t, ClientCertificatePath), keyText: "badkey", errMsg: "failed to find any PEM data in key input", }, } for i, tc := range testCases { tc := tc t.Run(strconv.Itoa(i), func(t testing.T) { cfg := HTTPClientConfig{ TLSConfig: TLSConfig{ CA: tc.caText, CAFile: tc.caFile, Cert: tc.certText, CertFile: tc.certFile, Key: Secret(tc.keyText), KeyFile: tc.keyFile, InsecureSkipVerify: false, }, } c, err := NewClientFromConfig(cfg, "test") if tc.errMsg != "" { require.ErrorContainsf(t, err, tc.errMsg, "Expected error message to contain %q, got %q", tc.errMsg, err) return } else if err != nil { t.Fatalf("Error creating HTTP Client: %v", err) } req, err := http.NewRequest(http.MethodGet, testServer.URL, nil) require.NoErrorf(t, err, "Error creating HTTP request: %v", err) r, err := c.Do(req) require.NoErrorf(t, err, "Can't connect to the test server") b, err := io.ReadAll(r.Body) r.Body.Close() if err != nil { t.Errorf("Can't read the server response body") } got := strings.TrimSpace(string(b)) if ExpectedMessage != got { t.Errorf("The expected message %q differs from the obtained message %q", ExpectedMessage, got) } }) } } func TestTLSRoundTripperRaces(t testing.T) { bs := getCertificateBlobs(t) tmpDir, err := os.MkdirTemp("", "tlsroundtripper") require.NoErrorf(t, err, "Failed to create tmp dir") defer os.RemoveAll(tmpDir) ca, cert, key := filepath.Join(tmpDir, "ca"), filepath.Join(tmpDir, "cert"), filepath.Join(tmpDir, "key") handler := func(w http.ResponseWriter, r http.Request) { fmt.Fprint(w, ExpectedMessage) } testServer, err := newTestServer(handler) require.NoError(t, err) defer testServer.Close() cfg := HTTPClientConfig{ TLSConfig: TLSConfig{ CAFile: ca, CertFile: cert, KeyFile: key, InsecureSkipVerify: false, }, } var c http.Client writeCertificate(bs, TLSCAChainPath, ca) writeCertificate(bs, ClientCertificatePath, cert) writeCertificate(bs, ClientKeyNoPassPath, key) c, err = NewClientFromConfig(cfg, "test") require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) var wg sync.WaitGroup ch := make(chan struct{}) var total, ok int64 // Spawn 10 Go routines polling the server concurrently. for i := 0; i < 10; i++ { wg.Add(1) go func() { defer wg.Done() for { select { case <-ch: return default: atomic.AddInt64(&total, 1) r, err := c.Get(testServer.URL) if err == nil { r.Body.Close() atomic.AddInt64(&ok, 1) } } } }() } // Change the CA file every 10ms for 1 second. wg.Add(1) go func() { defer wg.Done() i := 0 for { tick := time.NewTicker(10 time.Millisecond) <-tick.C if i%2 == 0 { writeCertificate(bs, ClientCertificatePath, ca) } else { writeCertificate(bs, TLSCAChainPath, ca) } i++ if i > 100 { close(ch) return } } }() wg.Wait() require.NotEqualf(t, ok, total, "Expecting some requests to fail but got %d/%d successful requests", ok, total) } func TestHideHTTPClientConfigSecrets(t testing.T) { c, _, err := LoadHTTPConfigFile("testdata/http.conf.good.yml") require.NoErrorf(t, err, "Error parsing %s: %s", "testdata/http.conf.good.yml", err) // String method must not reveal authentication credentials. s := c.String() require.NotContainsf(t, s, "mysecret", "http client config's String method reveals authentication credentials.") } func TestDefaultFollowRedirect(t testing.T) { cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.good.yml") if err != nil { t.Errorf("Error loading HTTP client config: %v", err) } if !cfg.FollowRedirects { t.Errorf("follow_redirects should be true") } } func TestValidateHTTPConfig(t testing.T) { cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.good.yml") if err != nil { t.Errorf("Error loading HTTP client config: %v", err) } err = cfg.Validate() require.NoErrorf(t, err, "Error validating %s: %s", "testdata/http.conf.good.yml", err) } func TestInvalidHTTPConfigs(t testing.T) { for _, ee := range invalidHTTPClientConfigs { _, _, err := LoadHTTPConfigFile(ee.httpClientConfigFile) if err == nil { t.Errorf("Expected error with config %q but got none", ee.httpClientConfigFile) continue } if !strings.Contains(err.Error(), ee.errMsg) { t.Errorf("Expected error for invalid HTTP client configuration to contain %q but got: %s", ee.errMsg, err) } } } type roundTrip struct { theResponse http.Response theError error } func (rt roundTrip) RoundTrip(r http.Request) (http.Response, error) { return rt.theResponse, rt.theError } type roundTripCheckRequest struct { checkRequest func(http.Request) roundTrip } func (rt roundTripCheckRequest) RoundTrip(r http.Request) (http.Response, error) { rt.checkRequest(r) return rt.theResponse, rt.theError } // NewRoundTripCheckRequest creates a new instance of a type that implements http.RoundTripper, // which before returning theResponse and theError, executes checkRequest against a http.Request. func NewRoundTripCheckRequest(checkRequest func(http.Request), theResponse http.Response, theError error) http.RoundTripper { return &roundTripCheckRequest{ checkRequest: checkRequest, roundTrip: roundTrip{ theResponse: theResponse, theError: theError, }, } } type oauth2TestServerResponse struct { AccessToken string `json:"access_token"` TokenType string `json:"token_type"` } type testOAuthServer struct { tokenTS httptest.Server ts httptest.Server } // newTestOAuthServer returns a new test server with the expected base64 encoded client ID and secret. func newTestOAuthServer(t testing.TB, expectedAuth string) testOAuthServer { var previousAuth string tokenTS := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { auth := r.Header.Get("Authorization") require.Equalf(t, expectedAuth, auth, "bad auth, expected %s, got %s", expectedAuth, auth) require.NotEqualf(t, auth, previousAuth, "token endpoint called twice") previousAuth = auth res, _ := json.Marshal(oauth2TestServerResponse{ AccessToken: "12345", TokenType: "Bearer", }) w.Header().Add("Content-Type", "application/json") _, _ = w.Write(res) })) ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { auth := r.Header.Get("Authorization") require.Equalf(t, "Bearer 12345", auth, "bad auth, expected %s, got %s", "Bearer 12345", auth) fmt.Fprintln(w, "Hello, client") })) return testOAuthServer{ tokenTS: tokenTS, ts: ts, } } func (s testOAuthServer) url() string { return s.ts.URL } func (s testOAuthServer) tokenURL() string { return s.tokenTS.URL } func (s testOAuthServer) close() { s.tokenTS.Close() s.ts.Close() } func TestOAuth2(t testing.T) { var expectedAuth string ts := newTestOAuthServer(t, &expectedAuth) defer ts.close() yamlConfig := fmt.Sprintf(` client_id: 1 client_secret: 2 scopes: - A - B token_url: %s endpoint_params: hi: hello `, ts.tokenURL()) expectedConfig := OAuth2{ ClientID: "1", ClientSecret: "2", Scopes: []string{"A", "B"}, EndpointParams: map[string]string{"hi": "hello"}, TokenURL: ts.tokenURL(), } var unmarshalledConfig OAuth2 err := yaml.Unmarshal([]byte(yamlConfig), &unmarshalledConfig) require.NoErrorf(t, err, "Expected no error unmarshalling yaml, got %v", err) require.Truef(t, reflect.DeepEqual(unmarshalledConfig, expectedConfig), "Got unmarshalled config %v, expected %v", unmarshalledConfig, expectedConfig) secret := NewInlineSecret(string(expectedConfig.ClientSecret)) rt := NewOAuth2RoundTripper(secret, &expectedConfig, http.DefaultTransport, &defaultHTTPClientOptions) client := http.Client{ Transport: rt, } // Default secret. expectedAuth = "Basic MToy" resp, err := client.Get(ts.url()) require.NoError(t, err) authorization := resp.Request.Header.Get("Authorization") require.Equalf(t, "Bearer 12345", authorization, "Expected authorization header to be 'Bearer', got '%s'", authorization) // Making a second request with the same secret should not re-call the token API. _, err = client.Get(ts.url()) require.NoError(t, err) // Empty secret. expectedAuth = "Basic MTo=" expectedConfig.ClientSecret = "" resp, err = client.Get(ts.url()) require.NoError(t, err) authorization = resp.Request.Header.Get("Authorization") require.Equalf(t, "Bearer 12345", authorization, "Expected authorization header to be 'Bearer 12345', got '%s'", authorization) // Making a second request with the same secret should not re-call the token API. resp, err = client.Get(ts.url()) require.NoError(t, err) // Update secret. expectedAuth = "Basic MToxMjM0NTY3" expectedConfig.ClientSecret = "1234567" _, err = client.Get(ts.url()) require.NoError(t, err) // Making a second request with the same secret should not re-call the token API. _, err = client.Get(ts.url()) require.NoError(t, err) authorization = resp.Request.Header.Get("Authorization") require.Equalf(t, "Bearer 12345", authorization, "Expected authorization header to be 'Bearer 12345', got '%s'", authorization) } func TestOAuth2UserAgent(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { require.Equalf(t, "myuseragent", r.Header.Get("User-Agent"), "Expected User-Agent header in oauth request to be 'myuseragent', got '%s'", r.Header.Get("User-Agent")) res, _ := json.Marshal(oauth2TestServerResponse{ AccessToken: "12345", TokenType: "Bearer", }) w.Header().Add("Content-Type", "application/json") _, _ = w.Write(res) })) defer ts.Close() config := DefaultHTTPClientConfig config.OAuth2 = &OAuth2{ ClientID: "1", ClientSecret: "2", Scopes: []string{"A", "B"}, EndpointParams: map[string]string{"hi": "hello"}, TokenURL: ts.URL + "/token", } rt, err := NewRoundTripperFromConfig(config, "test_oauth2", WithUserAgent("myuseragent")) require.NoError(t, err) client := http.Client{ Transport: rt, } resp, err := client.Get(ts.URL) require.NoError(t, err) authorization := resp.Request.Header.Get("Authorization") require.Equalf(t, "Bearer 12345", authorization, "Expected authorization header to be 'Bearer 12345', got '%s'", authorization) } func TestHost(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { require.Equalf(t, "localhost.localdomain", r.Host, "Expected Host header in request to be 'localhost.localdomain', got '%s'", r.Host) w.Header().Add("Content-Type", "application/json") })) defer ts.Close() config := DefaultHTTPClientConfig rt, err := NewRoundTripperFromConfig(config, "test_host", WithHost("localhost.localdomain")) require.NoError(t, err) client := http.Client{ Transport: rt, } _, err = client.Get(ts.URL) require.NoError(t, err) } func TestOAuth2WithFile(t testing.T) { var expectedAuth string ts := newTestOAuthServer(t, &expectedAuth) defer ts.close() secretFile, err := os.CreateTemp("", "oauth2_secret") require.NoError(t, err) defer os.Remove(secretFile.Name()) yamlConfig := fmt.Sprintf(` client_id: 1 client_secret_file: %s scopes: - A - B token_url: %s endpoint_params: hi: hello `, secretFile.Name(), ts.tokenURL()) expectedConfig := OAuth2{ ClientID: "1", ClientSecretFile: secretFile.Name(), Scopes: []string{"A", "B"}, EndpointParams: map[string]string{"hi": "hello"}, TokenURL: ts.tokenURL(), } var unmarshalledConfig OAuth2 err = yaml.Unmarshal([]byte(yamlConfig), &unmarshalledConfig) require.NoErrorf(t, err, "Expected no error unmarshalling yaml, got %v", err) require.Truef(t, reflect.DeepEqual(unmarshalledConfig, expectedConfig), "Got unmarshalled config %v, expected %v", unmarshalledConfig, expectedConfig) secret := NewFileSecret(expectedConfig.ClientSecretFile) rt := NewOAuth2RoundTripper(secret, &expectedConfig, http.DefaultTransport, &defaultHTTPClientOptions) client := http.Client{ Transport: rt, } // Empty secret file. expectedAuth = "Basic MTo=" resp, err := client.Get(ts.url()) require.NoError(t, err) authorization := resp.Request.Header.Get("Authorization") require.Equalf(t, "Bearer 12345", authorization, "Expected authorization header to be 'Bearer', got '%s'", authorization) // Making a second request with the same file content should not re-call the token API. _, err = client.Get(ts.url()) require.NoError(t, err) // File populated. expectedAuth = "Basic MToxMjM0NTY=" _, err = secretFile.Write([]byte("123456")) require.NoError(t, err) resp, err = client.Get(ts.url()) require.NoError(t, err) authorization = resp.Request.Header.Get("Authorization") require.Equalf(t, "Bearer 12345", authorization, "Expected authorization header to be 'Bearer 12345', got '%s'", authorization) // Making a second request with the same file content should not re-call the token API. resp, err = client.Get(ts.url()) require.NoError(t, err) // Update file. expectedAuth = "Basic MToxMjM0NTY3" _, err = secretFile.Write([]byte("7")) require.NoError(t, err) _, err = client.Get(ts.url()) require.NoError(t, err) // Making a second request with the same file content should not re-call the token API. _, err = client.Get(ts.url()) require.NoError(t, err) authorization = resp.Request.Header.Get("Authorization") require.Equalf(t, "Bearer 12345", authorization, "Expected authorization header to be 'Bearer 12345', got '%s'", authorization) } func TestMarshalURL(t testing.T) { urlp, err := url.Parse("http://example.com/") require.NoError(t, err) u := &URL{urlp} c, err := json.Marshal(u) require.NoError(t, err) require.Equalf(t, "\"http://example.com/\"", string(c), "URL not properly marshaled in JSON got '%s'", string(c)) c, err = yaml.Marshal(u) require.NoError(t, err) require.Equalf(t, "http://example.com/\n", string(c), "URL not properly marshaled in YAML got '%s'", string(c)) } func TestMarshalURLWrapperWithNilValue(t testing.T) { u := &URL{} c, err := json.Marshal(u) require.NoError(t, err) require.Equalf(t, "null", string(c), "URL with nil value not properly marshaled into JSON, got %q", c) c, err = yaml.Marshal(u) require.NoError(t, err) require.Equalf(t, "null\n", string(c), "URL with nil value not properly marshaled into JSON, got %q", c) } func TestUnmarshalNullURL(t testing.T) { b := []byte(`null`) { var u URL err := json.Unmarshal(b, &u) require.NoError(t, err) require.Truef(t, isEmptyNonNilURL(u.URL), "`null` literal not properly unmarshaled from JSON as URL, got %#v", u.URL) } { var u URL err := yaml.Unmarshal(b, &u) require.NoError(t, err) // UnmarshalYAML is not called when parsing null literal. require.Nilf(t, u.URL, "`null` literal not properly unmarshaled from YAML as URL, got %#v", u.URL) } } func TestUnmarshalEmptyURL(t testing.T) { b := []byte(`""`) { var u URL err := json.Unmarshal(b, &u) require.NoError(t, err) require.Truef(t, isEmptyNonNilURL(u.URL), "empty string not properly unmarshaled from JSON as URL, got %#v", u.URL) } { var u URL err := yaml.Unmarshal(b, &u) require.NoError(t, err) require.Truef(t, isEmptyNonNilURL(u.URL), "empty string not properly unmarshaled from YAML as URL, got %#v", u.URL) } } // checks if u equals to &url.URL{} func isEmptyNonNilURL(u url.URL) bool { return u != nil && u == url.URL{} } func TestUnmarshalURL(t testing.T) { b := []byte(`"http://example.com/a b"`) var u URL err := json.Unmarshal(b, &u) require.NoError(t, err) require.Equalf(t, "http://example.com/a%20b", u.String(), "URL not properly unmarshaled in JSON, got '%s'", u.String()) err = yaml.Unmarshal(b, &u) require.NoError(t, err) require.Equalf(t, "http://example.com/a%20b", u.String(), "URL not properly unmarshaled in YAML, got '%s'", u.String()) } func TestMarshalURLWithSecret(t testing.T) { var u URL err := yaml.Unmarshal([]byte("http://foo:bar@example.com"), &u) require.NoError(t, err) b, err := yaml.Marshal(u) require.NoError(t, err) require.Equalf(t, "http://foo:xxxxx@example.com", strings.TrimSpace(string(b)), "URL not properly marshaled in YAML, got '%s'", string(b)) } func TestHTTPClientConfig_Marshal(t testing.T) { proxyURL, err := url.Parse("http://localhost:8080") require.NoError(t, err) t.Run("without HTTP headers", func(t testing.T) { config := &HTTPClientConfig{ ProxyConfig: ProxyConfig{ ProxyURL: URL{proxyURL}, }, } t.Run("YAML", func(t testing.T) { actualYAML, err := yaml.Marshal(config) require.NoError(t, err) require.YAMLEq(t, ` proxy_url: "http://localhost:8080" follow_redirects: false enable_http2: false `, string(actualYAML)) // Unmarshalling the YAML should get the same struct in input. actual := &HTTPClientConfig{} require.NoError(t, yaml.Unmarshal(actualYAML, actual)) require.Equal(t, config, actual) }) t.Run("JSON", func(t testing.T) { actualJSON, err := json.Marshal(config) require.NoError(t, err) require.JSONEq(t, `{ "proxy_url":"http://localhost:8080", "tls_config":{"insecure_skip_verify":false}, "follow_redirects":false, "enable_http2":false }`, string(actualJSON)) // Unmarshalling the JSON should get the same struct in input. actual := &HTTPClientConfig{} require.NoError(t, json.Unmarshal(actualJSON, actual)) require.Equal(t, config, actual) }) }) t.Run("with HTTP headers", func(t testing.T) { config := &HTTPClientConfig{ ProxyConfig: ProxyConfig{ ProxyURL: URL{proxyURL}, }, HTTPHeaders: &Headers{ Headers: map[string]Header{ "X-Test": { Values: []string{"Value-1", "Value-2"}, }, }, }, } actualYAML, err := yaml.Marshal(config) require.NoError(t, err) require.YAMLEq(t, ` proxy_url: "http://localhost:8080" follow_redirects: false enable_http2: false http_headers: X-Test: values: - Value-1 - Value-2 `, string(actualYAML)) actualJSON, err := json.Marshal(config) require.NoError(t, err) require.JSONEq(t, `{ "proxy_url":"http://localhost:8080", "tls_config":{"insecure_skip_verify":false}, "follow_redirects":false, "enable_http2":false, "http_headers":{"X-Test":{"values":["Value-1","Value-2"]}} }`, string(actualJSON)) }) } func TestOAuth2Proxy(t testing.T) { _, _, err := LoadHTTPConfigFile("testdata/http.conf.oauth2-proxy.good.yml") if err != nil { t.Errorf("Error loading OAuth2 client config: %v", err) } } func TestModifyTLSCertificates(t testing.T) { bs := getCertificateBlobs(t) tmpDir, err := os.MkdirTemp("", "modifytlscertificates") require.NoErrorf(t, err, "Failed to create tmp dir") defer os.RemoveAll(tmpDir) ca, cert, key := filepath.Join(tmpDir, "ca"), filepath.Join(tmpDir, "cert"), filepath.Join(tmpDir, "key") handler := func(w http.ResponseWriter, r http.Request) { fmt.Fprint(w, ExpectedMessage) } testServer, err := newTestServer(handler) require.NoError(t, err) defer testServer.Close() tests := []struct { ca string cert string key string errMsg string modification func() }{ { ca: ClientCertificatePath, cert: ClientCertificatePath, key: ClientKeyNoPassPath, errMsg: "certificate signed by unknown authority", modification: func() { writeCertificate(bs, TLSCAChainPath, ca) }, }, { ca: TLSCAChainPath, cert: WrongClientCertPath, key: ClientKeyNoPassPath, errMsg: "private key does not match public key", modification: func() { writeCertificate(bs, ClientCertificatePath, cert) }, }, { ca: TLSCAChainPath, cert: ClientCertificatePath, key: WrongClientCertPath, errMsg: "found a certificate rather than a key in the PEM for the private key", modification: func() { writeCertificate(bs, ClientKeyNoPassPath, key) }, }, } cfg := HTTPClientConfig{ TLSConfig: TLSConfig{ CAFile: ca, CertFile: cert, KeyFile: key, InsecureSkipVerify: false, }, } var c http.Client for i, tc := range tests { t.Run(strconv.Itoa(i), func(t testing.T) { writeCertificate(bs, tc.ca, ca) writeCertificate(bs, tc.cert, cert) writeCertificate(bs, tc.key, key) if c == nil { c, err = NewClientFromConfig(cfg, "test") require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) } req, err := http.NewRequest(http.MethodGet, testServer.URL, nil) require.NoErrorf(t, err, "Error creating HTTP request: %v", err) r, err := c.Do(req) if err == nil { r.Body.Close() t.Fatalf("Could connect to the test server.") } require.ErrorContainsf(t, err, tc.errMsg, "Expected error message to contain %q, got %q", tc.errMsg, err) tc.modification() r, err = c.Do(req) require.NoErrorf(t, err, "Expected no error, got %q", err) b, err := io.ReadAll(r.Body) r.Body.Close() if err != nil { t.Errorf("Can't read the server response body") } got := strings.TrimSpace(string(b)) if ExpectedMessage != got { t.Errorf("The expected message %q differs from the obtained message %q", ExpectedMessage, got) } }) } } // loadHTTPConfigJSON parses the JSON input s into a HTTPClientConfig. func loadHTTPConfigJSON(buf []byte) (HTTPClientConfig, error) { cfg := &HTTPClientConfig{} err := json.Unmarshal(buf, cfg) if err != nil { return nil, err } return cfg, nil } // loadHTTPConfigJSONFile parses the given JSON file into a HTTPClientConfig. func loadHTTPConfigJSONFile(filename string) (HTTPClientConfig, []byte, error) { content, err := os.ReadFile(filename) if err != nil { return nil, nil, err } cfg, err := loadHTTPConfigJSON(content) if err != nil { return nil, nil, err } return cfg, content, nil } func TestProxyConfig_Proxy(t testing.T) { var proxyServer httptest.Server defer func() { if proxyServer != nil { proxyServer.Close() } }() proxyServerHandler := http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { fmt.Fprintf(w, "Hello, %s", r.URL.Path) }) proxyServer = httptest.NewServer(proxyServerHandler) testCases := []struct { name string proxyConfig string expectedProxyURL string targetURL string proxyEnv string noProxyEnv string }{ { name: "proxy from environment", proxyConfig: `proxy_from_environment: true`, expectedProxyURL: proxyServer.URL, proxyEnv: proxyServer.URL, targetURL: "http://prometheus.io/", }, { name: "proxy_from_environment with no_proxy", proxyConfig: `proxy_from_environment: true`, expectedProxyURL: "", proxyEnv: proxyServer.URL, noProxyEnv: "prometheus.io", targetURL: "http://prometheus.io/", }, { name: "proxy_from_environment and localhost", proxyConfig: `proxy_from_environment: true`, expectedProxyURL: "", proxyEnv: proxyServer.URL, targetURL: "http://localhost/", }, { name: "valid proxy_url and localhost", proxyConfig: "proxy_url: " + proxyServer.URL, expectedProxyURL: proxyServer.URL, targetURL: "http://localhost/", }, { name: "valid proxy_url and no_proxy and localhost", proxyConfig: fmt.Sprintf(`proxy_url: %s no_proxy: prometheus.io`, proxyServer.URL), expectedProxyURL: "", targetURL: "http://localhost/", }, { name: "valid proxy_url", proxyConfig: "proxy_url: " + proxyServer.URL, expectedProxyURL: proxyServer.URL, targetURL: "http://prometheus.io/", }, { name: "valid proxy url and no_proxy", proxyConfig: fmt.Sprintf(`proxy_url: %s no_proxy: prometheus.io`, proxyServer.URL), expectedProxyURL: "", targetURL: "http://prometheus.io/", }, { name: "valid proxy url and no_proxies", proxyConfig: fmt.Sprintf(`proxy_url: %s no_proxy: promcon.io,prometheus.io,cncf.io`, proxyServer.URL), expectedProxyURL: "", targetURL: "http://prometheus.io/", }, { name: "valid proxy url and no_proxies that do not include target", proxyConfig: fmt.Sprintf(`proxy_url: %s no_proxy: promcon.io,cncf.io`, proxyServer.URL), expectedProxyURL: proxyServer.URL, targetURL: "http://prometheus.io/", }, } for _, tc := range testCases { t.Run(tc.name, func(t testing.T) { if proxyServer != nil { defer proxyServer.Close() } var proxyConfig ProxyConfig err := yaml.Unmarshal([]byte(tc.proxyConfig), &proxyConfig) if err != nil { t.Errorf("failed to unmarshal proxy config: %v", err) return } if tc.proxyEnv != "" { currentProxy := os.Getenv("HTTP_PROXY") t.Cleanup(func() { os.Setenv("HTTP_PROXY", currentProxy) }) os.Setenv("HTTP_PROXY", tc.proxyEnv) } if tc.noProxyEnv != "" { currentProxy := os.Getenv("NO_PROXY") t.Cleanup(func() { os.Setenv("NO_PROXY", currentProxy) }) os.Setenv("NO_PROXY", tc.noProxyEnv) } req := httptest.NewRequest("GET", tc.targetURL, nil) proxyFunc := proxyConfig.Proxy() resultURL, err := proxyFunc(req) if err != nil { t.Fatalf("expected no error, but got: %v", err) return } if tc.expectedProxyURL == "" && resultURL != nil { t.Fatalf("expected no result URL, but got: %s", resultURL.String()) return } if tc.expectedProxyURL != "" && resultURL == nil { t.Fatalf("expected result URL, but got nil") return } if tc.expectedProxyURL != "" && resultURL.String() != tc.expectedProxyURL { t.Fatalf("expected result URL: %s, but got: %s", tc.expectedProxyURL, resultURL.String()) } }) } } func readFile(t testing.T, filename string) string { t.Helper() content, err := os.ReadFile(filename) require.NoErrorf(t, err, "Failed to read file %q: %s", filename, err) return string(content) } func TestHeaders(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { for k, v := range map[string]string{ "One": "value1", "Two": "value2", "Three": "value3", } { if r.Header.Get(k) != v { t.Errorf("expected %q, got %q", v, r.Header.Get(k)) } } w.WriteHeader(http.StatusNoContent) })) t.Cleanup(ts.Close) cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.headers.good.yaml") require.NoErrorf(t, err, "Error loading HTTP client config: %v", err) client, err := NewClientFromConfig(cfg, "test") require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) _, err = client.Get(ts.URL) require.NoErrorf(t, err, "can't fetch URL: %v", err) } func TestMultipleHeaders(t testing.T) { ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r http.Request) { for k, v := range map[string][]string{ "One": {"value1a", "value1b", "value1c"}, "Two": {"value2a", "value2b", "value2c"}, "Three": {"value3a", "value3b", "value3c"}, } { if !reflect.DeepEqual(r.Header.Values(k), v) { t.Errorf("expected %v, got %v", v, r.Header.Values(k)) } } w.WriteHeader(http.StatusNoContent) })) t.Cleanup(ts.Close) cfg, _, err := LoadHTTPConfigFile("testdata/http.conf.headers-multiple.good.yaml") require.NoErrorf(t, err, "Error loading HTTP client config: %v", err) client, err := NewClientFromConfig(*cfg, "test") require.NoErrorf(t, err, "Error creating HTTP Client: %v", err) _, err = client.Get(ts.URL) require.NoErrorf(t, err, "can't fetch URL: %v", err) }	65.92 KB	2025-05-25 12:27
📁 testdata	-	2025-05-25 12:27
📄 tls_config_test.go // Copyright 2016 The Prometheus Authors // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. package config import ( "bytes" "crypto/tls" "encoding/json" "errors" "fmt" "os" "path/filepath" "reflect" "strings" "testing" "github.com/stretchr/testify/require" "gopkg.in/yaml.v2" ) // LoadTLSConfig parses the given file into a tls.Config. func LoadTLSConfig(filename string) (tls.Config, error) { content, err := os.ReadFile(filename) if err != nil { return nil, err } cfg := TLSConfig{} switch filepath.Ext(filename) { case ".yml": if err = yaml.UnmarshalStrict(content, &cfg); err != nil { return nil, err } case ".json": decoder := json.NewDecoder(bytes.NewReader(content)) decoder.DisallowUnknownFields() if err = decoder.Decode(&cfg); err != nil { return nil, err } default: return nil, fmt.Errorf("Unknown extension: %s", filepath.Ext(filename)) } return NewTLSConfig(&cfg) } var expectedTLSConfigs = []struct { filename string config tls.Config }{ { filename: "tls_config.empty.good.json", config: &tls.Config{}, }, { filename: "tls_config.insecure.good.json", config: &tls.Config{InsecureSkipVerify: true}, }, { filename: "tls_config.tlsversion.good.json", config: &tls.Config{MinVersion: tls.VersionTLS11}, }, { filename: "tls_config.max_version.good.json", config: &tls.Config{MaxVersion: tls.VersionTLS12}, }, { filename: "tls_config.empty.good.yml", config: &tls.Config{}, }, { filename: "tls_config.insecure.good.yml", config: &tls.Config{InsecureSkipVerify: true}, }, { filename: "tls_config.tlsversion.good.yml", config: &tls.Config{MinVersion: tls.VersionTLS11}, }, { filename: "tls_config.max_version.good.yml", config: &tls.Config{MaxVersion: tls.VersionTLS12}, }, { filename: "tls_config.max_and_min_version.good.yml", config: &tls.Config{MaxVersion: tls.VersionTLS12, MinVersion: tls.VersionTLS11}, }, { filename: "tls_config.max_and_min_version_same.good.yml", config: &tls.Config{MaxVersion: tls.VersionTLS12, MinVersion: tls.VersionTLS12}, }, } func TestValidTLSConfig(t testing.T) { for _, cfg := range expectedTLSConfigs { got, err := LoadTLSConfig("testdata/" + cfg.filename) require.NoErrorf(t, err, "Error parsing %s: %s", cfg.filename, err) // non-nil functions are never equal. got.GetClientCertificate = nil require.Truef(t, reflect.DeepEqual(got, cfg.config), "%v: unexpected config result: \n\n%v\n expected\n\n%v", cfg.filename, got, cfg.config) } } var invalidTLSConfigs = []struct { filename string errMsg string }{ { filename: "tls_config.max_and_min_version.bad.yml", errMsg: "tls_config.max_version must be greater than or equal to tls_config.min_version if both are specified", }, } func TestInvalidTLSConfig(t testing.T) { for _, ee := range invalidTLSConfigs { _, err := LoadTLSConfig("testdata/" + ee.filename) if err == nil { t.Error("Expected error with config but got none") continue } if !strings.Contains(err.Error(), ee.errMsg) { t.Errorf("Expected error for invalid HTTP client configuration to contain %q but got: %s", ee.errMsg, err) } } } func TestTLSVersionStringer(t testing.T) { s := (TLSVersion)(tls.VersionTLS13) require.Equalf(t, "TLS13", s.String(), "tls.VersionTLS13 string should be TLS13, got %s", s.String()) } func TestTLSVersionMarshalYAML(t testing.T) { tests := []struct { input TLSVersion expected string err error }{ { input: TLSVersions["TLS13"], expected: "TLS13\n", err: nil, }, { input: TLSVersions["TLS10"], expected: "TLS10\n", err: nil, }, { input: TLSVersion(999), expected: "", err: errors.New("unknown TLS version: 999"), }, } for _, test := range tests { t.Run(fmt.Sprintf("MarshalYAML(%d)", test.input), func(t testing.T) { actualBytes, err := yaml.Marshal(&test.input) if err != nil { if test.err == nil \|\| err.Error() != test.err.Error() { t.Fatalf("error %v, expected %v", err, test.err) } return } actual := string(actualBytes) require.Equalf(t, test.expected, actual, "returned %s, expected %s", actual, test.expected) }) } } func TestTLSVersionMarshalJSON(t testing.T) { tests := []struct { input TLSVersion expected string err error }{ { input: TLSVersions["TLS13"], expected: `"TLS13"`, err: nil, }, { input: TLSVersions["TLS10"], expected: `"TLS10"`, err: nil, }, { input: TLSVersion(999), expected: "", err: errors.New("unknown TLS version: 999"), }, } for _, test := range tests { t.Run(fmt.Sprintf("MarshalJSON(%d)", test.input), func(t *testing.T) { actualBytes, err := json.Marshal(&test.input) if err != nil { if test.err == nil \|\| !strings.HasSuffix(err.Error(), test.err.Error()) { t.Fatalf("error %v, expected %v", err, test.err) } return } actual := string(actualBytes) require.Equalf(t, test.expected, actual, "returned %s, expected %s", actual, test.expected) }) } }	5.47 KB	2025-05-25 12:27

Terminal