forked from project-zot/zot
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Separate make commands that require sudo
Reworked privileged cert test so it runs in Go by moving make logic to Go logic Signed-off-by: Catalin Hofnar <[email protected]>
- Loading branch information
Showing
6 changed files
with
233 additions
and
140 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,123 @@ | ||
| //go:build extended && needprivileges | ||
| // +build extended,needprivileges | ||
|
|
||
| package cli //nolint:testpackage | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "context" | ||
| "crypto/tls" | ||
| "crypto/x509" | ||
| "fmt" | ||
| "io/ioutil" | ||
| "os" | ||
| "os/exec" | ||
| "path/filepath" | ||
| "testing" | ||
| "time" | ||
|
|
||
| . "github.com/smartystreets/goconvey/convey" | ||
| "gopkg.in/resty.v1" | ||
| "zotregistry.io/zot/pkg/api" | ||
| "zotregistry.io/zot/pkg/api/config" | ||
| ) | ||
|
|
||
| func TestElevatedPrivilegesTLSNewControllerPrivilegedCert(t *testing.T) { | ||
| Convey("Privileged certs - Make a new controller", t, func() { | ||
| cmd := exec.Command("mkdir", "-p", "/etc/containers/certs.d/127.0.0.1:8089/") // nolint: gosec | ||
| _, err := cmd.Output() | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| defer exec.Command("rm", "-rf", "/etc/containers/certs.d/127.0.0.1:8089/") | ||
|
|
||
| wd, _ := os.Getwd() | ||
| os.Chdir("../../test/data") | ||
|
|
||
| clientGlob, _ := filepath.Glob("client.*") | ||
| caGlob, _ := filepath.Glob("ca.*") | ||
|
|
||
| for _, file := range clientGlob { | ||
| cmd = exec.Command("cp", file, "/etc/containers/certs.d/127.0.0.1:8089/") | ||
| res, err := cmd.CombinedOutput() | ||
| if err != nil { | ||
| panic(string(res)) | ||
| } | ||
| } | ||
|
|
||
| for _, file := range caGlob { | ||
| cmd = exec.Command("cp", file, "/etc/containers/certs.d/127.0.0.1:8089/") | ||
| res, err := cmd.CombinedOutput() | ||
| if err != nil { | ||
| panic(string(res)) | ||
| } | ||
| } | ||
|
|
||
| allGlob, _ := filepath.Glob("/etc/containers/certs.d/127.0.0.1:8089/*.key") | ||
|
|
||
| for _, file := range allGlob { | ||
| cmd = exec.Command("chmod", "a=rwx", file) | ||
| res, err := cmd.CombinedOutput() | ||
| if err != nil { | ||
| panic(string(res)) | ||
| } | ||
| } | ||
|
|
||
| os.Chdir(wd) | ||
|
|
||
| caCert, err := ioutil.ReadFile(CACert) | ||
| So(err, ShouldBeNil) | ||
| caCertPool := x509.NewCertPool() | ||
| caCertPool.AppendCertsFromPEM(caCert) | ||
|
|
||
| resty.SetTLSClientConfig(&tls.Config{RootCAs: caCertPool, MinVersion: tls.VersionTLS12}) | ||
| defer func() { resty.SetTLSClientConfig(nil) }() | ||
| conf := config.New() | ||
| conf.HTTP.Port = SecurePort2 | ||
| conf.HTTP.TLS = &config.TLSConfig{ | ||
| Cert: ServerCert, | ||
| Key: ServerKey, | ||
| CACert: CACert, | ||
| } | ||
|
|
||
| ctlr := api.NewController(conf) | ||
| ctlr.Config.Storage.RootDirectory = t.TempDir() | ||
| go func() { | ||
| // this blocks | ||
| if err := ctlr.Run(context.Background()); err != nil { | ||
| return | ||
| } | ||
| }() | ||
|
|
||
| // wait till ready | ||
| for { | ||
| _, err := resty.R().Get(BaseURL2) | ||
| if err == nil { | ||
| break | ||
| } | ||
| time.Sleep(100 * time.Millisecond) | ||
| } | ||
|
|
||
| defer func() { | ||
| ctx := context.Background() | ||
| _ = ctlr.Server.Shutdown(ctx) | ||
| }() | ||
|
|
||
| Convey("Certs in privileged path", func() { | ||
| configPath := makeConfigFile( | ||
| fmt.Sprintf(`{"configs":[{"_name":"imagetest","url":"%s/v2/_catalog","showspinner":false}]}`, | ||
| BaseSecureURL2)) | ||
| defer os.Remove(configPath) | ||
|
|
||
| args := []string{"imagetest"} | ||
| imageCmd := NewImageCommand(new(searchService)) | ||
| imageBuff := bytes.NewBufferString("") | ||
| imageCmd.SetOut(imageBuff) | ||
| imageCmd.SetErr(imageBuff) | ||
| imageCmd.SetArgs(args) | ||
| err := imageCmd.Execute() | ||
| So(err, ShouldBeNil) | ||
| }) | ||
| }) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,97 @@ | ||
| //go:build needprivileges | ||
| // +build needprivileges | ||
|
|
||
| package storage_test | ||
|
|
||
| import ( | ||
| "bytes" | ||
| _ "crypto/sha256" | ||
| "io/ioutil" | ||
| "os" | ||
| "os/exec" | ||
| "path" | ||
| "strings" | ||
| "testing" | ||
|
|
||
| godigest "github.com/opencontainers/go-digest" | ||
| "github.com/rs/zerolog" | ||
| . "github.com/smartystreets/goconvey/convey" | ||
| "zotregistry.io/zot/pkg/extensions/monitoring" | ||
| "zotregistry.io/zot/pkg/log" | ||
| "zotregistry.io/zot/pkg/storage" | ||
| ) | ||
|
|
||
| func TestElevatedPrivilegesInvalidDedupe(t *testing.T) { | ||
| Convey("Invalid dedupe scenarios", t, func() { | ||
| dir := t.TempDir() | ||
|
|
||
| log := log.Logger{Logger: zerolog.New(os.Stdout)} | ||
| metrics := monitoring.NewMetricsServer(false, log) | ||
| imgStore := storage.NewImageStore(dir, true, storage.DefaultGCDelay, true, true, log, metrics) | ||
|
|
||
| upload, err := imgStore.NewBlobUpload("dedupe1") | ||
| So(err, ShouldBeNil) | ||
| So(upload, ShouldNotBeEmpty) | ||
|
|
||
| content := []byte("test-data3") | ||
| buf := bytes.NewBuffer(content) | ||
| buflen := buf.Len() | ||
| digest := godigest.FromBytes(content) | ||
| blob, err := imgStore.PutBlobChunkStreamed("dedupe1", upload, buf) | ||
| So(err, ShouldBeNil) | ||
| So(blob, ShouldEqual, buflen) | ||
|
|
||
| blobDigest1 := strings.Split(digest.String(), ":")[1] | ||
| So(blobDigest1, ShouldNotBeEmpty) | ||
|
|
||
| err = imgStore.FinishBlobUpload("dedupe1", upload, buf, digest.String()) | ||
| So(err, ShouldBeNil) | ||
| So(blob, ShouldEqual, buflen) | ||
|
|
||
| // Create a file at the same place where FinishBlobUpload will create | ||
| err = imgStore.InitRepo("dedupe2") | ||
| So(err, ShouldBeNil) | ||
|
|
||
| err = os.MkdirAll(path.Join(dir, "dedupe2", "blobs/sha256"), 0o755) | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| err = ioutil.WriteFile(path.Join(dir, "dedupe2", "blobs/sha256", blobDigest1), content, 0o755) // nolint: gosec | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| upload, err = imgStore.NewBlobUpload("dedupe2") | ||
| So(err, ShouldBeNil) | ||
| So(upload, ShouldNotBeEmpty) | ||
|
|
||
| content = []byte("test-data3") | ||
| buf = bytes.NewBuffer(content) | ||
| buflen = buf.Len() | ||
| digest = godigest.FromBytes(content) | ||
| blob, err = imgStore.PutBlobChunkStreamed("dedupe2", upload, buf) | ||
| So(err, ShouldBeNil) | ||
| So(blob, ShouldEqual, buflen) | ||
|
|
||
| cmd := exec.Command("chattr", "+i", path.Join(dir, "dedupe2", "blobs/sha256", blobDigest1)) // nolint: gosec | ||
| _, err = cmd.Output() | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| err = imgStore.FinishBlobUpload("dedupe2", upload, buf, digest.String()) | ||
| So(err, ShouldNotBeNil) | ||
| So(blob, ShouldEqual, buflen) | ||
|
|
||
| cmd = exec.Command("chattr", "-i", path.Join(dir, "dedupe2", "blobs/sha256", blobDigest1)) // nolint: gosec | ||
| _, err = cmd.Output() | ||
| if err != nil { | ||
| panic(err) | ||
| } | ||
|
|
||
| err = imgStore.FinishBlobUpload("dedupe2", upload, buf, digest.String()) | ||
| So(err, ShouldBeNil) | ||
| So(blob, ShouldEqual, buflen) | ||
| }) | ||
| } |
Oops, something went wrong.