From 0525bea59310a8e3e8e7d9feebcbd909f482cc92 Mon Sep 17 00:00:00 2001 From: Juan Font Date: Mon, 21 Nov 2022 20:55:16 +0000 Subject: [PATCH] Remove legacy OIDC tests --- Makefile | 10 - integration_oidc_test.go | 558 --------------------------------------- 2 files changed, 568 deletions(-) delete mode 100644 integration_oidc_test.go diff --git a/Makefile b/Makefile index 64423770..cd0297b8 100644 --- a/Makefile +++ b/Makefile @@ -48,16 +48,6 @@ test_integration_derp: -v /var/run/docker.sock:/var/run/docker.sock golang:1 \ go test $(TAGS) -failfast -timeout 30m -count=1 -run IntegrationDERP ./... -test_integration_oidc: - docker network rm $$(docker network ls --filter name=headscale --quiet) || true - docker network create headscale-test || true - docker run -t --rm \ - --network headscale-test \ - -v ~/.cache/hs-integration-go:/go \ - -v $$PWD:$$PWD -w $$PWD \ - -v /var/run/docker.sock:/var/run/docker.sock golang:1 \ - go test $(TAGS) -failfast -timeout 30m -count=1 -run IntegrationOIDC ./... - test_integration_v2_general: docker run \ -t --rm \ diff --git a/integration_oidc_test.go b/integration_oidc_test.go deleted file mode 100644 index 6dd79bed..00000000 --- a/integration_oidc_test.go +++ /dev/null @@ -1,558 +0,0 @@ -// nolint -package headscale - -import ( - "bytes" - "context" - "crypto/tls" - "fmt" - "io" - "log" - "net/http" - "net/url" - "os" - "path" - "strings" - "sync" - "testing" - "time" - - "github.com/ory/dockertest/v3" - "github.com/ory/dockertest/v3/docker" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/suite" -) - -const ( - oidcHeadscaleHostname = "headscale-oidc" - oidcMockHostname = "headscale-mock-oidc" - oidcNamespaceName = "oidcnamespace" - totalOidcContainers = 3 -) - -type IntegrationOIDCTestSuite struct { - suite.Suite - stats *suite.SuiteInformation - - pool dockertest.Pool - network dockertest.Network - headscale dockertest.Resource - mockOidc dockertest.Resource - saveLogs bool - - tailscales map[string]dockertest.Resource - joinWaitGroup sync.WaitGroup -} - -func TestIntegrationOIDCTestSuite(t *testing.T) { - if testing.Short() { - t.Skip("skipping integration tests due to short flag") - } - - saveLogs, err := GetEnvBool("HEADSCALE_INTEGRATION_SAVE_LOG") - if err != nil { - saveLogs = false - } - - s := new(IntegrationOIDCTestSuite) - - s.tailscales = make(map[string]dockertest.Resource) - s.saveLogs = saveLogs - - suite.Run(t, s) - - // HandleStats, which allows us to check if we passed and save logs - // is called after TearDown, so we cannot tear down containers before - // we have potentially saved the logs. - if s.saveLogs { - for _, tailscale := range s.tailscales { - if err := s.pool.Purge(&tailscale); err != nil { - log.Printf("Could not purge resource: %s\n", err) - } - } - - if !s.stats.Passed() { - err := s.saveLog(&s.headscale, "test_output") - if err != nil { - log.Printf("Could not save log: %s\n", err) - } - } - - if err := s.pool.Purge(&s.mockOidc); err != nil { - log.Printf("Could not purge resource: %s\n", err) - } - - if err := s.pool.Purge(&s.headscale); err != nil { - t.Logf("Could not purge resource: %s\n", err) - } - - if err := s.network.Close(); err != nil { - log.Printf("Could not close network: %s\n", err) - } - } -} - -func (s *IntegrationOIDCTestSuite) SetupSuite() { - if ppool, err := dockertest.NewPool(""); err == nil { - s.pool = *ppool - } else { - s.FailNow(fmt.Sprintf("Could not connect to docker: %s", err), "") - } - - network, err := GetFirstOrCreateNetwork(&s.pool, headscaleNetwork) - if err != nil { - s.FailNow(fmt.Sprintf("Failed to create or get network: %s", err), "") - } - s.network = network - - log.Printf("Network config: %v", s.network.Network.IPAM.Config[0]) - - s.Suite.T().Log("Setting up mock OIDC") - mockOidcOptions := &dockertest.RunOptions{ - Name: oidcMockHostname, - Cmd: []string{"headscale", "mockoidc"}, - ExposedPorts: []string{"10000/tcp"}, - PortBindings: map[docker.Port][]docker.PortBinding{ - "10000/tcp": {{HostPort: "10000"}}, - }, - Networks: []*dockertest.Network{&s.network}, - Env: []string{ - fmt.Sprintf("MOCKOIDC_ADDR=%s", oidcMockHostname), - "MOCKOIDC_PORT=10000", - "MOCKOIDC_CLIENT_ID=superclient", - "MOCKOIDC_CLIENT_SECRET=supersecret", - }, - } - - headscaleBuildOptions := &dockertest.BuildOptions{ - Dockerfile: "Dockerfile.debug", - ContextDir: ".", - } - - err = s.pool.RemoveContainerByName(oidcMockHostname) - if err != nil { - s.FailNow( - fmt.Sprintf( - "Could not remove existing container before building test: %s", - err, - ), - "", - ) - } - - if pmockoidc, err := s.pool.BuildAndRunWithBuildOptions( - headscaleBuildOptions, - mockOidcOptions, - DockerRestartPolicy); err == nil { - s.mockOidc = *pmockoidc - } else { - s.FailNow(fmt.Sprintf("Could not start mockOIDC container: %s", err), "") - } - - s.Suite.T().Logf("Waiting for headscale mock oidc to be ready for tests") - hostEndpoint := fmt.Sprintf( - "%s:%s", - s.mockOidc.GetIPInNetwork(&s.network), - s.mockOidc.GetPort("10000/tcp"), - ) - - if err := s.pool.Retry(func() error { - url := fmt.Sprintf("http://%s/oidc/.well-known/openid-configuration", hostEndpoint) - resp, err := http.Get(url) - if err != nil { - log.Printf("headscale mock OIDC tests is not ready: %s\n", err) - return err - } - - if resp.StatusCode != http.StatusOK { - return fmt.Errorf("status code not OK") - } - - return nil - }); err != nil { - // TODO(kradalby): If we cannot access headscale, or any other fatal error during - // test setup, we need to abort and tear down. However, testify does not seem to - // support that at the moment: - // https://github.com/stretchr/testify/issues/849 - return // fmt.Errorf("Could not connect to headscale: %s", err) - } - s.Suite.T().Log("headscale-mock-oidc container is ready for embedded OIDC tests") - - oidcCfg := fmt.Sprintf(` -oidc: - issuer: http://%s:10000/oidc - client_id: superclient - client_secret: supersecret - strip_email_domain: true`, s.mockOidc.GetIPInNetwork(&s.network)) - - currentPath, err := os.Getwd() - if err != nil { - s.FailNow(fmt.Sprintf("Could not determine current path: %s", err), "") - } - - baseConfig, err := os.ReadFile( - path.Join(currentPath, "integration_test/etc_oidc/base_config.yaml")) - if err != nil { - s.FailNow(fmt.Sprintf("Could not read base config: %s", err), "") - } - config := string(baseConfig) + oidcCfg - - log.Println(config) - - configPath := path.Join(currentPath, "integration_test/etc_oidc/config.yaml") - err = os.WriteFile(configPath, []byte(config), 0o644) - if err != nil { - s.FailNow(fmt.Sprintf("Could not write config: %s", err), "") - } - - headscaleOptions := &dockertest.RunOptions{ - Name: oidcHeadscaleHostname, - Networks: []*dockertest.Network{&s.network}, - Mounts: []string{ - path.Join(currentPath, - "integration_test/etc_oidc:/etc/headscale", - ), - }, - Cmd: []string{"headscale", "serve"}, - ExposedPorts: []string{"8443/tcp", "3478/udp"}, - PortBindings: map[docker.Port][]docker.PortBinding{ - "8443/tcp": {{HostPort: "8443"}}, - "3478/udp": {{HostPort: "3478"}}, - }, - } - - err = s.pool.RemoveContainerByName(oidcHeadscaleHostname) - if err != nil { - s.FailNow( - fmt.Sprintf( - "Could not remove existing container before building test: %s", - err, - ), - "", - ) - } - - s.Suite.T().Logf("Creating headscale container for OIDC integration tests") - if pheadscale, err := s.pool.BuildAndRunWithBuildOptions(headscaleBuildOptions, headscaleOptions, DockerRestartPolicy); err == nil { - s.headscale = *pheadscale - } else { - s.FailNow(fmt.Sprintf("Could not start headscale container: %s", err), "") - } - s.Suite.T().Logf("Created headscale container for embedded OIDC tests") - - s.Suite.T().Logf("Creating tailscale containers for embedded OIDC tests") - - for i := 0; i < totalOidcContainers; i++ { - version := tailscaleVersions[i%len(tailscaleVersions)] - hostname, container := s.tailscaleContainer( - fmt.Sprint(i), - version, - ) - s.tailscales[hostname] = *container - } - - s.Suite.T().Logf("Waiting for headscale to be ready for embedded OIDC tests") - hostMockEndpoint := fmt.Sprintf( - "%s:%s", - s.headscale.GetIPInNetwork(&s.network), - s.headscale.GetPort("8443/tcp"), - ) - - if err := s.pool.Retry(func() error { - url := fmt.Sprintf("https://%s/health", hostMockEndpoint) - insecureTransport := http.DefaultTransport.(*http.Transport).Clone() - insecureTransport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} - client := &http.Client{Transport: insecureTransport} - resp, err := client.Get(url) - if err != nil { - log.Printf("headscale for embedded OIDC tests is not ready: %s\n", err) - return err - } - - if resp.StatusCode != http.StatusOK { - return fmt.Errorf("status code not OK") - } - - return nil - }); err != nil { - // TODO(kradalby): If we cannot access headscale, or any other fatal error during - // test setup, we need to abort and tear down. However, testify does not seem to - // support that at the moment: - // https://github.com/stretchr/testify/issues/849 - return // fmt.Errorf("Could not connect to headscale: %s", err) - } - s.Suite.T().Log("headscale container is ready for embedded OIDC tests") - - s.Suite.T().Logf("Creating headscale namespace: %s\n", oidcNamespaceName) - result, _, err := ExecuteCommand( - &s.headscale, - []string{"headscale", "namespaces", "create", oidcNamespaceName}, - []string{}, - ) - log.Println("headscale create namespace result: ", result) - assert.Nil(s.T(), err) - - headscaleEndpoint := fmt.Sprintf( - "https://headscale:%s", - s.headscale.GetPort("8443/tcp"), - ) - - log.Printf( - "Joining tailscale containers to headscale at %s\n", - headscaleEndpoint, - ) - for hostname, tailscale := range s.tailscales { - s.joinWaitGroup.Add(1) - go s.AuthenticateOIDC(headscaleEndpoint, hostname, tailscale) - - // TODO(juan): Workaround for https://github.com/juanfont/headscale/issues/814 - time.Sleep(1 * time.Second) - } - - s.joinWaitGroup.Wait() - - // The nodes need a bit of time to get their updated maps from headscale - // TODO: See if we can have a more deterministic wait here. - time.Sleep(60 * time.Second) -} - -func (s *IntegrationOIDCTestSuite) AuthenticateOIDC( - endpoint, hostname string, - tailscale dockertest.Resource, -) { - defer s.joinWaitGroup.Done() - - loginURL, err := s.joinOIDC(endpoint, hostname, tailscale) - if err != nil { - s.FailNow(fmt.Sprintf("Could not join OIDC node: %s", err), "") - } - - insecureTransport := &http.Transport{ - TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, - } - client := &http.Client{Transport: insecureTransport} - resp, err := client.Get(loginURL.String()) - assert.Nil(s.T(), err) - - log.Printf("auth body, err: %#v, %s", resp, err) - - body, err := io.ReadAll(resp.Body) - assert.Nil(s.T(), err) - - if err != nil { - s.FailNow(fmt.Sprintf("Could not read login page: %s", err), "") - } - - log.Printf("Login page for %s: %s", hostname, string(body)) -} - -func (s *IntegrationOIDCTestSuite) joinOIDC( - endpoint, hostname string, - tailscale dockertest.Resource, -) (*url.URL, error) { - command := []string{ - "tailscale", - "up", - "-login-server", - endpoint, - "--hostname", - hostname, - } - - log.Println("Join command:", command) - log.Printf("Running join command for %s\n", hostname) - _, stderr, _ := ExecuteCommand( - &tailscale, - command, - []string{}, - ) - - // This piece of code just gets the login URL out of the stderr of the tailscale client. - // See https://github.com/tailscale/tailscale/blob/main/cmd/tailscale/cli/up.go#L584. - urlStr := strings.ReplaceAll(stderr, "\nTo authenticate, visit:\n\n\t", "") - urlStr = strings.TrimSpace(urlStr) - - // parse URL - loginUrl, err := url.Parse(urlStr) - if err != nil { - log.Printf("Could not parse login URL: %s", err) - log.Printf("Original join command result: %s", stderr) - return nil, err - } - - return loginUrl, nil -} - -func (s *IntegrationOIDCTestSuite) tailscaleContainer( - identifier, version string, -) (string, *dockertest.Resource) { - tailscaleBuildOptions := getDockerBuildOptions(version) - - hostname := fmt.Sprintf( - "tailscale-%s-%s", - strings.Replace(version, ".", "-", -1), - identifier, - ) - tailscaleOptions := &dockertest.RunOptions{ - Name: hostname, - Networks: []*dockertest.Network{&s.network}, - Cmd: []string{ - "tailscaled", "--tun=tsdev", - }, - - // expose the host IP address, so we can access it from inside the container - ExtraHosts: []string{ - "host.docker.internal:host-gateway", - "headscale:host-gateway", - }, - } - - pts, err := s.pool.BuildAndRunWithBuildOptions( - tailscaleBuildOptions, - tailscaleOptions, - DockerRestartPolicy, - DockerAllowLocalIPv6, - DockerAllowNetworkAdministration, - ) - if err != nil { - s.FailNow( - fmt.Sprintf( - "Could not start tailscale container version %s: %s", - version, - err, - ), - ) - } - log.Printf("Created %s container\n", hostname) - - return hostname, pts -} - -func (s *IntegrationOIDCTestSuite) TearDownSuite() { - if !s.saveLogs { - for _, tailscale := range s.tailscales { - if err := s.pool.Purge(&tailscale); err != nil { - log.Printf("Could not purge resource: %s\n", err) - } - } - - if err := s.pool.Purge(&s.headscale); err != nil { - log.Printf("Could not purge resource: %s\n", err) - } - - if err := s.pool.Purge(&s.mockOidc); err != nil { - log.Printf("Could not purge resource: %s\n", err) - } - - if err := s.network.Close(); err != nil { - log.Printf("Could not close network: %s\n", err) - } - } -} - -func (s *IntegrationOIDCTestSuite) HandleStats( - suiteName string, - stats *suite.SuiteInformation, -) { - s.stats = stats -} - -func (s *IntegrationOIDCTestSuite) saveLog( - resource *dockertest.Resource, - basePath string, -) error { - err := os.MkdirAll(basePath, os.ModePerm) - if err != nil { - return err - } - - var stdout bytes.Buffer - var stderr bytes.Buffer - - err = s.pool.Client.Logs( - docker.LogsOptions{ - Context: context.TODO(), - Container: resource.Container.ID, - OutputStream: &stdout, - ErrorStream: &stderr, - Tail: "all", - RawTerminal: false, - Stdout: true, - Stderr: true, - Follow: false, - Timestamps: false, - }, - ) - if err != nil { - return err - } - - log.Printf("Saving logs for %s to %s\n", resource.Container.Name, basePath) - - err = os.WriteFile( - path.Join(basePath, resource.Container.Name+".stdout.log"), - []byte(stdout.String()), - 0o644, - ) - if err != nil { - return err - } - - err = os.WriteFile( - path.Join(basePath, resource.Container.Name+".stderr.log"), - []byte(stdout.String()), - 0o644, - ) - if err != nil { - return err - } - - return nil -} - -func (s *IntegrationOIDCTestSuite) TestPingAllPeersByAddress() { - for hostname, tailscale := range s.tailscales { - ips, err := getIPs(s.tailscales) - assert.Nil(s.T(), err) - for peername, peerIPs := range ips { - for i, ip := range peerIPs { - // We currently cant ping ourselves, so skip that. - if peername == hostname { - continue - } - s.T(). - Run(fmt.Sprintf("%s-%s-%d", hostname, peername, i), func(t *testing.T) { - // We are only interested in "direct ping" which means what we - // might need a couple of more attempts before reaching the node. - command := []string{ - "tailscale", "ping", - "--timeout=1s", - "--c=10", - "--until-direct=true", - ip.String(), - } - - log.Printf( - "Pinging from %s to %s (%s)\n", - hostname, - peername, - ip, - ) - stdout, stderr, err := ExecuteCommand( - &tailscale, - command, - []string{}, - ) - assert.Nil(t, err) - log.Printf( - "result for %s: stdout: %s, stderr: %s\n", - hostname, - stdout, - stderr, - ) - assert.Contains(t, stdout, "pong") - }) - } - } - } -}