akovalenko/lnd.xprv
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

itest: parallelize test steps

Browse Source
This commit is contained in:
Oliver Gugger 2020-09-04 09:22:44 +02:00
parent 9862ee7cd6
commit decd2d975c
No known key found for this signature in database
GPG Key ID: 8E4256593F177720
1 changed files with 290 additions and 205 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

407
lntest/itest/lnd_macaroons_test.go
View File

@ -7,7 +7,6 @@ import (
"encoding/hex" "encoding/hex"
"sort" "sort"
"strconv" "strconv"
"strings"
"testing" "testing"
"github.com/lightningnetwork/lnd/lnrpc" "github.com/lightningnetwork/lnd/lnrpc"
@ -18,246 +17,332 @@ import (
"gopkg.in/macaroon.v2" "gopkg.in/macaroon.v2"
) )
// errContains is a helper function that returns true if a string is contained
// in the message of an error.
func errContains(err error, str string) bool {
return strings.Contains(err.Error(), str)
}
// testMacaroonAuthentication makes sure that if macaroon authentication is // testMacaroonAuthentication makes sure that if macaroon authentication is
// enabled on the gRPC interface, no requests with missing or invalid // enabled on the gRPC interface, no requests with missing or invalid
// macaroons are allowed. Further, the specific access rights (read/write, // macaroons are allowed. Further, the specific access rights (read/write,
// entity based) and first-party caveats are tested as well. // entity based) and first-party caveats are tested as well.
func testMacaroonAuthentication(net *lntest.NetworkHarness, t *harnessTest) { func testMacaroonAuthentication(net *lntest.NetworkHarness, t *harnessTest) {
var ( var (
ctxb = context.Background()
infoReq = &lnrpc.GetInfoRequest{} infoReq = &lnrpc.GetInfoRequest{}
newAddrReq = &lnrpc.NewAddressRequest{ newAddrReq = &lnrpc.NewAddressRequest{
Type: AddrTypeWitnessPubkeyHash, Type: AddrTypeWitnessPubkeyHash,
} }
testNode = net.Alice testNode = net.Alice
) )
ctxt, cancel := context.WithTimeout(ctxb, defaultTimeout)
defer cancel()
// First test: Make sure we get an error if we use no macaroons but try testCases := []struct {
// to connect to a node that has macaroon authentication enabled. name string
run func(ctxt context.Context, t *testing.T)
}{{
// First test: Make sure we get an error if we use no macaroons
// but try to connect to a node that has macaroon authentication
// enabled.
name: "no macaroon",
run: func(ctxt context.Context, t *testing.T) {
conn, err := testNode.ConnectRPC(false) conn, err := testNode.ConnectRPC(false)
require.NoError(t.t, err) require.NoError(t, err)
defer conn.Close() defer func() { _ = conn.Close() }()
client := lnrpc.NewLightningClient(conn) client := lnrpc.NewLightningClient(conn)
_, err = client.GetInfo(ctxt, infoReq) _, err = client.GetInfo(ctxt, infoReq)
if err == nil || !errContains(err, "expected 1 macaroon") { require.Error(t, err)
t.Fatalf("expected to get an error when connecting without " + require.Contains(t, err.Error(), "expected 1 macaroon")
"macaroons") },
} }, {
// Second test: Ensure that an invalid macaroon also triggers an
// Second test: Ensure that an invalid macaroon also triggers an error. // error.
name: "invalid macaroon",
run: func(ctxt context.Context, t *testing.T) {
invalidMac, _ := macaroon.New( invalidMac, _ := macaroon.New(
[]byte("dummy_root_key"), []byte("0"), "itest", []byte("dummy_root_key"), []byte("0"), "itest",
macaroon.LatestVersion, macaroon.LatestVersion,
) )
cleanup, client := macaroonClient(t.t, testNode, invalidMac) cleanup, client := macaroonClient(
t, testNode, invalidMac,
)
defer cleanup() defer cleanup()
_, err = client.GetInfo(ctxt, infoReq) _, err := client.GetInfo(ctxt, infoReq)
if err == nil || !errContains(err, "cannot get macaroon") { require.Error(t, err)
t.Fatalf("expected to get an error when connecting with an " + require.Contains(t, err.Error(), "cannot get macaroon")
"invalid macaroon") },
} }, {
// Third test: Try to access a write method with read-only
// Third test: Try to access a write method with read-only macaroon. // macaroon.
name: "read only macaroon",
run: func(ctxt context.Context, t *testing.T) {
readonlyMac, err := testNode.ReadMacaroon( readonlyMac, err := testNode.ReadMacaroon(
testNode.ReadMacPath(), defaultTimeout, testNode.ReadMacPath(), defaultTimeout,
) )
require.NoError(t.t, err) require.NoError(t, err)
cleanup, client = macaroonClient(t.t, testNode, readonlyMac) cleanup, client := macaroonClient(
t, testNode, readonlyMac,
)
defer cleanup() defer cleanup()
_, err = client.NewAddress(ctxt, newAddrReq) _, err = client.NewAddress(ctxt, newAddrReq)
if err == nil || !errContains(err, "permission denied") { require.Error(t, err)
t.Fatalf("expected to get an error when connecting to " + require.Contains(t, err.Error(), "permission denied")
"write method with read-only macaroon") },
} }, {
// Fourth test: Check first-party caveat with timeout that
// Fourth test: Check first-party caveat with timeout that expired // expired 30 seconds ago.
// 30 seconds ago. name: "expired macaroon",
run: func(ctxt context.Context, t *testing.T) {
readonlyMac, err := testNode.ReadMacaroon(
testNode.ReadMacPath(), defaultTimeout,
)
require.NoError(t, err)
timeoutMac, err := macaroons.AddConstraints( timeoutMac, err := macaroons.AddConstraints(
readonlyMac, macaroons.TimeoutConstraint(-30), readonlyMac, macaroons.TimeoutConstraint(-30),
) )
require.NoError(t.t, err) require.NoError(t, err)
cleanup, client = macaroonClient(t.t, testNode, timeoutMac) cleanup, client := macaroonClient(
defer cleanup() t, testNode, timeoutMac,
_, err = client.GetInfo(ctxt, infoReq)
if err == nil || !errContains(err, "macaroon has expired") {
t.Fatalf("expected to get an error when connecting with an " +
"invalid macaroon")
}
// Fifth test: Check first-party caveat with invalid IP address.
invalidIpAddrMac, err := macaroons.AddConstraints(
readonlyMac, macaroons.IPLockConstraint("1.1.1.1"),
) )
require.NoError(t.t, err)
cleanup, client = macaroonClient(t.t, testNode, invalidIpAddrMac)
defer cleanup() defer cleanup()
_, err = client.GetInfo(ctxt, infoReq) _, err = client.GetInfo(ctxt, infoReq)
if err == nil || !errContains(err, "different IP address") { require.Error(t, err)
t.Fatalf("expected to get an error when connecting with an " + require.Contains(t, err.Error(), "macaroon has expired")
"invalid macaroon") },
} }, {
// Fifth test: Check first-party caveat with invalid IP address.
// Sixth test: Make sure that if we do everything correct and send name: "invalid IP macaroon",
// the admin macaroon with first-party caveats that we can satisfy, run: func(ctxt context.Context, t *testing.T) {
// we get a correct answer. readonlyMac, err := testNode.ReadMacaroon(
testNode.ReadMacPath(), defaultTimeout,
)
require.NoError(t, err)
invalidIpAddrMac, err := macaroons.AddConstraints(
readonlyMac, macaroons.IPLockConstraint(
"1.1.1.1",
),
)
require.NoError(t, err)
cleanup, client := macaroonClient(
t, testNode, invalidIpAddrMac,
)
defer cleanup()
_, err = client.GetInfo(ctxt, infoReq)
require.Error(t, err)
require.Contains(t, err.Error(), "different IP address")
},
}, {
// Sixth test: Make sure that if we do everything correct and
// send the admin macaroon with first-party caveats that we can
// satisfy, we get a correct answer.
name: "correct macaroon",
run: func(ctxt context.Context, t *testing.T) {
adminMac, err := testNode.ReadMacaroon( adminMac, err := testNode.ReadMacaroon(
testNode.AdminMacPath(), defaultTimeout, testNode.AdminMacPath(), defaultTimeout,
) )
require.NoError(t.t, err) require.NoError(t, err)
adminMac, err = macaroons.AddConstraints( adminMac, err = macaroons.AddConstraints(
adminMac, macaroons.TimeoutConstraint(30), adminMac, macaroons.TimeoutConstraint(30),
macaroons.IPLockConstraint("127.0.0.1"), macaroons.IPLockConstraint("127.0.0.1"),
) )
require.NoError(t.t, err) require.NoError(t, err)
cleanup, client = macaroonClient(t.t, testNode, adminMac) cleanup, client := macaroonClient(t, testNode, adminMac)
defer cleanup() defer cleanup()
res, err := client.NewAddress(ctxt, newAddrReq) res, err := client.NewAddress(ctxt, newAddrReq)
require.NoError(t.t, err, "get new address") require.NoError(t, err, "get new address")
assert.Contains(t.t, res.Address, "bcrt1") assert.Contains(t, res.Address, "bcrt1")
},
}}
for _, tc := range testCases {
tc := tc
t.t.Run(tc.name, func(t *testing.T) {
t.Parallel()
ctxt, cancel := context.WithTimeout(
context.Background(), defaultTimeout,
)
defer cancel()
tc.run(ctxt, t)
})
}
} }
// testBakeMacaroon checks that when creating macaroons, the permissions param // testBakeMacaroon checks that when creating macaroons, the permissions param
// in the request must be set correctly, and the baked macaroon has the intended // in the request must be set correctly, and the baked macaroon has the intended
// permissions. // permissions.
func testBakeMacaroon(net *lntest.NetworkHarness, t *harnessTest) { func testBakeMacaroon(net *lntest.NetworkHarness, t *harnessTest) {
var ( var testNode = net.Alice
ctxb = context.Background()
req = &lnrpc.BakeMacaroonRequest{}
testNode = net.Alice
)
ctxt, cancel := context.WithTimeout(ctxb, defaultTimeout)
defer cancel()
// First test: when the permission list is empty in the request, an error testCases := []struct {
// should be returned. name string
adminMac, err := testNode.ReadMacaroon( run func(ctxt context.Context, t *testing.T,
testNode.AdminMacPath(), defaultTimeout, adminClient lnrpc.LightningClient)
) }{{
require.NoError(t.t, err) // First test: when the permission list is empty in the request,
cleanup, client := macaroonClient(t.t, testNode, adminMac)
defer cleanup()
_, err = client.BakeMacaroon(ctxt, req)
if err == nil || !errContains(err, "permission list cannot be empty") {
t.Fatalf("expected an error, got %v", err)
}
// Second test: when the action in the permission list is not valid,
// an error should be returned. // an error should be returned.
req = &lnrpc.BakeMacaroonRequest{ name: "no permission list",
Permissions: []*lnrpc.MacaroonPermission{ run: func(ctxt context.Context, t *testing.T,
{ adminClient lnrpc.LightningClient) {
req := &lnrpc.BakeMacaroonRequest{}
_, err := adminClient.BakeMacaroon(ctxt, req)
require.Error(t, err)
assert.Contains(
t, err.Error(), "permission list cannot be "+
"empty",
)
},
}, {
// Second test: when the action in the permission list is not
// valid, an error should be returned.
name: "invalid permission list",
run: func(ctxt context.Context, t *testing.T,
adminClient lnrpc.LightningClient) {
req := &lnrpc.BakeMacaroonRequest{
Permissions: []*lnrpc.MacaroonPermission{{
Entity: "macaroon", Entity: "macaroon",
Action: "invalid123", Action: "invalid123",
}, }},
},
}
_, err = client.BakeMacaroon(ctxt, req)
if err == nil || !errContains(err, "invalid permission action") {
t.Fatalf("expected an error, got %v", err)
} }
_, err := adminClient.BakeMacaroon(ctxt, req)
require.Error(t, err)
assert.Contains(
t, err.Error(), "invalid permission action",
)
},
}, {
// Third test: when the entity in the permission list is not
// valid, an error should be returned.
name: "invalid permission entity",
run: func(ctxt context.Context, t *testing.T,
adminClient lnrpc.LightningClient) {
// Third test: when the entity in the permission list is not valid, req := &lnrpc.BakeMacaroonRequest{
// an error should be returned. Permissions: []*lnrpc.MacaroonPermission{{
req = &lnrpc.BakeMacaroonRequest{
Permissions: []*lnrpc.MacaroonPermission{
{
Entity: "invalid123", Entity: "invalid123",
Action: "read", Action: "read",
}, }},
},
}
_, err = client.BakeMacaroon(ctxt, req)
if err == nil || !errContains(err, "invalid permission entity") {
t.Fatalf("expected an error, got %v", err)
} }
_, err := adminClient.BakeMacaroon(ctxt, req)
require.Error(t, err)
assert.Contains(
t, err.Error(), "invalid permission entity",
)
},
}, {
// Fourth test: check that when no root key ID is specified, the
// default root keyID is used.
name: "default root key ID",
run: func(ctxt context.Context, t *testing.T,
adminClient lnrpc.LightningClient) {
// Fourth test: check that when no root key ID is specified, the default req := &lnrpc.BakeMacaroonRequest{
// root key ID is used. Permissions: []*lnrpc.MacaroonPermission{{
req = &lnrpc.BakeMacaroonRequest{
Permissions: []*lnrpc.MacaroonPermission{
{
Entity: "macaroon", Entity: "macaroon",
Action: "read", Action: "read",
}, }},
},
} }
_, err = client.BakeMacaroon(ctxt, req) _, err := adminClient.BakeMacaroon(ctxt, req)
require.NoError(t.t, err) require.NoError(t, err)
listReq := &lnrpc.ListMacaroonIDsRequest{} listReq := &lnrpc.ListMacaroonIDsRequest{}
resp, err := client.ListMacaroonIDs(ctxt, listReq) resp, err := adminClient.ListMacaroonIDs(ctxt, listReq)
require.NoError(t.t, err) require.NoError(t, err)
if resp.RootKeyIds[0] != 0 { require.Equal(t, resp.RootKeyIds[0], uint64(0))
t.Fatalf("expected ID to be 0, found: %v", resp.RootKeyIds) },
} }, {
// Fifth test: create a macaroon use a non-default root key ID. // Fifth test: create a macaroon use a non-default root key ID.
name: "custom root key ID",
run: func(ctxt context.Context, t *testing.T,
adminClient lnrpc.LightningClient) {
rootKeyID := uint64(4200) rootKeyID := uint64(4200)
req = &lnrpc.BakeMacaroonRequest{ req := &lnrpc.BakeMacaroonRequest{
RootKeyId: rootKeyID, RootKeyId: rootKeyID,
Permissions: []*lnrpc.MacaroonPermission{ Permissions: []*lnrpc.MacaroonPermission{{
{
Entity: "macaroon", Entity: "macaroon",
Action: "read", Action: "read",
}, }},
},
} }
bakeResp, err := client.BakeMacaroon(ctxt, req) _, err := adminClient.BakeMacaroon(ctxt, req)
require.NoError(t.t, err) require.NoError(t, err)
listReq = &lnrpc.ListMacaroonIDsRequest{} listReq := &lnrpc.ListMacaroonIDsRequest{}
resp, err = client.ListMacaroonIDs(ctxt, listReq) resp, err := adminClient.ListMacaroonIDs(ctxt, listReq)
require.NoError(t.t, err) require.NoError(t, err)
// the ListMacaroonIDs should give a list of two IDs, the default ID 0, and // the ListMacaroonIDs should give a list of two IDs,
// the newly created ID. The returned response is sorted to guarantee the // the default ID 0, and the newly created ID. The
// order so that we can compare them one by one. // returned response is sorted to guarantee the order so
// that we can compare them one by one.
sort.Slice(resp.RootKeyIds, func(i, j int) bool { sort.Slice(resp.RootKeyIds, func(i, j int) bool {
return resp.RootKeyIds[i] < resp.RootKeyIds[j] return resp.RootKeyIds[i] < resp.RootKeyIds[j]
}) })
if resp.RootKeyIds[0] != 0 { require.Equal(t, resp.RootKeyIds[0], uint64(0))
t.Fatalf("expected ID to be %v, found: %v", 0, resp.RootKeyIds[0]) require.Equal(t, resp.RootKeyIds[1], rootKeyID)
} },
if resp.RootKeyIds[1] != rootKeyID { }, {
t.Fatalf( // Sixth test: check the baked macaroon has the intended
"expected ID to be %v, found: %v", // permissions. It should succeed in reading, and fail to write
rootKeyID, resp.RootKeyIds[1], // a macaroon.
) name: "custom macaroon permissions",
} run: func(ctxt context.Context, t *testing.T,
adminClient lnrpc.LightningClient) {
rootKeyID := uint64(4200)
req := &lnrpc.BakeMacaroonRequest{
RootKeyId: rootKeyID,
Permissions: []*lnrpc.MacaroonPermission{{
Entity: "macaroon",
Action: "read",
}},
}
bakeResp, err := adminClient.BakeMacaroon(ctxt, req)
require.NoError(t, err)
// Sixth test: check the baked macaroon has the intended permissions. It
// should succeed in reading, and fail to write a macaroon.
newMac, err := readMacaroonFromHex(bakeResp.Macaroon) newMac, err := readMacaroonFromHex(bakeResp.Macaroon)
require.NoError(t.t, err) require.NoError(t, err)
cleanup, client = macaroonClient(t.t, testNode, newMac) cleanup, readOnlyClient := macaroonClient(
t, testNode, newMac,
)
defer cleanup() defer cleanup()
// BakeMacaroon requires a write permission, so this call should return an // BakeMacaroon requires a write permission, so this
// error. // call should return an error.
_, err = client.BakeMacaroon(ctxt, req) _, err = readOnlyClient.BakeMacaroon(ctxt, req)
if err == nil || !errContains(err, "permission denied") { require.Error(t, err)
t.Fatalf("expected an error, got %v", err) require.Contains(t, err.Error(), "permission denied")
}
// ListMacaroon requires a read permission, so this call should succeed. // ListMacaroon requires a read permission, so this call
listReq = &lnrpc.ListMacaroonIDsRequest{} // should succeed.
resp, err = client.ListMacaroonIDs(ctxt, listReq) listReq := &lnrpc.ListMacaroonIDsRequest{}
require.NoError(t.t, err) _, err = readOnlyClient.ListMacaroonIDs(ctxt, listReq)
require.NoError(t, err)
// Current macaroon can only work on entity macaroon, so a GetInfo request // Current macaroon can only work on entity macaroon, so
// will fail. // a GetInfo request will fail.
infoReq := &lnrpc.GetInfoRequest{} infoReq := &lnrpc.GetInfoRequest{}
_, err = client.GetInfo(ctxt, infoReq) _, err = readOnlyClient.GetInfo(ctxt, infoReq)
if err == nil || !errContains(err, "permission denied") { require.Error(t, err)
t.Fatalf("expected error not returned, got %v", err) require.Contains(t, err.Error(), "permission denied")
},
}}
for _, tc := range testCases {
tc := tc
t.t.Run(tc.name, func(t *testing.T) {
t.Parallel()
ctxt, cancel := context.WithTimeout(
context.Background(), defaultTimeout,
)
defer cancel()
adminMac, err := testNode.ReadMacaroon(
testNode.AdminMacPath(), defaultTimeout,
)
require.NoError(t, err)
cleanup, client := macaroonClient(t, testNode, adminMac)
defer cleanup()
tc.run(ctxt, t, client)
})
} }
} }