mirror of
https://github.com/slackhq/nebula.git
synced 2026-11-15 06:26:52 +01:00
Matt RichardsonandClaude Opus 5.5
2f1931dc36
The control socket's fold made Group a value and gave the two 0600 constants one name; the info API's config reader and its tests catch up. - defaultInfoMode goes for ownerOnlyMode; a group is present when its ID is - the config test compares the whole Access with ownerOnly() Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
59 lines
1.9 KiB
Go
59 lines
1.9 KiB
Go
//go:build windows
|
|
|
|
package localapi
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"net"
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/Microsoft/go-winio"
|
|
"github.com/slackhq/nebula/commands"
|
|
"github.com/slackhq/nebula/test"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"golang.org/x/sys/windows"
|
|
)
|
|
|
|
// TestInfoIsServedOnAPipe: the info API serves HTTP on a named pipe, whose security
|
|
// descriptor is its access control the way a socket's mode is on unix; a group named
|
|
// in the config is admitted by it.
|
|
func TestInfoIsServedOnAPipe(t *testing.T) {
|
|
users, err := windows.CreateWellKnownSid(windows.WinBuiltinUsersSid)
|
|
require.NoError(t, err)
|
|
group := Group{Name: "Users", ID: users.String()}
|
|
|
|
s := NewInfoServer(test.NewLogger(), commands.New())
|
|
path := pipePrefix + "nebula-info-test"
|
|
require.NoError(t, s.Rebind(context.Background(), path, Access{Mode: groupSocketMode, Group: group}))
|
|
t.Cleanup(s.Stop)
|
|
assert.Equal(t, path, s.Path())
|
|
|
|
client := &http.Client{Transport: &http.Transport{
|
|
// What a program on the host has to do: ask for the data rights alone, since the
|
|
// group is granted no more; see pipeClientAccess.
|
|
DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
|
|
ctx, cancel := context.WithTimeout(ctx, 2*time.Second)
|
|
defer cancel()
|
|
return winio.DialPipeAccess(ctx, path, pipeClientAccess)
|
|
},
|
|
}}
|
|
res, err := client.Get("http://nebula/v1")
|
|
require.NoError(t, err)
|
|
defer res.Body.Close()
|
|
body, err := io.ReadAll(res.Body)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, http.StatusOK, res.StatusCode)
|
|
assert.Contains(t, string(body), `"help"`)
|
|
|
|
// A change of group means a new pipe under the same name, still serving.
|
|
require.NoError(t, s.Rebind(context.Background(), path, Access{Mode: groupSocketMode}))
|
|
res, err = client.Get("http://nebula/v1")
|
|
require.NoError(t, err)
|
|
res.Body.Close()
|
|
assert.Equal(t, http.StatusOK, res.StatusCode)
|
|
}
|