bucketeer/internal/probe/probe_test.go

package probe

import (
	"context"
	"errors"
	"net"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"tea.karlcom.de/karl/bucketeer/internal/model"
)

func serverHost(t *testing.T, h http.Handler) string {
	t.Helper()
	srv := httptest.NewTLSServer(h)
	t.Cleanup(srv.Close)
	return strings.TrimPrefix(srv.URL, "https://")
}

func statusHandler(status int) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(status) })
}

func TestProbeStorageStatuses(t *testing.T) {
	cases := []struct {
		status int
		want   model.ExposureState
	}{
		{http.StatusOK, model.ExposurePublicRead},
		{http.StatusForbidden, model.ExposureAuthRequired},
		{http.StatusUnauthorized, model.ExposureAuthRequired},
		{http.StatusNotFound, model.ExposureNotFound},
		{http.StatusInternalServerError, model.ExposureReachable},
	}
	for _, tc := range cases {
		p := New(Config{Workers: 1, Timeout: time.Second})
		host := serverHost(t, statusHandler(tc.status))
		r := p.ProbeDetailed(context.Background(), model.Candidate{
			Hostname: host, Provider: model.ProviderAWS, Service: model.ServiceS3,
		})
		if r.Exposure != tc.want {
			t.Errorf("status %d: got %s (%s), want %s", tc.status, r.Exposure, r.Detail, tc.want)
		}
	}
}

func TestProbeS3RegionRedirect(t *testing.T) {
	h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("x-amz-bucket-region", "eu-central-1")
		w.WriteHeader(http.StatusMovedPermanently)
	})
	p := New(Config{Workers: 1, Timeout: time.Second})
	host := serverHost(t, h)
	r := p.ProbeDetailed(context.Background(), model.Candidate{
		Hostname: host, Provider: model.ProviderAWS, Service: model.ServiceS3,
	})
	if r.Exposure != model.ExposureReachable || !strings.Contains(r.Detail, "eu-central-1") {
		t.Fatalf("got %s (%s), want reachable with region", r.Exposure, r.Detail)
	}
}

func TestProbeFirebase(t *testing.T) {
	p := New(Config{Workers: 1, Timeout: time.Second})
	host := serverHost(t, statusHandler(http.StatusUnauthorized))
	r := p.ProbeDetailed(context.Background(), model.Candidate{
		Hostname: host, Provider: model.ProviderGCP, Service: model.ServiceFirebaseDB,
	})
	if r.Exposure != model.ExposureAuthRequired {
		t.Fatalf("got %s, want auth_required", r.Exposure)
	}
	host2 := serverHost(t, statusHandler(http.StatusOK))
	r = p.ProbeDetailed(context.Background(), model.Candidate{
		Hostname: host2, Provider: model.ProviderGCP, Service: model.ServiceFirebaseDB,
	})
	if r.Exposure != model.ExposurePublicRead {
		t.Fatalf("got %s, want public_read", r.Exposure)
	}
}

func TestProbeAzureContainerDiscovery(t *testing.T) {
	h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path == "/images" && r.URL.Query().Get("comp") == "list" {
			w.WriteHeader(http.StatusOK)
			return
		}
		w.WriteHeader(http.StatusNotFound)
	})
	p := New(Config{Workers: 1, Timeout: time.Second})
	host := serverHost(t, h)
	r := p.ProbeDetailed(context.Background(), model.Candidate{
		Hostname: host, Resource: "acct", Provider: model.ProviderAzure, Service: model.ServiceBlobStorage,
	})
	if r.Exposure != model.ExposurePublicRead || !strings.Contains(r.Detail, "images") {
		t.Fatalf("got %s (%s), want public_read via container 'images'", r.Exposure, r.Detail)
	}
}

func TestProbeDatabaseTCP(t *testing.T) {
	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	defer ln.Close()
	go func() {
		for {
			conn, err := ln.Accept()
			if err != nil {
				return
			}
			conn.Close()
		}
	}()
	host, port, _ := net.SplitHostPort(ln.Addr().String())
	p := New(Config{Workers: 1, Timeout: time.Second})
	r := p.checkTCP(context.Background(), host, mustAtoi(port))
	if r.Exposure != model.ExposureReachable {
		t.Fatalf("got %+v, want reachable", r)
	}
	if r.ObjectReadable || r.Listable {
		t.Fatalf("tcp check must not claim readability: %+v", r)
	}

	// A closed port yields unknown, never readable.
	if r := p.checkTCP(context.Background(), "127.0.0.1", 1); r.Exposure == model.ExposurePublicRead {
		t.Fatal("closed port must never be public_read")
	}
}

func TestClassifyErrorNXDOMAIN(t *testing.T) {
	state, detail := classifyError(&net.DNSError{Err: "no such host", IsNotFound: true})
	if state != model.ExposurePrivate || !strings.Contains(detail, "no public record") {
		t.Fatalf("got %s (%s)", state, detail)
	}
	if state, _ := classifyError(errors.New("boom")); state != model.ExposureUnknown {
		t.Fatalf("got %s, want unknown", state)
	}
}

func mustAtoi(s string) int {
	n := 0
	for _, c := range s {
		n = n*10 + int(c-'0')
	}
	return n
}