72 lines
1.9 KiB
Go
72 lines
1.9 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/example/ollama-fair-gateway/internal/config"
|
|
)
|
|
|
|
func bypassTestConfig(useForwarded bool) config.AuthConfig {
|
|
return config.AuthConfig{
|
|
IPBypassUseForwardedIP: useForwarded,
|
|
TrustedProxies: []string{"10.0.0.0/8"},
|
|
IPBypass: []config.IPBypassConfig{{
|
|
CIDRs: []string{"127.0.0.1/32"},
|
|
Tenant: "local",
|
|
Subject: "localhost",
|
|
Scopes: []string{"gateway:admin"},
|
|
}},
|
|
}
|
|
}
|
|
|
|
func TestIPBypassDefaultsToDirectPeerNotForwardedHeader(t *testing.T) {
|
|
a, err := New(context.Background(), bypassTestConfig(false))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r := httptest.NewRequest("GET", "http://gateway/admin", nil)
|
|
r.RemoteAddr = "10.2.3.4:12345"
|
|
r.Header.Set("X-Forwarded-For", "127.0.0.1")
|
|
if got := a.ClientIP(r); got != "127.0.0.1" {
|
|
t.Fatalf("resolved client ip changed: got %q", got)
|
|
}
|
|
if _, err := a.Authenticate(r); err == nil {
|
|
t.Fatal("spoofed forwarded loopback unexpectedly satisfied ip_bypass")
|
|
}
|
|
}
|
|
|
|
func TestIPBypassForwardedCompatibilityMustBeExplicit(t *testing.T) {
|
|
a, err := New(context.Background(), bypassTestConfig(true))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r := httptest.NewRequest("GET", "http://gateway/admin", nil)
|
|
r.RemoteAddr = "10.2.3.4:12345"
|
|
r.Header.Set("X-Forwarded-For", "127.0.0.1")
|
|
id, err := a.Authenticate(r)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !id.IsAdmin() || id.AuthType != "ip-bypass" || id.ClientIP != "127.0.0.1" {
|
|
t.Fatalf("unexpected identity: %#v", id)
|
|
}
|
|
}
|
|
|
|
func TestIPBypassStillAcceptsDirectPeer(t *testing.T) {
|
|
a, err := New(context.Background(), bypassTestConfig(false))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r := httptest.NewRequest("GET", "http://gateway/admin", nil)
|
|
r.RemoteAddr = "127.0.0.1:12345"
|
|
id, err := a.Authenticate(r)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !id.IsAdmin() || id.ClientIP != "127.0.0.1" {
|
|
t.Fatalf("unexpected identity: %#v", id)
|
|
}
|
|
}
|