|
|
|
|
@ -17,177 +17,11 @@ limitations under the License.
|
|
|
|
|
package registry
|
|
|
|
|
|
|
|
|
|
import (
|
|
|
|
|
<<<<<<< HEAD
|
|
|
|
|
<<<<<<< HEAD
|
|
|
|
|
"bytes"
|
|
|
|
|
"context"
|
|
|
|
|
"fmt"
|
|
|
|
|
"io"
|
|
|
|
|
"io/ioutil"
|
|
|
|
|
"net"
|
|
|
|
|
=======
|
|
|
|
|
"fmt"
|
|
|
|
|
>>>>>>> dd5e82b5 (refactor to new test suite)
|
|
|
|
|
"os"
|
|
|
|
|
"path/filepath"
|
|
|
|
|
=======
|
|
|
|
|
"fmt"
|
|
|
|
|
"os"
|
|
|
|
|
>>>>>>> e676fd1c (Enable custom certificates option for OCI)
|
|
|
|
|
"testing"
|
|
|
|
|
|
|
|
|
|
"github.com/containerd/containerd/errdefs"
|
|
|
|
|
<<<<<<< HEAD
|
|
|
|
|
"github.com/distribution/distribution/v3/configuration"
|
|
|
|
|
"github.com/distribution/distribution/v3/registry"
|
|
|
|
|
"github.com/phayes/freeport"
|
|
|
|
|
"github.com/stretchr/testify/suite"
|
|
|
|
|
"golang.org/x/crypto/bcrypt"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
var (
|
|
|
|
|
testWorkspaceDir = "helm-registry-test"
|
|
|
|
|
testHtpasswdFileBasename = "authtest.htpasswd"
|
|
|
|
|
testCACertFileName = "root.pem"
|
|
|
|
|
testCAKeyFileName = "root-key.pem"
|
|
|
|
|
testClientCertFileName = "client.pem"
|
|
|
|
|
testClientKeyFileName = "client-key.pem"
|
|
|
|
|
testUsername = "myuser"
|
|
|
|
|
testPassword = "mypass"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
type RegistryClientTestSuite struct {
|
|
|
|
|
suite.Suite
|
|
|
|
|
Out io.Writer
|
|
|
|
|
DockerRegistryHost string
|
|
|
|
|
CompromisedRegistryHost string
|
|
|
|
|
WorkspaceDir string
|
|
|
|
|
RegistryClient *Client
|
|
|
|
|
|
|
|
|
|
PlainHTTPDockerRegistryHost string
|
|
|
|
|
TLSDockerRegistryHost string
|
|
|
|
|
TLSVerifyClientDockerRegistryHost string
|
|
|
|
|
|
|
|
|
|
PlainHTTPRegistryClient *Client
|
|
|
|
|
InsecureRegistryClient *Client
|
|
|
|
|
RegistryClientWithCA *Client
|
|
|
|
|
RegistryClientWithCertKey *Client
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
func (suite *RegistryClientTestSuite) SetupSuite() {
|
|
|
|
|
suite.WorkspaceDir = testWorkspaceDir
|
|
|
|
|
os.RemoveAll(suite.WorkspaceDir)
|
|
|
|
|
os.Mkdir(suite.WorkspaceDir, 0700)
|
|
|
|
|
|
|
|
|
|
var out bytes.Buffer
|
|
|
|
|
suite.Out = &out
|
|
|
|
|
credentialsFile := filepath.Join(suite.WorkspaceDir, CredentialsFileBasename)
|
|
|
|
|
|
|
|
|
|
// find the first non-local IP as the registry address
|
|
|
|
|
// or else, using localhost will always be insecure
|
|
|
|
|
var hostname string
|
|
|
|
|
addrs, err := net.InterfaceAddrs()
|
|
|
|
|
suite.Nil(err, "error getting IP addresses")
|
|
|
|
|
for _, address := range addrs {
|
|
|
|
|
if n, ok := address.(*net.IPNet); ok {
|
|
|
|
|
if n.IP.IsLinkLocalUnicast() || n.IP.IsLoopback() {
|
|
|
|
|
continue
|
|
|
|
|
}
|
|
|
|
|
hostname = n.IP.String()
|
|
|
|
|
break
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
suite.NotEmpty(hostname, "failed to get ip address as hostname")
|
|
|
|
|
|
|
|
|
|
// generate self-sign CA cert/key and client cert/key
|
|
|
|
|
caCert, caKey, clientCert, clientKey, err := genCerts(hostname)
|
|
|
|
|
suite.Nil(err, "error generating certs")
|
|
|
|
|
caCertPath := filepath.Join(suite.WorkspaceDir, testCACertFileName)
|
|
|
|
|
err = ioutil.WriteFile(caCertPath, caCert, 0644)
|
|
|
|
|
suite.Nil(err, "error creating test ca cert file")
|
|
|
|
|
caKeyPath := filepath.Join(suite.WorkspaceDir, testCAKeyFileName)
|
|
|
|
|
err = ioutil.WriteFile(caKeyPath, caKey, 0644)
|
|
|
|
|
suite.Nil(err, "error creating test ca key file")
|
|
|
|
|
clientCertPath := filepath.Join(suite.WorkspaceDir, testClientCertFileName)
|
|
|
|
|
err = ioutil.WriteFile(clientCertPath, clientCert, 0644)
|
|
|
|
|
suite.Nil(err, "error creating test client cert file")
|
|
|
|
|
clientKeyPath := filepath.Join(suite.WorkspaceDir, testClientKeyFileName)
|
|
|
|
|
err = ioutil.WriteFile(clientKeyPath, clientKey, 0644)
|
|
|
|
|
suite.Nil(err, "error creating test client key file")
|
|
|
|
|
|
|
|
|
|
// init test client
|
|
|
|
|
suite.RegistryClient, err = NewClient(
|
|
|
|
|
ClientOptDebug(true),
|
|
|
|
|
ClientOptEnableCache(true),
|
|
|
|
|
ClientOptWriter(suite.Out),
|
|
|
|
|
ClientOptCredentialsFile(credentialsFile),
|
|
|
|
|
)
|
|
|
|
|
suite.Nil(err, "no error creating registry client")
|
|
|
|
|
|
|
|
|
|
// init plain http client
|
|
|
|
|
suite.PlainHTTPRegistryClient, err = NewClient(
|
|
|
|
|
ClientOptDebug(true),
|
|
|
|
|
ClientOptEnableCache(true),
|
|
|
|
|
ClientOptWriter(suite.Out),
|
|
|
|
|
ClientOptCredentialsFile(credentialsFile),
|
|
|
|
|
ClientOptPlainHTTP(true),
|
|
|
|
|
)
|
|
|
|
|
suite.Nil(err, "error creating plain http registry client")
|
|
|
|
|
|
|
|
|
|
// init insecure client
|
|
|
|
|
suite.InsecureRegistryClient, err = NewClient(
|
|
|
|
|
ClientOptDebug(true),
|
|
|
|
|
ClientOptEnableCache(true),
|
|
|
|
|
ClientOptWriter(suite.Out),
|
|
|
|
|
ClientOptInsecureSkipVerifyTLS(true),
|
|
|
|
|
)
|
|
|
|
|
suite.Nil(err, "error creating insecure registry client")
|
|
|
|
|
|
|
|
|
|
// init client with CA cert
|
|
|
|
|
suite.RegistryClientWithCA, err = NewClient(
|
|
|
|
|
ClientOptDebug(true),
|
|
|
|
|
ClientOptEnableCache(true),
|
|
|
|
|
ClientOptWriter(suite.Out),
|
|
|
|
|
ClientOptCAFile(caCertPath),
|
|
|
|
|
)
|
|
|
|
|
suite.Nil(err, "error creating registry client with CA cert")
|
|
|
|
|
|
|
|
|
|
// init client with CA cert and client cert/key
|
|
|
|
|
suite.RegistryClientWithCertKey, err = NewClient(
|
|
|
|
|
ClientOptDebug(true),
|
|
|
|
|
ClientOptEnableCache(true),
|
|
|
|
|
ClientOptWriter(suite.Out),
|
|
|
|
|
ClientOptCAFile(caCertPath),
|
|
|
|
|
ClientOptCertKeyFiles(clientCertPath, clientKeyPath),
|
|
|
|
|
)
|
|
|
|
|
suite.Nil(err, "error creating registry client with CA cert")
|
|
|
|
|
|
|
|
|
|
// create htpasswd file (w BCrypt, which is required)
|
|
|
|
|
pwBytes, err := bcrypt.GenerateFromPassword([]byte(testPassword), bcrypt.DefaultCost)
|
|
|
|
|
suite.Nil(err, "no error generating bcrypt password for test htpasswd file")
|
|
|
|
|
htpasswdPath := filepath.Join(suite.WorkspaceDir, testHtpasswdFileBasename)
|
|
|
|
|
err = ioutil.WriteFile(htpasswdPath, []byte(fmt.Sprintf("%s:%s\n", testUsername, string(pwBytes))), 0644)
|
|
|
|
|
suite.Nil(err, "no error creating test htpasswd file")
|
|
|
|
|
|
|
|
|
|
// Registry config
|
|
|
|
|
config := &configuration.Configuration{}
|
|
|
|
|
port, err := freeport.GetFreePort()
|
|
|
|
|
suite.Nil(err, "no error finding free port for test registry")
|
|
|
|
|
suite.DockerRegistryHost = fmt.Sprintf("localhost:%d", port)
|
|
|
|
|
config.HTTP.Addr = fmt.Sprintf("127.0.0.1:%d", port)
|
|
|
|
|
config.HTTP.DrainTimeout = time.Duration(10) * time.Second
|
|
|
|
|
config.Storage = map[string]configuration.Parameters{"inmemory": map[string]interface{}{}}
|
|
|
|
|
config.Auth = configuration.Auth{
|
|
|
|
|
"htpasswd": configuration.Parameters{
|
|
|
|
|
"realm": "localhost",
|
|
|
|
|
"path": htpasswdPath,
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
dockerRegistry, err := registry.NewRegistry(context.Background(), config)
|
|
|
|
|
suite.Nil(err, "no error creating test registry")
|
|
|
|
|
|
|
|
|
|
suite.CompromisedRegistryHost = initCompromisedRegistryTestServer()
|
|
|
|
|
=======
|
|
|
|
|
"github.com/stretchr/testify/suite"
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
@ -197,29 +31,7 @@ type RegistryClientTestSuite struct {
|
|
|
|
|
|
|
|
|
|
func (suite *RegistryClientTestSuite) SetupSuite() {
|
|
|
|
|
// init test client
|
|
|
|
|
dockerRegistry := setup(&suite.TestSuite, false)
|
|
|
|
|
>>>>>>> e676fd1c (Enable custom certificates option for OCI)
|
|
|
|
|
|
|
|
|
|
// plain http registry
|
|
|
|
|
plainHTTPConfig := &configuration.Configuration{}
|
|
|
|
|
plainHTTPPort, err := freeport.GetFreePort()
|
|
|
|
|
suite.Nil(err, "no error finding free port for test plain HTTP registry")
|
|
|
|
|
suite.PlainHTTPDockerRegistryHost = fmt.Sprintf("%s:%d", hostname, plainHTTPPort)
|
|
|
|
|
plainHTTPConfig.HTTP.Addr = fmt.Sprintf(":%d", plainHTTPPort)
|
|
|
|
|
plainHTTPConfig.Storage = map[string]configuration.Parameters{"inmemory": map[string]interface{}{}}
|
|
|
|
|
plainHTTPConfig.Auth = configuration.Auth{
|
|
|
|
|
"htpasswd": configuration.Parameters{
|
|
|
|
|
"realm": hostname,
|
|
|
|
|
"path": htpasswdPath,
|
|
|
|
|
},
|
|
|
|
|
}
|
|
|
|
|
plainHTTPDockerRegistry, err := registry.NewRegistry(context.Background(), plainHTTPConfig)
|
|
|
|
|
suite.Nil(err, "no error creating test plain http registry")
|
|
|
|
|
|
|
|
|
|
// init TLS registry with self-signed CA
|
|
|
|
|
tlsRegistryPort, err := freeport.GetFreePort()
|
|
|
|
|
suite.Nil(err, "no error finding free port for test TLS registry")
|
|
|
|
|
suite.TLSDockerRegistryHost = fmt.Sprintf("%s:%d", hostname, tlsRegistryPort)
|
|
|
|
|
dockerRegistry := setup(&suite.TestSuite, false, false)
|
|
|
|
|
|
|
|
|
|
// Start Docker registry
|
|
|
|
|
go dockerRegistry.ListenAndServe()
|
|
|
|
|
|
Tom Runyon
3 years ago