Skip to content

Commit f879a93

Browse files
cosmo0920cosmo0920
authored
tests: internal: aws_credentials_sts: fix unit test (timestamps)
Signed-off-by: Hiroshi Hatake <[email protected]>
1 parent 3cc7af0 commit f879a93

File tree

1 file changed

+147
-54
lines changed

1 file changed

+147
-54
lines changed

‎tests/internal/aws_credentials_sts.c‎

Lines changed: 147 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -32,50 +32,6 @@
3232
#define WEB_TOKEN_FILE FLB_TESTS_DATA_PATH "/data/aws_credentials/\
3333
web_identity_token_file.txt"
3434

35-
#define STS_RESPONSE_EKS "<AssumeRoleWithWebIdentityResponse \
36-
xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">\n\
37-
<AssumeRoleWithWebIdentityResult>\n\
38-
<SubjectFromWebIdentityToken>amzn1.account.AF6RHO7KZU5XRVQJGXK6HB56KR2A\n\
39-
</SubjectFromWebIdentityToken>\n\
40-
<Audience>[email protected]</Audience>\n\
41-
<AssumedRoleUser>\n\
42-
<Arn>arn:aws:sts::123456789012:assumed-role/WebIdentityRole/app1</Arn>\n\
43-
<AssumedRoleId>AROACLKWSDQRAOEXAMPLE:app1</AssumedRoleId>\n\
44-
</AssumedRoleUser>\n\
45-
<Credentials>\n\
46-
<SessionToken>eks_token</SessionToken>\n\
47-
<SecretAccessKey>eks_skid</SecretAccessKey>\n\
48-
<Expiration>2025-10-24T23:00:23Z</Expiration>\n\
49-
<AccessKeyId>eks_akid</AccessKeyId>\n\
50-
</Credentials>\n\
51-
<Provider>www.amazon.com</Provider>\n\
52-
</AssumeRoleWithWebIdentityResult>\n\
53-
<ResponseMetadata>\n\
54-
<RequestId>ad4156e9-bce1-11e2-82e6-6b6efEXAMPLE</RequestId>\n\
55-
</ResponseMetadata>\n\
56-
</AssumeRoleWithWebIdentityResponse>"
57-
58-
#define STS_RESPONSE_ASSUME_ROLE "<AssumeRoleResponse \
59-
xmlns=\"https://sts.amazonaws.com/doc/\n\
60-
2011-06-15/\">\n\
61-
<AssumeRoleResult>\n\
62-
<AssumedRoleUser>\n\
63-
<Arn>arn:aws:sts::123456789012:assumed-role/demo/TestAR</Arn>\n\
64-
<AssumedRoleId>ARO123EXAMPLE123:TestAR</AssumedRoleId>\n\
65-
</AssumedRoleUser>\n\
66-
<Credentials>\n\
67-
<AccessKeyId>sts_akid</AccessKeyId>\n\
68-
<SecretAccessKey>sts_skid</SecretAccessKey>\n\
69-
<SessionToken>sts_token</SessionToken>\n\
70-
<Expiration>2025-11-09T13:34:41Z</Expiration>\n\
71-
</Credentials>\n\
72-
<PackedPolicySize>6</PackedPolicySize>\n\
73-
</AssumeRoleResult>\n\
74-
<ResponseMetadata>\n\
75-
<RequestId>c6104cbe-af31-11e0-8154-cbc7ccf896c7</RequestId>\n\
76-
</ResponseMetadata>\n\
77-
</AssumeRoleResponse>"
78-
7935
/*
8036
* Unexpected/invalid STS response. The goal of this is not to test anything
8137
* that might happen in production, but rather to test the error handling
@@ -96,6 +52,119 @@ response would have</SecretAccessKey>"
9652
*/
9753
int g_request_count;
9854

55+
static char *build_eks_response_with_ttl_calloc(time_t ttl_secs, size_t *out_len)
56+
{
57+
time_t exp = time(NULL) + ttl_secs;
58+
struct tm gm;
59+
char expbuf[32];
60+
const char *tmpl;
61+
size_t need = 0;
62+
char *buf = 0;
63+
64+
gmtime_r(&exp, &gm);
65+
strftime(expbuf, sizeof(expbuf), "%Y-%m-%dT%H:%M:%SZ", &gm);
66+
67+
tmpl =
68+
"<AssumeRoleWithWebIdentityResponse xmlns=\"https://sts.amazonaws.com/doc/2011-06-15/\">\n"
69+
" <AssumeRoleWithWebIdentityResult>\n"
70+
" <SubjectFromWebIdentityToken>amzn1.account.AF6RHO7KZU5XRVQJGXK6HB56KR2A\n"
71+
"</SubjectFromWebIdentityToken>\n"
72+
" <Audience>[email protected]</Audience>\n"
73+
" <AssumedRoleUser>\n"
74+
" <Arn>arn:aws:sts::123456789012:assumed-role/WebIdentityRole/app1</Arn>\n"
75+
" <AssumedRoleId>AROACLKWSDQRAOEXAMPLE:app1</AssumedRoleId>\n"
76+
" </AssumedRoleUser>\n"
77+
" <Credentials>\n"
78+
" <SessionToken>eks_token</SessionToken>\n"
79+
" <SecretAccessKey>eks_skid</SecretAccessKey>\n"
80+
" <Expiration>%s</Expiration>\n"
81+
" <AccessKeyId>eks_akid</AccessKeyId>\n"
82+
" </Credentials>\n"
83+
" <Provider>www.amazon.com</Provider>\n"
84+
" </AssumeRoleWithWebIdentityResult>\n"
85+
" <ResponseMetadata>\n"
86+
" <RequestId>ad4156e9-bce1-11e2-82e6-6b6efEXAMPLE</RequestId>\n"
87+
" </ResponseMetadata>\n"
88+
"</AssumeRoleWithWebIdentityResponse>";
89+
90+
need = (size_t)snprintf(NULL, 0, tmpl, expbuf) + 1;
91+
buf = flb_calloc(1, need);
92+
if (!buf) {
93+
flb_errno();
94+
return NULL;
95+
}
96+
snprintf(buf, need, tmpl, expbuf);
97+
if (out_len) {
98+
*out_len = need - 1;
99+
}
100+
return buf;
101+
}
102+
103+
static char *build_sts_response_with_ttl_calloc(time_t ttl_secs, size_t *out_len)
104+
{
105+
time_t exp = time(NULL) + ttl_secs;
106+
struct tm gm;
107+
char expbuf[32];
108+
const char *tmpl;
109+
size_t need = 0;
110+
char *buf = 0;
111+
112+
gmtime_r(&exp, &gm);
113+
strftime(expbuf, sizeof(expbuf), "%Y-%m-%dT%H:%M:%SZ", &gm);
114+
115+
tmpl =
116+
"<AssumeRoleResponse \
117+
xmlns=\"https://sts.amazonaws.com/doc/\n\
118+
2011-06-15/\">\n\
119+
<AssumeRoleResult>\n\
120+
<AssumedRoleUser>\n\
121+
<Arn>arn:aws:sts::123456789012:assumed-role/demo/TestAR</Arn>\n\
122+
<AssumedRoleId>ARO123EXAMPLE123:TestAR</AssumedRoleId>\n\
123+
</AssumedRoleUser>\n\
124+
<Credentials>\n\
125+
<AccessKeyId>sts_akid</AccessKeyId>\n\
126+
<SecretAccessKey>sts_skid</SecretAccessKey>\n\
127+
<SessionToken>sts_token</SessionToken>\n\
128+
<Expiration>%s</Expiration>\n\
129+
</Credentials>\n\
130+
<PackedPolicySize>6</PackedPolicySize>\n\
131+
</AssumeRoleResult>\n\
132+
<ResponseMetadata>\n\
133+
<RequestId>c6104cbe-af31-11e0-8154-cbc7ccf896c7</RequestId>\n\
134+
</ResponseMetadata>\n\
135+
</AssumeRoleResponse>";
136+
137+
need = (size_t)snprintf(NULL, 0, tmpl, expbuf) + 1;
138+
buf = flb_calloc(1, need);
139+
if (!buf) {
140+
flb_errno();
141+
return NULL;
142+
}
143+
snprintf(buf, need, tmpl, expbuf);
144+
if (out_len) {
145+
*out_len = need - 1;
146+
}
147+
return buf;
148+
}
149+
150+
static void http_test_attach_owned_payload(struct flb_http_client *c,
151+
char *buf, size_t len)
152+
{
153+
c->resp.status = 200;
154+
c->resp.data = buf;
155+
c->resp.data_len = len;
156+
c->resp.data_size = len + 1;
157+
c->resp.data_size_max = c->resp.data_size;
158+
159+
c->resp.headers_end = c->resp.data;
160+
c->resp.payload = buf;
161+
c->resp.payload_size = len;
162+
163+
c->resp.content_length = -1;
164+
c->resp.chunked_encoding = FLB_FALSE;
165+
c->resp.connection_close = -1;
166+
}
167+
99168
/* Each test case has its own request function */
100169

101170
/* unexpected output test- see description for STS_RESPONSE_MALFORMED */
@@ -124,6 +193,8 @@ struct flb_http_client *request_eks_test1(struct flb_aws_client *aws_client,
124193
int method, const char *uri)
125194
{
126195
struct flb_http_client *c;
196+
char *payload = NULL;
197+
size_t payload_len = 0;
127198

128199
TEST_CHECK(method == FLB_HTTP_GET);
129200
TEST_CHECK(strstr(uri, "Action=AssumeRoleWithWebIdentity") != NULL);
@@ -139,10 +210,13 @@ struct flb_http_client *request_eks_test1(struct flb_aws_client *aws_client,
139210
return NULL;
140211
}
141212
mk_list_init(&c->headers);
213+
payload = build_eks_response_with_ttl_calloc(3600, &payload_len);
214+
TEST_CHECK(payload != NULL);
215+
if (!payload) {
216+
return NULL;
217+
}
142218

143-
c->resp.status = 200;
144-
c->resp.payload = STS_RESPONSE_EKS;
145-
c->resp.payload_size = strlen(STS_RESPONSE_EKS);
219+
http_test_attach_owned_payload(c, payload, payload_len);
146220

147221
return c;
148222
}
@@ -153,6 +227,8 @@ struct flb_http_client *request_eks_flb_sts_session_name(struct flb_aws_client
153227
const char *uri)
154228
{
155229
struct flb_http_client *c;
230+
char *payload = NULL;
231+
size_t payload_len = 0;
156232

157233
TEST_CHECK(method == FLB_HTTP_GET);
158234
TEST_CHECK(strstr(uri, "Action=AssumeRoleWithWebIdentity") != NULL);
@@ -171,10 +247,13 @@ struct flb_http_client *request_eks_flb_sts_session_name(struct flb_aws_client
171247
return NULL;
172248
}
173249
mk_list_init(&c->headers);
250+
payload = build_eks_response_with_ttl_calloc(3600, &payload_len);
251+
TEST_CHECK(payload != NULL);
252+
if (!payload) {
253+
return NULL;
254+
}
174255

175-
c->resp.status = 200;
176-
c->resp.payload = STS_RESPONSE_EKS;
177-
c->resp.payload_size = strlen(STS_RESPONSE_EKS);
256+
http_test_attach_owned_payload(c, payload, payload_len);
178257

179258
return c;
180259
}
@@ -213,6 +292,8 @@ struct flb_http_client *request_sts_test1(struct flb_aws_client *aws_client,
213292
int method, const char *uri)
214293
{
215294
struct flb_http_client *c;
295+
char *payload = NULL;
296+
size_t payload_len = 0;
216297

217298
TEST_CHECK(method == FLB_HTTP_GET);
218299
TEST_CHECK(strstr(uri, "Action=AssumeRole") != NULL);
@@ -228,10 +309,13 @@ struct flb_http_client *request_sts_test1(struct flb_aws_client *aws_client,
228309
return NULL;
229310
}
230311
mk_list_init(&c->headers);
312+
payload = build_sts_response_with_ttl_calloc(3600, &payload_len);
313+
TEST_CHECK(payload != NULL);
314+
if (!payload) {
315+
return NULL;
316+
}
231317

232-
c->resp.status = 200;
233-
c->resp.payload = STS_RESPONSE_ASSUME_ROLE;
234-
c->resp.payload_size = strlen(STS_RESPONSE_ASSUME_ROLE);
318+
http_test_attach_owned_payload(c, payload, payload_len);
235319

236320
return c;
237321
}
@@ -384,19 +468,28 @@ static void test_process_sts_response()
384468
struct flb_aws_credentials *creds;
385469
struct flb_config *config;
386470
time_t expiration;
471+
char *payload = NULL;
472+
size_t payload_len = 0;
387473

388474
config = flb_config_init();
389475

390476
if (config == NULL) {
391477
return;
392478
}
393-
creds = flb_parse_sts_resp(STS_RESPONSE_EKS, &expiration);
479+
payload = build_eks_response_with_ttl_calloc(3600, &payload_len);
480+
TEST_CHECK(payload != NULL);
481+
if (!payload) {
482+
return;
483+
}
484+
485+
creds = flb_parse_sts_resp(payload, &expiration);
394486

395487
TEST_CHECK(strcmp(EKS_ACCESS_KEY, creds->access_key_id) == 0);
396488
TEST_CHECK(strcmp(EKS_SECRET_KEY, creds->secret_access_key) == 0);
397489
TEST_CHECK(strcmp(EKS_TOKEN, creds->session_token) == 0);
398490

399491
flb_aws_credentials_destroy(creds);
492+
flb_free(payload);
400493
flb_config_exit(config);
401494
}
402495

0 commit comments

Comments
 (0)