From 849951be1d1a7ee9f9302006ccb187bf5b4e36f3 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Wed, 22 Jul 2026 23:51:18 +0300 Subject: =?UTF-8?q?feat:=20DTail=20fork=20=E2=80=94=20server/client=20feat?= =?UTF-8?q?ure=20development?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Squashed development of the snonux/dtail fork's product code (internal/, cmd/) since diverging from mimecast/dtail. Major areas: - Read/output path: the former "turbo" channel-less path is now the single, default server-side read/output path for cat/grep/tail and MapReduce; the old channel-based path and its config/env toggles were removed. - MapReduce: single aggregate implementation (server + serverless) fed directly by a processor pipeline, with input-exhausted finalization via the shutdown coordinator; high-concurrency and data-race fixes. - Journal source reads (journal:unit.service) via journalctl, Linux-gated behind a journal-v1 capability. - Auth-key fast reconnect: in-memory per-user public-key cache with TTL/max-keys, registered over an authenticated session (AUTHKEY), checked before authorized_keys. - Interactive query reload (--interactive-query) with SESSION START/UPDATE generation boundaries and capability negotiation. - Client-side deadlines: --timeout / --shutdownAfter as context deadlines; follow shutdown handling. - Client logging: diagnostics-only daily log by default, opt-in payload tee via --log-payload. - Numerous correctness fixes (buffer-pool double-recycle races, EOF-sentinel leaks, glob-expansion cap, TOCTOU in CSV parsing) with accompanying unit tests. Co-Authored-By: Claude Opus 4.8 --- internal/user/server/user_test.go | 203 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 203 insertions(+) create mode 100644 internal/user/server/user_test.go (limited to 'internal/user/server/user_test.go') diff --git a/internal/user/server/user_test.go b/internal/user/server/user_test.go new file mode 100644 index 0000000..a431d37 --- /dev/null +++ b/internal/user/server/user_test.go @@ -0,0 +1,203 @@ +package server + +import ( + "context" + "sync" + "testing" + + "github.com/mimecast/dtail/internal/config" + "github.com/mimecast/dtail/internal/io/dlog" + "github.com/mimecast/dtail/internal/io/fs" + "github.com/mimecast/dtail/internal/source" +) + +// ensureTestDeps initialises config and the dlog server logger once per test +// binary run. It is safe to call from multiple parallel tests because it +// guards initialisation with the nil-checks used elsewhere in the test suite +// (see internal/mapr/server/aggregate_test.go). +func ensureTestDeps(t *testing.T) { + t.Helper() + if config.Server == nil { + config.Server = &config.ServerConfig{} + } + if config.Common == nil { + config.Common = &config.CommonConfig{ + // Use "none" logger to suppress output during tests and avoid + // the factory panic caused by an empty logger name. + Logger: "none", + LogLevel: "error", + } + } + if dlog.Server == nil { + ctx, cancel := context.WithCancel(context.Background()) + t.Cleanup(cancel) + var wg sync.WaitGroup + wg.Add(1) + dlog.Start(ctx, &wg, source.Server) + } +} + +// newTestUser creates a User with the given permission strings for testing. +// It bypasses PermissionLookup and OS-level checks so the unit tests +// focus solely on iteratePaths logic. +func newTestUser(perms []string) *User { + return &User{ + Name: "testuser", + remoteAddress: "127.0.0.1", + permissions: perms, + } +} + +// TestIteratePaths_DenyWins verifies that a deny rule (prefix '!') wins over +// any subsequent allow rule for the same path. This is the canonical +// "deny-wins" / "first-matching-deny" semantics expected from an ACL system. +// +// Before the fix, the loop used last-match-wins semantics, so a trailing +// allow rule could silently neutralise an earlier deny — a security footgun. +func TestIteratePaths_DenyWins(t *testing.T) { + ensureTestDeps(t) + t.Parallel() + + tests := []struct { + name string + permissions []string + path string + permType string + wantPerm bool + }{ + { + // Deny rule comes first; a later allow rule must NOT override it. + name: "deny_then_allow_same_path_deny_wins", + permissions: []string{ + "readfiles:!/var/log/secret.*", + "readfiles:/var/log/.*", + }, + path: "/var/log/secret.log", + permType: "readfiles", + wantPerm: false, + }, + { + // Allow rule comes first, then a deny rule — deny must still win. + name: "allow_then_deny_same_path_deny_wins", + permissions: []string{ + "readfiles:/var/log/.*", + "readfiles:!/var/log/secret.*", + }, + path: "/var/log/secret.log", + permType: "readfiles", + wantPerm: false, + }, + { + // A path that is only matched by the allow rule must be permitted. + name: "allow_non_denied_path", + permissions: []string{ + "readfiles:!/var/log/secret.*", + "readfiles:/var/log/.*", + }, + path: "/var/log/app.log", + permType: "readfiles", + wantPerm: true, + }, + { + // Multiple deny rules — any matching deny must block the path. + name: "multiple_denies_first_matches", + permissions: []string{ + "readfiles:!/var/log/secret.*", + "readfiles:!/var/log/private.*", + "readfiles:/var/log/.*", + }, + path: "/var/log/private.log", + permType: "readfiles", + wantPerm: false, + }, + { + // Path not matched by any rule must not gain permission. + name: "no_matching_rule_no_permission", + permissions: []string{ + "readfiles:/var/log/.*", + }, + path: "/etc/passwd", + permType: "readfiles", + wantPerm: false, + }, + { + // Permission type mismatch: rule for a different type must not apply. + name: "wrong_permission_type_ignored", + permissions: []string{ + "writefiles:/var/log/.*", + }, + path: "/var/log/app.log", + permType: "readfiles", + wantPerm: false, + }, + } + + for _, tc := range tests { + tc := tc // capture range var for parallel sub-tests + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + u := newTestUser(tc.permissions) + got, err := u.iteratePaths(tc.path, tc.permType) + if err != nil { + t.Fatalf("iteratePaths returned unexpected error: %v", err) + } + if got != tc.wantPerm { + t.Errorf("iteratePaths(%q, %q) = %v, want %v", + tc.path, tc.permType, got, tc.wantPerm) + } + }) + } +} + +// TestIteratePaths_InvalidRegex verifies that a malformed regex in the +// permission list is surfaced as an error rather than silently ignored. +func TestIteratePaths_InvalidRegex(t *testing.T) { + ensureTestDeps(t) + t.Parallel() + + u := newTestUser([]string{"readfiles:[invalid"}) + _, err := u.iteratePaths("/var/log/app.log", "readfiles") + if err == nil { + t.Error("expected an error for invalid regex, got nil") + } +} + +func TestValidateReadTarget_JournalUsesConfigPermissionOnly(t *testing.T) { + ensureTestDeps(t) + t.Parallel() + + u := newTestUser([]string{`readfiles:^journal:(nginx|postgresql)\.service$`}) + target, ok := u.ValidateReadTarget("journal:nginx.service", "readfiles") + if !ok { + t.Fatal("expected journal target to pass config permission") + } + if target.Kind != fs.JournalKind { + t.Fatalf("target.Kind = %v, want %v", target.Kind, fs.JournalKind) + } +} + +func TestValidateReadTarget_JournalDeniedByConfigPermission(t *testing.T) { + ensureTestDeps(t) + t.Parallel() + + u := newTestUser([]string{`readfiles:^journal:(nginx|postgresql)\.service$`}) + _, ok := u.ValidateReadTarget("journal:ssh.service", "readfiles") + if ok { + t.Fatal("expected journal target to be denied by config permission") + } +} + +func TestValidateReadTarget_JournalDenyRuleWins(t *testing.T) { + ensureTestDeps(t) + t.Parallel() + + u := newTestUser([]string{ + `readfiles:!^journal:postgresql\.service$`, + `readfiles:^journal:.*\.service$`, + }) + _, ok := u.ValidateReadTarget("journal:postgresql.service", "readfiles") + if ok { + t.Fatal("expected matching journal deny rule to block target") + } +} -- cgit v1.2.3