1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225 |
- // +build linux
- /*
- Copyright 2014 The Kubernetes Authors.
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
- */
- package subpath
- import (
- "fmt"
- "io/ioutil"
- "net"
- "os"
- "path/filepath"
- "reflect"
- "strconv"
- "syscall"
- "testing"
- "k8s.io/klog"
- "k8s.io/kubernetes/pkg/util/mount"
- )
- func TestSafeMakeDir(t *testing.T) {
- defaultPerm := os.FileMode(0750) + os.ModeDir
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) error
- path string
- checkPath string
- perm os.FileMode
- expectError bool
- }{
- {
- "directory-does-not-exist",
- func(base string) error {
- return nil
- },
- "test/directory",
- "test/directory",
- defaultPerm,
- false,
- },
- {
- "directory-with-sgid",
- func(base string) error {
- return nil
- },
- "test/directory",
- "test/directory",
- os.FileMode(0777) + os.ModeDir + os.ModeSetgid,
- false,
- },
- {
- "directory-with-suid",
- func(base string) error {
- return nil
- },
- "test/directory",
- "test/directory",
- os.FileMode(0777) + os.ModeDir + os.ModeSetuid,
- false,
- },
- {
- "directory-with-sticky-bit",
- func(base string) error {
- return nil
- },
- "test/directory",
- "test/directory",
- os.FileMode(0777) + os.ModeDir + os.ModeSticky,
- false,
- },
- {
- "directory-exists",
- func(base string) error {
- return os.MkdirAll(filepath.Join(base, "test/directory"), 0750)
- },
- "test/directory",
- "test/directory",
- defaultPerm,
- false,
- },
- {
- "create-base",
- func(base string) error {
- return nil
- },
- "",
- "",
- defaultPerm,
- false,
- },
- {
- "escape-base-using-dots",
- func(base string) error {
- return nil
- },
- "..",
- "",
- defaultPerm,
- true,
- },
- {
- "escape-base-using-dots-2",
- func(base string) error {
- return nil
- },
- "test/../../..",
- "",
- defaultPerm,
- true,
- },
- {
- "follow-symlinks",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "destination"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("destination", filepath.Join(base, "test"))
- },
- "test/directory",
- "destination/directory",
- defaultPerm,
- false,
- },
- {
- "follow-symlink-loop",
- func(base string) error {
- return os.Symlink("test", filepath.Join(base, "test"))
- },
- "test/directory",
- "",
- defaultPerm,
- true,
- },
- {
- "follow-symlink-multiple follow",
- func(base string) error {
- /* test1/dir points to test2 and test2/dir points to test1 */
- if err := os.MkdirAll(filepath.Join(base, "test1"), defaultPerm); err != nil {
- return err
- }
- if err := os.MkdirAll(filepath.Join(base, "test2"), defaultPerm); err != nil {
- return err
- }
- if err := os.Symlink(filepath.Join(base, "test2"), filepath.Join(base, "test1/dir")); err != nil {
- return err
- }
- if err := os.Symlink(filepath.Join(base, "test1"), filepath.Join(base, "test2/dir")); err != nil {
- return err
- }
- return nil
- },
- "test1/dir/dir/dir/dir/dir/dir/dir/foo",
- "test2/foo",
- defaultPerm,
- false,
- },
- {
- "danglink-symlink",
- func(base string) error {
- return os.Symlink("non-existing", filepath.Join(base, "test"))
- },
- "test/directory",
- "",
- defaultPerm,
- true,
- },
- {
- "non-directory",
- func(base string) error {
- return ioutil.WriteFile(filepath.Join(base, "test"), []byte{}, defaultPerm)
- },
- "test/directory",
- "",
- defaultPerm,
- true,
- },
- {
- "non-directory-final",
- func(base string) error {
- return ioutil.WriteFile(filepath.Join(base, "test"), []byte{}, defaultPerm)
- },
- "test",
- "",
- defaultPerm,
- true,
- },
- {
- "escape-with-relative-symlink",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir"), defaultPerm); err != nil {
- return err
- }
- if err := os.MkdirAll(filepath.Join(base, "exists"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("../exists", filepath.Join(base, "dir/test"))
- },
- "dir/test",
- "",
- defaultPerm,
- false,
- },
- {
- "escape-with-relative-symlink-not-exists",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("../not-exists", filepath.Join(base, "dir/test"))
- },
- "dir/test",
- "",
- defaultPerm,
- true,
- },
- {
- "escape-with-symlink",
- func(base string) error {
- return os.Symlink("/", filepath.Join(base, "test"))
- },
- "test/directory",
- "",
- defaultPerm,
- true,
- },
- }
- for i := range tests {
- test := tests[i]
- t.Run(test.name, func(t *testing.T) {
- base, err := ioutil.TempDir("", "safe-make-dir-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- defer os.RemoveAll(base)
- test.prepare(base)
- pathToCreate := filepath.Join(base, test.path)
- err = doSafeMakeDir(pathToCreate, base, test.perm)
- if err != nil && !test.expectError {
- t.Fatal(err)
- }
- if err != nil {
- t.Logf("got error: %s", err)
- }
- if err == nil && test.expectError {
- t.Fatalf("expected error, got none")
- }
- if test.checkPath != "" {
- st, err := os.Stat(filepath.Join(base, test.checkPath))
- if err != nil {
- t.Fatalf("cannot read path %s", test.checkPath)
- }
- actualMode := st.Mode()
- if actualMode != test.perm {
- if actualMode^test.perm == os.ModeSetgid && test.perm&os.ModeSetgid == 0 {
- // when TMPDIR is a kubernetes emptydir, the sticky gid bit is set due to fsgroup
- t.Logf("masking bit from %o", actualMode)
- } else {
- t.Errorf("expected permissions %o, got %o (%b)", test.perm, actualMode, test.perm^actualMode)
- }
- }
- }
- })
- }
- }
- func TestRemoveEmptyDirs(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) error
- // Function that validates directory structure after the test
- validate func(base string) error
- baseDir string
- endDir string
- expectError bool
- }{
- {
- name: "all-empty",
- prepare: func(base string) error {
- return os.MkdirAll(filepath.Join(base, "a/b/c"), defaultPerm)
- },
- validate: func(base string) error {
- return validateDirEmpty(filepath.Join(base, "a"))
- },
- baseDir: "a",
- endDir: "a/b/c",
- expectError: false,
- },
- {
- name: "dir-not-empty",
- prepare: func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "a/b/c"), defaultPerm); err != nil {
- return err
- }
- return os.Mkdir(filepath.Join(base, "a/b/d"), defaultPerm)
- },
- validate: func(base string) error {
- if err := validateDirNotExists(filepath.Join(base, "a/b/c")); err != nil {
- return err
- }
- return validateDirExists(filepath.Join(base, "a/b"))
- },
- baseDir: "a",
- endDir: "a/b/c",
- expectError: false,
- },
- {
- name: "path-not-within-base",
- prepare: func(base string) error {
- return os.MkdirAll(filepath.Join(base, "a/b/c"), defaultPerm)
- },
- validate: func(base string) error {
- return validateDirExists(filepath.Join(base, "a"))
- },
- baseDir: "a",
- endDir: "b/c",
- expectError: true,
- },
- {
- name: "path-already-deleted",
- prepare: func(base string) error {
- return nil
- },
- validate: func(base string) error {
- return nil
- },
- baseDir: "a",
- endDir: "a/b/c",
- expectError: false,
- },
- {
- name: "path-not-dir",
- prepare: func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "a/b"), defaultPerm); err != nil {
- return err
- }
- return ioutil.WriteFile(filepath.Join(base, "a/b", "c"), []byte{}, defaultPerm)
- },
- validate: func(base string) error {
- if err := validateDirExists(filepath.Join(base, "a/b")); err != nil {
- return err
- }
- return validateFileExists(filepath.Join(base, "a/b/c"))
- },
- baseDir: "a",
- endDir: "a/b/c",
- expectError: true,
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "remove-empty-dirs-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- if err = test.prepare(base); err != nil {
- os.RemoveAll(base)
- t.Fatalf("failed to prepare test %q: %v", test.name, err.Error())
- }
- err = removeEmptyDirs(filepath.Join(base, test.baseDir), filepath.Join(base, test.endDir))
- if err != nil && !test.expectError {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- if err == nil && test.expectError {
- t.Errorf("test %q failed: expected error, got success", test.name)
- }
- if err = test.validate(base); err != nil {
- t.Errorf("test %q failed validation: %v", test.name, err)
- }
- os.RemoveAll(base)
- }
- }
- func TestCleanSubPaths(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- testVol := "vol1"
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) ([]mount.MountPoint, error)
- // Function that validates directory structure after the test
- validate func(base string) error
- expectError bool
- }{
- {
- name: "not-exists",
- prepare: func(base string) ([]mount.MountPoint, error) {
- return nil, nil
- },
- validate: func(base string) error {
- return nil
- },
- expectError: false,
- },
- {
- name: "subpath-not-mount",
- prepare: func(base string) ([]mount.MountPoint, error) {
- return nil, os.MkdirAll(filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "0"), defaultPerm)
- },
- validate: func(base string) error {
- return validateDirNotExists(filepath.Join(base, containerSubPathDirectoryName))
- },
- expectError: false,
- },
- {
- name: "subpath-file",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1")
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- return nil, ioutil.WriteFile(filepath.Join(path, "0"), []byte{}, defaultPerm)
- },
- validate: func(base string) error {
- return validateDirNotExists(filepath.Join(base, containerSubPathDirectoryName))
- },
- expectError: false,
- },
- {
- name: "subpath-container-not-dir",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol)
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- return nil, ioutil.WriteFile(filepath.Join(path, "container1"), []byte{}, defaultPerm)
- },
- validate: func(base string) error {
- return validateDirExists(filepath.Join(base, containerSubPathDirectoryName, testVol))
- },
- expectError: true,
- },
- {
- name: "subpath-multiple-container-not-dir",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol)
- if err := os.MkdirAll(filepath.Join(path, "container1"), defaultPerm); err != nil {
- return nil, err
- }
- return nil, ioutil.WriteFile(filepath.Join(path, "container2"), []byte{}, defaultPerm)
- },
- validate: func(base string) error {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol)
- if err := validateDirNotExists(filepath.Join(path, "container1")); err != nil {
- return err
- }
- return validateFileExists(filepath.Join(path, "container2"))
- },
- expectError: true,
- },
- {
- name: "subpath-mount",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "0")
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- mounts := []mount.MountPoint{{Device: "/dev/sdb", Path: path}}
- return mounts, nil
- },
- validate: func(base string) error {
- return validateDirNotExists(filepath.Join(base, containerSubPathDirectoryName))
- },
- },
- {
- name: "subpath-mount-multiple",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "0")
- path2 := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "1")
- path3 := filepath.Join(base, containerSubPathDirectoryName, testVol, "container2", "1")
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- if err := os.MkdirAll(path2, defaultPerm); err != nil {
- return nil, err
- }
- if err := os.MkdirAll(path3, defaultPerm); err != nil {
- return nil, err
- }
- mounts := []mount.MountPoint{
- {Device: "/dev/sdb", Path: path},
- {Device: "/dev/sdb", Path: path3},
- }
- return mounts, nil
- },
- validate: func(base string) error {
- return validateDirNotExists(filepath.Join(base, containerSubPathDirectoryName))
- },
- },
- {
- name: "subpath-mount-multiple-vols",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "0")
- path2 := filepath.Join(base, containerSubPathDirectoryName, "vol2", "container1", "1")
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- if err := os.MkdirAll(path2, defaultPerm); err != nil {
- return nil, err
- }
- mounts := []mount.MountPoint{
- {Device: "/dev/sdb", Path: path},
- }
- return mounts, nil
- },
- validate: func(base string) error {
- baseSubdir := filepath.Join(base, containerSubPathDirectoryName)
- if err := validateDirNotExists(filepath.Join(baseSubdir, testVol)); err != nil {
- return err
- }
- return validateDirExists(baseSubdir)
- },
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "clean-subpaths-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- mounts, err := test.prepare(base)
- if err != nil {
- os.RemoveAll(base)
- t.Fatalf("failed to prepare test %q: %v", test.name, err.Error())
- }
- fm := &mount.FakeMounter{MountPoints: mounts}
- err = doCleanSubPaths(fm, base, testVol)
- if err != nil && !test.expectError {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- if err == nil && test.expectError {
- t.Errorf("test %q failed: expected error, got success", test.name)
- }
- if err = test.validate(base); err != nil {
- t.Errorf("test %q failed validation: %v", test.name, err)
- }
- os.RemoveAll(base)
- }
- }
- var (
- testVol = "vol1"
- testPod = "pod0"
- testContainer = "container0"
- testSubpath = 1
- )
- func setupFakeMounter(testMounts []string) *mount.FakeMounter {
- mounts := []mount.MountPoint{}
- for _, mountPoint := range testMounts {
- mounts = append(mounts, mount.MountPoint{Device: "/foo", Path: mountPoint})
- }
- return &mount.FakeMounter{MountPoints: mounts}
- }
- func getTestPaths(base string) (string, string) {
- return filepath.Join(base, testVol),
- filepath.Join(base, testPod, containerSubPathDirectoryName, testVol, testContainer, strconv.Itoa(testSubpath))
- }
- func TestBindSubPath(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) ([]string, string, string, error)
- expectError bool
- }{
- {
- name: "subpath-dir",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "dir0")
- return nil, volpath, subpath, os.MkdirAll(subpath, defaultPerm)
- },
- expectError: false,
- },
- {
- name: "subpath-dir-symlink",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "dir0")
- if err := os.MkdirAll(subpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- subpathLink := filepath.Join(volpath, "dirLink")
- return nil, volpath, subpath, os.Symlink(subpath, subpathLink)
- },
- expectError: false,
- },
- {
- name: "subpath-file",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "file0")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- return nil, volpath, subpath, ioutil.WriteFile(subpath, []byte{}, defaultPerm)
- },
- expectError: false,
- },
- {
- name: "subpath-not-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "file0")
- return nil, volpath, subpath, nil
- },
- expectError: true,
- },
- {
- name: "subpath-outside",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "dir0")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- return nil, volpath, subpath, os.Symlink(base, subpath)
- },
- expectError: true,
- },
- {
- name: "subpath-symlink-child-outside",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpathDir := filepath.Join(volpath, "dir0")
- subpath := filepath.Join(subpathDir, "child0")
- if err := os.MkdirAll(subpathDir, defaultPerm); err != nil {
- return nil, "", "", err
- }
- return nil, volpath, subpath, os.Symlink(base, subpath)
- },
- expectError: true,
- },
- {
- name: "subpath-child-outside-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpathDir := filepath.Join(volpath, "dir0")
- child := filepath.Join(base, "child0")
- subpath := filepath.Join(subpathDir, "child0")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // touch file outside
- if err := ioutil.WriteFile(child, []byte{}, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // create symlink for subpath dir
- return nil, volpath, subpath, os.Symlink(base, subpathDir)
- },
- expectError: true,
- },
- {
- name: "subpath-child-outside-not-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpathDir := filepath.Join(volpath, "dir0")
- subpath := filepath.Join(subpathDir, "child0")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // create symlink for subpath dir
- return nil, volpath, subpath, os.Symlink(base, subpathDir)
- },
- expectError: true,
- },
- {
- name: "subpath-child-outside-exists-middle-dir-symlink",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpathDir := filepath.Join(volpath, "dir0")
- symlinkDir := filepath.Join(subpathDir, "linkDir0")
- child := filepath.Join(base, "child0")
- subpath := filepath.Join(symlinkDir, "child0")
- if err := os.MkdirAll(subpathDir, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // touch file outside
- if err := ioutil.WriteFile(child, []byte{}, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // create symlink for middle dir
- return nil, volpath, subpath, os.Symlink(base, symlinkDir)
- },
- expectError: true,
- },
- {
- name: "subpath-backstepping",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "dir0")
- symlinkBase := filepath.Join(volpath, "..")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // create symlink for subpath
- return nil, volpath, subpath, os.Symlink(symlinkBase, subpath)
- },
- expectError: true,
- },
- {
- name: "subpath-mountdir-already-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, subpathMount := getTestPaths(base)
- if err := os.MkdirAll(subpathMount, defaultPerm); err != nil {
- return nil, "", "", err
- }
- subpath := filepath.Join(volpath, "dir0")
- return nil, volpath, subpath, os.MkdirAll(subpath, defaultPerm)
- },
- expectError: false,
- },
- {
- name: "subpath-mount-already-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, subpathMount := getTestPaths(base)
- mounts := []string{subpathMount}
- if err := os.MkdirAll(subpathMount, defaultPerm); err != nil {
- return nil, "", "", err
- }
- subpath := filepath.Join(volpath, "dir0")
- return mounts, volpath, subpath, os.MkdirAll(subpath, defaultPerm)
- },
- expectError: false,
- },
- {
- name: "mount-unix-socket",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, subpathMount := getTestPaths(base)
- mounts := []string{subpathMount}
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- socketFile, socketCreateError := createSocketFile(volpath)
- return mounts, volpath, socketFile, socketCreateError
- },
- expectError: false,
- },
- {
- name: "subpath-mounting-fifo",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, subpathMount := getTestPaths(base)
- mounts := []string{subpathMount}
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- testFifo := filepath.Join(volpath, "mount_test.fifo")
- err := syscall.Mkfifo(testFifo, 0)
- return mounts, volpath, testFifo, err
- },
- expectError: false,
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "bind-subpath-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- mounts, volPath, subPath, err := test.prepare(base)
- if err != nil {
- os.RemoveAll(base)
- t.Fatalf("failed to prepare test %q: %v", test.name, err.Error())
- }
- fm := setupFakeMounter(mounts)
- subpath := Subpath{
- VolumeMountIndex: testSubpath,
- Path: subPath,
- VolumeName: testVol,
- VolumePath: volPath,
- PodDir: filepath.Join(base, "pod0"),
- ContainerName: testContainer,
- }
- _, subpathMount := getTestPaths(base)
- bindPathTarget, err := doBindSubPath(fm, subpath)
- if test.expectError {
- if err == nil {
- t.Errorf("test %q failed: expected error, got success", test.name)
- }
- if bindPathTarget != "" {
- t.Errorf("test %q failed: expected empty bindPathTarget, got %v", test.name, bindPathTarget)
- }
- if err = validateDirNotExists(subpathMount); err != nil {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- }
- if !test.expectError {
- if err != nil {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- if bindPathTarget != subpathMount {
- t.Errorf("test %q failed: expected bindPathTarget %v, got %v", test.name, subpathMount, bindPathTarget)
- }
- if err = validateFileExists(subpathMount); err != nil {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- }
- os.RemoveAll(base)
- }
- }
- func TestSafeOpen(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) error
- path string
- expectError bool
- }{
- {
- "directory-does-not-exist",
- func(base string) error {
- return nil
- },
- "test/directory",
- true,
- },
- {
- "directory-exists",
- func(base string) error {
- return os.MkdirAll(filepath.Join(base, "test/directory"), 0750)
- },
- "test/directory",
- false,
- },
- {
- "escape-base-using-dots",
- func(base string) error {
- return nil
- },
- "..",
- true,
- },
- {
- "escape-base-using-dots-2",
- func(base string) error {
- return os.MkdirAll(filepath.Join(base, "test"), 0750)
- },
- "test/../../..",
- true,
- },
- {
- "symlink",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "destination"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("destination", filepath.Join(base, "test"))
- },
- "test",
- true,
- },
- {
- "symlink-nested",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir1/dir2"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("dir1", filepath.Join(base, "dir1/dir2/test"))
- },
- "test",
- true,
- },
- {
- "symlink-loop",
- func(base string) error {
- return os.Symlink("test", filepath.Join(base, "test"))
- },
- "test",
- true,
- },
- {
- "symlink-not-exists",
- func(base string) error {
- return os.Symlink("non-existing", filepath.Join(base, "test"))
- },
- "test",
- true,
- },
- {
- "non-directory",
- func(base string) error {
- return ioutil.WriteFile(filepath.Join(base, "test"), []byte{}, defaultPerm)
- },
- "test/directory",
- true,
- },
- {
- "non-directory-final",
- func(base string) error {
- return ioutil.WriteFile(filepath.Join(base, "test"), []byte{}, defaultPerm)
- },
- "test",
- false,
- },
- {
- "escape-with-relative-symlink",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir"), defaultPerm); err != nil {
- return err
- }
- if err := os.MkdirAll(filepath.Join(base, "exists"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("../exists", filepath.Join(base, "dir/test"))
- },
- "dir/test",
- true,
- },
- {
- "escape-with-relative-symlink-not-exists",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("../not-exists", filepath.Join(base, "dir/test"))
- },
- "dir/test",
- true,
- },
- {
- "escape-with-symlink",
- func(base string) error {
- return os.Symlink("/", filepath.Join(base, "test"))
- },
- "test",
- true,
- },
- {
- "mount-unix-socket",
- func(base string) error {
- socketFile, socketError := createSocketFile(base)
- if socketError != nil {
- return fmt.Errorf("Error preparing socket file %s with %v", socketFile, socketError)
- }
- return nil
- },
- "mt.sock",
- false,
- },
- {
- "mounting-unix-socket-in-middle",
- func(base string) error {
- testSocketFile, socketError := createSocketFile(base)
- if socketError != nil {
- return fmt.Errorf("Error preparing socket file %s with %v", testSocketFile, socketError)
- }
- return nil
- },
- "mt.sock/bar",
- true,
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "safe-open-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- test.prepare(base)
- pathToCreate := filepath.Join(base, test.path)
- fd, err := doSafeOpen(pathToCreate, base)
- if err != nil && !test.expectError {
- t.Errorf("test %q: %s", test.name, err)
- }
- if err != nil {
- klog.Infof("got error: %s", err)
- }
- if err == nil && test.expectError {
- t.Errorf("test %q: expected error, got none", test.name)
- }
- syscall.Close(fd)
- os.RemoveAll(base)
- }
- }
- func createSocketFile(socketDir string) (string, error) {
- testSocketFile := filepath.Join(socketDir, "mt.sock")
- // Switch to volume path and create the socket file
- // socket file can not have length of more than 108 character
- // and hence we must use relative path
- oldDir, _ := os.Getwd()
- err := os.Chdir(socketDir)
- if err != nil {
- return "", err
- }
- defer func() {
- os.Chdir(oldDir)
- }()
- _, socketCreateError := net.Listen("unix", "mt.sock")
- return testSocketFile, socketCreateError
- }
- func TestFindExistingPrefix(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) error
- path string
- expectedPath string
- expectedDirs []string
- expectError bool
- }{
- {
- "directory-does-not-exist",
- func(base string) error {
- return nil
- },
- "directory",
- "",
- []string{"directory"},
- false,
- },
- {
- "directory-exists",
- func(base string) error {
- return os.MkdirAll(filepath.Join(base, "test/directory"), 0750)
- },
- "test/directory",
- "test/directory",
- []string{},
- false,
- },
- {
- "follow-symlinks",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "destination/directory"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("destination", filepath.Join(base, "test"))
- },
- "test/directory",
- "test/directory",
- []string{},
- false,
- },
- {
- "follow-symlink-loop",
- func(base string) error {
- return os.Symlink("test", filepath.Join(base, "test"))
- },
- "test/directory",
- "",
- nil,
- true,
- },
- {
- "follow-symlink-multiple follow",
- func(base string) error {
- /* test1/dir points to test2 and test2/dir points to test1 */
- if err := os.MkdirAll(filepath.Join(base, "test1"), defaultPerm); err != nil {
- return err
- }
- if err := os.MkdirAll(filepath.Join(base, "test2"), defaultPerm); err != nil {
- return err
- }
- if err := os.Symlink(filepath.Join(base, "test2"), filepath.Join(base, "test1/dir")); err != nil {
- return err
- }
- if err := os.Symlink(filepath.Join(base, "test1"), filepath.Join(base, "test2/dir")); err != nil {
- return err
- }
- return nil
- },
- "test1/dir/dir/foo/bar",
- "test1/dir/dir",
- []string{"foo", "bar"},
- false,
- },
- {
- "danglink-symlink",
- func(base string) error {
- return os.Symlink("non-existing", filepath.Join(base, "test"))
- },
- // OS returns IsNotExist error both for dangling symlink and for
- // non-existing directory.
- "test/directory",
- "",
- []string{"test", "directory"},
- false,
- },
- {
- "with-fifo-in-middle",
- func(base string) error {
- testFifo := filepath.Join(base, "mount_test.fifo")
- return syscall.Mkfifo(testFifo, 0)
- },
- "mount_test.fifo/directory",
- "",
- nil,
- true,
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "find-prefix-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- test.prepare(base)
- path := filepath.Join(base, test.path)
- existingPath, dirs, err := findExistingPrefix(base, path)
- if err != nil && !test.expectError {
- t.Errorf("test %q: %s", test.name, err)
- }
- if err != nil {
- klog.Infof("got error: %s", err)
- }
- if err == nil && test.expectError {
- t.Errorf("test %q: expected error, got none", test.name)
- }
- fullExpectedPath := filepath.Join(base, test.expectedPath)
- if existingPath != fullExpectedPath {
- t.Errorf("test %q: expected path %q, got %q", test.name, fullExpectedPath, existingPath)
- }
- if !reflect.DeepEqual(dirs, test.expectedDirs) {
- t.Errorf("test %q: expected dirs %v, got %v", test.name, test.expectedDirs, dirs)
- }
- os.RemoveAll(base)
- }
- }
- func validateDirEmpty(dir string) error {
- files, err := ioutil.ReadDir(dir)
- if err != nil {
- return err
- }
- if len(files) != 0 {
- return fmt.Errorf("Directory %q is not empty", dir)
- }
- return nil
- }
- func validateDirExists(dir string) error {
- _, err := ioutil.ReadDir(dir)
- if err != nil {
- return err
- }
- return nil
- }
- func validateDirNotExists(dir string) error {
- _, err := ioutil.ReadDir(dir)
- if os.IsNotExist(err) {
- return nil
- }
- if err != nil {
- return err
- }
- return fmt.Errorf("dir %q still exists", dir)
- }
- func validateFileExists(file string) error {
- if _, err := os.Stat(file); err != nil {
- return err
- }
- return nil
- }
|