|
| 1 | +package extproc |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "sync/atomic" |
| 6 | + "testing" |
| 7 | + "time" |
| 8 | + |
| 9 | + extprocv3 "github.com/envoyproxy/go-control-plane/envoy/service/ext_proc/v3" |
| 10 | + |
| 11 | + "github.com/kagenti/kagenti-extensions/authbridge/authlib/listener/skiphost" |
| 12 | + "github.com/kagenti/kagenti-extensions/authbridge/authlib/pipeline" |
| 13 | + "github.com/kagenti/kagenti-extensions/authbridge/authlib/plugins/plugintesting" |
| 14 | + "github.com/kagenti/kagenti-extensions/authbridge/authlib/session" |
| 15 | +) |
| 16 | + |
| 17 | +// markerPlugin records one Invocation per OnRequest call so tests can |
| 18 | +// assert whether the outbound pipeline ran. Mirrors the helper in the |
| 19 | +// forwardproxy skiphost tests; kept local to avoid a public test-only |
| 20 | +// type in plugintesting. |
| 21 | +type markerPlugin struct { |
| 22 | + calls atomic.Int32 |
| 23 | +} |
| 24 | + |
| 25 | +func (p *markerPlugin) Name() string { return "marker" } |
| 26 | +func (p *markerPlugin) Capabilities() pipeline.PluginCapabilities { return pipeline.PluginCapabilities{} } |
| 27 | +func (p *markerPlugin) OnResponse(context.Context, *pipeline.Context) pipeline.Action { |
| 28 | + return pipeline.Action{Type: pipeline.Continue} |
| 29 | +} |
| 30 | + |
| 31 | +func (p *markerPlugin) OnRequest(_ context.Context, pctx *pipeline.Context) pipeline.Action { |
| 32 | + p.calls.Add(1) |
| 33 | + pctx.Record(pipeline.Invocation{ |
| 34 | + Plugin: "marker", |
| 35 | + Action: pipeline.ActionObserve, |
| 36 | + Phase: pipeline.InvocationPhaseRequest, |
| 37 | + Reason: "ran", |
| 38 | + }) |
| 39 | + return pipeline.Action{Type: pipeline.Continue} |
| 40 | +} |
| 41 | + |
| 42 | +func newSkipServer(t *testing.T, store *session.Store, skip *skiphost.Matcher) (*Server, *markerPlugin) { |
| 43 | + t.Helper() |
| 44 | + inbound, err := plugintesting.BuildPipeline([]pipeline.Plugin{}) |
| 45 | + if err != nil { |
| 46 | + t.Fatalf("building inbound pipeline: %v", err) |
| 47 | + } |
| 48 | + mp := &markerPlugin{} |
| 49 | + outbound, err := plugintesting.BuildPipeline([]pipeline.Plugin{mp}) |
| 50 | + if err != nil { |
| 51 | + t.Fatalf("building outbound pipeline: %v", err) |
| 52 | + } |
| 53 | + return &Server{ |
| 54 | + InboundPipeline: pipeline.NewHolder(inbound), |
| 55 | + OutboundPipeline: pipeline.NewHolder(outbound), |
| 56 | + Sessions: store, |
| 57 | + SkipHosts: skip, |
| 58 | + }, mp |
| 59 | +} |
| 60 | + |
| 61 | +// TestExtProc_SkipHosts_OutboundBypass asserts the headers-only outbound |
| 62 | +// path: a SkipHosts-matched destination produces zero plugin invocations |
| 63 | +// and zero session events, and the response is a plain pass-through. |
| 64 | +// The motivating case is OTel-collector traffic in envoy-sidecar |
| 65 | +// deployments — without this gate, every export from the agent would |
| 66 | +// run the pipeline and append a session event, evicting the inbound |
| 67 | +// A2A user intent from the FIFO buffer. |
| 68 | +func TestExtProc_SkipHosts_OutboundBypass(t *testing.T) { |
| 69 | + store := session.New(5*time.Minute, 100, 0) |
| 70 | + defer store.Close() |
| 71 | + |
| 72 | + // Match the agent's exgentic-style FQDN pattern: a leading-* glob |
| 73 | + // against the fixed suffix is the operator-friendly way to write |
| 74 | + // this and matches the hostname after net.SplitHostPort strips the |
| 75 | + // :8335 from pctx.Host. |
| 76 | + skip, err := skiphost.New([]string{"otel-collector.*.svc.cluster.local"}) |
| 77 | + if err != nil { |
| 78 | + t.Fatalf("skiphost.New: %v", err) |
| 79 | + } |
| 80 | + |
| 81 | + srv, mp := newSkipServer(t, store, skip) |
| 82 | + |
| 83 | + stream := &mockStream{ |
| 84 | + ctx: context.Background(), |
| 85 | + requests: []*extprocv3.ProcessingRequest{ |
| 86 | + outboundRequest(makeHeaders( |
| 87 | + ":authority", "otel-collector.kagenti-system.svc.cluster.local:8335", |
| 88 | + ":path", "/v1/traces", |
| 89 | + )), |
| 90 | + }, |
| 91 | + } |
| 92 | + |
| 93 | + _ = srv.Process(stream) |
| 94 | + |
| 95 | + if len(stream.responses) != 1 { |
| 96 | + t.Fatalf("expected 1 response, got %d", len(stream.responses)) |
| 97 | + } |
| 98 | + rh := stream.responses[0].GetRequestHeaders() |
| 99 | + if rh == nil { |
| 100 | + t.Fatal("expected RequestHeaders pass-through response") |
| 101 | + } |
| 102 | + if rh.Response != nil && rh.Response.HeaderMutation != nil && |
| 103 | + len(rh.Response.HeaderMutation.SetHeaders) > 0 { |
| 104 | + t.Error("skipped host must not have header mutations (pipeline did not run)") |
| 105 | + } |
| 106 | + if mp.calls.Load() != 0 { |
| 107 | + t.Errorf("pipeline ran %d times; want 0 — SkipHosts must short-circuit before pipeline.Run", mp.calls.Load()) |
| 108 | + } |
| 109 | + if sessions := store.ListSessions(); len(sessions) != 0 { |
| 110 | + t.Errorf("%d session(s) recorded; want 0 — SkipHosts must skip recording entirely", len(sessions)) |
| 111 | + } |
| 112 | +} |
| 113 | + |
| 114 | +// TestExtProc_SkipHosts_NonMatchingRunsPipeline is the regression guard: |
| 115 | +// with a SkipHosts list set, hosts that don't match must still run the |
| 116 | +// pipeline and have their Invocation recorded. Without this pairing, |
| 117 | +// the bypass test above could pass trivially with a globally disabled |
| 118 | +// pipeline. |
| 119 | +func TestExtProc_SkipHosts_NonMatchingRunsPipeline(t *testing.T) { |
| 120 | + store := session.New(5*time.Minute, 100, 0) |
| 121 | + defer store.Close() |
| 122 | + |
| 123 | + skip, err := skiphost.New([]string{"otel-collector*"}) |
| 124 | + if err != nil { |
| 125 | + t.Fatalf("skiphost.New: %v", err) |
| 126 | + } |
| 127 | + |
| 128 | + srv, mp := newSkipServer(t, store, skip) |
| 129 | + |
| 130 | + stream := &mockStream{ |
| 131 | + ctx: context.Background(), |
| 132 | + requests: []*extprocv3.ProcessingRequest{ |
| 133 | + outboundRequest(makeHeaders( |
| 134 | + ":authority", "github-tool-mcp:8000", |
| 135 | + ":path", "/mcp", |
| 136 | + )), |
| 137 | + }, |
| 138 | + } |
| 139 | + |
| 140 | + _ = srv.Process(stream) |
| 141 | + |
| 142 | + if mp.calls.Load() != 1 { |
| 143 | + t.Errorf("pipeline ran %d times; want 1 — host did not match skip list", mp.calls.Load()) |
| 144 | + } |
| 145 | + if sessions := store.ListSessions(); len(sessions) != 1 { |
| 146 | + t.Errorf("session count = %d; want 1 — Invocation should drive recording for non-skipped hosts", len(sessions)) |
| 147 | + } |
| 148 | +} |
| 149 | + |
| 150 | +// TestExtProc_SkipHosts_NilMatcherPreservesBehavior asserts the |
| 151 | +// upgrade-safety contract: a Server without SkipHosts (nil Matcher) |
| 152 | +// behaves identically to today's code. Pipeline runs, sessions record. |
| 153 | +func TestExtProc_SkipHosts_NilMatcherPreservesBehavior(t *testing.T) { |
| 154 | + store := session.New(5*time.Minute, 100, 0) |
| 155 | + defer store.Close() |
| 156 | + |
| 157 | + srv, mp := newSkipServer(t, store, nil) |
| 158 | + |
| 159 | + stream := &mockStream{ |
| 160 | + ctx: context.Background(), |
| 161 | + requests: []*extprocv3.ProcessingRequest{ |
| 162 | + outboundRequest(makeHeaders( |
| 163 | + ":authority", "any-service", |
| 164 | + ":path", "/", |
| 165 | + )), |
| 166 | + }, |
| 167 | + } |
| 168 | + |
| 169 | + _ = srv.Process(stream) |
| 170 | + |
| 171 | + if mp.calls.Load() != 1 { |
| 172 | + t.Errorf("nil SkipHosts: pipeline ran %d times, want 1", mp.calls.Load()) |
| 173 | + } |
| 174 | +} |
0 commit comments