v0.22.0 several enhancements and fixes for security, network, doc, test, packaging

internal/sink/httpchain/httpchain_test.go

@@ -1,6 +1,7 @@
 package httpchain
 
 import (
+	"context"
 	"crypto/tls"
 	"net"
 	"net/http"
@@ -16,6 +17,7 @@ import (
 	"logwisp/internal/config"
 	"logwisp/internal/core"
 	"logwisp/internal/session"
+	ingest "logwisp/internal/source/httpchain"
 	"logwisp/internal/testutil"
 
 	"github.com/lixenwraith/auth"
@@ -126,3 +128,75 @@ func TestRefusedTokenLogsInAgainAndDeliversOnce(t *testing.T) {
 		t.Fatalf("logins = %v, want 2", logins)
 	}
 }
+
+// The target URL brackets an IPv6 host and escapes its zone: a URL built
+// from the raw host could not even form a request.
+func TestTargetURLBracketsAnIPv6Host(t *testing.T) {
+	manager := session.NewManager(time.Hour)
+	t.Cleanup(manager.Stop)
+	for host, want := range map[string]string{
+		"::1":          "http://[::1]:9000/ingest",
+		"fe80::1%eth0": "http://[fe80::1%25eth0]:9000/ingest",
+	} {
+		created, err := NewHTTPChainSinkPlugin("fwd", map[string]any{"host": host, "port": int64(9000)},
+			log.NewLogger(), session.NewProxy(manager, "fwd"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got := created.(*HTTPChainSink).url; got != want {
+			t.Errorf("host %q: target %q, want %q", host, got, want)
+		}
+	}
+}
+
+// A link runs over the IPv6 loopback with TLS: the source binds ::1, and the
+// sink dials it and verifies the certificate's ::1 address.
+func TestLinkOverIPv6LoopbackWithTLS(t *testing.T) {
+	testutil.RequireIPv6(t)
+	pki := testutil.NewPKI(t, "edge-01")
+	probe, err := net.Listen("tcp6", "[::1]:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, port, _ := net.SplitHostPort(probe.Addr().String())
+	probe.Close()
+	p, _ := strconv.ParseInt(port, 10, 64)
+	manager := session.NewManager(time.Hour)
+	t.Cleanup(manager.Stop)
+
+	src, err := ingest.NewHTTPChainSourcePlugin("in", map[string]any{
+		"host": "::1", "port": p,
+		"tls": map[string]any{"enabled": true, "cert_file": pki.ServerCert, "key_file": pki.ServerKey},
+	}, log.NewLogger(), session.NewProxy(manager, "in"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	entries := src.Subscribe()
+	if err := src.Start(); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(src.Stop)
+
+	created, err := NewHTTPChainSinkPlugin("fwd", map[string]any{
+		"host": "::1", "port": p,
+		"tls": map[string]any{"enabled": true, "ca_file": pki.CA},
+	}, log.NewLogger(), session.NewProxy(manager, "fwd"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	sink := created.(*HTTPChainSink)
+	sink.append(core.TransportEvent{Time: time.Now(), Payload: []byte("over IPv6")})
+	ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
+	defer cancel()
+	if !sink.flush(ctx) || sink.droppedBatches.Load() != 0 {
+		t.Fatalf("batch not delivered: %d request errors", sink.requestErrors.Load())
+	}
+	select {
+	case e := <-entries:
+		if e.Message != "over IPv6" {
+			t.Fatalf("message %q", e.Message)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("the source published nothing")
+	}
+}