Merge "Update versions to fix security violations"
[dmaap/datarouter.git] / datarouter-prov / src / test / java / org / onap / dmaap / datarouter / provisioning / InternalServletTest.java
1 /*******************************************************************************
2  * ============LICENSE_START==================================================
3  * * org.onap.dmaap
4  * * ===========================================================================
5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.
6  * * ===========================================================================
7  * * Licensed under the Apache License, Version 2.0 (the "License");
8  * * you may not use this file except in compliance with the License.
9  * * You may obtain a copy of the License at
10  * *
11  *  *      http://www.apache.org/licenses/LICENSE-2.0
12  * *
13  *  * Unless required by applicable law or agreed to in writing, software
14  * * distributed under the License is distributed on an "AS IS" BASIS,
15  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  * * See the License for the specific language governing permissions and
17  * * limitations under the License.
18  * * ============LICENSE_END====================================================
19  * *
20  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.
21  * *
22  ******************************************************************************/
23 package org.onap.dmaap.datarouter.provisioning;
24
25 import static org.hamcrest.Matchers.notNullValue;
26 import static org.mockito.Matchers.anyString;
27 import static org.mockito.Matchers.argThat;
28 import static org.mockito.Matchers.eq;
29 import static org.mockito.Mockito.mock;
30 import static org.mockito.Mockito.verify;
31 import static org.mockito.Mockito.when;
32 import static org.onap.dmaap.datarouter.provisioning.BaseServlet.BEHALF_HEADER;
33
34 import java.io.File;
35 import java.net.InetAddress;
36 import javax.persistence.EntityManager;
37 import javax.persistence.EntityManagerFactory;
38 import javax.persistence.Persistence;
39 import javax.servlet.ServletInputStream;
40 import javax.servlet.ServletOutputStream;
41 import javax.servlet.http.HttpServletRequest;
42 import javax.servlet.http.HttpServletResponse;
43
44 import org.apache.commons.lang3.reflect.FieldUtils;
45 import org.junit.Before;
46 import org.junit.Test;
47 import org.junit.runner.RunWith;
48 import org.junit.BeforeClass;
49 import org.junit.AfterClass;
50 import org.mockito.Mock;
51
52 import org.onap.dmaap.datarouter.provisioning.beans.Deleteable;
53 import org.onap.dmaap.datarouter.provisioning.beans.Insertable;
54 import org.onap.dmaap.datarouter.provisioning.beans.LogRecord;
55 import org.onap.dmaap.datarouter.provisioning.beans.Updateable;
56 import org.powermock.api.mockito.PowerMockito;
57 import org.powermock.core.classloader.annotations.PrepareForTest;
58 import org.powermock.modules.junit4.PowerMockRunner;
59
60 @RunWith(PowerMockRunner.class)
61 @PrepareForTest(LogRecord.class)
62 public class InternalServletTest extends DrServletTestBase {
63   private static EntityManagerFactory emf;
64   private static EntityManager em;
65   private InternalServlet internalServlet;
66
67   @Mock
68   private HttpServletRequest request;
69
70   @Mock
71   private HttpServletResponse response;
72
73   @BeforeClass
74   public static void init() {
75     emf = Persistence.createEntityManagerFactory("dr-unit-tests");
76     em = emf.createEntityManager();
77     System.setProperty(
78             "org.onap.dmaap.datarouter.provserver.properties",
79             "src/test/resources/h2Database.properties");
80   }
81
82   @AfterClass
83   public static void tearDownClass() {
84     em.clear();
85     em.close();
86     emf.close();
87   }
88
89   @Before
90   public void setUp() throws Exception {
91     internalServlet = new InternalServlet();
92     setUpValidAuthorisedRequest();
93   }
94
95   @Test
96   public void Given_Request_Is_HTTP_GET_And_Address_Not_Authorized_When_HTTPS_Is_Required_Then_Forbidden_Response_Is_Generated()
97       throws Exception {
98     when(request.getRemoteAddr()).thenReturn("127.100.0.3");
99     internalServlet.doGet(request, response);
100     verify(response)
101         .sendError(eq(HttpServletResponse.SC_FORBIDDEN), argThat(notNullValue(String.class)));
102   }
103
104   @Test
105   public void Given_Request_Is_HTTP_GET_With_Halt_In_Endpoint_But_Not_Sent_From_Localhost_Then_Forbidden_Response_Is_Generated()
106       throws Exception {
107     when(request.getPathInfo()).thenReturn("/halt");
108     when(request.isSecure()).thenReturn(false);
109     when(request.getRemoteAddr()).thenReturn("127.100.0.3");
110     internalServlet.doGet(request, response);
111     verify(response).setStatus(eq(HttpServletResponse.SC_FORBIDDEN));
112   }
113
114   @Test
115   public void Given_Request_Is_HTTP_GET_With_Halt_In_Endpoint_Then_Request_Succeeds() throws Exception {
116     when(request.getPathInfo()).thenReturn("/halt");
117     when(request.isSecure()).thenReturn(false);
118     when(request.getRemoteAddr()).thenReturn("127.0.0.1");
119     internalServlet.doGet(request, response);
120     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
121   }
122
123   @Test
124   public void Given_Request_Is_HTTP_GET_With_FetchProv_In_Endpoint_Then_Request_Succeeds()
125       throws Exception {
126     when(request.getPathInfo()).thenReturn("/fetchProv");
127     when(request.isSecure()).thenReturn(false);
128     internalServlet.doGet(request, response);
129     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
130   }
131
132   @Test
133   public void Given_Request_Is_HTTP_GET_With_Prov_In_Endpoint_Then_Request_Succeeds() throws Exception {
134     when(request.getPathInfo()).thenReturn("/prov");
135     when(request.getQueryString()).thenReturn(null);
136     setPokerToNotCreateTimers();
137     ServletOutputStream outStream = mock(ServletOutputStream.class);
138     when(response.getOutputStream()).thenReturn(outStream);
139     internalServlet.doGet(request, response);
140     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
141   }
142
143   @Test
144   public void Given_Request_Is_HTTP_GET_With_Logs_In_Endpoint_Then_Request_Succeeds() throws Exception {
145     when(request.getPathInfo()).thenReturn("/logs/");
146     ServletOutputStream outStream = mock(ServletOutputStream.class);
147     when(response.getOutputStream()).thenReturn(outStream);
148     internalServlet.doGet(request, response);
149     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
150   }
151
152   @Test
153   public void Given_Request_Is_HTTP_GET_Starts_With_Logs_In_Endpoint_Then_Request_Succeeds()
154       throws Exception {
155     when(request.getPathInfo()).thenReturn("/logs/TestFile");
156     internalServlet.doGet(request, response);
157     verify(response)
158         .sendError(eq(HttpServletResponse.SC_NO_CONTENT), argThat(notNullValue(String.class)));
159   }
160
161   @Test
162   public void Given_Request_Is_HTTP_GET_Starts_With_Logs_In_Endpoint_And_File_Exists_Then_Request_Returns_Ok()
163       throws Exception {
164     when(request.getPathInfo()).thenReturn("/logs/testFile.txt");
165     File testFile = new File("unit-test-logs/testFile.txt");
166     testFile.createNewFile();
167     testFile.deleteOnExit();
168     ServletOutputStream outStream = mock(ServletOutputStream.class);
169     when(response.getOutputStream()).thenReturn(outStream);
170     internalServlet.doGet(request, response);
171     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
172   }
173
174   @Test
175   public void Given_Request_Is_HTTP_GET_With_Api_In_Endpoint_Then_Request_Succeeds() throws Exception {
176     when(request.getPathInfo()).thenReturn("/api/DELIVERY_MAX_RETRY_INTERVAL");
177     ServletOutputStream outStream = mock(ServletOutputStream.class);
178     when(response.getOutputStream()).thenReturn(outStream);
179     internalServlet.doGet(request, response);
180     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
181   }
182
183   @Test
184   public void Given_Request_Is_HTTP_GET_With_Drlogs_In_Endpoint_Then_Request_Succeeds()
185       throws Exception {
186     when(request.getPathInfo()).thenReturn("/drlogs/");
187     ServletOutputStream outStream = mock(ServletOutputStream.class);
188     when(response.getOutputStream()).thenReturn(outStream);
189     internalServlet.doGet(request, response);
190     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
191   }
192
193   @Test
194   public void Given_Request_Is_HTTP_GET_With_Incorrect_Endpoint_Then_No_Content_Response_Is_Generated()
195       throws Exception {
196     when(request.getPathInfo()).thenReturn("/incorrect/");
197     internalServlet.doGet(request, response);
198     verify(response)
199         .sendError(eq(HttpServletResponse.SC_NOT_FOUND), argThat(notNullValue(String.class)));
200   }
201
202   @Test
203   public void Given_Request_Is_HTTP_PUT_And_Address_Not_Authorized_When_HTTPS_Is_Required_Then_Forbidden_Response_Is_Generated()
204       throws Exception {
205     when(request.getRemoteAddr()).thenReturn("127.100.0.3");
206     FieldUtils.writeDeclaredStaticField(BaseServlet.class, "isAddressAuthEnabled", "true", true);
207     internalServlet.doPut(request, response);
208     verify(response)
209         .sendError(eq(HttpServletResponse.SC_FORBIDDEN), argThat(notNullValue(String.class)));
210   }
211
212   @Test
213   public void Given_Request_Is_HTTP_PUT_With_Api_In_Endpoint_Request_Succeeds() throws Exception {
214     when(request.getPathInfo()).thenReturn("/api/NODES");
215     String[] values = {"V", "a", "l", "u", "e", "s"};
216     when(request.getParameterValues(anyString())).thenReturn(values);
217     internalServlet = internalServerSuccess();
218     setPokerToNotCreateTimers();
219     internalServlet.doPut(request, response);
220     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
221   }
222
223   @Test
224   public void Given_Request_Is_HTTP_PUT_With_Api_In_Endpoint_And_Update_Fails_Then_Internal_Server_Error_Is_Generated()
225       throws Exception {
226     when(request.getPathInfo()).thenReturn("/api/NODES");
227     String[] values = {"V", "a", "l", "u", "e", "s"};
228     when(request.getParameterValues(anyString())).thenReturn(values);
229     internalServlet = internalServerFailure();
230     internalServlet.doPut(request, response);
231     verify(response).sendError(eq(HttpServletResponse.SC_INTERNAL_SERVER_ERROR),
232         argThat(notNullValue(String.class)));
233   }
234
235   @Test
236   public void Given_Request_Is_HTTP_PUT_With_Incorrect_Endpoint_Then_Not_Found_Error_Is_Generated()
237       throws Exception {
238     when(request.getPathInfo()).thenReturn("/incorrect");
239     internalServlet.doPut(request, response);
240     verify(response)
241         .sendError(eq(HttpServletResponse.SC_NOT_FOUND), argThat(notNullValue(String.class)));
242   }
243
244   @Test
245   public void Given_Request_Is_HTTP_DELETE_And_Address_Not_Authorized_When_HTTPS_Is_Required_Then_Forbidden_Response_Is_Generated()
246       throws Exception {
247     when(request.getRemoteAddr()).thenReturn("127.100.0.3");
248     FieldUtils.writeDeclaredStaticField(BaseServlet.class, "isAddressAuthEnabled", "true", true);
249     internalServlet.doDelete(request, response);
250     verify(response)
251         .sendError(eq(HttpServletResponse.SC_FORBIDDEN), argThat(notNullValue(String.class)));
252   }
253
254   @Test
255   public void Given_Request_Is_HTTP_DELETE_With_Api_In_Endpoint_Request_Succeeds()
256       throws Exception {
257     when(request.getPathInfo()).thenReturn("/api/NODES");
258     String[] values = {"V", "a", "l", "u", "e", "s"};
259     when(request.getParameterValues(anyString())).thenReturn(values);
260     internalServlet = internalServerSuccess();
261     setPokerToNotCreateTimers();
262     internalServlet.doDelete(request, response);
263     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
264   }
265
266   @Test
267   public void Given_Request_Is_HTTP_DELETE_With_Api_In_Endpoint_And_Delete_Fails_Then_Internal_Server_Error_Is_Generated()
268       throws Exception {
269     when(request.getPathInfo()).thenReturn("/api/NODES");
270     String[] values = {"V", "a", "l", "u", "e", "s"};
271     when(request.getParameterValues(anyString())).thenReturn(values);
272     internalServlet = internalServerFailure();
273     internalServlet.doDelete(request, response);
274     verify(response).sendError(eq(HttpServletResponse.SC_INTERNAL_SERVER_ERROR),
275         argThat(notNullValue(String.class)));
276   }
277
278   @Test
279   public void Given_Request_Is_HTTP_DELETE_With_Incorrect_Endpoint_Then_Not_Found_Error_Is_Generated()
280       throws Exception {
281     when(request.getPathInfo()).thenReturn("/incorrect");
282     internalServlet.doDelete(request, response);
283     verify(response)
284         .sendError(eq(HttpServletResponse.SC_NOT_FOUND), argThat(notNullValue(String.class)));
285   }
286
287   @Test
288   public void Given_Request_Is_HTTP_POST_And_Address_Not_Authorized_When_HTTPS_Is_Required_Then_Forbidden_Response_Is_Generated()
289       throws Exception {
290     when(request.getRemoteAddr()).thenReturn("127.100.0.3");
291     internalServlet.doPost(request, response);
292     verify(response)
293         .sendError(eq(HttpServletResponse.SC_FORBIDDEN), argThat(notNullValue(String.class)));
294   }
295
296   @Test
297   public void Given_Request_Is_HTTP_POST_With_Api_In_Endpoint_Request_Succeeds() throws Exception {
298     when(request.getPathInfo()).thenReturn("/api/key");
299     String[] values = {"V", "a", "l", "u", "e", "s"};
300     when(request.getParameterValues(anyString())).thenReturn(values);
301     internalServlet = internalServerSuccess();
302     setPokerToNotCreateTimers();
303     internalServlet.doPost(request, response);
304     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
305   }
306
307   @Test
308   public void Given_Request_Is_HTTP_POST_With_Api_In_Endpoint_And_Insert_Fails_Then_Internal_Server_Error_Is_Generated()
309       throws Exception {
310     when(request.getPathInfo()).thenReturn("/api/Key");
311     String[] values = {"V", "a", "l", "u", "e", "s"};
312     when(request.getParameterValues(anyString())).thenReturn(values);
313     internalServlet = internalServerFailure();
314     internalServlet.doPost(request, response);
315     verify(response).sendError(eq(HttpServletResponse.SC_INTERNAL_SERVER_ERROR),
316         argThat(notNullValue(String.class)));
317   }
318
319   @Test
320   public void Given_Request_Is_HTTP_POST_To_Logs_And_Content_Header_Is_Not_Supported_Type_Then_Unsupported_Media_Type_Response_Is_Generated()
321       throws Exception {
322     when(request.getHeader("Content-Type")).thenReturn("stub_contentType");
323     when(request.getPathInfo()).thenReturn("/logs/");
324     internalServlet.doPost(request, response);
325     verify(response).setStatus(eq(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE));
326   }
327
328   @Test
329   public void Given_Request_Is_HTTP_POST_To_Logs_And_Content_Encoding_Is_Not_Supported_Type_Then_Unsupported_Media_Type_Response_Is_Generated()
330       throws Exception {
331     when(request.getHeader("Content-Encoding")).thenReturn("not-supported");
332     when(request.getPathInfo()).thenReturn("/logs/");
333     internalServlet.doPost(request, response);
334     verify(response).setStatus(eq(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE));
335   }
336
337   @Test
338   public void Given_Request_Is_HTTP_POST_To_Logs_Then_Request_Succeeds()
339       throws Exception {
340     when(request.getHeader("Content-Encoding")).thenReturn("gzip");
341     when(request.getPathInfo()).thenReturn("/logs/");
342     ServletInputStream inStream = mock(ServletInputStream.class);
343     when(request.getInputStream()).thenReturn(inStream);
344     File testDir = new File("unit-test-logs/spool");
345     testDir.mkdirs();
346     testDir.deleteOnExit();
347     internalServlet.doPost(request, response);
348     verify(response).setStatus(eq(HttpServletResponse.SC_CREATED));
349   }
350
351   @Test
352   public void Given_Request_Is_HTTP_POST_To_Drlogs_And_Then_Unsupported_Media_Type_Response_Is_Generated()
353       throws Exception {
354     when(request.getHeader("Content-Type")).thenReturn("stub_contentType");
355     when(request.getPathInfo()).thenReturn("/drlogs/");
356     internalServlet.doPost(request, response);
357     verify(response).setStatus(eq(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE));
358   }
359
360   @Test
361   public void Given_Request_Is_HTTP_POST_To_Drlogs_And_Request_Succeeds() throws Exception {
362     when(request.getPathInfo()).thenReturn("/drlogs/");
363     ServletInputStream inStream = mock(ServletInputStream.class);
364     when(inStream.read()).thenReturn(1, -1);
365     when(request.getInputStream()).thenReturn(inStream);
366     PowerMockito.mockStatic(LogRecord.class);
367     internalServlet.doPost(request, response);
368     verify(response).setStatus(eq(HttpServletResponse.SC_OK));
369   }
370
371   @Test
372   public void Given_Request_Is_HTTP_POST_With_Incorrect_Endpoint_Then_Not_Found_Error_Is_Generated()
373       throws Exception {
374     when(request.getPathInfo()).thenReturn("/incorrect/");
375     internalServlet.doPost(request, response);
376     verify(response)
377         .sendError(eq(HttpServletResponse.SC_NOT_FOUND), argThat(notNullValue(String.class)));
378   }
379
380   private void setUpValidAuthorisedRequest() throws Exception {
381     setUpValidSecurityOnHttpRequest();
382     setBehalfHeader("Stub_Value");
383     setValidPathInfoInHttpHeader();
384     when(request.getHeader("Content-Type")).thenReturn("text/plain");
385     when(request.getHeader("Content-Encoding")).thenReturn("gzip");
386   }
387
388   private void setUpValidSecurityOnHttpRequest() throws Exception {
389     when(request.isSecure()).thenReturn(true);
390     when(request.getRemoteAddr()).thenReturn(InetAddress.getLocalHost().getHostAddress());
391     InetAddress[] nodeAddresses = new InetAddress[1];
392     nodeAddresses[0] = InetAddress.getLocalHost();
393     FieldUtils.writeDeclaredStaticField(BaseServlet.class, "nodeAddresses", nodeAddresses, true);
394     FieldUtils.writeDeclaredStaticField(BaseServlet.class, "requireCert", false, true);
395   }
396
397   private void setBehalfHeader(String headerValue) {
398     when(request.getHeader(BEHALF_HEADER)).thenReturn(headerValue);
399   }
400
401   private void setValidPathInfoInHttpHeader() {
402     when(request.getPathInfo()).thenReturn("/123");
403   }
404
405   private void setPokerToNotCreateTimers() throws Exception {
406     Poker poker = mock(Poker.class);
407     FieldUtils.writeDeclaredStaticField(Poker.class, "poker", poker, true);
408   }
409
410   private InternalServlet internalServerSuccess() {
411     InternalServlet internalServlet = new InternalServlet() {
412
413       protected boolean doUpdate(Updateable bean) {
414         return true;
415       }
416
417       protected boolean doDelete(Deleteable bean) {
418         return true;
419       }
420
421       protected boolean doInsert(Insertable bean) {
422         return true;
423       }
424     };
425     return internalServlet;
426   }
427
428   private InternalServlet internalServerFailure() {
429     InternalServlet internalServlet = new InternalServlet() {
430
431       protected boolean doUpdate(Updateable bean) {
432         return false;
433       }
434
435       protected boolean doDelete(Deleteable bean) {
436         return false;
437       }
438
439       protected boolean doInsert(Insertable bean) {
440         return false;
441       }
442     };
443     return internalServlet;
444   }
445 }