Skip to content

Commit 04891f8

Browse files
cowboncowbon
committed
Use Bad Request for invalid inputs in /chares
Use HTTP 400 Bad Request when the subattester fail to parse the input JSON tsructure, or the expcted length of the nonce doesn't match. Signed-off-by: Ian Chin Wang <[email protected]>
1 parent 94bebd6 commit 04891f8

File tree

7 files changed

+72
-29
lines changed

7 files changed

+72
-29
lines changed

‎api/server.go‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,18 @@ type Server struct {
2828
options string
2929
}
3030

31+
func responseCodeToHTTP(responseCode uint32) int {
32+
// Plugin should return 200 on success, 400 for caller input errors, and 500 for everything else.
33+
switch responseCode {
34+
case 200:
35+
return http.StatusOK
36+
case 400:
37+
return http.StatusBadRequest
38+
default:
39+
return http.StatusInternalServerError
40+
}
41+
}
42+
3143
func NewServer(logger *zap.SugaredLogger, manager plugin.IManager, options string) *Server {
3244
return &Server{
3345
logger: logger,
@@ -215,7 +227,7 @@ func (s *Server) RatsdChares(w http.ResponseWriter, r *http.Request, param Ratsd
215227
if !out.Status.Result {
216228
errMsg := fmt.Sprintf(
217229
"failed to get attestation report from %s: %s ", pn, out.Status.Error)
218-
p := problems.NewDetailedProblem(http.StatusInternalServerError, errMsg)
230+
p := problems.NewDetailedProblem(responseCodeToHTTP(out.StatusCode), errMsg)
219231
s.reportProblem(w, p)
220232
return false
221233
}

‎attesters/mocktsm/mocktsm.go‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package mocktsm
55
import (
66
"encoding/json"
77
"fmt"
8+
"net/http"
89
"strconv"
910

1011
"github.com/google/go-configfs-tsm/configfs/configfsi"
@@ -39,11 +40,12 @@ type MockPlugin struct {
3940
client *faketsm.Client
4041
}
4142

42-
func getEvidenceError(e error) *compositor.EvidenceOut {
43+
func getEvidenceError(e error, statusCode uint32) *compositor.EvidenceOut {
4344
return &compositor.EvidenceOut{
4445
Status: &compositor.Status{
4546
Result: false, Error: e.Error(),
4647
},
48+
StatusCode: statusCode,
4749
}
4850
}
4951

@@ -78,13 +80,13 @@ func (m *MockPlugin) GetEvidence(in *compositor.EvidenceIn) *compositor.Evidence
7880
errMsg := fmt.Errorf(
7981
"nonce size of the mockTSM attester should be %d, got %d",
8082
nonceSize, uint32(len(in.Nonce)))
81-
return getEvidenceError(errMsg)
83+
return getEvidenceError(errMsg, http.StatusBadRequest)
8284
}
8385

8486
if in.ContentType != mediaType {
8587
errMsg := fmt.Errorf(
8688
"no supported format in mock TSM plugin matches the requested format")
87-
return getEvidenceError(errMsg)
89+
return getEvidenceError(errMsg, http.StatusBadRequest)
8890
}
8991
req := &report.Request{
9092
InBlob: in.Nonce,
@@ -96,7 +98,7 @@ func (m *MockPlugin) GetEvidence(in *compositor.EvidenceIn) *compositor.Evidence
9698
if err := json.Unmarshal(in.Options, &options); err != nil {
9799
errMsg := fmt.Errorf(
98100
"failed to parse %s: %v", in.Options, err)
99-
return getEvidenceError(errMsg)
101+
return getEvidenceError(errMsg, http.StatusBadRequest)
100102
}
101103
}
102104

@@ -105,15 +107,15 @@ func (m *MockPlugin) GetEvidence(in *compositor.EvidenceIn) *compositor.Evidence
105107
if err != nil || level < 0 {
106108
errMsg := fmt.Errorf("privilege_level %s is invalid",
107109
privlevel)
108-
return getEvidenceError(errMsg)
110+
return getEvidenceError(errMsg, http.StatusBadRequest)
109111
}
110112
req.Privilege = &report.Privilege{Level: uint(level)}
111113
}
112114

113115
resp, err := report.Get(m.client, req)
114116
if err != nil {
115117
errMsg := fmt.Errorf("failed to get mock TSM report: %v", err)
116-
return getEvidenceError(errMsg)
118+
return getEvidenceError(errMsg, http.StatusInternalServerError)
117119
}
118120

119121
out := &tokens.TSMReport{
@@ -125,12 +127,13 @@ func (m *MockPlugin) GetEvidence(in *compositor.EvidenceIn) *compositor.Evidence
125127
outEncoded, err := out.ToJSON()
126128
if err != nil {
127129
errMsg := fmt.Errorf("failed to JSON encode mock TSM report: %v", err)
128-
return getEvidenceError(errMsg)
130+
return getEvidenceError(errMsg, http.StatusInternalServerError)
129131
}
130132

131133
return &compositor.EvidenceOut{
132134
Status: statusSucceeded,
133135
Evidence: outEncoded,
136+
StatusCode: http.StatusOK,
134137
}
135138
}
136139

‎attesters/mocktsm/mocktsm_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package mocktsm
55
import (
66
"encoding/hex"
77
"fmt"
8+
"net/http"
89
"testing"
910

1011
"github.com/stretchr/testify/assert"
@@ -65,6 +66,7 @@ func Test_GetEvidence_wrong_nonce_size(t *testing.T) {
6566
Result: false,
6667
Error: errMsg,
6768
},
69+
StatusCode: http.StatusBadRequest,
6870
}
6971

7072
assert.Equal(t, expected, p.GetEvidence(in))
@@ -82,6 +84,7 @@ func Test_GetEvidence_invalid_format(t *testing.T) {
8284
Result: false,
8385
Error: "no supported format in mock TSM plugin matches the requested format",
8486
},
87+
StatusCode: http.StatusBadRequest,
8588
}
8689

8790
assert.Equal(t, expected, p.GetEvidence(in))
@@ -106,6 +109,7 @@ func Test_GetEvidence_No_Options(t *testing.T) {
106109
expected := &compositor.EvidenceOut{
107110
Status: statusSucceeded,
108111
Evidence: outEncoded,
112+
StatusCode: http.StatusOK,
109113
}
110114

111115
assert.Equal(t, expected, p.GetEvidence(in))
@@ -134,6 +138,7 @@ func TestGetEvidence_With_Invalid_Options(t *testing.T) {
134138
Result: false,
135139
Error: tt.msg,
136140
},
141+
StatusCode: http.StatusBadRequest,
137142
}
138143

139144
assert.Equal(t, expected, p.GetEvidence(in))
@@ -161,6 +166,7 @@ func Test_GetEvidence_With_Valid_Privilege_level(t *testing.T) {
161166
expected := &compositor.EvidenceOut{
162167
Status: statusSucceeded,
163168
Evidence: outEncoded,
169+
StatusCode: http.StatusOK,
164170
}
165171

166172
assert.Equal(t, expected, p.GetEvidence(in))

‎attesters/tsm/tsm.go‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package tsm
55
import (
66
"encoding/json"
77
"fmt"
8+
"net/http"
89
"strconv"
910

1011
"github.com/google/go-configfs-tsm/configfs/linuxtsm"
@@ -41,11 +42,12 @@ var (
4142

4243
type TSMPlugin struct{}
4344

44-
func getEvidenceError(e error) *compositor.EvidenceOut {
45+
func getEvidenceError(e error, statusCode uint32) *compositor.EvidenceOut {
4546
return &compositor.EvidenceOut{
4647
Status: &compositor.Status{
4748
Result: false, Error: e.Error(),
4849
},
50+
StatusCode: statusCode,
4951
}
5052
}
5153

@@ -88,7 +90,7 @@ func (t *TSMPlugin) GetEvidence(in *compositor.EvidenceIn) *compositor.EvidenceO
8890
errMsg := fmt.Errorf(
8991
"nonce size of the TSM attester should be %d, got %d",
9092
tsmNonceSize, uint32(len(in.Nonce)))
91-
return getEvidenceError(errMsg)
93+
return getEvidenceError(errMsg, http.StatusBadRequest)
9294
}
9395

9496
for _, format := range supportedFormats {
@@ -103,7 +105,7 @@ func (t *TSMPlugin) GetEvidence(in *compositor.EvidenceIn) *compositor.EvidenceO
103105
if err := json.Unmarshal(in.Options, &options); err != nil {
104106
errMsg := fmt.Errorf(
105107
"failed to parse %s: %v", in.Options, err)
106-
return getEvidenceError(errMsg)
108+
return getEvidenceError(errMsg, http.StatusBadRequest)
107109
}
108110
}
109111

@@ -112,21 +114,21 @@ func (t *TSMPlugin) GetEvidence(in *compositor.EvidenceIn) *compositor.EvidenceO
112114
if err != nil || level < 0 {
113115
errMsg := fmt.Errorf("privilege_level %s is invalid",
114116
privlevel)
115-
return getEvidenceError(errMsg)
117+
return getEvidenceError(errMsg, http.StatusBadRequest)
116118
}
117119
req.Privilege = &report.Privilege{Level: uint(level)}
118120
}
119121

120122
client, err := linuxtsm.MakeClient()
121123
if err != nil {
122124
errMsg := fmt.Errorf("failed to create config TSM client: %v", err)
123-
return getEvidenceError(errMsg)
125+
return getEvidenceError(errMsg, http.StatusInternalServerError)
124126
}
125127

126128
resp, err := report.Get(client, req)
127129
if err != nil {
128130
errMsg := fmt.Errorf("failed to get TSM report: %v", err)
129-
return getEvidenceError(errMsg)
131+
return getEvidenceError(errMsg, http.StatusInternalServerError)
130132
}
131133

132134
out := &tokens.TSMReport{
@@ -148,16 +150,17 @@ func (t *TSMPlugin) GetEvidence(in *compositor.EvidenceIn) *compositor.EvidenceO
148150
outEncoded, err := encodeOp()
149151
if err != nil {
150152
errMsg := fmt.Errorf("failed to encode TSM report as %s: %v", encodeAs, err)
151-
return getEvidenceError(errMsg)
153+
return getEvidenceError(errMsg, http.StatusInternalServerError)
152154
}
153155

154156
return &compositor.EvidenceOut{
155157
Status: statusSucceeded,
156158
Evidence: outEncoded,
159+
StatusCode: http.StatusOK,
157160
}
158161
}
159162
}
160163

161164
errMsg := fmt.Errorf("no supported format in tsm plugin matches the requested format")
162-
return getEvidenceError(errMsg)
165+
return getEvidenceError(errMsg, http.StatusBadRequest)
163166
}

‎attesters/tsm/tsm_test.go‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ package tsm
44

55
import (
66
"fmt"
7+
"net/http"
78
"testing"
89

910
"github.com/google/go-configfs-tsm/configfs/linuxtsm"
@@ -20,15 +21,19 @@ var (
2021
)
2122

2223
func Test_getEvidenceError(t *testing.T) {
23-
e := fmt.Errorf("sample error")
24+
tests := []uint32 {http.StatusBadRequest, http.StatusBadRequest}
25+
for _, tt := range tests {
26+
e := fmt.Errorf("sample error")
2427

25-
expected := &compositor.EvidenceOut{
26-
Status: &compositor.Status{
27-
Result: false, Error: "sample error",
28-
},
29-
}
28+
expected := &compositor.EvidenceOut{
29+
Status: &compositor.Status{
30+
Result: false, Error: "sample error",
31+
},
32+
StatusCode: tt,
33+
}
3034

31-
assert.Equal(t, expected, getEvidenceError(e))
35+
assert.Equal(t, expected, getEvidenceError(e, tt))
36+
}
3237
}
3338

3439
func Test_GetOptions(t *testing.T) {
@@ -87,6 +92,7 @@ func Test_GetEvidence_wrong_nonce_size(t *testing.T) {
8792
Result: false,
8893
Error: errMsg,
8994
},
95+
StatusCode: http.StatusBadRequest,
9096
}
9197

9298
assert.Equal(t, expected, p.GetEvidence(in))
@@ -104,6 +110,7 @@ func Test_GetEvidence_invalid_format(t *testing.T) {
104110
Result: false,
105111
Error: "no supported format in tsm plugin matches the requested format",
106112
},
113+
StatusCode: http.StatusBadRequest,
107114
}
108115

109116
assert.Equal(t, expected, p.GetEvidence(in))
@@ -133,6 +140,7 @@ func TestGetEvidence_With_Invalid_Options(t *testing.T) {
133140
Result: false,
134141
Error: tt.msg,
135142
},
143+
StatusCode: http.StatusBadRequest,
136144
}
137145

138146
assert.Equal(t, expected, p.GetEvidence(in))

‎proto/compositor.proto‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,5 +60,6 @@ message EvidenceIn {
6060

6161
message EvidenceOut {
6262
Status status = 1;
63-
bytes evidence = 2;
63+
uint32 statusCode = 2;
64+
bytes evidence = 3;
6465
}

‎proto/compositor/compositor.pb.go‎

Lines changed: 15 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)