expand proxy tests to cover managed transport

Signed-off-by: Sanskar Jaiswal <[email protected]>
Co-authored-by: Paulo Gomes <[email protected]>

Author: aryan9600

pkg/git/strategy/proxy/strategy_proxy_test.go

@@ -29,17 +29,23 @@ import (
 
 	"github.com/elazarl/goproxy"
 	"github.com/fluxcd/pkg/gittestserver"
+	"github.com/go-logr/logr"
 	. "github.com/onsi/gomega"
 
 	"github.com/fluxcd/source-controller/pkg/git"
 	"github.com/fluxcd/source-controller/pkg/git/gogit"
 	"github.com/fluxcd/source-controller/pkg/git/libgit2"
+	"github.com/fluxcd/source-controller/pkg/git/libgit2/managed"
 	"github.com/fluxcd/source-controller/pkg/git/strategy"
 )
 
 // These tests are run in a different _test.go file because go-git uses the ProxyFromEnvironment function of the net/http package
 // which caches the Proxy settings, hence not including other tests in the same file ensures a clean proxy setup for the tests to run.
 func TestCheckoutStrategyForImplementation_Proxied(t *testing.T) {
+	// for libgit2 we are only testing for managed transport,
+	// as unmanaged is sunsetting.
+	// Unmanaged transport does not support HTTP_PROXY.
+	managed.InitManagedTransport(logr.Discard())
 
 	type cleanupFunc func()
 
@@ -62,8 +68,104 @@ func TestCheckoutStrategyForImplementation_Proxied(t *testing.T) {
 	proxyAddr := fmt.Sprintf("localhost:%d", l.Addr().(*net.TCPAddr).Port)
 	g.Expect(l.Close()).ToNot(HaveOccurred())
 
-	// Note there is no libgit2 HTTP_PROXY test as libgit2 doesnt support proxied HTTP requests.
 	cases := []testCase{
+		{
+			name:    "gogit_HTTP_PROXY",
+			gitImpl: gogit.Implementation,
+			url:     "http://example.com/bar/test-reponame",
+			branch:  "main",
+			setupGitProxy: func(g *WithT, proxy *goproxy.ProxyHttpServer, proxyGotRequest *bool) (*git.AuthOptions, cleanupFunc) {
+				// Create the git server.
+				gitServer, err := gittestserver.NewTempGitServer()
+				g.Expect(err).ToNot(HaveOccurred())
+
+				username := "test-user"
+				password := "test-password"
+				gitServer.Auth(username, password)
+				gitServer.KeyDir(gitServer.Root())
+
+				g.Expect(gitServer.StartHTTP()).ToNot(HaveOccurred())
+
+				// Initialize a git repo.
+				err = gitServer.InitRepo("../testdata/repo1", "main", "bar/test-reponame")
+				g.Expect(err).ToNot(HaveOccurred())
+
+				u, err := url.Parse(gitServer.HTTPAddress())
+				g.Expect(err).ToNot(HaveOccurred())
+
+				// The request is being forwarded to the local test git server in this handler.
+				var proxyHandler goproxy.FuncReqHandler = func(req *http.Request, ctx *goproxy.ProxyCtx) (*http.Request, *http.Response) {
+					userAgent := req.Header.Get("User-Agent")
+					if strings.Contains(req.Host, "example.com") && strings.Contains(userAgent, "git") {
+						*proxyGotRequest = true
+						req.Host = u.Host
+						req.URL.Host = req.Host
+						return req, nil
+					}
+					// Reject if it isnt our request.
+					return req, goproxy.NewResponse(req, goproxy.ContentTypeText, http.StatusForbidden, "")
+				}
+				proxy.OnRequest().Do(proxyHandler)
+
+				return &git.AuthOptions{
+						Transport: git.HTTP,
+						Username:  username,
+						Password:  password,
+					}, func() {
+						os.RemoveAll(gitServer.Root())
+						gitServer.StopHTTP()
+					}
+			},
+			shortTimeout:  false,
+			wantUsedProxy: true,
+			wantError:     false,
+		},
+		{
+			name:    "gogit_HTTPS_PROXY",
+			gitImpl: gogit.Implementation,
+			url:     "https://github.com/git-fixtures/basic",
+			branch:  "master",
+			setupGitProxy: func(g *WithT, proxy *goproxy.ProxyHttpServer, proxyGotRequest *bool) (*git.AuthOptions, cleanupFunc) {
+				var proxyHandler goproxy.FuncHttpsHandler = func(host string, ctx *goproxy.ProxyCtx) (*goproxy.ConnectAction, string) {
+					// We don't check for user agent as this handler is only going to process CONNECT requests, and because Go's net/http
+					// is the one making such a request on behalf of go-git, adding a check for the go net/http user agent (Go-http-client)
+					// would only allow false positives from any request originating from Go's net/http.
+					if strings.Contains(host, "github.com") {
+						*proxyGotRequest = true
+						return goproxy.OkConnect, host
+					}
+					// Reject if it isnt our request.
+					return goproxy.RejectConnect, host
+				}
+				proxy.OnRequest().HandleConnect(proxyHandler)
+
+				// go-git does not allow to use an HTTPS proxy and a custom root CA at the same time.
+				// See https://github.com/fluxcd/source-controller/pull/524#issuecomment-1006673163.
+				return nil, func() {}
+			},
+			shortTimeout:  false,
+			wantUsedProxy: true,
+			wantError:     false,
+		},
+		{
+			name:    "gogit_NO_PROXY",
+			gitImpl: gogit.Implementation,
+			url:     "https://192.0.2.1/bar/test-reponame",
+			branch:  "main",
+			setupGitProxy: func(g *WithT, proxy *goproxy.ProxyHttpServer, proxyGotRequest *bool) (*git.AuthOptions, cleanupFunc) {
+				var proxyHandler goproxy.FuncHttpsHandler = func(host string, ctx *goproxy.ProxyCtx) (*goproxy.ConnectAction, string) {
+					// We shouldn't hit the proxy so we just want to check for any interaction, then reject.
+					*proxyGotRequest = true
+					return goproxy.RejectConnect, host
+				}
+				proxy.OnRequest().HandleConnect(proxyHandler)
+
+				return nil, func() {}
+			},
+			shortTimeout:  true,
+			wantUsedProxy: false,
+			wantError:     true,
+		},
 		{
 			name:    "libgit2_HTTPS_PROXY",
 			gitImpl: libgit2.Implementation,
@@ -100,6 +202,7 @@ func TestCheckoutStrategyForImplementation_Proxied(t *testing.T) {
 				// The request is being forwarded to the local test git server in this handler.
 				// The certificate used here is valid for both example.com and localhost.
 				var proxyHandler goproxy.FuncHttpsHandler = func(host string, ctx *goproxy.ProxyCtx) (*goproxy.ConnectAction, string) {
+					defer managed.RemoveTransportOptions("https://example.com/bar/test-reponame")
 					// Check if the host matches with the git server address and the user-agent is the expected git client.
 					userAgent := ctx.Req.Header.Get("User-Agent")
 					if strings.Contains(host, "example.com") && strings.Contains(userAgent, "libgit2") {
@@ -112,10 +215,11 @@ func TestCheckoutStrategyForImplementation_Proxied(t *testing.T) {
 				proxy.OnRequest().HandleConnect(proxyHandler)
 
 				return &git.AuthOptions{
-						Transport: git.HTTPS,
-						Username:  username,
-						Password:  password,
-						CAFile:    exampleCA,
+						Transport:           git.HTTPS,
+						Username:            username,
+						Password:            password,
+						CAFile:              exampleCA,
+						TransportOptionsURL: "https://proxy-test",
 					}, func() {
 						os.RemoveAll(gitServer.Root())
 						gitServer.StopHTTP()
@@ -126,33 +230,31 @@ func TestCheckoutStrategyForImplementation_Proxied(t *testing.T) {
 			wantError:     false,
 		},
 		{
-			name:    "gogit_HTTP_PROXY",
-			gitImpl: gogit.Implementation,
+			name:    "libgit2_HTTP_PROXY",
+			gitImpl: libgit2.Implementation,
 			url:     "http://example.com/bar/test-reponame",
 			branch:  "main",
 			setupGitProxy: func(g *WithT, proxy *goproxy.ProxyHttpServer, proxyGotRequest *bool) (*git.AuthOptions, cleanupFunc) {
 				// Create the git server.
 				gitServer, err := gittestserver.NewTempGitServer()
 				g.Expect(err).ToNot(HaveOccurred())
 
-				username := "test-user"
-				password := "test-password"
-				gitServer.Auth(username, password)
-				gitServer.KeyDir(gitServer.Root())
-
-				g.Expect(gitServer.StartHTTP()).ToNot(HaveOccurred())
+				err = gitServer.StartHTTP()
+				g.Expect(err).ToNot(HaveOccurred())
 
 				// Initialize a git repo.
-				err = gitServer.InitRepo("../testdata/repo1", "main", "bar/test-reponame")
+				repoPath := "bar/test-reponame"
+				err = gitServer.InitRepo("../testdata/repo1", "main", repoPath)
 				g.Expect(err).ToNot(HaveOccurred())
 
 				u, err := url.Parse(gitServer.HTTPAddress())
 				g.Expect(err).ToNot(HaveOccurred())
 
 				// The request is being forwarded to the local test git server in this handler.
+				// The certificate used here is valid for both example.com and localhost.
 				var proxyHandler goproxy.FuncReqHandler = func(req *http.Request, ctx *goproxy.ProxyCtx) (*http.Request, *http.Response) {
 					userAgent := req.Header.Get("User-Agent")
-					if strings.Contains(req.Host, "example.com") && strings.Contains(userAgent, "git") {
+					if strings.Contains(req.Host, "example.com") && strings.Contains(userAgent, "libgit2") {
 						*proxyGotRequest = true
 						req.Host = u.Host
 						req.URL.Host = req.Host
@@ -164,9 +266,8 @@ func TestCheckoutStrategyForImplementation_Proxied(t *testing.T) {
 				proxy.OnRequest().Do(proxyHandler)
 
 				return &git.AuthOptions{
-						Transport: git.HTTP,
-						Username:  username,
-						Password:  password,
+						Transport:           git.HTTP,
+						TransportOptionsURL: "http://proxy-test",
 					}, func() {
 						os.RemoveAll(gitServer.Root())
 						gitServer.StopHTTP()
@@ -177,35 +278,8 @@ func TestCheckoutStrategyForImplementation_Proxied(t *testing.T) {
 			wantError:     false,
 		},
 		{
-			name:    "gogit_HTTPS_PROXY",
-			gitImpl: gogit.Implementation,
-			url:     "https://github.com/git-fixtures/basic",
-			branch:  "master",
-			setupGitProxy: func(g *WithT, proxy *goproxy.ProxyHttpServer, proxyGotRequest *bool) (*git.AuthOptions, cleanupFunc) {
-				var proxyHandler goproxy.FuncHttpsHandler = func(host string, ctx *goproxy.ProxyCtx) (*goproxy.ConnectAction, string) {
-					// We don't check for user agent as this handler is only going to process CONNECT requests, and because Go's net/http
-					// is the one making such a request on behalf of go-git, adding a check for the go net/http user agent (Go-http-client)
-					// would only allow false positives from any request originating from Go's net/http.
-					if strings.Contains(host, "github.com") {
-						*proxyGotRequest = true
-						return goproxy.OkConnect, host
-					}
-					// Reject if it isnt our request.
-					return goproxy.RejectConnect, host
-				}
-				proxy.OnRequest().HandleConnect(proxyHandler)
-
-				// go-git does not allow to use an HTTPS proxy and a custom root CA at the same time.
-				// See https://github.com/fluxcd/source-controller/pull/524#issuecomment-1006673163.
-				return nil, func() {}
-			},
-			shortTimeout:  false,
-			wantUsedProxy: true,
-			wantError:     false,
-		},
-		{
-			name:    "gogit_NO_PROXY",
-			gitImpl: gogit.Implementation,
+			name:    "libgit2_NO_PROXY",
+			gitImpl: libgit2.Implementation,
 			url:     "https://192.0.2.1/bar/test-reponame",
 			branch:  "main",
 			setupGitProxy: func(g *WithT, proxy *goproxy.ProxyHttpServer, proxyGotRequest *bool) (*git.AuthOptions, cleanupFunc) {
@@ -218,13 +292,10 @@ func TestCheckoutStrategyForImplementation_Proxied(t *testing.T) {
 
 				return nil, func() {}
 			},
-			shortTimeout:  true,
+			shortTimeout:  false,
 			wantUsedProxy: false,
 			wantError:     true,
 		},
-		// TODO: Add a NO_PROXY test for libgit2 once the version of libgit2 used by the source controller is updated to a version that includes
-		// the NO_PROXY functionality
-		// This PR introduces the functionality in libgit2: https://github.com/libgit2/libgit2/pull/6026
 	}
 
 	for _, tt := range cases {
@@ -282,7 +353,6 @@ func TestCheckoutStrategyForImplementation_Proxied(t *testing.T) {
 			}
 
 			g.Expect(proxyGotRequest).To(Equal(tt.wantUsedProxy))
-
 		})
 	}
 }