cmd/telemetrygodev: validate reports during upload request

Added report validation to upload requests. Upload requests will fail if
- The report is missing or invalid values for X, Config, or Week.
- The report contains programs, counters, or stacks that aren't registered
in the latest upload config.

Change-Id: I8f4f945456f02897eda1f455c725b5a82d675f5d
Reviewed-on: https://go-review.googlesource.com/c/telemetry/+/503761
TryBot-Result: Gopher Robot <[email protected]>
Run-TryBot: Jamal Carvalho <[email protected]>
Reviewed-by: Hyang-Ah Hana Kim <[email protected]>

Author: jamalc

godev/cmd/telemetrygodev/README.md

@@ -14,11 +14,12 @@ cloud storage emulator and use the -gcs flag to use the Cloud Storage API.
 
 ### Environment Variables
 
-| Name                               | Default        | Description                                               |
-| ---------------------------------- | -------------- | --------------------------------------------------------- |
-| GO_TELEMETRY_PROJECT_ID            | go-telemetry   | GCP project ID                                            |
-| GO_TELEMETRY_STORAGE_EMULATOR_HOST | localhost:8081 | Host for the Cloud Storage emulator                       |
-| GO_TELEMETRY_LOCAL_STORAGE         | .localstorage  | Directory for storage emulator I/O or file system storage |
+| Name                               | Default               | Description                                               |
+| ---------------------------------- | --------------------- | --------------------------------------------------------- |
+| GO_TELEMETRY_PROJECT_ID            | go-telemetry          | GCP project ID                                            |
+| GO_TELEMETRY_STORAGE_EMULATOR_HOST | localhost:8081        | Host for the Cloud Storage emulator                       |
+| GO_TELEMETRY_LOCAL_STORAGE         | .localstorage         | Directory for storage emulator I/O or file system storage |
+| GO_TELEMETRY_UPLOAD_CONFIG         | ../config/config.json | Location of the upload config used for report validation  |
 
 ## Testing
 

godev/cmd/telemetrygodev/config.go

@@ -26,6 +26,10 @@ type config struct {
 	// UploadBucket is the storage bucket for report uploads.
 	UploadBucket string
 
+	// UploadConfig is the location of the upload config deployed with the server.
+	// It's used to validate telemetry uploads.
+	UploadConfig string
+
 	// UseGCS is true if the server should use the Cloud Storage API for reading and
 	// writing storage objects.
 	UseGCS bool
@@ -62,6 +66,7 @@ func newConfig() *config {
 		StorageEmulatorHost: env("GO_TELEMETRY_STORAGE_EMULATOR_HOST", "localhost:8081"),
 		LocalStorage:        env("GO_TELEMETRY_LOCAL_STORAGE", ".localstorage"),
 		UploadBucket:        service + "-uploaded",
+		UploadConfig:        env("GO_TELEMETRY_UPLOAD_CONFIG", "../config/config.json"),
 		UseGCS:              *useGCS,
 		DevMode:             *devMode,
 	}

godev/cmd/telemetrygodev/config_test.go

@@ -16,6 +16,7 @@ func TestConfig(t *testing.T) {
 		StorageEmulatorHost: "localhost:8081",
 		LocalStorage:        ".localstorage",
 		UploadBucket:        "local-telemetry-uploaded",
+		UploadConfig:        "../config/config.json",
 	}
 	if got := newConfig(); !reflect.DeepEqual(got, want) {
 		t.Errorf("Config() = %v, want %v", got, want)

godev/cmd/telemetrygodev/main.go

@@ -7,6 +7,7 @@ package main
 
 import (
 	"context"
+	_ "embed"
 	"encoding/json"
 	"flag"
 	"fmt"
@@ -15,13 +16,16 @@ import (
 	"net/http"
 	"os"
 	"path"
+	"time"
 
+	"golang.org/x/mod/semver"
 	"golang.org/x/telemetry"
 	"golang.org/x/telemetry/godev"
 	"golang.org/x/telemetry/godev/internal/content"
 	"golang.org/x/telemetry/godev/internal/middleware"
 	"golang.org/x/telemetry/godev/internal/storage"
 	"golang.org/x/telemetry/godev/internal/unionfs"
+	"golang.org/x/telemetry/godev/internal/upload"
 )
 
 func main() {
@@ -32,26 +36,31 @@ func main() {
 	if err != nil {
 		log.Fatal(err)
 	}
+	ucfg, err := upload.ReadConfig(cfg.UploadConfig)
+	if err != nil {
+		log.Fatal(err)
+	}
 	fsys := fsys(cfg.DevMode)
 	cserv := content.Server(fsys)
 	mux := http.NewServeMux()
 
 	mux.Handle("/", cserv)
-	mux.Handle("/upload/", handleUpload(store))
+	mux.Handle("/upload/", handleUpload(ucfg, store))
 
 	fmt.Printf("server listening at http://localhost:%s\n", cfg.Port)
 	log.Fatal(http.ListenAndServe(":"+cfg.Port, middleware.Default(mux)))
 }
 
-func handleUpload(store storage.Store) content.HandlerFunc {
+func handleUpload(ucfg *upload.Config, store storage.Store) content.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) error {
 		if r.Method == "POST" {
 			var report telemetry.Report
 			if err := json.NewDecoder(r.Body).Decode(&report); err != nil {
 				return err
 			}
-			// TODO: validate the report, checking that the counters and stacks contained are things
-			// we want to collect and file name is something reasonable.
+			if err := validate(&report, ucfg); err != nil {
+				return content.Error(err, http.StatusBadRequest)
+			}
 			// TODO: capture metrics for collisions.
 			ctx := r.Context()
 			name := fmt.Sprintf("%s/%g.json", report.Week, report.X)
@@ -66,12 +75,48 @@ func handleUpload(store storage.Store) content.HandlerFunc {
 			if err := f.Close(); err != nil {
 				return err
 			}
-			return content.Text(w, "ok", http.StatusOK)
+			return content.Status(w, http.StatusOK)
 		}
 		return content.Status(w, http.StatusMethodNotAllowed)
 	}
 }
 
+// validate validates the telemetry report data against the latest config.
+func validate(r *telemetry.Report, cfg *upload.Config) error {
+	// TODO: reject/drop data arrived too early or too late.
+	if _, err := time.Parse("2006-01-02", r.Week); err != nil {
+		return fmt.Errorf("invalid week %s", r.Week)
+	}
+	if !semver.IsValid(r.Config) {
+		return fmt.Errorf("invalid config %s", r.Config)
+	}
+	if r.X == 0 {
+		return fmt.Errorf("invalid X %g", r.X)
+	}
+	// TODO: We can probably keep known programs and counters even when a report
+	// includes something that has been removed from the latest config.
+	for _, p := range r.Programs {
+		if !cfg.HasGOARCH(p.GOARCH) ||
+			!cfg.HasGOOS(p.GOOS) ||
+			!cfg.HasGoVersion(p.GoVersion) ||
+			!cfg.HasProgram(p.Program) ||
+			!cfg.HasVersion(p.Program, p.Version) {
+			return fmt.Errorf("unknown program build %s@%s %s %s/%s", p.Program, p.Version, p.GoVersion, p.GOOS, p.GOARCH)
+		}
+		for c := range p.Counters {
+			if !cfg.HasCounter(p.Program, c) {
+				return fmt.Errorf("unknown counter %s", c)
+			}
+		}
+		for s := range p.Stacks {
+			if !cfg.HasStack(p.Program, s) {
+				return fmt.Errorf("unknown stack %s", s)
+			}
+		}
+	}
+	return nil
+}
+
 func fsys(fromOS bool) fs.FS {
 	var f fs.FS = godev.FS
 	if fromOS {

godev/cmd/telemetrygodev/main_test.go

@@ -0,0 +1,71 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package main
+
+import (
+	_ "embed"
+	"testing"
+
+	"golang.org/x/telemetry"
+	"golang.org/x/telemetry/godev/internal/upload"
+)
+
+func TestValidate(t *testing.T) {
+	cfg, err := upload.ReadConfig("testdata/config.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tests := []struct {
+		name    string
+		report  *telemetry.Report
+		wantErr bool
+	}{
+		{
+			name:    "empty report",
+			report:  &telemetry.Report{},
+			wantErr: true,
+		},
+		{
+			name: "valid report with no counters",
+			report: &telemetry.Report{
+				Week:     "2023-06-15",
+				LastWeek: "",
+				X:        0.1,
+				Programs: []*telemetry.ProgramReport{},
+				Config:   "v0.0.1-test",
+			},
+			wantErr: false,
+		},
+		{
+			name: "valid report with counters",
+			report: &telemetry.Report{
+				Week:     "2023-06-15",
+				LastWeek: "",
+				X:        0.1,
+				Programs: []*telemetry.ProgramReport{
+					{
+						Program:   "golang.org/x/tools/gopls",
+						Version:   "v0.10.1",
+						GoVersion: "go1.20.1",
+						GOOS:      "linux",
+						GOARCH:    "arm64",
+						Counters: map[string]int64{
+							"editor:vim": 100,
+						},
+					},
+				},
+				Config: "v0.0.1-test",
+			},
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := validate(tt.report, cfg); (err != nil) != tt.wantErr {
+				t.Errorf("validate() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}

godev/cmd/telemetrygodev/testdata/config.json

@@ -0,0 +1,43 @@
+{
+  "Version": "v0.0.1-test",
+  "GOOS": [
+    "linux",
+    "darwin"
+  ],
+  "GOARCH": [
+    "amd64",
+    "arm64"
+  ],
+  "GoVersion": [
+    "go1.20",
+    "go1.20.1"
+  ],
+  "Programs": [
+    {
+      "Name": "golang.org/x/tools/gopls",
+      "Versions": [
+        "v0.10.1",
+        "v0.11.0"
+      ],
+      "Counters": [
+        {
+          "Name": "editor:{emacs,vim,vscode,other}",
+          "Rate": 0.01
+        }
+      ]
+    },
+    {
+      "Name": "cmd/go",
+      "Versions": [
+        "v0.10.1",
+        "v0.11.0"
+      ],
+      "Counters": [
+        {
+          "Name": "go/buildcache/miss:{0,0.1,0.2,0.5,1,10,100,2,20,5,50}",
+          "Rate": 0.01
+        }
+      ]
+    }
+  ]
+}

godev/go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/google/go-cmp v0.5.9
 	github.com/yuin/goldmark v1.5.4
 	golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1
+	golang.org/x/mod v0.10.0
 	golang.org/x/telemetry v0.0.0-00010101000000-000000000000
 )
 

godev/go.sum

@@ -263,6 +263,8 @@ golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=