From 8cc60e6896b7c030891a3578ae2405a14b2fed49 Mon Sep 17 00:00:00 2001 From: Mark Sargent <99003+sarge@users.noreply.github.com> Date: Mon, 23 Mar 2020 13:08:02 +1300 Subject: ci: test local CA and update SNI tests (#3145) * run caddy tests in process * call main with run args * exclude tests - windows * include json example * disable caddyfile tests, include json test with non trusted local ca * converted SNI tests to json syntax --- caddytest/integration/caddyfile_test.go | 68 -------- caddytest/integration/sni_test.go | 277 ++++++++++++++++++++++++++++++++ 2 files changed, 277 insertions(+), 68 deletions(-) create mode 100644 caddytest/integration/sni_test.go (limited to 'caddytest/integration') diff --git a/caddytest/integration/caddyfile_test.go b/caddytest/integration/caddyfile_test.go index 3e89a26..dd3dcba 100644 --- a/caddytest/integration/caddyfile_test.go +++ b/caddytest/integration/caddyfile_test.go @@ -66,71 +66,3 @@ func TestDuplicateHosts(t *testing.T) { "caddyfile", "duplicate site address not allowed") } - -func TestDefaultSNI(t *testing.T) { - - // arrange - caddytest.InitServer(t, ` - { - http_port 9080 - https_port 9443 - default_sni *.caddy.localhost - } - - 127.0.0.1:9443 { - tls /caddy.localhost.crt /caddy.localhost.key - respond /version 200 { - body "hello from a" - } - } - `, "caddyfile") - - // act and assert - caddytest.AssertGetResponse(t, "https://127.0.0.1:9443/version", 200, "hello from a") -} - -func TestDefaultSNIWithNamedHostAndExplicitIP(t *testing.T) { - - // arrange - caddytest.InitServer(t, ` - { - http_port 9080 - https_port 9443 - default_sni a.caddy.localhost - } - - a.caddy.localhost:9443, 127.0.0.1:9443 { - tls /a.caddy.localhost.crt /a.caddy.localhost.key - respond /version 200 { - body "hello from a" - } - } - `, "caddyfile") - - // act and assert - // makes a request with no sni - caddytest.AssertGetResponse(t, "https://127.0.0.1:9443/version", 200, "hello from a") -} - -func TestDefaultSNIWithPortMappingOnly(t *testing.T) { - - // arrange - caddytest.InitServer(t, ` - { - http_port 9080 - https_port 9443 - default_sni a.caddy.localhost - } - - :9443 { - tls /a.caddy.localhost.crt /a.caddy.localhost.key - respond /version 200 { - body "hello from a.caddy.localhost" - } - } - `, "caddyfile") - - // act and assert - // makes a request with no sni - caddytest.AssertGetResponse(t, "https://127.0.0.1:9443/version", 200, "hello from a") -} diff --git a/caddytest/integration/sni_test.go b/caddytest/integration/sni_test.go new file mode 100644 index 0000000..d329782 --- /dev/null +++ b/caddytest/integration/sni_test.go @@ -0,0 +1,277 @@ +package integration + +import ( + "testing" + + "github.com/caddyserver/caddy/v2/caddytest" +) + +func TestDefaultSNI(t *testing.T) { + + // arrange + caddytest.InitServer(t, `{ + "apps": { + "http": { + "http_port": 9080, + "https_port": 9443, + "servers": { + "srv0": { + "listen": [ + ":9443" + ], + "routes": [ + { + "handle": [ + { + "handler": "subroute", + "routes": [ + { + "handle": [ + { + "body": "hello from a.caddy.localhost", + "handler": "static_response", + "status_code": 200 + } + ], + "match": [ + { + "path": [ + "/version" + ] + } + ] + } + ] + } + ], + "match": [ + { + "host": [ + "127.0.0.1" + ] + } + ], + "terminal": true + } + ], + "tls_connection_policies": [ + { + "certificate_selection": { + "policy": "custom", + "tag": "cert0" + }, + "match": { + "sni": [ + "127.0.0.1" + ] + } + }, + { + "default_sni": "*.caddy.localhost" + } + ] + } + } + }, + "tls": { + "certificates": { + "load_files": [ + { + "certificate": "/caddy.localhost.crt", + "key": "/caddy.localhost.key", + "tags": [ + "cert0" + ] + } + ] + } + }, + "pki": { + "certificate_authorities" : { + "local" : { + "install_trust": false + } + } + } + } + } + `, "json") + + // act and assert + // makes a request with no sni + caddytest.AssertGetResponse(t, "https://127.0.0.1:9443/version", 200, "hello from a") +} + +func TestDefaultSNIWithNamedHostAndExplicitIP(t *testing.T) { + + // arrange + caddytest.InitServer(t, ` + { + "apps": { + "http": { + "http_port": 9080, + "https_port": 9443, + "servers": { + "srv0": { + "listen": [ + ":9443" + ], + "routes": [ + { + "handle": [ + { + "handler": "subroute", + "routes": [ + { + "handle": [ + { + "body": "hello from a", + "handler": "static_response", + "status_code": 200 + } + ], + "match": [ + { + "path": [ + "/version" + ] + } + ] + } + ] + } + ], + "match": [ + { + "host": [ + "a.caddy.localhost", + "127.0.0.1" + ] + } + ], + "terminal": true + } + ], + "tls_connection_policies": [ + { + "certificate_selection": { + "policy": "custom", + "tag": "cert0" + }, + "default_sni": "a.caddy.localhost", + "match": { + "sni": [ + "a.caddy.localhost", + "127.0.0.1", + "" + ] + } + }, + { + "default_sni": "a.caddy.localhost" + } + ] + } + } + }, + "tls": { + "certificates": { + "load_files": [ + { + "certificate": "/a.caddy.localhost.crt", + "key": "/a.caddy.localhost.key", + "tags": [ + "cert0" + ] + } + ] + } + }, + "pki": { + "certificate_authorities" : { + "local" : { + "install_trust": false + } + } + } + } + } + `, "json") + + // act and assert + // makes a request with no sni + caddytest.AssertGetResponse(t, "https://127.0.0.1:9443/version", 200, "hello from a") +} + +func TestDefaultSNIWithPortMappingOnly(t *testing.T) { + + // arrange + caddytest.InitServer(t, ` + { + "apps": { + "http": { + "http_port": 9080, + "https_port": 9443, + "servers": { + "srv0": { + "listen": [ + ":9443" + ], + "routes": [ + { + "handle": [ + { + "body": "hello from a.caddy.localhost", + "handler": "static_response", + "status_code": 200 + } + ], + "match": [ + { + "path": [ + "/version" + ] + } + ] + } + ], + "tls_connection_policies": [ + { + "certificate_selection": { + "policy": "custom", + "tag": "cert0" + }, + "default_sni": "a.caddy.localhost" + } + ] + } + } + }, + "tls": { + "certificates": { + "load_files": [ + { + "certificate": "/a.caddy.localhost.crt", + "key": "/a.caddy.localhost.key", + "tags": [ + "cert0" + ] + } + ] + } + }, + "pki": { + "certificate_authorities" : { + "local" : { + "install_trust": false + } + } + } + } + } + `, "json") + + // act and assert + // makes a request with no sni + caddytest.AssertGetResponse(t, "https://127.0.0.1:9443/version", 200, "hello from a") +} -- cgit v1.2.3