traefik/integration/acme_test.go

373 lines
11 KiB
Go
Raw Normal View History

package integration
import (
"crypto/tls"
"crypto/x509"
2017-06-27 12:42:12 +00:00
"fmt"
"net/http"
"os"
"time"
"github.com/containous/traefik/integration/try"
2018-06-27 13:08:05 +00:00
"github.com/containous/traefik/provider/acme"
2017-06-27 12:42:12 +00:00
"github.com/containous/traefik/testhelpers"
2018-06-27 13:08:05 +00:00
"github.com/containous/traefik/types"
"github.com/go-check/check"
checker "github.com/vdemeester/shakers"
)
// ACME test suites (using libcompose)
type AcmeSuite struct {
BaseSuite
boulderIP string
}
// Acme tests configuration
type AcmeTestCase struct {
2018-06-27 13:08:05 +00:00
configuration acme.Configuration
traefikConfFilePath string
2018-06-27 13:08:05 +00:00
expectedDomain string
expectedAlgorithm x509.PublicKeyAlgorithm
}
2017-06-27 12:42:12 +00:00
const (
// Domain to check
acmeDomain = "traefik.acme.wtf"
2017-06-27 12:42:12 +00:00
// Wildcard domain to check
wildcardDomain = "*.acme.wtf"
2018-03-06 13:50:03 +00:00
// Traefik default certificate
traefikDefaultDomain = "TRAEFIK DEFAULT CERT"
2017-06-27 12:42:12 +00:00
)
2018-06-27 13:08:05 +00:00
func (s *AcmeSuite) getAcmeURL() string {
return fmt.Sprintf("http://%s:4001/directory", s.boulderIP)
}
func (s *AcmeSuite) SetUpSuite(c *check.C) {
s.createComposeProject(c, "boulder")
s.composeProject.Start(c)
s.boulderIP = s.composeProject.Container(c, "boulder").NetworkSettings.IPAddress
// wait for boulder
2018-06-27 13:08:05 +00:00
err := try.GetRequest(s.getAcmeURL(), 120*time.Second, try.StatusCodeIs(http.StatusOK))
c.Assert(err, checker.IsNil)
}
func (s *AcmeSuite) TearDownSuite(c *check.C) {
// shutdown and delete compose project
if s.composeProject != nil {
s.composeProject.Stop(c)
}
}
2018-03-05 19:54:04 +00:00
// Test ACME provider with certificate at start
func (s *AcmeSuite) TestACMEProviderAtStart(c *check.C) {
2017-06-27 12:42:12 +00:00
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme-base.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnHostRule: true,
Domains: types.Domains{types.Domain{
Main: "traefik.acme.wtf",
}},
},
expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA,
}
2017-06-27 12:42:12 +00:00
s.retrieveAcmeCertificate(c, testCase)
}
2018-03-05 19:54:04 +00:00
// Test ACME provider with certificate at start
func (s *AcmeSuite) TestACMEProviderAtStartInSAN(c *check.C) {
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme-base.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
Domains: types.Domains{types.Domain{
Main: "acme.wtf",
SANs: []string{"traefik.acme.wtf"},
}},
},
expectedDomain: "acme.wtf",
expectedAlgorithm: x509.RSA,
}
2018-03-05 19:54:04 +00:00
s.retrieveAcmeCertificate(c, testCase)
}
// Test ACME provider with certificate at start
func (s *AcmeSuite) TestACMEProviderOnHost(c *check.C) {
2017-06-27 12:42:12 +00:00
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme-base.toml",
configuration: acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
CAServer: s.getAcmeURL(),
OnHostRule: true,
},
expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA,
}
s.retrieveAcmeCertificate(c, testCase)
}
// Test ACME provider with certificate at start ECDSA algo
func (s *AcmeSuite) TestACMEProviderOnHostECDSA(c *check.C) {
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme-base.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnHostRule: true,
KeyType: "EC384",
},
expectedDomain: acmeDomain,
expectedAlgorithm: x509.ECDSA,
}
s.retrieveAcmeCertificate(c, testCase)
}
// Test ACME provider with certificate at start invalid algo default RSA
func (s *AcmeSuite) TestACMEProviderOnHostInvalidAlgo(c *check.C) {
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme-base.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnHostRule: true,
KeyType: "INVALID",
},
expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA,
}
2017-06-27 12:42:12 +00:00
s.retrieveAcmeCertificate(c, testCase)
}
2018-03-06 13:50:03 +00:00
// Test ACME provider with certificate at start and no ACME challenge
func (s *AcmeSuite) TestACMEProviderOnHostWithNoACMEChallenge(c *check.C) {
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme-base.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
OnHostRule: true,
},
expectedDomain: traefikDefaultDomain,
expectedAlgorithm: x509.RSA,
}
2018-03-06 13:50:03 +00:00
s.retrieveAcmeCertificate(c, testCase)
}
2018-01-15 15:04:05 +00:00
// Test OnDemand option with none provided certificate and challenge HTTP-01
func (s *AcmeSuite) TestOnDemandRetrieveAcmeCertificateHTTP01(c *check.C) {
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme-base.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnDemand: true,
},
expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA,
}
2018-01-15 15:04:05 +00:00
s.retrieveAcmeCertificate(c, testCase)
}
// Test OnHostRule option with none provided certificate and challenge HTTP-01
func (s *AcmeSuite) TestOnHostRuleRetrieveAcmeCertificateHTTP01(c *check.C) {
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme-base.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnHostRule: true,
},
expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA,
}
2018-01-15 15:04:05 +00:00
s.retrieveAcmeCertificate(c, testCase)
}
// Test OnHostRule option with none provided certificate and challenge HTTP-01 and web path
func (s *AcmeSuite) TestOnHostRuleRetrieveAcmeCertificateHTTP01WithPath(c *check.C) {
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme_http01_web_path.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnHostRule: true,
},
expectedDomain: acmeDomain,
expectedAlgorithm: x509.RSA,
}
s.retrieveAcmeCertificate(c, testCase)
}
// Test OnDemand option with a wildcard provided certificate
func (s *AcmeSuite) TestOnDemandRetrieveAcmeCertificateWithWildcard(c *check.C) {
2018-06-27 13:08:05 +00:00
// FIXME flaky
c.Skip("Flaky behavior will be fixed in the next PR")
2017-06-27 12:42:12 +00:00
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme_tls.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnDemand: true,
},
expectedDomain: wildcardDomain,
expectedAlgorithm: x509.RSA,
}
2017-06-27 12:42:12 +00:00
s.retrieveAcmeCertificate(c, testCase)
}
// Test onHostRule option with a wildcard provided certificate
func (s *AcmeSuite) TestOnHostRuleRetrieveAcmeCertificateWithWildcard(c *check.C) {
2017-06-27 12:42:12 +00:00
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme_tls.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnHostRule: true,
},
expectedDomain: wildcardDomain,
expectedAlgorithm: x509.RSA,
}
2017-06-27 12:42:12 +00:00
s.retrieveAcmeCertificate(c, testCase)
}
// Test OnDemand option with a wildcard provided certificate
func (s *AcmeSuite) TestOnDemandRetrieveAcmeCertificateWithDynamicWildcard(c *check.C) {
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme_tls_dynamic.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnDemand: true,
},
expectedDomain: wildcardDomain,
expectedAlgorithm: x509.RSA,
}
s.retrieveAcmeCertificate(c, testCase)
}
// Test onHostRule option with a wildcard provided certificate
func (s *AcmeSuite) TestOnHostRuleRetrieveAcmeCertificateWithDynamicWildcard(c *check.C) {
testCase := AcmeTestCase{
2018-06-27 13:08:05 +00:00
traefikConfFilePath: "fixtures/acme/acme_tls_dynamic.toml",
configuration: acme.Configuration{
CAServer: s.getAcmeURL(),
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnHostRule: true,
},
expectedDomain: wildcardDomain,
expectedAlgorithm: x509.RSA,
}
s.retrieveAcmeCertificate(c, testCase)
}
// Test Let's encrypt down
func (s *AcmeSuite) TestNoValidLetsEncryptServer(c *check.C) {
2018-06-27 13:08:05 +00:00
file := s.adaptFile(c, "fixtures/acme/acme-base.toml", acme.Configuration{
CAServer: "http://wrongurl:4001/directory",
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "http"},
OnHostRule: true,
})
defer os.Remove(file)
cmd, display := s.traefikCmd(withConfigFile(file))
defer display(c)
err := cmd.Start()
c.Assert(err, checker.IsNil)
defer cmd.Process.Kill()
// Expected traefik works
err = try.GetRequest("http://127.0.0.1:8080/api/providers", 10*time.Second, try.StatusCodeIs(http.StatusOK))
c.Assert(err, checker.IsNil)
}
// Doing an HTTPS request and test the response certificate
2017-06-27 12:42:12 +00:00
func (s *AcmeSuite) retrieveAcmeCertificate(c *check.C, testCase AcmeTestCase) {
2018-06-27 13:08:05 +00:00
file := s.adaptFile(c, testCase.traefikConfFilePath, testCase.configuration)
defer os.Remove(file)
2017-06-27 12:42:12 +00:00
cmd, display := s.traefikCmd(withConfigFile(file))
defer display(c)
err := cmd.Start()
c.Assert(err, checker.IsNil)
defer cmd.Process.Kill()
2018-04-10 08:52:04 +00:00
// A real file is needed to have the right mode on acme.json file
defer os.Remove("/tmp/acme.json")
backend := startTestServer("9010", http.StatusOK)
defer backend.Close()
2018-06-27 13:08:05 +00:00
client := &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
},
}
// wait for traefik (generating acme account take some seconds)
err = try.Do(90*time.Second, func() error {
2017-12-04 19:04:08 +00:00
_, errGet := client.Get("https://127.0.0.1:5001")
return errGet
})
c.Assert(err, checker.IsNil)
2018-06-27 13:08:05 +00:00
client = &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{
InsecureSkipVerify: true,
ServerName: acmeDomain,
},
},
}
2017-06-27 12:42:12 +00:00
req := testhelpers.MustNewRequest(http.MethodGet, "https://127.0.0.1:5001/", nil)
req.Host = acmeDomain
req.Header.Set("Host", acmeDomain)
req.Header.Set("Accept", "*/*")
var resp *http.Response
2017-06-27 12:42:12 +00:00
// Retry to send a Request which uses the LE generated certificate
2017-06-27 12:42:12 +00:00
err = try.Do(60*time.Second, func() error {
resp, err = client.Do(req)
2017-06-27 12:42:12 +00:00
// /!\ If connection is not closed, SSLHandshake will only be done during the first trial /!\
req.Close = true
2017-06-27 12:42:12 +00:00
if err != nil {
return err
}
2017-06-27 12:42:12 +00:00
cn := resp.TLS.PeerCertificates[0].Subject.CommonName
2018-06-27 13:08:05 +00:00
if cn != testCase.expectedDomain {
return fmt.Errorf("domain %s found instead of %s", cn, testCase.expectedDomain)
2017-06-27 12:42:12 +00:00
}
return nil
})
2017-06-27 12:42:12 +00:00
c.Assert(err, checker.IsNil)
c.Assert(resp.StatusCode, checker.Equals, http.StatusOK)
// Check Domain into response certificate
2018-06-27 13:08:05 +00:00
c.Assert(resp.TLS.PeerCertificates[0].Subject.CommonName, checker.Equals, testCase.expectedDomain)
c.Assert(resp.TLS.PeerCertificates[0].PublicKeyAlgorithm, checker.Equals, testCase.expectedAlgorithm)
}