traefik/integration/acme_test.go

529 lines
13 KiB
Go
Raw Normal View History

package integration
import (
"crypto/tls"
"crypto/x509"
2017-06-27 12:42:12 +00:00
"fmt"
"net"
"net/http"
"os"
2018-07-03 10:44:04 +00:00
"path/filepath"
"testing"
"time"
2018-07-03 10:44:04 +00:00
"github.com/miekg/dns"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/stretchr/testify/suite"
"github.com/traefik/traefik/v2/integration/try"
"github.com/traefik/traefik/v2/pkg/config/static"
"github.com/traefik/traefik/v2/pkg/log"
"github.com/traefik/traefik/v2/pkg/provider/acme"
"github.com/traefik/traefik/v2/pkg/testhelpers"
"github.com/traefik/traefik/v2/pkg/types"
)
// ACME test suites.
type AcmeSuite struct {
BaseSuite
2018-07-03 10:44:04 +00:00
pebbleIP string
fakeDNSServer *dns.Server
}
func TestAcmeSuite(t *testing.T) {
suite.Run(t, new(AcmeSuite))
}
type subCases struct {
host string
expectedCommonName string
expectedAlgorithm x509.PublicKeyAlgorithm
}
2018-07-03 10:44:04 +00:00
type acmeTestCase struct {
template templateModel
traefikConfFilePath string
subCases []subCases
}
2018-07-03 10:44:04 +00:00
type templateModel struct {
Domain types.Domain
Domains []types.Domain
2018-07-03 10:44:04 +00:00
PortHTTP string
PortHTTPS string
Acme map[string]static.CertificateResolver
2018-07-03 10:44:04 +00:00
}
2017-06-27 12:42:12 +00:00
const (
// Domain to check
acmeDomain = "traefik.acme.wtf"
2017-06-27 12:42:12 +00:00
// Wildcard domain to check
wildcardDomain = "*.acme.wtf"
)
2018-06-27 13:08:05 +00:00
func (s *AcmeSuite) getAcmeURL() string {
return fmt.Sprintf("https://%s/dir",
net.JoinHostPort(s.pebbleIP, "14000"))
2018-07-03 10:44:04 +00:00
}
func setupPebbleRootCA() (*http.Transport, error) {
path, err := filepath.Abs("fixtures/acme/ssl/pebble.minica.pem")
if err != nil {
return nil, err
}
os.Setenv("LEGO_CA_CERTIFICATES", path)
os.Setenv("LEGO_CA_SERVER_NAME", "pebble")
2021-03-04 19:08:03 +00:00
customCAs, err := os.ReadFile(path)
2018-07-03 10:44:04 +00:00
if err != nil {
return nil, err
}
certPool := x509.NewCertPool()
if ok := certPool.AppendCertsFromPEM(customCAs); !ok {
2020-05-11 10:06:07 +00:00
return nil, fmt.Errorf("error creating x509 cert pool from %q: %w", path, err)
2018-07-03 10:44:04 +00:00
}
return &http.Transport{
TLSClientConfig: &tls.Config{
ServerName: "pebble",
RootCAs: certPool,
},
}, nil
2018-06-27 13:08:05 +00:00
}
func (s *AcmeSuite) SetupSuite() {
s.BaseSuite.SetupSuite()
s.createComposeProject("pebble")
s.composeUp()
// Retrieving the Docker host ip.
s.fakeDNSServer = startFakeDNSServer(s.hostIP)
s.pebbleIP = s.getComposeServiceIP("pebble")
2018-07-03 10:44:04 +00:00
pebbleTransport, err := setupPebbleRootCA()
require.NoError(s.T(), err)
2018-07-03 10:44:04 +00:00
2018-08-01 14:56:04 +00:00
// wait for pebble
2018-07-03 10:44:04 +00:00
req := testhelpers.MustNewRequest(http.MethodGet, s.getAcmeURL(), nil)
client := &http.Client{
Transport: pebbleTransport,
}
2018-07-03 10:44:04 +00:00
err = try.Do(5*time.Second, func() error {
resp, errGet := client.Do(req)
if errGet != nil {
return errGet
}
return try.StatusCodeIs(http.StatusOK)(resp)
})
require.NoError(s.T(), err)
}
func (s *AcmeSuite) TearDownSuite() {
s.BaseSuite.TearDownSuite()
if s.fakeDNSServer != nil {
err := s.fakeDNSServer.Shutdown()
if err != nil {
log.WithoutContext().Info(err.Error())
}
2018-07-03 10:44:04 +00:00
}
s.composeDown()
}
func (s *AcmeSuite) TestHTTP01Domains() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_domains.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: acmeDomain,
expectedAlgorithm: x509.RSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Domains: []types.Domain{{
Main: "traefik.acme.wtf",
}},
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
2018-07-03 10:44:04 +00:00
}},
},
2018-06-27 13:08:05 +00:00
},
}
2017-06-27 12:42:12 +00:00
s.retrieveAcmeCertificate(testCase)
}
func (s *AcmeSuite) TestHTTP01StoreDomains() {
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_store_domains.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: acmeDomain,
expectedAlgorithm: x509.RSA,
}},
template: templateModel{
Domain: types.Domain{
Main: "traefik.acme.wtf",
},
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
}},
},
},
}
s.retrieveAcmeCertificate(testCase)
}
func (s *AcmeSuite) TestHTTP01DomainsInSAN() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_domains.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: "acme.wtf",
expectedAlgorithm: x509.RSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Domains: []types.Domain{{
Main: "acme.wtf",
SANs: []string{"traefik.acme.wtf"},
}},
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
2018-07-03 10:44:04 +00:00
}},
},
2018-06-27 13:08:05 +00:00
},
}
2018-03-05 19:54:04 +00:00
s.retrieveAcmeCertificate(testCase)
2018-03-05 19:54:04 +00:00
}
func (s *AcmeSuite) TestHTTP01OnHostRule() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_base.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: acmeDomain,
expectedAlgorithm: x509.RSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
}},
},
},
}
s.retrieveAcmeCertificate(testCase)
}
func (s *AcmeSuite) TestMultipleResolver() {
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_multiple_resolvers.toml",
subCases: []subCases{
{
host: acmeDomain,
expectedCommonName: acmeDomain,
expectedAlgorithm: x509.RSA,
},
{
host: "tchouk.acme.wtf",
expectedCommonName: "tchouk.acme.wtf",
expectedAlgorithm: x509.ECDSA,
},
},
template: templateModel{
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
}},
"tchouk": {ACME: &acme.Configuration{
TLSChallenge: &acme.TLSChallenge{},
KeyType: "EC256",
}},
2018-07-03 10:44:04 +00:00
},
2018-06-27 13:08:05 +00:00
},
}
s.retrieveAcmeCertificate(testCase)
}
func (s *AcmeSuite) TestHTTP01OnHostRuleECDSA() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_base.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: acmeDomain,
expectedAlgorithm: x509.ECDSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
KeyType: "EC384",
}},
2018-07-03 10:44:04 +00:00
},
2018-06-27 13:08:05 +00:00
},
}
s.retrieveAcmeCertificate(testCase)
}
func (s *AcmeSuite) TestHTTP01OnHostRuleInvalidAlgo() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_base.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: acmeDomain,
expectedAlgorithm: x509.RSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
KeyType: "INVALID",
}},
2018-07-03 10:44:04 +00:00
},
2018-06-27 13:08:05 +00:00
},
}
2017-06-27 12:42:12 +00:00
s.retrieveAcmeCertificate(testCase)
}
func (s *AcmeSuite) TestHTTP01OnHostRuleDefaultDynamicCertificatesWithWildcard() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_tls.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: wildcardDomain,
expectedAlgorithm: x509.RSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
}},
2018-07-03 10:44:04 +00:00
},
2018-06-27 13:08:05 +00:00
},
}
2018-01-15 15:04:05 +00:00
s.retrieveAcmeCertificate(testCase)
2018-01-15 15:04:05 +00:00
}
func (s *AcmeSuite) TestHTTP01OnHostRuleDynamicCertificatesWithWildcard() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_tls_dynamic.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: wildcardDomain,
expectedAlgorithm: x509.RSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
}},
2018-07-03 10:44:04 +00:00
},
2018-06-27 13:08:05 +00:00
},
}
2018-01-15 15:04:05 +00:00
s.retrieveAcmeCertificate(testCase)
2018-01-15 15:04:05 +00:00
}
func (s *AcmeSuite) TestTLSALPN01OnHostRuleTCP() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_tcp.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: acmeDomain,
expectedAlgorithm: x509.RSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
TLSChallenge: &acme.TLSChallenge{},
}},
2018-07-03 10:44:04 +00:00
},
2018-06-27 13:08:05 +00:00
},
}
s.retrieveAcmeCertificate(testCase)
}
func (s *AcmeSuite) TestTLSALPN01OnHostRule() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_base.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: acmeDomain,
expectedAlgorithm: x509.RSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
TLSChallenge: &acme.TLSChallenge{},
2018-07-03 10:44:04 +00:00
}},
},
},
}
s.retrieveAcmeCertificate(testCase)
2018-07-03 10:44:04 +00:00
}
func (s *AcmeSuite) TestTLSALPN01Domains() {
2018-07-03 10:44:04 +00:00
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_domains.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: acmeDomain,
expectedAlgorithm: x509.RSA,
}},
2018-07-03 10:44:04 +00:00
template: templateModel{
Domains: []types.Domain{{
Main: "traefik.acme.wtf",
}},
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
TLSChallenge: &acme.TLSChallenge{},
2018-07-03 10:44:04 +00:00
}},
},
2018-06-27 13:08:05 +00:00
},
}
s.retrieveAcmeCertificate(testCase)
}
func (s *AcmeSuite) TestTLSALPN01DomainsInSAN() {
testCase := acmeTestCase{
traefikConfFilePath: "fixtures/acme/acme_domains.toml",
subCases: []subCases{{
host: acmeDomain,
expectedCommonName: "acme.wtf",
expectedAlgorithm: x509.RSA,
}},
template: templateModel{
Domains: []types.Domain{{
Main: "acme.wtf",
SANs: []string{"traefik.acme.wtf"},
}},
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
TLSChallenge: &acme.TLSChallenge{},
}},
},
},
}
s.retrieveAcmeCertificate(testCase)
}
2020-05-11 10:06:07 +00:00
// Test Let's encrypt down.
func (s *AcmeSuite) TestNoValidLetsEncryptServer() {
file := s.adaptFile("fixtures/acme/acme_base.toml", templateModel{
Acme: map[string]static.CertificateResolver{
"default": {ACME: &acme.Configuration{
CAServer: "http://wrongurl:4001/directory",
HTTPChallenge: &acme.HTTPChallenge{EntryPoint: "web"},
}},
2018-07-03 10:44:04 +00:00
},
2018-06-27 13:08:05 +00:00
})
s.traefikCmd(withConfigFile(file))
// Expected traefik works
err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 10*time.Second, try.StatusCodeIs(http.StatusOK))
require.NoError(s.T(), err)
}
2020-05-11 10:06:07 +00:00
// Doing an HTTPS request and test the response certificate.
func (s *AcmeSuite) retrieveAcmeCertificate(testCase acmeTestCase) {
2018-07-03 10:44:04 +00:00
if len(testCase.template.PortHTTP) == 0 {
testCase.template.PortHTTP = ":5002"
}
if len(testCase.template.PortHTTPS) == 0 {
testCase.template.PortHTTPS = ":5001"
}
for _, value := range testCase.template.Acme {
if len(value.ACME.CAServer) == 0 {
value.ACME.CAServer = s.getAcmeURL()
}
2018-07-03 10:44:04 +00:00
}
file := s.adaptFile(testCase.traefikConfFilePath, testCase.template)
s.traefikCmd(withConfigFile(file))
2017-06-27 12:42:12 +00:00
2018-04-10 08:52:04 +00:00
// A real file is needed to have the right mode on acme.json file
defer os.Remove("/tmp/acme.json")
backend := startTestServer("9010", http.StatusOK, "")
defer backend.Close()
client := &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
},
}
// wait for traefik (generating acme account take some seconds)
err := try.Do(60*time.Second, func() error {
_, errGet := client.Get("https://127.0.0.1:5001")
return errGet
})
require.NoError(s.T(), err)
for _, sub := range testCase.subCases {
client = &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{
InsecureSkipVerify: true,
ServerName: sub.host,
},
// Needed so that each subcase redoes the SSL handshake
DisableKeepAlives: true,
2018-06-27 13:08:05 +00:00
},
}
2017-06-27 12:42:12 +00:00
req := testhelpers.MustNewRequest(http.MethodGet, "https://127.0.0.1:5001/", nil)
req.Host = sub.host
req.Header.Set("Host", sub.host)
req.Header.Set("Accept", "*/*")
var resp *http.Response
2017-06-27 12:42:12 +00:00
// Retry to send a Request which uses the LE generated certificate
err := try.Do(60*time.Second, func() error {
resp, err = client.Do(req)
if err != nil {
return err
}
2017-06-27 12:42:12 +00:00
cn := resp.TLS.PeerCertificates[0].Subject.CommonName
if cn != sub.expectedCommonName {
return fmt.Errorf("domain %s found instead of %s", cn, sub.expectedCommonName)
}
2017-06-27 12:42:12 +00:00
return nil
})
2017-06-27 12:42:12 +00:00
require.NoError(s.T(), err)
assert.Equal(s.T(), http.StatusOK, resp.StatusCode)
// Check Domain into response certificate
assert.Equal(s.T(), sub.expectedCommonName, resp.TLS.PeerCertificates[0].Subject.CommonName)
assert.Equal(s.T(), sub.expectedAlgorithm, resp.TLS.PeerCertificates[0].PublicKeyAlgorithm)
}
}