111 lines
3 KiB
Go
111 lines
3 KiB
Go
|
package main
|
||
|
|
|
||
|
|
import (
|
||
|
|
"crypto/tls"
|
||
|
|
"net"
|
||
|
|
"net/http"
|
||
|
|
"net/http/httptest"
|
||
|
|
"os/exec"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
checker "github.com/vdemeester/shakers"
|
||
|
|
check "gopkg.in/check.v1"
|
||
|
|
)
|
||
|
|
|
||
|
|
// HTTPSSuite
|
||
|
|
type HTTPSSuite struct{ BaseSuite }
|
||
|
|
|
||
|
|
// TestWithSNIConfigHandshake involves a client sending a SNI hostname of
|
||
|
|
// "snitest.com", which happens to match the CN of 'snitest.com.crt'. The test
|
||
|
|
// verifies that traefik presents the correct certificate.
|
||
|
|
func (s *HTTPSSuite) TestWithSNIConfigHandshake(c *check.C) {
|
||
|
|
cmd := exec.Command(traefikBinary, "fixtures/https/https_sni.toml")
|
||
|
|
err := cmd.Start()
|
||
|
|
c.Assert(err, checker.IsNil)
|
||
|
|
defer cmd.Process.Kill()
|
||
|
|
|
||
|
|
time.Sleep(500 * time.Millisecond)
|
||
|
|
|
||
|
|
tlsConfig := &tls.Config{
|
||
|
|
InsecureSkipVerify: true,
|
||
|
|
ServerName: "snitest.com",
|
||
|
|
}
|
||
|
|
conn, err := tls.Dial("tcp", "127.0.0.1:443", tlsConfig)
|
||
|
|
c.Assert(err, checker.IsNil, check.Commentf("failed to connect to server"))
|
||
|
|
|
||
|
|
defer conn.Close()
|
||
|
|
err = conn.Handshake()
|
||
|
|
c.Assert(err, checker.IsNil, check.Commentf("TLS handshake error"))
|
||
|
|
|
||
|
|
cs := conn.ConnectionState()
|
||
|
|
err = cs.PeerCertificates[0].VerifyHostname("snitest.com")
|
||
|
|
c.Assert(err, checker.IsNil, check.Commentf("certificate did not match SNI servername"))
|
||
|
|
}
|
||
|
|
|
||
|
|
// TestWithSNIConfigRoute involves a client sending HTTPS requests with
|
||
|
|
// SNI hostnames of "snitest.org" and "snitest.com". The test verifies
|
||
|
|
// that traefik routes the requests to the expected backends.
|
||
|
|
func (s *HTTPSSuite) TestWithSNIConfigRoute(c *check.C) {
|
||
|
|
cmd := exec.Command(traefikBinary, "fixtures/https/https_sni.toml")
|
||
|
|
err := cmd.Start()
|
||
|
|
c.Assert(err, checker.IsNil)
|
||
|
|
defer cmd.Process.Kill()
|
||
|
|
|
||
|
|
backend1 := startTestServer("9010", 204)
|
||
|
|
backend2 := startTestServer("9020", 205)
|
||
|
|
defer backend1.Close()
|
||
|
|
defer backend2.Close()
|
||
|
|
|
||
|
|
time.Sleep(2000 * time.Millisecond)
|
||
|
|
|
||
|
|
tr1 := &http.Transport{
|
||
|
|
TLSClientConfig: &tls.Config{
|
||
|
|
InsecureSkipVerify: true,
|
||
|
|
ServerName: "snitest.com",
|
||
|
|
},
|
||
|
|
}
|
||
|
|
tr2 := &http.Transport{
|
||
|
|
TLSClientConfig: &tls.Config{
|
||
|
|
InsecureSkipVerify: true,
|
||
|
|
ServerName: "snitest.org",
|
||
|
|
},
|
||
|
|
}
|
||
|
|
|
||
|
|
client := &http.Client{Transport: tr1}
|
||
|
|
req, _ := http.NewRequest("GET", "https://127.0.0.1/", nil)
|
||
|
|
req.Host = "snitest.com"
|
||
|
|
req.Header.Set("Host", "snitest.com")
|
||
|
|
req.Header.Set("Accept", "*/*")
|
||
|
|
resp, err := client.Do(req)
|
||
|
|
c.Assert(err, checker.IsNil)
|
||
|
|
// Expected a 204 (from backend1)
|
||
|
|
c.Assert(resp.StatusCode, checker.Equals, 204)
|
||
|
|
|
||
|
|
client = &http.Client{Transport: tr2}
|
||
|
|
req, _ = http.NewRequest("GET", "https://127.0.0.1/", nil)
|
||
|
|
req.Host = "snitest.org"
|
||
|
|
req.Header.Set("Host", "snitest.org")
|
||
|
|
req.Header.Set("Accept", "*/*")
|
||
|
|
resp, err = client.Do(req)
|
||
|
|
c.Assert(err, checker.IsNil)
|
||
|
|
// Expected a 205 (from backend2)
|
||
|
|
c.Assert(resp.StatusCode, checker.Equals, 205)
|
||
|
|
}
|
||
|
|
|
||
|
|
func startTestServer(port string, statusCode int) (ts *httptest.Server) {
|
||
|
|
handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||
|
|
w.WriteHeader(statusCode)
|
||
|
|
})
|
||
|
|
listener, err := net.Listen("tcp", "127.0.0.1:"+port)
|
||
|
|
if err != nil {
|
||
|
|
panic(err)
|
||
|
|
}
|
||
|
|
|
||
|
|
ts = &httptest.Server{
|
||
|
|
Listener: listener,
|
||
|
|
Config: &http.Server{Handler: handler},
|
||
|
|
}
|
||
|
|
ts.Start()
|
||
|
|
return
|
||
|
|
}
|