initial commit
This commit is contained in:
+215
@@ -0,0 +1,215 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestParseTLSVersion(t *testing.T) {
|
||||
tests := []struct {
|
||||
input string
|
||||
want uint16
|
||||
wantErr bool
|
||||
}{
|
||||
{"1.0", tls.VersionTLS10, false},
|
||||
{"TLS1.0", tls.VersionTLS10, false},
|
||||
{"1.1", tls.VersionTLS11, false},
|
||||
{"1.2", tls.VersionTLS12, false},
|
||||
{"tls1.2", tls.VersionTLS12, false},
|
||||
{"1.3", tls.VersionTLS13, false},
|
||||
{"2.0", 0, true},
|
||||
{"invalid", 0, true},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
got, err := parseTLSVersion(tt.input)
|
||||
if (err != nil) != tt.wantErr {
|
||||
t.Errorf("parseTLSVersion(%q) error = %v, wantErr %v", tt.input, err, tt.wantErr)
|
||||
continue
|
||||
}
|
||||
if got != tt.want {
|
||||
t.Errorf("parseTLSVersion(%q) = %x, want %x", tt.input, got, tt.want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseTargetURL(t *testing.T) {
|
||||
tests := []struct {
|
||||
input string
|
||||
wantHost string
|
||||
wantSch string
|
||||
wantErr bool
|
||||
}{
|
||||
{"https://example.com", "example.com", "https", false},
|
||||
{"http://localhost:9000", "localhost:9000", "http", false},
|
||||
{"example.com:8443", "example.com:8443", "https", false},
|
||||
{"", "", "", true},
|
||||
{"ftp://example.com", "", "", true},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
u, err := ParseTargetURL(tt.input)
|
||||
if (err != nil) != tt.wantErr {
|
||||
t.Errorf("ParseTargetURL(%q) error = %v, wantErr %v", tt.input, err, tt.wantErr)
|
||||
continue
|
||||
}
|
||||
if !tt.wantErr {
|
||||
if u.Host != tt.wantHost || u.Scheme != tt.wantSch {
|
||||
t.Errorf("ParseTargetURL(%q) = %s://%s, want %s://%s", tt.input, u.Scheme, u.Host, tt.wantSch, tt.wantHost)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateSelfSignedCert(t *testing.T) {
|
||||
cert, err := generateSelfSignedCert([]string{"custom.local", "192.168.1.50"})
|
||||
if err != nil {
|
||||
t.Fatalf("generateSelfSignedCert() failed: %v", err)
|
||||
}
|
||||
|
||||
if len(cert.Certificate) == 0 {
|
||||
t.Fatal("generateSelfSignedCert() returned empty certificate chain")
|
||||
}
|
||||
if cert.PrivateKey == nil {
|
||||
t.Fatal("generateSelfSignedCert() returned nil private key")
|
||||
}
|
||||
}
|
||||
|
||||
func TestProxy_TLS12_To_TLS13_Backend(t *testing.T) {
|
||||
// 1. Setup backend server that ONLY accepts TLS 1.3
|
||||
backendHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.URL.Path == "/test-endpoint" {
|
||||
w.Header().Set("X-Backend-Received-Proto", r.Proto)
|
||||
w.Header().Set("X-Backend-Received-Host", r.Host)
|
||||
w.WriteHeader(http.StatusOK)
|
||||
body, _ := io.ReadAll(r.Body)
|
||||
w.Write([]byte("backend-response: " + string(body)))
|
||||
return
|
||||
}
|
||||
http.NotFound(w, r)
|
||||
})
|
||||
|
||||
backendServer := httptest.NewUnstartedServer(backendHandler)
|
||||
backendServer.TLS = &tls.Config{
|
||||
MinVersion: tls.VersionTLS13,
|
||||
MaxVersion: tls.VersionTLS13,
|
||||
}
|
||||
backendServer.StartTLS()
|
||||
defer backendServer.Close()
|
||||
|
||||
backendURL, err := url.Parse(backendServer.URL)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to parse backend URL: %v", err)
|
||||
}
|
||||
|
||||
// 2. Setup smallprox handler pointing to the TLS 1.3 backend
|
||||
proxyHandler := NewProxyHandler(ProxyConfig{
|
||||
TargetURL: backendURL,
|
||||
PreserveHost: false,
|
||||
})
|
||||
|
||||
proxyCert, err := generateSelfSignedCert(nil)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to generate proxy cert: %v", err)
|
||||
}
|
||||
|
||||
proxyServer := httptest.NewUnstartedServer(proxyHandler)
|
||||
// Proxy frontend only accepts TLS 1.2
|
||||
proxyServer.TLS = &tls.Config{
|
||||
Certificates: []tls.Certificate{proxyCert},
|
||||
MinVersion: tls.VersionTLS12,
|
||||
MaxVersion: tls.VersionTLS12,
|
||||
}
|
||||
proxyServer.StartTLS()
|
||||
defer proxyServer.Close()
|
||||
|
||||
// 3. Client configured strictly for TLS 1.2
|
||||
client := &http.Client{
|
||||
Transport: &http.Transport{
|
||||
TLSClientConfig: &tls.Config{
|
||||
InsecureSkipVerify: true,
|
||||
MinVersion: tls.VersionTLS12,
|
||||
MaxVersion: tls.VersionTLS12,
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
// Make request through proxy
|
||||
req, err := http.NewRequest(http.MethodPost, proxyServer.URL+"/test-endpoint", strings.NewReader("hello-from-tls12-client"))
|
||||
if err != nil {
|
||||
t.Fatalf("failed to create request: %v", err)
|
||||
}
|
||||
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("client request through proxy failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("expected status 200 OK, got %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
if resp.TLS == nil || resp.TLS.Version != tls.VersionTLS12 {
|
||||
t.Errorf("expected client TLS version to be TLS 1.2 (0x0303), got %x", resp.TLS.Version)
|
||||
}
|
||||
|
||||
body, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to read response body: %v", err)
|
||||
}
|
||||
|
||||
expectedBody := "backend-response: hello-from-tls12-client"
|
||||
if string(body) != expectedBody {
|
||||
t.Errorf("expected body %q, got %q", expectedBody, string(body))
|
||||
}
|
||||
|
||||
// Verify Host was rewritten to backend host
|
||||
if receivedHost := resp.Header.Get("X-Backend-Received-Host"); receivedHost != backendURL.Host {
|
||||
t.Errorf("expected backend to receive host %q, got %q", backendURL.Host, receivedHost)
|
||||
}
|
||||
}
|
||||
|
||||
func TestProxy_PreserveHost(t *testing.T) {
|
||||
backendHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.Header().Set("X-Received-Host", r.Host)
|
||||
w.WriteHeader(http.StatusOK)
|
||||
})
|
||||
|
||||
backendServer := httptest.NewServer(backendHandler)
|
||||
defer backendServer.Close()
|
||||
|
||||
backendURL, err := url.Parse(backendServer.URL)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to parse backend URL: %v", err)
|
||||
}
|
||||
|
||||
proxyHandler := NewProxyHandler(ProxyConfig{
|
||||
TargetURL: backendURL,
|
||||
PreserveHost: true,
|
||||
})
|
||||
|
||||
proxyServer := httptest.NewServer(proxyHandler)
|
||||
defer proxyServer.Close()
|
||||
|
||||
req, err := http.NewRequest(http.MethodGet, proxyServer.URL+"/test", nil)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to create request: %v", err)
|
||||
}
|
||||
req.Host = "custom-domain.net"
|
||||
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if got := resp.Header.Get("X-Received-Host"); got != "custom-domain.net" {
|
||||
t.Errorf("expected preserved host %q, got %q", "custom-domain.net", got)
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user