73 lines
2.1 KiB
Go
73 lines
2.1 KiB
Go
package tlsservice
|
|
|
|
import (
|
|
"net"
|
|
"net/http"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestDomainValidationAndRestart(t *testing.T) {
|
|
for _, domain := range []string{"test-link.appx365.com", "a.b"} {
|
|
if !ValidDomain(domain) {
|
|
t.Errorf("valid domain rejected: %s", domain)
|
|
}
|
|
}
|
|
for _, domain := range []string{"", "localhost", "127.0.0.1", "-a.example.com", "a..example.com", "a.example.com:80", "*.example.com", "a.example.com/evil"} {
|
|
if ValidDomain(domain) {
|
|
t.Errorf("invalid domain accepted: %s", domain)
|
|
}
|
|
}
|
|
|
|
t.Setenv("VPN_TLS_DOMAIN", "")
|
|
dir := t.TempDir()
|
|
if err := Start(http.NotFoundHandler(), dir); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := ConfigureDomain(dir, "Test-Link.Appx365.Com"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
status := Status()
|
|
if status.Enabled || status.Domain != "" || status.ConfiguredDomain != "test-link.appx365.com" || !status.RestartRequired {
|
|
t.Fatalf("saved domain must wait for restart: %+v", status)
|
|
}
|
|
info, err := os.Stat(filepath.Join(dir, "tls-domain"))
|
|
if err != nil || info.Mode().Perm() != 0o600 {
|
|
t.Fatalf("domain config permissions: %v, %v", info, err)
|
|
}
|
|
t.Setenv("VPN_TLS_DOMAIN", "other.example.com")
|
|
if err := ConfigureDomain(dir, "test-link.appx365.com"); err == nil {
|
|
t.Fatal("environment-managed domain must not be overwritten")
|
|
}
|
|
}
|
|
|
|
func TestFailedHTTPSBindReleasesHTTPPort(t *testing.T) {
|
|
t.Setenv("VPN_TLS_DOMAIN", "test-link.appx365.com")
|
|
occupied, err := net.Listen("tcp", "127.0.0.1:0")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer occupied.Close()
|
|
httpPort, err := net.Listen("tcp", "127.0.0.1:0")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
httpAddr := httpPort.Addr().String()
|
|
httpPort.Close()
|
|
t.Setenv("VPN_TLS_HTTP_ADDR", httpAddr)
|
|
t.Setenv("VPN_TLS_HTTPS_ADDR", occupied.Addr().String())
|
|
if err := Start(http.NotFoundHandler(), t.TempDir()); err == nil || !strings.Contains(err.Error(), "HTTPS") {
|
|
t.Fatalf("expected HTTPS port conflict: %v", err)
|
|
}
|
|
rebound, err := net.Listen("tcp", httpAddr)
|
|
if err != nil {
|
|
t.Fatalf("HTTP listener leaked after HTTPS bind failed: %v", err)
|
|
}
|
|
rebound.Close()
|
|
if Status().Enabled {
|
|
t.Fatal("failed start reported active TLS")
|
|
}
|
|
}
|