v0.24.5

tests/transport_config.rs

@@ -0,0 +1,45 @@
+use rust_proxy::config::{compile, demo_config, ValidationPolicy};
+
+fn policy() -> ValidationPolicy {
+    ValidationPolicy {
+        tls_addr: None,
+        cert_dir: None,
+        data_dir: None,
+        proxy_addr: "127.0.0.1:8080".parse().unwrap(),
+        admin_addr: "127.0.0.1:9090".parse().unwrap(),
+    }
+}
+
+#[test]
+fn local_listener_backend_requires_explicit_risk_acceptance() {
+    let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
+    let backend = &mut config.vhosts[0].backends[0];
+    backend.url = "http://127.0.0.1:9090".into();
+    backend.allow_private = true;
+    backend.accept_local_listener_risk = false;
+
+    let error = compile(config.clone(), 1, &policy())
+        .expect_err("local administration listener must be rejected by default");
+    assert!(error.to_string().contains("accept_local_listener_risk=true"));
+
+    config.vhosts[0].backends[0].accept_local_listener_risk = true;
+    compile(config, 2, &policy())
+        .expect("explicit risk acceptance should permit the local listener target");
+}
+
+#[test]
+fn rfc8441_requires_an_h2_capable_listener_and_h2c_is_explicit() {
+    let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
+    config.vhosts[0].websockets = true;
+    config.vhosts[0].websocket_rfc8441 = true;
+    config.vhosts[0].http2_enabled = true;
+
+    let error = compile(config.clone(), 10, &policy())
+        .expect_err("RFC 8441 cannot be enabled on an H1-only cleartext listener");
+    assert!(error.to_string().contains("HTTP/2-capable listener"));
+
+    config.listeners.endpoints[0].binding.h2c = true;
+    let snapshot = compile(config, 11, &policy())
+        .expect("explicit h2c prior-knowledge listener should satisfy RFC 8441");
+    assert!(snapshot.websocket_rfc8441_on("127.0.0.1:8080".parse().unwrap(), false));
+}