v0.25.1

src/settings/tests.rs

@@ -0,0 +1,231 @@
+mod tests {
+    use super::*;
+    #[test]
+    fn http2_connection_limits_default_and_validate_independently() {
+        let defaults: Http2Connections = serde_json::from_str("{}").unwrap();
+        assert_eq!(defaults.idle_timeout_seconds, 300);
+        assert_eq!(defaults.max_connection_lifetime_seconds, 0);
+        assert_eq!(defaults.drain_timeout_seconds, 10);
+        defaults.validate().unwrap();
+
+        let configured = Http2Connections {
+            idle_timeout_seconds: 45,
+            max_connection_lifetime_seconds: 3_600,
+            drain_timeout_seconds: 20,
+        };
+        configured.validate().unwrap();
+        assert_eq!(configured.idle_timeout(), Duration::from_secs(45));
+        assert_eq!(configured.max_connection_lifetime(), Some(Duration::from_secs(3_600)));
+        assert_eq!(configured.drain_timeout(), Duration::from_secs(20));
+        assert!(Http2Connections { idle_timeout_seconds: 0, ..defaults }.validate().is_err());
+        assert!(Http2Connections { max_connection_lifetime_seconds: 2_592_001, ..defaults }.validate().is_err());
+        assert!(Http2Connections { drain_timeout_seconds: 0, ..defaults }.validate().is_err());
+    }
+    #[test]
+    fn server_policy_and_injection() {
+        let mut headers = HeaderMap::new();
+        headers.insert("server", "origin".parse().unwrap());
+        ServerHeader {
+            mode: ServerMode::Hide,
+            ..Default::default()
+        }
+        .apply(&mut headers);
+        assert!(!headers.contains_key("server"));
+        let custom = ServerHeader {
+            mode: ServerMode::Custom,
+            value: "RustProxy/v0.1.0".into(),
+        };
+        custom.validate().unwrap();
+        custom.apply(&mut headers);
+        assert_eq!(headers["server"], "RustProxy/v0.1.0");
+        assert!(ServerHeader {
+            mode: ServerMode::Custom,
+            value: "bad\r\nx: y".into()
+        }
+        .validate()
+        .is_err());
+    }
+    #[test]
+    fn explicit_startup_binds_are_injected_and_cannot_be_removed() {
+        let locks = StartupLocks {
+            http: Some("127.0.0.1:18080".parse().unwrap()),
+            https: Some("127.0.0.1:18443".parse().unwrap()),
+            administration: Some("127.0.0.1:19090".parse().unwrap()),
+        };
+        let mut config = crate::config::Config::default();
+        config.administration.listen = Some("127.0.0.1:19999".parse().unwrap());
+        locks.ensure_config(&mut config);
+        assert!(config.administration.listen.is_none());
+        locks
+            .validate(&config, "127.0.0.1:19090".parse().unwrap())
+            .unwrap();
+
+        let http = config
+            .listeners
+            .endpoints
+            .iter_mut()
+            .find(|endpoint| {
+                endpoint.bindings().iter().any(|binding| {
+                    binding.address == "127.0.0.1:18080".parse().unwrap() && !binding.tls
+                })
+            })
+            .unwrap();
+        http.enabled = false;
+        locks.ensure_config(&mut config);
+        assert!(config.listeners.endpoints.iter().any(|endpoint| {
+            endpoint.enabled
+                && endpoint.bindings().iter().any(|binding| {
+                    binding.address == "127.0.0.1:18080".parse().unwrap() && !binding.tls
+                })
+        }));
+
+        config.listeners.endpoints.retain(|endpoint| {
+            !endpoint.bindings().iter().any(|binding| {
+                binding.address == "127.0.0.1:18080".parse().unwrap() && !binding.tls
+            })
+        });
+        assert!(locks
+            .validate(&config, "127.0.0.1:19090".parse().unwrap())
+            .is_err());
+    }
+
+    #[test]
+    fn startup_defaults_become_named_listeners() {
+        let saved = Listeners::from_startup(
+            "0.0.0.0:80".parse().unwrap(),
+            Some("0.0.0.0:443".parse().unwrap()),
+        );
+        assert_eq!(saved.endpoints.len(), 2);
+        assert_eq!(saved.endpoints[0].id, "http");
+        assert_eq!(saved.endpoints[0].binding.address.port(), 80);
+        assert_eq!(saved.endpoints[1].id, "https");
+        assert_eq!(saved.endpoints[1].binding.address.port(), 443);
+        assert_eq!(
+            saved.endpoints[1].binding.http2_settings,
+            Some(Http2Connections::default())
+        );
+        assert!(saved.endpoints[1].binding.http3.is_some());
+    }
+    #[test]
+    fn named_listener_can_bind_multiple_explicit_addresses() {
+        let endpoint = NamedListener {
+            id: "web".into(),
+            name: "Web".into(),
+            scope: ListenerScope::Public,
+            enabled: true,
+            binding: crate::vhost::Listener {
+                address: "192.0.2.10:443".parse().unwrap(),
+                tls: true,
+                http2: true,
+                http2_settings: Some(Http2Connections::default()),
+                h2c: false,
+                http3: None,
+            },
+            additional_addresses: vec!["192.0.2.11:443".parse().unwrap()],
+        };
+        let bindings = endpoint.bindings();
+        assert_eq!(bindings.len(), 2);
+        assert_eq!(bindings[0].address, "192.0.2.10:443".parse().unwrap());
+        assert_eq!(bindings[1].address, "192.0.2.11:443".parse().unwrap());
+        assert_eq!(bindings[0].tls, bindings[1].tls);
+        assert_eq!(bindings[0].http2, bindings[1].http2);
+    }
+
+    #[test]
+    fn multi_address_listener_rejects_unspecified_or_duplicate_addresses() {
+        let policy = crate::config::ValidationPolicy {
+            tls_addr: None,
+            cert_dir: None,
+            data_dir: None,
+            proxy_addr: "127.0.0.1:18080".parse().unwrap(),
+            admin_addr: "127.0.0.1:19090".parse().unwrap(),
+        };
+        let mut listeners = Listeners {
+            endpoints: vec![NamedListener {
+                id: "web".into(),
+                name: "Web".into(),
+                scope: ListenerScope::Public,
+                enabled: true,
+                binding: crate::vhost::Listener {
+                    address: "0.0.0.0:8080".parse().unwrap(),
+                    tls: false,
+                    http2: false,
+                    http2_settings: None,
+                    h2c: false,
+                    http3: None,
+                },
+                additional_addresses: vec!["192.0.2.10:8080".parse().unwrap()],
+            }],
+        };
+        assert!(listeners.validate(&policy).is_err());
+        listeners.endpoints[0].binding.address = "192.0.2.10:8080".parse().unwrap();
+        assert!(listeners.validate(&policy).is_err());
+        listeners.endpoints[0].additional_addresses = vec!["192.0.2.11:8080".parse().unwrap()];
+        assert!(listeners.validate(&policy).is_ok());
+    }
+
+    #[test]
+    fn administration_certificate_requires_tls_and_known_inventory_id() {
+        let inventory = crate::tls::Settings {
+            certificates: vec![crate::tls::Certificate {
+                issuer: None,
+                id: "panel".into(),
+                covered_hosts: Vec::new(),
+                hosts: vec![],
+                cert_file: "panel.pem".into(),
+                key_file: "panel.key".into(),
+            }],
+            ..crate::tls::Settings::default()
+        };
+        let mut admin = Administration {
+            tls: false,
+            certificate_id: Some("panel".into()),
+            ..Administration::default()
+        };
+        assert!(admin.validate(&inventory).is_err());
+        admin.tls = true;
+        assert!(admin.validate(&inventory).is_ok());
+        admin.certificate_id = Some("missing".into());
+        assert!(admin.validate(&inventory).is_err());
+    }
+    #[test]
+    fn administration_session_lifetime_is_7_to_30_days_and_hot_apply_only() {
+        let tls = crate::tls::Settings::default();
+        let mut admin = Administration::default();
+        assert_eq!(admin.session_days, 30);
+        assert_eq!(admin.session_seconds(), 30 * 24 * 60 * 60);
+        assert!(admin.validate(&tls).is_ok());
+        let active = admin.clone();
+        admin.session_days = 7;
+        assert!(admin.validate(&tls).is_ok());
+        assert!(!admin.restart_differs(&active));
+        admin.session_days = 6;
+        assert!(admin.validate(&tls).is_err());
+        admin.session_days = 31;
+        assert!(admin.validate(&tls).is_err());
+    }
+    #[test]
+    fn administration_hostnames_are_normalized_and_unique() {
+        let mut admin = Administration {
+            tls: true,
+            allowed_hosts: vec!["Panel.Example.COM.".into()],
+            ..Administration::default()
+        };
+        admin.validate(&crate::tls::Settings::default()).unwrap();
+        assert_eq!(admin.allowed_hosts, vec!["panel.example.com".to_owned()]);
+        admin.allowed_hosts = vec!["panel.example.com".into(), "PANEL.EXAMPLE.COM.".into()];
+        assert!(admin.validate(&crate::tls::Settings::default()).is_err());
+    }
+    #[test]
+    fn administration_hostname_count_is_not_artificially_capped() {
+        let mut admin = Administration {
+            tls: true,
+            allowed_hosts: (0..40)
+                .map(|index| format!("admin-{index}.example.test"))
+                .collect(),
+            ..Administration::default()
+        };
+        assert!(admin.validate(&crate::tls::Settings::default()).is_ok());
+        assert_eq!(admin.allowed_hosts.len(), 40);
+    }
+}