957 lines
37 KiB
Rust
957 lines
37 KiB
Rust
mod tests {
|
|
use super::*;
|
|
fn policy() -> ValidationPolicy {
|
|
ValidationPolicy {
|
|
tls_addr: None,
|
|
cert_dir: None,
|
|
data_dir: None,
|
|
proxy_addr: "127.0.0.1:8080".parse().unwrap(),
|
|
admin_addr: "127.0.0.1:9090".parse().unwrap(),
|
|
}
|
|
}
|
|
#[test]
|
|
fn route_handles_reuse_snapshot_ownership_without_cloning_compiled_routes() {
|
|
let snapshot = compile(demo_config("127.0.0.1:9000".parse().unwrap()), 1, &policy()).unwrap();
|
|
let local = "127.0.0.1:8080".parse().unwrap();
|
|
let first = snapshot.select_on_arc("localhost", "/", local, false).unwrap();
|
|
let second = snapshot.select_on_arc("localhost", "/child", local, false).unwrap();
|
|
// Both selectors point into one immutable compiled snapshot.
|
|
assert!(std::sync::Arc::ptr_eq(first, second));
|
|
let legacy = snapshot.select_on("localhost", "/", local, false).unwrap();
|
|
assert!(std::ptr::eq(first.as_ref(), legacy));
|
|
assert!(snapshot.select_on_arc("not-this-host", "/", local, false).is_none());
|
|
}
|
|
|
|
#[test]
|
|
fn missing_http2_settings_use_release_defaults() {
|
|
let config: Config = serde_json::from_value(serde_json::json!({})).unwrap();
|
|
assert_eq!(config.http2, crate::settings::Http2Connections::default());
|
|
config.http2.validate().unwrap();
|
|
}
|
|
|
|
#[test]
|
|
fn normalized_unicode_prefix_survives_serialization_and_recompile() {
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
config.vhosts[0].routes[0].path_prefix = "/caf%C3%A9".into();
|
|
let first = compile(config, 0, &policy()).unwrap();
|
|
let saved = serde_json::to_string(&first.envelope.config).unwrap();
|
|
let second = compile(serde_json::from_str(&saved).unwrap(), 1, &policy()).unwrap();
|
|
assert!(second.select("localhost", "/caf\u{e9}/hello").is_some());
|
|
}
|
|
#[test]
|
|
fn web_server_main_source_needs_no_backend_pool() {
|
|
let tmp = tempfile::TempDir::new().unwrap();
|
|
std::fs::write(tmp.path().join("index.html"), b"hello").unwrap();
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
config.web_services.push(crate::web_server::Service {
|
|
id: "site".into(),
|
|
name: "Site".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
index: vec!["index.html".into()],
|
|
directory_listing: false,
|
|
..Default::default()
|
|
});
|
|
config.vhosts[0].source = crate::vhost::Source::WebServer {
|
|
web_service_id: "site".into(),
|
|
};
|
|
config.vhosts[0].backends.clear();
|
|
config.vhosts[0].routes.clear();
|
|
let snapshot = compile(config, 1, &policy()).unwrap();
|
|
let route = snapshot.select("localhost", "/").unwrap();
|
|
assert!(matches!(&route.source, CompiledSource::WebServer(_)));
|
|
assert!(route.pool.is_none());
|
|
assert!(route.backend.is_none());
|
|
assert!(snapshot.pools.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn web_server_and_reverse_proxy_can_share_one_vhost() {
|
|
let tmp = tempfile::TempDir::new().unwrap();
|
|
std::fs::write(tmp.path().join("index.html"), b"hello").unwrap();
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
config.web_services.push(crate::web_server::Service {
|
|
id: "site".into(),
|
|
name: "Site".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
index: vec!["index.html".into()],
|
|
directory_listing: false,
|
|
..Default::default()
|
|
});
|
|
let host = &mut config.vhosts[0];
|
|
host.source = crate::vhost::Source::WebServer {
|
|
web_service_id: "site".into(),
|
|
};
|
|
host.routes = vec![crate::vhost::PathRoute {
|
|
id: "api".into(),
|
|
path_prefix: "/api".into(),
|
|
source: crate::vhost::Source::ReverseProxy,
|
|
..Default::default()
|
|
}];
|
|
let snapshot = compile(config, 1, &policy()).unwrap();
|
|
let root = snapshot.select("localhost", "/").unwrap();
|
|
let api = snapshot.select("localhost", "/api/test").unwrap();
|
|
assert!(matches!(&root.source, CompiledSource::WebServer(_)));
|
|
assert!(matches!(&api.source, CompiledSource::ReverseProxy));
|
|
assert!(api.pool.is_some());
|
|
assert!(api.backend.is_some());
|
|
}
|
|
|
|
#[test]
|
|
fn one_web_service_can_be_reused_by_multiple_vhosts() {
|
|
let tmp = tempfile::TempDir::new().unwrap();
|
|
std::fs::write(tmp.path().join("index.html"), b"shared").unwrap();
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
config.web_services.push(crate::web_server::Service {
|
|
id: "shared-site".into(),
|
|
name: "Shared site".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
index: vec!["index.html".into()],
|
|
directory_listing: false,
|
|
..Default::default()
|
|
});
|
|
let first = &mut config.vhosts[0];
|
|
first.source = crate::vhost::Source::WebServer {
|
|
web_service_id: "shared-site".into(),
|
|
};
|
|
first.backends.clear();
|
|
first.routes.clear();
|
|
|
|
let mut second = first.clone();
|
|
second.id = "shared-second".into();
|
|
second.frontend.hosts = vec!["second.localhost".into()];
|
|
config.vhosts.push(second);
|
|
|
|
let snapshot = compile(config, 1, &policy()).unwrap();
|
|
let first_route = snapshot.select("localhost", "/").unwrap();
|
|
let second_route = snapshot.select("second.localhost", "/").unwrap();
|
|
assert!(
|
|
matches!(&first_route.source, CompiledSource::WebServer(service) if service.id == "shared-site")
|
|
);
|
|
assert!(
|
|
matches!(&second_route.source, CompiledSource::WebServer(service) if service.id == "shared-site")
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn unknown_web_service_reference_is_rejected() {
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
config.vhosts[0].source = crate::vhost::Source::WebServer {
|
|
web_service_id: "missing".into(),
|
|
};
|
|
let error = compile(config, 1, &policy()).unwrap_err().to_string();
|
|
assert!(error.contains("unknown Web Service"), "{error}");
|
|
}
|
|
|
|
#[test]
|
|
fn missing_source_fields_remain_reverse_proxy_for_old_configs() {
|
|
let source: crate::vhost::Source =
|
|
serde_json::from_value(serde_json::json!({"type":"reverse_proxy"})).unwrap();
|
|
assert_eq!(source, crate::vhost::Source::ReverseProxy);
|
|
let route: crate::vhost::PathRoute =
|
|
serde_json::from_value(serde_json::json!({"id":"legacy"})).unwrap();
|
|
assert_eq!(route.source, crate::vhost::Source::ReverseProxy);
|
|
}
|
|
|
|
#[test]
|
|
fn host_normalization() {
|
|
assert_eq!(request_host("EXAMPLE.com.:8080").unwrap(), "example.com");
|
|
assert_eq!(request_host("example.com:65535").unwrap(), "example.com");
|
|
assert_eq!(request_host("[::1]").unwrap(), "::1");
|
|
assert_eq!(request_host("[::1]:8080").unwrap(), "::1");
|
|
assert_eq!(request_host("a:").unwrap(), "a");
|
|
assert_eq!(request_host("[::1]:").unwrap(), "::1");
|
|
for invalid in [
|
|
"",
|
|
"a..b",
|
|
"*.test",
|
|
"a/b",
|
|
"user@host",
|
|
"-bad.test",
|
|
"a:99999",
|
|
"a:0",
|
|
"a:abc",
|
|
"[::1]:99999",
|
|
"[::1]:0",
|
|
"[::1]suffix",
|
|
"[::1]suffix:80",
|
|
] {
|
|
assert!(request_host(invalid).is_err(), "{invalid}");
|
|
}
|
|
}
|
|
#[test]
|
|
fn wildcard_host_patterns_are_normalized_and_exact_hosts_win() {
|
|
assert_eq!(
|
|
normalize_host_pattern("*.Example.TEST.").unwrap(),
|
|
"*.example.test"
|
|
);
|
|
for invalid in ["*", "foo.*.test", "*.com", "*.*.example.test"] {
|
|
assert!(normalize_host_pattern(invalid).is_err(), "{invalid}");
|
|
}
|
|
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].id = "wildcard".into();
|
|
c.vhosts[0].frontend.hosts = vec!["*.example.test".into()];
|
|
let mut exact = c.vhosts[0].clone();
|
|
exact.id = "exact".into();
|
|
exact.frontend.hosts = vec!["api.example.test".into()];
|
|
c.vhosts.push(exact);
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
|
|
assert_eq!(
|
|
snapshot
|
|
.select_on("api.example.test", "/", local, false)
|
|
.unwrap()
|
|
.id,
|
|
"exact/main"
|
|
);
|
|
assert_eq!(
|
|
snapshot
|
|
.select_on("www.example.test", "/", local, false)
|
|
.unwrap()
|
|
.id,
|
|
"wildcard/main"
|
|
);
|
|
}
|
|
#[test]
|
|
fn logging_vhost_resolution_reuses_router_host_precedence() {
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
config.vhosts[0].id = "wildcard".into();
|
|
config.vhosts[0].frontend.hosts = vec!["*.example.test".into()];
|
|
let mut exact = config.vhosts[0].clone();
|
|
exact.id = "exact".into();
|
|
exact.frontend.hosts = vec!["api.example.test".into()];
|
|
config.vhosts.push(exact);
|
|
let snapshot = compile(config, 1, &policy()).unwrap();
|
|
let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
|
|
|
|
let routed = snapshot
|
|
.resolve_logging_vhost(
|
|
local,
|
|
false,
|
|
Some("wildcard"),
|
|
Some("api.example.test"),
|
|
None,
|
|
None,
|
|
)
|
|
.unwrap();
|
|
assert_eq!(routed.vhost, "wildcard");
|
|
assert_eq!(routed.matched_by, "router");
|
|
|
|
let exact = snapshot
|
|
.resolve_logging_vhost(local, false, None, Some("API.EXAMPLE.TEST:8080"), None, None)
|
|
.unwrap();
|
|
assert_eq!(exact.vhost, "exact");
|
|
assert_eq!(exact.matched_by, "authority");
|
|
|
|
let wildcard = snapshot
|
|
.resolve_logging_vhost(local, false, None, None, Some("www.example.test:8080"), None)
|
|
.unwrap();
|
|
assert_eq!(wildcard.vhost, "wildcard");
|
|
assert_eq!(wildcard.matched_by, "host");
|
|
|
|
let sni = snapshot
|
|
.resolve_logging_vhost(local, false, None, None, None, Some("api.example.test"))
|
|
.unwrap();
|
|
assert_eq!(sni.vhost, "exact");
|
|
assert_eq!(sni.matched_by, "sni");
|
|
|
|
assert!(snapshot
|
|
.resolve_logging_vhost(local, false, None, None, None, Some("unknown.test"))
|
|
.is_none());
|
|
assert!(snapshot
|
|
.resolve_logging_vhost(local, false, None, None, None, None)
|
|
.is_none());
|
|
}
|
|
|
|
#[test]
|
|
fn reusable_acl_profile_reference_is_compiled_and_unknown_reference_fails() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.acl_profiles = serde_json::from_value(serde_json::json!([{
|
|
"id":"office", "name":"Office",
|
|
"acl":{"default":"deny","rules":[{"network":"10.0.0.0/8","action":"allow"}]},
|
|
"country_access":{"mode":"block","countries":["RU"]}
|
|
}]))
|
|
.unwrap();
|
|
c.vhosts[0].acl_profile_id = Some("office".into());
|
|
let snapshot = compile(c.clone(), 1, &policy()).unwrap();
|
|
let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
|
|
let frontend = snapshot.frontend("localhost", local, false).unwrap();
|
|
assert_eq!(frontend.acl_profile_id.as_deref(), Some("office"));
|
|
assert!(frontend
|
|
.profile_acl
|
|
.as_ref()
|
|
.unwrap()
|
|
.allows("10.2.3.4".parse().unwrap()));
|
|
assert!(!frontend
|
|
.profile_acl
|
|
.as_ref()
|
|
.unwrap()
|
|
.allows("192.0.2.1".parse().unwrap()));
|
|
assert!(!frontend.profile_country_access.allows(Some("RU")));
|
|
|
|
c.vhosts[0].acl_profile_id = Some("missing".into());
|
|
assert!(compile(c, 2, &policy()).is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn rfc8441_is_advertised_only_on_opted_in_h2_capable_listener() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].websockets = true;
|
|
c.vhosts[0].websocket_rfc8441 = true;
|
|
let error = compile(c.clone(), 1, &policy()).unwrap_err().to_string();
|
|
assert!(error.contains("HTTP/2-capable listener"), "{error}");
|
|
|
|
c.listeners.endpoints[0].binding.h2c = true;
|
|
let snapshot = compile(c.clone(), 2, &policy()).unwrap();
|
|
let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
|
|
assert!(snapshot.websocket_rfc8441_on(local, false));
|
|
assert!(!snapshot.websocket_rfc8441_on(local, true));
|
|
|
|
c.vhosts[0].websocket_rfc8441 = false;
|
|
let snapshot = compile(c, 3, &policy()).unwrap();
|
|
assert!(!snapshot.websocket_rfc8441_on(local, false));
|
|
}
|
|
#[test]
|
|
fn force_ssl_requires_plain_http_and_chooses_https_target() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].force_ssl = true;
|
|
let error = compile(c.clone(), 1, &policy()).unwrap_err().to_string();
|
|
assert!(
|
|
error.contains("at least one selected TLS listener"),
|
|
"{error}"
|
|
);
|
|
|
|
c.listeners.endpoints.push(crate::settings::NamedListener {
|
|
id: "https-a".into(),
|
|
name: "HTTPS A".into(),
|
|
scope: crate::settings::ListenerScope::Internal,
|
|
enabled: true,
|
|
binding: crate::vhost::Listener {
|
|
address: "127.0.0.1:8443".parse().unwrap(),
|
|
tls: true,
|
|
http2: true,
|
|
http2_settings: Some(crate::settings::Http2Connections::default()),
|
|
h2c: false,
|
|
http3: None,
|
|
},
|
|
additional_addresses: vec![],
|
|
});
|
|
c.listeners.endpoints.push(crate::settings::NamedListener {
|
|
id: "https-b".into(),
|
|
name: "HTTPS B".into(),
|
|
scope: crate::settings::ListenerScope::Internal,
|
|
enabled: true,
|
|
binding: crate::vhost::Listener {
|
|
address: "127.0.0.1:9443".parse().unwrap(),
|
|
tls: true,
|
|
http2: true,
|
|
http2_settings: Some(crate::settings::Http2Connections::default()),
|
|
h2c: false,
|
|
http3: None,
|
|
},
|
|
additional_addresses: vec![],
|
|
});
|
|
c.vhosts[0].frontend.listener_ids = vec!["http".into(), "https-a".into(), "https-b".into()];
|
|
let error = compile(c.clone(), 2, &policy()).unwrap_err().to_string();
|
|
assert!(error.contains("cannot choose an HTTPS target"), "{error}");
|
|
|
|
c.listeners
|
|
.endpoints
|
|
.iter_mut()
|
|
.find(|item| item.id == "https-b")
|
|
.unwrap()
|
|
.binding
|
|
.address = "127.0.0.1:443".parse().unwrap();
|
|
let snapshot = compile(c.clone(), 3, &policy()).unwrap();
|
|
let frontend = snapshot
|
|
.frontend("localhost", "127.0.0.1:8080".parse().unwrap(), false)
|
|
.unwrap();
|
|
assert_eq!(frontend.https_redirect_port, Some(443));
|
|
|
|
c.vhosts[0].frontend.listener_ids = vec!["https-a".into(), "https-b".into()];
|
|
let error = compile(c, 4, &policy()).unwrap_err().to_string();
|
|
assert!(error.contains("plain HTTP listener"), "{error}");
|
|
}
|
|
#[test]
|
|
fn preserve_host_is_valid_with_every_upstream_protocol() {
|
|
for protocol in [
|
|
UpstreamProtocol::Http1,
|
|
UpstreamProtocol::Auto,
|
|
UpstreamProtocol::Http2,
|
|
UpstreamProtocol::H2,
|
|
] {
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
let member = &mut config.vhosts[0].backends[0];
|
|
member.url = "https://10.87.20.2:443".into();
|
|
member.allow_private = true;
|
|
member.preserve_host = true;
|
|
member.protocol = protocol;
|
|
let snapshot = compile(config, 1, &policy()).unwrap();
|
|
assert!(snapshot.pools[0].members[0].backend.preserve_host);
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn backend_tls_server_name_keeps_network_origin_and_changes_verified_request_name() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].backends[0].url = "https://10.87.20.2:443".into();
|
|
c.vhosts[0].backends[0].allow_private = true;
|
|
c.vhosts[0].backends[0].tls_server_name = Some("Backend.Unitra.Internal.".into());
|
|
let s = compile(c, 1, &policy()).unwrap();
|
|
let backend = &s.pools[0].members[0].backend;
|
|
assert_eq!(backend.origin, "https://10.87.20.2:443");
|
|
assert_eq!(
|
|
backend.request_origin,
|
|
"https://backend.unitra.internal:443"
|
|
);
|
|
}
|
|
#[test]
|
|
fn tls_server_name_is_https_dns_only() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].backends[0].tls_server_name = Some("backend.internal".into());
|
|
assert!(compile(c.clone(), 1, &policy()).is_err());
|
|
c.vhosts[0].backends[0].url = "https://10.87.20.2:443".into();
|
|
c.vhosts[0].backends[0].tls_server_name = Some("10.87.20.2".into());
|
|
assert!(compile(c, 1, &policy()).is_err());
|
|
}
|
|
#[test]
|
|
fn backend_tls_verification_defaults_off_and_can_be_enabled_explicitly() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
assert!(!c.vhosts[0].backends[0].tls_verify);
|
|
assert!(compile(c.clone(), 1, &policy()).is_ok());
|
|
|
|
c.vhosts[0].backends[0].url = "https://10.87.20.2:443".into();
|
|
c.vhosts[0].backends[0].allow_private = true;
|
|
c.vhosts[0].backends[0].tls_ca_pem = Some("not a certificate".into());
|
|
assert!(compile(c.clone(), 1, &policy()).is_ok());
|
|
|
|
c.vhosts[0].backends[0].tls_verify = true;
|
|
assert!(compile(c, 1, &policy()).is_err());
|
|
}
|
|
#[test]
|
|
fn redirect_hosts_share_listener_routing_without_opening_vhost_routes() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.redirects = serde_json::from_value(serde_json::json!([{
|
|
"id":"legacy","name":"Legacy","frontend":{"hosts":["old.localhost"],"listener_ids":["http"]},
|
|
"rules":[{"id":"root","target":"https://new.localhost/","status_code":308}]
|
|
}])).unwrap();
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
|
|
let (_host, rule) = snapshot
|
|
.redirect_on("old.localhost", "/a", local, false)
|
|
.unwrap();
|
|
assert_eq!(rule.id, "root");
|
|
assert!(snapshot
|
|
.select_on("old.localhost", "/a", local, false)
|
|
.is_none());
|
|
}
|
|
|
|
#[test]
|
|
fn custom_locations_override_but_main_vhost_remains_fallback() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
// The demo document still contains the pre-0.16 synthetic root route.
|
|
// Validation must normalize it away and keep the main backend internally.
|
|
let mut custom = c.vhosts[0].routes[0].clone();
|
|
custom.id = "test".into();
|
|
custom.path_prefix = "/test".into();
|
|
custom.response = Some(crate::vhost::LocationResponse {
|
|
status: 200,
|
|
content_type: "text/plain".into(),
|
|
body: "ok".into(),
|
|
});
|
|
c.vhosts[0].routes.push(custom);
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/test").unwrap().id,
|
|
"demo/test"
|
|
);
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/test/a").unwrap().id,
|
|
"demo/test"
|
|
);
|
|
assert_eq!(snapshot.select("localhost", "/").unwrap().id, "demo/main");
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/abc").unwrap().id,
|
|
"demo/main"
|
|
);
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/static/a.js").unwrap().id,
|
|
"demo/main"
|
|
);
|
|
assert!(snapshot.envelope.config.vhosts[0]
|
|
.routes
|
|
.iter()
|
|
.all(|route| !route.is_legacy_main_fallback()));
|
|
}
|
|
|
|
#[test]
|
|
fn deliberate_root_custom_location_can_override_main_fallback() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
let root = &mut c.vhosts[0].routes[0];
|
|
root.response = Some(crate::vhost::LocationResponse {
|
|
status: 204,
|
|
content_type: "text/plain".into(),
|
|
body: String::new(),
|
|
});
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/anything").unwrap().id,
|
|
"demo/root"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn direct_admin_listener_backend_is_marked_for_guarded_control_plane_use() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.administration.listen = Some("0.0.0.0:9090".parse().unwrap());
|
|
c.administration.tls = true;
|
|
c.vhosts[0].backends[0].url = "https://127.0.0.1:9090".into();
|
|
c.vhosts[0].backends[0].allow_private = true;
|
|
c.vhosts[0].backends[0].accept_local_listener_risk = true;
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
assert!(snapshot.pools[0].members[0].backend.targets_admin_listener);
|
|
}
|
|
|
|
#[test]
|
|
fn backend_diagnostic_flags_compile_to_frontend() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].backend_header = true;
|
|
c.vhosts[0].backend_timing_header = true;
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
|
|
let frontend = snapshot.frontend("localhost", local, false).unwrap();
|
|
assert!(frontend.backend_header);
|
|
assert!(frontend.backend_timing_header);
|
|
}
|
|
|
|
|
|
#[test]
|
|
fn path_boundaries() {
|
|
assert!(prefix_matches("/api", "/api"));
|
|
assert!(prefix_matches("/api", "/api/users"));
|
|
assert!(!prefix_matches("/api", "/apix"));
|
|
assert!(prefix_matches("/", "/anything"));
|
|
}
|
|
#[test]
|
|
fn invalid_per_backend_health_policy_rejected_without_global_override() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].backends[0].health_check = Some(crate::balance::HealthCheck {
|
|
mode: crate::balance::HealthMode::Http,
|
|
interval_ms: 300,
|
|
timeout_ms: 400,
|
|
slow_response_ms: 0,
|
|
..Default::default()
|
|
});
|
|
assert!(compile(c.clone(), 1, &policy()).is_err());
|
|
c.vhosts[0].backends[0].health_check.as_mut().unwrap().timeout_ms = 200;
|
|
assert!(compile(c, 1, &policy()).is_ok());
|
|
}
|
|
#[test]
|
|
fn private_requires_opt_in_and_metadata_always_denied() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
assert!(compile(c.clone(), 1, &policy()).is_ok());
|
|
c.vhosts[0].backends[0].allow_private = false;
|
|
assert!(compile(c.clone(), 1, &policy()).is_err());
|
|
c.vhosts[0].backends[0].allow_private = true;
|
|
for target in [
|
|
"http://169.254.169.254",
|
|
"http://100.100.100.200",
|
|
"http://0.0.0.0",
|
|
"http://127.0.0.1:9090",
|
|
"http://[::ffff:169.254.169.254]",
|
|
"http://[fe80::1]",
|
|
"http://user:pass@127.0.0.1:9000",
|
|
] {
|
|
c.vhosts[0].backends[0].url = target.into();
|
|
assert!(compile(c.clone(), 1, &policy()).is_err(), "{target}");
|
|
}
|
|
c.vhosts[0].backends[0].url = "http://127.0.0.1:9090".into();
|
|
c.vhosts[0].backends[0].accept_local_listener_risk = true;
|
|
assert!(compile(c.clone(), 1, &policy()).is_ok());
|
|
c.vhosts[0].backends[0].allow_private = false;
|
|
assert!(compile(c, 1, &policy()).is_err());
|
|
}
|
|
#[test]
|
|
fn longest_prefix_and_aliases() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
let mut specific = c.vhosts[0].routes[0].clone();
|
|
specific.id = "api".into();
|
|
specific.path_prefix = "/api".into();
|
|
c.vhosts[0].routes.push(specific);
|
|
let s = compile(c, 7, &policy()).unwrap();
|
|
assert_eq!(s.select("localhost", "/api/x").unwrap().id, "demo/api");
|
|
assert_eq!(s.select("demo.localhost", "/apix").unwrap().id, "demo/main");
|
|
assert!(s.select("unknown", "/").is_none());
|
|
assert_eq!(s.envelope.revision, 7);
|
|
}
|
|
#[test]
|
|
fn nginx_style_location_precedence_exact_priority_regex_prefix() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].routes[0].id = "root".into();
|
|
|
|
let mut prefix = c.vhosts[0].routes[0].clone();
|
|
prefix.id = "api-prefix".into();
|
|
prefix.path_prefix = "/api".into();
|
|
|
|
let mut regex = c.vhosts[0].routes[0].clone();
|
|
regex.id = "api-regex".into();
|
|
regex.match_type = crate::vhost::PathMatch::Regex;
|
|
regex.path_prefix = r"^/api/v[0-9]+/".into();
|
|
|
|
let mut exact = c.vhosts[0].routes[0].clone();
|
|
exact.id = "api-exact".into();
|
|
exact.match_type = crate::vhost::PathMatch::Exact;
|
|
exact.path_prefix = "/api/v1/fixed".into();
|
|
|
|
let mut trailing_exact = c.vhosts[0].routes[0].clone();
|
|
trailing_exact.id = "trailing-exact".into();
|
|
trailing_exact.match_type = crate::vhost::PathMatch::Exact;
|
|
trailing_exact.path_prefix = "/trailing/".into();
|
|
|
|
c.vhosts[0]
|
|
.routes
|
|
.extend([prefix.clone(), regex, exact, trailing_exact]);
|
|
let snapshot = compile(c.clone(), 1, &policy()).unwrap();
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/api/v1/fixed").unwrap().id,
|
|
"demo/api-exact"
|
|
);
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/api/v2/users").unwrap().id,
|
|
"demo/api-regex"
|
|
);
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/api/plain").unwrap().id,
|
|
"demo/api-prefix"
|
|
);
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/trailing/").unwrap().id,
|
|
"demo/trailing-exact"
|
|
);
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/trailing").unwrap().id,
|
|
"demo/main"
|
|
);
|
|
|
|
c.vhosts[0].routes.retain(|route| route.id != "api-prefix");
|
|
prefix.match_type = crate::vhost::PathMatch::PrefixPriority;
|
|
prefix.id = "api-priority".into();
|
|
c.vhosts[0].routes.push(prefix);
|
|
let snapshot = compile(c, 2, &policy()).unwrap();
|
|
assert_eq!(
|
|
snapshot.select("localhost", "/api/v2/users").unwrap().id,
|
|
"demo/api-priority"
|
|
);
|
|
}
|
|
#[test]
|
|
fn location_rewrites_are_normalized_and_regex_captures_expand() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
let route = &mut c.vhosts[0].routes[0];
|
|
route.match_type = crate::vhost::PathMatch::Regex;
|
|
route.path_prefix = r"^/api/v([0-9]+)(/.*)$".into();
|
|
route.rewrite = crate::vhost::PathRewrite {
|
|
mode: crate::vhost::RewriteMode::Regex,
|
|
value: "/service/${1}${2}".into(),
|
|
};
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
let selected = snapshot.select("localhost", "/api/v42/items").unwrap();
|
|
assert_eq!(
|
|
selected
|
|
.rewritten_path("/api/v42/items")
|
|
.unwrap()
|
|
.as_deref(),
|
|
Some("/service/42/items")
|
|
);
|
|
assert_eq!(
|
|
selected
|
|
.rewritten_path("/api/v42/Ubuntu 14.04 LTS")
|
|
.unwrap()
|
|
.as_deref(),
|
|
Some("/service/42/Ubuntu 14.04 LTS")
|
|
);
|
|
}
|
|
#[test]
|
|
fn custom_location_response_is_validated() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].routes[0].response = Some(crate::vhost::LocationResponse {
|
|
status: 200,
|
|
content_type: "application/json".into(),
|
|
body: r#"{"ok":true}"#.into(),
|
|
});
|
|
assert!(compile(c.clone(), 1, &policy()).is_ok());
|
|
c.vhosts[0].routes[0].response.as_mut().unwrap().status = 199;
|
|
assert!(compile(c.clone(), 1, &policy()).is_err());
|
|
c.vhosts[0].routes[0].response.as_mut().unwrap().status = 200;
|
|
c.vhosts[0].routes[0]
|
|
.response
|
|
.as_mut()
|
|
.unwrap()
|
|
.content_type = "text/plain\r\nx-bad: 1".into();
|
|
assert!(compile(c, 1, &policy()).is_err());
|
|
}
|
|
#[test]
|
|
fn local_response_hosts_reserve_frontends_and_do_not_require_backends() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.not_found_hosts = serde_json::from_value(serde_json::json!([{
|
|
"id":"missing",
|
|
"name":"Missing site",
|
|
"frontend":{"hosts":["missing.localhost"],"listener_ids":["http"]},
|
|
"page":{"kind":"html","status":404,"html":"<h1>Not found</h1>"}
|
|
}]))
|
|
.unwrap();
|
|
let snapshot = compile(c.clone(), 1, &policy()).unwrap();
|
|
let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
|
|
let host = snapshot
|
|
.not_found_host_on("missing.localhost", local, false)
|
|
.unwrap();
|
|
assert_eq!(host.id, "missing");
|
|
assert_eq!(host.page.status, Some(404));
|
|
|
|
c.not_found_hosts[0].frontend.hosts = vec!["localhost".into()];
|
|
assert!(compile(c, 2, &policy()).is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn conflicts_are_rejected() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
// Keep both entries as real Custom Locations; the untouched legacy root
|
|
// is intentionally normalized away before duplicate-matcher validation.
|
|
c.vhosts[0].routes[0].path_prefix = "/api".into();
|
|
let mut duplicate = c.vhosts[0].routes[0].clone();
|
|
duplicate.id = "other".into();
|
|
c.vhosts[0].routes.push(duplicate);
|
|
assert!(compile(c, 0, &policy()).is_err());
|
|
}
|
|
#[test]
|
|
fn tls12_only_vhost_override_is_valid_without_http3_listener() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].tls_policy = Some(crate::tls::ProtocolPolicy {
|
|
tls12: true,
|
|
tls13: false,
|
|
cipher_suites: vec![],
|
|
});
|
|
assert!(compile(c, 1, &policy()).is_ok());
|
|
}
|
|
|
|
#[test]
|
|
fn persisted_remote_administration_requires_tls() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.administration.listen = Some("192.0.2.10:9090".parse().unwrap());
|
|
assert!(compile(c.clone(), 1, &policy()).is_err());
|
|
c.administration.tls = true;
|
|
assert!(compile(c, 1, &policy()).is_ok());
|
|
}
|
|
#[test]
|
|
fn legacy_startup_remote_administration_is_left_to_cli_risk_gate() {
|
|
let mut p = policy();
|
|
p.admin_addr = "0.0.0.0:9090".parse().unwrap();
|
|
let c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
assert!(c.administration.listen.is_none());
|
|
assert!(compile(c, 1, &p).is_ok());
|
|
}
|
|
|
|
#[test]
|
|
fn www_redirect_claims_companion_hostname_and_keeps_first_host_canonical() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].frontend.hosts = vec!["example.test".into()];
|
|
c.vhosts[0].www_redirect = true;
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
assert!(snapshot.select("www.example.test", "/path").is_some());
|
|
let frontend = snapshot
|
|
.frontend("www.example.test", "127.0.0.1:8080".parse().unwrap(), false)
|
|
.unwrap();
|
|
assert_eq!(
|
|
frontend.www_redirect.as_ref(),
|
|
Some(&("www.example.test".into(), "example.test".into()))
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn multiple_domains_share_vhost_and_selected_canonical_redirect() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].frontend.hosts = vec![
|
|
"suba.local".into(), "subb.local".into(), "site.test".into(),
|
|
];
|
|
c.vhosts[0].www_redirect = true;
|
|
c.vhosts[0].www_redirect_target = Some("site.test".into());
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
for hostname in ["suba.local", "subb.local", "site.test", "www.site.test"] {
|
|
assert!(snapshot.select(hostname, "/same").is_some(), "{hostname}");
|
|
}
|
|
for hostname in ["suba.local", "subb.local", "www.site.test"] {
|
|
let frontend = snapshot.frontend(hostname, "127.0.0.1:8080".parse().unwrap(), false).unwrap();
|
|
assert_eq!(frontend.www_redirect.as_ref(),
|
|
Some(&("www.site.test".into(), "site.test".into())));
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn implicit_www_target_is_claimed_and_other_domain_stays_independent() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].frontend.hosts = vec!["suba.local".into(), "subb.local".into()];
|
|
c.vhosts[0].www_redirect = true;
|
|
c.vhosts[0].www_redirect_target = Some("www.subb.local".into());
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
for host in ["suba.local", "subb.local", "www.subb.local"] {
|
|
assert!(snapshot.select(host, "/path").is_some(), "{host}");
|
|
}
|
|
assert!(snapshot.select("www.suba.local", "/path").is_none());
|
|
let frontend = snapshot.frontend("subb.local", "127.0.0.1:8080".parse().unwrap(), false).unwrap();
|
|
assert_eq!(frontend.www_redirect.as_ref(),
|
|
Some(&(String::from("subb.local"), String::from("www.subb.local"))));
|
|
}
|
|
|
|
#[test]
|
|
fn selected_www_redirect_target_must_belong_to_vhost() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].frontend.hosts = vec!["suba.local".into()];
|
|
c.vhosts[0].www_redirect = true;
|
|
c.vhosts[0].www_redirect_target = Some("elsewhere.local".into());
|
|
assert!(compile(c, 1, &policy()).is_err());
|
|
}
|
|
|
|
#[test]
|
|
fn http_health_check_defaults_host_to_first_exact_vhost_dns_name() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].frontend.hosts = vec!["app.example.test".into()];
|
|
c.vhosts[0].load_balancing.health_check.mode = crate::balance::HealthMode::Http;
|
|
c.vhosts[0].load_balancing.health_check.host = None;
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
assert_eq!(
|
|
snapshot.pools[0].settings.health_check.host.as_deref(),
|
|
Some("app.example.test")
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn per_member_http_health_inherits_vhost_dns_even_when_global_health_is_tcp() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].frontend.hosts = vec!["app.example.test".into()];
|
|
// demo_config explicitly disables probes; this case exercises TCP fallback.
|
|
c.vhosts[0].load_balancing.health_check.mode = crate::balance::HealthMode::Tcp;
|
|
assert_eq!(c.vhosts[0].load_balancing.health_check.mode, crate::balance::HealthMode::Tcp);
|
|
c.vhosts[0].backends[0].health_check = Some(crate::balance::HealthCheck {
|
|
mode: crate::balance::HealthMode::Http, path: "/healthz".into(), ..Default::default()
|
|
});
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
let pool = &snapshot.pools[0];
|
|
assert_eq!(pool.settings.health_for(&pool.members[0].definition).host.as_deref(), Some("app.example.test"));
|
|
}
|
|
#[test]
|
|
fn explicit_http_health_check_host_override_wins_over_vhost_hostname() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].frontend.hosts = vec!["app.example.test".into()];
|
|
c.vhosts[0].load_balancing.health_check.mode = crate::balance::HealthMode::Http;
|
|
c.vhosts[0].load_balancing.health_check.host = Some("health.example.test".into());
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
assert_eq!(
|
|
snapshot.pools[0].settings.health_check.host.as_deref(),
|
|
Some("health.example.test")
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn custom_location_redirect_supports_separate_capture_regex_and_query() {
|
|
let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
c.vhosts[0].routes = vec![crate::vhost::PathRoute {
|
|
id: "archives".into(),
|
|
path_prefix: r"\.(?:tar\.gz|zip?)$".into(),
|
|
match_type: crate::vhost::PathMatch::RegexInsensitive,
|
|
response: None,
|
|
redirect: Some(crate::vhost::LocationRedirect {
|
|
status: 301,
|
|
target: "https://storage.example.test/o/$1".into(),
|
|
rewrite_pattern: Some(r"^/(.*)$".into()),
|
|
preserve_query: true,
|
|
}),
|
|
..Default::default()
|
|
}];
|
|
let snapshot = compile(c, 1, &policy()).unwrap();
|
|
let route = snapshot.select("localhost", "/repo/file.tar.gz").unwrap();
|
|
let uri: http::Uri = "/repo/file.tar.gz?download=1".parse().unwrap();
|
|
let location = route
|
|
.redirect_location("/repo/file.tar.gz", &uri)
|
|
.unwrap()
|
|
.unwrap();
|
|
assert_eq!(
|
|
location,
|
|
"https://storage.example.test/o/repo/file.tar.gz?download=1"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn shared_php_fpm_profile_is_reused_and_detach_restores_local_configuration() {
|
|
let tmp = tempfile::TempDir::new().unwrap();
|
|
std::fs::write(tmp.path().join("index.php"), b"<?php echo 'ok';").unwrap();
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
config.php_fpm_profiles.push(crate::web_server::PhpFpmProfile {
|
|
id: "php-default".into(),
|
|
name: "Default PHP pool".into(),
|
|
php: crate::web_server::Php {
|
|
enabled: true,
|
|
endpoint: "tcp:127.0.0.1:9000".into(),
|
|
..Default::default()
|
|
},
|
|
});
|
|
let service = crate::web_server::Service {
|
|
id: "site-one".into(),
|
|
name: "Site One".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
php_profile_id: Some("php-default".into()),
|
|
// Standalone settings remain distinct and disabled.
|
|
php: crate::web_server::Php::default(),
|
|
..Default::default()
|
|
};
|
|
let mut second = service.clone();
|
|
second.id = "site-two".into();
|
|
second.name = "Site Two".into();
|
|
config.web_services.extend([service, second]);
|
|
config.vhosts[0].source = crate::vhost::Source::WebServer {
|
|
web_service_id: "site-one".into(),
|
|
};
|
|
config.vhosts[0].routes.clear();
|
|
config.vhosts[0].backends.clear();
|
|
|
|
let snapshot = compile(config, 1, &policy()).unwrap();
|
|
for id in ["site-one", "site-two"] {
|
|
let compiled = snapshot.web_php_services.get(id).unwrap();
|
|
assert!(compiled.php.is_some(), "{id} must use the shared FPM profile");
|
|
}
|
|
assert_eq!(snapshot.envelope.config.php_fpm_profiles.len(), 1);
|
|
assert!(!snapshot.envelope.config.web_services[0].php.enabled);
|
|
assert!(!snapshot.envelope.config.web_services[1].php.enabled);
|
|
|
|
let serialized = serde_json::to_string(&snapshot.envelope.config).unwrap();
|
|
let mut detached: Config = serde_json::from_str(&serialized).unwrap();
|
|
detached.web_services[0].php_profile_id = None;
|
|
let snapshot = compile(detached, 2, &policy()).unwrap();
|
|
assert!(snapshot.web_php_services.get("site-one").unwrap().php.is_none());
|
|
assert!(snapshot.web_php_services.get("site-two").unwrap().php.is_some());
|
|
}
|
|
|
|
#[test]
|
|
fn shared_php_fpm_profile_reference_and_duplicate_ids_are_rejected() {
|
|
let tmp = tempfile::TempDir::new().unwrap();
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
config.web_services.push(crate::web_server::Service {
|
|
id: "site".into(),
|
|
name: "Site".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
php_profile_id: Some("missing".into()),
|
|
..Default::default()
|
|
});
|
|
let err = compile(config.clone(), 1, &policy()).unwrap_err().to_string();
|
|
assert!(err.contains("unknown PHP-FPM profile"), "{err}");
|
|
config.web_services[0].php_profile_id = None;
|
|
let profile = crate::web_server::PhpFpmProfile {
|
|
id: "duplicate".into(),
|
|
name: "Duplicate".into(),
|
|
php: Default::default(),
|
|
};
|
|
config.php_fpm_profiles = vec![profile.clone(), profile];
|
|
let err = compile(config, 1, &policy()).unwrap_err().to_string();
|
|
assert!(err.contains("duplicate PHP-FPM profile"), "{err}");
|
|
}
|
|
}
|