49 lines
1.9 KiB
Rust
49 lines
1.9 KiB
Rust
use rust_proxy::config::{compile, demo_config, ValidationPolicy};
|
|
|
|
fn policy() -> ValidationPolicy {
|
|
ValidationPolicy {
|
|
tls_addr: None,
|
|
cert_dir: None,
|
|
data_dir: None,
|
|
proxy_addr: "127.0.0.1:8080".parse().unwrap(),
|
|
admin_addr: "127.0.0.1:9090".parse().unwrap(),
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn local_listener_backend_requires_explicit_risk_acceptance() {
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
let backend = &mut config.vhosts[0].backends[0];
|
|
backend.url = "http://127.0.0.1:9090".into();
|
|
backend.allow_private = true;
|
|
backend.accept_local_listener_risk = false;
|
|
|
|
let error = compile(config.clone(), 1, &policy())
|
|
.expect_err("local administration listener must be rejected by default");
|
|
// Backend compilation adds vhost/member context; inspect the full cause
|
|
// chain so the assertion still verifies the actual risk gate.
|
|
let detail = format!("{error:#}");
|
|
assert!(detail.contains("accept_local_listener_risk=true"), "{detail}");
|
|
|
|
config.vhosts[0].backends[0].accept_local_listener_risk = true;
|
|
compile(config, 2, &policy())
|
|
.expect("explicit risk acceptance should permit the local listener target");
|
|
}
|
|
|
|
#[test]
|
|
fn rfc8441_requires_an_h2_capable_listener_and_h2c_is_explicit() {
|
|
let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
|
|
config.vhosts[0].websockets = true;
|
|
config.vhosts[0].websocket_rfc8441 = true;
|
|
config.vhosts[0].http2_enabled = true;
|
|
|
|
let error = compile(config.clone(), 10, &policy())
|
|
.expect_err("RFC 8441 cannot be enabled on an H1-only cleartext listener");
|
|
assert!(error.to_string().contains("HTTP/2-capable listener"));
|
|
|
|
config.listeners.endpoints[0].binding.h2c = true;
|
|
let snapshot = compile(config, 11, &policy())
|
|
.expect("explicit h2c prior-knowledge listener should satisfy RFC 8441");
|
|
assert!(snapshot.websocket_rfc8441_on("127.0.0.1:8080".parse().unwrap(), false));
|
|
}
|