1308 lines
91 KiB
Python
Executable File
1308 lines
91 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Offline release checks that do not require Rust/Cargo or network access.
|
|
|
|
Exercises the shipped SQLite migration/backup and stopped-source upgrade path,
|
|
then checks the 0.24.1 shared-statistics/runtime/settings contracts and retained legacy-WebSocket and retained control-plane/cache-UX/live-log contracts plus retained transport contracts.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import importlib.util
|
|
import json
|
|
import os
|
|
import re
|
|
from pathlib import Path
|
|
import sqlite3
|
|
import subprocess
|
|
import tempfile
|
|
import tomllib
|
|
import zipfile
|
|
|
|
import backup as backup_module
|
|
import deploy
|
|
import migrate_npm
|
|
import upgrade as upgrade_module
|
|
from rust_source import rust_source
|
|
from web_assets import read_app_js, read_vhosts_js
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
def read_cache_source() -> str:
|
|
return rust_source(ROOT, "src/cache/mod.rs")
|
|
|
|
def read_deploy_source() -> str:
|
|
return "\n".join((ROOT / name).read_text(encoding="utf-8") for name in ("scripts/deploy_core.py", "scripts/deploy_runtime.py", "scripts/deploy.py"))
|
|
|
|
def read_docker_agent_source() -> str:
|
|
return "\n".join(path.read_text(encoding="utf-8") for path in sorted((ROOT / "docker-agent").glob("*.go")) if not path.name.endswith("_test.go"))
|
|
|
|
|
|
def sql_and_backup_smoke(tmp: Path) -> None:
|
|
data = tmp / "data"
|
|
data.mkdir(mode=0o700, parents=True)
|
|
db = data / "config.sqlite3"
|
|
connection = sqlite3.connect(db)
|
|
try:
|
|
connection.executescript((ROOT / "migrations/0002_admin.sql").read_text(encoding="utf-8"))
|
|
connection.executescript((ROOT / "migrations/0003_certificate_renewals.sql").read_text(encoding="utf-8"))
|
|
document = json.dumps({"listeners": {"endpoints": []}, "vhosts": []})
|
|
connection.execute(
|
|
"INSERT INTO configuration(id, revision, document) VALUES(1, 4, ?)",
|
|
(document,),
|
|
)
|
|
connection.execute(
|
|
"INSERT INTO administrator(id,username,password_hash,generation,created_at) VALUES(1,'owner','test-hash',1,1)"
|
|
)
|
|
connection.execute(
|
|
"INSERT INTO certificate_renewals(certificate_id,last_checked,next_check,last_renewed,not_after,failures,status,message) VALUES(?,?,?,?,?,?,?,?)",
|
|
("site-cert", 100, 200, 50, 500, 1, "retry", "saved observation"),
|
|
)
|
|
connection.execute("PRAGMA user_version = 3")
|
|
connection.commit()
|
|
# Simulate additive startup migrations through the current schema-v8.
|
|
connection.executescript((ROOT / "migrations/0004_admin_preferences.sql").read_text(encoding="utf-8"))
|
|
connection.executescript((ROOT / "migrations/0005_certificate_api.sql").read_text(encoding="utf-8"))
|
|
connection.executescript((ROOT / "migrations/0006_certificate_api_credentials.sql").read_text(encoding="utf-8"))
|
|
connection.executescript((ROOT / "migrations/0007_secret_store.sql").read_text(encoding="utf-8"))
|
|
connection.executescript((ROOT / "migrations/0008_config_history.sql").read_text(encoding="utf-8"))
|
|
connection.execute(
|
|
"INSERT INTO admin_preferences(administrator_id,document) VALUES(1,?)",
|
|
(json.dumps({"live_log_columns": ["time", "status"]}),),
|
|
)
|
|
connection.execute("PRAGMA user_version = 8")
|
|
connection.commit()
|
|
assert connection.execute("PRAGMA quick_check").fetchone()[0] == "ok"
|
|
tables = {
|
|
row[0]
|
|
for row in connection.execute(
|
|
"SELECT name FROM sqlite_master WHERE type='table'"
|
|
)
|
|
}
|
|
for table in ("configuration", "administrator", "admin_sessions", "admin_audit", "auth_throttle", "certificate_renewals", "admin_preferences", "certificate_api_credential", "certificate_api_credentials", "secret_store", "configuration_history"):
|
|
assert table in tables, table
|
|
finally:
|
|
connection.close()
|
|
os.chmod(db, 0o600)
|
|
|
|
destination = tmp / "backup"
|
|
copied = backup_module.backup(data, destination)
|
|
assert copied.is_file()
|
|
metadata = json.loads((destination / "backup.json").read_text(encoding="utf-8"))
|
|
assert metadata["project"] == "RustProxy"
|
|
assert metadata["schema"] == 8
|
|
assert metadata["configuration_revision"] == 4
|
|
restored = sqlite3.connect(copied)
|
|
try:
|
|
assert restored.execute("PRAGMA quick_check").fetchone()[0] == "ok"
|
|
assert restored.execute("SELECT revision FROM configuration WHERE id=1").fetchone()[0] == 4
|
|
assert restored.execute("SELECT status, message FROM certificate_renewals WHERE certificate_id='site-cert'").fetchone() == ("retry", "saved observation")
|
|
assert json.loads(restored.execute("SELECT document FROM admin_preferences WHERE administrator_id=1").fetchone()[0]) == {"live_log_columns": ["time", "status"]}
|
|
assert restored.execute("SELECT username FROM administrator WHERE id=1").fetchone()[0] == "owner"
|
|
finally:
|
|
restored.close()
|
|
|
|
|
|
def upgrade_smoke(tmp: Path) -> None:
|
|
target = tmp / "installed"
|
|
target.mkdir(parents=True)
|
|
(target / "Cargo.toml").write_text(
|
|
'[package]\nname = "rust-proxy"\nversion = "0.8.1"\n', encoding="utf-8"
|
|
)
|
|
(target / "src").mkdir()
|
|
(target / "src/obsolete.rs").write_text("obsolete\n", encoding="utf-8")
|
|
(target / "langs").mkdir()
|
|
custom_pack = {"meta": {"code": "zz_ZZ", "name": "Site test"}, "strings": {}}
|
|
(target / "langs/site.json").write_text(json.dumps(custom_pack), encoding="utf-8")
|
|
(target / "data").mkdir(mode=0o700)
|
|
(target / "data/keep.txt").write_text("preserve\n", encoding="utf-8")
|
|
legacy = target / "data/certs/renewals.json"
|
|
legacy.parent.mkdir(parents=True)
|
|
legacy.write_text('{"legacy":true}\n', encoding="utf-8")
|
|
(target / ".env").write_text("RUST_PROXY_DEMO=0\n", encoding="utf-8")
|
|
|
|
backup = upgrade_module.upgrade(ROOT, target, stopped=True)
|
|
assert backup.is_dir()
|
|
assert (backup / "src/obsolete.rs").is_file()
|
|
assert not (target / "src/obsolete.rs").exists()
|
|
assert 'version = "0.27.2"' in (target / "Cargo.toml").read_text(encoding="utf-8")
|
|
assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
|
|
assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
|
|
assert (target / "langs/site.json").is_file()
|
|
assert (target / "docker-agent/main.go").is_file()
|
|
assert (target / "docker-agent/model.go").is_file()
|
|
assert (target / "docker-agent/docker.go").is_file()
|
|
assert (target / "docker-agent/network.go").is_file()
|
|
assert (target / "docker-agent/certificate.go").is_file()
|
|
assert (target / "docker-agent/server.go").is_file()
|
|
manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
|
|
assert manifest["to_version"] == "0.27.2"
|
|
assert manifest["removed_obsolete_runtime_state"] is True
|
|
assert not legacy.exists()
|
|
assert not (backup / "legacy-data").exists()
|
|
|
|
# Legacy cleanup must never follow a symlinked certs directory outside the data root.
|
|
unsafe = tmp / "unsafe-installed"
|
|
unsafe.mkdir()
|
|
(unsafe / "Cargo.toml").write_text('[package]\nname = "rust-proxy"\nversion = "0.8.1"\n', encoding="utf-8")
|
|
(unsafe / "src").mkdir(); (unsafe / "src/old.rs").write_text("old\n", encoding="utf-8")
|
|
(unsafe / "data").mkdir()
|
|
outside = tmp / "outside-certs"; outside.mkdir()
|
|
outside_legacy = outside / "renewals.json"; outside_legacy.write_text('{"outside":true}\n', encoding="utf-8")
|
|
(unsafe / "data/certs").symlink_to(outside, target_is_directory=True)
|
|
try:
|
|
upgrade_module.upgrade(ROOT, unsafe, stopped=True)
|
|
except ValueError as error:
|
|
assert "must not be a symlink" in str(error)
|
|
else:
|
|
raise AssertionError("symlinked certs directory was accepted during legacy cleanup")
|
|
assert outside_legacy.read_text(encoding="utf-8") == '{"outside":true}\n'
|
|
assert 'version = "0.8.1"' in (unsafe / "Cargo.toml").read_text(encoding="utf-8")
|
|
assert (unsafe / "src/old.rs").is_file()
|
|
|
|
|
|
def deployment_gate_smoke(tmp: Path) -> None:
|
|
assert deploy.admin_address("127.0.0.1:9090") == ("127.0.0.1:9090", False)
|
|
assert deploy.admin_address("0.0.0.0:9090", True) == ("0.0.0.0:9090", True)
|
|
try:
|
|
deploy.admin_address("0.0.0.0:9090", False)
|
|
except ValueError:
|
|
pass
|
|
else:
|
|
raise AssertionError("remote administration bind accepted without --allow-remote-admin")
|
|
assert deploy.admin_address("192.0.2.10:9090", True) == ("192.0.2.10:9090", True)
|
|
|
|
remote_unit = deploy.service_unit({"prefix":"/opt/rustproxy", "data_dir":"/var/lib/rustproxy", "user":"rustproxy", "group":"rustproxy", "admin":"0.0.0.0:9090", "remote_admin":True, "http":"0.0.0.0:80", "https":"0.0.0.0:443"})
|
|
assert "ExecStart=/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy --admin-listen 0.0.0.0:9090 serve --proxy-listen 0.0.0.0:80 --tls-listen 0.0.0.0:443 --allow-remote-admin" in remote_unit
|
|
assert "ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy" in remote_unit
|
|
assert "TimeoutStopSec=120" in remote_unit
|
|
for marker in ["PrivateDevices=true", "ProtectKernelLogs=true", "RestrictNamespaces=true", "RestrictRealtime=true", "SystemCallArchitectures=native"]:
|
|
assert marker in remote_unit, marker
|
|
deploy_source = read_deploy_source()
|
|
assert "def stop_for_managed_update" in deploy_source and ".managed-update" in deploy_source
|
|
assert "systemctl', 'stop', SERVICE" in deploy_source
|
|
assert "def ensure_service_data_access" in deploy_source
|
|
assert "status=200/CHDIR" in deploy_source
|
|
assert "runuser', '-u', account.pw_name, '--', 'test', '-x'" in deploy_source
|
|
assert deploy_source.index("ensure_service_data_access(data, account)") < deploy_source.index("stop_for_managed_update(data)")
|
|
assert deploy_source.index("stop_for_managed_update(data)") < deploy_source.index("backup = backup_stopped(record, prefix)")
|
|
|
|
data = tmp / "admin-health"
|
|
data.mkdir(parents=True)
|
|
database = data / "config.sqlite3"
|
|
connection = sqlite3.connect(database)
|
|
connection.execute("CREATE TABLE configuration(id INTEGER PRIMARY KEY, revision INTEGER NOT NULL, document TEXT NOT NULL)")
|
|
connection.execute(
|
|
"INSERT INTO configuration VALUES(1, 7, ?)",
|
|
(json.dumps({"administration": {"listen": "0.0.0.0:9443", "tls": True, "allowed_hosts": ["panel.example.test"]}}),),
|
|
)
|
|
connection.commit(); connection.close()
|
|
record = {"admin": "127.0.0.1:9090", "data_dir": str(data)}
|
|
assert deploy.admin_health_endpoint(record) == ("127.0.0.1:9443", True, "panel.example.test:9443")
|
|
|
|
|
|
def npm_migration_smoke(tmp: Path) -> None:
|
|
database = tmp / "npm.sqlite"
|
|
connection = sqlite3.connect(database)
|
|
connection.execute(
|
|
"CREATE TABLE proxy_host("
|
|
"id INTEGER, domain_names TEXT, forward_scheme TEXT, forward_host TEXT, forward_port INTEGER, "
|
|
"allow_websocket_upgrade INTEGER, http2_support INTEGER, enabled INTEGER, certificate_id INTEGER, "
|
|
"ssl_forced INTEGER, access_list_id INTEGER, advanced_config TEXT, locations TEXT, "
|
|
"caching_enabled INTEGER, block_exploits INTEGER, meta TEXT)"
|
|
)
|
|
connection.execute(
|
|
"INSERT INTO proxy_host VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
|
|
(12, json.dumps(["App.Example.test", "*.apps.example.test"]), "http", "10.20.30.40", 8080,
|
|
1, 1, 1, 9, 0, 4, "proxy_read_timeout 90s;", "[]", 1, 0, "{}"),
|
|
)
|
|
connection.execute(
|
|
"INSERT INTO proxy_host VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
|
|
(13, json.dumps(["secure.example.test"]), "http", "10.20.30.41", 8081,
|
|
1, 1, 1, 10, 1, 0, "", "[]", 0, 0, "{}"),
|
|
)
|
|
connection.commit(); connection.close()
|
|
rows = migrate_npm.load_npm_hosts(database)
|
|
config = {
|
|
"listeners": {"endpoints": [
|
|
{"id": "public-http", "enabled": True, "binding": {"address": "0.0.0.0:80", "tls": False}},
|
|
{"id": "public-https", "enabled": True, "binding": {"address": "0.0.0.0:443", "tls": True}},
|
|
]},
|
|
"vhosts": [],
|
|
}
|
|
merged, decisions = migrate_npm.build_migration(rows, config)
|
|
assert len(decisions) == 2 and all(item.action == "import" for item in decisions)
|
|
migrated = merged["vhosts"][0]
|
|
assert migrated["frontend"]["hosts"] == ["app.example.test", "*.apps.example.test"]
|
|
assert migrated["frontend"]["listener_ids"] == ["public-http", "public-https"]
|
|
assert migrated["backends"][0]["url"] == "http://10.20.30.40:8080"
|
|
assert migrated["backends"][0]["allow_private"] is True
|
|
assert migrated["websockets"] is True
|
|
assert migrated["force_ssl"] is False
|
|
assert migrated["forward_client_ip"] is True
|
|
assert any("access_list_id=4" in warning for warning in decisions[0].warnings or [])
|
|
assert any("advanced_config" in warning for warning in decisions[0].warnings or [])
|
|
secure = merged["vhosts"][1]
|
|
assert secure["force_ssl"] is True
|
|
assert secure["frontend"]["listener_ids"] == ["public-http", "public-https"]
|
|
assert any("Force SSL" in warning for warning in decisions[1].warnings or [])
|
|
|
|
|
|
def ui_contract_smoke() -> None:
|
|
html = (ROOT / "src/admin/web/index.html").read_text(encoding="utf-8")
|
|
app = read_app_js(ROOT)
|
|
settings = (ROOT / "src/admin/web/settings.js").read_text(encoding="utf-8")
|
|
vhosts = read_vhosts_js(ROOT)
|
|
streams = (ROOT / "src/admin/web/streams.js").read_text(encoding="utf-8")
|
|
redirects = (ROOT / "src/admin/web/redirects.js").read_text(encoding="utf-8")
|
|
host404 = (ROOT / "src/admin/web/host404.js").read_text(encoding="utf-8")
|
|
integrations = (ROOT / "src/admin/web/integrations.js").read_text(encoding="utf-8")
|
|
acme_ui = (ROOT / "src/admin/web/acme.js").read_text(encoding="utf-8")
|
|
traffic = (ROOT / "src/admin/web/traffic-panel.js").read_text(encoding="utf-8")
|
|
cache = (ROOT / "src/admin/web/cache-panel.js").read_text(encoding="utf-8")
|
|
transform_panel = (ROOT / "src/admin/web/transform-panel.js").read_text(encoding="utf-8")
|
|
css = (ROOT / "src/admin/web/style.css").read_text(encoding="utf-8")
|
|
required_html = [
|
|
'id="panel-traffic"',
|
|
'id="traffic-scope"',
|
|
'id="traffic-chart-countries"',
|
|
'id="traffic-chart-client-ips"',
|
|
'id="traffic-tabs"',
|
|
'data-traffic-tab="overview"',
|
|
'data-traffic-tab="clients"',
|
|
'data-traffic-tab="requests"',
|
|
'data-traffic-tab="delivery"',
|
|
'id="traffic-chart-user-agents"',
|
|
'id="traffic-chart-paths"',
|
|
'id="traffic-chart-routes"',
|
|
'id="traffic-chart-volume"',
|
|
'id="log-capture-user-agent"',
|
|
'id="log-capture-country"',
|
|
'id="cache-auto-trim-enabled"',
|
|
'id="settings-tab-logging"',
|
|
'id="settings-page-logging"',
|
|
'id="logging-form"',
|
|
'id="error-log-form"',
|
|
'id="settings-tab-administration"',
|
|
'id="settings-tab-tls-policy"',
|
|
'id="admin-tls"',
|
|
'id="tls-policy-12"',
|
|
'id="tls-policy-13"',
|
|
'id="cache-resident-age-header"',
|
|
'id="cache-cold-enabled"',
|
|
'id="cache-transient-memory"',
|
|
'id="cache-cold-queue-bytes"',
|
|
'id="cache-eviction-limit"',
|
|
'data-cache-memory-preset="recommended"',
|
|
'id="cache-cold-path"',
|
|
'id="cache-cold-bytes"',
|
|
'id="cache-cold-entries"',
|
|
'id="cp-hot-entries-meter"',
|
|
'id="cp-memory"',
|
|
'id="cp-cold-entries-meter"',
|
|
'id="cp-cold-disk"',
|
|
'id="cache-cold-after"',
|
|
'id="log-format-preset"',
|
|
'id="log-format-open"',
|
|
'id="logging-format-dialog"',
|
|
'id="logging-field-rows"',
|
|
'id="panel-acl-profiles"',
|
|
'id="acl-profile-form"',
|
|
'id="acl-profile-list"',
|
|
'id="acl-profile-rule-rows"',
|
|
'id="acl-profile-rule-add"',
|
|
'id="acl-profile-import-rules"',
|
|
'id="vhost-search"',
|
|
'id="panel-redirects"',
|
|
'id="redirect-search"',
|
|
'id="redirect-list"',
|
|
'id="redirect-new"',
|
|
'id="redirect-dialog"',
|
|
'id="redirect-form"',
|
|
'id="redirect-rules"',
|
|
'id="redirect-rule-add"',
|
|
'id="panel-notfound"',
|
|
'id="notfound-search"',
|
|
'id="notfound-list"',
|
|
'id="notfound-new"',
|
|
'id="notfound-dialog"',
|
|
'id="notfound-form"',
|
|
'id="notfound-hosts-editor"',
|
|
'id="notfound-listeners"',
|
|
'id="notfound-certificate"',
|
|
'id="notfound-mode"',
|
|
'id="notfound-status"',
|
|
'id="panel-streams"',
|
|
'id="stream-search"',
|
|
'id="stream-list"',
|
|
'id="stream-new"',
|
|
'id="stream-listener-add"',
|
|
'id="stream-dialog"',
|
|
'id="stream-form"',
|
|
'class="vhost-dialog logging-format-dialog"',
|
|
]
|
|
for marker in required_html:
|
|
assert marker in html, marker
|
|
assert '/api/traffic' in traffic and 'rustProxyTrafficPanel' in traffic
|
|
for marker in ['function selectTab(', 'function renderDonut(', 'function renderBars(', 'renderBars("client-ips"', 'renderBars("user-agents"', 'renderBars("paths"', 'renderBars("routes"', 'renderBars("volume"']:
|
|
assert marker in traffic, marker
|
|
assert 'traffic: "/traffic"' in app and 'window.rustProxyTrafficPanel?.refresh()' in app
|
|
for marker in ['id="settings-tab-manual-config"', 'id="settings-page-manual-config"', 'id="config-editor"', 'id="save-json"', 'id="export-config"']:
|
|
assert marker in html, marker
|
|
assert 'data-panel="configuration"' not in html and 'id="panel-configuration"' not in html
|
|
assert html.index('data-panel="vhosts"') < html.index('data-panel="redirects"') < html.index('data-panel="notfound"') < html.index('data-panel="streams"') < html.index('data-panel="acl-profiles"')
|
|
assert "matching_resident_bytes" in cache and "matching_body_bytes" in cache
|
|
for marker in ["data.settings?.max_entries", "data.settings?.cold_max_entries", "data.settings?.cold_max_bytes", "setMeter("]:
|
|
assert marker in cache, marker
|
|
for marker in ["cache-memory-breakdown", "cache-transient-breakdown", "cache-cold-storage", "cache-transient-sparkline", "cache-fill-sparkline", "cache-queue-sparkline", "cache-io-sparkline", "cache-cold-sparkline", "metric-info", "process-rss-total", "memory-cache-hot", "memory-cache-transient", "memory-transform", "memory-transform-inflight", "memory-non-cache-rss", "process-rss-anon", "process-rss-file", "process-data-swap", "memoryAccountingHint"]:
|
|
assert marker in html, marker
|
|
for marker in ["transient_bytes", "fill_bytes_active", "cold_queue_bytes", "cold_write_bytes_active", "cold_read_bytes_active", "process_rss_anon_bytes", "process_rss_file_bytes"]:
|
|
assert marker in app or marker in cache, marker
|
|
assert "matching_cold_bytes" in cache and "cold_promotions" in cache and "hot_demotions" in cache
|
|
assert "next.logging" in app and "logstash:" in app and "loki:" in app and "file:" in app
|
|
assert "LOGGING_PRESETS" in app and "selectedLoggingMapping" in app and "renderLoggingPreview" in app
|
|
assert "administration" in settings and "tls-policy" in settings
|
|
assert "additional_addresses" in integrations
|
|
assert "addressTagEditor" in integrations and "listener-address-chip-editor" in integrations
|
|
assert 'const h2 = field(grid, "listener-h2", "vhHttp2"' in integrations
|
|
assert 'h2Configure' in integrations and 'selectHttpTab?.("http2")' in integrations
|
|
assert 'renderHttp2Settings' in integrations and 'collectHttp2Listeners' in integrations
|
|
assert 'const h3 = field(grid, "listener-h3", "h3Enable"' in integrations
|
|
assert 'h3Configure' in integrations and 'selectHttpTab?.("http3")' in integrations
|
|
h3_tuning = integrations.split('function http3SettingsControls', 1)[1].split('function addRow', 1)[0]
|
|
assert 'h3Enable' not in h3_tuning
|
|
assert 'data-i18n="processDiagnostics">Process<' in html
|
|
for marker in ['function setOptionalMetric', 'setOptionalMetric("process-rss-anon"', 'setOptionalMetric("system-swap"', 'setOptionalMetric("system-network"']:
|
|
assert marker in app, marker
|
|
assert 'const http80 = prefer(false, 80);' in integrations
|
|
assert 'if (http80) autoIds.add(http80.id);' in integrations and 'candidates.find(endpoint => !endpoint.binding?.tls)' in integrations
|
|
assert 'https443' not in integrations
|
|
assert 'window.rustProxyIntegrations.bindings(holder, selected, !editing)' in redirects
|
|
assert 'window.rustProxyIntegrations.hostnames(hostHolder' in redirects
|
|
assert 'function hostnames(parent, initial = [], options = {})' in integrations
|
|
assert 'class="protocol-toggle-row"' in html
|
|
assert "stream-host-rows" not in integrations and 'id="settings-page-streams"' not in html and 'id="streams-form"' not in html
|
|
for marker in ["rustProxyStreams", "streamTrafficChart", "streamPendingRestart", "chartHistory", "sessions_total", "bytes_in", "bytes_out"]:
|
|
assert marker in streams, marker
|
|
assert '$("stream-listener-add").addEventListener("click", () => { setPanel("settings"); window.rustProxySettings?.select("listeners"); });' in streams
|
|
assert "/assets/streams.js" in html
|
|
assert "/assets/redirects.js" in html
|
|
assert "/assets/host404.js" in html
|
|
for marker in ["rustProxyRedirects", 'saveSection("redirects"', "redirectTargetType", "redirectPathMode", "redirectQueryMode", "redirectCacheSeconds"]:
|
|
assert marker in redirects, marker
|
|
for marker in ["rustProxyNotFound", 'saveSection("not_found_hosts"', "rustProxyIntegrations.hostnames", "rustProxyIntegrations.bindings", "notfound-mode", "notfound-status", "BUILTIN_STATUSES", "ERROR_STATUSES", 'rustProxyDrafts.register("notfound"', 'rustProxyEnableControl($("notfound-enabled"))']:
|
|
assert marker in host404, marker
|
|
assert 'for (let code = 200; code <= 599; code++)' not in host404
|
|
assert 'id="docker-search"' in html and 'id="docker-show-hidden"' in html
|
|
assert 'preserve_host: true' in vhosts
|
|
assert "tls_policy" in vhosts and "vhost-live-grid" in vhosts
|
|
assert '"force-ssl", "vhForceSsl"' in vhosts and 'force_ssl: yes("force-ssl")' in vhosts
|
|
assert '"forward-client-ip", "vhForwardClientIp"' in vhosts and 'forward_client_ip: yes("forward-client-ip")' in vhosts
|
|
assert "vhForceSslNeedsTls" in vhosts and "vhForceSslNeedsHttp" in vhosts and "vhForceSslPortConflict" in vhosts
|
|
assert "tlsPorts.has(443)" in vhosts
|
|
assert '$("vhost-search").addEventListener("input", render)' in vhosts and "vhSearchEmpty" in vhosts
|
|
for marker in ['toggleVhostEnabled', 'vhQuickEnable', 'vhQuickDisable', 'backend_table_columns', 'applyPoolTableView', 'rustProxyEnableControl']:
|
|
assert marker in vhosts, marker
|
|
assert 'rustproxy-backend-table-v1' not in vhosts and 'poolTablePreferenceKey' not in vhosts
|
|
assert 'window.rustProxyPreferences.update({' in vhosts and 'backend_table_sort' in vhosts and 'backend_table_descending' in vhosts
|
|
for marker in ['id="vhost-sort"', 'id="vhost-sort-direction"', 'id="docker-vhost-sort"', 'id="docker-vhost-sort-direction"', 'id="redirect-sort"', 'id="redirect-sort-direction"', 'id="notfound-sort"', 'id="notfound-sort-direction"', 'id="stream-sort"', 'id="stream-sort-direction"']:
|
|
assert marker in html, marker
|
|
preferences_source = (ROOT / 'src/admin/preferences.rs').read_text(encoding='utf-8')
|
|
for marker in ['vhost_list_sort', 'docker_vhost_sort', 'redirect_list_sort', 'notfound_list_sort', 'stream_list_sort']:
|
|
assert marker in preferences_source, marker
|
|
assert 'vhost_list_sort' in vhosts and 'vhost_list_descending' in vhosts
|
|
list_sort_sources = {
|
|
'docker': (ROOT / 'src/admin/web/docker.js').read_text(encoding='utf-8'),
|
|
'redirects': (ROOT / 'src/admin/web/redirects.js').read_text(encoding='utf-8'),
|
|
'notfound': (ROOT / 'src/admin/web/host404.js').read_text(encoding='utf-8'),
|
|
'streams': (ROOT / 'src/admin/web/streams.js').read_text(encoding='utf-8'),
|
|
}
|
|
assert 'docker_vhost_sort' in list_sort_sources['docker'] and 'sortServiceRows' in list_sort_sources['docker']
|
|
assert 'redirect_list_sort' in list_sort_sources['redirects']
|
|
assert 'notfound_list_sort' in list_sort_sources['notfound']
|
|
assert 'stream_list_sort' in list_sort_sources['streams']
|
|
for marker in ['id="pool-search"', 'id="pool-sort"', 'data-pool-column-toggle="vhost"']:
|
|
assert marker in html, marker
|
|
for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'id="about-python-runtime"', 'id="runtime-python"', 'id="acme-runtime-components"']:
|
|
assert marker in html, marker
|
|
for language in ['langs/en_US.json', 'langs/pl_pl.json']:
|
|
text = (ROOT / language).read_text(encoding='utf-8')
|
|
assert './dev.sh tls deploy' not in text
|
|
assert '/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy tls deploy' in text
|
|
startup_source = (ROOT / 'src/main/admin_runtime.rs').read_text(encoding='utf-8')
|
|
for marker in ['https://git.linuxiarz.pl/gru/RustProxy', 'https://rustproxy.linuxiarz.pl/', 'join("acme-python")', 'certificate_runtime']:
|
|
assert marker in startup_source, marker
|
|
for document in ['docs/RENEWAL.md', 'docs/INSTALL.md', 'docs/API.md']:
|
|
document_text = (ROOT / document).read_text(encoding='utf-8')
|
|
assert './dev.sh tls deploy' not in document_text
|
|
assert '/opt/rustproxy/current/rust-proxy --data-dir /var/lib/rustproxy tls deploy' in document_text
|
|
style = (ROOT / "src/admin/web/style.css").read_text(encoding="utf-8")
|
|
for marker in ['--scrollbar-thumb', '*::-webkit-scrollbar-thumb', '.backend-table-tools', '.vhost-quick-toggle', '.dashboard-widget-toggle', '--toolbar-control-height: min(var(--button-min-height), var(--ui-field-min-height))', 'height: var(--toolbar-control-height)']:
|
|
assert marker in style, marker
|
|
assert "pool-vhost-disabled" in vhosts
|
|
for marker in ["locationMatchRegex", "headersVisualBuilder", "headersAdvancedJson", "openLocationHelp", "cloudflare-client-ip", "timing-headers"]:
|
|
assert marker in vhosts, marker
|
|
for marker in ["location-help-dialog", "cache-memory-sparkline", "network-rx-sparkline", "latency-sparkline", "sourceIp"]:
|
|
assert marker in html, marker
|
|
for marker in ["lastApiLatencyMs", "cacheMemorySamples", "networkRxSamples", "responseLatencySamples"]:
|
|
assert marker in app, marker
|
|
assert '<details class="mini-live-chart mini-live-chart-collapsible">' not in html
|
|
assert 'data-i18n="responseLatencyHistory"' in html and 'data-i18n="responseLatencyHint"' in html and 'data-i18n-aria="responseLatencyInfo"' in html
|
|
assert 'bindSettingsForm("error-log-form"' in app and '}, "logging", selectLoggingSection);' in app
|
|
assert 'viewBox: "0 0 300 60"' in app and 'M0 15H300 M0 30H300 M0 45H300' in app
|
|
assert '.network-interface-row {' in css and 'background: transparent' in css
|
|
assert "hostTagEditor" in vhosts and "vhost-chart-line" in vhosts and "vhLifetimeChart" in vhosts
|
|
for marker in ["refreshCertificateInventory", "certificateDetails", "certificate-domain-pills", "certificateCoverageUnknown", "async function revalidateSession", 'Object.values(PANEL_PATHS), "/configuration"', "recoverInvalidOrigin", "auth.invalid_origin", "ORIGIN_RECOVERY_KEY"]:
|
|
assert marker in app, marker
|
|
for marker in ['data-certificate-tab="installed"', 'data-certificate-tab="renewal"', 'data-certificate-tab="generate"', 'id="certificate-page-installed"', 'id="certificate-page-renewal"', 'id="certificate-page-generate"']:
|
|
assert marker in html, marker
|
|
assert 'id="certificate-dialog"' not in html and 'id="certificate-close"' not in html
|
|
for marker in ['function selectTab(name, focus = false, persist = true)', 'log_directories', 'certbotLogs', 'value?.kind?.startsWith("renewal")']:
|
|
assert marker in acme_ui, marker
|
|
for marker in ['id="acme-runtime-card"', 'id="acme-runtime-message"', 'id="acme-runtime-state"', 'id="acme-runtime-path"', 'rust-proxy --data-dir ./data admin setup-token', 'rust-proxy --data-dir /var/lib/rustproxy admin setup-token']:
|
|
assert marker in html, marker
|
|
for marker in ['function renderRuntime(value)', 'runtimeAvailable', 'certificateRuntimeUnavailable']:
|
|
assert marker in acme_ui, marker
|
|
for marker in ['.certificate-operation-card', '.renewal-meta', '#panel-tls .certificate-tabs']:
|
|
assert marker in css, marker
|
|
login = (ROOT / "src/admin/web/login.js").read_text(encoding="utf-8")
|
|
settings_ui = (ROOT / "src/admin/web/settings.js").read_text(encoding="utf-8")
|
|
assert "async function redirectExistingSession" in login and "/api/auth/session" in login
|
|
assert '["/settings", "/configuration", "/logging"].includes(location.pathname)' in settings_ui
|
|
assert 'new URLSearchParams(location.search).get("tab")' in settings_ui and 'function syncLocation()' in settings_ui and 'history.replaceState' in settings_ui
|
|
assert '"/docker-vhosts"' in login and 'settingsTabs = new Set' in login and '`/settings?tab=${encodeURIComponent(tab)}`' in login
|
|
login_html = (ROOT / 'src/admin/web/login.html').read_text(encoding='utf-8')
|
|
assert 'class="auth-page auth-loading"' in login_html and 'document.body.classList.remove("auth-loading")' in login
|
|
assert 'class="app-loading"' in html and 'document.documentElement.classList.remove("app-loading")' in app
|
|
assert 'url.pathname = "/settings"' in settings_ui and 'url.searchParams.set("tab", active)' in settings_ui
|
|
assert 'function withFormSubmitState(form, submitter, task)' in app and 'button.textContent = t("saving")' in app
|
|
assert 'function fieldError(target, message)' in app and 'function showFieldError(error, form = null)' in app
|
|
assert 'function authReturnDestination()' in app and 'pendingAuthDestination || authReturnDestination()' in app
|
|
assert '$("login").hidden = navigating' in app and 'id="auth-message"' in html
|
|
assert 'settings-tabs button.has-unsaved::after' in css and 'function syncSettingsDirtyIndicators()' in app
|
|
assert 'setSettingsDirty("config-editor")' in app and '!settingsDirty.has("config-editor")' in app
|
|
assert 'throw fieldError($("tls-policy-12")' in settings_ui
|
|
assert 'input[type="checkbox"],\ninput[type="radio"] {' in css and 'width: 15px;' in css and '.log-column-option input[type="checkbox"]' not in css and 'overflow: visible' in css and 'max-height: min(38dvh, 220px)' not in css
|
|
assert '.log-tools input:not([type="checkbox"]):not([type="radio"])' in css
|
|
assert '.log-tools input {\n' not in css
|
|
footer = app.split('function renderFooter(s) {', 1)[1].split('let lastLogs', 1)[0]
|
|
assert 'SQLite / HTTP/1.1' not in footer and 'coldQ:' not in footer and 'streamFallback' not in footer
|
|
assert '`${apiLatency} / ${t("logsDropped")}: ${s.logs_dropped}`' in footer
|
|
assert 'update?.update_available && update.latest_version' in footer and 'footer-update' in footer
|
|
assert '#docker-agents-form>.form-actions {' in css and 'justify-content: flex-start' in css
|
|
for marker in ['prom-trusted-no-token', 'prom-streams', 'prom-logging']:
|
|
assert marker in html and marker in settings_ui, marker
|
|
for marker in [".certificate-details", ".certificate-domain-pills", ".certificate-card .pill"]:
|
|
assert marker in css, marker
|
|
integrations_0194 = (ROOT / "src/admin/web/integrations.js").read_text(encoding="utf-8")
|
|
docker_0194 = (ROOT / "src/admin/web/docker.js").read_text(encoding="utf-8")
|
|
assert 'readAddresses.input' in integrations_0194
|
|
assert 'form.reset(); window.rustProxyCertificates?.close();' in integrations_0194
|
|
assert '$("cert-import-pem").value = ""' not in integrations_0194 and '$("cert-import-key").value = ""' not in integrations_0194
|
|
assert 'throw fieldError(row.querySelector(".docker-agent-listener-choices")' in docker_0194
|
|
management = (ROOT / "src/admin/web/management.js").read_text(encoding="utf-8")
|
|
assert "rustProxyAclProfiles" in management and "acl_profiles" in management
|
|
for marker in ["collectRuleRows", "parseBulkRules", "allow_exceptions", "block_exceptions", "renderPreview", "normalizeNetwork"]:
|
|
assert marker in management, marker
|
|
assert "function refreshTranslations()" in management and "refreshTranslations }" in management
|
|
assert "window.rustProxyAclProfiles?.refreshTranslations?.();" in app
|
|
assert "normalizeAclRuleText" in app and "ruleSyntaxLine" in app
|
|
assert ".settings-tabs" in css and "grid-template-columns" in css and "width: 100%" in css
|
|
assert ".logging-grid fieldset" not in css
|
|
assert ".pool-vhost-disabled" in css and ".acl-profile-rule" in css
|
|
assert ".stream-live-grid" in css and ".stream-chart-rx" in css and ".listener-address-chip-editor" in css
|
|
for marker in ['.vh-backend-card', '.auth-subcard', '.vh-cache-options[hidden]', '.protocol-toggle-row', '.listener-choices']:
|
|
assert marker in css, marker
|
|
assert html.count('<h3 class="subheading"') >= 3
|
|
|
|
|
|
def source_contract_smoke() -> None:
|
|
config = rust_source(ROOT, "src/config.rs")
|
|
tls = rust_source(ROOT, "src/tls.rs")
|
|
main = rust_source(ROOT, "src/main.rs")
|
|
server = rust_source(ROOT, "src/server.rs")
|
|
logging = rust_source(ROOT, "src/logging.rs")
|
|
secret_store = rust_source(ROOT, "src/secret_store.rs")
|
|
backup = rust_source(ROOT, "src/backup.rs")
|
|
acme_worker = (ROOT / "scripts/acme_provider.py").read_text(encoding="utf-8")
|
|
for feature_marker in ["AES_256_GCM", "master.key", "O_NOFOLLOW", "migrate_acme_credentials"]:
|
|
assert feature_marker in secret_store, feature_marker
|
|
for feature_marker in ["Argon2", "RPROXYB1", "secret-store-key.enc", "validate_backup_version"]:
|
|
assert feature_marker in backup, feature_marker
|
|
for feature_marker in ["ErrorLogSettings", "ERROR_LOG_QUEUE", "RedactingStderr", "open_error_file", "ErrorLogLayer"]:
|
|
assert feature_marker in logging, feature_marker
|
|
assert "credential_ini_b64" in acme_worker and "credential_file.unlink" in acme_worker
|
|
cache = read_cache_source()
|
|
settings = rust_source(ROOT, "src/settings.rs")
|
|
websocket = rust_source(ROOT, "src/proxy/websocket.rs")
|
|
proxy = rust_source(ROOT, "src/proxy/mod.rs")
|
|
assert '.insert("x-rustproxy-backend-time", value)' in proxy and '.insert("x-rust-proxy-backend-time", value)' not in proxy
|
|
pages = rust_source(ROOT, "src/pages.rs")
|
|
admin = rust_source(ROOT, "src/admin/mod.rs")
|
|
stream = rust_source(ROOT, "src/stream.rs")
|
|
runtime = rust_source(ROOT, "src/runtime.rs")
|
|
acl = rust_source(ROOT, "src/acl.rs")
|
|
policies = (ROOT / "tests/policies.rs").read_text(encoding="utf-8")
|
|
http3 = rust_source(ROOT, "src/http3.rs")
|
|
redirect = rust_source(ROOT, "src/redirect.rs")
|
|
not_found = rust_source(ROOT, "src/not_found.rs")
|
|
prometheus = rust_source(ROOT, "src/prometheus.rs")
|
|
auth = rust_source(ROOT, "src/auth/mod.rs")
|
|
auth_store = rust_source(ROOT, "src/auth/store.rs")
|
|
upstream = rust_source(ROOT, "src/upstream.rs")
|
|
vhosts_js = read_vhosts_js(ROOT)
|
|
docker_source = rust_source(ROOT, "src/docker.rs")
|
|
docker_js = (ROOT / "src/admin/web/docker.js").read_text(encoding="utf-8")
|
|
docker_agent = read_docker_agent_source()
|
|
html = (ROOT / "src/admin/web/index.html").read_text(encoding="utf-8")
|
|
cache_panel_ui = (ROOT / "src/admin/web/cache-panel.js").read_text(encoding="utf-8")
|
|
transform_panel = (ROOT / "src/admin/web/transform-panel.js").read_text(encoding="utf-8")
|
|
app_js = read_app_js(ROOT)
|
|
|
|
# 0.24.1: shared library statistics, authenticated runtime metadata and Logging in Settings.
|
|
manifest = tomllib.loads((ROOT / "Cargo.toml").read_text(encoding="utf-8"))
|
|
system_stats = rust_source(ROOT, "src/system_stats/mod.rs")
|
|
linux_stats = rust_source(ROOT, "src/system_stats/linux.rs")
|
|
settings_ui = (ROOT / "src/admin/web/settings.js").read_text(encoding="utf-8")
|
|
openapi_0241 = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
|
|
assert not (ROOT / "src/system_stats/bsd.rs").exists()
|
|
metrics_process = manifest["dependencies"]["metrics-process"]
|
|
assert metrics_process["version"] == "=2.4.3"
|
|
assert metrics_process["default-features"] is False
|
|
assert metrics_process["features"] == ["dummy"]
|
|
sysinfo_network = manifest["dependencies"]["sysinfo"]
|
|
assert sysinfo_network["version"] == "=0.38.4"
|
|
assert sysinfo_network["default-features"] is False
|
|
assert sysinfo_network["features"] == ["network"]
|
|
target_key = 'cfg(any(target_os = "linux", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd", target_os = "dragonfly", target_os = "macos", target_os = "windows"))'
|
|
assert manifest["target"][target_key]["dependencies"]["systemstat"] == "=0.2.7"
|
|
for marker in [
|
|
"systemstat::{Platform, System}",
|
|
"metrics_process::collector::collect",
|
|
"sysinfo::Networks::new_with_refreshed_list",
|
|
"collect_network_systemstat",
|
|
"merge_network_interfaces",
|
|
"system_swap_total_bytes",
|
|
"system_uptime_seconds",
|
|
"process_virtual_memory_bytes",
|
|
"process_start_time_seconds",
|
|
"max_fds",
|
|
]:
|
|
assert marker in system_stats, marker
|
|
for forbidden in ["sysctl", "netstat", "Command::new"]:
|
|
assert forbidden not in system_stats, forbidden
|
|
for marker in ["/proc/stat", "/proc/meminfo", "RssAnon", "VmData", "VmSwap", "pub(crate) fn augment"]:
|
|
assert marker in linux_stats, marker
|
|
for marker in [
|
|
"LinuxEnvironment::Lxc", "process_start_ticks", "CLOCK_BOOTTIME", "/proc/1/stat",
|
|
"/proc/loadavg", "lxc_load_average", "view.environment = Some(environment.label())",
|
|
"if environment == LinuxEnvironment::Lxc",
|
|
]:
|
|
assert marker in linux_stats, marker
|
|
assert 'const processPlatform = [d.platform, d.environment].filter(Boolean).join(" / ");' in app_js
|
|
for marker in ["installed_data_dir_candidates", "resolve_installed_data_dir", '"/var/lib/rustproxy"', '"/var/db/rustproxy"']:
|
|
assert marker in main, marker
|
|
for marker in ['payload["runtime"]', '"statistics_source"', '"data_directory"', '"database_path"']:
|
|
assert marker in admin, marker
|
|
anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
|
|
assert '"/api/status"' not in anonymous_block
|
|
assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.27.2"' in openapi_0241
|
|
assert 'id="panel-logging"' not in html
|
|
for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
|
|
assert marker in html, marker
|
|
assert 'location.pathname === "/logging"' in settings_ui
|
|
|
|
# 0.22.3 h2c Upgrade and externally owned certificate deployment contracts.
|
|
for marker in [
|
|
'StatusCode::SWITCHING_PROTOCOLS',
|
|
'struct H2cUpgradeIo',
|
|
'HTTP2-Settings',
|
|
'http1_h2c_upgrade_bootstraps_request_as_http2_stream_one',
|
|
'malformed_h2c_upgrade_is_rejected_before_switching_protocols',
|
|
]:
|
|
assert marker in server, marker
|
|
for marker in [
|
|
'"/api/certificates/reload"',
|
|
'certificate_reload',
|
|
'"/api/certificates/deploy"',
|
|
'certificate_deploy',
|
|
'certificate.deploy',
|
|
'certificate.reload',
|
|
'reload_certificates().await',
|
|
'"operation": "unchanged"',
|
|
'config.tls.certificates.push(crate::tls::Certificate',
|
|
]:
|
|
assert marker in admin, marker
|
|
for marker in ['pub async fn reload_certificates', 'configured certificates reloaded from disk']:
|
|
assert marker in runtime, marker
|
|
for marker in ['TlsCommand::Deploy', '/api/certificates/deploy', '/api/certificates/reload', 'read_external_pem']:
|
|
assert marker in main, marker
|
|
for marker in ['pub fn stage_external_pair', 'pub fn reconcile_external_pair', 'ExternalPairDeployment::Unchanged', 'pub fn remove_external_pair', 'external_pair_stages_generation_and_rolls_back_cleanly', 'external_pair_reconcile_is_idempotent_and_repairs_missing_generation']:
|
|
assert marker in tls, marker
|
|
assert 'api("/api/certificates/reload"' in app_js
|
|
transport_0223 = (ROOT / "docs/TRANSPORT.md").read_text(encoding="utf-8")
|
|
assert 'Upgrade: h2c' in transport_0223 and 'stream 1' in transport_0223
|
|
assert 'legacy HTTP/1.1 Upgrade-to-h2c is not implemented' not in transport_0223
|
|
audit_0233 = (ROOT / "docs/V0.24.0_AUDIT.md").read_text(encoding="utf-8")
|
|
audit_0232 = (ROOT / "docs/V0.23.2_AUDIT.md").read_text(encoding="utf-8")
|
|
audit_0223 = (ROOT / "docs/V0.22.3_AUDIT.md").read_text(encoding="utf-8")
|
|
for marker in ["legacy websocket", "origin", "http/1.1", "sec-websocket-accept", "ilo4"]:
|
|
assert marker.lower() in audit_0233.lower(), marker
|
|
for marker in ["600 samples", "308", "HTTPS", "<data-dir>/certs", "--livelogs"]:
|
|
assert marker.lower() in audit_0232.lower(), marker
|
|
assert 'external certificate ownership model' in audit_0223.lower() and 'release gate' in audit_0223.lower()
|
|
|
|
update_check = rust_source(ROOT, "src/update_check.rs")
|
|
update_defaults = tomllib.loads((ROOT / "UPDATE_CHECK.toml").read_text(encoding="utf-8"))
|
|
assert update_defaults["repository_url"] == "https://git.linuxiarz.pl/gru/RustProxy"
|
|
assert update_defaults["version_url"].endswith("/raw/branch/master/Cargo.toml")
|
|
assert update_defaults["interval_seconds"] == 3600
|
|
for marker in ['include_str!("../UPDATE_CHECK.toml")', 'pub async fn poll_loop', 'tokio::time::sleep(interval)', 'package_version(&document)', 'MAX_VERSION_DOCUMENT_BYTES']:
|
|
assert marker in update_check, marker
|
|
assert 'update version document is too large or incomplete: {error}' in update_check
|
|
assert '.context("update version document is too large or incomplete")' not in update_check
|
|
for marker in ['tracing::error!(', 'MAX_REDIRECTS: usize = 5', 'SSL_CERT_FILE', 'CURL_CA_BUNDLE', '/usr/local/share/certs/ca-root-nss.crt', 'response.status().is_redirection()', 'redirect_target(¤t, location)']:
|
|
assert marker in update_check, marker
|
|
assert 'pub last_error:' not in update_check
|
|
for marker in ['RUST_PROXY_UPDATE_REPOSITORY_URL', 'RUST_PROXY_UPDATE_VERSION_URL', 'RUST_PROXY_UPDATE_CHECK_INTERVAL_SECS', 'state.start_update_check(update_check);']:
|
|
assert marker in main, marker
|
|
assert 'pub software_update: Arc<crate::update_check::SharedStatus>' in runtime
|
|
assert 'payload["software_update"] = json!(state.software_update.snapshot());' in admin
|
|
|
|
for marker in [
|
|
"a persisted remote administration listener requires administration TLS",
|
|
"validate_narrower_than",
|
|
"tls_policy",
|
|
"AclProfile",
|
|
"normalize_host_pattern",
|
|
"profile_country_access",
|
|
"https_redirect_port",
|
|
"forward_client_ip",
|
|
"plain HTTP listener",
|
|
"tls_ports.contains(&443)",
|
|
"backend_tls_verification_defaults_off_and_can_be_enabled_explicitly",
|
|
"pub accept_local_listener_risk: bool",
|
|
"backend_diagnostic_flags_compile_to_frontend",
|
|
"backend_header: host.backend_header",
|
|
"backend_timing_header: host.backend_timing_header",
|
|
]:
|
|
assert marker in config, marker
|
|
for marker in ["compile_admin", "ProtocolPolicy", "policy_only_configuration_does_not_require_certificate_directory", "certificate_covered_hosts", "legacy_certificate_coverage_can_be_read_from_existing_pem"]:
|
|
assert marker in tls, marker
|
|
assert "compile_admin" in main and "serve_tls_with_plain_redirect" in main
|
|
assert "TlsMode::Fixed" in server and "TlsMode::Frontend" in server and "plaintext_router" in server
|
|
assert "additional_addresses" in settings and "multi-address listeners require explicit IPs" in settings
|
|
for marker in ["pub session_days: u16", "session_days: 30", "(7..=30).contains(&self.session_days)", "administration_session_lifetime_is_7_to_30_days_and_hot_apply_only"]:
|
|
assert marker in settings, marker
|
|
for marker in ["30 * 24 * 60 * 60", "browser_session_lifetime_is_configurable_without_sliding_expiry", "session_cookie_uses_configured_remaining_lifetime"]:
|
|
assert marker in auth, marker
|
|
for marker in ["create_browser_session", "session_at_with_browser_lifetime", "browser session lifetime must be 7..30 days"]:
|
|
assert marker in auth_store, marker
|
|
for marker in ["accept_local_listener_risk", "!self_target || self.accept_local_listener_risk", "explicit_risk_acceptance_allows_local_listener_but_not_private_policy_bypass"]:
|
|
assert marker in upstream, marker
|
|
assert "member-local-risk" in vhosts_js and "vhLocalListenerRiskConfirm" in vhosts_js
|
|
assert 'function administrationListenCandidates()' in vhosts_js and 'function adminListenerBackendCandidate(raw)' in vhosts_js
|
|
for marker in ['latestStatus?.administration?.locked_listen', 'latestStatus?.administration?.active?.listen', 'latestStatus?.admin_listen', "value === 'localhost'", '/^127(?:\\.\\d{1,3}){3}$/.test(value)', 'riskGate.hidden = show !== true', 'row.syncLocalRisk = () => syncRisk(false)']:
|
|
assert marker in vhosts_js, marker
|
|
assert 'const saved = editing ? (envelope?.config.vhosts || []).find(item => item.id === editing) : null;' in vhosts_js
|
|
assert 'load(saved ? structuredClone(saved) : defaults());' in vhosts_js
|
|
assert 'backends: [{ id: "origin-1", url: ""' in vhosts_js
|
|
assert 'preserve_host: true' in vhosts_js
|
|
for marker in ['vhBackendDiagnostics', 'backend_header: yes("backend-header")', 'backend_timing_header: yes("backend-timing-header")', 'protocol-toggle-row', 'auth-subcard', 'vh-cache-options', 'syncCacheVisibility', 'cache: { enabled: false }']:
|
|
assert marker in vhosts_js, marker
|
|
assert 'values.length ? values : [{ id: "root"' not in vhosts_js
|
|
for marker in ["PinnedCertificateVerifier", "tls_fingerprint_sha256", "health_check: crate::balance::HealthCheck", "certificate fingerprint mismatch", "generated_id"]:
|
|
assert marker in docker_source, marker
|
|
for marker in ["docker-agent-fingerprint", "docker-agent-certificate", "docker-health-mode", "docker-search", "docker-show-hidden", "pool_routes", "dockerBackendUp", "setInterval"]:
|
|
assert marker in docker_js, marker
|
|
assert 'function checkboxField(key, control)' in docker_js
|
|
assert 'checkboxField("dockerPreserveHost", preserve)' in docker_js and 'checkboxField("dockerAclInline", inline)' in docker_js
|
|
assert 'label = el("label", undefined, "check vh-check")' in docker_js
|
|
ui_css = (ROOT / "src/admin/web/style.css").read_text(encoding="utf-8")
|
|
assert '.docker-route-grid input:not([type="checkbox"])' in ui_css and '.docker-checkbox-field .vh-check {' in ui_css
|
|
assert 'docker-switch-row' in docker_js and '.docker-switch-row {' in ui_css and 'repeat(5, minmax(110px, 160px))' in ui_css
|
|
assert '.docker-passive-health-editor .docker-health-grid {' in ui_css
|
|
assert '.docker-health-grid input:not([type="checkbox"])' in ui_css and '.docker-passive-health-editor .docker-checkbox-field input[type="checkbox"]' in ui_css
|
|
assert 'id="sparkline-transform"' in html and 'id="rate-transform"' in html
|
|
assert 'id="panel-transform"' in html and 'data-panel="transform"' in html and '/assets/transform-panel.js' in html
|
|
assert '/api/transform' in transform_panel and 'tp-cache-hits' in transform_panel
|
|
for marker in ['transform-memory-budget', 'transform-max-inflight', 'data-transform-preset="conservative"', 'data-transform-preset="recommended"', 'data-transform-preset="performance"', 'data-transform-preset="uber"']:
|
|
assert marker in html, marker
|
|
for marker in ['selectedTransformPreset', 'transformPresetValues', 'applyTransformPreset', 'updateTransformResourceSizing', 'memory_budget_bytes', 'max_inflight']:
|
|
assert marker in app_js, marker
|
|
assert '<details class="card function-live-chart" id="cache-live-chart">' in html
|
|
assert '<details class="card function-live-chart" id="transform-live-chart">' in html
|
|
for marker in ['cache-live-hit-line', 'cache-live-miss-line', 'cache-live-bypass-line']:
|
|
assert marker in html and marker in cache_panel_ui, marker
|
|
for marker in ['transform-live-applied-line', 'transform-live-cache-line', 'transform-live-skipped-line', 'transform-live-error-line']:
|
|
assert marker in html and marker in transform_panel, marker
|
|
assert 'sparklinePoints(liveChartSamples.hits, 900, 180, 10, peak)' in cache_panel_ui
|
|
assert 'sparklinePoints(liveChartSamples.applied, 900, 180, 10, peak)' in transform_panel
|
|
assert '.function-live-chart svg {' in ui_css and 'height: clamp(180px, 22vw, 270px)' in ui_css
|
|
assert '--transform-chart:' in ui_css and '--chart-quaternary:' in ui_css and 'stroke: var(--chart-quaternary)' in ui_css and 'background: var(--transform-chart)' in ui_css
|
|
assert '.cache-transform-badge {' in ui_css and 'border: 1px solid var(--pill-line)' in ui_css and 'border-radius: 3px' in ui_css
|
|
html = (ROOT / 'src/admin/web/index.html').read_text(encoding='utf-8')
|
|
cache_panel_js = (ROOT / 'src/admin/web/cache-panel.js').read_text(encoding='utf-8')
|
|
management_js = (ROOT / 'src/admin/web/management.js').read_text(encoding='utf-8')
|
|
app_js = read_app_js(ROOT)
|
|
vhosts_js = read_vhosts_js(ROOT)
|
|
cache_rs = read_cache_source()
|
|
admin_rs = rust_source(ROOT, 'src/admin/mod.rs')
|
|
logging_rs = rust_source(ROOT, 'src/logging.rs')
|
|
assert 'bindSettingsForm("pages-form", next => { next.pages = global.read(); }, "pages")' in management_js
|
|
assert '"pages" => {' in admin_rs and 'default_pages_section_accepts_the_standard_value_payload' in admin_rs
|
|
assert 'pub const LIVE_WINDOW: usize = 256;' in logging_rs and 'pub const HISTORY_CAPACITY: usize = 4096;' in logging_rs
|
|
assert 'api("/api/logs?limit=4096")' in management_js
|
|
assert 'const STATUS_NAMES = { 200: "OK"' in management_js and '404: "Not Found"' in management_js and 'statusLabel(code)' in management_js
|
|
assert 'let paused = null, expanded = null' in management_js and 'function mergeExpanded(data)' in management_js and 'entries.length >= 4096' in management_js
|
|
assert 'dialog.addEventListener("close", () => { if (pinning) return; expanded = null; paused = null;' in management_js
|
|
assert 'hash_scheme.as_bytes()' in cache_rs and 'cache_key_separates_frontend_scheme' in cache_rs
|
|
assert not (ROOT / 'src/cache.rs').exists() and (ROOT / 'src/cache/mod.rs').is_file()
|
|
cache_mod = rust_source(ROOT, 'src/cache/mod.rs')
|
|
assert 'impl Cache {\n include!(' not in cache_mod
|
|
for fragment in ['lifecycle.rs', 'cold.rs', 'dashboard.rs', 'tickets.rs', 'lookup.rs']:
|
|
assert rust_source(ROOT, f'src/cache/{fragment}').lstrip().startswith('impl Cache {')
|
|
assert 'payload["transform_metrics"] = json!(state.transform_metrics.total())' in admin_rs
|
|
for marker in ['payload["transform_resources"]', 'payload["memory_accounting"]', 'non_cache_rss_includes_transform', 'cold_limit_bytes', 'cold_limit_entries']:
|
|
assert marker in admin_rs or marker in cache, marker
|
|
assert 'const transformed = s.transform_metrics || {}' in app_js and 'transformSamples.push(rates.transform)' in app_js
|
|
for marker in ['status.memory_accounting || {}', 'memory.cache_hot_bytes', 'memory.transform_reserved_bytes', 'cache-cold-storage']:
|
|
assert marker in app_js, marker
|
|
for marker in ['data?.resources || {}', 'tp-memory', 'tp-inflight']:
|
|
assert marker in transform_panel, marker
|
|
assert 'function uptime(value)' in app_js and 'setOptionalMetric("process-uptime", status.uptime_seconds != null' in app_js
|
|
assert 'connection-uptime-footer' not in html and 'id="process-uptime"' in html
|
|
assert 'function rateBytes(value)' in app_js and 'if (value === 0) return "0.0 KiB";' in app_js and 'return "<0.1 KiB";' in app_js
|
|
assert 'function backendTrafficRate(' in vhosts_js and 'member.bytes_in' in vhosts_js and 'member.bytes_out' in vhosts_js and 'rateBytes(memberTraffic)' in vhosts_js and 'rateBytes(d.traffic)' in vhosts_js
|
|
assert 'id="cache-domain-filter"' in html and 'cacheDomainFilterEnabled' in html and 'cacheDomainFilterDisabled' in html
|
|
assert 'const visibleDomains = (data, groups) =>' in cache_panel_js and 'scoped?.settings?.enabled ?? data.settings?.enabled ?? false' in cache_panel_js
|
|
for marker in ['effectiveCacheMemory', 'cacheMemoryHeadroom', 'cachePresetValues', 'applyCacheMemoryPreset', 'selectedCacheMemoryPreset', 'selectedCacheColdPreset', 'applyRecommendedColdCachePreset', 'cacheMemoryPresetTooSmall', 'cacheObjectOverTransientWarning', 'cgroup_memory_max_bytes', 'transient_max_bytes', 'cold_queue_max_bytes', 'hot_eviction_max_objects']:
|
|
assert marker in app_js, marker
|
|
assert 'envelope?.config.cache?.enabled === true && cacheToggle.value !== "off"' in vhosts_js
|
|
assert 'groups = d.domains || [], shownGroups = visibleDomains(data, groups)' in cache_panel_js and 'replaceChildren(...shownGroups.map(row =>' in cache_panel_js
|
|
balance_rs = rust_source(ROOT, 'src/balance.rs')
|
|
assert 'traffic_rate_drops_to_zero_after_an_idle_sample_window' in balance_rs and 'if delta == 0 {' in balance_rs and 'sample.rate = 0.0;' in balance_rs
|
|
all_admin_js = "\n".join(path.read_text(encoding='utf-8') for path in (ROOT / 'src/admin/web').glob('*.js'))
|
|
assert not re.search(r'(?<![A-Za-z])(?:window\.)?(?:alert|confirm)\s*\(', all_admin_js)
|
|
assert 'function appConfirm(message, options = {})' in app_js and 'function apiErrorMessage(path, response, value)' in app_js
|
|
deploy_py = read_deploy_source()
|
|
assert "SHELL_PATH_PROFILE = Path('/etc/profile.d/rustproxy-path.sh')" in deploy_py and 'install_shell_path(prefix)' in deploy_py and 'check_shell_path(prefix)' in deploy_py
|
|
assert 'grid-column: span 3' in ui_css and '.check>span {' in ui_css and 'transform: translateY(-1px)' in ui_css
|
|
assert '.cache-toolbar-status .check' in ui_css and '.docker-toolbar .check' in ui_css and '.docker-alias-field>span:first-child {' in ui_css and 'margin-bottom: 0' in ui_css and '.docker-alias-editor {' in ui_css and 'min-height: 38px' in ui_css and 'height: 30px' in ui_css
|
|
assert 'readOnly: !!editing' not in vhosts_js and 'vhIdRenameConfirm' in vhosts_js and 'v.id === value.id && v.id !== editing' in vhosts_js
|
|
assert 'enforce_local_page_no_cache' in proxy and 'LocalGeneratedResponse' in proxy and 'locally_generated_pages_remove_cache_metadata' in proxy
|
|
assert 'local_page_method_rejection_is_still_marked_non_cacheable' in pages and 'response.extensions_mut().insert(PageServed);' in pages
|
|
screenshots = {path.name for path in (ROOT / 'docs/screenshots').iterdir() if path.is_file()}
|
|
assert 'README.md' in screenshots
|
|
assert screenshots <= {'README.md', 'login.png', 'location-headers.png'}
|
|
assert 'generated_vhost_inherits_global_server_header_policy' in rust_source(ROOT, 'src/docker.rs')
|
|
assert '.docker-route-grid {' in ui_css and 'align-items: start' in ui_css
|
|
assert '.docker-acl-grid {' in ui_css and 'height: 38px' in ui_css
|
|
assert 'preserve.checked = assignment?.preserve_host !== false' in docker_js
|
|
for marker in ["ensureSelfSignedCertificate", "ListenAndServeTLS", "CertificateSHA256", "RUSTPROXY_DOCKER_AGENT_TLS"]:
|
|
assert marker in docker_agent, marker
|
|
for marker in [
|
|
'fallbacks: HashMap<String, Vec<CompiledRoute>>',
|
|
'id: format!("{}/main", host.id)',
|
|
'custom_locations_override_but_main_vhost_remains_fallback',
|
|
'direct_admin_listener_backend_is_marked_for_guarded_control_plane_use',
|
|
'pub targets_admin_listener: bool',
|
|
]:
|
|
assert marker in config, marker
|
|
vhost_source = rust_source(ROOT, "src/vhost.rs")
|
|
assert 'is_legacy_main_fallback' in vhost_source
|
|
assert "benign_tunnel_close" in websocket and "ConnectionReset" in websocket
|
|
assert 'StatusCode::UNAUTHORIZED => Some(include_str!("admin/web/error_401.html"))' in pages
|
|
assert 'StatusCode::NOT_FOUND => Some(include_str!("admin/web/error_404.html"))' in pages
|
|
assert 'pub struct MinimalWelcome' in pages and 'builtin_welcome_is_minimal_and_never_cacheable' in pages and 'HeaderValue::from_static("no-store")' in pages
|
|
for marker in [
|
|
"fn admin_request_authority",
|
|
"Version::HTTP_2 | Version::HTTP_3",
|
|
"request.uri().authority().ok_or(())?",
|
|
"administration_https_health_accepts_http2_authority_without_host_header",
|
|
]:
|
|
assert marker in admin, marker
|
|
assert "fn panel_document_path" in admin and "panel_document_path(&path)" in admin and "panel_subpage_routes_survive_browser_refresh" in admin
|
|
assert 'response.extensions().get::<LocalHostResponse>().is_none()' in proxy
|
|
assert '"cdn-cache-control"' in proxy and '"x-cache-resident-age"' in proxy
|
|
for marker in ["OriginBackend", "apply_backend_diagnostic_headers", "x-rustproxy-backend-time", "backend_diagnostics_are_opt_in_and_strip_spoofed_values"]:
|
|
assert marker in proxy, marker
|
|
for marker in ["force_ssl_redirect", "force_ssl_location", "StatusCode::PERMANENT_REDIRECT", "https_redirect_port", "apply_upstream"]:
|
|
assert marker in proxy, marker
|
|
forwarding = rust_source(ROOT, "src/forwarding.rs")
|
|
for marker in ["pub fn apply_upstream", 'headers.remove("x-forwarded-for")', 'headers.remove("x-real-ip")', "upstream_can_withhold_client_ip_without_losing_origin_metadata"]:
|
|
assert marker in forwarding, marker
|
|
for marker in ["SINK_QUEUE", "FileSink", "LogstashSink", "LokiSink", "Limited::new"]:
|
|
assert marker in logging, marker
|
|
for marker in [
|
|
"matching_body_bytes", "matching_resident_bytes", "matching_cold_bytes",
|
|
"expose_resident_age", "x-cache-resident-age", "COLD_QUEUE",
|
|
"ColdFile", "body_sha256", "get_tiered", "revalidation_tiered",
|
|
"cold_queue_dropped_total", "cold_after_seconds", "cold_on_age", "cold_max_hot_seconds", "cold_policy_can_demote_by_total_hot_residency_age",
|
|
"lru_demotion_persists_and_survives_restart",
|
|
"managed_update_flush_ignores_shutdown_toggle_when_cold_tier_is_enabled",
|
|
"flush_hot_to_cold_for_update",
|
|
"disabled_cache_strips_diagnostics_without_exposing_bypass_headers",
|
|
"vary_selects_variants_without_fragmenting_the_primary_hash",
|
|
"vary_schema_change_removes_incompatible_fallbacks",
|
|
"varnish_primary_hash_uses_host_and_url_not_unrelated_request_headers",
|
|
"resident_age_survives_successful_revalidation",
|
|
"COLD_FORMAT_VERSION: u8 = 3",
|
|
"cold_cache_uses_two_hex_character_shards",
|
|
"legacy_flat_cold_cache_is_not_migrated",
|
|
"manual_cold_cleanup_reports_removed_objects_and_freed_bytes",
|
|
"rfc5861_windows_and_revalidation_flags_are_separate_metadata",
|
|
"request_max_stale_is_bounded_and_respects_revalidation_flags",
|
|
"max_stale_can_reuse_an_object_after_normal_ttl_expiry",
|
|
"request_max_age_only_revalidates_when_cached_age_exceeds_limit",
|
|
"transformed_plan_uses_transformed_content_length",
|
|
"transformed_representation_is_stored_and_reused",
|
|
"every_enabled_transform_kind_can_fill_and_reuse_the_cached_representation",
|
|
"query_strings_remain_distinct_and_bypass_query_is_only_a_request_policy",
|
|
"transformed_client_conditionals_use_the_representation_etag_not_the_origin_etag",
|
|
"no_transform_does_not_disable_shared_storage",
|
|
"duplicate_and_argument_immutable_do_not_invalidate_cache_control",
|
|
"fill_incomplete", "transform_length_mismatch", "object_too_large",
|
|
"cold_cleanup_skips_an_entry_while_a_read_is_pinned",
|
|
"stale_if_error_is_only_available_inside_its_window",
|
|
"matching_hot_key",
|
|
"matching_cold_key",
|
|
]:
|
|
assert marker in cache, marker
|
|
transform = rust_source(ROOT, "src/transform/mod.rs")
|
|
for marker in [
|
|
"pub struct Settings", "pub struct Overrides",
|
|
"resolved.enabled = global.enabled && self.enabled",
|
|
"pub fn no_transform", "OriginValidators", "fn decode<'a>",
|
|
"Cow::Borrowed(body)", "trim_allocator_after_large_transform",
|
|
"pub memory_budget_bytes: usize", "pub max_inflight: usize", "Preset::Uber",
|
|
"try_reserve_transform_memory(required_memory, settings.memory_budget_bytes)",
|
|
"try_reserve_transform_slot(settings.max_inflight)",
|
|
"drop(decoded);", "drop(raw);",
|
|
"rustproxy-",
|
|
"unchanged_compressed_body_is_canonicalized_to_identity",
|
|
"origin_no_transform_blocks_body_changes_and_keeps_validator",
|
|
"final_no_transform_blocks_body_changes",
|
|
"compressed_no_transform_preserves_origin_encoding_and_bytes",
|
|
"empty_head_body_with_origin_length_keeps_origin_representation_headers",
|
|
"CanonicalIdentity",
|
|
]:
|
|
assert marker in transform, marker
|
|
assert 'collect bounded static response for transformation: {error}' in transform
|
|
assert '.context("collect bounded static response for transformation")' not in transform
|
|
lookup = rust_source(ROOT, 'src/cache/lookup.rs')
|
|
model = rust_source(ROOT, 'src/cache/model.rs')
|
|
css_minifier = rust_source(ROOT, 'src/transform/css.rs')
|
|
assert 'let Some(_read_lease) = self.try_reserve_transient' in lookup
|
|
assert 'struct TransientLease {\n _inner: Arc<TransientLeaseInner>,' in model
|
|
assert 'struct TransientLease(Arc<TransientLeaseInner>);' not in model
|
|
assert 'last_char = out.chars().last();' not in css_minifier
|
|
assert css_minifier.count("last_char = Some(' ');") == 1
|
|
assert "pub mod transform;" in rust_source(ROOT, "src/lib.rs")
|
|
for name in ["js.rs", "css.rs"]:
|
|
minifier = (ROOT / "src/transform" / name).read_text(encoding="utf-8")
|
|
assert "Vec<char>" not in minifier and ".chars().collect" not in minifier
|
|
assert "into_bytes()" in minifier
|
|
balance = rust_source(ROOT, "src/balance.rs")
|
|
for marker in [
|
|
"pub struct PassiveHealth", "enabled: false", "pub passive_health: PassiveHealth",
|
|
"passive_health_is_opt_in_and_uses_separate_thresholds",
|
|
"legacy_settings_without_passive_health_default_to_off",
|
|
"slow_5xx_counts_both_observability_classes_when_passive_is_off",
|
|
"unhealthy_source_hands_off_when_the_original_health_domain_recovers",
|
|
"active_health_failures_total", "passive_health_failures_total",
|
|
"http_5xx_total", "timeouts_total", "connect_errors_total", "io_errors_total", "slow_responses_total",
|
|
]:
|
|
assert marker in balance, marker
|
|
for marker in [
|
|
'fill_bytes_active', 'cold_queue_items', 'cold_queue_bytes',
|
|
'cold_write_bytes_active', 'cold_read_bytes_active', 'transient_bytes',
|
|
'transient_max_bytes', 'cold_queue_max_bytes', 'hot_eviction_max_objects',
|
|
'hot_logical_bytes', 'hot_allocated_bytes', 'memory_pressure_rejections',
|
|
'struct FillGauge', 'struct TransientLease', 'reserve_fill_allocation',
|
|
'release_allocator_memory()', 'fn hot_entry_cost(',
|
|
]:
|
|
assert marker in cache, marker
|
|
assert 'impl Drop for Candidate' not in cache
|
|
diagnostics = rust_source(ROOT, "src/diagnostics.rs") + rust_source(ROOT, "src/system_stats/mod.rs") + rust_source(ROOT, "src/system_stats/linux.rs")
|
|
for marker in ['process_rss_anon_bytes', 'process_rss_file_bytes', 'process_rss_shmem_bytes', 'process_data_bytes', 'process_swap_bytes', 'RssAnon', 'RssFile', 'RssShmem', 'VmData', 'VmSwap']:
|
|
assert marker in diagnostics, marker
|
|
for marker in ['admin_session_passthrough', 'admin_control_plane', 'restore_admin_cookie', 'BEFORE returning a successful RFC 9220 response', 'websocket_phase("tunnel_ready")']:
|
|
assert marker in proxy, marker
|
|
headers_source = rust_source(ROOT, "src/proxy/headers.rs")
|
|
assert 'pub fn restore_admin_cookie' in headers_source and 'admin_cookie_can_be_restored_only_from_captured_fragment' in headers_source
|
|
assert "state.cache.purge(None)" not in proxy
|
|
assert "request.method() == Method::HEAD && cache_ticket.is_some()" in proxy
|
|
for marker in ["cache_effective_enabled", "transform_effective_enabled", "Some(route.id.clone())"]:
|
|
assert marker in proxy, marker
|
|
for marker in ["pub struct Metrics", "pub struct MetricsView", "struct ActiveSession", "sessions_total", "sessions_completed", "bytes_in", "bytes_out", "packets_in", "packets_out", "metrics_view_reports_l4_counters"]:
|
|
assert marker in stream, marker
|
|
for marker in ["pub enum TargetType", "pub enum PathMode", "pub enum QueryMode", "StatusCode::from_u16", "cache_seconds", "unconditional self-redirect"]:
|
|
assert marker in redirect, marker
|
|
assert "pub redirects: Vec<crate::redirect::Host>" in config and "redirect_on" in config
|
|
assert "pub not_found_hosts: Vec<crate::not_found::Host>" in config and "not_found_host_on" in config
|
|
for marker in ["pub struct Host", "pub struct CompiledHost", "crate::pages::Page"]:
|
|
assert marker in not_found, marker
|
|
assert "RedirectResponse" in proxy and "snapshot.redirect_on" in proxy
|
|
assert "#[serde(default)]\n pub tls_verify: bool" in config
|
|
upstream = rust_source(ROOT, "src/upstream.rs")
|
|
assert "BackendCertificateVerificationDisabled" in upstream and "supported_schemes" in upstream
|
|
disabled_verifier = upstream.split("impl ServerCertVerifier for BackendCertificateVerificationDisabled", 1)[1].split("pub fn client(", 1)[0]
|
|
assert disabled_verifier.count("Ok(HandshakeSignatureValid::assertion())") == 2
|
|
assert "WebPkiServerVerifier" not in disabled_verifier
|
|
assert "stream_metrics" in runtime and "stream_metrics" in main
|
|
for marker in ["PrefixPriority", "RegexInsensitive", "LocationResponse", "pub rewrite: PathRewrite"]:
|
|
assert marker in rust_source(ROOT, "src/vhost.rs"), marker
|
|
for marker in ["rewritten_path", "nginx_style_location_precedence_exact_priority_regex_prefix", "location_rewrites_are_normalized_and_regex_captures_expand", "custom_location_response_is_validated"]:
|
|
assert marker in config, marker
|
|
for marker in ["local_location_response", "route.rewritten_path(&path)", "encoded_origin_path", "client_ip.to_string()"]:
|
|
assert marker in proxy, marker
|
|
assert proxy.index("RustProxy: denied by access policy") < proxy.index("if let Some(spec) = &route.response") < proxy.index("let (backend, backend_lease, affinity_cookie)")
|
|
assert "pub client_ip: Option<String>" in logging and "client_ip" in logging
|
|
assert '"metrics": stream_metrics' in admin and '"/assets/streams.js"' in admin and 'include_str!("web/streams.js")' in admin
|
|
assert '.route("/404-hosts", get(public::index))' in admin and '"/assets/host404.js"' in admin and 'include_str!("web/host404.js")' in admin and '"not_found_hosts"' in admin
|
|
assert "session_at_with_browser_lifetime" in admin and "session_lifetime_seconds" in admin
|
|
assert '/api/preferences' in admin and 'live_log_columns' in admin
|
|
assert 'default_admin_theme' in admin and '"dark" | "light"' in admin
|
|
html = (ROOT / 'src/admin/web/index.html').read_text(encoding='utf-8')
|
|
assert 'id="ui-theme"' in html and 'html[data-theme="light"] {' in ui_css
|
|
assert 'body[data-density="compact"] input:not([type="checkbox"]):not([type="radio"])' in ui_css
|
|
assert '<div class="edition">INDEPENDENT BY DESIGN <span>' not in html
|
|
assert '<div class="edition">INDEPENDENT BY DESIGN</div>' in html
|
|
assert "inspected_metadata" in admin and "certificate_metadata" in admin
|
|
balance = rust_source(ROOT, "src/balance.rs")
|
|
assert "max_concurrent_requests" in balance and "queue_timeout_ms" in balance and "select_retry_wait" in balance
|
|
for marker in ["dns_errors_total", "tls_errors_total", "response_header_timeouts_total", "last_failure_detail", "last_recovered_ms"]:
|
|
assert marker in balance, marker
|
|
tls_source = rust_source(ROOT, "src/tls.rs")
|
|
for marker in ["CertificateMetadata", "not_before_unix", "not_after_unix", "days_remaining", "expiry_status"]:
|
|
assert marker in tls_source, marker
|
|
assert '"/assets/redirects.js"' in admin and 'include_str!("web/redirects.js")' in admin and '.route("/redirects", get(public::index))' in admin
|
|
assert '/Ubuntu%2014.04%20LTS/' in acl and 'repeated_slashes_are_normalized_for_routing' in acl and 'percent_encoded_spaces_are_valid_request_paths' in policies and 'repeated_slashes_route_normally_but_reach_upstream_unchanged' in policies and 'local_location_response_uses_response_rules_without_opening_backend' in policies and 'local_location_response_still_respects_route_acl' in policies
|
|
db_source = rust_source(ROOT, "src/db.rs")
|
|
acme_source = rust_source(ROOT, "src/acme.rs")
|
|
acme_runtime = (ROOT / "src/acme/runtime_env.rs").read_text(encoding="utf-8")
|
|
assert 'runtime_setup_once' in acme_source
|
|
assert 'include!("acme/runtime_env.rs")' in (ROOT / 'src/acme.rs').read_text(encoding='utf-8')
|
|
for marker in ['CERTBOT_PACKAGES', 'join("acme-python")', 'virtualenv>=20,<21', 'distro_certbot_available', 'acme.runtime_python_missing', 'acme.runtime_pip_missing']:
|
|
assert marker in acme_runtime, marker
|
|
assert "SCHEMA_VERSION: i64 = 8" in db_source and "certificate_renewals" in db_source and "0004_admin_preferences.sql" in db_source and "0005_certificate_api.sql" in db_source and "0006_certificate_api_credentials.sql" in db_source and "0007_secret_store.sql" in db_source and "0008_config_history.sql" in db_source
|
|
runtime_source = rust_source(ROOT, "src/runtime.rs")
|
|
assert 'replace_as_restore' in db_source and 'config.restore' in db_source and 'source_revision' in db_source
|
|
assert 'restore_config_history' in admin and '/api/config/history/restore' in admin
|
|
assert 'pub async fn restore_as' in runtime_source and 'replace_as_restore' in runtime_source
|
|
assert "load_renewal_observations" not in acme_source and "renewals.json" not in acme_source
|
|
for marker in ["pub kind: &'static str", "pub log_directory: String", "pub(crate) fn certbot_log_directory", 'kind: "issue"', '"renewal-dry-run"']:
|
|
assert marker in acme_source, marker
|
|
assert '"log_directories":log_directories' in admin and 'crate::acme::certbot_log_directory' in admin
|
|
assert '"runtime":state.acme.runtime_view()' in admin
|
|
assert '"certificate_runtime": state.acme.runtime_view()' in rust_source(ROOT, 'src/admin/status.rs')
|
|
assert "store.load_certificate_renewals().await?" in main and "state.acme.restore_renewals(renewal_observations)" in main
|
|
assert 'accept-remote-admin-risk' in main and 'hide = true' in main
|
|
settings_rust = rust_source(ROOT, 'src/settings.rs')
|
|
assert 'pub struct StartupLocks' in settings_rust and 'fixed by systemd/startup' in settings_rust
|
|
logging_rust = rust_source(ROOT, 'src/logging.rs')
|
|
assert 'pub per_vhost: bool' in logging_rust and 'default_vhost_log_directory' in logging_rust
|
|
pages_rust = rust_source(ROOT, 'src/pages.rs')
|
|
assert 'validate_local_response' in pages_rust and '(200..=599).contains(&status)' in pages_rust
|
|
assert 'Kind::Builtin' in pages_rust and 'builtin_application_page' in pages_rust
|
|
docker_rust = rust_source(ROOT, 'src/docker.rs')
|
|
for marker in ['pub poll_interval_seconds: u64', 'pub acl_profile_id: Option<String>', 'pub proxy_timeouts: crate::vhost::ProxyTimeouts', 'refresh(&self, settings: &Settings, force: bool)']:
|
|
assert marker in docker_rust, marker
|
|
docker_ui = (ROOT / 'src/admin/web/docker.js').read_text(encoding='utf-8')
|
|
for marker in ['docker-live-refresh', 'saveAssignment(agentId, row, publish)', 'docker-acl-profile', 'docker-proxy-read', 'dockerOpenApp', 'proxiedUrl(agent, hostname)']:
|
|
assert marker in docker_ui, marker
|
|
compression_source = rust_source(ROOT, 'src/compression.rs')
|
|
metrics_source = rust_source(ROOT, 'src/metrics.rs')
|
|
style_source = (ROOT / 'src/admin/web/style.css').read_text(encoding='utf-8')
|
|
app_source = read_app_js(ROOT)
|
|
assert 'restoreConfigRevision' in app_source and 'configHistoryRestoreConfirm' in app_source
|
|
assert 'function setMobileMenu(open)' in app_source and 'setPanel(button.dataset.panel); setMobileMenu(false);' in app_source
|
|
assert 'id="mobile-menu-toggle"' in html and 'id="main-navigation"' in html
|
|
assert '.sidebar.mobile-nav-open .main-navigation' in style_source
|
|
assert 'id="about-open"' in html and 'id="about-dialog"' in html and 'Mateusz Gruszczynski' in html
|
|
assert 'https://git.linuxiarz.pl/gru/RustProxy' in html and 'data-i18n="documentation" id="api-docs"' in html
|
|
assert '$("about-open").addEventListener("click"' in app_source and '.about-dialog {' in style_source
|
|
assert 'id="config-history-restore"' in html
|
|
vhosts_ui = read_vhosts_js(ROOT)
|
|
for marker in ['pub enum AppliedEncoding', 'AppliedEncoding::Gzip', 'AppliedEncoding::Brotli', 'AppliedEncoding::Zstd', 'AppliedEncoding::Deflate']:
|
|
assert marker in compression_source, marker
|
|
for marker in [
|
|
'gzip: true', 'br: true', 'zstd: true', 'deflate: false',
|
|
'const PREFERENCE: [Self; 4] = [Self::Zstd, Self::Brotli, Self::Gzip, Self::Deflate]',
|
|
'quality_weights_win_before_server_priority',
|
|
'equal_quality_uses_zstd_then_br_then_gzip_then_deflate',
|
|
'cookies_authorization_and_private_cache_policy_do_not_disable_compression',
|
|
'existing_content_encoding_is_never_recompressed',
|
|
]:
|
|
assert marker in compression_source, marker
|
|
assert 'AllowCookie' not in compression_source
|
|
diagnostics_source = rust_source(ROOT, 'src/diagnostics.rs') + rust_source(ROOT, 'src/system_stats/mod.rs') + rust_source(ROOT, 'src/system_stats/linux.rs')
|
|
for marker in ['pub struct NetworkInterfaceView', 'pub network_interfaces: Vec<NetworkInterfaceView>', 'sysinfo::Networks::new_with_refreshed_list', 'system.network_stats', 'collect_network_systemstat', 'normalize_network_interfaces', 'merge_network_interfaces']:
|
|
assert marker in diagnostics_source, marker
|
|
assert 'interfaces.truncate(64)' not in diagnostics_source, 'network inventory must not silently truncate interfaces'
|
|
for marker in ['pub http1_requests: AtomicU64', 'pub fn record_compression', 'each_codec_has_an_independent_counter', 'http1_requests_total']:
|
|
assert marker in metrics_source, marker
|
|
assert 'state.metrics.record_compression(encoding)' in proxy
|
|
assert 'protocolSamples' in app_source and 'm.http1_requests' in app_source and '$("open-proxy")' not in app_source
|
|
assert 'renderNetworkInterfaceCharts' in app_source and 'networkInterfaceSamples' in app_source
|
|
assert 'rp-hidden-network-interfaces' in app_source and 'network-interface-hide' in style_source
|
|
ui_html = (ROOT / 'src/admin/web/index.html').read_text(encoding='utf-8')
|
|
for marker in ['metric-bytes-down', 'metric-bytes-up', 'connection-chart', 'certificate-api-credentials']:
|
|
assert marker in ui_html, marker
|
|
assert 'id="network-interface-charts"' in ui_html
|
|
assert 'compressionCountersHelp' not in ui_html
|
|
assert 'sparkline-h1' in (ROOT / 'src/admin/web/index.html').read_text(encoding='utf-8')
|
|
assert 'body[data-density="compact"]' in style_source and '--ui-control: 22px' in style_source
|
|
compact_style_0270 = style_source.replace(' ', '')
|
|
for marker in ['progress::-webkit-progress-bar', 'progress::-webkit-progress-value', 'progress::-moz-progress-bar', '-webkit-appearance:none']:
|
|
assert marker in compact_style_0270, marker
|
|
assert 'status.backend_pool_domains' in vhosts_ui and 'payload["backend_pool_domains"]' in admin
|
|
docker_source = rust_source(ROOT, 'src/docker.rs')
|
|
management_ui = (ROOT / 'src/admin/web/management.js').read_text(encoding='utf-8')
|
|
for marker in ['function aliasEditor(', 'host-chip-editor docker-alias-editor', '.docker-force-ssl', '.docker-websockets', '.docker-cache-enabled', '.docker-compression-enabled', '.docker-passive-enabled', '.docker-passive-5xx', '.docker-agent-acl-profile']:
|
|
assert marker in docker_ui, marker
|
|
for forbidden in ['.docker-compression-zstd', '.docker-compression-br', '.docker-compression-gzip', '.docker-compression-deflate', 'compressionSelect(']:
|
|
assert forbidden not in docker_ui, forbidden
|
|
assert 'compressionEnabled.checked = assignment?.compression_enabled !== false' in docker_ui
|
|
assert 'compression_zstd: null, compression_br: null, compression_gzip: null, compression_deflate: null' in docker_ui
|
|
for marker in ['"force_ssl": assignment.force_ssl.unwrap_or(false)', '"websockets": assignment.websockets', '"enabled": assignment.compression_enabled', '"cache": {"enabled": assignment.cache_enabled}', '"passive_health": assignment.passive_health.clone()', 'assignment.acl_profile_id.clone().or_else(|| agent.acl_profile_id.clone())', 'host.transient_unavailable = target.is_none()', 'inventory: previous_inventory']:
|
|
assert marker in docker_source, marker
|
|
route_cache_0270 = rust_source(ROOT, 'src/proxy/forward/route_cache.rs')
|
|
for marker in ['if route.unavailable', 'StatusCode::SERVICE_UNAVAILABLE', 'published Docker service is currently unavailable', 'retry-after']:
|
|
assert marker in route_cache_0270, marker
|
|
assert 'agent.acl_profile_id === profile.id' in management_ui
|
|
vhost_source = rust_source(ROOT, 'src/vhost.rs')
|
|
for marker in ['DEFAULT_PROXY_CONNECT_TIMEOUT_SECONDS: u64 = 10', 'DEFAULT_PROXY_RESPONSE_HEADER_TIMEOUT_SECONDS: u64 = 120', 'DEFAULT_PROXY_READ_TIMEOUT_SECONDS: u64 = 60', 'DEFAULT_PROXY_SEND_TIMEOUT_SECONDS: u64 = 60', 'proxy_timeouts_have_explicit_safe_defaults_but_keep_null_compatibility']:
|
|
assert marker in vhost_source, marker
|
|
assert 'defaultProxyTimeouts = () => ({ connect_timeout_seconds: 10, response_header_timeout_seconds: 120, read_timeout_seconds: 60, send_timeout_seconds: 60 })' in vhosts_ui
|
|
assert 'actions.append(enabledLabel, stateBadge, remove)' in docker_ui
|
|
assert 'row._readListeners = listenerControl.read' in docker_ui and '.docker-agent-listeners' not in docker_ui
|
|
assert 'docker-agent-status-badge' in style_source and 'justify-content: center' in style_source
|
|
assert '.docker-agent-grid>label' in style_source and '#docker-agent-add' in style_source and 'margin-top: 14px' in style_source
|
|
assert 'Bearer token:' in (ROOT / 'docker-agent/install.sh').read_text(encoding='utf-8')
|
|
tls_rust = rust_source(ROOT, 'src/tls.rs')
|
|
assert 'pub fn validate_certificate_removals' in tls_rust and 'pub fn effective_cipher_suites' in tls_rust
|
|
assert "renewals.json" not in main
|
|
upgrade_source = (ROOT / "scripts/upgrade.py").read_text(encoding="utf-8")
|
|
assert "removed_obsolete_runtime_state" in upgrade_source and "legacy-data" not in upgrade_source and "certs_dir.is_symlink()" in upgrade_source
|
|
assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
|
|
openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
|
|
assert '"/api/config/history/restore"' in openapi
|
|
for marker in ['"version": "0.27.2"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
|
|
assert marker in openapi, marker
|
|
assert '"software_update"' in openapi and '"update_available"' in openapi
|
|
for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
|
|
assert marker in openapi, marker
|
|
for marker in ['"/api/certificate-api"', '"/api/certificate-api/{key_id}"', '"/api/certificates/{certificate_id}/reload"', '"CertificateReloadOneResult"', '"CertificateApiBearer"', '"CertificateApiKey"', '"/api/live-logs"']:
|
|
assert marker in openapi, marker
|
|
websocket_source = rust_source(ROOT, 'src/proxy/websocket.rs')
|
|
proxy_source = rust_source(ROOT, 'src/proxy/mod.rs')
|
|
for marker in ['websocket_legacy_support', 'vhWebsocketLegacySupport', 'vhWebsocketLegacySupportHelp']:
|
|
assert marker in vhosts_ui or marker in openapi, marker
|
|
for marker in ['fn legacy_websocket_origin(', 'request.headers_mut().insert("origin", origin)', 'websocket_legacy_support && !websocket_upstream_h2']:
|
|
assert marker in proxy_source, marker
|
|
for marker in ['legacy_support: bool', 'legacy 101 response declared a non-zero body', 'legacy_upstream_response_accepts_old_101_syntax_but_keeps_accept_proof_strict']:
|
|
assert marker in websocket_source, marker
|
|
for marker in ['certificate_api_credentials', 'upsert_certificate_api_credential', 'revoke_certificate_api_credential', 'verify_certificate_api_credential']:
|
|
assert marker in db_source, marker
|
|
logging_source = rust_source(ROOT, 'src/logging.rs')
|
|
for marker in ['LIVE_STREAM_CAPACITY', 'broadcast::Sender<LogEntry>', 'pub fn subscribe']:
|
|
assert marker in logging_source, marker
|
|
for marker in ['livelogs: bool', 'LiveLogFilters', 'live_logs_command', 'LocalAdminCertificateVerifier', 'detect_local_admin_scheme', 'admin.uri("/api/live-logs")']:
|
|
assert marker in main, marker
|
|
assert '.uri(format!("http://{addr}/api/live-logs"))' not in main
|
|
for marker in [
|
|
"allow_trusted_network_without_token", "include_docker_vhosts", "include_streams", "include_logging",
|
|
"rust_proxy_docker_vhost_{name}", "rust_proxy_docker_backend_{name}", "rust_proxy_geoip_loaded", "not_after_timestamp_seconds",
|
|
"ewma_latency_seconds", "passive_failures", "active_health_failures_total",
|
|
"passive_health_failures_total", "http_5xx_total", "timeouts_total",
|
|
"connect_errors_total", "io_errors_total", "slow_responses_total",
|
|
"rust_proxy_log_sink_queue_dropped_total", "rust_proxy_not_found_hosts_configured",
|
|
]:
|
|
assert marker in prometheus, marker
|
|
assert "if docker_targets.contains_key(&pool.id)" in prometheus
|
|
assert "if docker_targets.contains_key(id)" in prometheus
|
|
assert "rust_proxy_docker_vhost_exchange_duration_seconds" in prometheus
|
|
assert "PeerAddr" in prometheus and "Forwarded headers never participate in this decision" in prometheus
|
|
transport_doc = (ROOT / "docs/TRANSPORT.md").read_text(encoding="utf-8")
|
|
assert '127.0.0.1:9090' in transport_doc and 'accept_local_listener_risk: true' in transport_doc
|
|
drop_impl = http3.split('impl Drop for ReceiveBody', 1)[1].split('#[cfg(test)]', 1)[0]
|
|
assert 'self.stream.stop_sending(' not in drop_impl
|
|
websocket_source = rust_source(ROOT, 'src/proxy/websocket.rs')
|
|
for marker in ['h3::quinn::RecvStream', 'websocket_rfc9220_on(local)', 'run_h3', 'H3_REQUEST_CANCELLED']:
|
|
assert marker in http3 or marker in websocket_source, marker
|
|
assert 'upstream: Upgraded' in websocket_source
|
|
assert 'timeout(Duration::from_secs(10), upstream)' not in websocket_source
|
|
for marker in ['websocket_phase("tunnel_started")', 'websocket_phase("tunnel_closed")', 'h3_reset("H3_REQUEST_CANCELLED")']:
|
|
assert marker in websocket_source, marker
|
|
logging_source = rust_source(ROOT, 'src/logging.rs')
|
|
for marker in ['http_version', 'transport', 'websocket_bootstrap', 'websocket_phase', 'websocket_error', 'h3_reset_code', 'upstream_status']:
|
|
assert marker in logging_source, marker
|
|
assert 'h3_quinn' not in http3 and 'h3_quinn' not in (ROOT / 'tests/http3.rs').read_text(encoding='utf-8')
|
|
h3_test = (ROOT / 'tests/http3.rs').read_text(encoding='utf-8')
|
|
assert 'RFC 9220: Extended CONNECT negotiates WebSocket on the same H3 stream.' in h3_test
|
|
assert 'Method::CONNECT' in h3_test and 'h3::ext::Protocol' in h3_test and '.send_data(' in h3_test
|
|
for marker in ['external_admin_authority', 'external_admin_scheme', 'trusted_admin_forwarded_proto', 'reverse_proxy_dns_allowlist_uses_external_port_and_keeps_direct_port_available']:
|
|
assert marker in admin, marker
|
|
|
|
|
|
def container_contract_smoke() -> None:
|
|
dockerfile = (ROOT / "Dockerfile").read_text(encoding="utf-8")
|
|
unit = (ROOT / "deploy/rustproxy.service").read_text(encoding="utf-8")
|
|
assert "LogsDirectory=rustproxy" in unit and "LogsDirectoryMode=0770" in unit
|
|
assert "Environment=MALLOC_ARENA_MAX=2" in unit
|
|
assert "TimeoutStopSec=120" in unit
|
|
assert "ReadWritePaths=/var/lib/rustproxy /var/log/rustproxy" in unit
|
|
generated_unit = deploy.service_unit({"prefix":"/opt/rustproxy", "data_dir":"/var/lib/rustproxy", "user":"rustproxy", "group":"rustproxy", "admin":"127.0.0.1:9090", "remote_admin":False, "http":"0.0.0.0:80", "https":"0.0.0.0:443"})
|
|
assert "LogsDirectory=rustproxy" in generated_unit and "/var/log/rustproxy" in generated_unit
|
|
assert "Environment=MALLOC_ARENA_MAX=2" in generated_unit
|
|
for marker in [
|
|
"FROM rust:1.88-trixie AS build",
|
|
"cargo generate-lockfile",
|
|
"cargo build --locked --release",
|
|
"FROM debian:trixie-slim AS runtime",
|
|
"python3-venv",
|
|
"python3-pip",
|
|
"certbot",
|
|
"python3-certbot-dns-cloudflare",
|
|
"python3-certbot-dns-ovh",
|
|
"python3-certbot-dns-rfc2136",
|
|
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"USER rustproxy:rustproxy",
|
|
'VOLUME ["/var/lib/rustproxy"]',
|
|
]:
|
|
assert marker in dockerfile, marker
|
|
ignore = set((ROOT / ".dockerignore").read_text(encoding="utf-8").splitlines())
|
|
for marker in {"data", "target", ".env", "*.pem", "*.key"}:
|
|
assert marker in ignore, marker
|
|
assert (ROOT / "docs/CONTAINER.md").is_file()
|
|
|
|
def grafana_contract_smoke() -> None:
|
|
assert not (ROOT / "debian").exists(), "Debian packaging belongs to the external packaging repository"
|
|
dashboard = json.loads((ROOT / "grafana/rustproxy-overview.json").read_text(encoding="utf-8"))
|
|
assert dashboard.get("uid") == "rustproxy-0170"
|
|
queries = json.dumps(dashboard)
|
|
for marker in ["rust_proxy_process_rss_bytes", "rust_proxy_cache_transient_bytes", "rust_proxy_backend_ewma_latency_seconds", "rust_proxy_certificate_renewal_not_after_timestamp_seconds", "rust_proxy_not_found_hosts_configured", "rust_proxy_http1_requests_total", "rust_proxy_backend_upstream_client_generation_requests", "rust_proxy_backend_upstream_client_generation_age_seconds", "rust_proxy_backend_retry_attempts_total", "rust_proxy_backend_upstream_client_rotations_total", "rust_proxy_docker_backend_upstream_client_generation_requests", "rust_proxy_docker_backend_retry_attempts_total"]:
|
|
assert marker in queries, marker
|
|
|
|
|
|
def reproducible_archive_smoke(tmp: Path) -> None:
|
|
first = tmp / "first.zip"
|
|
second = tmp / "second.zip"
|
|
env = dict(os.environ, SOURCE_DATE_EPOCH="1700000000")
|
|
subprocess.run(["python3", str(ROOT / "make_zip.py"), str(first)], check=True, env=env, stdout=subprocess.DEVNULL)
|
|
subprocess.run(["python3", str(ROOT / "make_zip.py"), str(second)], check=True, env=env, stdout=subprocess.DEVNULL)
|
|
first_bytes, second_bytes = first.read_bytes(), second.read_bytes()
|
|
assert hashlib.sha256(first_bytes).digest() == hashlib.sha256(second_bytes).digest()
|
|
with zipfile.ZipFile(first) as archive:
|
|
names = archive.namelist()
|
|
assert "RustProxy/SHA256SUMS" in names
|
|
assert "RustProxy/scripts/rust_source.py" in names
|
|
assert "RustProxy/scripts/rust_module_contracts.py" in names
|
|
assert "RustProxy/scripts/source_module_contracts.py" in names
|
|
for name in names:
|
|
if name.startswith("RustProxy/") and name.endswith(".rs"):
|
|
assert len(archive.read(name).decode("utf-8").splitlines()) <= 500, name
|
|
if name.startswith("RustProxy/src/admin/web/") and name.endswith(".js"):
|
|
assert len(archive.read(name).decode("utf-8").splitlines()) <= 500, name
|
|
if name.startswith("RustProxy/docker-agent/") and name.endswith(".go"):
|
|
assert len(archive.read(name).decode("utf-8").splitlines()) <= 500, name
|
|
assert "RustProxy/src/admin/web/error_401.html" in names
|
|
assert "RustProxy/src/admin/web/error_404.html" in names
|
|
assert "RustProxy/docs/CUSTOM_LOCATIONS.md" in names
|
|
assert "RustProxy/docs/WEB_SERVER.md" in names
|
|
assert "RustProxy/docs/PHP_FPM.md" in names
|
|
for module in ["mod.rs", "config.rs", "filesystem.rs", "security.rs", "response.rs", "request.rs", "routing.rs", "fastcgi.rs", "serve.rs", "htaccess.rs", "tests.rs"]:
|
|
assert f"RustProxy/src/web_server/{module}" in names
|
|
assert "RustProxy/src/web_server.rs" not in names
|
|
assert "RustProxy/src/admin/web/web-server.js" in names
|
|
for module in ["app/core.js", "app/preferences.js", "app/config-history.js", "app/runtime.js", "app/settings.js", "drafts.js", "vhosts/core.js", "vhosts/editor.js", "vhosts/render.js"]:
|
|
assert f"RustProxy/src/admin/web/{module}" in names
|
|
assert "RustProxy/src/admin/web/app.js" not in names and "RustProxy/src/admin/web/vhosts.js" not in names
|
|
for module in ["model.go", "docker.go", "network.go", "certificate.go", "server.go", "main.go", "main_test.go"]:
|
|
assert f"RustProxy/docker-agent/{module}" in names
|
|
for module in ["deploy.py", "deploy_core.py", "deploy_runtime.py", "migrate_npm.py", "migrate_npm_core.py", "migrate_npm_api.py"]:
|
|
assert f"RustProxy/scripts/{module}" in names
|
|
assert "RustProxy/nagios/check_rustproxy.py" in names
|
|
assert "RustProxy/nagios/check_rustproxy_api" in names
|
|
assert "RustProxy/src/admin/web/host404.js" in names
|
|
assert "RustProxy/docs/NOT_FOUND_HOSTS.md" in names
|
|
assert not any(name.startswith("RustProxy/debian/") for name in names)
|
|
assert "RustProxy/grafana/rustproxy-overview.json" in names
|
|
assert "RustProxy/UPDATE_CHECK.toml" in names
|
|
assert "RustProxy/src/update_check.rs" in names
|
|
assert "RustProxy/docker-agent/docker-agent" not in names
|
|
assert all("/data/" not in name and "/target/" not in name for name in names)
|
|
assert all(not name.endswith("/.env") for name in names), "local .env leaked into release archive"
|
|
assert "RustProxy/.env.example" in names
|
|
timestamps = {item.date_time for item in archive.infolist()}
|
|
assert len(timestamps) == 1
|
|
|
|
|
|
def managed_acme_relocation_smoke(tmp: Path) -> None:
|
|
"""Reproduce the 0.27.1 relocated console-script shebang failure."""
|
|
stage = tmp / "acme-python.installing"
|
|
final = tmp / "acme-python"
|
|
bindir = stage / "bin"
|
|
bindir.mkdir(parents=True)
|
|
python = bindir / "python"
|
|
python.write_text(
|
|
"#!/bin/sh\n"
|
|
"test \"$1\" = -I && test \"$2\" = -m && test \"$3\" = certbot && test \"$4\" = --version || exit 2\n"
|
|
"echo 'certbot 5.8.0'\n",
|
|
encoding="utf-8",
|
|
)
|
|
python.chmod(0o755)
|
|
console = bindir / "certbot"
|
|
console.write_text(f"#!{python}\necho 'certbot 5.8.0'\n", encoding="utf-8")
|
|
console.chmod(0o755)
|
|
stage.rename(final)
|
|
|
|
relocated_console = final / "bin/certbot"
|
|
try:
|
|
subprocess.run([str(relocated_console), "--version"], check=True, capture_output=True, text=True)
|
|
except OSError:
|
|
pass
|
|
else:
|
|
raise AssertionError("relocated pip console script unexpectedly kept a valid staging shebang")
|
|
|
|
worker_path = ROOT / "scripts/acme_provider.py"
|
|
spec = importlib.util.spec_from_file_location("rustproxy_acme_provider", worker_path)
|
|
assert spec and spec.loader
|
|
module = importlib.util.module_from_spec(spec)
|
|
old = os.environ.get("RUSTPROXY_CERTBOT_PYTHON")
|
|
os.environ["RUSTPROXY_CERTBOT_PYTHON"] = str(final / "bin/python")
|
|
try:
|
|
spec.loader.exec_module(module)
|
|
prefix = module.certbot_prefix()
|
|
assert prefix == [str(final / "bin/python"), "-I", "-m", "certbot"]
|
|
result = subprocess.run(prefix + ["--version"], check=True, capture_output=True, text=True)
|
|
assert result.stdout.strip() == "certbot 5.8.0"
|
|
finally:
|
|
if old is None:
|
|
os.environ.pop("RUSTPROXY_CERTBOT_PYTHON", None)
|
|
else:
|
|
os.environ["RUSTPROXY_CERTBOT_PYTHON"] = old
|
|
|
|
|
|
def main() -> None:
|
|
subprocess.run(["python3", str(ROOT / "scripts/rust_module_contracts.py")], check=True)
|
|
subprocess.run(["python3", str(ROOT / "scripts/source_module_contracts.py")], check=True)
|
|
with tempfile.TemporaryDirectory(prefix="rustproxy-release-smoke-") as directory:
|
|
tmp = Path(directory)
|
|
sql_and_backup_smoke(tmp / "sql")
|
|
upgrade_smoke(tmp / "upgrade")
|
|
managed_acme_relocation_smoke(tmp / "acme-relocation")
|
|
reproducible_archive_smoke(tmp / "archives")
|
|
deployment_gate_smoke(tmp)
|
|
npm_migration_smoke(tmp)
|
|
ui_contract_smoke()
|
|
source_contract_smoke()
|
|
container_contract_smoke()
|
|
grafana_contract_smoke()
|
|
print("PASS: 0.27.2 SQLite/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|