initial commit
This commit is contained in:
@@ -0,0 +1,546 @@
|
||||
package proxy
|
||||
|
||||
import (
|
||||
"crypto/tls"
|
||||
"encoding/json"
|
||||
"io"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"helix-proxy/internal/certificate"
|
||||
"helix-proxy/internal/config"
|
||||
"helix-proxy/internal/store"
|
||||
|
||||
"golang.org/x/net/websocket"
|
||||
)
|
||||
|
||||
// TestEngine_Integration_FullSetup wires proxy hosts, redirections, dead hosts,
|
||||
// access lists, certificates, locations, and streams against configurable whoami upstreams.
|
||||
func TestEngine_Integration_FullSetup(t *testing.T) {
|
||||
eng, st := newTestEngine(t)
|
||||
defer closeStore(st)
|
||||
|
||||
// --- upstream mocks ---
|
||||
mainUpstream := NewWhoami(t, WhoamiConfig{
|
||||
Routes: map[string]WhoamiRoute{
|
||||
"/health": {Status: 200, Body: `{"status":"ok"}`, Headers: map[string]string{"X-Secret": "hidden"}},
|
||||
},
|
||||
})
|
||||
apiUpstream := NewWhoami(t, WhoamiConfig{
|
||||
ValidPrefixes: []string{"/v2"},
|
||||
})
|
||||
authUpstream := NewWhoami(t, WhoamiConfig{})
|
||||
tcpEcho := NewTCPEcho(t, "STREAM-OK\n")
|
||||
|
||||
certRec := issueDevCert(t, st, "secure.example", "stream.example")
|
||||
|
||||
// --- access list ---
|
||||
al, _ := st.CreateAccessList(store.AccessList{
|
||||
Name: "integration-acl",
|
||||
SatisfyAny: false,
|
||||
Clients: []store.AccessClient{{Address: "all", Directive: "allow"}},
|
||||
Items: []store.AccessItem{{Username: "testuser", Password: "secret"}},
|
||||
PassAuth: false,
|
||||
})
|
||||
|
||||
// --- proxy host: headers, location rewrite, access, cert ---
|
||||
_, _ = st.CreateProxyHost(store.ProxyHost{
|
||||
DomainNames: []string{"proxy-int.example"},
|
||||
ForwardScheme: "http",
|
||||
ForwardHost: mainUpstream.Hostname,
|
||||
ForwardPort: mainUpstream.Port,
|
||||
CertificateID: certRec.ID,
|
||||
AccessListID: al.ID,
|
||||
TrustForwardedProto: true,
|
||||
RequestHeaders: []store.HeaderRule{{Name: "X-Injected-Req", Value: "yes"}},
|
||||
ResponseHeaders: []store.HeaderRule{{Name: "X-Injected-Resp", Value: "yes"}},
|
||||
HideHeaders: []string{"X-Secret"},
|
||||
Enabled: true,
|
||||
Locations: []store.Location{{
|
||||
Path: "/api",
|
||||
ForwardScheme: "http",
|
||||
ForwardHost: apiUpstream.Hostname,
|
||||
ForwardPort: apiUpstream.Port,
|
||||
ForwardPath: "/v2",
|
||||
}},
|
||||
})
|
||||
|
||||
// proxy with passAuth=true to verify Authorization reaches upstream
|
||||
alPass, _ := st.CreateAccessList(store.AccessList{
|
||||
Name: "pass-auth-acl",
|
||||
Clients: []store.AccessClient{{Address: "all", Directive: "allow"}},
|
||||
Items: []store.AccessItem{{Username: "u", Password: "p"}},
|
||||
PassAuth: true,
|
||||
})
|
||||
_, _ = st.CreateProxyHost(store.ProxyHost{
|
||||
DomainNames: []string{"passauth.example"},
|
||||
ForwardScheme: "http",
|
||||
ForwardHost: authUpstream.Hostname,
|
||||
ForwardPort: authUpstream.Port,
|
||||
AccessListID: alPass.ID,
|
||||
Enabled: true,
|
||||
})
|
||||
|
||||
// --- redirection host ---
|
||||
_, _ = st.CreateRedirectionHost(store.RedirectionHost{
|
||||
DomainNames: []string{"redir-int.example"},
|
||||
ForwardHTTPCode: 302,
|
||||
ForwardScheme: "https",
|
||||
ForwardDomainName: "target-int.example",
|
||||
PreservePath: true,
|
||||
Enabled: true,
|
||||
})
|
||||
|
||||
// --- dead hosts ---
|
||||
_, _ = st.CreateDeadHost(store.DeadHost{
|
||||
DomainNames: []string{"dead-int.example"},
|
||||
Enabled: true,
|
||||
Meta: map[string]any{"html": "<h1>integration dead</h1>"},
|
||||
})
|
||||
wwwDir := config.Resolve("www")
|
||||
_ = os.MkdirAll(wwwDir, 0o755)
|
||||
_ = os.WriteFile(filepath.Join(wwwDir, "404.html"), []byte("<h1>INTEGRATION 404 FILE</h1>"), 0o644)
|
||||
_, _ = st.CreateDeadHost(store.DeadHost{DomainNames: []string{"deadfile-int.example"}, Enabled: true})
|
||||
|
||||
// --- default site modes ---
|
||||
_ = st.SetSetting("default_site", "404")
|
||||
|
||||
// --- stream (TCP) ---
|
||||
t.Setenv("DISABLE_IPV6", "1")
|
||||
streamPort := pickFreePort(t)
|
||||
_, _ = st.CreateStream(store.Stream{
|
||||
IncomingPort: streamPort,
|
||||
ForwardingHost: tcpEcho.Host,
|
||||
ForwardingPort: tcpEcho.Port,
|
||||
TCPForwarding: true,
|
||||
Enabled: true,
|
||||
})
|
||||
cleanupStreams(t, eng, st)
|
||||
|
||||
eng.ReloadFromStore()
|
||||
h := eng.Handler()
|
||||
|
||||
// --- redirection ---
|
||||
rr := doReq(h, "GET", "redir-int.example", "/foo?bar=1", nil, nil)
|
||||
if rr.Code != 302 || !strings.Contains(rr.Header().Get("Location"), "https://target-int.example/foo?bar=1") {
|
||||
t.Errorf("redirection: code=%d loc=%q", rr.Code, rr.Header().Get("Location"))
|
||||
}
|
||||
|
||||
// --- dead hosts ---
|
||||
rr = doReq(h, "GET", "dead-int.example", "/", nil, nil)
|
||||
if rr.Code != 404 || !strings.Contains(rr.Body.String(), "integration dead") {
|
||||
t.Errorf("dead meta: code=%d body=%q", rr.Code, rr.Body.String())
|
||||
}
|
||||
rr = doReq(h, "GET", "deadfile-int.example", "/", nil, nil)
|
||||
if rr.Code != 404 || !strings.Contains(rr.Body.String(), "INTEGRATION 404 FILE") {
|
||||
t.Errorf("dead file: code=%d body=%q", rr.Code, rr.Body.String())
|
||||
}
|
||||
|
||||
// --- default 404 ---
|
||||
rr = doReq(h, "GET", "unknown-int.example", "/", nil, nil)
|
||||
if rr.Code != 404 {
|
||||
t.Errorf("default 404: %d", rr.Code)
|
||||
}
|
||||
|
||||
// --- certificate SNI ---
|
||||
cert, err := eng.GetCertificate(&tls.ClientHelloInfo{ServerName: "secure.example"})
|
||||
if err != nil || cert == nil {
|
||||
t.Errorf("GetCertificate secure.example: err=%v cert=%v", err, cert)
|
||||
}
|
||||
|
||||
// --- proxy: main path with auth + injected headers ---
|
||||
authHdr := http.Header{
|
||||
"Authorization": []string{"Basic " + basic("testuser", "secret")},
|
||||
"X-Forwarded-For": []string{"10.0.0.5"},
|
||||
"X-Forwarded-Proto": []string{"https"},
|
||||
}
|
||||
rr = doReq(h, "GET", "proxy-int.example", "/health", authHdr, nil)
|
||||
if rr.Code != 200 {
|
||||
t.Fatalf("proxy /health: code=%d body=%s", rr.Code, rr.Body.String())
|
||||
}
|
||||
if rr.Header().Get("X-Injected-Resp") != "yes" {
|
||||
t.Error("response header injection missing")
|
||||
}
|
||||
if rr.Header().Get("X-Secret") != "" {
|
||||
t.Error("hide header failed: X-Secret leaked")
|
||||
}
|
||||
if got, ok := mainUpstream.LastRequest(); !ok {
|
||||
t.Fatal("main upstream saw no request")
|
||||
} else {
|
||||
if got.Path != "/health" {
|
||||
t.Errorf("main path: got %q want /health", got.Path)
|
||||
}
|
||||
if got.HeaderValue("X-Injected-Req") != "yes" {
|
||||
t.Errorf("request header injection: got %q", got.HeaderValue("X-Injected-Req"))
|
||||
}
|
||||
if got.HeaderValue("Authorization") != "" {
|
||||
t.Error("passAuth=false should strip Authorization before upstream")
|
||||
}
|
||||
if got.HeaderValue("X-Forwarded-Proto") != "https" {
|
||||
t.Errorf("X-Forwarded-Proto: got %q", got.HeaderValue("X-Forwarded-Proto"))
|
||||
}
|
||||
}
|
||||
|
||||
// --- location path rewrite ---
|
||||
apiUpstream.ClearRequests()
|
||||
rr = doReq(h, "GET", "proxy-int.example", "/api/foo", authHdr, nil)
|
||||
if rr.Code != 200 {
|
||||
t.Fatalf("location /api/foo: code=%d", rr.Code)
|
||||
}
|
||||
got, ok := apiUpstream.LastRequest()
|
||||
if !ok {
|
||||
t.Fatal("api upstream saw no request for location")
|
||||
}
|
||||
if got.Path != "/v2/foo" {
|
||||
t.Errorf("location rewrite: upstream path=%q want /v2/foo", got.Path)
|
||||
}
|
||||
if rr.Header().Get("X-Whoami-Path") != "/v2/foo" {
|
||||
t.Errorf("X-Whoami-Path header: %q", rr.Header().Get("X-Whoami-Path"))
|
||||
}
|
||||
|
||||
// --- passAuth=true keeps Authorization ---
|
||||
authUpstream.ClearRequests()
|
||||
rr = doReq(h, "GET", "passauth.example", "/", http.Header{
|
||||
"Authorization": []string{"Basic " + basic("u", "p")},
|
||||
}, nil)
|
||||
if rr.Code != 200 {
|
||||
t.Fatalf("passauth proxy: code=%d", rr.Code)
|
||||
}
|
||||
got, ok = authUpstream.LastRequest()
|
||||
if !ok {
|
||||
t.Fatal("auth upstream saw no request")
|
||||
}
|
||||
if got.HeaderValue("Authorization") == "" {
|
||||
t.Error("passAuth=true should forward Authorization to upstream")
|
||||
}
|
||||
|
||||
// --- whoami JSON echo on default route ---
|
||||
mainUpstream.ClearRequests()
|
||||
rr = doReq(h, "GET", "proxy-int.example", "/echo-test?q=1", authHdr, nil)
|
||||
if rr.Code != 200 {
|
||||
t.Fatalf("echo route: code=%d", rr.Code)
|
||||
}
|
||||
var echoed WhoamiRequest
|
||||
if err := json.Unmarshal(rr.Body.Bytes(), &echoed); err != nil {
|
||||
t.Fatalf("parse whoami json: %v body=%s", err, rr.Body.String())
|
||||
}
|
||||
if echoed.Path != "/echo-test" || echoed.Query != "q=1" {
|
||||
t.Errorf("whoami json echo: path=%q query=%q", echoed.Path, echoed.Query)
|
||||
}
|
||||
|
||||
// --- stream TCP forwarding ---
|
||||
waitForTCP(t, net.JoinHostPort("127.0.0.1", itoa(streamPort)), 5*time.Second)
|
||||
conn, err := net.DialTimeout("tcp", net.JoinHostPort("127.0.0.1", itoa(streamPort)), 2*time.Second)
|
||||
if err != nil {
|
||||
t.Fatalf("dial stream port %d: %v", streamPort, err)
|
||||
}
|
||||
defer conn.Close()
|
||||
_ = conn.SetDeadline(time.Now().Add(2 * time.Second))
|
||||
if _, err := io.WriteString(conn, "ping\n"); err != nil {
|
||||
t.Fatalf("stream write: %v", err)
|
||||
}
|
||||
buf := make([]byte, 64)
|
||||
n, err := conn.Read(buf)
|
||||
if err != nil {
|
||||
t.Fatalf("stream read: %v", err)
|
||||
}
|
||||
if !strings.Contains(string(buf[:n]), "STREAM-OK") {
|
||||
t.Errorf("stream echo: got %q", string(buf[:n]))
|
||||
}
|
||||
|
||||
// reload lifecycle: cleanupStreams t.Cleanup also exercises disable path
|
||||
strms := st.GetStreams()
|
||||
if len(strms) == 0 {
|
||||
t.Fatal("no streams in store")
|
||||
}
|
||||
}
|
||||
|
||||
// TestEngine_Integration_Websocket verifies end-to-end websocket upgrade and message echo.
|
||||
func TestEngine_Integration_Websocket(t *testing.T) {
|
||||
eng, st := newTestEngine(t)
|
||||
defer closeStore(st)
|
||||
|
||||
wsUp := NewWhoamiWS(t, "/ws")
|
||||
_, _ = st.CreateProxyHost(store.ProxyHost{
|
||||
DomainNames: []string{"ws-int.example"},
|
||||
ForwardScheme: "http",
|
||||
ForwardHost: wsUp.Hostname,
|
||||
ForwardPort: wsUp.Port,
|
||||
Enabled: true,
|
||||
AllowWebsocketUpgrade: true,
|
||||
TrustForwardedProto: true,
|
||||
})
|
||||
eng.ReloadFromStore()
|
||||
|
||||
proxy := newProxyServer(t, eng)
|
||||
ws := dialWhoamiWS(t, proxy.URL, "ws-int.example", "/ws", http.Header{
|
||||
"X-Forwarded-For": []string{"10.9.8.7"},
|
||||
"X-Forwarded-Proto": []string{"https"},
|
||||
})
|
||||
|
||||
if err := websocket.Message.Send(ws, "hello"); err != nil {
|
||||
t.Fatalf("ws send: %v", err)
|
||||
}
|
||||
var reply string
|
||||
if err := websocket.Message.Receive(ws, &reply); err != nil {
|
||||
t.Fatalf("ws recv: %v", err)
|
||||
}
|
||||
if reply != "echo:hello" {
|
||||
t.Errorf("ws echo: got %q", reply)
|
||||
}
|
||||
|
||||
got, ok := wsUp.UpgradeRequest()
|
||||
if !ok {
|
||||
t.Fatal("upstream missed websocket upgrade request")
|
||||
}
|
||||
if got.Path != "/ws" {
|
||||
t.Errorf("upgrade path: %q", got.Path)
|
||||
}
|
||||
if !strings.Contains(got.HeaderValue("X-Forwarded-For"), "10.9.8.7") {
|
||||
t.Errorf("upgrade X-Forwarded-For: %q", got.HeaderValue("X-Forwarded-For"))
|
||||
}
|
||||
if got.HeaderValue("X-Forwarded-Proto") != "https" {
|
||||
t.Errorf("upgrade X-Forwarded-Proto: %q", got.HeaderValue("X-Forwarded-Proto"))
|
||||
}
|
||||
if got.HeaderValue("Connection") != "Upgrade" || got.HeaderValue("Upgrade") != "websocket" {
|
||||
t.Errorf("upgrade headers: conn=%q up=%q", got.HeaderValue("Connection"), got.HeaderValue("Upgrade"))
|
||||
}
|
||||
msgs := wsUp.Messages()
|
||||
if len(msgs) != 1 || msgs[0] != "hello" {
|
||||
t.Errorf("upstream messages: %v", msgs)
|
||||
}
|
||||
}
|
||||
|
||||
// TestEngine_Integration_Caching exercises cache HIT/MISS through whoami upstreams.
|
||||
func TestEngine_Integration_Caching(t *testing.T) {
|
||||
eng, st := newTestEngine(t)
|
||||
defer closeStore(st)
|
||||
|
||||
upstream := NewWhoami(t, WhoamiConfig{
|
||||
DefaultHeaders: map[string]string{"Cache-Control": "max-age=3600"},
|
||||
Routes: map[string]WhoamiRoute{
|
||||
"/asset": {Body: "CACHED-ASSET"},
|
||||
},
|
||||
})
|
||||
_, _ = st.CreateProxyHost(store.ProxyHost{
|
||||
DomainNames: []string{"cache-int.example"},
|
||||
ForwardScheme: "http",
|
||||
ForwardHost: upstream.Hostname,
|
||||
ForwardPort: upstream.Port,
|
||||
Enabled: true,
|
||||
CachingEnabled: true,
|
||||
})
|
||||
eng.ReloadFromStore()
|
||||
h := eng.Handler()
|
||||
|
||||
rr1 := doReq(h, "GET", "cache-int.example", "/asset", nil, nil)
|
||||
if rr1.Code != 200 || rr1.Header().Get("X-Proxy-Cache") != "MISS" || rr1.Body.String() != "CACHED-ASSET" {
|
||||
t.Fatalf("cache MISS: code=%d cache=%s body=%q", rr1.Code, rr1.Header().Get("X-Proxy-Cache"), rr1.Body.String())
|
||||
}
|
||||
if reqs := upstream.Requests(); len(reqs) != 1 {
|
||||
t.Fatalf("upstream requests after MISS: %d", len(reqs))
|
||||
}
|
||||
|
||||
rr2 := doReq(h, "GET", "cache-int.example", "/asset", nil, nil)
|
||||
if rr2.Header().Get("X-Proxy-Cache") != "HIT" || rr2.Body.String() != "CACHED-ASSET" {
|
||||
t.Errorf("cache HIT: cache=%s body=%q", rr2.Header().Get("X-Proxy-Cache"), rr2.Body.String())
|
||||
}
|
||||
if reqs := upstream.Requests(); len(reqs) != 1 {
|
||||
t.Errorf("upstream should not be hit again on HIT; requests=%d", len(reqs))
|
||||
}
|
||||
}
|
||||
|
||||
// TestEngine_Integration_ProxyMiddleware exercises ssl_forced, block_exploits, and HSTS
|
||||
// against a real whoami upstream.
|
||||
func TestEngine_Integration_ProxyMiddleware(t *testing.T) {
|
||||
eng, st := newTestEngine(t)
|
||||
defer closeStore(st)
|
||||
|
||||
upstream := NewWhoami(t, WhoamiConfig{})
|
||||
_, _ = st.CreateProxyHost(store.ProxyHost{
|
||||
DomainNames: []string{"middleware.example"},
|
||||
ForwardScheme: "http",
|
||||
ForwardHost: upstream.Hostname,
|
||||
ForwardPort: upstream.Port,
|
||||
Enabled: true,
|
||||
SslForced: true,
|
||||
BlockExploits: true,
|
||||
HstsEnabled: true,
|
||||
HstsSubdomains: true,
|
||||
TrustForwardedProto: true,
|
||||
})
|
||||
eng.ReloadFromStore()
|
||||
h := eng.Handler()
|
||||
|
||||
// ssl_forced redirects plain http
|
||||
rr := doReq(h, "GET", "middleware.example", "/ok", http.Header{
|
||||
"X-Forwarded-Proto": []string{"http"},
|
||||
}, nil)
|
||||
if rr.Code != 301 || !strings.HasPrefix(rr.Header().Get("Location"), "https://") {
|
||||
t.Errorf("ssl_forced: code=%d loc=%q", rr.Code, rr.Header().Get("Location"))
|
||||
}
|
||||
|
||||
// block_exploits on https path
|
||||
req := httptest.NewRequest("GET", "/.env", nil)
|
||||
req.Host = "middleware.example"
|
||||
req.TLS = &tls.ConnectionState{}
|
||||
rr = httptest.NewRecorder()
|
||||
h.ServeHTTP(rr, req)
|
||||
if rr.Code != 403 || !strings.Contains(rr.Body.String(), "exploits") {
|
||||
t.Errorf("block_exploits: code=%d body=%q", rr.Code, rr.Body.String())
|
||||
}
|
||||
|
||||
// HSTS + successful whoami proxy on https
|
||||
req = httptest.NewRequest("GET", "/ok", nil)
|
||||
req.Host = "middleware.example"
|
||||
req.TLS = &tls.ConnectionState{}
|
||||
rr = httptest.NewRecorder()
|
||||
h.ServeHTTP(rr, req)
|
||||
if rr.Code != 200 {
|
||||
t.Fatalf("proxy ok: code=%d body=%s", rr.Code, rr.Body.String())
|
||||
}
|
||||
if hs := rr.Header().Get("Strict-Transport-Security"); !strings.Contains(hs, "includeSubDomains") {
|
||||
t.Errorf("hsts: %q", hs)
|
||||
}
|
||||
got, ok := upstream.LastRequest()
|
||||
if !ok || got.Path != "/ok" {
|
||||
t.Errorf("upstream path: got=%v ok=%v", got.Path, ok)
|
||||
}
|
||||
}
|
||||
|
||||
// issueDevCert creates and issues a self-signed certificate in development mode.
|
||||
func issueDevCert(t *testing.T, st store.Store, domains ...string) store.Certificate {
|
||||
t.Helper()
|
||||
t.Setenv("PROXY_MODE", "development")
|
||||
cm := certificate.NewManager(st)
|
||||
rec, _ := st.CreateCertificate(store.Certificate{
|
||||
Provider: "letsencrypt",
|
||||
DomainNames: domains,
|
||||
Meta: map[string]any{},
|
||||
})
|
||||
if err := cm.Issue(rec, cm.GetEmailForCert(rec)); err != nil {
|
||||
t.Fatalf("issue cert: %v", err)
|
||||
}
|
||||
rec, _ = st.GetCertificate(rec.ID)
|
||||
return rec
|
||||
}
|
||||
|
||||
// TestEngine_Integration_TLSStream verifies TLS-terminated TCP stream forwarding.
|
||||
func TestEngine_Integration_TLSStream(t *testing.T) {
|
||||
eng, st := newTestEngine(t)
|
||||
defer closeStore(st)
|
||||
t.Setenv("DISABLE_IPV6", "1")
|
||||
|
||||
certRec := issueDevCert(t, st, "stream-tls.example")
|
||||
tcpEcho := NewTCPEcho(t, "STREAM-TLS-OK\n")
|
||||
streamPort := 20000 + int(time.Now().UnixNano()%10000)
|
||||
|
||||
_, _ = st.CreateStream(store.Stream{
|
||||
IncomingPort: streamPort,
|
||||
ForwardingHost: tcpEcho.Host,
|
||||
ForwardingPort: tcpEcho.Port,
|
||||
TCPForwarding: true,
|
||||
Enabled: true,
|
||||
CertificateID: certRec.ID,
|
||||
})
|
||||
cleanupStreams(t, eng, st)
|
||||
eng.ReloadFromStore()
|
||||
|
||||
if eng.getStreamCert(certRec.ID) == nil {
|
||||
t.Fatalf("stream cert %d not loaded after reload", certRec.ID)
|
||||
}
|
||||
|
||||
trust, err := eng.GetCertificate(&tls.ClientHelloInfo{ServerName: "stream-tls.example"})
|
||||
if err != nil {
|
||||
t.Fatalf("GetCertificate: %v", err)
|
||||
}
|
||||
|
||||
addr := net.JoinHostPort("127.0.0.1", itoa(streamPort))
|
||||
var waitErr error
|
||||
for attempt := 0; attempt < 3; attempt++ {
|
||||
waitErr = tryWaitForTLSStream(addr, "stream-tls.example", trust, 2*time.Second)
|
||||
if waitErr == nil {
|
||||
break
|
||||
}
|
||||
eng.ReloadFromStore()
|
||||
}
|
||||
if waitErr != nil {
|
||||
t.Fatalf("tls stream listener on %s: %v", addr, waitErr)
|
||||
}
|
||||
|
||||
conn := DialTLSStream(t, addr, "stream-tls.example", trust)
|
||||
if _, err := io.WriteString(conn, "ping\n"); err != nil {
|
||||
t.Fatalf("tls stream write: %v", err)
|
||||
}
|
||||
got := ReadStreamGreeting(t, conn, 64, 2*time.Second)
|
||||
if !strings.Contains(got, "STREAM-TLS-OK") {
|
||||
t.Errorf("tls stream echo: got %q", got)
|
||||
}
|
||||
|
||||
// plain TCP to a TLS listener should fail handshake quickly
|
||||
raw, err := net.DialTimeout("tcp", addr, time.Second)
|
||||
if err != nil {
|
||||
t.Fatalf("raw dial: %v", err)
|
||||
}
|
||||
defer raw.Close()
|
||||
_ = raw.SetDeadline(time.Now().Add(time.Second))
|
||||
if _, err := io.WriteString(raw, "not-tls\n"); err != nil {
|
||||
t.Fatalf("raw write: %v", err)
|
||||
}
|
||||
buf := make([]byte, 16)
|
||||
if _, err := raw.Read(buf); err == nil {
|
||||
t.Error("expected plain TCP to TLS stream to fail read, got data")
|
||||
}
|
||||
}
|
||||
|
||||
// TestEngine_Integration_UDPStream verifies UDP stream forwarding.
|
||||
func TestEngine_Integration_UDPStream(t *testing.T) {
|
||||
eng, st := newTestEngine(t)
|
||||
defer closeStore(st)
|
||||
t.Setenv("DISABLE_IPV6", "1") // bind 0.0.0.0 so 127.0.0.1 dials reach the listener
|
||||
|
||||
udpEcho := NewUDPEcho(t, "UDP-STREAM-OK\n")
|
||||
streamPort := pickFreePort(t)
|
||||
|
||||
_, _ = st.CreateStream(store.Stream{
|
||||
IncomingPort: streamPort,
|
||||
ForwardingHost: udpEcho.Host,
|
||||
ForwardingPort: udpEcho.Port,
|
||||
UDPForwarding: true,
|
||||
Enabled: true,
|
||||
})
|
||||
cleanupStreams(t, eng, st)
|
||||
eng.ReloadFromStore()
|
||||
|
||||
addr := net.JoinHostPort("127.0.0.1", itoa(streamPort))
|
||||
waitForUDP(t, addr, 2*time.Second)
|
||||
|
||||
target, err := net.ResolveUDPAddr("udp", addr)
|
||||
if err != nil {
|
||||
t.Fatalf("resolve stream udp: %v", err)
|
||||
}
|
||||
conn, err := net.DialUDP("udp", nil, target)
|
||||
if err != nil {
|
||||
t.Fatalf("dial stream udp: %v", err)
|
||||
}
|
||||
defer conn.Close()
|
||||
_ = conn.SetDeadline(time.Now().Add(2 * time.Second))
|
||||
|
||||
if _, err := conn.Write([]byte("probe")); err != nil {
|
||||
t.Fatalf("udp write: %v", err)
|
||||
}
|
||||
buf := make([]byte, 64)
|
||||
n, err := conn.Read(buf)
|
||||
if err != nil {
|
||||
t.Fatalf("udp read: %v", err)
|
||||
}
|
||||
if !strings.Contains(string(buf[:n]), "UDP-STREAM-OK") {
|
||||
t.Errorf("udp stream echo: got %q", string(buf[:n]))
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user