e2e/acme_test.go

  1package e2e
  2
  3import (
  4	"crypto/tls"
  5	"fmt"
  6	"net"
  7	"net/http"
  8	"os"
  9	"os/exec"
 10	"path/filepath"
 11	"testing"
 12	"time"
 13)
 14
 15// TestACMEServe verifies the acme wiring offline: the HTTPS listener is up
 16// with autocert answering handshakes, and the port-80-style helper listener
 17// serves redirects. Actual issuance needs a reachable CA and a public DNS
 18// name, which a test cannot have; what matters here is that the plumbing is
 19// correct and failure to issue does not kill the daemon.
 20func TestACMEServe(t *testing.T) {
 21	t.Parallel()
 22	inst := startInstanceWith(t, "") // helper for binary + keys; killed below
 23	inst.proc.Process.Kill()
 24	inst.proc.Wait()
 25
 26	ports := freePorts(t, 2)
 27	httpsPort, acmeHTTPPort := ports[0], ports[1]
 28	cfg := fmt.Sprintf(`
 29[server]
 30root = %q
 31site_url = "https://gitbay.example"
 32[ssh]
 33port = %d
 34[http]
 35addr = "127.0.0.1:%d"
 36tls = "acme"
 37acme_email = "noreply@gitbay.example"
 38acme_http_addr = "127.0.0.1:%d"
 39`, inst.root, inst.port, httpsPort, acmeHTTPPort)
 40	if err := os.WriteFile(inst.config, []byte(cfg), 0o600); err != nil {
 41		t.Fatal(err)
 42	}
 43	inst.proc = exec.Command(inst.gitbayd, "--config", inst.config, "serve")
 44	inst.proc.Stderr = os.Stderr
 45	if err := inst.proc.Start(); err != nil {
 46		t.Fatal(err)
 47	}
 48	t.Cleanup(func() { inst.proc.Process.Kill(); inst.proc.Wait() })
 49
 50	wait := func(port int) {
 51		t.Helper()
 52		deadline := time.Now().Add(10 * time.Second)
 53		for {
 54			conn, err := net.DialTimeout("tcp", fmt.Sprintf("127.0.0.1:%d", port), 200*time.Millisecond)
 55			if err == nil {
 56				conn.Close()
 57				return
 58			}
 59			if time.Now().After(deadline) {
 60				t.Fatalf("port %d never came up", port)
 61			}
 62			time.Sleep(50 * time.Millisecond)
 63		}
 64	}
 65	wait(httpsPort)
 66	wait(acmeHTTPPort)
 67
 68	// The helper listener redirects everything to the canonical HTTPS host.
 69	client := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error {
 70		return http.ErrUseLastResponse
 71	}}
 72	resp, err := client.Get(fmt.Sprintf("http://127.0.0.1:%d/alice/repo/log?x=1", acmeHTTPPort))
 73	if err != nil {
 74		t.Fatal(err)
 75	}
 76	resp.Body.Close()
 77	if resp.StatusCode != http.StatusMovedPermanently ||
 78		resp.Header.Get("Location") != "https://gitbay.example/alice/repo/log?x=1" {
 79		t.Fatalf("redirect: %d %q", resp.StatusCode, resp.Header.Get("Location"))
 80	}
 81
 82	// A TLS handshake reaches autocert, which tries (and fails) to issue —
 83	// the handshake errors, the daemon survives, the listener stays up.
 84	conn, err := tls.DialWithDialer(&net.Dialer{Timeout: 3 * time.Second}, "tcp",
 85		fmt.Sprintf("127.0.0.1:%d", httpsPort),
 86		&tls.Config{ServerName: "gitbay.example", InsecureSkipVerify: true})
 87	if err == nil {
 88		conn.Close()
 89		t.Fatal("handshake unexpectedly succeeded with no CA reachable")
 90	}
 91	wait(httpsPort) // still listening after the failed handshake
 92
 93	// Certificates cache under the server root.
 94	if _, err := os.Stat(filepath.Join(inst.root, "acme")); err != nil {
 95		t.Fatalf("acme cache dir: %v", err)
 96	}
 97
 98	// A host outside the whitelist is refused before any issuance attempt.
 99	conn2, err := tls.DialWithDialer(&net.Dialer{Timeout: 3 * time.Second}, "tcp",
100		fmt.Sprintf("127.0.0.1:%d", httpsPort),
101		&tls.Config{ServerName: "evil.example", InsecureSkipVerify: true})
102	if err == nil {
103		conn2.Close()
104		t.Fatal("handshake for non-whitelisted host succeeded")
105	}
106}