2017-07-06 16:28:13 +02:00
package integration
2016-12-12 18:30:31 +01:00
import (
"crypto/tls"
2017-06-27 14:42:12 +02:00
"fmt"
2016-12-12 18:30:31 +01:00
"net/http"
2017-09-13 10:34:04 +02:00
"os"
2016-12-12 18:30:31 +01:00
"time"
2017-05-17 15:22:44 +02:00
"github.com/containous/traefik/integration/try"
2017-06-27 14:42:12 +02:00
"github.com/containous/traefik/testhelpers"
2016-12-12 18:30:31 +01:00
"github.com/go-check/check"
checker "github.com/vdemeester/shakers"
)
// ACME test suites (using libcompose)
type AcmeSuite struct {
BaseSuite
2017-05-17 15:22:44 +02:00
boulderIP string
2016-12-12 18:30:31 +01:00
}
2017-06-19 13:22:41 +02:00
// Acme tests configuration
type AcmeTestCase struct {
onDemand bool
traefikConfFilePath string
domainToCheck string
2016-12-12 18:30:31 +01:00
}
2017-06-27 14:42:12 +02:00
const (
// Domain to check
acmeDomain = "traefik.acme.wtf"
2017-06-19 13:22:41 +02:00
2017-06-27 14:42:12 +02:00
// Wildcard domain to check
wildcardDomain = "*.acme.wtf"
)
2017-06-19 13:22:41 +02:00
2016-12-12 18:30:31 +01:00
func ( s * AcmeSuite ) SetUpSuite ( c * check . C ) {
s . createComposeProject ( c , "boulder" )
s . composeProject . Start ( c )
2017-05-17 15:22:44 +02:00
s . boulderIP = s . composeProject . Container ( c , "boulder" ) . NetworkSettings . IPAddress
2016-12-12 18:30:31 +01:00
// wait for boulder
2017-05-17 15:22:44 +02:00
err := try . GetRequest ( "http://" + s . boulderIP + ":4000/directory" , 120 * time . Second , try . StatusCodeIs ( http . StatusOK ) )
2016-12-12 18:30:31 +01:00
c . Assert ( err , checker . IsNil )
}
func ( s * AcmeSuite ) TearDownSuite ( c * check . C ) {
// shutdown and delete compose project
if s . composeProject != nil {
s . composeProject . Stop ( c )
}
}
2017-06-19 13:22:41 +02:00
// Test OnDemand option with none provided certificate
func ( s * AcmeSuite ) TestOnDemandRetrieveAcmeCertificate ( c * check . C ) {
2017-06-27 14:42:12 +02:00
testCase := AcmeTestCase {
2017-06-19 13:22:41 +02:00
traefikConfFilePath : "fixtures/acme/acme.toml" ,
onDemand : true ,
domainToCheck : acmeDomain }
2017-06-27 14:42:12 +02:00
s . retrieveAcmeCertificate ( c , testCase )
2017-06-19 13:22:41 +02:00
}
// Test OnHostRule option with none provided certificate
func ( s * AcmeSuite ) TestOnHostRuleRetrieveAcmeCertificate ( c * check . C ) {
2017-06-27 14:42:12 +02:00
testCase := AcmeTestCase {
2017-06-19 13:22:41 +02:00
traefikConfFilePath : "fixtures/acme/acme.toml" ,
onDemand : false ,
domainToCheck : acmeDomain }
2017-06-27 14:42:12 +02:00
s . retrieveAcmeCertificate ( c , testCase )
2017-06-19 13:22:41 +02:00
}
// Test OnDemand option with a wildcard provided certificate
func ( s * AcmeSuite ) TestOnDemandRetrieveAcmeCertificateWithWildcard ( c * check . C ) {
2017-06-27 14:42:12 +02:00
testCase := AcmeTestCase {
2017-06-19 13:22:41 +02:00
traefikConfFilePath : "fixtures/acme/acme_provided.toml" ,
onDemand : true ,
domainToCheck : wildcardDomain }
2017-06-27 14:42:12 +02:00
s . retrieveAcmeCertificate ( c , testCase )
2017-06-19 13:22:41 +02:00
}
// Test onHostRule option with a wildcard provided certificate
func ( s * AcmeSuite ) TestOnHostRuleRetrieveAcmeCertificateWithWildcard ( c * check . C ) {
2017-06-27 14:42:12 +02:00
testCase := AcmeTestCase {
2017-06-19 13:22:41 +02:00
traefikConfFilePath : "fixtures/acme/acme_provided.toml" ,
onDemand : false ,
domainToCheck : wildcardDomain }
2017-05-17 15:22:44 +02:00
2017-06-27 14:42:12 +02:00
s . retrieveAcmeCertificate ( c , testCase )
2017-06-19 13:22:41 +02:00
}
// Doing an HTTPS request and test the response certificate
2017-06-27 14:42:12 +02:00
func ( s * AcmeSuite ) retrieveAcmeCertificate ( c * check . C , testCase AcmeTestCase ) {
file := s . adaptFile ( c , testCase . traefikConfFilePath , struct {
2017-06-19 13:22:41 +02:00
BoulderHost string
OnDemand , OnHostRule bool
2017-06-27 14:42:12 +02:00
} {
BoulderHost : s . boulderIP ,
OnDemand : testCase . onDemand ,
OnHostRule : ! testCase . onDemand ,
} )
2017-09-13 10:34:04 +02:00
defer os . Remove ( file )
2017-06-27 14:42:12 +02:00
2017-09-13 10:34:04 +02:00
cmd , display := s . traefikCmd ( withConfigFile ( file ) )
defer display ( c )
2016-12-12 18:30:31 +01:00
err := cmd . Start ( )
c . Assert ( err , checker . IsNil )
defer cmd . Process . Kill ( )
2017-05-17 15:22:44 +02:00
backend := startTestServer ( "9010" , http . StatusOK )
2016-12-12 18:30:31 +01:00
defer backend . Close ( )
tr := & http . Transport {
TLSClientConfig : & tls . Config { InsecureSkipVerify : true } ,
}
client := & http . Client { Transport : tr }
// wait for traefik (generating acme account take some seconds)
2017-05-17 15:22:44 +02:00
err = try . Do ( 90 * time . Second , func ( ) error {
2016-12-12 18:30:31 +01:00
_ , err := client . Get ( "https://127.0.0.1:5001" )
2017-05-17 15:22:44 +02:00
return err
2016-12-12 18:30:31 +01:00
} )
c . Assert ( err , checker . IsNil )
tr = & http . Transport {
TLSClientConfig : & tls . Config {
InsecureSkipVerify : true ,
2017-06-19 13:22:41 +02:00
ServerName : acmeDomain ,
2016-12-12 18:30:31 +01:00
} ,
}
client = & http . Client { Transport : tr }
2017-06-27 14:42:12 +02:00
req := testhelpers . MustNewRequest ( http . MethodGet , "https://127.0.0.1:5001/" , nil )
2017-06-19 13:22:41 +02:00
req . Host = acmeDomain
req . Header . Set ( "Host" , acmeDomain )
2016-12-12 18:30:31 +01:00
req . Header . Set ( "Accept" , "*/*" )
2017-06-19 13:22:41 +02:00
var resp * http . Response
2017-06-27 14:42:12 +02:00
2017-06-19 13:22:41 +02:00
// Retry to send a Request which uses the LE generated certificate
2017-06-27 14:42:12 +02:00
err = try . Do ( 60 * time . Second , func ( ) error {
2017-06-19 13:22:41 +02:00
resp , err = client . Do ( req )
2017-06-27 14:42:12 +02:00
2017-06-19 13:22:41 +02:00
// /!\ If connection is not closed, SSLHandshake will only be done during the first trial /!\
req . Close = true
2017-06-27 14:42:12 +02:00
2017-06-19 13:22:41 +02:00
if err != nil {
return err
}
2017-06-27 14:42:12 +02:00
cn := resp . TLS . PeerCertificates [ 0 ] . Subject . CommonName
if cn != testCase . domainToCheck {
return fmt . Errorf ( "domain %s found in place of %s" , cn , testCase . domainToCheck )
}
2017-06-19 13:22:41 +02:00
return nil
} )
2017-06-27 14:42:12 +02:00
2016-12-12 18:30:31 +01:00
c . Assert ( err , checker . IsNil )
2017-05-17 15:22:44 +02:00
c . Assert ( resp . StatusCode , checker . Equals , http . StatusOK )
2017-06-19 13:22:41 +02:00
// Check Domain into response certificate
2017-06-27 14:42:12 +02:00
c . Assert ( resp . TLS . PeerCertificates [ 0 ] . Subject . CommonName , checker . Equals , testCase . domainToCheck )
2016-12-12 18:30:31 +01:00
}