detached 000e12a

test(pki): add TLS handshake integration tests

commit
000e12a7013a05ae4cf01f6c6eba7a80a5957082
author
brice · · 2026-03-29 17:07 UTC
parent
14736d4
signature
GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email
1 file · +120 -0
Unified
UnifiedSplit
A internal/app/pki_integration_test.go +120 -0
@@ -0,0 +1,120 @@
1+package app_test
2+
3+import (
4+ "context"
5+ "crypto/tls"
6+ "crypto/x509"
7+ "net/http"
8+ "testing"
9+ "time"
10+
11+ pkiadapter "github.com/bnema/gordon/internal/adapters/out/pki"
12+ "github.com/bnema/gordon/internal/domain"
13+ pkiusecase "github.com/bnema/gordon/internal/usecase/pki"
14+ "github.com/bnema/zerowrap"
15+ "github.com/stretchr/testify/assert"
16+ "github.com/stretchr/testify/require"
17+)
18+
19+type stubRoutes struct {
20+ routes []domain.Route
21+}
22+
23+func (s *stubRoutes) GetRoutes(_ context.Context) []domain.Route { return s.routes }
24+func (s *stubRoutes) GetExternalRoutes() map[string]string { return nil }
25+
26+func TestTLSHandshake_OnDemandCert(t *testing.T) {
27+ dir := t.TempDir()
28+ log := zerowrap.Default()
29+
30+ ca, err := pkiadapter.NewCA(dir, log)
31+ require.NoError(t, err)
32+
33+ routes := &stubRoutes{routes: []domain.Route{{Domain: "test.local"}}}
34+ ctx, cancel := context.WithCancel(context.Background())
35+ defer cancel()
36+
37+ svc := pkiusecase.NewService(ctx, ca, routes, log)
38+ defer svc.Stop()
39+
40+ // Start a TLS server using the PKI service
41+ tlsCfg := &tls.Config{
42+ MinVersion: tls.VersionTLS12,
43+ GetCertificate: svc.GetCertificate,
44+ }
45+
46+ srv := &http.Server{
47+ Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.Write([]byte("ok")) }),
48+ TLSConfig: tlsCfg,
49+ }
50+
51+ ln, err := tls.Listen("tcp", "127.0.0.1:0", tlsCfg)
52+ require.NoError(t, err)
53+ defer ln.Close()
54+
55+ go srv.Serve(ln)
56+ defer srv.Close()
57+
58+ // Build a client that trusts Gordon's root CA
59+ rootPool := x509.NewCertPool()
60+ rootPool.AppendCertsFromPEM(ca.RootCertificate())
61+
62+ client := &http.Client{
63+ Transport: &http.Transport{
64+ TLSClientConfig: &tls.Config{
65+ RootCAs: rootPool,
66+ ServerName: "test.local",
67+ },
68+ },
69+ Timeout: 5 * time.Second,
70+ }
71+
72+ resp, err := client.Get("https://" + ln.Addr().String() + "/")
73+ require.NoError(t, err)
74+ defer resp.Body.Close()
75+ assert.Equal(t, http.StatusOK, resp.StatusCode)
76+}
77+
78+func TestTLSHandshake_UnknownDomain_Rejected(t *testing.T) {
79+ dir := t.TempDir()
80+ log := zerowrap.Default()
81+
82+ ca, err := pkiadapter.NewCA(dir, log)
83+ require.NoError(t, err)
84+
85+ routes := &stubRoutes{routes: []domain.Route{{Domain: "allowed.local"}}}
86+ ctx, cancel := context.WithCancel(context.Background())
87+ defer cancel()
88+
89+ svc := pkiusecase.NewService(ctx, ca, routes, log)
90+ defer svc.Stop()
91+
92+ tlsCfg := &tls.Config{
93+ MinVersion: tls.VersionTLS12,
94+ GetCertificate: svc.GetCertificate,
95+ }
96+
97+ ln, err := tls.Listen("tcp", "127.0.0.1:0", tlsCfg)
98+ require.NoError(t, err)
99+ defer ln.Close()
100+
101+ srv := &http.Server{Handler: http.NotFoundHandler(), TLSConfig: tlsCfg}
102+ go srv.Serve(ln)
103+ defer srv.Close()
104+
105+ rootPool := x509.NewCertPool()
106+ rootPool.AppendCertsFromPEM(ca.RootCertificate())
107+
108+ client := &http.Client{
109+ Transport: &http.Transport{
110+ TLSClientConfig: &tls.Config{
111+ RootCAs: rootPool,
112+ ServerName: "unknown.local", // not in route table
113+ },
114+ },
115+ Timeout: 5 * time.Second,
116+ }
117+
118+ _, err = client.Get("https://" + ln.Addr().String() + "/")
119+ assert.Error(t, err, "TLS handshake should fail for unknown domain")
120+}
@@ -0,0 +1,120 @@
1+package app_test
2+
3+import (
4+ "context"
5+ "crypto/tls"
6+ "crypto/x509"
7+ "net/http"
8+ "testing"
9+ "time"
10+
11+ pkiadapter "github.com/bnema/gordon/internal/adapters/out/pki"
12+ "github.com/bnema/gordon/internal/domain"
13+ pkiusecase "github.com/bnema/gordon/internal/usecase/pki"
14+ "github.com/bnema/zerowrap"
15+ "github.com/stretchr/testify/assert"
16+ "github.com/stretchr/testify/require"
17+)
18+
19+type stubRoutes struct {
20+ routes []domain.Route
21+}
22+
23+func (s *stubRoutes) GetRoutes(_ context.Context) []domain.Route { return s.routes }
24+func (s *stubRoutes) GetExternalRoutes() map[string]string { return nil }
25+
26+func TestTLSHandshake_OnDemandCert(t *testing.T) {
27+ dir := t.TempDir()
28+ log := zerowrap.Default()
29+
30+ ca, err := pkiadapter.NewCA(dir, log)
31+ require.NoError(t, err)
32+
33+ routes := &stubRoutes{routes: []domain.Route{{Domain: "test.local"}}}
34+ ctx, cancel := context.WithCancel(context.Background())
35+ defer cancel()
36+
37+ svc := pkiusecase.NewService(ctx, ca, routes, log)
38+ defer svc.Stop()
39+
40+ // Start a TLS server using the PKI service
41+ tlsCfg := &tls.Config{
42+ MinVersion: tls.VersionTLS12,
43+ GetCertificate: svc.GetCertificate,
44+ }
45+
46+ srv := &http.Server{
47+ Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.Write([]byte("ok")) }),
48+ TLSConfig: tlsCfg,
49+ }
50+
51+ ln, err := tls.Listen("tcp", "127.0.0.1:0", tlsCfg)
52+ require.NoError(t, err)
53+ defer ln.Close()
54+
55+ go srv.Serve(ln)
56+ defer srv.Close()
57+
58+ // Build a client that trusts Gordon's root CA
59+ rootPool := x509.NewCertPool()
60+ rootPool.AppendCertsFromPEM(ca.RootCertificate())
61+
62+ client := &http.Client{
63+ Transport: &http.Transport{
64+ TLSClientConfig: &tls.Config{
65+ RootCAs: rootPool,
66+ ServerName: "test.local",
67+ },
68+ },
69+ Timeout: 5 * time.Second,
70+ }
71+
72+ resp, err := client.Get("https://" + ln.Addr().String() + "/")
73+ require.NoError(t, err)
74+ defer resp.Body.Close()
75+ assert.Equal(t, http.StatusOK, resp.StatusCode)
76+}
77+
78+func TestTLSHandshake_UnknownDomain_Rejected(t *testing.T) {
79+ dir := t.TempDir()
80+ log := zerowrap.Default()
81+
82+ ca, err := pkiadapter.NewCA(dir, log)
83+ require.NoError(t, err)
84+
85+ routes := &stubRoutes{routes: []domain.Route{{Domain: "allowed.local"}}}
86+ ctx, cancel := context.WithCancel(context.Background())
87+ defer cancel()
88+
89+ svc := pkiusecase.NewService(ctx, ca, routes, log)
90+ defer svc.Stop()
91+
92+ tlsCfg := &tls.Config{
93+ MinVersion: tls.VersionTLS12,
94+ GetCertificate: svc.GetCertificate,
95+ }
96+
97+ ln, err := tls.Listen("tcp", "127.0.0.1:0", tlsCfg)
98+ require.NoError(t, err)
99+ defer ln.Close()
100+
101+ srv := &http.Server{Handler: http.NotFoundHandler(), TLSConfig: tlsCfg}
102+ go srv.Serve(ln)
103+ defer srv.Close()
104+
105+ rootPool := x509.NewCertPool()
106+ rootPool.AppendCertsFromPEM(ca.RootCertificate())
107+
108+ client := &http.Client{
109+ Transport: &http.Transport{
110+ TLSClientConfig: &tls.Config{
111+ RootCAs: rootPool,
112+ ServerName: "unknown.local", // not in route table
113+ },
114+ },
115+ Timeout: 5 * time.Second,
116+ }
117+
118+ _, err = client.Get("https://" + ln.Addr().String() + "/")
119+ assert.Error(t, err, "TLS handshake should fail for unknown domain")
120+}

Keyboard shortcuts

Single-key shortcuts are on. ctrl k and esc work whatever this says.

ctrl k :
go to a section, branch, tag, file or repository
?
this list
j k
move the row cursor down / up
enter
open the row under the cursor; on Files, a directory opens or closes in place
↑ ↓ ← → home end
in the file tree (focus on a row): previous / next row, close / open a directory or go to its parent / first entry, first / last row. They never open a file
l h
on Files: open a directory or a file / close a directory or go up to its parent, then to the parent page. Elsewhere: into the side panel (on a merge request, its files) / back to the content; there j k move between its controls
g g G
first / last row
/
filter the list; on Files, find a file anywhere in the repository (esc clears, enter opens the best match)
b
switch branch or tag
g s g f g c g b g m g i g r g a
tabs: summary, files, commits, branches & tags, merge requests, issues, releases, actions (when available)
g h
home
w
wide mode: use the whole width of the screen, or not (remembered)
y
copy a permalink pinned to the commit
d u x
diff: split / unified / collapse or expand all
e E
diff: the whole file in view / every file, with the lines the hunks hide
n
merge request: next note in the diff
esc
close a dialog, leave a field

Branches 7

Tags 106

↑↓ moveenter openesc close