mirror of
https://github.com/caddyserver/caddy.git
synced 2024-12-23 22:27:38 -05:00
e0f1a02c37
All code relating to a caddytls.Config and setting it up from the Caddyfile is still intact; only the certificate management-related code was removed into a separate package. I don't expect this to build in CI successfully; updating dependencies and vendor is coming next. I've also removed the ad-hoc, half-baked storage plugins that we need to finish making first-class Caddy plugins (they were never documented anyway). The new certmagic package has a much better storage interface, and we can finally move toward making a new storage plugin type, but it shouldn't be configurable in the Caddyfile, I think, since it doesn't make sense for a Caddy instance to use more than one storage config... We also have the option of eliminating DNS provider plugins and just shipping all of lego's DNS providers by using a lego package (the caddytls/setup.go file has a comment describing how) -- but it doubles Caddy's binary size by 100% from about 19 MB to around 40 MB...!
110 lines
3.3 KiB
Go
110 lines
3.3 KiB
Go
// Copyright 2015 Light Code Labs, LLC
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package caddytls
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"reflect"
|
|
"testing"
|
|
|
|
"github.com/klauspost/cpuid"
|
|
)
|
|
|
|
func TestConvertTLSConfigProtocolVersions(t *testing.T) {
|
|
// same min and max protocol versions
|
|
config := &Config{
|
|
Enabled: true,
|
|
ProtocolMinVersion: tls.VersionTLS12,
|
|
ProtocolMaxVersion: tls.VersionTLS12,
|
|
}
|
|
err := config.buildStandardTLSConfig()
|
|
if err != nil {
|
|
t.Fatalf("Did not expect an error, but got %v", err)
|
|
}
|
|
if got, want := config.tlsConfig.MinVersion, uint16(tls.VersionTLS12); got != want {
|
|
t.Errorf("Expected min version to be %x, got %x", want, got)
|
|
}
|
|
if got, want := config.tlsConfig.MaxVersion, uint16(tls.VersionTLS12); got != want {
|
|
t.Errorf("Expected max version to be %x, got %x", want, got)
|
|
}
|
|
}
|
|
|
|
func TestConvertTLSConfigPreferServerCipherSuites(t *testing.T) {
|
|
// prefer server cipher suites
|
|
config := Config{Enabled: true, PreferServerCipherSuites: true}
|
|
err := config.buildStandardTLSConfig()
|
|
if err != nil {
|
|
t.Fatalf("Did not expect an error, but got %v", err)
|
|
}
|
|
if got, want := config.tlsConfig.PreferServerCipherSuites, true; got != want {
|
|
t.Errorf("Expected PreferServerCipherSuites==%v but got %v", want, got)
|
|
}
|
|
}
|
|
|
|
func TestMakeTLSConfigTLSEnabledDisabledError(t *testing.T) {
|
|
// verify handling when Enabled is true and false
|
|
configs := []*Config{
|
|
{Enabled: true},
|
|
{Enabled: false},
|
|
}
|
|
_, err := MakeTLSConfig(configs)
|
|
if err == nil {
|
|
t.Fatalf("Expected an error, but got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestConvertTLSConfigCipherSuites(t *testing.T) {
|
|
// ensure cipher suites are unioned and
|
|
// that TLS_FALLBACK_SCSV is prepended
|
|
configs := []*Config{
|
|
{Enabled: true, Ciphers: []uint16{0xc02c, 0xc030}},
|
|
{Enabled: true, Ciphers: []uint16{0xc012, 0xc030, 0xc00a}},
|
|
{Enabled: true, Ciphers: nil},
|
|
}
|
|
|
|
defaultCiphersExpected := getPreferredDefaultCiphers()
|
|
expectedCiphers := [][]uint16{
|
|
{tls.TLS_FALLBACK_SCSV, 0xc02c, 0xc030},
|
|
{tls.TLS_FALLBACK_SCSV, 0xc012, 0xc030, 0xc00a},
|
|
append([]uint16{tls.TLS_FALLBACK_SCSV}, defaultCiphersExpected...),
|
|
}
|
|
|
|
for i, config := range configs {
|
|
err := config.buildStandardTLSConfig()
|
|
if err != nil {
|
|
t.Errorf("Test %d: Expected no error, got: %v", i, err)
|
|
}
|
|
if !reflect.DeepEqual(config.tlsConfig.CipherSuites, expectedCiphers[i]) {
|
|
t.Errorf("Test %d: Expected ciphers %v but got %v",
|
|
i, expectedCiphers[i], config.tlsConfig.CipherSuites)
|
|
}
|
|
|
|
}
|
|
}
|
|
|
|
func TestGetPreferredDefaultCiphers(t *testing.T) {
|
|
expectedCiphers := defaultCiphers
|
|
if !cpuid.CPU.AesNi() {
|
|
expectedCiphers = defaultCiphersNonAESNI
|
|
}
|
|
|
|
// Ensure ordering is correct and ciphers are what we expected.
|
|
result := getPreferredDefaultCiphers()
|
|
for i, actual := range result {
|
|
if actual != expectedCiphers[i] {
|
|
t.Errorf("Expected cipher in position %d to be %0x, got %0x", i, expectedCiphers[i], actual)
|
|
}
|
|
}
|
|
}
|