route-proxy serves a route's internal-name alias, never certifies it

A route now consumed with two hosts when the mesh composed both — the same host under internal-name reaches the same rule as its public name, restoring the convenience a predecessor proxy gave for reaching a service over the VPN without a public TLS round trip (the field composeName now writes, feat/route-carries-internal-alias — this branch depends on that one landing for internal-name to ever be populated; builds and tests clean without it, just serves nothing extra). Never certified: onlyWhatTheMeshSaid used routed(), which answered yes for any host in the table regardless of how it got there. A new eligibleForACME() checks a parallel 'public' set instead — every host reached through a route's own name, never one reached only through its internal-name — so an internal alias is proxied but never given its own failing ACME order. routed() is unchanged and still used for the 404 message, which legitimately wants 'is this host served at all.'
2026-09-25 17:24:13 +02:00
parent 752abaa81d
commit 6da55bdfea
3 changed files with 127 additions and 24 deletions
@@ -28,6 +28,16 @@ func plain(routes map[string]string) map[string][]rule {
 	return out
 }

+// allPublic is every host in a routes map, ACME-eligible — the ordinary case for a test with no
+// internal-name alias of its own to distinguish.
+func allPublic(routes map[string][]rule) map[string]bool {
+	out := map[string]bool{}
+	for host := range routes {
+		out[host] = true
+	}
+	return out
+}
+
 // targetOf is where a host's first matching rule sends a request.
 func targetOf(routes map[string][]rule, host string) string {
 	if rules := routes[host]; len(rules) > 0 {
@@ -39,7 +49,7 @@ func targetOf(routes map[string][]rule, host string) string {
 // A route is a grant: the consumer supplies a target, and where that machine is comes from the
 // mesh rather than from a naming convention the proxy has to know.
 func TestARouteGoesToWhereTheMeshSaysTheConsumerIs(t *testing.T) {
-	routes, err := routesFrom(write(t, `{"contributions":1,"requirement":"route","given":[
+	routes, _, err := routesFrom(write(t, `{"contributions":1,"requirement":"route","given":[
 	  {"from":"app","node":"laptop","at":"laptop.internal","values":{"name":"App.Example","port":8080}}
 	]}`))
 	if err != nil {
@@ -52,10 +62,49 @@ func TestARouteGoesToWhereTheMeshSaysTheConsumerIs(t *testing.T) {
 	}
 }

+// A route with an internal-name alias is reachable under both hostnames, pointed at the same
+// target — the same convenience a predecessor proxy gave for reaching a service over the VPN
+// without a public TLS round trip.
+func TestARouteWithAnInternalNameIsReachableUnderBoth(t *testing.T) {
+	routes, public, err := routesFrom(write(t, `{"given":[
+	  {"from":"app","node":"anchor","at":"anchor.internal",
+	   "values":{"name":"app.example","internal-name":"app.anchor.internal","port":8080}}
+	]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if targetOf(routes, "app.example") != "http://anchor.internal:8080" {
+		t.Fatalf("the public name does not point at the consumer: %v", routes)
+	}
+	if targetOf(routes, "app.anchor.internal") != "http://anchor.internal:8080" {
+		t.Fatalf("the internal alias does not point at the same consumer: %v", routes)
+	}
+	if !public["app.example"] {
+		t.Errorf("the public name is not eligible for a certificate: %v", public)
+	}
+	if public["app.anchor.internal"] {
+		t.Errorf("the internal alias is eligible for a certificate no public CA could ever issue: %v",
+			public)
+	}
+}
+
+// A route with no internal-name composed gets no second host — the ordinary case, unchanged.
+func TestARouteWithNoInternalNameGetsNoAlias(t *testing.T) {
+	routes, _, err := routesFrom(write(t, `{"given":[
+	  {"from":"app","node":"anchor","values":{"name":"app.example","port":8080}}
+	]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(routes) != 1 {
+		t.Fatalf("a route with no internal-name grew a second host: %v", routes)
+	}
+}
+
 // A workload beside the proxy is ordinary, and reaching it over loopback is both correct and the
 // only thing that works when there is no private network.
 func TestAConsumerOnTheProxysOwnMachineIsReachedOverLoopback(t *testing.T) {
-	routes, err := routesFrom(write(t, `{"given":[
+	routes, _, err := routesFrom(write(t, `{"given":[
 	  {"from":"app","node":"anchor","values":{"name":"app.example","port":9000}}
 	]}`))
 	if err != nil {
@@ -68,7 +117,7 @@ func TestAConsumerOnTheProxysOwnMachineIsReachedOverLoopback(t *testing.T) {

 // Skipped rather than served wrongly. A route with no port would proxy to :0.
 func TestAContributionMissingWhatARouteNeedsIsSkipped(t *testing.T) {
-	routes, err := routesFrom(write(t, `{"given":[
+	routes, _, err := routesFrom(write(t, `{"given":[
 	  {"from":"a","node":"n","at":"n.internal","values":{"name":"no-port.example"}},
 	  {"from":"b","node":"n","at":"n.internal","values":{"port":8080}},
 	  {"from":"c","node":"n","at":"n.internal","values":{"name":"fine.example","port":8080}}
@@ -92,7 +141,7 @@ func TestTheProxyReachesTheWorkloadAndNamesWhatItServes(t *testing.T) {
 	host, port, _ := strings.Cut(target, ":")

 	held := newTable()
-	held.set(plain(map[string]string{"app.example": "http://" + host + ":" + port}))
+	held.set(plain(map[string]string{"app.example": "http://" + host + ":" + port}), allPublic(plain(map[string]string{"app.example": "http://" + host + ":" + port})))

 	proxy := httptest.NewServer(handler(held))
 	defer proxy.Close()
@@ -137,11 +186,12 @@ func TestTheProxyReachesTheWorkloadAndNamesWhatItServes(t *testing.T) {
 // nothing fails more visibly than a stale grant, which is exactly why it must not survive.
 func TestWithdrawingARouteStopsServingIt(t *testing.T) {
 	held := newTable()
-	held.set(plain(map[string]string{
+	initial := plain(map[string]string{
 		"going.example":   "http://a.internal:80",
 		"staying.example": "http://b.internal:80",
-	}))
-	held.set(plain(map[string]string{"staying.example": "http://b.internal:80"}))
+	})
+	held.set(initial, allPublic(initial))
+	held.set(plain(map[string]string{"staying.example": "http://b.internal:80"}), allPublic(plain(map[string]string{"staying.example": "http://b.internal:80"})))

 	if _, still := held.find("going.example", "/"); still {
 		t.Fatal("a route whose module was unassigned is still served")
@@ -154,7 +204,7 @@ func TestWithdrawingARouteStopsServingIt(t *testing.T) {
 // A Host header carries a port and the name does not.
 func TestARequestNamingAPortStillFindsItsRoute(t *testing.T) {
 	held := newTable()
-	held.set(plain(map[string]string{"app.example": "http://a.internal:8080"}))
+	held.set(plain(map[string]string{"app.example": "http://a.internal:8080"}), allPublic(plain(map[string]string{"app.example": "http://a.internal:8080"})))
 	if _, found := held.find("app.example:8080", "/"); !found {
 		t.Fatal("a request to app.example:8080 did not find the route for app.example")
 	}
@@ -185,7 +235,7 @@ func TestTheIssuerIsStagingUnlessNamed(t *testing.T) {
 // rate limit — and the proxy would look healthy throughout.
 func TestNoCertificateIsAskedForOnAnUnroutedName(t *testing.T) {
 	held := newTable()
-	held.set(plain(map[string]string{"photos.example": "http://127.0.0.1:8080"}))
+	held.set(plain(map[string]string{"photos.example": "http://127.0.0.1:8080"}), allPublic(plain(map[string]string{"photos.example": "http://127.0.0.1:8080"})))
 	policy := onlyWhatTheMeshSaid(held)

 	if err := policy(context.Background(), "photos.example"); err != nil {
@@ -198,16 +248,39 @@ func TestNoCertificateIsAskedForOnAnUnroutedName(t *testing.T) {
 	}
 }

+// A certificate is asked for on a route's public name, never on its internal-network alias — no
+// public CA can validate a private name, and asking anyway would only spend the account's rate
+// limit on an order that can never succeed.
+func TestNoCertificateIsAskedForOnAnInternalAlias(t *testing.T) {
+	routes, public, err := routesFrom(write(t, `{"given":[
+	  {"from":"app","node":"anchor","at":"anchor.internal",
+	   "values":{"name":"app.example","internal-name":"app.anchor.internal","port":8080}}
+	]}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	held := newTable()
+	held.set(routes, public)
+	policy := onlyWhatTheMeshSaid(held)
+
+	if err := policy(context.Background(), "app.example"); err != nil {
+		t.Errorf("the route's public name was refused a certificate: %v", err)
+	}
+	if err := policy(context.Background(), "app.anchor.internal"); err == nil {
+		t.Error("a certificate was ordered for the internal alias, which no public CA can validate")
+	}
+}
+
 // A route withdrawn stops being certifiable, without the proxy restarting.
 func TestWithdrawingARouteWithdrawsItsCertificate(t *testing.T) {
 	held := newTable()
-	held.set(plain(map[string]string{"photos.example": "http://127.0.0.1:8080"}))
+	held.set(plain(map[string]string{"photos.example": "http://127.0.0.1:8080"}), allPublic(plain(map[string]string{"photos.example": "http://127.0.0.1:8080"})))
 	policy := onlyWhatTheMeshSaid(held)
 	if err := policy(context.Background(), "photos.example"); err != nil {
 		t.Fatal(err)
 	}

-	held.set(nil)
+	held.set(nil, nil)
 	if err := policy(context.Background(), "photos.example"); err == nil {
 		t.Fatal("a withdrawn route can still order certificates, so the policy read a copy taken " +
 			"once rather than what is served now")