jschoubben
dad0a153ff
autocert checks the host policy before the token and answers 403 — the internal authority does this for every public name, so mail.novox.be's challenge died on the internal manager's probe one commit after it stopped dying on the public one's 404. Both shapes of refusal now fall through to routing; a fifth test pins the 403 case with a refusing policy.
110 lines
4.5 KiB
Go
110 lines
4.5 KiB
Go
package main
|
|
|
|
// The challenge path falls through for real. autocert's own HTTPHandler answers 404 itself for a
|
|
// token it does not hold and never consults its fallback on the challenge path — the
|
|
// predecessor's fault, the edge owning /.well-known/acme-challenge outright, rediscovered live
|
|
// when Mailu's renewal died behind this proxy on cutover day (2026-09-26). These tests pin the
|
|
// three behaviours tokenOrRoute exists for.
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"golang.org/x/crypto/acme/autocert"
|
|
)
|
|
|
|
func routedTo(t *testing.T, marker string) http.Handler {
|
|
t.Helper()
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
if _, err := w.Write([]byte(marker)); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestATokenNoAuthorityHoldsIsRoutedNot404d(t *testing.T) {
|
|
m := &autocert.Manager{Prompt: autocert.AcceptTOS, Cache: autocert.DirCache(t.TempDir())}
|
|
h := tokenOrRoute(routedTo(t, "the workload answered"), m)
|
|
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, httptest.NewRequest("GET", "http://mail.example/.well-known/acme-challenge/somebody-elses-token", nil))
|
|
|
|
if rec.Code != http.StatusOK || rec.Body.String() != "the workload answered" {
|
|
t.Fatalf("a token no authority holds must reach plain routing; got %d %q", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestATokenAManagerHoldsIsAnsweredByIt(t *testing.T) {
|
|
// autocert reads a token it does not have in memory from its cache, under "<token>+http-01" —
|
|
// which is also how a token would survive the manager restarting mid-issuance.
|
|
dir := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(dir, "held-token+http-01"), []byte("the-key-authorization"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
m := &autocert.Manager{Prompt: autocert.AcceptTOS, Cache: autocert.DirCache(dir)}
|
|
h := tokenOrRoute(routedTo(t, "must not be reached"), m)
|
|
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, httptest.NewRequest("GET", "http://mail.example/.well-known/acme-challenge/held-token", nil))
|
|
|
|
if rec.Code != http.StatusOK || rec.Body.String() != "the-key-authorization" {
|
|
t.Fatalf("the manager holding a token answers it; got %d %q", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestASecondAuthorityIsProbedBeforeRouting(t *testing.T) {
|
|
first := &autocert.Manager{Prompt: autocert.AcceptTOS, Cache: autocert.DirCache(t.TempDir())}
|
|
dir := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(dir, "internal-token+http-01"), []byte("internal-key"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
second := &autocert.Manager{Prompt: autocert.AcceptTOS, Cache: autocert.DirCache(dir)}
|
|
h := tokenOrRoute(routedTo(t, "must not be reached"), first, second)
|
|
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, httptest.NewRequest("GET", "http://git.internal/.well-known/acme-challenge/internal-token", nil))
|
|
|
|
if rec.Code != http.StatusOK || rec.Body.String() != "internal-key" {
|
|
t.Fatalf("the second authority's token is found by probing past the first; got %d %q", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAnAuthorityWhosePolicyRefusesTheNameIsProbedPast(t *testing.T) {
|
|
// autocert checks the host policy before the token and answers 403 — the internal authority
|
|
// does this for every public name. A policy refusal is as much "not mine" as a missing token:
|
|
// the request must still reach plain routing, where the workload's own ACME client answers.
|
|
refusing := &autocert.Manager{
|
|
Prompt: autocert.AcceptTOS,
|
|
Cache: autocert.DirCache(t.TempDir()),
|
|
HostPolicy: func(ctx context.Context, host string) error {
|
|
return fmt.Errorf("no internal-only route for %q in this mesh", host)
|
|
},
|
|
}
|
|
h := tokenOrRoute(routedTo(t, "the workload answered"), refusing)
|
|
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, httptest.NewRequest("GET", "http://mail.example/.well-known/acme-challenge/mailus-token", nil))
|
|
|
|
if rec.Code != http.StatusOK || rec.Body.String() != "the workload answered" {
|
|
t.Fatalf("a policy refusal must fall through to routing; got %d %q", rec.Code, rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestAnOrdinaryPathNeverTouchesTheChallengeMachinery(t *testing.T) {
|
|
m := &autocert.Manager{Prompt: autocert.AcceptTOS, Cache: autocert.DirCache(t.TempDir())}
|
|
h := tokenOrRoute(routedTo(t, "routed"), m)
|
|
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, httptest.NewRequest("GET", "http://site.example/index.html", nil))
|
|
|
|
if rec.Code != http.StatusOK || rec.Body.String() != "routed" {
|
|
t.Fatalf("an ordinary path goes straight to routing; got %d %q", rec.Code, rec.Body.String())
|
|
}
|
|
}
|