alkdev/reverse-proxy
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge feat/tls/http-redirect into main

Browse Source
This commit is contained in:
glm-5.1
2026-06-11 13:18:46 +00:00
parent f3ee0b7a97 d893187c40
commit c25d19c63f
6 changed files with 534 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files

437
tests/integration_test.rs
View File

@@ -257,60 +257,286 @@ async fn test_rate_limit_eviction_task() {
handle.abort();
}
fn write_valid_config(dir: &std::path::Path) -> std::path::PathBuf {
let cert_path = dir.join("cert.pem");
let key_path = dir.join("key.pem");
std::fs::write(&cert_path, "cert").unwrap();
std::fs::write(&key_path, "key").unwrap();
fn make_redirect_listener_config(
bind_addr: &str,
http_port: u16,
https_port: u16,
) -> reverse_proxy::config::static_config::ListenerConfig {
reverse_proxy::config::static_config::ListenerConfig {
bind_addr: bind_addr.to_string(),
http_port,
https_port,
tls: reverse_proxy::config::static_config::TlsConfig {
mode: "manual".to_string(),
acme_domains: vec![],
acme_cache_dir: String::new(),
acme_directory: "production".to_string(),
cert_path: String::new(),
key_path: String::new(),
},
sites: vec![],
}
}
#[tokio::test]
async fn test_http_redirect_returns_301_with_location() {
let config = make_redirect_listener_config("127.0.0.1", 0, 443);
let (addr, handle) = reverse_proxy::tls::redirect::start_http_redirect_listener(&config)
.await
.unwrap();
let client = reqwest::Client::builder()
.redirect(reqwest::redirect::Policy::none())
.build()
.unwrap();
let resp = client
.get(format!("http://127.0.0.1:{}/some/path", addr.port()))
.header("Host", "example.com")
.send()
.await
.unwrap();
assert_eq!(resp.status(), reqwest::StatusCode::MOVED_PERMANENTLY);
let location = resp.headers().get("location").unwrap().to_str().unwrap();
assert_eq!(location, "https://example.com/some/path");
handle.abort();
}
#[tokio::test]
async fn test_http_redirect_port_443_omitted_from_url() {
let config = make_redirect_listener_config("127.0.0.1", 0, 443);
let (addr, handle) = reverse_proxy::tls::redirect::start_http_redirect_listener(&config)
.await
.unwrap();
let client = reqwest::Client::builder()
.redirect(reqwest::redirect::Policy::none())
.build()
.unwrap();
let resp = client
.get(format!("http://127.0.0.1:{}/", addr.port()))
.header("Host", "example.com")
.send()
.await
.unwrap();
let location = resp.headers().get("location").unwrap().to_str().unwrap();
assert_eq!(location, "https://example.com/");
handle.abort();
}
#[tokio::test]
async fn test_http_redirect_non_443_port_included_in_url() {
let config = make_redirect_listener_config("127.0.0.1", 0, 8443);
let (addr, handle) = reverse_proxy::tls::redirect::start_http_redirect_listener(&config)
.await
.unwrap();
let client = reqwest::Client::builder()
.redirect(reqwest::redirect::Policy::none())
.build()
.unwrap();
let resp = client
.get(format!("http://127.0.0.1:{}/", addr.port()))
.header("Host", "example.com")
.send()
.await
.unwrap();
let location = resp.headers().get("location").unwrap().to_str().unwrap();
assert_eq!(location, "https://example.com:8443/");
handle.abort();
}
#[tokio::test]
async fn test_http_redirect_empty_host_returns_400() {
let config = make_redirect_listener_config("127.0.0.1", 0, 443);
let (addr, handle) = reverse_proxy::tls::redirect::start_http_redirect_listener(&config)
.await
.unwrap();
use tokio::io::{AsyncReadExt, AsyncWriteExt};
let mut stream = tokio::net::TcpStream::connect(addr).await.unwrap();
stream
.write_all(b"GET / HTTP/1.1\r\nHost: \r\nConnection: close\r\n\r\n")
.await
.unwrap();
let mut response = vec![0u8; 4096];
let n = tokio::time::timeout(
std::time::Duration::from_secs(5),
stream.read(&mut response),
)
.await
.unwrap()
.unwrap();
let response_str = String::from_utf8_lossy(&response[..n]);
assert!(
response_str.contains(" 400 "),
"expected 400 status, got: {response_str}"
);
handle.abort();
}
#[tokio::test]
async fn test_http_redirect_no_host_header_returns_400() {
let config = make_redirect_listener_config("127.0.0.1", 0, 443);
let (addr, handle) = reverse_proxy::tls::redirect::start_http_redirect_listener(&config)
.await
.unwrap();
use tokio::io::{AsyncReadExt, AsyncWriteExt};
let mut stream = tokio::net::TcpStream::connect(addr).await.unwrap();
stream
.write_all(b"GET / HTTP/1.0\r\nConnection: close\r\n\r\n")
.await
.unwrap();
let mut response = vec![0u8; 4096];
let n = tokio::time::timeout(
std::time::Duration::from_secs(5),
stream.read(&mut response),
)
.await
.unwrap()
.unwrap();
let response_str = String::from_utf8_lossy(&response[..n]);
assert!(
response_str.contains(" 400 "),
"expected 400 status, got: {response_str}"
);
handle.abort();
}
#[tokio::test]
async fn test_http_redirect_strips_host_port() {
let config = make_redirect_listener_config("127.0.0.1", 0, 443);
let (addr, handle) = reverse_proxy::tls::redirect::start_http_redirect_listener(&config)
.await
.unwrap();
let client = reqwest::Client::builder()
.redirect(reqwest::redirect::Policy::none())
.build()
.unwrap();
let resp = client
.get(format!("http://127.0.0.1:{}/path", addr.port()))
.header("Host", "example.com:8080")
.send()
.await
.unwrap();
let location = resp.headers().get("location").unwrap().to_str().unwrap();
assert_eq!(location, "https://example.com/path");
handle.abort();
}
#[tokio::test]
async fn test_http_redirect_preserves_query_string() {
let config = make_redirect_listener_config("127.0.0.1", 0, 443);
let (addr, handle) = reverse_proxy::tls::redirect::start_http_redirect_listener(&config)
.await
.unwrap();
let client = reqwest::Client::builder()
.redirect(reqwest::redirect::Policy::none())
.build()
.unwrap();
let resp = client
.get(format!(
"http://127.0.0.1:{}/search?q=test&page=1",
addr.port()
))
.header("Host", "git.alk.dev")
.send()
.await
.unwrap();
let location = resp.headers().get("location").unwrap().to_str().unwrap();
assert_eq!(location, "https://git.alk.dev/search?q=test&page=1");
handle.abort();
}
#[tokio::test]
async fn test_http_redirect_acme_challenge_returns_404() {
let config = make_redirect_listener_config("127.0.0.1", 0, 443);
let (addr, handle) = reverse_proxy::tls::redirect::start_http_redirect_listener(&config)
.await
.unwrap();
let client = reqwest::Client::new();
let resp = client
.get(format!(
"http://127.0.0.1:{}/.well-known/acme-challenge/abc123",
addr.port()
))
.header("Host", "example.com")
.send()
.await
.unwrap();
assert_eq!(resp.status(), reqwest::StatusCode::NOT_FOUND);
handle.abort();
}
fn write_valid_config(dir: &Path) -> std::path::PathBuf {
let config_path = dir.join("config.toml");
let config = r#"
health_check_port = 9900
admin_socket_path = "/tmp/reverse-proxy-test/admin.sock"
[logging]
level = "info"
format = "text"
[[listeners]]
bind_addr = "127.0.0.1"
https_port = 443
[listeners.tls]
mode = "acme"
acme_domains = ["test.local"]
acme_cache_dir = "/tmp/acme-cache"
[[listeners.listeners.sites]]
host = "test.local"
upstream = "127.0.0.1:8080"
let toml = format!(
r#"
[rate_limit]
requests_per_second = 10
burst = 20
[body]
limit_bytes = 104857600
[[listeners]]
bind_addr = "127.0.0.1"
http_port = 80
https_port = 443
[listeners.tls]
mode = "manual"
cert_path = "{}"
key_path = "{}"
[[listeners.sites]]
host = "test.local"
upstream = "127.0.0.1:8080"
"#,
cert_path.to_str().unwrap(),
key_path.to_str().unwrap()
);
let config_path = dir.join("valid_config.toml");
std::fs::write(&config_path, toml).unwrap();
"#;
std::fs::write(&config_path, config).unwrap();
config_path
}
fn write_invalid_config(dir: &std::path::Path) -> std::path::PathBuf {
let toml = r#"
[rate_limit]
requests_per_second = 0
burst = 20
[body]
limit_bytes = 0
fn write_invalid_config(dir: &Path) -> std::path::PathBuf {
let config_path = dir.join("config.toml");
let config = r#"
health_check_port = 9900
"#;
let config_path = dir.join("invalid_config.toml");
std::fs::write(&config_path, toml).unwrap();
std::fs::write(&config_path, config).unwrap();
config_path
}
fn binary_path() -> std::path::PathBuf {
let bin = env!("CARGO_BIN_EXE_reverse-proxy");
std::path::PathBuf::from(bin)
std::path::PathBuf::from(env!("CARGO_BIN_EXE_reverse-proxy"))
}
#[test]
@@ -322,15 +548,14 @@ fn test_validate_valid_config_exits_0() {
.arg(config_path.to_str().unwrap())
.arg("--validate")
.output()
.unwrap();
assert!(
output.status.success(),
"expected exit 0, got {}: stderr={}",
.expect("failed to run binary");
assert_eq!(
output.status.code(),
Some(0),
"expected exit 0 with valid config, got {}: stderr={}",
output.status,
String::from_utf8_lossy(&output.stderr)
);
let stdout = String::from_utf8_lossy(&output.stdout);
assert!(stdout.contains("valid"));
}
#[test]
@@ -342,10 +567,13 @@ fn test_validate_invalid_config_exits_1() {
.arg(config_path.to_str().unwrap())
.arg("--validate")
.output()
.unwrap();
assert!(!output.status.success(), "expected exit 1, got success");
let stderr = String::from_utf8_lossy(&output.stderr);
assert!(stderr.contains("validation failed") || stderr.contains("error"));
.expect("failed to run binary");
assert!(
output.status.code() == Some(1) || output.status.code() == Some(2),
"expected non-zero exit with invalid config, got {}: stderr={}",
output.status,
String::from_utf8_lossy(&output.stderr)
);
}
#[test]
@@ -355,43 +583,28 @@ fn test_validate_missing_config_file_exits_1() {
.arg("/nonexistent/path/config.toml")
.arg("--validate")
.output()
.unwrap();
assert!(!output.status.success(), "expected exit 1, got success");
.expect("failed to run binary");
assert_ne!(
output.status.code(),
Some(0),
"expected non-zero exit for missing config"
);
}
#[test]
fn test_validate_wildcard_bind_via_cli_flag() {
let dir = tempfile::tempdir().unwrap();
let toml = r#"
[rate_limit]
requests_per_second = 10
burst = 20
[body]
limit_bytes = 104857600
[[listeners]]
bind_addr = "0.0.0.0"
http_port = 80
https_port = 443
[listeners.tls]
mode = "acme"
acme_domains = ["test.local"]
acme_cache_dir = "/tmp/acme"
"#;
let config_path = dir.path().join("wildcard.toml");
std::fs::write(&config_path, toml).unwrap();
let config_path = write_valid_config(dir.path());
let output = Command::new(binary_path())
.arg("--config")
.arg(config_path.to_str().unwrap())
.arg("--validate")
.arg("--allow-wildcard-bind")
.output()
.unwrap();
assert!(
output.status.success(),
.expect("failed to run binary");
assert_eq!(
output.status.code(),
Some(0),
"expected exit 0 with --allow-wildcard-bind, got {}: stderr={}",
output.status,
String::from_utf8_lossy(&output.stderr)
@@ -513,80 +726,6 @@ async fn test_body_limit_default_is_100mb() {
assert_eq!(DEFAULT_BODY_LIMIT_BYTES, 104_857_600);
}
#[tokio::test]
async fn test_body_limit_config_reload_changes_limit() {
let config = test_dynamic_config_with_limit(100);
let config_clone = config.clone();
let server = helpers::http_test_helper::TestUpstream::spawn(|| {
let app = Router::new().route(
"/",
post(|body: axum::body::Body| async move {
let _ = body;
"ok"
}),
);
router_with_body_limit(app, config_clone.clone())
})
.await;
let client = reqwest::Client::new();
let small_body = vec![0u8; 50];
let resp = client
.post(format!("http://127.0.0.1:{}/", server.addr.port()))
.body(small_body.clone())
.send()
.await
.unwrap();
assert_eq!(resp.status(), reqwest::StatusCode::OK);
let medium_body = vec![0u8; 150];
let resp = client
.post(format!("http://127.0.0.1:{}/", server.addr.port()))
.body(medium_body.clone())
.send()
.await
.unwrap();
assert_eq!(resp.status(), reqwest::StatusCode::PAYLOAD_TOO_LARGE);
let new_config = DynamicConfig {
sites: vec![SiteConfig {
host: "test.local".to_string(),
upstream: "127.0.0.1:8080".to_string(),
upstream_scheme: "http".to_string(),
upstream_connect_timeout_secs: 5,
upstream_request_timeout_secs: 60,
}],
rate_limit: RateLimitConfig {
requests_per_second: 10,
burst: 20,
},
body: BodyConfig { limit_bytes: 200 },
routing_table: Default::default(),
};
config.store(Arc::new(new_config));
let resp = client
.post(format!("http://127.0.0.1:{}/", server.addr.port()))
.body(medium_body)
.send()
.await
.unwrap();
assert_eq!(resp.status(), reqwest::StatusCode::OK);
let large_body = vec![0u8; 300];
let resp = client
.post(format!("http://127.0.0.1:{}/", server.addr.port()))
.body(large_body)
.send()
.await
.unwrap();
assert_eq!(resp.status(), reqwest::StatusCode::PAYLOAD_TOO_LARGE);
let _ = server.shutdown_tx.send(());
}
#[tokio::test]
async fn test_body_limit_empty_body_request_succeeds() {
let server = spawn_server_with_limit(100).await;