@@ -0,0 +1,472 @@
1+package http
2+
3+import (
4+ "context"
5+ "errors"
6+ "fmt"
7+ "io/ioutil"
8+ "net/http"
9+
10+ "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
11+ . "github.com/onsi/ginkgo"
12+ . "github.com/onsi/ginkgo/extensions/table"
13+ . "github.com/onsi/gomega"
14+)
15+
16+const hello = "Hello World!"
17+
18+var _ = Describe("Server", func() {
19+ handler := http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
20+ rw.Write([]byte(hello))
21+ })
22+
23+ Context("NewServer", func() {
24+ type newServerTableInput struct {
25+ opts Opts
26+ expectedErr error
27+ expectHTTPListener bool
28+ expectTLSListener bool
29+ }
30+
31+ DescribeTable("When creating the new server from the options", func(in *newServerTableInput) {
32+ srv, err := NewServer(in.opts)
33+ if in.expectedErr != nil {
34+ Expect(err).To(MatchError(ContainSubstring(in.expectedErr.Error())))
35+ Expect(srv).To(BeNil())
36+ return
37+ }
38+
39+ Expect(err).ToNot(HaveOccurred())
40+
41+ s, ok := srv.(*server)
42+ Expect(ok).To(BeTrue())
43+
44+ Expect(s.listener != nil).To(Equal(in.expectHTTPListener))
45+ if in.expectHTTPListener {
46+ Expect(s.listener.Close()).To(Succeed())
47+ }
48+ Expect(s.tlsListener != nil).To(Equal(in.expectTLSListener))
49+ if in.expectTLSListener {
50+ Expect(s.tlsListener.Close()).To(Succeed())
51+ }
52+ },
53+ Entry("with a valid http bind address", &newServerTableInput{
54+ opts: Opts{
55+ Handler: handler,
56+ BindAddress: "127.0.0.1:0",
57+ },
58+ expectedErr: nil,
59+ expectHTTPListener: true,
60+ expectTLSListener: false,
61+ }),
62+ Entry("with a valid https bind address, with no TLS config", &newServerTableInput{
63+ opts: Opts{
64+ Handler: handler,
65+ SecureBindAddress: "127.0.0.1:0",
66+ },
67+ expectedErr: errors.New("error setting up TLS listener: no TLS config provided"),
68+ expectHTTPListener: false,
69+ expectTLSListener: false,
70+ }),
71+ Entry("with a valid https bind address, and valid TLS config", &newServerTableInput{
72+ opts: Opts{
73+ Handler: handler,
74+ SecureBindAddress: "127.0.0.1:0",
75+ TLS: &options.TLS{
76+ Key: &keyDataSource,
77+ Cert: &certDataSource,
78+ },
79+ },
80+ expectedErr: nil,
81+ expectHTTPListener: false,
82+ expectTLSListener: true,
83+ }),
84+ Entry("with a both a valid http and valid https bind address, and valid TLS config", &newServerTableInput{
85+ opts: Opts{
86+ Handler: handler,
87+ BindAddress: "127.0.0.1:0",
88+ SecureBindAddress: "127.0.0.1:0",
89+ TLS: &options.TLS{
90+ Key: &keyDataSource,
91+ Cert: &certDataSource,
92+ },
93+ },
94+ expectedErr: nil,
95+ expectHTTPListener: true,
96+ expectTLSListener: true,
97+ }),
98+ Entry("with a \"-\" for the bind address", &newServerTableInput{
99+ opts: Opts{
100+ Handler: handler,
101+ BindAddress: "-",
102+ },
103+ expectedErr: nil,
104+ expectHTTPListener: false,
105+ expectTLSListener: false,
106+ }),
107+ Entry("with a \"-\" for the secure bind address", &newServerTableInput{
108+ opts: Opts{
109+ Handler: handler,
110+ SecureBindAddress: "-",
111+ },
112+ expectedErr: nil,
113+ expectHTTPListener: false,
114+ expectTLSListener: false,
115+ }),
116+ Entry("with an invalid bind address scheme", &newServerTableInput{
117+ opts: Opts{
118+ Handler: handler,
119+ BindAddress: "invalid://127.0.0.1:0",
120+ },
121+ expectedErr: errors.New("error setting up listener: listen (invalid, 127.0.0.1:0) failed: listen invalid: unknown network invalid"),
122+ expectHTTPListener: false,
123+ expectTLSListener: false,
124+ }),
125+ Entry("with an invalid secure bind address scheme", &newServerTableInput{
126+ opts: Opts{
127+ Handler: handler,
128+ SecureBindAddress: "invalid://127.0.0.1:0",
129+ TLS: &options.TLS{
130+ Key: &keyDataSource,
131+ Cert: &certDataSource,
132+ },
133+ },
134+ expectedErr: nil,
135+ expectHTTPListener: false,
136+ expectTLSListener: true,
137+ }),
138+ Entry("with an invalid bind address port", &newServerTableInput{
139+ opts: Opts{
140+ Handler: handler,
141+ BindAddress: "127.0.0.1:a",
142+ },
143+ expectedErr: errors.New("error setting up listener: listen (tcp, 127.0.0.1:a) failed: listen tcp: lookup tcp/a: "),
144+ expectHTTPListener: false,
145+ expectTLSListener: false,
146+ }),
147+ Entry("with an invalid secure bind address port", &newServerTableInput{
148+ opts: Opts{
149+ Handler: handler,
150+ SecureBindAddress: "127.0.0.1:a",
151+ TLS: &options.TLS{
152+ Key: &keyDataSource,
153+ Cert: &certDataSource,
154+ },
155+ },
156+ expectedErr: errors.New("error setting up TLS listener: listen (127.0.0.1:a) failed: listen tcp: lookup tcp/a: "),
157+ expectHTTPListener: false,
158+ expectTLSListener: false,
159+ }),
160+ Entry("with an invalid TLS key", &newServerTableInput{
161+ opts: Opts{
162+ Handler: handler,
163+ SecureBindAddress: "127.0.0.1:0",
164+ TLS: &options.TLS{
165+ Key: &options.SecretSource{
166+ Value: []byte("invalid"),
167+ },
168+ Cert: &certDataSource,
169+ },
170+ },
171+ expectedErr: errors.New("error setting up TLS listener: could not load certificate: could not parse certificate data: tls: failed to find any PEM data in key input"),
172+ expectHTTPListener: false,
173+ expectTLSListener: false,
174+ }),
175+ Entry("with an invalid TLS cert", &newServerTableInput{
176+ opts: Opts{
177+ Handler: handler,
178+ SecureBindAddress: "127.0.0.1:0",
179+ TLS: &options.TLS{
180+ Key: &keyDataSource,
181+ Cert: &options.SecretSource{
182+ Value: []byte("invalid"),
183+ },
184+ },
185+ },
186+ expectedErr: errors.New("error setting up TLS listener: could not load certificate: could not parse certificate data: tls: failed to find any PEM data in certificate input"),
187+ expectHTTPListener: false,
188+ expectTLSListener: false,
189+ }),
190+ Entry("with no TLS key", &newServerTableInput{
191+ opts: Opts{
192+ Handler: handler,
193+ SecureBindAddress: "127.0.0.1:0",
194+ TLS: &options.TLS{
195+ Cert: &certDataSource,
196+ },
197+ },
198+ expectedErr: errors.New("error setting up TLS listener: could not load certificate: could not load key data: no configuration provided"),
199+ expectHTTPListener: false,
200+ expectTLSListener: false,
201+ }),
202+ Entry("with no TLS cert", &newServerTableInput{
203+ opts: Opts{
204+ Handler: handler,
205+ SecureBindAddress: "127.0.0.1:0",
206+ TLS: &options.TLS{
207+ Key: &keyDataSource,
208+ },
209+ },
210+ expectedErr: errors.New("error setting up TLS listener: could not load certificate: could not load cert data: no configuration provided"),
211+ expectHTTPListener: false,
212+ expectTLSListener: false,
213+ }),
214+ Entry("when the bind address is prefixed with the http scheme", &newServerTableInput{
215+ opts: Opts{
216+ Handler: handler,
217+ BindAddress: "http://127.0.0.1:0",
218+ },
219+ expectedErr: nil,
220+ expectHTTPListener: true,
221+ expectTLSListener: false,
222+ }),
223+ Entry("when the secure bind address is prefixed with the https scheme", &newServerTableInput{
224+ opts: Opts{
225+ Handler: handler,
226+ SecureBindAddress: "https://127.0.0.1:0",
227+ TLS: &options.TLS{
228+ Key: &keyDataSource,
229+ Cert: &certDataSource,
230+ },
231+ },
232+ expectedErr: nil,
233+ expectHTTPListener: false,
234+ expectTLSListener: true,
235+ }),
236+ )
237+ })
238+
239+ Context("Start", func() {
240+ var srv Server
241+ var ctx context.Context
242+ var cancel context.CancelFunc
243+
244+ BeforeEach(func() {
245+ ctx, cancel = context.WithCancel(context.Background())
246+ })
247+
248+ AfterEach(func() {
249+ cancel()
250+ })
251+
252+ Context("with an http server", func() {
253+ var listenAddr string
254+
255+ BeforeEach(func() {
256+ var err error
257+ srv, err = NewServer(Opts{
258+ Handler: handler,
259+ BindAddress: "127.0.0.1:0",
260+ })
261+ Expect(err).ToNot(HaveOccurred())
262+
263+ s, ok := srv.(*server)
264+ Expect(ok).To(BeTrue())
265+
266+ listenAddr = fmt.Sprintf("http://%s/", s.listener.Addr().String())
267+ })
268+
269+ It("Starts the server and serves the handler", func() {
270+ go func() {
271+ defer GinkgoRecover()
272+ Expect(srv.Start(ctx)).To(Succeed())
273+ }()
274+
275+ resp, err := client.Get(listenAddr)
276+ Expect(err).ToNot(HaveOccurred())
277+ Expect(resp.StatusCode).To(Equal(http.StatusOK))
278+
279+ body, err := ioutil.ReadAll(resp.Body)
280+ Expect(err).ToNot(HaveOccurred())
281+ Expect(string(body)).To(Equal(hello))
282+ })
283+
284+ It("Stops the server when the context is cancelled", func() {
285+ go func() {
286+ defer GinkgoRecover()
287+ Expect(srv.Start(ctx)).To(Succeed())
288+ }()
289+
290+ _, err := client.Get(listenAddr)
291+ Expect(err).ToNot(HaveOccurred())
292+
293+ cancel()
294+
295+ Eventually(func() error {
296+ _, err := client.Get(listenAddr)
297+ return err
298+ }).Should(HaveOccurred())
299+ })
300+ })
301+
302+ Context("with an https server", func() {
303+ var secureListenAddr string
304+
305+ BeforeEach(func() {
306+ var err error
307+ srv, err = NewServer(Opts{
308+ Handler: handler,
309+ SecureBindAddress: "127.0.0.1:0",
310+ TLS: &options.TLS{
311+ Key: &keyDataSource,
312+ Cert: &certDataSource,
313+ },
314+ })
315+ Expect(err).ToNot(HaveOccurred())
316+
317+ s, ok := srv.(*server)
318+ Expect(ok).To(BeTrue())
319+
320+ secureListenAddr = fmt.Sprintf("https://%s/", s.tlsListener.Addr().String())
321+ })
322+
323+ It("Starts the server and serves the handler", func() {
324+ go func() {
325+ defer GinkgoRecover()
326+ Expect(srv.Start(ctx)).To(Succeed())
327+ }()
328+
329+ resp, err := client.Get(secureListenAddr)
330+ Expect(err).ToNot(HaveOccurred())
331+ Expect(resp.StatusCode).To(Equal(http.StatusOK))
332+
333+ body, err := ioutil.ReadAll(resp.Body)
334+ Expect(err).ToNot(HaveOccurred())
335+ Expect(string(body)).To(Equal(hello))
336+ })
337+
338+ It("Stops the server when the context is cancelled", func() {
339+ go func() {
340+ defer GinkgoRecover()
341+ Expect(srv.Start(ctx)).To(Succeed())
342+ }()
343+
344+ _, err := client.Get(secureListenAddr)
345+ Expect(err).ToNot(HaveOccurred())
346+
347+ cancel()
348+
349+ Eventually(func() error {
350+ _, err := client.Get(secureListenAddr)
351+ return err
352+ }).Should(HaveOccurred())
353+ })
354+
355+ It("Serves the certificate provided", func() {
356+ go func() {
357+ defer GinkgoRecover()
358+ Expect(srv.Start(ctx)).To(Succeed())
359+ }()
360+
361+ resp, err := client.Get(secureListenAddr)
362+ Expect(err).ToNot(HaveOccurred())
363+ Expect(resp.StatusCode).To(Equal(http.StatusOK))
364+
365+ Expect(resp.TLS.VerifiedChains).Should(HaveLen(1))
366+ Expect(resp.TLS.VerifiedChains[0]).Should(HaveLen(1))
367+ Expect(resp.TLS.VerifiedChains[0][0].Raw).Should(Equal(certData))
368+ })
369+ })
370+
371+ Context("with both an http and an https server", func() {
372+ var listenAddr, secureListenAddr string
373+
374+ BeforeEach(func() {
375+ var err error
376+ srv, err = NewServer(Opts{
377+ Handler: handler,
378+ BindAddress: "127.0.0.1:0",
379+ SecureBindAddress: "127.0.0.1:0",
380+ TLS: &options.TLS{
381+ Key: &keyDataSource,
382+ Cert: &certDataSource,
383+ },
384+ })
385+ Expect(err).ToNot(HaveOccurred())
386+
387+ s, ok := srv.(*server)
388+ Expect(ok).To(BeTrue())
389+
390+ listenAddr = fmt.Sprintf("http://%s/", s.listener.Addr().String())
391+ secureListenAddr = fmt.Sprintf("https://%s/", s.tlsListener.Addr().String())
392+ })
393+
394+ It("Starts the server and serves the handler on http", func() {
395+ go func() {
396+ defer GinkgoRecover()
397+ Expect(srv.Start(ctx)).To(Succeed())
398+ }()
399+
400+ resp, err := client.Get(listenAddr)
401+ Expect(err).ToNot(HaveOccurred())
402+ Expect(resp.StatusCode).To(Equal(http.StatusOK))
403+
404+ body, err := ioutil.ReadAll(resp.Body)
405+ Expect(err).ToNot(HaveOccurred())
406+ Expect(string(body)).To(Equal(hello))
407+ })
408+
409+ It("Starts the server and serves the handler on https", func() {
410+ go func() {
411+ defer GinkgoRecover()
412+ Expect(srv.Start(ctx)).To(Succeed())
413+ }()
414+
415+ resp, err := client.Get(secureListenAddr)
416+ Expect(err).ToNot(HaveOccurred())
417+ Expect(resp.StatusCode).To(Equal(http.StatusOK))
418+
419+ body, err := ioutil.ReadAll(resp.Body)
420+ Expect(err).ToNot(HaveOccurred())
421+ Expect(string(body)).To(Equal(hello))
422+ })
423+
424+ It("Stops both servers when the context is cancelled", func() {
425+ go func() {
426+ defer GinkgoRecover()
427+ Expect(srv.Start(ctx)).To(Succeed())
428+ }()
429+
430+ _, err := client.Get(listenAddr)
431+ Expect(err).ToNot(HaveOccurred())
432+ _, err = client.Get(secureListenAddr)
433+ Expect(err).ToNot(HaveOccurred())
434+
435+ cancel()
436+
437+ Eventually(func() error {
438+ _, err := client.Get(listenAddr)
439+ return err
440+ }).Should(HaveOccurred())
441+ Eventually(func() error {
442+ _, err := client.Get(secureListenAddr)
443+ return err
444+ }).Should(HaveOccurred())
445+ })
446+ })
447+ })
448+
449+ Context("getNetworkScheme", func() {
450+ DescribeTable("should return the scheme", func(in, expected string) {
451+ Expect(getNetworkScheme(in)).To(Equal(expected))
452+ },
453+ Entry("with no scheme", "127.0.0.1:0", "tcp"),
454+ Entry("with a tcp scheme", "tcp://127.0.0.1:0", "tcp"),
455+ Entry("with a http scheme", "http://192.168.0.1:1", "tcp"),
456+ Entry("with a unix scheme", "unix://172.168.16.2:2", "unix"),
457+ Entry("with a random scheme", "random://10.10.10.10:10", "random"),
458+ )
459+ })
460+
461+ Context("getListenAddress", func() {
462+ DescribeTable("should remove the scheme", func(in, expected string) {
463+ Expect(getListenAddress(in)).To(Equal(expected))
464+ },
465+ Entry("with no scheme", "127.0.0.1:0", "127.0.0.1:0"),
466+ Entry("with a tcp scheme", "tcp://127.0.0.1:0", "127.0.0.1:0"),
467+ Entry("with a http scheme", "http://192.168.0.1:1", "192.168.0.1:1"),
468+ Entry("with a unix scheme", "unix://172.168.16.2:2", "172.168.16.2:2"),
469+ Entry("with a random scheme", "random://10.10.10.10:10", "10.10.10.10:10"),
470+ )
471+ })
472+})