From 9ab4d8910e73eb1e4214e4a72dd00c9c56e89efb Mon Sep 17 00:00:00 2001 From: sergeyfrolov Date: Fri, 27 Jul 2018 12:29:12 -0400 Subject: [PATCH] Fix h2 tests (#42) Fix tests: start actually using http2 in tests --- acl_test.go | 56 ++++++------ common_test.go | 7 +- forwardproxy_test.go | 182 ++++++++++++++++++++----------------- probe_resist_test.go | 210 +++++++++++++++++++++---------------------- 4 files changed, 240 insertions(+), 215 deletions(-) diff --git a/acl_test.go b/acl_test.go index fe9c832..693a626 100644 --- a/acl_test.go +++ b/acl_test.go @@ -14,9 +14,9 @@ test blacklist refused with correct status func TestWhitelistAllowing(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyWhiteListing.addr, httpTargetVer, + response, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyWhiteListing.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -29,9 +29,9 @@ func TestWhitelistAllowing(t *testing.T) { func TestWhitelistBlocking(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyForwardProxyWhiteListing.addr, httpTargetVer, + response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyForwardProxyWhiteListing.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -41,9 +41,9 @@ func TestWhitelistBlocking(t *testing.T) { } } - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy("google.com:6451", resource, caddyForwardProxyWhiteListing.addr, httpTargetVer, + response, err := getViaProxy("google.com:6451", resource, caddyForwardProxyWhiteListing.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -56,9 +56,9 @@ func TestWhitelistBlocking(t *testing.T) { func TestLocalhostDefaultForbidden(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy("localhost:6451", resource, caddyForwardProxyNoBlacklistOverride.addr, httpTargetVer, + response, err := getViaProxy("localhost:6451", resource, caddyForwardProxyNoBlacklistOverride.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -68,9 +68,9 @@ func TestLocalhostDefaultForbidden(t *testing.T) { } } - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy("127.0.0.1:808", resource, caddyForwardProxyNoBlacklistOverride.addr, httpTargetVer, + response, err := getViaProxy("127.0.0.1:808", resource, caddyForwardProxyNoBlacklistOverride.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -80,9 +80,9 @@ func TestLocalhostDefaultForbidden(t *testing.T) { } } - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy("[::1]:8080", resource, caddyForwardProxyNoBlacklistOverride.addr, httpTargetVer, + response, err := getViaProxy("[::1]:8080", resource, caddyForwardProxyNoBlacklistOverride.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -95,9 +95,9 @@ func TestLocalhostDefaultForbidden(t *testing.T) { func TestLocalNetworksDefaultForbidden(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy("10.0.0.0:80", resource, caddyForwardProxyNoBlacklistOverride.addr, httpTargetVer, + response, err := getViaProxy("10.0.0.0:80", resource, caddyForwardProxyNoBlacklistOverride.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -107,9 +107,9 @@ func TestLocalNetworksDefaultForbidden(t *testing.T) { } } - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy("127.222.34.1:443", resource, caddyForwardProxyNoBlacklistOverride.addr, httpTargetVer, + response, err := getViaProxy("127.222.34.1:443", resource, caddyForwardProxyNoBlacklistOverride.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -119,9 +119,9 @@ func TestLocalNetworksDefaultForbidden(t *testing.T) { } } - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy("172.16.0.1:8080", resource, caddyForwardProxyNoBlacklistOverride.addr, httpTargetVer, + response, err := getViaProxy("172.16.0.1:8080", resource, caddyForwardProxyNoBlacklistOverride.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -131,9 +131,9 @@ func TestLocalNetworksDefaultForbidden(t *testing.T) { } } - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy("192.168.192.168:888", resource, caddyForwardProxyNoBlacklistOverride.addr, httpTargetVer, + response, err := getViaProxy("192.168.192.168:888", resource, caddyForwardProxyNoBlacklistOverride.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -146,9 +146,9 @@ func TestLocalNetworksDefaultForbidden(t *testing.T) { func TestBlacklistBlocking(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(blacklistedDomain, resource, caddyForwardProxyBlackListing.addr, httpTargetVer, + response, err := getViaProxy(blacklistedDomain, resource, caddyForwardProxyBlackListing.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -158,9 +158,9 @@ func TestBlacklistBlocking(t *testing.T) { } } - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(blacklistedIPv4, resource, caddyForwardProxyBlackListing.addr, httpTargetVer, + response, err := getViaProxy(blacklistedIPv4, resource, caddyForwardProxyBlackListing.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -170,9 +170,9 @@ func TestBlacklistBlocking(t *testing.T) { } } - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(blacklistedIPv6, resource, caddyForwardProxyBlackListing.addr, httpTargetVer, + response, err := getViaProxy("["+blacklistedIPv6+"]:80", resource, caddyForwardProxyBlackListing.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) @@ -185,9 +185,9 @@ func TestBlacklistBlocking(t *testing.T) { func TestBlacklistAllowing(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyBlackListing.addr, httpTargetVer, + response, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyBlackListing.addr, httpProxyVer, "", useTls) if err != nil { t.Fatal(err) diff --git a/common_test.go b/common_test.go index 6c90843..1c5fbed 100644 --- a/common_test.go +++ b/common_test.go @@ -36,7 +36,12 @@ Auth/NoAuth Empty/Correct/Wrong -- tries different credentials */ var testResources = []string{"", "/pic.png"} -var testHttpVersions = []string{"HTTP/2.0", "HTTP/1.1"} +var testHttpProxyVersions = []string{"HTTP/2.0", "HTTP/1.1"} +var testHttpTargetVersions = []string{"HTTP/1.1"} +var httpVersionToAlpn = map[string]string{ + "HTTP/1.1": "http/1.1", + "HTTP/2.0": "h2", +} var blacklistedDomain = "google-public-dns-a.google.com" // supposed to ever resolve to one of 2 IP addresses below var blacklistedIPv4 = "8.8.8.8" diff --git a/forwardproxy_test.go b/forwardproxy_test.go index 552b6c9..4a73342 100644 --- a/forwardproxy_test.go +++ b/forwardproxy_test.go @@ -20,6 +20,7 @@ import ( "errors" "fmt" "io" + "io/ioutil" "net" "net/http" "net/url" @@ -27,72 +28,85 @@ import ( "testing" "time" + "github.com/caddyserver/forwardproxy/httpclient" _ "github.com/mholt/caddy/caddyhttp/header" _ "github.com/mholt/caddy/caddyhttp/httpserver" _ "github.com/mholt/caddy/caddyhttp/redirect" _ "github.com/mholt/caddy/caddyhttp/root" + "golang.org/x/net/http2" ) -func dial(proxyAddr string, useTls bool) (net.Conn, error) { +func dial(proxyAddr, httpProxyVer string, useTls bool) (net.Conn, error) { if useTls { - return tls.Dial("tcp", proxyAddr, &tls.Config{InsecureSkipVerify: true}) + return tls.Dial("tcp", proxyAddr, &tls.Config{InsecureSkipVerify: true, + NextProtos: []string{httpVersionToAlpn[httpProxyVer]}}) } else { return net.Dial("tcp", proxyAddr) } } -func getViaProxy(targetHost, resource, proxyAddr, httpTargetVer, proxyCredentials string, useTls bool) (*http.Response, error) { - proxyConn, err := dial(proxyAddr, useTls) +func getViaProxy(targetHost, resource, proxyAddr, httpProxyVer, proxyCredentials string, useTls bool) (*http.Response, error) { + proxyConn, err := dial(proxyAddr, httpProxyVer, useTls) if err != nil { return nil, err } - return getResourceViaProxyConn(proxyConn, targetHost, resource, httpTargetVer, proxyCredentials) + return getResourceViaProxyConn(proxyConn, targetHost, resource, httpProxyVer, proxyCredentials) } // if connect is not successful - that response is returned, otherwise the requested resource func connectAndGetViaProxy(targetHost, resource, proxyAddr, httpTargetVer, proxyCredentials, httpProxyVer string, useTls bool) (*http.Response, error) { - proxyConn, err := dial(proxyAddr, useTls) + proxyConn, err := dial(proxyAddr, httpProxyVer, useTls) if err != nil { return nil, err } - connectRequest := http.Request{Header: make(http.Header)} + req := http.Request{Header: make(http.Header)} if len(proxyCredentials) > 0 { - connectRequest.Header.Set("Proxy-Authorization", proxyCredentials) + req.Header.Set("Proxy-Authorization", proxyCredentials) } - connectRequest.Host = targetHost - connectRequest.URL, err = url.Parse("https://" + connectRequest.Host) + req.Host = targetHost + req.URL, err = url.Parse("https://" + req.Host) if err != nil { return nil, err } - connectRequest.RequestURI = connectRequest.Host - connectRequest.Method = "CONNECT" + req.RequestURI = req.Host + req.Method = "CONNECT" + req.Proto = httpProxyVer + var resp *http.Response switch httpProxyVer { case "HTTP/2.0": - connectRequest.ProtoMajor = 2 - connectRequest.ProtoMinor = 0 + req.ProtoMajor = 2 + req.ProtoMinor = 0 + pr, pw := io.Pipe() + req.Body = ioutil.NopCloser(pr) + t := http2.Transport{} + clientConn, err := t.NewClientConn(proxyConn) + if err != nil { + return nil, err + } + resp, err = clientConn.RoundTrip(&req) + if err != nil { + return resp, err + } + proxyConn = httpclient.NewHttp2Conn(proxyConn, pw, resp.Body) case "HTTP/1.1": - connectRequest.ProtoMajor = 1 - connectRequest.ProtoMinor = 1 + req.ProtoMajor = 1 + req.ProtoMinor = 1 + req.Write(proxyConn) + resp, err = http.ReadResponse(bufio.NewReader(proxyConn), &req) + if err != nil { + return resp, err + } default: - panic("http2ProxyVer: " + httpProxyVer) + panic("proxy ver: " + httpProxyVer) } - connectRequest.Proto = httpProxyVer - if len(proxyCredentials) > 0 { - connectRequest.Header.Set("Proxy-Authorization", proxyCredentials) - } - err = connectRequest.Write(proxyConn) if err != nil { - return nil, err + return resp, err } - connectResponse, err := http.ReadResponse(bufio.NewReader(proxyConn), &connectRequest) - if err != nil { - return connectResponse, err - } - if connectResponse.StatusCode != http.StatusOK { - return connectResponse, err + if resp.StatusCode != http.StatusOK { + return resp, err } return getResourceViaProxyConn(proxyConn, targetHost, resource, httpTargetVer, proxyCredentials) @@ -101,35 +115,39 @@ func connectAndGetViaProxy(targetHost, resource, proxyAddr, httpTargetVer, proxy func getResourceViaProxyConn(proxyConn net.Conn, targetHost, resource, httpTargetVer, proxyCredentials string) (*http.Response, error) { var err error - request := http.Request{Header: make(http.Header)} + req := http.Request{Header: make(http.Header)} if len(proxyCredentials) > 0 { - request.Header.Set("Proxy-Authorization", proxyCredentials) + req.Header.Set("Proxy-Authorization", proxyCredentials) } - request.Host = targetHost - request.URL, err = url.Parse("http://" + request.Host + resource) + req.Host = targetHost + req.URL, err = url.Parse("http://" + req.Host + resource) if err != nil { return nil, err } - request.RequestURI = request.Host + resource - request.Method = "GET" + req.RequestURI = req.Host + resource + req.Method = "GET" + req.Proto = httpTargetVer switch httpTargetVer { case "HTTP/2.0": - request.ProtoMajor = 2 - request.ProtoMinor = 0 + req.ProtoMajor = 2 + req.ProtoMinor = 0 + t := http2.Transport{AllowHTTP: true} + clientConn, err := t.NewClientConn(proxyConn) + if err != nil { + return nil, err + } + return clientConn.RoundTrip(&req) case "HTTP/1.1": - request.ProtoMajor = 1 - request.ProtoMinor = 1 + req.ProtoMajor = 1 + req.ProtoMinor = 1 + t := http.Transport{Dial: func(network, addr string) (net.Conn, error) { + return proxyConn, nil + }} + return t.RoundTrip(&req) default: - panic("http2TargetVer: " + httpTargetVer) + panic("proxy ver: " + httpTargetVer) } - request.Proto = httpTargetVer - - err = request.WriteProxy(proxyConn) - if err != nil { - return nil, err - } - return http.ReadResponse(bufio.NewReader(proxyConn), &request) } // If response is expected: returns nil. @@ -195,9 +213,9 @@ func TestPassthrough(t *testing.T) { func TestGETNoAuth(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyForwardProxy.addr, httpTargetVer, credentialsEmpty, useTls) + response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyForwardProxy.addr, httpProxyVer, credentialsEmpty, useTls) if err != nil { t.Fatal(err) } else if err = responseExpected(response, caddyHTTPTestTarget.contents[resource]); err != nil { @@ -209,9 +227,9 @@ func TestGETNoAuth(t *testing.T) { func TestGETAuthCorrect(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyForwardProxyAuth.addr, httpTargetVer, credentialsCorrect, useTls) + response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyForwardProxyAuth.addr, httpProxyVer, credentialsCorrect, useTls) if err != nil { t.Fatal(err) } else if err = responseExpected(response, caddyHTTPTestTarget.contents[resource]); err != nil { @@ -224,9 +242,9 @@ func TestGETAuthCorrect(t *testing.T) { func TestGETAuthWrong(t *testing.T) { useTls := true for _, wrongCreds := range credentialsWrong { - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyForwardProxyAuth.addr, httpTargetVer, wrongCreds, useTls) + response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyForwardProxyAuth.addr, httpProxyVer, wrongCreds, useTls) if err != nil { t.Fatal(err) } @@ -242,7 +260,7 @@ func TestGETAuthWrong(t *testing.T) { func TestProxySelfGet(t *testing.T) { useTls := true // GETNoAuth to self - for _, httpTargetVer := range testHttpVersions { + for _, httpTargetVer := range testHttpTargetVersions { for _, resource := range testResources { response, err := getViaProxy(caddyForwardProxy.addr, resource, caddyForwardProxy.addr, httpTargetVer, credentialsEmpty, useTls) if err != nil { @@ -254,7 +272,7 @@ func TestProxySelfGet(t *testing.T) { } // GETAuthCorrect to self - for _, httpTargetVer := range testHttpVersions { + for _, httpTargetVer := range testHttpTargetVersions { for _, resource := range testResources { response, err := getViaProxy(caddyForwardProxyAuth.addr, resource, caddyForwardProxyAuth.addr, httpTargetVer, credentialsCorrect, useTls) if err != nil { @@ -272,8 +290,8 @@ func TestProxySelfGet(t *testing.T) { func TestConnectNoAuth(t *testing.T) { useTls := true - for _, httpProxyVer := range testHttpVersions { - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { + for _, httpTargetVer := range testHttpTargetVersions { for _, resource := range testResources { response, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, caddyForwardProxy.addr, httpTargetVer, credentialsEmpty, httpProxyVer, useTls) if err != nil { @@ -288,14 +306,14 @@ func TestConnectNoAuth(t *testing.T) { func TestConnectAuthCorrect(t *testing.T) { useTls := true - for _, httpProxyVer := range testHttpVersions { - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { + for _, httpTargetVer := range testHttpTargetVersions { for _, resource := range testResources { response, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyAuth.addr, httpTargetVer, credentialsCorrect, httpProxyVer, useTls) if err != nil { - t.Fatal(err) + t.Fatal(httpProxyVer, httpTargetVer, err) } else if err = responseExpected(response, caddyTestTarget.contents[resource]); err != nil { - t.Fatal(err) + t.Fatal(httpProxyVer, httpTargetVer, err) } } } @@ -305,8 +323,8 @@ func TestConnectAuthCorrect(t *testing.T) { func TestConnectAuthWrong(t *testing.T) { useTls := true for _, wrongCreds := range credentialsWrong { - for _, httpProxyVer := range testHttpVersions { - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { + for _, httpTargetVer := range testHttpTargetVersions { for _, resource := range testResources { response, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyAuth.addr, httpTargetVer, wrongCreds, httpProxyVer, useTls) if err != nil { @@ -349,15 +367,17 @@ func TestPAC(t *testing.T) { func TestCONNECTViaUpstream(t *testing.T) { useTls := true - for _, httpProxyVer := range testHttpVersions { - for _, httpTargetVer := range testHttpVersions { - for _, resource := range testResources { - response, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, caddyAuthedUpstreamEnter.addr, - httpTargetVer, credentialsUpstreamCorrect, httpProxyVer, useTls) - if err != nil { - t.Fatal(err) - } else if err = responseExpected(response, caddyTestTarget.contents[resource]); err != nil { - t.Fatal(err) + for range make([]byte, 5) { // do several times to test http2 connection reuse + for _, httpProxyVer := range testHttpProxyVersions { + for _, httpTargetVer := range testHttpTargetVersions { + for _, resource := range testResources { + response, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, caddyAuthedUpstreamEnter.addr, + httpTargetVer, credentialsUpstreamCorrect, httpProxyVer, useTls) + if err != nil { + t.Fatal(err) + } else if err = responseExpected(response, caddyTestTarget.contents[resource]); err != nil { + t.Fatal(err) + } } } } @@ -366,14 +386,16 @@ func TestCONNECTViaUpstream(t *testing.T) { func TestGETViaUpstream(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { - for _, resource := range testResources { - response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyAuthedUpstreamEnter.addr, httpTargetVer, - credentialsUpstreamCorrect, useTls) - if err != nil { - t.Fatal(err) - } else if err = responseExpected(response, caddyHTTPTestTarget.contents[resource]); err != nil { - t.Fatal(err) + for range make([]byte, 5) { // do several times to test http2 connection reuse + for _, httpProxyVer := range testHttpProxyVersions { + for _, resource := range testResources { + response, err := getViaProxy(caddyHTTPTestTarget.addr, resource, caddyAuthedUpstreamEnter.addr, httpProxyVer, + credentialsUpstreamCorrect, useTls) + if err != nil { + t.Fatal(err) + } else if err = responseExpected(response, caddyHTTPTestTarget.contents[resource]); err != nil { + t.Fatal(err) + } } } } diff --git a/probe_resist_test.go b/probe_resist_test.go index 40e89d1..4ebf365 100644 --- a/probe_resist_test.go +++ b/probe_resist_test.go @@ -12,9 +12,9 @@ import ( func TestGETAuthCorrectProbeResist(t *testing.T) { useTls := true - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - response, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyProbeResist.addr, httpTargetVer, credentialsCorrect, useTls) + response, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyProbeResist.addr, httpProxyVer, credentialsCorrect, useTls) if err != nil { t.Fatal(err) } else if err = responseExpected(response, caddyTestTarget.contents[resource]); err != nil { @@ -27,25 +27,25 @@ func TestGETAuthCorrectProbeResist(t *testing.T) { func TestGETAuthWrongProbeResist(t *testing.T) { useTls := true for _, wrongCreds := range credentialsWrong { - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { for _, resource := range testResources { - responseProbeResist, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyProbeResist.addr, httpTargetVer, wrongCreds, useTls) + responseProbeResist, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyProbeResist.addr, httpProxyVer, wrongCreds, useTls) if err != nil { t.Fatal(err) } // get response from reference server without forwardproxy and compare them - responseReference, err := getViaProxy(caddyTestTarget.addr, resource, caddyDummyProbeResist.addr, httpTargetVer, wrongCreds, useTls) + responseReference, err := getViaProxy(caddyTestTarget.addr, resource, caddyDummyProbeResist.addr, httpProxyVer, wrongCreds, useTls) if err != nil { t.Fatal(err) } // as a sanity check, get 407 from simple authenticated forwardproxy - responseForwardProxy, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyAuth.addr, httpTargetVer, wrongCreds, useTls) + responseForwardProxy, err := getViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyAuth.addr, httpProxyVer, wrongCreds, useTls) if err != nil { t.Fatal(err) } - if responseProbeResist.StatusCode != http.StatusNotFound { - t.Fatalf("Expected response: 404 StatusNotFound, Got: %d %s\n", - responseProbeResist.StatusCode, responseProbeResist.Status) + if responseProbeResist.StatusCode != responseReference.StatusCode { + t.Fatalf("Expected response: %d, Got: %d\n", + responseReference.StatusCode, responseProbeResist.StatusCode) } if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { t.Fatal(err) @@ -55,23 +55,23 @@ func TestGETAuthWrongProbeResist(t *testing.T) { } } for _, resource := range testResources { - responseProbeResist, err := getViaProxy(caddyForwardProxyProbeResist.addr, resource, caddyForwardProxyProbeResist.addr, httpTargetVer, wrongCreds, useTls) + responseProbeResist, err := getViaProxy(caddyForwardProxyProbeResist.addr, resource, caddyForwardProxyProbeResist.addr, httpProxyVer, wrongCreds, useTls) if err != nil { t.Fatal(err) } // get response from reference server without forwardproxy and compare them - responseReference, err := getViaProxy(caddyDummyProbeResist.addr, resource, caddyDummyProbeResist.addr, httpTargetVer, wrongCreds, useTls) + responseReference, err := getViaProxy(caddyDummyProbeResist.addr, resource, caddyDummyProbeResist.addr, httpProxyVer, wrongCreds, useTls) if err != nil { t.Fatal(err) } // as a sanity check, get 407 from simple authenticated forwardproxy - responseForwardProxy, err := getViaProxy(caddyForwardProxyAuth.addr, resource, caddyForwardProxyAuth.addr, httpTargetVer, wrongCreds, useTls) + responseForwardProxy, err := getViaProxy(caddyForwardProxyAuth.addr, resource, caddyForwardProxyAuth.addr, httpProxyVer, wrongCreds, useTls) if err != nil { t.Fatal(err) } if responseProbeResist.StatusCode != http.StatusOK { - t.Fatalf("Expected response: 200 StatusOK, Got: %d %s\n", - responseProbeResist.StatusCode, responseProbeResist.Status) + t.Fatalf("Expected response: 200 StatusOK, Got: %d\n", + responseProbeResist.StatusCode) } if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { t.Fatal(err) @@ -87,49 +87,45 @@ func TestGETAuthWrongProbeResist(t *testing.T) { // test that responses on http redirect port are same func TestGETAuthWrongProbeResistRedir(t *testing.T) { useTls := false + httpProxyVer := "HTTP/1.1" for _, wrongCreds := range credentialsWrong { - for _, httpTargetVer := range testHttpVersions { - // request test target - for _, resource := range testResources { - responseProbeResist, err := getViaProxy(caddyTestTarget.addr, resource, stripPort(caddyForwardProxyProbeResist.addr)+":"+caddyForwardProxyProbeResist.HTTPRedirectPort, - httpTargetVer, wrongCreds, useTls) - if err != nil { - t.Fatal(err) - } - // get response from reference server without forwardproxy and compare them - responseReference, err := getViaProxy(caddyTestTarget.addr, resource, stripPort(caddyDummyProbeResist.addr)+":"+caddyDummyProbeResist.HTTPRedirectPort, - httpTargetVer, wrongCreds, useTls) - if err != nil { - t.Fatal(err) - } - if responseProbeResist.StatusCode != http.StatusMovedPermanently { - t.Fatalf("Expected response: 301 StatusMovedPermanently, Got: %d %s\n", - responseProbeResist.StatusCode, responseProbeResist.Status) - } - if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { - t.Fatal(err) - } + // request test target + for _, resource := range testResources { + responseProbeResist, rPRerr := getViaProxy(caddyTestTarget.addr, resource, stripPort(caddyForwardProxyProbeResist.addr)+":"+caddyForwardProxyProbeResist.HTTPRedirectPort, + httpProxyVer, wrongCreds, useTls) + // get response from reference server without forwardproxy and compare them + responseReference, rRerr := getViaProxy(caddyTestTarget.addr, resource, stripPort(caddyDummyProbeResist.addr)+":"+caddyDummyProbeResist.HTTPRedirectPort, + httpProxyVer, wrongCreds, useTls) + if (rPRerr == nil && rRerr != nil) || (rPRerr != nil && rRerr == nil) { + t.Fatalf("Reference error: %s. Probe resist error: %s", rRerr, rPRerr) } - // request self - for _, resource := range testResources { - responseProbeResist, err := getViaProxy(caddyForwardProxyProbeResist.addr, resource, stripPort(caddyForwardProxyProbeResist.addr)+":"+caddyForwardProxyProbeResist.HTTPRedirectPort, - httpTargetVer, wrongCreds, useTls) - if err != nil { - t.Fatal(err) - } - // get response from reference server without forwardproxy and compare them - responseReference, err := getViaProxy(caddyDummyProbeResist.addr, resource, stripPort(caddyDummyProbeResist.addr)+":"+caddyDummyProbeResist.HTTPRedirectPort, - httpTargetVer, wrongCreds, useTls) - if err != nil { - t.Fatal(err) - } - if responseProbeResist.StatusCode != http.StatusMovedPermanently { - t.Fatalf("Expected response: 301 StatusMovedPermanently, Got: %d %s\n", - responseProbeResist.StatusCode, responseProbeResist.Status) - } - if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { - t.Fatal(err) - } + if responseProbeResist.StatusCode != responseReference.StatusCode { + t.Fatalf("Expected response: %d, Got: %d\n", + responseReference.StatusCode, responseProbeResist.StatusCode) + } + if err := responsesAreEqual(responseProbeResist, responseReference); err != nil { + t.Fatal(err) + } + } + // request self + for _, resource := range testResources { + responseProbeResist, err := getViaProxy(caddyForwardProxyProbeResist.addr, resource, stripPort(caddyForwardProxyProbeResist.addr)+":"+caddyForwardProxyProbeResist.HTTPRedirectPort, + httpProxyVer, wrongCreds, useTls) + if err != nil { + t.Fatal(err) + } + // get response from reference server without forwardproxy and compare them + responseReference, err := getViaProxy(caddyDummyProbeResist.addr, resource, stripPort(caddyDummyProbeResist.addr)+":"+caddyDummyProbeResist.HTTPRedirectPort, + httpProxyVer, wrongCreds, useTls) + if err != nil { + t.Fatal(err) + } + if responseProbeResist.StatusCode != responseReference.StatusCode { + t.Fatalf("Expected response: %d, Got: %d\n", + responseReference.StatusCode, responseProbeResist.StatusCode) + } + if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { + t.Fatal(err) } } } @@ -137,8 +133,8 @@ func TestGETAuthWrongProbeResistRedir(t *testing.T) { func TestConnectAuthCorrectProbeResist(t *testing.T) { useTls := true - for _, httpProxyVer := range testHttpVersions { - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { + for _, httpTargetVer := range testHttpTargetVersions { for _, resource := range testResources { response, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyProbeResist.addr, httpTargetVer, credentialsCorrect, httpProxyVer, useTls) if err != nil { @@ -154,8 +150,8 @@ func TestConnectAuthCorrectProbeResist(t *testing.T) { func TestConnectAuthWrongProbeResist(t *testing.T) { useTls := true for _, wrongCreds := range credentialsWrong { - for _, httpProxyVer := range testHttpVersions { - for _, httpTargetVer := range testHttpVersions { + for _, httpProxyVer := range testHttpProxyVersions { + for _, httpTargetVer := range testHttpTargetVersions { for _, resource := range testResources { responseProbeResist, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, caddyForwardProxyProbeResist.addr, httpTargetVer, wrongCreds, httpProxyVer, useTls) if err != nil { @@ -171,9 +167,9 @@ func TestConnectAuthWrongProbeResist(t *testing.T) { if err != nil { t.Fatal(err) } - if responseProbeResist.StatusCode != http.StatusNotFound { - t.Fatalf("Expected response: 404 StatusNotFound, Got: %d %s\n", - responseProbeResist.StatusCode, responseProbeResist.Status) + if responseProbeResist.StatusCode != responseReference.StatusCode { + t.Fatalf("Expected response: %d, Got: %d\n", + responseReference.StatusCode, responseProbeResist.StatusCode) } if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { t.Fatal(err) @@ -184,6 +180,9 @@ func TestConnectAuthWrongProbeResist(t *testing.T) { } // request self for _, resource := range testResources { + if httpTargetVer != httpProxyVer { + continue + } responseProbeResist, err := connectAndGetViaProxy(caddyForwardProxyProbeResist.addr, resource, caddyForwardProxyProbeResist.addr, httpTargetVer, wrongCreds, httpProxyVer, useTls) if err != nil { t.Fatal(err) @@ -199,8 +198,8 @@ func TestConnectAuthWrongProbeResist(t *testing.T) { t.Fatal(err) } if responseProbeResist.StatusCode != http.StatusOK { - t.Fatalf("Expected response: 200 StatusOK, Got: %d %s\n", - responseProbeResist.StatusCode, responseProbeResist.Status) + t.Fatalf("Expected response: 200 StatusOK, Got: %d\n", + responseProbeResist.StatusCode) } if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { t.Fatal(err) @@ -217,50 +216,49 @@ func TestConnectAuthWrongProbeResist(t *testing.T) { // test that responses on http redirect port are same func TestConnectAuthWrongProbeResistRedir(t *testing.T) { useTls := false + httpProxyVer := "HTTP/1.1" for _, wrongCreds := range credentialsWrong { - for _, httpProxyVer := range testHttpVersions { - for _, httpTargetVer := range testHttpVersions { - // request test target - for _, resource := range testResources { - responseProbeResist, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, stripPort(caddyForwardProxyProbeResist.addr)+":"+caddyForwardProxyProbeResist.HTTPRedirectPort, - httpTargetVer, wrongCreds, httpProxyVer, useTls) - if err != nil { - t.Fatal(err) - } - // get response from reference server without forwardproxy and compare them - responseReference, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, stripPort(caddyDummyProbeResist.addr)+":"+caddyDummyProbeResist.HTTPRedirectPort, - httpTargetVer, wrongCreds, httpProxyVer, useTls) - if err != nil { - t.Fatal(err) - } - if responseProbeResist.StatusCode != http.StatusMovedPermanently { - t.Fatalf("Expected response: 301 StatusMovedPermanently, Got: %d %s\n", - responseProbeResist.StatusCode, responseProbeResist.Status) - } - if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { - t.Fatal(err) - } + for _, httpTargetVer := range testHttpTargetVersions { + // request test target + for _, resource := range testResources { + responseProbeResist, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, stripPort(caddyForwardProxyProbeResist.addr)+":"+caddyForwardProxyProbeResist.HTTPRedirectPort, + httpTargetVer, wrongCreds, httpProxyVer, useTls) + if err != nil { + t.Fatal(err) } - // request self - for _, resource := range testResources { - responseProbeResist, err := connectAndGetViaProxy(caddyForwardProxyProbeResist.addr, resource, stripPort(caddyForwardProxyProbeResist.addr)+":"+caddyForwardProxyProbeResist.HTTPRedirectPort, - httpTargetVer, wrongCreds, httpProxyVer, useTls) - if err != nil { - t.Fatal(err) - } - // get response from reference server without forwardproxy and compare them - responseReference, err := connectAndGetViaProxy(caddyDummyProbeResist.addr, resource, stripPort(caddyDummyProbeResist.addr)+":"+caddyDummyProbeResist.HTTPRedirectPort, - httpTargetVer, wrongCreds, httpProxyVer, useTls) - if err != nil { - t.Fatal(err) - } - if responseProbeResist.StatusCode != http.StatusMovedPermanently { - t.Fatalf("Expected response: 301 StatusMovedPermanently, Got: %d %s\n", - responseProbeResist.StatusCode, responseProbeResist.Status) - } - if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { - t.Fatal(err) - } + // get response from reference server without forwardproxy and compare them + responseReference, err := connectAndGetViaProxy(caddyTestTarget.addr, resource, stripPort(caddyDummyProbeResist.addr)+":"+caddyDummyProbeResist.HTTPRedirectPort, + httpTargetVer, wrongCreds, httpProxyVer, useTls) + if err != nil { + t.Fatal(err) + } + if responseProbeResist.StatusCode != responseReference.StatusCode { + t.Fatalf("Expected response: %d, Got: %d\n", + responseReference.StatusCode, responseProbeResist.StatusCode) + } + if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { + t.Fatal(err) + } + } + // request self + for _, resource := range testResources { + responseProbeResist, err := connectAndGetViaProxy(caddyForwardProxyProbeResist.addr, resource, stripPort(caddyForwardProxyProbeResist.addr)+":"+caddyForwardProxyProbeResist.HTTPRedirectPort, + httpTargetVer, wrongCreds, httpProxyVer, useTls) + if err != nil { + t.Fatal(err) + } + // get response from reference server without forwardproxy and compare them + responseReference, err := connectAndGetViaProxy(caddyDummyProbeResist.addr, resource, stripPort(caddyDummyProbeResist.addr)+":"+caddyDummyProbeResist.HTTPRedirectPort, + httpTargetVer, wrongCreds, httpProxyVer, useTls) + if err != nil { + t.Fatal(err) + } + if responseProbeResist.StatusCode != responseReference.StatusCode { + t.Fatalf("Expected response: %d, Got: %d\n", + responseReference.StatusCode, responseProbeResist.StatusCode) + } + if err = responsesAreEqual(responseProbeResist, responseReference); err != nil { + t.Fatal(err) } } }