Skip to content

Commit 769389d

Browse files
javorszkyjavorszky
committed
Add unit tests for sni
1 parent 7d57ed2 commit 769389d

File tree

3 files changed

+134
-13
lines changed

3 files changed

+134
-13
lines changed

‎internal/configs/version2/templates_test.go

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -737,6 +737,15 @@ func TestExecuteVirtualServerTemplateWithJWKSWithToken(t *testing.T) {
737737
if !bytes.Contains(got, []byte("proxy_cache_valid 200 12h;")) {
738738
t.Error("want `proxy_cache_valid 200 12h;` in generated template")
739739
}
740+
741+
if !bytes.Contains(got, []byte("proxy_ssl_server_name on;")) {
742+
t.Error("want `proxy_ssl_server_name on;` in generated template")
743+
}
744+
745+
if !bytes.Contains(got, []byte("proxy_ssl_name sni.idp.spec.example.com;")) {
746+
t.Error("want `proxy_ssl_name sni.idp.spec.example.com;` in generated template")
747+
}
748+
740749
snaps.MatchSnapshot(t, string(got))
741750
t.Log(string(got))
742751
}
@@ -2340,10 +2349,12 @@ var (
23402349
Server: Server{
23412350
JWTAuthList: map[string]*JWTAuth{
23422351
"default/jwt-policy": {
2343-
Key: "default/jwt-policy",
2344-
Realm: "Spec Realm API",
2345-
Token: "$http_token",
2346-
KeyCache: "1h",
2352+
Key: "default/jwt-policy",
2353+
Realm: "Spec Realm API",
2354+
Token: "$http_token",
2355+
KeyCache: "1h",
2356+
JwksSNIEnabled: true,
2357+
JwksSNIName: "sni.idp.spec.example.com",
23472358
JwksURI: JwksURI{
23482359
JwksScheme: "https",
23492360
JwksHost: "idp.spec.example.com",

‎internal/configs/virtualserver_test.go

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5641,9 +5641,11 @@ func TestGenerateVirtualServerConfigJWKSPolicy(t *testing.T) {
56415641
},
56425642
Spec: conf_v1.PolicySpec{
56435643
JWTAuth: &conf_v1.JWTAuth{
5644-
Realm: "Spec Realm API",
5645-
JwksURI: "https://idp.spec.example.com:443/spec-keys",
5646-
KeyCache: "1h",
5644+
Realm: "Spec Realm API",
5645+
JwksURI: "https://idp.spec.example.com:443/spec-keys",
5646+
KeyCache: "1h",
5647+
SNIEnabled: true,
5648+
SNIServerName: "idp.spec.example.com",
56475649
},
56485650
},
56495651
},
@@ -5709,9 +5711,11 @@ func TestGenerateVirtualServerConfigJWKSPolicy(t *testing.T) {
57095711
Server: version2.Server{
57105712
JWTAuthList: map[string]*version2.JWTAuth{
57115713
"default/jwt-policy": {
5712-
Key: "default/jwt-policy",
5713-
Realm: "Spec Realm API",
5714-
KeyCache: "1h",
5714+
Key: "default/jwt-policy",
5715+
Realm: "Spec Realm API",
5716+
KeyCache: "1h",
5717+
JwksSNIEnabled: true,
5718+
JwksSNIName: "idp.spec.example.com",
57155719
JwksURI: version2.JwksURI{
57165720
JwksScheme: "https",
57175721
JwksHost: "idp.spec.example.com",
@@ -5732,9 +5736,11 @@ func TestGenerateVirtualServerConfigJWKSPolicy(t *testing.T) {
57325736
},
57335737
},
57345738
JWTAuth: &version2.JWTAuth{
5735-
Key: "default/jwt-policy",
5736-
Realm: "Spec Realm API",
5737-
KeyCache: "1h",
5739+
Key: "default/jwt-policy",
5740+
Realm: "Spec Realm API",
5741+
KeyCache: "1h",
5742+
JwksSNIName: "idp.spec.example.com",
5743+
JwksSNIEnabled: true,
57385744
JwksURI: version2.JwksURI{
57395745
JwksScheme: "https",
57405746
JwksHost: "idp.spec.example.com",

‎pkg/apis/configuration/validation/policy_test.go

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,33 @@ func TestValidatePolicy_JWTIsNotValidOn(t *testing.T) {
9595
},
9696
},
9797
},
98+
{
99+
name: "SNI server name passed, but SNI not enabled",
100+
policy: &v1.Policy{
101+
Spec: v1.PolicySpec{
102+
JWTAuth: &v1.JWTAuth{
103+
Realm: "My Product API",
104+
JwksURI: "https://myjwksuri.com",
105+
KeyCache: "1h",
106+
SNIServerName: "ipd.org",
107+
},
108+
},
109+
},
110+
},
111+
{
112+
name: "SNI server name passed, SNI enabled, bad SNI server name",
113+
policy: &v1.Policy{
114+
Spec: v1.PolicySpec{
115+
JWTAuth: &v1.JWTAuth{
116+
Realm: "My Product API",
117+
JwksURI: "https://myjwksuri.com",
118+
KeyCache: "1h",
119+
SNIEnabled: true,
120+
SNIServerName: "msql://ipd.org",
121+
},
122+
},
123+
},
124+
},
98125
}
99126

100127
for _, tc := range tt {
@@ -164,6 +191,33 @@ func TestValidatePolicy_IsValidOnJWTPolicy(t *testing.T) {
164191
},
165192
},
166193
},
194+
{
195+
name: "with SNI and without SNI server name",
196+
policy: &v1.Policy{
197+
Spec: v1.PolicySpec{
198+
JWTAuth: &v1.JWTAuth{
199+
Realm: "My Product API",
200+
KeyCache: "1h",
201+
JwksURI: "https://login.mydomain.com/keys",
202+
SNIEnabled: true,
203+
},
204+
},
205+
},
206+
},
207+
{
208+
name: "with SNI and with SNI server name",
209+
policy: &v1.Policy{
210+
Spec: v1.PolicySpec{
211+
JWTAuth: &v1.JWTAuth{
212+
Realm: "My Product API",
213+
KeyCache: "1h",
214+
JwksURI: "https://login.mydomain.com/keys",
215+
SNIEnabled: true,
216+
SNIServerName: "https://example.org",
217+
},
218+
},
219+
},
220+
},
167221
}
168222

169223
for _, tc := range tt {
@@ -787,6 +841,27 @@ func TestValidateJWT_PassesOnValidInput(t *testing.T) {
787841
},
788842
msg: "jwt with jwksURI",
789843
},
844+
{
845+
jwt: &v1.JWTAuth{
846+
Realm: "My Product API",
847+
Token: "$cookie_auth_token",
848+
JwksURI: "https://idp.com/token",
849+
KeyCache: "1h",
850+
SNIEnabled: true,
851+
SNIServerName: "https://ipd.com:9999",
852+
},
853+
msg: "SNI enabled and valid SNI server name",
854+
},
855+
{
856+
jwt: &v1.JWTAuth{
857+
Realm: "My Product API",
858+
Token: "$cookie_auth_token",
859+
JwksURI: "https://idp.com/token",
860+
KeyCache: "1h",
861+
SNIEnabled: true,
862+
},
863+
msg: "SNI enabled and no server name passed",
864+
},
790865
}
791866
for _, test := range tests {
792867
allErrs := validateJWT(test.jwt, field.NewPath("jwt"))
@@ -890,6 +965,35 @@ func TestValidateJWT_FailsOnInvalidInput(t *testing.T) {
890965
},
891966
msg: "invalid JwksURI",
892967
},
968+
{
969+
jwt: &v1.JWTAuth{
970+
Realm: "My Product api",
971+
JwksURI: "https://idp.com/token",
972+
KeyCache: "1h",
973+
SNIEnabled: true,
974+
SNIServerName: "msql://not-\\\\a-valid-sni",
975+
},
976+
msg: "invalid SNI server name",
977+
},
978+
{
979+
jwt: &v1.JWTAuth{
980+
Realm: "My Product api",
981+
JwksURI: "https://idp.com/token",
982+
KeyCache: "1h",
983+
SNIEnabled: false,
984+
SNIServerName: "https://idp.com",
985+
},
986+
msg: "SNI server name passed, SNI not enabled",
987+
},
988+
{
989+
jwt: &v1.JWTAuth{
990+
Realm: "My Product api",
991+
JwksURI: "https://idp.com/token",
992+
KeyCache: "1h",
993+
SNIServerName: "https://idp.com",
994+
},
995+
msg: "SNI server name passed, SNI not passed",
996+
},
893997
}
894998
for _, test := range tests {
895999
test := test

0 commit comments

Comments
 (0)