74 lines
2.7 KiB
Go
74 lines
2.7 KiB
Go
package gateway
|
|
|
|
import (
|
|
"context"
|
|
"crypto/sha256"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"encoding/hex"
|
|
"encoding/pem"
|
|
"net"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strconv"
|
|
"testing"
|
|
|
|
protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
|
|
)
|
|
|
|
func TestNativeApolloManagementUsesSessionScopedMTLS(t *testing.T) {
|
|
serverTLS, clientTLS := testTLS(t)
|
|
server := httptest.NewUnstartedServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
|
|
if request.URL.Path != "/serverinfo" || request.TLS == nil || len(request.TLS.PeerCertificates) != 1 {
|
|
http.Error(response, "mTLS required", http.StatusUnauthorized)
|
|
return
|
|
}
|
|
_, _ = response.Write([]byte("<root><uniqueid>apollo-server</uniqueid></root>"))
|
|
}))
|
|
server.TLS = serverTLS
|
|
server.StartTLS()
|
|
defer server.Close()
|
|
host, portText, err := net.SplitHostPort(server.Listener.Addr().String())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
port, err := strconv.ParseInt(portText, 10, 64)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
pinned := sha256.Sum256(serverTLS.Certificates[0].Certificate[0])
|
|
work := protocol.ProviderSessionWork{
|
|
Version: "1", SessionID: "session-1", GatewayID: "gateway-1", ReconnectSequence: 0,
|
|
ExpiresAt: "2099-01-01T00:00:00Z", ProviderProfile: ProviderProfileApollo,
|
|
ProviderIdentity: "apollo-server#sha256:" + hex.EncodeToString(pinned[:]), PolicyVersionID: "policy-1", ApplicationID: "1", ClientID: "paired-client",
|
|
ManagementHost: host, ManagementPort: port, StreamHost: host, StreamPort: 47984,
|
|
ClientCertificatePem: certificatePEM(t, clientTLS.Certificates[0]),
|
|
ClientPrivateKeyPem: privateKeyPEM(t, clientTLS.Certificates[0]),
|
|
ServerCertificatePem: certificatePEM(t, tls.Certificate{Certificate: [][]byte{serverTLS.Certificates[0].Certificate[1]}}),
|
|
}
|
|
data, err := NewNativeApolloBackend().Management(context.Background(), LaunchRequest{SessionID: "session-1", ProviderProfile: ProviderProfileApollo, ProviderWork: work})
|
|
if err != nil {
|
|
t.Fatalf("Management() error = %v", err)
|
|
}
|
|
if info, err := ParseManagementXML(data); err != nil || info.Identity.UniqueID != "apollo-server" {
|
|
t.Fatalf("ParseManagementXML() = %+v, %v", info, err)
|
|
}
|
|
}
|
|
|
|
func certificatePEM(t *testing.T, certificate tls.Certificate) string {
|
|
t.Helper()
|
|
if len(certificate.Certificate) == 0 {
|
|
t.Fatal("expected certificate")
|
|
}
|
|
return string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certificate.Certificate[0]}))
|
|
}
|
|
|
|
func privateKeyPEM(t *testing.T, certificate tls.Certificate) string {
|
|
t.Helper()
|
|
encoded, err := x509.MarshalPKCS8PrivateKey(certificate.PrivateKey)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: encoded}))
|
|
}
|