mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
29a900226d
* add new directive in the global scope `certificates_directory` which is used to bulk load certs and trust them in Authelia * this is in ADDITION to system certs and are trusted by both LDAP and SMTP * added a shared TLSConfig struct to be used by both SMTP and LDAP, and anything else in the future that requires tuning the TLS * remove usage of deprecated LDAP funcs Dial and DialTLS in favor of DialURL which is also easier to use * use the server name from LDAP URL or SMTP host when validating the certificate unless otherwise defined in the TLS section * added temporary translations from the old names to the new ones for all deprecated options * added docs * updated example configuration * final deprecations to be done in 4.28.0 * doc updates * fix misc linting issues * uniform deprecation notices for ease of final removal * added additional tests covering previously uncovered areas and the new configuration options * add non-fatal to certificate loading when system certs could not be loaded * adjust timeout of Suite ShortTimeouts * add warnings pusher for the StructValidator * make the schema suites uninform * utilize the warnings in the StructValidator * fix test suite usage for skip_verify * extract LDAP filter parsing into it's own function to make it possible to test * test LDAP filter parsing * update ErrorContainer interface * add tests to the StructValidator * add NewTLSConfig test * move baseDN for users/groups into parsed values * add tests to cover many of the outstanding areas in LDAP * add explicit deferred LDAP conn close to UpdatePassword * add some basic testing to SMTP notifier * suggestions from code review
135 lines
4.4 KiB
Go
135 lines
4.4 KiB
Go
package utils
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/authelia/authelia/internal/configuration/schema"
|
|
)
|
|
|
|
func TestShouldSetupDefaultTLSMinVersionOnErr(t *testing.T) {
|
|
schemaTLSConfig := &schema.TLSConfig{
|
|
MinimumVersion: "NotAVersion",
|
|
ServerName: "golang.org",
|
|
SkipVerify: true,
|
|
}
|
|
|
|
tlsConfig := NewTLSConfig(schemaTLSConfig, tls.VersionTLS12, nil)
|
|
|
|
assert.Equal(t, uint16(tls.VersionTLS12), tlsConfig.MinVersion)
|
|
assert.Equal(t, "golang.org", tlsConfig.ServerName)
|
|
assert.True(t, tlsConfig.InsecureSkipVerify)
|
|
}
|
|
|
|
func TestShouldReturnCorrectTLSVersions(t *testing.T) {
|
|
tls13 := uint16(tls.VersionTLS13)
|
|
tls12 := uint16(tls.VersionTLS12)
|
|
tls11 := uint16(tls.VersionTLS11)
|
|
tls10 := uint16(tls.VersionTLS10)
|
|
|
|
version, err := TLSStringToTLSConfigVersion(TLS13)
|
|
assert.Equal(t, tls13, version)
|
|
assert.NoError(t, err)
|
|
|
|
version, err = TLSStringToTLSConfigVersion("TLS" + TLS13)
|
|
assert.Equal(t, tls13, version)
|
|
assert.NoError(t, err)
|
|
|
|
version, err = TLSStringToTLSConfigVersion(TLS12)
|
|
assert.Equal(t, tls12, version)
|
|
assert.NoError(t, err)
|
|
|
|
version, err = TLSStringToTLSConfigVersion("TLS" + TLS12)
|
|
assert.Equal(t, tls12, version)
|
|
assert.NoError(t, err)
|
|
|
|
version, err = TLSStringToTLSConfigVersion(TLS11)
|
|
assert.Equal(t, tls11, version)
|
|
assert.NoError(t, err)
|
|
|
|
version, err = TLSStringToTLSConfigVersion("TLS" + TLS11)
|
|
assert.Equal(t, tls11, version)
|
|
assert.NoError(t, err)
|
|
|
|
version, err = TLSStringToTLSConfigVersion(TLS10)
|
|
assert.Equal(t, tls10, version)
|
|
assert.NoError(t, err)
|
|
|
|
version, err = TLSStringToTLSConfigVersion("TLS" + TLS10)
|
|
assert.Equal(t, tls10, version)
|
|
assert.NoError(t, err)
|
|
}
|
|
|
|
func TestShouldReturnZeroAndErrorOnInvalidTLSVersions(t *testing.T) {
|
|
version, err := TLSStringToTLSConfigVersion("TLS1.4")
|
|
assert.Error(t, err)
|
|
assert.Equal(t, uint16(0), version)
|
|
assert.EqualError(t, err, "supplied TLS version isn't supported")
|
|
|
|
version, err = TLSStringToTLSConfigVersion("SSL3.0")
|
|
assert.Error(t, err)
|
|
assert.Equal(t, uint16(0), version)
|
|
assert.EqualError(t, err, "supplied TLS version isn't supported")
|
|
}
|
|
|
|
func TestShouldReturnErrWhenX509DirectoryNotExist(t *testing.T) {
|
|
pool, errs, nonFatalErrs := NewX509CertPool("/tmp/asdfzyxabc123/not/a/real/dir", nil)
|
|
assert.NotNil(t, pool)
|
|
assert.Len(t, nonFatalErrs, 0)
|
|
require.Len(t, errs, 1)
|
|
assert.EqualError(t, errs[0], "could not read certificates from directory open /tmp/asdfzyxabc123/not/a/real/dir: no such file or directory")
|
|
}
|
|
|
|
func TestShouldNotReturnErrWhenX509DirectoryExist(t *testing.T) {
|
|
pool, errs, nonFatalErrs := NewX509CertPool("/tmp", nil)
|
|
assert.NotNil(t, pool)
|
|
assert.Len(t, nonFatalErrs, 0)
|
|
assert.Len(t, errs, 0)
|
|
}
|
|
|
|
func TestShouldRaiseNonFatalErrWhenNotifierTrustedCertConfigured(t *testing.T) {
|
|
config := &schema.Configuration{
|
|
Notifier: &schema.NotifierConfiguration{
|
|
SMTP: &schema.SMTPNotifierConfiguration{
|
|
TrustedCert: "../suites/common/ssl/cert.pem",
|
|
},
|
|
},
|
|
}
|
|
|
|
pool, errs, nonFatalErrs := NewX509CertPool("/tmp", config)
|
|
assert.NotNil(t, pool)
|
|
require.Len(t, nonFatalErrs, 1)
|
|
assert.Len(t, errs, 0)
|
|
|
|
assert.EqualError(t, nonFatalErrs[0], "defining the trusted cert in the SMTP notifier is deprecated and will be removed in 4.28.0, please use the global certificates_directory instead")
|
|
}
|
|
|
|
func TestShouldRaiseErrAndNonFatalErrWhenNotifierTrustedCertConfiguredAndNotExist(t *testing.T) {
|
|
config := &schema.Configuration{
|
|
Notifier: &schema.NotifierConfiguration{
|
|
SMTP: &schema.SMTPNotifierConfiguration{
|
|
TrustedCert: "/tmp/asdfzyxabc123/not/a/real/cert.pem",
|
|
},
|
|
},
|
|
}
|
|
|
|
pool, errs, nonFatalErrs := NewX509CertPool("/tmp", config)
|
|
assert.NotNil(t, pool)
|
|
require.Len(t, nonFatalErrs, 1)
|
|
require.Len(t, errs, 1)
|
|
|
|
assert.EqualError(t, errs[0], "could not import legacy SMTP trusted_cert (see the new certificates_directory option) certificate /tmp/asdfzyxabc123/not/a/real/cert.pem (file does not exist)")
|
|
assert.EqualError(t, nonFatalErrs[0], "defining the trusted cert in the SMTP notifier is deprecated and will be removed in 4.28.0, please use the global certificates_directory instead")
|
|
}
|
|
|
|
func TestShouldReadCertsFromDirectoryButNotKeys(t *testing.T) {
|
|
pool, errs, nonFatalErrs := NewX509CertPool("../suites/common/ssl/", nil)
|
|
assert.NotNil(t, pool)
|
|
require.Len(t, errs, 1)
|
|
assert.Len(t, nonFatalErrs, 0)
|
|
assert.EqualError(t, errs[0], "could not import certificate key.pem")
|
|
}
|