Add test for fallback certificate in customcert core tests

tests/core/customcert/docker-compose.test.yml

@@ -6,8 +6,9 @@ services:
     environment:
       PYTHONUNBUFFERED: "1"
       USE_CUSTOM_SSL: "no"
+      CUSTOM_SSL_CERT: "/certs/certificate.pem"
     extra_hosts:
-      - "www.example.com:192.168.0.2"
+      - "app1.example.com:192.168.0.2"
     networks:
       bw-services:
         ipv4_address: 192.168.0.3

tests/core/customcert/docker-compose.yml

@@ -2,13 +2,17 @@ version: "3.5"
 
 services:
   bw:
-    image: bunkerity/bunkerweb:1.5.5
-    pull_policy: never
+    # image: bunkerity/bunkerweb:1.5.5
+    # pull_policy: never
+    build:
+      context: ../../..
+      dockerfile: src/bw/Dockerfile
     labels:
       - "bunkerweb.INSTANCE=yes"
     volumes:
       - ./index.html:/var/www/html/index.html
     environment:
+      SERVER_NAME: "app1.example.com"
       API_WHITELIST_IP: "127.0.0.0/8 10.20.30.0/24 192.168.0.3"
       HTTP_PORT: "80"
       HTTPS_PORT: "443"
@@ -36,8 +40,11 @@ services:
         ipv4_address: 192.168.0.2
 
   bw-scheduler:
-    image: bunkerity/bunkerweb-scheduler:1.5.5
-    pull_policy: never
+    # image: bunkerity/bunkerweb-scheduler:1.5.5
+    # pull_policy: never
+    build:
+      context: ../../..
+      dockerfile: src/scheduler/Dockerfile
     depends_on:
       - bw
       - bw-docker

tests/core/customcert/init/entrypoint.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
-echo "ℹ️ Generating certificate for www.example.com ..."
-openssl req -nodes -x509 -newkey rsa:4096 -keyout /certs/privatekey.key -out /certs/certificate.pem -days 365 -subj /CN=www.example.com/
+echo "ℹ️ Generating certificate for app1.example.com ..."
+openssl req -nodes -x509 -newkey rsa:4096 -keyout /certs/privatekey.key -out /certs/certificate.pem -days 365 -subj /CN=app1.example.com/
 
 chown -R root:101 /certs
 chmod -R 777 /certs

tests/core/customcert/main.py

@@ -1,5 +1,9 @@
 from contextlib import suppress
+from cryptography import x509
+from cryptography.hazmat.backends import default_backend
 from os import getenv
+from socket import create_connection
+from ssl import CERT_NONE, DER_cert_to_PEM_cert, create_default_context
 from requests import RequestException, get
 from traceback import format_exc
 from time import sleep
@@ -9,7 +13,7 @@ try:
     retries = 0
     while not ready:
         with suppress(RequestException):
-            resp = get("http://www.example.com/ready", headers={"Host": "www.example.com"}, verify=False, allow_redirects=True)
+            resp = get("http://app1.example.com/ready", headers={"Host": "app1.example.com"}, verify=False, allow_redirects=True)
             status_code = resp.status_code
             text = resp.text
 
@@ -28,14 +32,16 @@ try:
             sleep(5)
 
     use_custom_ssl = getenv("USE_CUSTOM_SSL", "no") == "yes"
+    fallback = not bool(getenv("CUSTOM_SSL_CERT", False))
 
     print(
-        "ℹ️ Sending a request to http://www.example.com ...",
+        "ℹ️ Sending a request to http://app1.example.com ...",
         flush=True,
     )
 
     try:
-        get("http://www.example.com", headers={"Host": "www.example.com"})
+        req = get("http://app1.example.com", headers={"Host": "app1.example.com"})
+        req.raise_for_status()
     except RequestException:
         if not use_custom_ssl:
             print(
@@ -49,20 +55,48 @@ try:
         exit(0)
 
     print(
-        "ℹ️ Sending a request to https://www.example.com ...",
+        "ℹ️ Sending a request to https://app1.example.com ...",
         flush=True,
     )
 
     try:
-        get("https://www.example.com", headers={"Host": "www.example.com"}, verify=False)
-    except RequestException:
+        req = get("https://app1.example.com", headers={"Host": "app1.example.com"}, verify=False)
+        req.raise_for_status()
+    except RequestException as e:
         print(
-            "❌ The request failed even though the Custom Cert is activated, exiting ...",
+            f"❌ The request failed even though the Custom Cert is activated:\n{e}\n exiting ...",
             flush=True,
         )
         exit(1)
 
-    print("✅ The Custom Cert is activated, as expected ...", flush=True)
+    sleep(1)
+
+    context = create_default_context()
+    context.check_hostname = False
+    context.verify_mode = CERT_NONE
+    with create_connection(("app1.example.com", 443)) as sock:
+        with context.wrap_socket(sock, server_hostname="app1.example.com") as ssock:
+            # Retrieve the SSL certificate
+            pem_data = DER_cert_to_PEM_cert(ssock.getpeercert(True))
+
+    # Parse the PEM certificate
+    certificate = x509.load_pem_x509_certificate(pem_data.encode(), default_backend())
+
+    common_name = certificate.subject.get_attributes_for_oid(x509.oid.NameOID.COMMON_NAME)[0].value
+    if fallback and common_name != "www.example.org":
+        print(
+            f"❌ The Custom Cert is activated and the Common Name (CN) is not www.example.org (fallback one) but {common_name}, exiting ...",
+            flush=True,
+        )
+        exit(1)
+    elif not fallback and common_name != "app1.example.com":
+        print(
+            f"❌ The Custom Cert is activated and the Common Name (CN) is not app1.example.com but {common_name}, exiting ...",
+            flush=True,
+        )
+        exit(1)
+
+    print("✅ The Custom Cert is activated and the Common Name (CN) is the right one, as expected ...", flush=True)
 except SystemExit as e:
     exit(e.code)
 except:

tests/core/customcert/requirements.in

@@ -1,2 +1,3 @@
+cryptography==41.0.7
 requests==2.31.0
 selenium==4.16.0

tests/core/customcert/requirements.txt

@@ -16,6 +16,60 @@ certifi==2023.11.17 \
     # via
     #   requests
     #   selenium
+cffi==1.16.0 \
+    --hash=sha256:0c9ef6ff37e974b73c25eecc13952c55bceed9112be2d9d938ded8e856138bcc \
+    --hash=sha256:131fd094d1065b19540c3d72594260f118b231090295d8c34e19a7bbcf2e860a \
+    --hash=sha256:1b8ebc27c014c59692bb2664c7d13ce7a6e9a629be20e54e7271fa696ff2b417 \
+    --hash=sha256:2c56b361916f390cd758a57f2e16233eb4f64bcbeee88a4881ea90fca14dc6ab \
+    --hash=sha256:2d92b25dbf6cae33f65005baf472d2c245c050b1ce709cc4588cdcdd5495b520 \
+    --hash=sha256:31d13b0f99e0836b7ff893d37af07366ebc90b678b6664c955b54561fc36ef36 \
+    --hash=sha256:32c68ef735dbe5857c810328cb2481e24722a59a2003018885514d4c09af9743 \
+    --hash=sha256:3686dffb02459559c74dd3d81748269ffb0eb027c39a6fc99502de37d501faa8 \
+    --hash=sha256:582215a0e9adbe0e379761260553ba11c58943e4bbe9c36430c4ca6ac74b15ed \
+    --hash=sha256:5b50bf3f55561dac5438f8e70bfcdfd74543fd60df5fa5f62d94e5867deca684 \
+    --hash=sha256:5bf44d66cdf9e893637896c7faa22298baebcd18d1ddb6d2626a6e39793a1d56 \
+    --hash=sha256:6602bc8dc6f3a9e02b6c22c4fc1e47aa50f8f8e6d3f78a5e16ac33ef5fefa324 \
+    --hash=sha256:673739cb539f8cdaa07d92d02efa93c9ccf87e345b9a0b556e3ecc666718468d \
+    --hash=sha256:68678abf380b42ce21a5f2abde8efee05c114c2fdb2e9eef2efdb0257fba1235 \
+    --hash=sha256:68e7c44931cc171c54ccb702482e9fc723192e88d25a0e133edd7aff8fcd1f6e \
+    --hash=sha256:6b3d6606d369fc1da4fd8c357d026317fbb9c9b75d36dc16e90e84c26854b088 \
+    --hash=sha256:748dcd1e3d3d7cd5443ef03ce8685043294ad6bd7c02a38d1bd367cfd968e000 \
+    --hash=sha256:7651c50c8c5ef7bdb41108b7b8c5a83013bfaa8a935590c5d74627c047a583c7 \
+    --hash=sha256:7b78010e7b97fef4bee1e896df8a4bbb6712b7f05b7ef630f9d1da00f6444d2e \
+    --hash=sha256:7e61e3e4fa664a8588aa25c883eab612a188c725755afff6289454d6362b9673 \
+    --hash=sha256:80876338e19c951fdfed6198e70bc88f1c9758b94578d5a7c4c91a87af3cf31c \
+    --hash=sha256:8895613bcc094d4a1b2dbe179d88d7fb4a15cee43c052e8885783fac397d91fe \
+    --hash=sha256:88e2b3c14bdb32e440be531ade29d3c50a1a59cd4e51b1dd8b0865c54ea5d2e2 \
+    --hash=sha256:8f8e709127c6c77446a8c0a8c8bf3c8ee706a06cd44b1e827c3e6a2ee6b8c098 \
+    --hash=sha256:9cb4a35b3642fc5c005a6755a5d17c6c8b6bcb6981baf81cea8bfbc8903e8ba8 \
+    --hash=sha256:9f90389693731ff1f659e55c7d1640e2ec43ff725cc61b04b2f9c6d8d017df6a \
+    --hash=sha256:a09582f178759ee8128d9270cd1344154fd473bb77d94ce0aeb2a93ebf0feaf0 \
+    --hash=sha256:a6a14b17d7e17fa0d207ac08642c8820f84f25ce17a442fd15e27ea18d67c59b \
+    --hash=sha256:a72e8961a86d19bdb45851d8f1f08b041ea37d2bd8d4fd19903bc3083d80c896 \
+    --hash=sha256:abd808f9c129ba2beda4cfc53bde801e5bcf9d6e0f22f095e45327c038bfe68e \
+    --hash=sha256:ac0f5edd2360eea2f1daa9e26a41db02dd4b0451b48f7c318e217ee092a213e9 \
+    --hash=sha256:b29ebffcf550f9da55bec9e02ad430c992a87e5f512cd63388abb76f1036d8d2 \
+    --hash=sha256:b2ca4e77f9f47c55c194982e10f058db063937845bb2b7a86c84a6cfe0aefa8b \
+    --hash=sha256:b7be2d771cdba2942e13215c4e340bfd76398e9227ad10402a8767ab1865d2e6 \
+    --hash=sha256:b84834d0cf97e7d27dd5b7f3aca7b6e9263c56308ab9dc8aae9784abb774d404 \
+    --hash=sha256:b86851a328eedc692acf81fb05444bdf1891747c25af7529e39ddafaf68a4f3f \
+    --hash=sha256:bcb3ef43e58665bbda2fb198698fcae6776483e0c4a631aa5647806c25e02cc0 \
+    --hash=sha256:c0f31130ebc2d37cdd8e44605fb5fa7ad59049298b3f745c74fa74c62fbfcfc4 \
+    --hash=sha256:c6a164aa47843fb1b01e941d385aab7215563bb8816d80ff3a363a9f8448a8dc \
+    --hash=sha256:d8a9d3ebe49f084ad71f9269834ceccbf398253c9fac910c4fd7053ff1386936 \
+    --hash=sha256:db8e577c19c0fda0beb7e0d4e09e0ba74b1e4c092e0e40bfa12fe05b6f6d75ba \
+    --hash=sha256:dc9b18bf40cc75f66f40a7379f6a9513244fe33c0e8aa72e2d56b0196a7ef872 \
+    --hash=sha256:e09f3ff613345df5e8c3667da1d918f9149bd623cd9070c983c013792a9a62eb \
+    --hash=sha256:e4108df7fe9b707191e55f33efbcb2d81928e10cea45527879a4749cbe472614 \
+    --hash=sha256:e6024675e67af929088fda399b2094574609396b1decb609c55fa58b028a32a1 \
+    --hash=sha256:e70f54f1796669ef691ca07d046cd81a29cb4deb1e5f942003f401c0c4a2695d \
+    --hash=sha256:e715596e683d2ce000574bae5d07bd522c781a822866c20495e52520564f0969 \
+    --hash=sha256:e760191dd42581e023a68b758769e2da259b5d52e3103c6060ddc02c9edb8d7b \
+    --hash=sha256:ed86a35631f7bfbb28e108dd96773b9d5a6ce4811cf6ea468bb6a359b256b1e4 \
+    --hash=sha256:ee07e47c12890ef248766a6e55bd38ebfb2bb8edd4142d56db91b21ea68b7627 \
+    --hash=sha256:fa3a0128b152627161ce47201262d3140edb5a5c3da88d73a1b790a959126956 \
+    --hash=sha256:fcc8eb6d5902bb1cf6dc4f187ee3ea80a1eba0a89aba40a5cb20a5087d961357
+    # via cryptography
 charset-normalizer==3.3.2 \
     --hash=sha256:06435b539f889b1f6f4ac1758871aae42dc3a8c0e24ac9e60c2384973ad73027 \
     --hash=sha256:06a81e93cd441c56a9b65d8e1d043daeb97a3d0856d177d5c90ba85acb3db087 \
@@ -108,6 +162,31 @@ charset-normalizer==3.3.2 \
     --hash=sha256:fd1abc0d89e30cc4e02e4064dc67fcc51bd941eb395c502aac3ec19fab46b519 \
     --hash=sha256:ff8fa367d09b717b2a17a052544193ad76cd49979c805768879cb63d9ca50561
     # via requests
+cryptography==41.0.7 \
+    --hash=sha256:079b85658ea2f59c4f43b70f8119a52414cdb7be34da5d019a77bf96d473b960 \
+    --hash=sha256:09616eeaef406f99046553b8a40fbf8b1e70795a91885ba4c96a70793de5504a \
+    --hash=sha256:13f93ce9bea8016c253b34afc6bd6a75993e5c40672ed5405a9c832f0d4a00bc \
+    --hash=sha256:37a138589b12069efb424220bf78eac59ca68b95696fc622b6ccc1c0a197204a \
+    --hash=sha256:3c78451b78313fa81607fa1b3f1ae0a5ddd8014c38a02d9db0616133987b9cdf \
+    --hash=sha256:43f2552a2378b44869fe8827aa19e69512e3245a219104438692385b0ee119d1 \
+    --hash=sha256:48a0476626da912a44cc078f9893f292f0b3e4c739caf289268168d8f4702a39 \
+    --hash=sha256:49f0805fc0b2ac8d4882dd52f4a3b935b210935d500b6b805f321addc8177406 \
+    --hash=sha256:5429ec739a29df2e29e15d082f1d9ad683701f0ec7709ca479b3ff2708dae65a \
+    --hash=sha256:5a1b41bc97f1ad230a41657d9155113c7521953869ae57ac39ac7f1bb471469a \
+    --hash=sha256:68a2dec79deebc5d26d617bfdf6e8aab065a4f34934b22d3b5010df3ba36612c \
+    --hash=sha256:7a698cb1dac82c35fcf8fe3417a3aaba97de16a01ac914b89a0889d364d2f6be \
+    --hash=sha256:841df4caa01008bad253bce2a6f7b47f86dc9f08df4b433c404def869f590a15 \
+    --hash=sha256:90452ba79b8788fa380dfb587cca692976ef4e757b194b093d845e8d99f612f2 \
+    --hash=sha256:928258ba5d6f8ae644e764d0f996d61a8777559f72dfeb2eea7e2fe0ad6e782d \
+    --hash=sha256:af03b32695b24d85a75d40e1ba39ffe7db7ffcb099fe507b39fd41a565f1b157 \
+    --hash=sha256:b640981bf64a3e978a56167594a0e97db71c89a479da8e175d8bb5be5178c003 \
+    --hash=sha256:c5ca78485a255e03c32b513f8c2bc39fedb7f5c5f8535545bdc223a03b24f248 \
+    --hash=sha256:c7f3201ec47d5207841402594f1d7950879ef890c0c495052fa62f58283fde1a \
+    --hash=sha256:d5ec85080cce7b0513cfd233914eb8b7bbd0633f1d1703aa28d1dd5a72f678ec \
+    --hash=sha256:d6c391c021ab1f7a82da5d8d0b3cee2f4b2c455ec86c8aebbc84837a631ff309 \
+    --hash=sha256:e3114da6d7f95d2dee7d3f4eec16dacff819740bbab931aff8648cb13c5ff5e7 \
+    --hash=sha256:f983596065a18a2183e7f79ab3fd4c475205b839e02cbc0efbbf9666c4b3083d
+    # via -r requirements.in
 exceptiongroup==1.2.0 \
     --hash=sha256:4bfd3996ac73b41e9b9628b04e079f193850720ea5945fc96a08633c66912f14 \
     --hash=sha256:91f5c769735f051a4290d52edd0858999b57e5876e9f85937691bd4c9fa3ed68
@@ -128,6 +207,10 @@ outcome==1.3.0.post0 \
     --hash=sha256:9dcf02e65f2971b80047b377468e72a268e15c0af3cf1238e6ff14f7f91143b8 \
     --hash=sha256:e771c5ce06d1415e356078d3bdd68523f284b4ce5419828922b6871e65eda82b
     # via trio
+pycparser==2.21 \
+    --hash=sha256:8ee45429555515e1f6b185e78100aea234072576aa43ab53aefcae078162fca9 \
+    --hash=sha256:e644fdec12f7872f86c58ff790da456218b10f863970249516d60a5eaca77206
+    # via cffi
 pysocks==1.7.1 \
     --hash=sha256:08e69f092cc6dbe92a0fdd16eeb9b9ffbc13cadfe5ca4c7bd92ffb078b293299 \
     --hash=sha256:2725bd0a9925919b9b51739eea5f9e2bae91e83288108a9ad338b2e3a4435ee5 \

tests/core/customcert/test.sh

@@ -31,6 +31,8 @@ else
     echo "USE_CUSTOM_SSL=no" | sudo tee -a /etc/bunkerweb/variables.env
     echo "CUSTOM_SSL_CERT=/tmp/certificate.pem" | sudo tee -a /etc/bunkerweb/variables.env
     echo "CUSTOM_SSL_KEY=/tmp/privatekey.key" | sudo tee -a /etc/bunkerweb/variables.env
+    export CUSTOM_SSL_CERT="/tmp/certificate.pem"
+    export CUSTOM_SSL_KEY="/tmp/privatekey.key"
     sudo touch /var/www/html/index.html
     sudo cp ready.conf /etc/bunkerweb/configs/server-http
 fi
@@ -43,12 +45,14 @@ cleanup_stack () {
         if [ "$integration" == "docker" ] ; then
             rm -rf init/certs
             find . -type f -name 'docker-compose.*' -exec sed -i 's@USE_CUSTOM_SSL: "yes"@USE_CUSTOM_SSL: "no"@' {} \;
+            find . -type f -name 'docker-compose.*' -exec sed -i 's@CUSTOM_SSL_CERT: ".*"@CUSTOM_SSL_CERT: "/certs/certificate.pem"@' {} \;
+            find . -type f -name 'docker-compose.*' -exec sed -i 's@CUSTOM_SSL_KEY: ".*"@CUSTOM_SSL_KEY: "/certs/privatekey.key"@' {} \;
         else
             sudo rm -f /tmp/certificate.pem /tmp/privatekey.key
             sudo sed -i 's@USE_CUSTOM_SSL=.*$@USE_CUSTOM_SSL=no@' /etc/bunkerweb/variables.env
+            sudo sed -i 's@CUSTOM_SSL_CERT=.*$@CUSTOM_SSL_CERT=/tmp/certificate.pem@' /etc/bunkerweb/variables.env
+            sudo sed -i 's@CUSTOM_SSL_KEY=.*$@CUSTOM_SSL_KEY=/tmp/privatekey.key@' /etc/bunkerweb/variables.env
             unset USE_CUSTOM_SSL
-            unset CUSTOM_SSL_CERT
-            unset CUSTOM_SSL_KEY
         fi
         if [[ $end -eq 1 && $exit_code = 0 ]] ; then
             return
@@ -103,7 +107,7 @@ else
     sudo chmod 777 /tmp/privatekey.key /tmp/certificate.pem
 fi
 
-for test in "deactivated" "activated"
+for test in "deactivated" "activated" "fallback"
 do
     if [ "$test" = "deactivated" ] ; then
         echo "🔏 Running tests without the custom cert ..."
@@ -115,6 +119,20 @@ do
             sudo sed -i 's@USE_CUSTOM_SSL=.*$@USE_CUSTOM_SSL=yes@' /etc/bunkerweb/variables.env
             export USE_CUSTOM_SSL="yes"
         fi
+    elif [ "$test" = "fallback" ] ; then
+        echo "🔏 Running tests with the custom cert activated and fallback to default cert ..."
+        echo "ℹ Keeping the USE_CUSTOM_SSL variable to yes"
+        if [ "$integration" == "docker" ] ; then
+            find . -type f -name 'docker-compose.*' -exec sed -i 's@CUSTOM_SSL_CERT: ".*"@CUSTOM_SSL_CERT: ""@' {} \;
+            find . -type f -name 'docker-compose.*' -exec sed -i 's@CUSTOM_SSL_KEY: ".*"@CUSTOM_SSL_KEY: ""@' {} \;
+        else
+            sudo sed -i 's@USE_CUSTOM_SSL=.*$@USE_CUSTOM_SSL=yes@' /etc/bunkerweb/variables.env
+            sudo sed -i 's@CUSTOM_SSL_CERT=.*$@CUSTOM_SSL_CERT=@' /etc/bunkerweb/variables.env
+            sudo sed -i 's@CUSTOM_SSL_KEY=.*$@CUSTOM_SSL_KEY=@' /etc/bunkerweb/variables.env
+            unset CUSTOM_SSL_CERT
+            unset CUSTOM_SSL_KEY
+            export USE_CUSTOM_SSL="yes"
+        fi
     fi
 
     echo "🔏 Starting stack ..."