1
0
mirror of https://github.com/thib8956/nginx-proxy synced 2025-07-01 14:25:46 +00:00
Commit Graph

45 Commits

Author SHA1 Message Date
cb59c24470 tests non standard port Host header 2024-02-13 15:24:37 +01:00
5d2f51dfe2 Fix test case assertion depending on python version 2023-12-19 21:31:19 +01:00
7d44f98e4f test: remove unused import 2023-12-12 22:16:32 +01:00
c4cf0af373 test: fix failing tests 2023-12-12 21:56:27 +01:00
060f09cfce ci: ensure all compose files are valid compose v2 + formatting 2023-12-12 21:56:27 +01:00
c4cb1c3797 test: tests for HTTP/3
Co-authored-by: Nicolas Duchon <nicolas.duchon@gmail.com>
Co-authored-by: Niek <100143256+SchoNie@users.noreply.github.com>
2023-12-08 00:48:08 +01:00
2b621599ff test: fix wildcard_certs_and_nohttps test 2023-05-08 21:20:47 +02:00
9b4bb07b34 fix: Don't create fallback http(s) server when http(s) disabled
Before, a fallback http server was created to handle requests for
unknown virtual hosts even when `HTTPS_METHOD=nohttp`.  (In this case,
all http vhosts would be unknown.)  Likewise, a catch-all fallback
https server was still created even if `HTTPS_METHOD=nohttps`.

Now the fallback servers are created only if needed.  This brings the
behavior in line with the documentation and user expectation.  It will
also make it easier to implement a planned feature: different servers
on different ports.
2023-02-04 18:59:38 -05:00
16066cab61 fix: Don't create cert error https server if https is not enabled 2023-02-02 17:17:00 -05:00
01745a836f tests: Fix path to ca-root.crt
`os.getcwd()` is not guaranteed to always return the `test/`
directory.
2023-02-17 02:34:08 -05:00
5aba125fb7 chore: do not copy useless files into the image
Move required files but 'nginx.tmpl' into a local 'app' folder and copy the
folder content into the image.

'nginx.tmpl' should be moved as well, but this is a breaking change for
configuration with a separate 'docker-gen' container.
2022-03-07 16:01:15 +01:00
0185a2971c tests: fix virtual path tests for new dhparam 2022-02-24 15:21:14 +01:00
e08b3487c9 test: Add test to cover SSL of path-based routing 2022-02-24 15:08:18 +01:00
c5166f580e tests: Add utility method to verify TLS chain of trust 2021-12-21 18:44:51 +13:00
9dc9d90d34 tests: Verify site-specific DH params feature works correctly
This addition requires usage of `DEFAULT_HOST` on containers tested to ensure they don't accidentally use `web2` as their default fallback (due to no SNI / `-servername` requested in openssl queries), otherwise they would be testing against the incorrect DH params response.

They could alternatively request an FQDN explicitly as well, instead of relying on implicit fallback/default server selection behaviour.

---

`web2.nginx-proxy.tld.dhparam.pem` is a copy of `ffdhe2048.pem`.
2021-12-21 18:41:43 +13:00
0f15130476 tests: Verify correct DH group size when negotiating
Additionally allows for adding extra openssl params when needed.
2021-12-21 18:41:43 +13:00
75528bdfcb chore: Refactor checksum comparisons
- Use a DRY method instead.
- ENV test changed from 2048-bit to 3072-bit to avoid confusion in a future test that should not be mixed up accidentally with 2048-bit elsewhere.
- Custom DH file test comparison changed to match other comparisons for equality against the expected DH param content.
- Related comments revised, additional comment for context added by the test definition.
- Minor white-space adjustments.
2021-12-21 18:41:43 +13:00
36c4ed7632 test: replace test dhparam.pem with ffdhe3072.pem 2021-10-20 21:04:29 +02:00
ab7ac0aadb fix: backward compatibility w/ DHPARAM_GENERATION
Also use true rather than 1 to stay consistent
with other boolean environment variables
2021-10-20 19:15:27 +02:00
41bd4076c0 chore: DRY up test_dhparam.yml
Use YAML anchors for repeated values providing a single source of truth.

I would use `x-*` convention to store anchors above service containers, but this seems to require a compose config that defines the services (and version?) keys, which this test setup was failing to be compatible with for some reason..
2021-09-29 15:20:08 +13:00
e81001615c tests: Improve error handling output and use regular string comparisons
As this project isn't exactly python focused apart from the test suite, I'll assume other contributors are probably not as experienced with python either. Since this is a rather technical test, the extra comments should help grok the functionality without floundering around with the docs.

When the subprocess raises an exception due to an issue with the command (_eg using `-CAfile` arg to `openssl` with an invalid path_), the tests would output large walls of text that wasn't particularly helpful in troubleshooting the issue. `stderr` was also leaking out inbetween the test case results in the terminal, this has been resolved by ensuring that output is caught and piped, which keeps it available to python when an exception is raised. Identifying the actual error cause and location is now much nicer.

Updated the output to be plain string content instead of byte strings, this works fine :)
2021-09-28 21:59:53 +13:00
1d2f308cdf feat: Bring back ability to skip default DH params
Adds back the ability to avoid using DH params, provided no file was explicitly supplied.

This used to be `DHPARAM_GENERATION=false`, the equivalent is now `DHPARAM_SKIP=1` (default 0). Previous name was no longer appropriate.

Ensures that if a user has explicitly provided their own dhparam file to still output a warning instead of the skip message, since `DHPARAM_SKIP=1` doesn't disable the support in nginx.
2021-09-28 21:59:53 +13:00
fd35a09240 tests: Revise dhparams tests
- `dhparam_generation` tests are no longer necessary, dropped.

Modified the remaining `dhparam` test to use multiple `nginx-proxy` images to verify correct behavior for different configs.

Tests now cover:

- Default (ffdhe4096) is used.
- Alternative via ENV (ffdhe2048) works correctly.
- Invalid group via ENV (1024-bit) fails.
- Custom DH params provided via file mount works with warning emitted.

---

- `assert_log_contains`: added a `container_name` arg with `nginxproxy` as the default value. This allows multiple nginx-proxy containers to utilize this method instead.

- Extracted out the `openssl` test (_to `negotiate_cipher()`_) and modified it to be a bit more flexible. It now takes a container with optional extra args to pass to `openssl` command called, as well as the `grep` string to match. This made the original test redundant, so I've dropped it.

- Added two methods to use `negotiate_cipher()`, one verifies a DHE cipher suite was negotiated and checks that a DH emphermal key was also mentioned in the output. The other method verifies the expectation of failing to negotiate a valid cipher if DH params have not been set, while verifying that non-DHE cipher suites can be successfully negotiated.

- Added a `get_env()` method for extracting attached environments on a container. This is useful for verifying invalid `DHPARAM_BITS` values (eg `1024`-bit).

- The original `Server Temp Key` assertion was incorrect, it was expecting a value that is unrelated to DHE cipher suite support (_`X25519` is related to ECDHE_). This is due to TLS 1.3 being negotiated where you cannot use custom DH params, nor influence the negotiated cipher due to this mechanism changing from TLS 1.3. TLS 1.3 does support DH params, but it internally negotiates RFC 7919 group between server and client instead. Thus to verify expectations, the connection via `openssl` is made explicitly with TLS 1.2 instead.
2021-09-28 21:59:53 +13:00
9299a2801e tests: Remove dhparam volume
No longer necessary for the majority of tests.
2021-09-28 21:50:11 +13:00
795e0acda7 ci: remove InsecureRequestWarning from urllib3 2021-08-02 18:09:34 +02:00
790785f1ab test: custom HTTPS port and redirection 2021-06-15 00:38:32 +02:00
0c60d57031 fix(ci): fix test_dhparam_is_generated_if_missing 2021-04-27 00:35:20 +02:00
37e85e6e8d chore(ci): ♻️ convert Python old % string to f-strings 2021-04-27 00:35:20 +02:00
950a28f5ea chore(ci): ⬆️ porting python 2.7 code to python 3.9 2021-04-27 00:35:19 +02:00
ad7c02570b chore: use nginxproxy's DockerHub registry
Transitioning away from jwilder/nginx-proxy
Please see #1304 for more details
2021-04-01 16:06:09 +02:00
23823c4b21 Fix the test 2019-08-07 17:33:02 +01:00
ad41178036 Fixed tests that are now failing due to the dhparam clearing command beating the nginx startup. This is fixed permanently in #1213, but this PR fixes the test so as not to rely on the dhparam autogen, which is tested elsewhere. 2019-02-04 15:15:04 -05:00
936e57a6de Fixed #1080, can't disable HSTS with noredirect 2018-08-01 11:30:06 -04:00
3590c1bae0 Added regression test to ensure HSTS works for errors 2018-03-26 14:58:06 -04:00
a6e8fae7f5 Merge pull request #970 from kamermans/bugfix/failing_ssl_tests
Fixed failing SSL tests
2017-11-09 10:04:20 -07:00
612bf72ceb Support old and new versions of requests 2017-11-08 23:19:13 -05:00
ebd1485b09 Catch SSLError instead of CertificateError 2017-11-08 22:53:44 -05:00
58a02f107e Removed '-verify 0' - to disable verification, exclude -verify entirely 2017-11-08 22:42:52 -05:00
a312472fb5 Added custom HSTS support (issue #953) 2017-11-08 22:30:24 -05:00
c41186a3a4 Merge branch 'master' into feature_ssl_improvement 2017-06-14 16:31:12 -06:00
8414a94d59 TESTS: add test for the case in which a wildcard cert matches a container having nohttps set 2017-03-15 02:12:07 +01:00
abdd5883a1 TESTS: refactor dhparam tests 2017-03-08 02:37:12 +01:00
98b5828f83 Modified tests to include dhparams 2017-03-07 14:04:44 -05:00
0244b4e71e Added dhparams test in new format 2017-03-07 14:04:37 -05:00
6069bc53cd TESTS: replace old test suite with the new one
get rid of Bats definitively
2017-02-17 00:29:30 +01:00