6c7df68c7c
* Initial support for using multiple SSL certificates. * Also list IP address subjectAltNames on log. * Use Python 3.7+ way of specifying TLSv1.2 as the minimum version. Linter fixes. * isort * Cleanup, store server name for later use. Add RSA ciphers. Log rejected SNIs. * Cleanup, linter. * Alter the order of initial log messages and handling. In particular, enable debug mode early so that debug messages during init can be shown. * Store server name (SNI) to conn_info. * Update test with new error message. * Refactor for readability. * Cleanup * Replace old expired test cert with new ones and a script for regenerating them as needed. * Refactor TLS tests to a separate file. * Add cryptography to dev deps for rebuilding TLS certs. * Minor adjustment to messages. * Tests added for new TLS code. * Find the correct log row before testing for message. The order was different on CI. * More log message order fixup. The tests do not account for the logo being printed first. * Another attempt at log message indexing fixup. * Major TLS refactoring. CertSelector now allows dicts and SSLContext within its list. Server names are stored even when no list is used. SSLContext.sanic now contains a dict with any setting passed and information extracted from cert. That information is available on request.conn_info.cert. Type annotations added. More tests incl. a handler for faking hostname in tests. * Remove a problematic logger test that apparently was not adding any coverage or value to anything. * Revert accidental commit of uvloop disable. * Typing fixes / refactoring. * Additional test for cert selection. Certs recreated without DNS:localhost on sanic.example cert. * Add tests for single certificate path shorthand and SNI information. * Move TLS dict processing to CertSimple, make the names field optional and use names from the cert if absent. * Sanic CLI options --tls and --tls-strict-host to use the new features. * SSL argument typing updated * Use ValueError for internal message passing to avoid CertificateError's odd message formatting. * Linter * Test CLI TLS options. * Maybe the right codeclimate option now... * Improved TLS argument help, removed support for combining --cert/--key with --tls. * Removed support for strict checking without any certs, black forced fscked up formatting. * Update CLI tests for stricter TLS options. Co-authored-by: L. Karkkainen <tronic@users.noreply.github.com> Co-authored-by: Adam Hopkins <admhpkns@gmail.com>
255 lines
6.1 KiB
Python
255 lines
6.1 KiB
Python
import json
|
|
import subprocess
|
|
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from sanic_routing import __version__ as __routing_version__
|
|
|
|
from sanic import __version__
|
|
from sanic.config import BASE_LOGO
|
|
|
|
|
|
def capture(command):
|
|
proc = subprocess.Popen(
|
|
command,
|
|
stdout=subprocess.PIPE,
|
|
stderr=subprocess.PIPE,
|
|
cwd=Path(__file__).parent,
|
|
)
|
|
try:
|
|
out, err = proc.communicate(timeout=0.5)
|
|
except subprocess.TimeoutExpired:
|
|
proc.kill()
|
|
out, err = proc.communicate()
|
|
return out, err, proc.returncode
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"appname",
|
|
(
|
|
"fake.server.app",
|
|
"fake.server:app",
|
|
"fake.server:create_app()",
|
|
"fake.server.create_app()",
|
|
),
|
|
)
|
|
def test_server_run(appname):
|
|
command = ["sanic", appname]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
firstline = lines[6]
|
|
|
|
assert exitcode != 1
|
|
assert firstline == b"Goin' Fast @ http://127.0.0.1:8000"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"cmd",
|
|
(
|
|
(
|
|
"--cert=certs/sanic.example/fullchain.pem",
|
|
"--key=certs/sanic.example/privkey.pem",
|
|
),
|
|
(
|
|
"--tls=certs/sanic.example/",
|
|
"--tls=certs/localhost/",
|
|
),
|
|
(
|
|
"--tls=certs/sanic.example/",
|
|
"--tls=certs/localhost/",
|
|
"--tls-strict-host",
|
|
),
|
|
),
|
|
)
|
|
def test_tls_options(cmd):
|
|
command = ["sanic", "fake.server.app", *cmd, "-p=9999", "--debug"]
|
|
out, err, exitcode = capture(command)
|
|
assert exitcode != 1
|
|
lines = out.split(b"\n")
|
|
firstline = lines[6]
|
|
assert firstline == b"Goin' Fast @ https://127.0.0.1:9999"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"cmd",
|
|
(
|
|
(
|
|
"--cert=certs/sanic.example/fullchain.pem",
|
|
),
|
|
(
|
|
"--cert=certs/sanic.example/fullchain.pem",
|
|
"--key=certs/sanic.example/privkey.pem",
|
|
"--tls=certs/localhost/",
|
|
),
|
|
(
|
|
"--tls-strict-host",
|
|
),
|
|
),
|
|
)
|
|
def test_tls_wrong_options(cmd):
|
|
command = ["sanic", "fake.server.app", *cmd, "-p=9999", "--debug"]
|
|
out, err, exitcode = capture(command)
|
|
assert exitcode == 1
|
|
assert not out
|
|
errmsg = err.decode().split("sanic: error: ")[1].split("\n")[0]
|
|
assert errmsg == "TLS certificates must be specified by either of:"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"cmd",
|
|
(
|
|
("--host=localhost", "--port=9999"),
|
|
("-H", "localhost", "-p", "9999"),
|
|
),
|
|
)
|
|
def test_host_port_localhost(cmd):
|
|
command = ["sanic", "fake.server.app", *cmd]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
firstline = lines[6]
|
|
|
|
assert exitcode != 1
|
|
assert firstline == b"Goin' Fast @ http://localhost:9999"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"cmd",
|
|
(
|
|
("--host=127.0.0.127", "--port=9999"),
|
|
("-H", "127.0.0.127", "-p", "9999"),
|
|
),
|
|
)
|
|
def test_host_port_ipv4(cmd):
|
|
command = ["sanic", "fake.server.app", *cmd]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
firstline = lines[6]
|
|
|
|
assert exitcode != 1
|
|
assert firstline == b"Goin' Fast @ http://127.0.0.127:9999"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"cmd",
|
|
(
|
|
("--host=::", "--port=9999"),
|
|
("-H", "::", "-p", "9999"),
|
|
),
|
|
)
|
|
def test_host_port_ipv6_any(cmd):
|
|
command = ["sanic", "fake.server.app", *cmd]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
firstline = lines[6]
|
|
|
|
assert exitcode != 1
|
|
assert firstline == b"Goin' Fast @ http://[::]:9999"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"cmd",
|
|
(
|
|
("--host=::1", "--port=9999"),
|
|
("-H", "::1", "-p", "9999"),
|
|
),
|
|
)
|
|
def test_host_port_ipv6_loopback(cmd):
|
|
command = ["sanic", "fake.server.app", *cmd]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
firstline = lines[6]
|
|
|
|
assert exitcode != 1
|
|
assert firstline == b"Goin' Fast @ http://[::1]:9999"
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"num,cmd",
|
|
(
|
|
(1, (f"--workers={1}",)),
|
|
(2, (f"--workers={2}",)),
|
|
(4, (f"--workers={4}",)),
|
|
(1, ("-w", "1")),
|
|
(2, ("-w", "2")),
|
|
(4, ("-w", "4")),
|
|
),
|
|
)
|
|
def test_num_workers(num, cmd):
|
|
command = ["sanic", "fake.server.app", *cmd]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
|
|
worker_lines = [line for line in lines if b"worker" in line]
|
|
assert exitcode != 1
|
|
assert len(worker_lines) == num * 2
|
|
|
|
|
|
@pytest.mark.parametrize("cmd", ("--debug", "-d"))
|
|
def test_debug(cmd):
|
|
command = ["sanic", "fake.server.app", cmd]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
|
|
app_info = lines[26]
|
|
info = json.loads(app_info)
|
|
|
|
assert (b"\n".join(lines[:6])).decode("utf-8") == BASE_LOGO
|
|
assert info["debug"] is True
|
|
assert info["auto_reload"] is True
|
|
|
|
|
|
@pytest.mark.parametrize("cmd", ("--auto-reload", "-r"))
|
|
def test_auto_reload(cmd):
|
|
command = ["sanic", "fake.server.app", cmd]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
|
|
app_info = lines[26]
|
|
info = json.loads(app_info)
|
|
|
|
assert info["debug"] is False
|
|
assert info["auto_reload"] is True
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"cmd,expected", (("--access-log", True), ("--no-access-log", False))
|
|
)
|
|
def test_access_logs(cmd, expected):
|
|
command = ["sanic", "fake.server.app", cmd]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
|
|
app_info = lines[26]
|
|
info = json.loads(app_info)
|
|
|
|
assert info["access_log"] is expected
|
|
|
|
|
|
@pytest.mark.parametrize("cmd", ("--version", "-v"))
|
|
def test_version(cmd):
|
|
command = ["sanic", cmd]
|
|
out, err, exitcode = capture(command)
|
|
version_string = f"Sanic {__version__}; Routing {__routing_version__}\n"
|
|
|
|
assert out == version_string.encode("utf-8")
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
"cmd,expected",
|
|
(
|
|
("--noisy-exceptions", True),
|
|
("--no-noisy-exceptions", False),
|
|
),
|
|
)
|
|
def test_noisy_exceptions(cmd, expected):
|
|
command = ["sanic", "fake.server.app", cmd]
|
|
out, err, exitcode = capture(command)
|
|
lines = out.split(b"\n")
|
|
|
|
app_info = lines[26]
|
|
info = json.loads(app_info)
|
|
|
|
assert info["noisy_exceptions"] is expected
|