53 lines
2.0 KiB
Bash
Executable File
53 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
|
|
# shellcheck disable=SC1091
|
|
. "$ROOT/scripts/configure-backoffice-https-vm.sh"
|
|
|
|
assert_rejected() {
|
|
local label="${1:?label}" function_name="${2:?function}" value="${3:-}"
|
|
if ("$function_name" "$value") >/dev/null 2>&1; then
|
|
echo "FAIL: $label was accepted: $value" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
validate_public_host "admin.example.com"
|
|
validate_public_host "130.162.134.59"
|
|
validate_tls_email "ops@example.com"
|
|
validate_ssh_host "hermes"
|
|
validate_ipv4 "130.162.134.59"
|
|
validate_port "8082"
|
|
validate_remote_dir '$HOME/apps/vpd-backoffice'
|
|
|
|
assert_rejected "invalid IPv4 host" validate_public_host "130.162.134.999"
|
|
assert_rejected "wildcard host" validate_public_host "*.example.com"
|
|
assert_rejected "single-label host" validate_public_host "hermes"
|
|
assert_rejected "invalid email" validate_tls_email "ops at example.com"
|
|
assert_rejected "SSH option injection" validate_ssh_host "-oProxyCommand=id"
|
|
assert_rejected "invalid IPv4" validate_ipv4 "130.162.134.999"
|
|
assert_rejected "privileged overflow port" validate_port "65536"
|
|
assert_rejected "remote command injection" validate_remote_dir '$HOME/apps/x;id'
|
|
assert_rejected "remote path traversal" validate_remote_dir '$HOME/apps/../etc'
|
|
|
|
tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/vpd-backoffice-https-test.XXXXXX")"
|
|
trap 'rm -rf "$tmp_dir"' EXIT
|
|
PUBLIC_HOST="admin.example.com"
|
|
TLS_EMAIL="ops@example.com"
|
|
APP_PORT="8082"
|
|
render_caddyfile "$tmp_dir/Caddyfile"
|
|
|
|
grep -Fq 'admin.example.com {' "$tmp_dir/Caddyfile"
|
|
grep -Fq 'email ops@example.com' "$tmp_dir/Caddyfile"
|
|
grep -Fq 'reverse_proxy 127.0.0.1:8082' "$tmp_dir/Caddyfile"
|
|
grep -Fq 'Strict-Transport-Security "max-age=31536000; includeSubDomains"' "$tmp_dir/Caddyfile"
|
|
|
|
PUBLIC_HOST="130.162.134.59"
|
|
render_caddyfile "$tmp_dir/Caddyfile.ip"
|
|
grep -Fq '130.162.134.59 {' "$tmp_dir/Caddyfile.ip"
|
|
grep -Fq 'profile shortlived' "$tmp_dir/Caddyfile.ip"
|
|
|
|
echo "PASS: HTTPS configuration validation and rendering"
|