()
| 551 | |
| 552 | #[tokio::test] |
| 553 | async fn test_reload_serves_new_cert() { |
| 554 | install_rustls_provider(); |
| 555 | |
| 556 | let dir = tempfile::tempdir().expect("failed to create tempdir"); |
| 557 | let (ca_cert, ca_key) = generate_test_certs_with_ca(dir.path()); |
| 558 | let acceptor = TlsAcceptor::from_files( |
| 559 | &dir.path().join("server-cert.pem"), |
| 560 | &dir.path().join("server-key.pem"), |
| 561 | Some(&dir.path().join("ca.pem")), |
| 562 | false, |
| 563 | ) |
| 564 | .expect("failed to build acceptor"); |
| 565 | |
| 566 | let client_config = build_test_client_config(&dir.path().join("ca.pem")); |
| 567 | let connector = tokio_rustls::TlsConnector::from(client_config); |
| 568 | let server_name = |
| 569 | rustls::pki_types::ServerName::try_from("localhost").expect("invalid server name"); |
| 570 | |
| 571 | // Connection 1: original cert |
| 572 | let listener1 = TcpListener::bind("127.0.0.1:0") |
| 573 | .await |
| 574 | .expect("failed to bind"); |
| 575 | let addr1 = listener1.local_addr().expect("failed to get local addr"); |
| 576 | let acc1 = acceptor.clone(); |
| 577 | let server_task_1 = tokio::spawn(async move { |
| 578 | let (stream, _) = listener1.accept().await.expect("accept failed"); |
| 579 | acc1.acceptor() |
| 580 | .accept(stream) |
| 581 | .await |
| 582 | .expect("TLS accept failed"); |
| 583 | }); |
| 584 | let tcp_1 = TcpStream::connect(addr1).await.expect("connect failed"); |
| 585 | let tls_1 = connector |
| 586 | .connect(server_name.clone(), tcp_1) |
| 587 | .await |
| 588 | .expect("TLS handshake failed"); |
| 589 | let server_cert_1 = peer_cert_der(&tls_1); |
| 590 | server_task_1.await.expect("server task 1 failed"); |
| 591 | assert!(!server_cert_1.is_empty()); |
| 592 | |
| 593 | // Generate new server cert + reload |
| 594 | generate_server_cert(&ca_cert, &ca_key, dir.path()); |
| 595 | acceptor.reload().expect("reload should succeed"); |
| 596 | |
| 597 | // Connection 2: new cert on a fresh listener |
| 598 | let listener2 = TcpListener::bind("127.0.0.1:0") |
| 599 | .await |
| 600 | .expect("failed to bind"); |
| 601 | let addr2 = listener2.local_addr().expect("failed to get local addr"); |
| 602 | let acc2 = acceptor.clone(); |
| 603 | let server_task_2 = tokio::spawn(async move { |
| 604 | let (stream, _) = listener2.accept().await.expect("accept failed"); |
| 605 | acc2.acceptor() |
| 606 | .accept(stream) |
| 607 | .await |
| 608 | .expect("TLS accept failed"); |
| 609 | }); |
| 610 | let tcp_2 = TcpStream::connect(addr2).await.expect("connect failed"); |
nothing calls this directly
no test coverage detected