Function TestTCPProxyWithTLS

proxy/tcp_integration_test.go:101–164

TestTCPProxyWithTLS tests proxying an encrypted TCP connection to an unencrypted upstream TCP server. The proxy terminates the TLS connection.

(t *testing.T)

// to an unencrypted upstream TCP server. The proxy terminates the
// TLS connection.
func TestTCPProxyWithTLS(t *testing.T) {
	srv := tcptest.NewServer(echoHandler)
	defer srv.Close()

	// setup cert source
	dir := t.TempDir()

	mustWrite := func(name string, data []byte) {
		path := filepath.Join(dir, name)
		if err := os.WriteFile(path, data, 0644); err != nil {
			t.Fatalf("os.WriteFile: %s", err)
		}
	}
	mustWrite("example.com-key.pem", internal.LocalhostKey)
	mustWrite("example.com-cert.pem", internal.LocalhostCert)

	// start tcp proxy
	proxyAddr := "127.0.0.1:57779"
	cs := config.CertSource{Name: "cs", Type: "path", CertPath: dir}
	src, err := cert.NewSource(cs)
	if err != nil {
		t.Fatal("cert.NewSource: ", err)
	}
	tlscfg, err := cert.TLSConfig(src, false, 0, 0, nil)
	if err != nil {
		t.Fatal("cert.TLSConfig: ", err)
	}
	go func() {

		h := &tcp.Proxy{
			Lookup: func(string) *route.Target {
				return &route.Target{URL: &url.URL{Host: srv.Addr}}
			},
		}

		l := config.Listen{Addr: proxyAddr}
		if err := ListenAndServeTCP(l, h, tlscfg); err != nil {
			// closing the listener returns this error from the accept loop
			// which we can ignore.
			if err.Error() != "accept tcp 127.0.0.1:57779: use of closed network connection" {
				t.Log("ListenAndServeTCP: ", err)
			}
		}
	}()
	defer Close()

	rootCAs := x509.NewCertPool()
	if ok := rootCAs.AppendCertsFromPEM(internal.LocalhostCert); !ok {
		t.Fatal("could not parse cert")
	}
	cfg := &tls.Config{
		RootCAs:    rootCAs,
		ServerName: "example.com",
	}

	// connect to proxy
	out, err := tcptest.NewTLSRetryDialer(cfg).Dial("tcp", proxyAddr)
	if err != nil {