96 lines
2.8 KiB
Bash
Executable file
96 lines
2.8 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
if [ $# -lt 2 ]; then
|
|
echo "Usage: $0 <image> <tls_app_dir> [docker-run-arg ...]" >&2
|
|
exit 1
|
|
fi
|
|
|
|
IMAGE="$1"
|
|
TLS_APP_DIR="$2"
|
|
shift 2 || true
|
|
DOCKER_ARGS=("$@")
|
|
|
|
SMOKE_DLL=/tls/TlsSmoke.dll
|
|
PUBLIC_URL="https://example.com"
|
|
LOCAL_PORT=9443
|
|
|
|
run_smoke() {
|
|
local url="$1"
|
|
shift
|
|
docker run --rm \
|
|
-v "${TLS_APP_DIR}:/tls:ro" \
|
|
"${DOCKER_ARGS[@]}" \
|
|
"$@" \
|
|
"$IMAGE" \
|
|
dotnet "$SMOKE_DLL" "$url"
|
|
}
|
|
|
|
run_public_test() {
|
|
echo "[CA] Validating public trust store against ${PUBLIC_URL}" >&2
|
|
run_smoke "$PUBLIC_URL"
|
|
}
|
|
|
|
start_local_ca_server() {
|
|
CERT_WORKDIR=$(mktemp -d)
|
|
|
|
openssl req -x509 -newkey rsa:2048 -days 2 -nodes -keyout "$CERT_WORKDIR/ca.key" -out "$CERT_WORKDIR/ca.crt" -subj "/CN=ElsaTestCA" >/dev/null 2>&1
|
|
openssl req -newkey rsa:2048 -nodes -keyout "$CERT_WORKDIR/server.key" -out "$CERT_WORKDIR/server.csr" -subj "/CN=host.docker.internal" >/dev/null 2>&1
|
|
|
|
cat <<CERTEXT > "$CERT_WORKDIR/server.ext"
|
|
subjectAltName = DNS:localhost,DNS:host.docker.internal,IP:127.0.0.1
|
|
extendedKeyUsage = serverAuth
|
|
keyUsage = digitalSignature, keyEncipherment
|
|
CERTEXT
|
|
|
|
openssl x509 -req -in "$CERT_WORKDIR/server.csr" -CA "$CERT_WORKDIR/ca.crt" -CAkey "$CERT_WORKDIR/ca.key" -CAcreateserial -out "$CERT_WORKDIR/server.crt" -days 2 -sha256 -extfile "$CERT_WORKDIR/server.ext" >/dev/null 2>&1
|
|
|
|
openssl s_server -quiet -accept "$LOCAL_PORT" -www -cert "$CERT_WORKDIR/server.crt" -key "$CERT_WORKDIR/server.key" >/dev/null 2>&1 &
|
|
SERVER_PID=$!
|
|
|
|
for _ in {1..20}; do
|
|
if nc -z localhost "$LOCAL_PORT" >/dev/null 2>&1; then
|
|
break
|
|
fi
|
|
sleep 0.2
|
|
done
|
|
|
|
echo "$CERT_WORKDIR"
|
|
}
|
|
|
|
run_extra_ca_test() {
|
|
local cert_dir
|
|
cert_dir=$(start_local_ca_server)
|
|
trap "kill ${SERVER_PID:-0} >/dev/null 2>&1 || true; rm -rf '$cert_dir'" EXIT
|
|
|
|
echo "[CA] Validating EXTRA_CA_CERT flow against local CA" >&2
|
|
run_smoke "https://host.docker.internal:${LOCAL_PORT}" \
|
|
--add-host host.docker.internal:host-gateway \
|
|
-v "${cert_dir}:/certs:ro" \
|
|
-e EXTRA_CA_CERT=/certs/ca.crt
|
|
|
|
echo "[CA] Validating SSL_CERT_FILE fallback" >&2
|
|
run_smoke "https://host.docker.internal:${LOCAL_PORT}" \
|
|
--add-host host.docker.internal:host-gateway \
|
|
-v "${cert_dir}:/certs:ro" \
|
|
-e SSL_CERT_FILE=/certs/ca.crt
|
|
|
|
mkdir -p "$cert_dir/dir"
|
|
cp "$cert_dir/ca.crt" "$cert_dir/dir/custom-ca.crt"
|
|
openssl rehash "$cert_dir/dir" >/dev/null 2>&1
|
|
|
|
echo "[CA] Validating SSL_CERT_DIR fallback" >&2
|
|
run_smoke "https://host.docker.internal:${LOCAL_PORT}" \
|
|
--add-host host.docker.internal:host-gateway \
|
|
-v "${cert_dir}:/certs:ro" \
|
|
-e SSL_CERT_DIR=/certs/dir
|
|
|
|
kill "${SERVER_PID:-0}" >/dev/null 2>&1 || true
|
|
wait "${SERVER_PID:-0}" 2>/dev/null || true
|
|
rm -rf "$cert_dir"
|
|
trap - EXIT
|
|
}
|
|
|
|
run_public_test
|
|
run_extra_ca_test
|