githubmirror/traefik

integration/https_test.go
1 432 строки51 KB
Romain
Fix snicheck for routers with no hosts
10 июн 2026, 16:16
10 июн 2026, 16:160209f98
package integration

import (
	"bytes"
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"net"
	"net/http"
	"net/http/httptest"
	"os"
	"testing"
	"time"

	"github.com/BurntSushi/toml"
	"github.com/quic-go/quic-go/http3"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"github.com/stretchr/testify/suite"
	"github.com/traefik/traefik/v2/integration/try"
	"github.com/traefik/traefik/v2/pkg/config/dynamic"
	traefiktls "github.com/traefik/traefik/v2/pkg/tls"
	"golang.org/x/net/http2"
)

// HTTPSSuite tests suite.
type HTTPSSuite struct{ BaseSuite }

func TestHTTPSSuite(t *testing.T) {
	suite.Run(t, &HTTPSSuite{})
}

// TestWithSNIConfigHandshake involves a client sending a SNI hostname of
// "snitest.com", which happens to match the CN of 'snitest.com.crt'. The test
// verifies that traefik presents the correct certificate.
func (s *HTTPSSuite) TestWithSNIConfigHandshake() {
	file := s.adaptFile("fixtures/https/https_sni.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 500*time.Millisecond, try.BodyContains("Host(`snitest.org`)"))
	require.NoError(s.T(), err)

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.com",
		NextProtos:         []string{"h2", "http/1.1"},
	}
	conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "failed to connect to server")

	defer conn.Close()
	err = conn.Handshake()
	assert.NoError(s.T(), err, "TLS handshake error")

	cs := conn.ConnectionState()
	err = cs.PeerCertificates[0].VerifyHostname("snitest.com")
	assert.NoError(s.T(), err, "certificate did not match SNI servername")

	proto := conn.ConnectionState().NegotiatedProtocol
	assert.Equal(s.T(), "h2", proto)
}

// TestWithSNIConfigRoute involves a client sending HTTPS requests with
// SNI hostnames of "snitest.org" and "snitest.com". The test verifies
// that traefik routes the requests to the expected backends.
func (s *HTTPSSuite) TestWithSNIConfigRoute() {
	file := s.adaptFile("fixtures/https/https_sni.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`snitest.org`)"))
	require.NoError(s.T(), err)

	backend1 := startTestServer("9010", http.StatusNoContent, "")
	backend2 := startTestServer("9020", http.StatusResetContent, "")
	defer backend1.Close()
	defer backend2.Close()

	err = try.GetRequest(backend1.URL, 1*time.Second, try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)
	err = try.GetRequest(backend2.URL, 1*time.Second, try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)

	tr1 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         "snitest.com",
		},
	}
	tr2 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         "snitest.org",
		},
	}

	req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr1.TLSClientConfig.ServerName
	req.Header.Set("Host", tr1.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 30*time.Second, tr1, try.HasCn(tr1.TLSClientConfig.ServerName), try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)

	req, err = http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr2.TLSClientConfig.ServerName
	req.Header.Set("Host", tr2.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 30*time.Second, tr2, try.HasCn(tr2.TLSClientConfig.ServerName), try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)
}

// TestWithEntryPointTLSConfig verifies that a router relying on the entry point
// TLS configuration (without an explicit router TLS section) is served over HTTPS,
// including when the entry point references user-defined TLS options.
// Regression test for https://github.com/traefik/traefik/issues/13289.
func (s *HTTPSSuite) TestWithEntryPointTLSConfig() {
	file := s.adaptFile("fixtures/https/https_entrypoint_tls.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`snitest.com`)"))
	require.NoError(s.T(), err)

	backend := startTestServer("9010", http.StatusNoContent, "")
	defer backend.Close()

	err = try.GetRequest(backend.URL, 1*time.Second, try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)

	tr := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         "snitest.com",
		},
	}

	req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr.TLSClientConfig.ServerName
	req.Header.Set("Host", tr.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 30*time.Second, tr, try.HasCn(tr.TLSClientConfig.ServerName), try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)

	// The websecure-options entry point references the user-defined "foo" TLS options (maxVersion VersionTLS12).
	// A request with no router-level TLS must still have these options resolved and applied.
	trOptions := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         "snitest.org",
		},
	}

	req, err = http.NewRequest(http.MethodGet, "https://127.0.0.1:4444/", nil)
	require.NoError(s.T(), err)
	req.Host = trOptions.TLSClientConfig.ServerName
	req.Header.Set("Host", trOptions.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 30*time.Second, trOptions, try.HasCn(trOptions.TLSClientConfig.ServerName), try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)

	// A TLS 1.3-only client must fail the handshake, proving the "foo" options
	// (resolved from the entry point) are effectively enforced.
	_, err = tls.Dial("tcp", "127.0.0.1:4444", &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.org",
		MinVersion:         tls.VersionTLS13,
	})
	assert.Error(s.T(), err)
}

// TestWithTLSOptions verifies that traefik routes the requests with the associated tls options.
func (s *HTTPSSuite) TestWithTLSOptions() {
	file := s.adaptFile("fixtures/https/https_tls_options.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`snitest.org`)"))
	require.NoError(s.T(), err)

	backend1 := startTestServer("9010", http.StatusNoContent, "")
	backend2 := startTestServer("9020", http.StatusResetContent, "")
	defer backend1.Close()
	defer backend2.Close()

	err = try.GetRequest(backend1.URL, 1*time.Second, try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)
	err = try.GetRequest(backend2.URL, 1*time.Second, try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)

	tr1 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			MaxVersion:         tls.VersionTLS12,
			ServerName:         "snitest.com",
		},
	}

	tr2 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			MaxVersion:         tls.VersionTLS12,
			ServerName:         "snitest.org",
		},
	}

	tr3 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			MaxVersion:         tls.VersionTLS11,
			ServerName:         "snitest.org",
		},
	}

	// With valid TLS options and request
	req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr1.TLSClientConfig.ServerName
	req.Header.Set("Host", tr1.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 30*time.Second, tr1, try.HasCn(tr1.TLSClientConfig.ServerName), try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)

	// With a valid TLS version
	req, err = http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr2.TLSClientConfig.ServerName
	req.Header.Set("Host", tr2.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 3*time.Second, tr2, try.HasCn(tr2.TLSClientConfig.ServerName), try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)

	// With a bad TLS version
	req, err = http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr3.TLSClientConfig.ServerName
	req.Header.Set("Host", tr3.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")
	client := http.Client{
		Transport: tr3,
	}
	_, err = client.Do(req)
	assert.Error(s.T(), err)
	assert.Contains(s.T(), err.Error(), "tls: no supported versions satisfy MinVersion and MaxVersion")

	//	with unknown tls option
	err = try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("unknown TLS options: unknown@file"))
	require.NoError(s.T(), err)
}

// TestWithConflictingTLSOptions checks that routers with same SNI but different TLS options get fallbacked to the default TLS options.
func (s *HTTPSSuite) TestWithConflictingTLSOptions() {
	file := s.adaptFile("fixtures/https/https_tls_options.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`snitest.net`)"))
	require.NoError(s.T(), err)

	backend1 := startTestServer("9010", http.StatusNoContent, "")
	backend2 := startTestServer("9020", http.StatusResetContent, "")
	defer backend1.Close()
	defer backend2.Close()

	err = try.GetRequest(backend1.URL, 1*time.Second, try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)
	err = try.GetRequest(backend2.URL, 1*time.Second, try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)

	tr4 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			MaxVersion:         tls.VersionTLS11,
			ServerName:         "snitest.net",
		},
	}

	trDefault := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			MaxVersion:         tls.VersionTLS12,
			ServerName:         "snitest.net",
		},
	}

	// With valid TLS options and request
	req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = trDefault.TLSClientConfig.ServerName
	req.Header.Set("Host", trDefault.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 30*time.Second, trDefault, try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)

	// With a bad TLS version
	req, err = http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr4.TLSClientConfig.ServerName
	req.Header.Set("Host", tr4.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")
	client := http.Client{
		Transport: tr4,
	}
	_, err = client.Do(req)
	assert.ErrorContains(s.T(), err, "tls: no supported versions satisfy MinVersion and MaxVersion")

	// with unknown tls option
	err = try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("router's TLSOptions configuration is conflicting with other routers on the same entrypoint and host, default TLS options will be used instead"))
	require.NoError(s.T(), err)
}

// TestWithSNIStrictNotMatchedRequest involves a client sending a SNI hostname of
// "snitest.org", which does not match the CN of 'snitest.com.crt'. The test
// verifies that traefik closes the connection.

func (s *HTTPSSuite) TestWithSNIStrictNotMatchedRequest() {
	file := s.adaptFile("fixtures/https/https_sni_strict.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 500*time.Millisecond, try.BodyContains("Host(`snitest.com`)"))
	require.NoError(s.T(), err)

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.org",
		NextProtos:         []string{"h2", "http/1.1"},
	}
	// Connection with no matching certificate should fail
	_, err = tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.Error(s.T(), err, "failed to connect to server")
}

// TestWithDefaultCertificate involves a client sending a SNI hostname of
// "snitest.org", which does not match the CN of 'snitest.com.crt'. The test
// verifies that traefik returns the default certificate.

func (s *HTTPSSuite) TestWithDefaultCertificate() {
	file := s.adaptFile("fixtures/https/https_sni_default_cert.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 500*time.Millisecond, try.BodyContains("Host(`snitest.com`)"))
	require.NoError(s.T(), err)

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.org",
		NextProtos:         []string{"h2", "http/1.1"},
	}
	conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "failed to connect to server")

	defer conn.Close()
	err = conn.Handshake()
	assert.NoError(s.T(), err, "TLS handshake error")

	cs := conn.ConnectionState()
	err = cs.PeerCertificates[0].VerifyHostname("snitest.com")
	assert.NoError(s.T(), err, "server did not serve correct default certificate")

	proto := cs.NegotiatedProtocol
	assert.Equal(s.T(), "h2", proto)
}

// TestWithDefaultCertificateNoSNI involves a client sending a request with no ServerName
// which does not match the CN of 'snitest.com.crt'. The test
// verifies that traefik returns the default certificate.

func (s *HTTPSSuite) TestWithDefaultCertificateNoSNI() {
	file := s.adaptFile("fixtures/https/https_sni_default_cert.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 500*time.Millisecond, try.BodyContains("Host(`snitest.com`)"))
	require.NoError(s.T(), err)

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		NextProtos:         []string{"h2", "http/1.1"},
	}
	conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "failed to connect to server")

	defer conn.Close()
	err = conn.Handshake()
	assert.NoError(s.T(), err, "TLS handshake error")

	cs := conn.ConnectionState()
	err = cs.PeerCertificates[0].VerifyHostname("snitest.com")
	assert.NoError(s.T(), err, "server did not serve correct default certificate")

	proto := cs.NegotiatedProtocol
	assert.Equal(s.T(), "h2", proto)
}

// TestWithOverlappingCertificate involves a client sending a SNI hostname of
// "www.snitest.com", which matches the CN of two static certificates:
// 'wildcard.snitest.com.crt', and `www.snitest.com.crt`. The test
// verifies that traefik returns the non-wildcard certificate.

func (s *HTTPSSuite) TestWithOverlappingStaticCertificate() {
	file := s.adaptFile("fixtures/https/https_sni_default_cert.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 500*time.Millisecond, try.BodyContains("Host(`snitest.com`)"))
	require.NoError(s.T(), err)

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "www.snitest.com",
		NextProtos:         []string{"h2", "http/1.1"},
	}
	conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "failed to connect to server")

	defer conn.Close()
	err = conn.Handshake()
	assert.NoError(s.T(), err, "TLS handshake error")

	cs := conn.ConnectionState()
	err = cs.PeerCertificates[0].VerifyHostname("www.snitest.com")
	assert.NoError(s.T(), err, "server did not serve correct default certificate")

	proto := cs.NegotiatedProtocol
	assert.Equal(s.T(), "h2", proto)
}

// TestWithOverlappingCertificate involves a client sending a SNI hostname of
// "www.snitest.com", which matches the CN of two dynamic certificates:
// 'wildcard.snitest.com.crt', and `www.snitest.com.crt`. The test
// verifies that traefik returns the non-wildcard certificate.

func (s *HTTPSSuite) TestWithOverlappingDynamicCertificate() {
	file := s.adaptFile("fixtures/https/dynamic_https_sni_default_cert.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 500*time.Millisecond, try.BodyContains("Host(`snitest.com`)"))
	require.NoError(s.T(), err)

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "www.snitest.com",
		NextProtos:         []string{"h2", "http/1.1"},
	}
	conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "failed to connect to server")

	defer conn.Close()
	err = conn.Handshake()
	assert.NoError(s.T(), err, "TLS handshake error")

	cs := conn.ConnectionState()
	err = cs.PeerCertificates[0].VerifyHostname("www.snitest.com")
	assert.NoError(s.T(), err, "server did not serve correct default certificate")

	proto := cs.NegotiatedProtocol
	assert.Equal(s.T(), "h2", proto)
}

// TestWithClientCertificateAuthentication
// The client can send a certificate signed by a CA trusted by the server but it's optional.

func (s *HTTPSSuite) TestWithClientCertificateAuthentication() {
	file := s.adaptFile("fixtures/https/clientca/https_1ca1config.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 500*time.Millisecond, try.BodyContains("Host(`snitest.org`)"))
	require.NoError(s.T(), err)

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.com",
		Certificates:       []tls.Certificate{},
	}
	// Connection without client certificate should fail
	_, err = tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "should be allowed to connect to server")

	// Connect with client certificate signed by ca1
	cert, err := tls.LoadX509KeyPair("fixtures/https/clientca/client1.crt", "fixtures/https/clientca/client1.key")
	assert.NoError(s.T(), err, "unable to load client certificate and key")
	tlsConfig.Certificates = append(tlsConfig.Certificates, cert)

	conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "failed to connect to server")

	conn.Close()

	// Connect with client certificate not signed by ca1
	cert, err = tls.LoadX509KeyPair("fixtures/https/snitest.org.cert", "fixtures/https/snitest.org.key")
	assert.NoError(s.T(), err, "unable to load client certificate and key")
	tlsConfig.Certificates = append(tlsConfig.Certificates, cert)

	conn, err = tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "failed to connect to server")

	conn.Close()

	// Connect with client signed by ca2 should fail
	tlsConfig = &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.com",
		Certificates:       []tls.Certificate{},
	}
	cert, err = tls.LoadX509KeyPair("fixtures/https/clientca/client2.crt", "fixtures/https/clientca/client2.key")
	assert.NoError(s.T(), err, "unable to load client certificate and key")
	tlsConfig.Certificates = append(tlsConfig.Certificates, cert)

	_, err = tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "should be allowed to connect to server")
}

// TestWithClientCertificateAuthentication
// Use two CA:s and test that clients with client signed by either of them can connect.

func (s *HTTPSSuite) TestWithClientCertificateAuthenticationMultipleCAs() {
	server1 := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, _ *http.Request) { _, _ = rw.Write([]byte("server1")) }))
	server2 := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, _ *http.Request) { _, _ = rw.Write([]byte("server2")) }))
	defer func() {
		server1.Close()
		server2.Close()
	}()

	file := s.adaptFile("fixtures/https/clientca/https_2ca1config.toml", struct {
		Server1 string
		Server2 string
	}{
		Server1: server1.URL,
		Server2: server2.URL,
	})

	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`snitest.org`)"))
	require.NoError(s.T(), err)

	req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443", nil)
	require.NoError(s.T(), err)
	req.Host = "snitest.com"

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.com",
		Certificates:       []tls.Certificate{},
	}

	client := http.Client{
		Transport: &http.Transport{TLSClientConfig: tlsConfig},
		Timeout:   1 * time.Second,
	}

	// Connection without client certificate should fail
	_, err = client.Do(req)
	assert.Error(s.T(), err)

	cert, err := tls.LoadX509KeyPair("fixtures/https/clientca/client1.crt", "fixtures/https/clientca/client1.key")
	assert.NoError(s.T(), err, "unable to load client certificate and key")
	tlsConfig.Certificates = append(tlsConfig.Certificates, cert)

	// Connect with client signed by ca1
	_, err = client.Do(req)
	require.NoError(s.T(), err)

	// Connect with client signed by ca2
	tlsConfig = &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.com",
		Certificates:       []tls.Certificate{},
	}

	cert, err = tls.LoadX509KeyPair("fixtures/https/clientca/client2.crt", "fixtures/https/clientca/client2.key")
	assert.NoError(s.T(), err, "unable to load client certificate and key")
	tlsConfig.Certificates = append(tlsConfig.Certificates, cert)

	client = http.Client{
		Transport: &http.Transport{TLSClientConfig: tlsConfig},
		Timeout:   1 * time.Second,
	}

	// Connect with client signed by ca1
	_, err = client.Do(req)
	require.NoError(s.T(), err)

	// Connect with client signed by ca3 should fail
	tlsConfig = &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.com",
		Certificates:       []tls.Certificate{},
	}

	cert, err = tls.LoadX509KeyPair("fixtures/https/clientca/client3.crt", "fixtures/https/clientca/client3.key")
	assert.NoError(s.T(), err, "unable to load client certificate and key")
	tlsConfig.Certificates = append(tlsConfig.Certificates, cert)

	client = http.Client{
		Transport: &http.Transport{TLSClientConfig: tlsConfig},
		Timeout:   1 * time.Second,
	}

	// Connect with client signed by ca1
	_, err = client.Do(req)
	assert.Error(s.T(), err)
}

// TestWithClientCertificateAuthentication
// Use two CA:s in two different files and test that clients with client signed by either of them can connect.

func (s *HTTPSSuite) TestWithClientCertificateAuthenticationMultipleCAsMultipleFiles() {
	server1 := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, _ *http.Request) { _, _ = rw.Write([]byte("server1")) }))
	server2 := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, _ *http.Request) { _, _ = rw.Write([]byte("server2")) }))
	defer func() {
		server1.Close()
		server2.Close()
	}()

	file := s.adaptFile("fixtures/https/clientca/https_2ca2config.toml", struct {
		Server1 string
		Server2 string
	}{
		Server1: server1.URL,
		Server2: server2.URL,
	})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`snitest.org`)"))
	require.NoError(s.T(), err)

	req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443", nil)
	require.NoError(s.T(), err)
	req.Host = "snitest.com"

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.com",
		Certificates:       []tls.Certificate{},
	}

	client := http.Client{
		Transport: &http.Transport{TLSClientConfig: tlsConfig},
		Timeout:   1 * time.Second,
	}

	// Connection without client certificate should fail
	_, err = client.Do(req)
	assert.Error(s.T(), err)

	// Connect with client signed by ca1
	cert, err := tls.LoadX509KeyPair("fixtures/https/clientca/client1.crt", "fixtures/https/clientca/client1.key")
	assert.NoError(s.T(), err, "unable to load client certificate and key")
	tlsConfig.Certificates = append(tlsConfig.Certificates, cert)

	_, err = client.Do(req)
	require.NoError(s.T(), err)

	// Connect with client signed by ca2
	tlsConfig = &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.com",
		Certificates:       []tls.Certificate{},
	}

	cert, err = tls.LoadX509KeyPair("fixtures/https/clientca/client2.crt", "fixtures/https/clientca/client2.key")
	assert.NoError(s.T(), err, "unable to load client certificate and key")
	tlsConfig.Certificates = append(tlsConfig.Certificates, cert)

	client = http.Client{
		Transport: &http.Transport{TLSClientConfig: tlsConfig},
		Timeout:   1 * time.Second,
	}

	_, err = client.Do(req)
	require.NoError(s.T(), err)

	// Connect with client signed by ca3 should fail
	tlsConfig = &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "snitest.com",
		Certificates:       []tls.Certificate{},
	}

	cert, err = tls.LoadX509KeyPair("fixtures/https/clientca/client3.crt", "fixtures/https/clientca/client3.key")
	assert.NoError(s.T(), err, "unable to load client certificate and key")
	tlsConfig.Certificates = append(tlsConfig.Certificates, cert)

	client = http.Client{
		Transport: &http.Transport{TLSClientConfig: tlsConfig},
		Timeout:   1 * time.Second,
	}

	_, err = client.Do(req)
	assert.Error(s.T(), err)
}

func (s *HTTPSSuite) TestWithRootCAsContentForHTTPSOnBackend() {
	backend := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	defer backend.Close()

	file := s.adaptFile("fixtures/https/rootcas/https.toml", struct{ BackendHost string }{backend.URL})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains(backend.URL))
	require.NoError(s.T(), err)

	err = try.GetRequest("http://127.0.0.1:8081/ping", 1*time.Second, try.StatusCodeIs(http.StatusOK))
	require.NoError(s.T(), err)
}

func (s *HTTPSSuite) TestWithRootCAsFileForHTTPSOnBackend() {
	backend := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	defer backend.Close()

	file := s.adaptFile("fixtures/https/rootcas/https_with_file.toml", struct{ BackendHost string }{backend.URL})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains(backend.URL))
	require.NoError(s.T(), err)

	err = try.GetRequest("http://127.0.0.1:8081/ping", 1*time.Second, try.StatusCodeIs(http.StatusOK))
	require.NoError(s.T(), err)
}

func startTestServer(port string, statusCode int, textContent string) (ts *httptest.Server) {
	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(statusCode)
		if textContent != "" {
			_, _ = w.Write([]byte(textContent))
		}
	})
	listener, err := net.Listen("tcp", "127.0.0.1:"+port)
	if err != nil {
		panic(err)
	}

	ts = &httptest.Server{
		Listener: listener,
		Config:   &http.Server{Handler: handler},
	}
	ts.Start()
	return ts
}

// TestWithSNIDynamicConfigRouteWithNoChange involves a client sending HTTPS requests with
// SNI hostnames of "snitest.org" and "snitest.com". The test verifies
// that traefik routes the requests to the expected backends thanks to given certificate if possible
// otherwise thanks to the default one.
func (s *HTTPSSuite) TestWithSNIDynamicConfigRouteWithNoChange() {
	dynamicConfFileName := s.adaptFile("fixtures/https/dynamic_https.toml", struct{}{})
	confFileName := s.adaptFile("fixtures/https/dynamic_https_sni.toml", struct {
		DynamicConfFileName string
	}{
		DynamicConfFileName: dynamicConfFileName,
	})
	s.traefikCmd(withConfigFile(confFileName))

	tr1 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         "snitest.org",
		},
	}

	tr2 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         "snitest.com",
		},
	}

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`"+tr1.TLSClientConfig.ServerName+"`)"))
	require.NoError(s.T(), err)

	backend1 := startTestServer("9010", http.StatusNoContent, "")
	backend2 := startTestServer("9020", http.StatusResetContent, "")
	defer backend1.Close()
	defer backend2.Close()

	err = try.GetRequest(backend1.URL, 500*time.Millisecond, try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)
	err = try.GetRequest(backend2.URL, 500*time.Millisecond, try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)

	req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr1.TLSClientConfig.ServerName
	req.Header.Set("Host", tr1.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	// snitest.org certificate must be used yet && Expected a 204 (from backend1)
	err = try.RequestWithTransport(req, 30*time.Second, tr1, try.HasCn(tr1.TLSClientConfig.ServerName), try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)

	req, err = http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr2.TLSClientConfig.ServerName
	req.Header.Set("Host", tr2.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	// snitest.com certificate does not exist, default certificate has to be used && Expected a 205 (from backend2)
	err = try.RequestWithTransport(req, 30*time.Second, tr2, try.HasCn("TRAEFIK DEFAULT CERT"), try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)
}

// TestWithSNIDynamicConfigRouteWithChange involves a client sending HTTPS requests with
// SNI hostnames of "snitest.org" and "snitest.com". The test verifies
// that traefik updates its configuration when the HTTPS configuration is modified and
// it routes the requests to the expected backends thanks to given certificate if possible
// otherwise thanks to the default one.

func (s *HTTPSSuite) TestWithSNIDynamicConfigRouteWithChange() {
	dynamicConfFileName := s.adaptFile("fixtures/https/dynamic_https.toml", struct{}{})
	confFileName := s.adaptFile("fixtures/https/dynamic_https_sni.toml", struct {
		DynamicConfFileName string
	}{
		DynamicConfFileName: dynamicConfFileName,
	})
	s.traefikCmd(withConfigFile(confFileName))

	tr1 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         "snitest.com",
		},
	}

	tr2 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         "snitest.org",
		},
	}

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`"+tr2.TLSClientConfig.ServerName+"`)"))
	require.NoError(s.T(), err)

	backend1 := startTestServer("9010", http.StatusNoContent, "")
	backend2 := startTestServer("9020", http.StatusResetContent, "")
	defer backend1.Close()
	defer backend2.Close()

	err = try.GetRequest(backend1.URL, 500*time.Millisecond, try.StatusCodeIs(http.StatusNoContent))
	require.NoError(s.T(), err)
	err = try.GetRequest(backend2.URL, 500*time.Millisecond, try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)

	// Change certificates configuration file content
	s.modifyCertificateConfFileContent(tr1.TLSClientConfig.ServerName, dynamicConfFileName)

	req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr1.TLSClientConfig.ServerName
	req.Header.Set("Host", tr1.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 30*time.Second, tr1, try.HasCn(tr1.TLSClientConfig.ServerName), try.StatusCodeIs(http.StatusNotFound))
	require.NoError(s.T(), err)

	req, err = http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr2.TLSClientConfig.ServerName
	req.Header.Set("Host", tr2.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 30*time.Second, tr2, try.HasCn("TRAEFIK DEFAULT CERT"), try.StatusCodeIs(http.StatusNotFound))
	require.NoError(s.T(), err)
}

// TestWithSNIDynamicConfigRouteWithTlsConfigurationDeletion involves a client sending HTTPS requests with
// SNI hostnames of "snitest.org" and "snitest.com". The test verifies
// that traefik updates its configuration when the HTTPS configuration is modified, even if it totally deleted, and
// it routes the requests to the expected backends thanks to given certificate if possible
// otherwise thanks to the default one.

func (s *HTTPSSuite) TestWithSNIDynamicConfigRouteWithTlsConfigurationDeletion() {
	dynamicConfFileName := s.adaptFile("fixtures/https/dynamic_https.toml", struct{}{})
	confFileName := s.adaptFile("fixtures/https/dynamic_https_sni.toml", struct {
		DynamicConfFileName string
	}{
		DynamicConfFileName: dynamicConfFileName,
	})
	s.traefikCmd(withConfigFile(confFileName))

	tr2 := &http.Transport{
		TLSClientConfig: &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         "snitest.org",
		},
	}

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`"+tr2.TLSClientConfig.ServerName+"`)"))
	require.NoError(s.T(), err)

	backend2 := startTestServer("9020", http.StatusResetContent, "")

	defer backend2.Close()

	err = try.GetRequest(backend2.URL, 500*time.Millisecond, try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)

	req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443/", nil)
	require.NoError(s.T(), err)
	req.Host = tr2.TLSClientConfig.ServerName
	req.Header.Set("Host", tr2.TLSClientConfig.ServerName)
	req.Header.Set("Accept", "*/*")

	err = try.RequestWithTransport(req, 30*time.Second, tr2, try.HasCn(tr2.TLSClientConfig.ServerName), try.StatusCodeIs(http.StatusResetContent))
	require.NoError(s.T(), err)

	// Change certificates configuration file content
	s.modifyCertificateConfFileContent("", dynamicConfFileName)

	err = try.RequestWithTransport(req, 30*time.Second, tr2, try.HasCn("TRAEFIK DEFAULT CERT"), try.StatusCodeIs(http.StatusNotFound))
	require.NoError(s.T(), err)
}

func (s *HTTPSSuite) TestEntryPointHttpsRedirectAndPathModification() {
	file := s.adaptFile("fixtures/https/https_redirect.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 5*time.Second, try.BodyContains("Host(`example.com`)"))
	require.NoError(s.T(), err)

	client := &http.Client{
		CheckRedirect: func(req *http.Request, via []*http.Request) error {
			return http.ErrUseLastResponse
		},
	}

	testCases := []struct {
		desc  string
		hosts []string
		path  string
	}{
		{
			desc:  "Stripped URL redirect",
			hosts: []string{"example.com", "foo.com", "bar.com"},
			path:  "/api",
		},
		{
			desc:  "Stripped URL with trailing slash redirect",
			hosts: []string{"example.com", "example2.com", "foo.com", "foo2.com", "bar.com", "bar2.com"},
			path:  "/api/",
		},
		{
			desc:  "Stripped URL with path redirect",
			hosts: []string{"example.com", "example2.com", "foo.com", "foo2.com", "bar.com", "bar2.com"},
			path:  "/api/bacon",
		},
		{
			desc:  "Stripped URL with path and trailing slash redirect",
			hosts: []string{"example.com", "example2.com", "foo.com", "foo2.com", "bar.com", "bar2.com"},
			path:  "/api/bacon/",
		},
		{
			desc:  "Root Path with redirect",
			hosts: []string{"test.com", "test2.com", "pow.com", "pow2.com"},
			path:  "/",
		},
		{
			desc:  "Path modify with redirect",
			hosts: []string{"test.com", "test2.com", "pow.com", "pow2.com"},
			path:  "/wtf",
		},
		{
			desc:  "Path modify with trailing slash redirect",
			hosts: []string{"test.com", "test2.com", "pow.com", "pow2.com"},
			path:  "/wtf/",
		},
		{
			desc:  "Path modify with matching path segment redirect",
			hosts: []string{"test.com", "test2.com", "pow.com", "pow2.com"},
			path:  "/wtf/foo",
		},
	}

	for _, test := range testCases {
		sourceURL := fmt.Sprintf("http://127.0.0.1:8888%s", test.path)
		for _, host := range test.hosts {
			req, err := http.NewRequest(http.MethodGet, sourceURL, nil)
			require.NoError(s.T(), err)
			req.Host = host

			resp, err := client.Do(req)
			require.NoError(s.T(), err)
			resp.Body.Close()

			location := resp.Header.Get("Location")
			expected := "https://" + net.JoinHostPort(host, "8443") + test.path

			assert.Equal(s.T(), expected, location)
		}
	}
}

// TestWithSNIDynamicCaseInsensitive involves a client sending a SNI hostname of
// "bar.www.snitest.com", which matches the DNS SAN of '*.WWW.SNITEST.COM'. The test
// verifies that traefik presents the correct certificate.
func (s *HTTPSSuite) TestWithSNIDynamicCaseInsensitive() {
	file := s.adaptFile("fixtures/https/https_sni_case_insensitive_dynamic.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 500*time.Millisecond, try.BodyContains("HostRegexp(`{subdomain:[a-z1-9-]+}.www.snitest.com`)"))
	require.NoError(s.T(), err)

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		ServerName:         "bar.www.snitest.com",
		NextProtos:         []string{"h2", "http/1.1"},
	}
	conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
	assert.NoError(s.T(), err, "failed to connect to server")

	defer conn.Close()
	err = conn.Handshake()
	assert.NoError(s.T(), err, "TLS handshake error")

	cs := conn.ConnectionState()
	err = cs.PeerCertificates[0].VerifyHostname("*.WWW.SNITEST.COM")
	assert.NoError(s.T(), err, "certificate did not match SNI servername")

	proto := conn.ConnectionState().NegotiatedProtocol
	assert.Equal(s.T(), "h2", proto)
}

// TestWithDomainFronting verify the domain fronting behavior
func (s *HTTPSSuite) TestWithDomainFronting() {
	backend := startTestServer("9010", http.StatusOK, "server1")
	defer backend.Close()
	backend2 := startTestServer("9020", http.StatusOK, "server2")
	defer backend2.Close()
	backend3 := startTestServer("9030", http.StatusOK, "server3")
	defer backend3.Close()
	backend5 := startTestServer("9050", http.StatusOK, "server5")
	defer backend5.Close()

	file := s.adaptFile("fixtures/https/https_domain_fronting.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1000*time.Millisecond, try.BodyContains("Host(`site1.www.snitest.com`)"))
	require.NoError(s.T(), err)

	testCases := []struct {
		desc               string
		hostHeader         string
		serverName         string
		expectedContent    string
		expectedStatusCode int
	}{
		{
			desc:               "SimpleCase",
			hostHeader:         "site1.www.snitest.com",
			serverName:         "site1.www.snitest.com",
			expectedContent:    "server1",
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:               "Simple case with port in the Host Header",
			hostHeader:         "site3.www.snitest.com:4443",
			serverName:         "site3.www.snitest.com",
			expectedContent:    "server3",
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:               "Spaces after the servername",
			hostHeader:         "site3.www.snitest.com",
			serverName:         "site3.www.snitest.com ",
			expectedContent:    "server3",
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:               "Domain Fronting with same tlsOptions should follow header",
			hostHeader:         "site1.www.snitest.com",
			serverName:         "site2.www.snitest.com",
			expectedContent:    "server1",
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:               "Domain Fronting with same tlsOptions should follow header (2)",
			hostHeader:         "site2.www.snitest.com",
			serverName:         "site1.www.snitest.com",
			expectedContent:    "server2",
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:               "Domain Fronting with different tlsOptions should produce a 421",
			hostHeader:         "site2.www.snitest.com",
			serverName:         "site3.www.snitest.com",
			expectedContent:    "",
			expectedStatusCode: http.StatusMisdirectedRequest,
		},
		{
			desc:               "Domain Fronting with different tlsOptions should produce a 421 (2)",
			hostHeader:         "site3.www.snitest.com",
			serverName:         "site1.www.snitest.com",
			expectedContent:    "",
			expectedStatusCode: http.StatusMisdirectedRequest,
		},
		{
			desc:               "Case insensitive",
			hostHeader:         "sIte1.www.snitest.com",
			serverName:         "sitE1.www.snitest.com",
			expectedContent:    "server1",
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:               "Domain Fronting with ambiguous TLS options should produce a 421",
			hostHeader:         "site4.www.snitest.com",
			serverName:         "site3.www.snitest.com",
			expectedContent:    "",
			expectedStatusCode: http.StatusMisdirectedRequest,
		},
		{
			desc:               "Domain Fronting with same non-default TLS options should not produce a 421",
			hostHeader:         "site5.www.snitest.com",
			serverName:         "site3.www.snitest.com",
			expectedContent:    "server5",
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:               "FQDN host header with empty SNI to non-default TLS options route should produce a 421",
			hostHeader:         "site3.www.snitest.com.",
			serverName:         "",
			expectedContent:    "",
			expectedStatusCode: http.StatusMisdirectedRequest,
		},
		{
			desc:               "Non-FQDN host header with empty SNI matching FQDN route rule should produce a 421",
			hostHeader:         "site6.www.snitest.com",
			serverName:         "",
			expectedContent:    "",
			expectedStatusCode: http.StatusMisdirectedRequest,
		},
	}

	for _, test := range testCases {
		req, err := http.NewRequest(http.MethodGet, "https://127.0.0.1:4443", nil)
		require.NoError(s.T(), err)
		req.Host = test.hostHeader

		err = try.RequestWithTransport(req, 500*time.Millisecond, &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true, ServerName: test.serverName}}, try.StatusCodeIs(test.expectedStatusCode), try.BodyContains(test.expectedContent))
		assert.NoError(s.T(), err, "test %s failed with: %v", test.desc, err)

		err = try.RequestWithTransport(req, 500*time.Millisecond, &http3.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true, ServerName: test.serverName}}, try.StatusCodeIs(test.expectedStatusCode), try.BodyContains(test.expectedContent))
		assert.NoError(s.T(), err, "test %s failed with: %v", test.desc, err)
	}
}

// TestWithTLSOptionsConflict checks how TLS options are resolved when several routers
// target the same host (SNI), across the different conflict situations:
//   - same options on the same entryPoint: no conflict, the options are applied;
//   - different options on the same entryPoint: conflict, fallback to the default options;
//   - different options on different entryPoints: no conflict, each entryPoint keeps its
//     own options (they are selected independently on each listener);
//   - domain fronting (Host header != SNI): allowed when both resolve to the same options,
//     rejected with a 421 otherwise.
//
// The effective TLS options are probed through the negotiated TLS version: the "tls12"
// options cap the version to TLS 1.2, while the "tls13" options require at least TLS 1.3.
func (s *HTTPSSuite) TestWithTLSOptionsConflict() {
	backend := startTestServer("9010", http.StatusOK, "server1")
	defer backend.Close()

	file := s.adaptFile("fixtures/https/https_tls_options_conflict.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 1*time.Second, try.BodyContains("Host(`cross.www.snitest.com`)"))
	require.NoError(s.T(), err)

	testCases := []struct {
		desc       string
		addr       string // entryPoint address to reach
		hostHeader string
		serverName string // SNI
		minVersion uint16 // 0 means the crypto/tls library default
		maxVersion uint16 // 0 means the crypto/tls library default
		// expectHandshakeError is set when the TLS handshake itself is expected to fail
		// (i.e. the probed options reject the client's TLS version). Otherwise
		// expectedStatusCode is asserted on the HTTP response.
		expectHandshakeError bool
		expectedStatusCode   int
	}{
		// Same host, same options, same entryPoint: no conflict, the "tls12" options are applied.
		{
			desc:               "same options / same entryPoint: TLS 1.2 client is accepted",
			addr:               "127.0.0.1:4443",
			hostHeader:         "same.www.snitest.com",
			serverName:         "same.www.snitest.com",
			maxVersion:         tls.VersionTLS12,
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:                 "same options / same entryPoint: TLS 1.3 client is rejected (maxVersion TLS1.2 enforced)",
			addr:                 "127.0.0.1:4443",
			hostHeader:           "same.www.snitest.com",
			serverName:           "same.www.snitest.com",
			minVersion:           tls.VersionTLS13,
			expectHandshakeError: true,
		},

		// Same host, different options, same entryPoint: conflict, both routers fall back to the default options.
		{
			desc:               "conflicting options / same entryPoint: TLS 1.3 client is accepted (default options used)",
			addr:               "127.0.0.1:4443",
			hostHeader:         "conflict.www.snitest.com",
			serverName:         "conflict.www.snitest.com",
			minVersion:         tls.VersionTLS13,
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:               "conflicting options / same entryPoint: TLS 1.2 client is accepted (default options used)",
			addr:               "127.0.0.1:4443",
			hostHeader:         "conflict.www.snitest.com",
			serverName:         "conflict.www.snitest.com",
			maxVersion:         tls.VersionTLS12,
			expectedStatusCode: http.StatusOK,
		},

		// Same host, different options, different entryPoints: no conflict, each entryPoint keeps its own options.
		{
			desc:               "different entryPoints: websecure keeps tls12, TLS 1.2 client is accepted",
			addr:               "127.0.0.1:4443",
			hostHeader:         "cross.www.snitest.com",
			serverName:         "cross.www.snitest.com",
			maxVersion:         tls.VersionTLS12,
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:                 "different entryPoints: websecure keeps tls12, TLS 1.3 client is rejected",
			addr:                 "127.0.0.1:4443",
			hostHeader:           "cross.www.snitest.com",
			serverName:           "cross.www.snitest.com",
			minVersion:           tls.VersionTLS13,
			expectHandshakeError: true,
		},
		{
			desc:               "different entryPoints: websecure2 keeps tls13, TLS 1.3 client is accepted",
			addr:               "127.0.0.1:4444",
			hostHeader:         "cross.www.snitest.com",
			serverName:         "cross.www.snitest.com",
			minVersion:         tls.VersionTLS13,
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:                 "different entryPoints: websecure2 keeps tls13, TLS 1.2 client is rejected",
			addr:                 "127.0.0.1:4444",
			hostHeader:           "cross.www.snitest.com",
			serverName:           "cross.www.snitest.com",
			maxVersion:           tls.VersionTLS12,
			expectHandshakeError: true,
		},

		// Domain fronting (Host header != SNI) on the same entryPoint.
		{
			desc:               "domain fronting / same options: request follows the Host header (200)",
			addr:               "127.0.0.1:4443",
			hostHeader:         "df-a.www.snitest.com",
			serverName:         "df-b.www.snitest.com",
			maxVersion:         tls.VersionTLS12,
			expectedStatusCode: http.StatusOK,
		},
		{
			desc:               "domain fronting / different options: request is misdirected (421)",
			addr:               "127.0.0.1:4443",
			hostHeader:         "df-a.www.snitest.com",
			serverName:         "df-c.www.snitest.com",
			minVersion:         tls.VersionTLS13,
			expectedStatusCode: http.StatusMisdirectedRequest,
		},
	}

	for _, test := range testCases {
		tlsConfig := &tls.Config{
			InsecureSkipVerify: true,
			ServerName:         test.serverName,
			MinVersion:         test.minVersion,
			MaxVersion:         test.maxVersion,
		}

		req, err := http.NewRequest(http.MethodGet, "https://"+test.addr+"/", nil)
		require.NoError(s.T(), err)
		req.Host = test.hostHeader

		if test.expectHandshakeError {
			_, err = (&http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}).Do(req)
			assert.ErrorContains(s.T(), err, "tls:", "test %q should fail the TLS handshake", test.desc)
			continue
		}

		err = try.RequestWithTransport(req, 2*time.Second, &http.Transport{TLSClientConfig: tlsConfig}, try.StatusCodeIs(test.expectedStatusCode))
		assert.NoError(s.T(), err, "test %q failed with: %v", test.desc, err)
	}
}

// TestWithInvalidTLSOption verifies the behavior when using an invalid tlsOption configuration.
func (s *HTTPSSuite) TestWithInvalidTLSOption() {
	backend := startTestServer("9010", http.StatusOK, "server1")
	defer backend.Close()

	file := s.adaptFile("fixtures/https/https_invalid_tls_options.toml", struct{}{})
	s.traefikCmd(withConfigFile(file))

	// wait for Traefik
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", 500*time.Millisecond, try.BodyContains("Host(`snitest.com`)"))
	require.NoError(s.T(), err)

	testCases := []struct {
		desc       string
		serverName string
	}{
		{
			desc:       "With invalid TLS Options specified",
			serverName: "snitest.com",
		},
		{
			desc:       "With invalid Default TLS Options",
			serverName: "snitest.org",
		},
		{
			desc: "With TLS Options without servername (fallback to default)",
		},
	}

	for _, test := range testCases {
		tlsConfig := &tls.Config{
			InsecureSkipVerify: true,
		}
		if test.serverName != "" {
			tlsConfig.ServerName = test.serverName
		}

		conn, err := tls.Dial("tcp", "127.0.0.1:4443", tlsConfig)
		assert.Error(s.T(), err, "connected to server successfully")
		assert.Nil(s.T(), conn)
	}
}

// modifyCertificateConfFileContent replaces the content of a HTTPS configuration file.
func (s *HTTPSSuite) modifyCertificateConfFileContent(certFileName, confFileName string) {
	file, err := os.OpenFile("./"+confFileName, os.O_WRONLY, os.ModeExclusive)
	require.NoError(s.T(), err)
	defer func() {
		file.Close()
	}()
	err = file.Truncate(0)
	require.NoError(s.T(), err)

	// If certificate file is not provided, just truncate the configuration file
	if len(certFileName) > 0 {
		tlsConf := dynamic.Configuration{
			TLS: &dynamic.TLSConfiguration{
				Certificates: []*traefiktls.CertAndStores{
					{
						Certificate: traefiktls.Certificate{
							CertFile: traefiktls.FileOrContent("fixtures/https/" + certFileName + ".cert"),
							KeyFile:  traefiktls.FileOrContent("fixtures/https/" + certFileName + ".key"),
						},
					},
				},
			},
		}

		var confBuffer bytes.Buffer
		err := toml.NewEncoder(&confBuffer).Encode(tlsConf)
		require.NoError(s.T(), err)

		_, err = file.Write(confBuffer.Bytes())
		require.NoError(s.T(), err)
	}
}

func (s *SimpleSuite) TestMaxConcurrentStream() {
	file := s.adaptFile("fixtures/https/max_concurrent_stream.toml", struct{}{})

	s.traefikCmd(withConfigFile(file), "--log.level=DEBUG", "--accesslog")

	// Wait for traefik.
	err := try.GetRequest("http://127.0.0.1:8080/api/rawdata", time.Second, try.BodyContains("api@internal"))
	require.NoError(s.T(), err)

	// Add client self-signed cert.
	roots := x509.NewCertPool()
	certContent, err := os.ReadFile("./resources/tls/local.cert")
	require.NoError(s.T(), err)

	roots.AppendCertsFromPEM(certContent)

	// Open a connection to inspect SettingsFrame.
	conn, err := tls.Dial("tcp", "127.0.0.1:8000", &tls.Config{
		RootCAs:    roots,
		NextProtos: []string{"h2"},
	})
	require.NoError(s.T(), err)

	framer := http2.NewFramer(nil, conn)
	frame, err := framer.ReadFrame()
	require.NoError(s.T(), err)

	fr, ok := frame.(*http2.SettingsFrame)
	require.True(s.T(), ok)

	maxConcurrentStream, ok := fr.Value(http2.SettingMaxConcurrentStreams)
	assert.True(s.T(), ok)
	assert.Equal(s.T(), uint32(42), maxConcurrentStream)
}