bergamot
731b60863a
Tunnel method now requires Bearer JWT (HMAC-HS256) in gRPC metadata.
- internal/auth: pure-stdlib verifier + issuer + revoked-jti list
- internal/tunnel: per-target rate limiter + egress allowlist with
wildcard support + crypto/rand frame padding to {1KB, 4KB, 16KB}
- cmd/server reads /etc/stats-gateway/{jwt.key,tunnel.yaml,revoked.txt}
via --config-dir flag
- cmd/issue-token Go binary wraps auth.Issue
- configs/tunnel.yaml example with projectshitpost wildcard
Tests: 13 PASS across 5 packages.
23 lines
571 B
Go
23 lines
571 B
Go
package tunnel
|
|
|
|
import "testing"
|
|
|
|
func TestAllowEgress(t *testing.T) {
|
|
cfg := EgressConfig{Allowed: []string{"192.0.2.10:8443", "*.projectshitpost.fun:443"}}
|
|
cases := []struct {
|
|
target string
|
|
want bool
|
|
}{
|
|
{"192.0.2.10:8443", true},
|
|
{"foo.projectshitpost.fun:443", true},
|
|
{"projectshitpost.fun:443", false}, // wildcard "*.x" doesn't match bare "x"
|
|
{"8.8.8.8:53", false},
|
|
{"192.0.2.10:22", false},
|
|
}
|
|
for _, tc := range cases {
|
|
if got := cfg.Allow(tc.target); got != tc.want {
|
|
t.Errorf("Allow(%q) = %v, want %v", tc.target, got, tc.want)
|
|
}
|
|
}
|
|
}
|