test tls: allowed ou in client cert (#74)

crowdsecurity · Jun 8, 2023 · c6ae05f · c6ae05f
1 parent 3ba5d79
commit c6ae05f
Show file tree

Hide file tree

Showing 3 changed files with 23 additions and 4 deletions.
diff --git a/cmd/root.go b/cmd/root.go
@@ -160,6 +160,8 @@ func Execute() error {
 		return err
 	}
 
+	log.Infof("Starting %s %s", name, version.String())
+
 	if *testConfig {
 		log.Info("config is valid")
 		return nil

diff --git a/test/bouncer/test_custom_bouncer.py b/test/bouncer/test_custom_bouncer.py
@@ -40,7 +40,7 @@ def test_no_lapi(bouncer, cb_stream_cfg_factory):
         cb.wait_for_lines_fnmatch([
             "*connection refused*",
             "*terminating bouncer process*",
-            "*bouncer stream halted*",
+            "*process terminated with error: bouncer stream halted*",
         ])
 
 
@@ -56,9 +56,9 @@ def test_bad_api_key(crowdsec, bouncer, cb_stream_cfg_factory):
                 "*Using API key auth*",
                 "*Processing new and deleted decisions . . .*",
                 "*auth-api: auth with api key failed return nil response, error*",
-                "*bouncer stream halted*",
+                "*process terminated with error: bouncer stream halted*",
             ])
-            cb.proc.wait(timeout=0.5)
+            cb.proc.wait(timeout=1)
             assert not cb.proc.is_running()
 
 

diff --git a/test/bouncer/test_tls.py b/test/bouncer/test_tls.py
@@ -73,12 +73,29 @@ def test_tls_mutual(crowdsec, certs_dir, api_key_factory, bouncer, cb_stream_cfg
         port = cs.probe.get_bound_port('8080')
         cfg = cb_stream_cfg_factory()
         cfg['api_url'] = f'https://localhost:{port}'
+        cfg['ca_cert_path'] = (certs / 'ca.crt').as_posix()
+
+        cfg['cert_path'] = (certs / 'agent.crt').as_posix()
+        cfg['key_path'] = (certs / 'agent.key').as_posix()
+
+        with bouncer(cfg) as cb:
+            cb.wait_for_lines_fnmatch([
+                "*Starting crowdsec-custom-bouncer*",
+                "*Using CA cert*",
+                "*Using cert auth with cert * and key *",
+                "*API error: access forbidden*",
+            ])
+
+        cs.wait_for_log("*client certificate OU (?agent-ou?) doesn't match expected OU (?bouncer-ou?)*")
+
         cfg['cert_path'] = (certs / 'bouncer.crt').as_posix()
         cfg['key_path'] = (certs / 'bouncer.key').as_posix()
-        cfg['ca_cert_path'] = (certs / 'ca.crt').as_posix()
 
         with bouncer(cfg) as cb:
             cb.wait_for_lines_fnmatch([
+                "*Starting crowdsec-custom-bouncer*",
+                "*Using CA cert*",
+                "*Using cert auth with cert * and key *",
                 "*Processing new and deleted decisions . . .*",
                 "*deleting 0 decisions*",
                 "*adding 0 decisions*",