Ilker ManapandClaude Opus 5.5
c522e8b2aa
Without agent_tls the control plane served plaintext h2c on every interface, and any machine reaching it could register as any node. The server now refuses to start that way unless agent_insecure: true, and then binds loopback when agent_listen names only a port. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
30 lines
875 B
Go
30 lines
875 B
Go
package cli
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/config"
|
|
"gitea.mynodes.xyz/ilker/llmgw/internal/tlsconf"
|
|
)
|
|
|
|
func TestTheAgentPortOpensWithoutTLSOnlyWhenToldAndThenOnLoopback(t *testing.T) {
|
|
cfg := config.Default()
|
|
if _, err := agentListenAddr(cfg); err == nil {
|
|
t.Error("a control plane with no agent_tls opened its agent port")
|
|
}
|
|
cfg.AgentInsecure = true
|
|
if a, _ := agentListenAddr(cfg); a != "127.0.0.1:7443" {
|
|
t.Errorf("insecure, port only: %s", a)
|
|
}
|
|
cfg.AgentListen = "10.0.0.5:7443"
|
|
if a, _ := agentListenAddr(cfg); a != "10.0.0.5:7443" {
|
|
t.Errorf("insecure, an address named: %s", a)
|
|
}
|
|
cfg.AgentInsecure = false
|
|
cfg.AgentListen = ":7443"
|
|
cfg.AgentTLS = tlsconf.Config{CA: "ca.pem", Cert: "s.pem", Key: "s-key.pem"}
|
|
if a, err := agentListenAddr(cfg); err != nil || a != ":7443" {
|
|
t.Errorf("with TLS: %s %v", a, err)
|
|
}
|
|
}
|