Merge branch v2.11 into v3.0

pkg/server/router/tcp/router_test.go

@@ -14,6 +14,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/go-acme/lego/v4/challenge/tlsalpn01"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/traefik/traefik/v3/pkg/config/dynamic"
@@ -22,6 +23,8 @@ import (
 	"github.com/traefik/traefik/v3/pkg/server/service/tcp"
 	tcp2 "github.com/traefik/traefik/v3/pkg/tcp"
 	traefiktls "github.com/traefik/traefik/v3/pkg/tls"
+	"github.com/traefik/traefik/v3/pkg/tls/generate"
+	"github.com/traefik/traefik/v3/pkg/types"
 )
 
 type applyRouter func(conf *runtime.Configuration)
@@ -166,11 +169,16 @@ func Test_Routing(t *testing.T) {
 	dialerManager.Update(map[string]*dynamic.TCPServersTransport{"default@internal": {}})
 	serviceManager := tcp.NewManager(conf, dialerManager)
 
+	certPEM, keyPEM, err := generate.KeyPair("foo.bar", time.Time{})
+	require.NoError(t, err)
+
 	// Creates the tlsManager and defines the TLS 1.0 and 1.2 TLSOptions.
 	tlsManager := traefiktls.NewManager()
 	tlsManager.UpdateConfigs(
 		context.Background(),
-		map[string]traefiktls.Store{},
+		map[string]traefiktls.Store{
+			tlsalpn01.ACMETLS1Protocol: {},
+		},
 		map[string]traefiktls.Options{
 			"default": {
 				MinVersion: "VersionTLS10",
@@ -185,7 +193,10 @@ func Test_Routing(t *testing.T) {
 				MaxVersion: "VersionTLS12",
 			},
 		},
-		[]*traefiktls.CertAndStores{})
+		[]*traefiktls.CertAndStores{{
+			Certificate: traefiktls.Certificate{CertFile: types.FileOrContent(certPEM), KeyFile: types.FileOrContent(keyPEM)},
+			Stores:      []string{tlsalpn01.ACMETLS1Protocol},
+		}})
 
 	middlewaresBuilder := tcpmiddleware.NewBuilder(conf.TCPMiddlewares)
 
@@ -209,6 +220,10 @@ func Test_Routing(t *testing.T) {
 			desc:    "No routers",
 			routers: []applyRouter{},
 			checks: []checkCase{
+				{
+					desc:        "ACME TLS Challenge",
+					checkRouter: checkACMETLS,
+				},
 				{
 					desc:          "TCP with client sending first bytes should fail",
 					checkRouter:   checkTCPClientFirst,
@@ -246,6 +261,16 @@ func Test_Routing(t *testing.T) {
 				},
 			},
 		},
+		{
+			desc:    "TCP TLS passthrough does not catch ACME TLS",
+			routers: []applyRouter{routerTCPTLSCatchAllPassthrough},
+			checks: []checkCase{
+				{
+					desc:        "ACME TLS Challenge",
+					checkRouter: checkACMETLS,
+				},
+			},
+		},
 		{
 			desc:    "Single TCP CatchAll router",
 			routers: []applyRouter{routerTCPCatchAll},
@@ -556,8 +581,6 @@ func Test_Routing(t *testing.T) {
 	}
 
 	for _, test := range testCases {
-		test := test
-
 		t.Run(test.desc, func(t *testing.T) {
 			t.Parallel()
 
@@ -694,6 +717,21 @@ func routerTCPTLSCatchAll(conf *runtime.Configuration) {
 	}
 }
 
+// routerTCPTLSCatchAllPassthrough a TCP TLS CatchAll Passthrough - HostSNI(`*`) router with TLS 1.0 config.
+func routerTCPTLSCatchAllPassthrough(conf *runtime.Configuration) {
+	conf.TCPRouters["tcp-tls-catchall-passthrough"] = &runtime.TCPRouterInfo{
+		TCPRouter: &dynamic.TCPRouter{
+			EntryPoints: []string{"web"},
+			Service:     "tcp",
+			Rule:        "HostSNI(`*`)",
+			TLS: &dynamic.RouterTCPTLSConfig{
+				Options:     "tls12",
+				Passthrough: true,
+			},
+		},
+	}
+}
+
 // routerTCPTLS configures a TCP TLS - HostSNI(`foo.bar`) router with TLS 1.2 config.
 func routerTCPTLS(conf *runtime.Configuration) {
 	conf.TCPRouters["tcp-tls"] = &runtime.TCPRouterInfo{
@@ -736,6 +774,33 @@ func routerHTTPS(conf *runtime.Configuration) {
 	}
 }
 
+// checkACMETLS simulates a ACME TLS Challenge client connection.
+// It returns an error if TLS handshake fails.
+func checkACMETLS(addr string, _ time.Duration) (err error) {
+	tlsConfig := &tls.Config{
+		InsecureSkipVerify: true,
+		ServerName:         "foo.bar",
+		MinVersion:         tls.VersionTLS10,
+		NextProtos:         []string{tlsalpn01.ACMETLS1Protocol},
+	}
+	conn, err := tls.Dial("tcp", addr, tlsConfig)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		closeErr := conn.Close()
+		if closeErr != nil && err == nil {
+			err = closeErr
+		}
+	}()
+
+	if conn.ConnectionState().Version != tls.VersionTLS10 {
+		return fmt.Errorf("wrong TLS version. wanted %X, got %X", tls.VersionTLS10, conn.ConnectionState().Version)
+	}
+
+	return nil
+}
+
 // checkTCPClientFirst simulates a TCP client sending first bytes first.
 // It returns an error if it doesn't receive the expected response.
 func checkTCPClientFirst(addr string, timeout time.Duration) (err error) {