.github/scripts/test_docker_image.sh
#!/bin/bash

set -ex

# Config paths
CLI_VERSION="1.3.0"
CONFIG=~/.cosmian/cosmian-no-tls.toml
TLS_CONFIG=~/.cosmian/cosmian-tls.toml
KMS_URL_HTTP="http://0.0.0.0:9998"
KMS_URL_HTTPS="https://0.0.0.0:9999"

# Cert paths
CA_CERT="test_data/certificates/client_server/ca/ca.crt"
CLIENT_CERT="test_data/certificates/client_server/owner/owner.client.acme.com.crt"
CLIENT_KEY="test_data/certificates/client_server/owner/owner.client.acme.com.key"
CLIENT_PKCS12_PATH="test_data/certificates/client_server/owner/owner.client.acme.com.p12"

set -ex

# install cli
sudo apt update && sudo apt install -y wget
wget "https://package.cosmian.com/cli/$CLI_VERSION/ubuntu-24.04/cosmian-cli_$CLI_VERSION-1_amd64.deb"
sudo apt install ./"cosmian-cli_$CLI_VERSION-1_amd64.deb"
cosmian --version

# update cli conf
mkdir -p ~/.cosmian
touch $CONFIG $TLS_CONFIG

echo '
[kms_config]
print_json = false

[kms_config.http_config]
server_url = "'$KMS_URL_HTTP'"
' | tee $CONFIG

echo '
[kms_config]
print_json = false

[kms_config.http_config]
server_url = "'$KMS_URL_HTTPS'"
accept_invalid_certs = true
ssl_client_pkcs12_path = "'$CLIENT_PKCS12_PATH'"
ssl_client_pkcs12_password = "password"
' | tee $TLS_CONFIG

# Run docker containers
docker compose -f .github/scripts/docker-compose-authentication-tests.yml up -d

# Wait for the containers to be ready
sleep 10

# Function to test OpenSSL connections
openssl_test() {
    local host_port=$1
    local tls_version=$2
    echo "Testing $host_port with TLS $tls_version"
    echo "QUIT" | openssl s_client -"$tls_version" -connect "$host_port" \
        -CAfile "$CA_CERT" \
        -cert "$CLIENT_CERT" \
        -key "$CLIENT_KEY" \
        -verify_return_error \
        -brief
}

# Function to test expected TLS failures
test_tls_failure() {
    local host_port=$1
    local tls_version=$2
    local description=$3

    if openssl_test "$host_port" "$tls_version"; then
        echo "ERROR: $description - TLS $tls_version test should have failed on $host_port"
        exit 1
    else
        echo "EXPECTED: $description - TLS $tls_version correctly rejected on $host_port"
    fi
}

# Create symmetric keys
cosmian -c "$CONFIG" kms sym keys create
cosmian -c "$TLS_CONFIG" kms sym keys create

# Test TLS on HTTP server with default options
openssl_test "127.0.0.1:9999" "tls1_2"
openssl_test "127.0.0.1:9999" "tls1_3"

# Test TLS socket server with default options
openssl_test "127.0.0.1:5696" "tls1_2"
openssl_test "127.0.0.1:5696" "tls1_3"

# Test TLS on HTTP server with specific TLS1.3
test_tls_failure "127.0.0.1:10000" "tls1_2" "TLS 1.2 correctly rejected on TLS 1.3-only port 10000"
openssl_test "127.0.0.1:10000" "tls1_3"

# Test TLS socket server with specific TLS1.3
test_tls_failure "127.0.0.1:5697" "tls1_2" "TLS 1.2 correctly rejected on TLS 1.3-only port 5697"
openssl_test "127.0.0.1:5697" "tls1_3"

# Test UI endpoints
curl -I http://127.0.0.1:9998/ui/index.html
curl --insecure -I https://127.0.0.1:9999/ui/index.html
curl --insecure -I https://127.0.0.1:10000/ui/index.html
