c/ooni-probe-cli
Watch
1
0
Fork
You've already forked ooni-probe-cli
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(netxlite): improve TLS auto-configuration (#409)

Browse source 
Auto-configure every relevant TLS field as close as possible to
where it's actually used.

As a side effect, add support for mocking the creation of a TLS
connection, which should possibly be useful for uTLS?

Work that is part of https://github.com/ooni/probe/issues/1505
This commit is contained in:
Simone Basso 2021-06-25 20:51:59 +02:00 • committed by GitHub
commit b07890af4d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
16 changed files with 360 additions and 89 deletions
Download patch file Download diff file Expand all files Collapse all files

34
internal/netxlite/tlsdialer_test.go
View file

@ -3,7 +3,6 @@ package netxlite
import (
"context"
"crypto/tls"
"crypto/x509"
"errors"
"io"
"net"
@ -54,7 +53,7 @@ func TestTLSDialerFailureHandshaking(t *testing.T) {
return nil
}}, nil
}},
TLSHandshaker: &TLSHandshakerStdlib{},
TLSHandshaker: &TLSHandshakerConfigurable{},
}
conn, err := dialer.DialTLSContext(ctx, "tcp", "www.google.com:443")
if !errors.Is(err, io.EOF) {
@ -99,9 +98,6 @@ func TestTLSDialerConfigFromEmptyConfigForWeb(t *testing.T) {
if config.ServerName != "www.google.com" {
t.Fatal("invalid server name")
}
if config.RootCAs == nil {
t.Fatal("expected non-nil root CAs")
}
if diff := cmp.Diff(config.NextProtos, []string{"h2", "http/1.1"}); diff != "" {
t.Fatal(diff)
}
@ -113,9 +109,6 @@ func TestTLSDialerConfigFromEmptyConfigForDoT(t *testing.T) {
if config.ServerName != "dns.google" {
t.Fatal("invalid server name")
}
if config.RootCAs == nil {
t.Fatal("expected non-nil root CAs")
}
if diff := cmp.Diff(config.NextProtos, []string{"dot"}); diff != "" {
t.Fatal(diff)
}
@ -131,9 +124,6 @@ func TestTLSDialerConfigWithServerName(t *testing.T) {
if config.ServerName != "example.com" {
t.Fatal("invalid server name")
}
if config.RootCAs == nil {
t.Fatal("expected non-nil root CAs")
}
if diff := cmp.Diff(config.NextProtos, []string{"dot"}); diff != "" {
t.Fatal(diff)
}
@ -149,29 +139,7 @@ func TestTLSDialerConfigWithALPN(t *testing.T) {
if config.ServerName != "dns.google" {
t.Fatal("invalid server name")
}
if config.RootCAs == nil {
t.Fatal("expected non-nil root CAs")
}
if diff := cmp.Diff(config.NextProtos, []string{"h2"}); diff != "" {
t.Fatal(diff)
}
}
func TestTLSDialerConfigWithRootCA(t *testing.T) {
pool := &x509.CertPool{}
d := &TLSDialer{
Config: &tls.Config{
RootCAs: pool,
},
}
config := d.config("dns.google", "853")
if config.ServerName != "dns.google" {
t.Fatal("invalid server name")
}
if config.RootCAs != pool {
t.Fatal("not the RootCAs we expected")
}
if diff := cmp.Diff(config.NextProtos, []string{"dot"}); diff != "" {
t.Fatal(diff)
}
}