f4f3ed7c42
The code that is now into the tracex package was written a long time ago, so let's start to make it more in line with the coding style of packages that were written more recently. I didn't apply all the changes I'd like to apply in a single diff and for now I am committing just this diff. Broadly, what we need to do is: 1. improve documentation 2. ~always use pointer receivers (object receives have the issue that they are not mutable by accident meaning that you can mutate them but their state do not change after the call returns, which is potentially a source of bugs in case you later refactor to use a pointer receiver, so always use pointer receivers) 3. ~always avoid embedding (let's say we want to avoid embedding for types we define and it's instead fine to embed types that are defined in the stdlib: if later we add a new method, we will not see a broken build and we'll probably forget to add the new method to all wrappers -- conversely, if we're wrapping rather than embedding, we'll see a broken build and act accordingly) 4. prefer unit tests and group tests by type being tested rather than using a flat structure for tests There's a coverage slippage that I'll compensate in a follow-up diff where I'll focus on unit testing. Reference issue: https://github.com/ooni/probe/issues/2121
299 lines
7.6 KiB
Go
299 lines
7.6 KiB
Go
package tracex
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"reflect"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/ooni/probe-cli/v3/internal/model"
|
|
"github.com/ooni/probe-cli/v3/internal/netxlite"
|
|
)
|
|
|
|
func TestSaverTLSHandshakerSuccessWithReadWrite(t *testing.T) {
|
|
// This is the most common use case for collecting reads, writes
|
|
if testing.Short() {
|
|
t.Skip("skip test in short mode")
|
|
}
|
|
nextprotos := []string{"h2"}
|
|
saver := &Saver{}
|
|
tlsdlr := &netxlite.TLSDialerLegacy{
|
|
Config: &tls.Config{NextProtos: nextprotos},
|
|
Dialer: netxlite.NewDialerWithResolver(
|
|
model.DiscardLogger,
|
|
netxlite.NewResolverStdlib(model.DiscardLogger),
|
|
func(dialer model.Dialer) model.Dialer {
|
|
return &SaverConnDialer{
|
|
Dialer: dialer,
|
|
Saver: saver,
|
|
}
|
|
},
|
|
),
|
|
TLSHandshaker: saver.WrapTLSHandshaker(&netxlite.TLSHandshakerConfigurable{}),
|
|
}
|
|
// Implementation note: we don't close the connection here because it is
|
|
// very handy to have the last event being the end of the handshake
|
|
_, err := tlsdlr.DialTLSContext(context.Background(), "tcp", "www.google.com:443")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
ev := saver.Read()
|
|
if len(ev) < 4 {
|
|
// it's a bit tricky to be sure about the right number of
|
|
// events because network conditions may influence that
|
|
t.Fatal("unexpected number of events")
|
|
}
|
|
if ev[0].Name != "tls_handshake_start" {
|
|
t.Fatal("unexpected Name")
|
|
}
|
|
if ev[0].TLSServerName != "www.google.com" {
|
|
t.Fatal("unexpected TLSServerName")
|
|
}
|
|
if !reflect.DeepEqual(ev[0].TLSNextProtos, nextprotos) {
|
|
t.Fatal("unexpected TLSNextProtos")
|
|
}
|
|
if ev[0].Time.After(time.Now()) {
|
|
t.Fatal("unexpected Time")
|
|
}
|
|
last := len(ev) - 1
|
|
for idx := 1; idx < last; idx++ {
|
|
if ev[idx].Data == nil {
|
|
t.Fatal("unexpected Data")
|
|
}
|
|
if ev[idx].Duration <= 0 {
|
|
t.Fatal("unexpected Duration")
|
|
}
|
|
if ev[idx].Err != nil {
|
|
t.Fatal("unexpected Err")
|
|
}
|
|
if ev[idx].NumBytes <= 0 {
|
|
t.Fatal("unexpected NumBytes")
|
|
}
|
|
switch ev[idx].Name {
|
|
case netxlite.ReadOperation, netxlite.WriteOperation:
|
|
default:
|
|
t.Fatal("unexpected Name")
|
|
}
|
|
if ev[idx].Time.Before(ev[idx-1].Time) {
|
|
t.Fatal("unexpected Time")
|
|
}
|
|
}
|
|
if ev[last].Duration <= 0 {
|
|
t.Fatal("unexpected Duration")
|
|
}
|
|
if ev[last].Err != nil {
|
|
t.Fatal("unexpected Err")
|
|
}
|
|
if ev[last].Name != "tls_handshake_done" {
|
|
t.Fatal("unexpected Name")
|
|
}
|
|
if ev[last].TLSCipherSuite == "" {
|
|
t.Fatal("unexpected TLSCipherSuite")
|
|
}
|
|
if ev[last].TLSNegotiatedProto != "h2" {
|
|
t.Fatal("unexpected TLSNegotiatedProto")
|
|
}
|
|
if !reflect.DeepEqual(ev[last].TLSNextProtos, nextprotos) {
|
|
t.Fatal("unexpected TLSNextProtos")
|
|
}
|
|
if ev[last].TLSPeerCerts == nil {
|
|
t.Fatal("unexpected TLSPeerCerts")
|
|
}
|
|
if ev[last].TLSServerName != "www.google.com" {
|
|
t.Fatal("unexpected TLSServerName")
|
|
}
|
|
if ev[last].TLSVersion == "" {
|
|
t.Fatal("unexpected TLSVersion")
|
|
}
|
|
if ev[last].Time.Before(ev[last-1].Time) {
|
|
t.Fatal("unexpected Time")
|
|
}
|
|
}
|
|
|
|
func TestSaverTLSHandshakerSuccess(t *testing.T) {
|
|
if testing.Short() {
|
|
t.Skip("skip test in short mode")
|
|
}
|
|
nextprotos := []string{"h2"}
|
|
saver := &Saver{}
|
|
tlsdlr := &netxlite.TLSDialerLegacy{
|
|
Config: &tls.Config{NextProtos: nextprotos},
|
|
Dialer: &netxlite.DialerSystem{},
|
|
TLSHandshaker: saver.WrapTLSHandshaker(&netxlite.TLSHandshakerConfigurable{}),
|
|
}
|
|
conn, err := tlsdlr.DialTLSContext(context.Background(), "tcp", "www.google.com:443")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
conn.Close()
|
|
ev := saver.Read()
|
|
if len(ev) != 2 {
|
|
t.Fatal("unexpected number of events")
|
|
}
|
|
if ev[0].Name != "tls_handshake_start" {
|
|
t.Fatal("unexpected Name")
|
|
}
|
|
if ev[0].TLSServerName != "www.google.com" {
|
|
t.Fatal("unexpected TLSServerName")
|
|
}
|
|
if !reflect.DeepEqual(ev[0].TLSNextProtos, nextprotos) {
|
|
t.Fatal("unexpected TLSNextProtos")
|
|
}
|
|
if ev[0].Time.After(time.Now()) {
|
|
t.Fatal("unexpected Time")
|
|
}
|
|
if ev[1].Duration <= 0 {
|
|
t.Fatal("unexpected Duration")
|
|
}
|
|
if ev[1].Err != nil {
|
|
t.Fatal("unexpected Err")
|
|
}
|
|
if ev[1].Name != "tls_handshake_done" {
|
|
t.Fatal("unexpected Name")
|
|
}
|
|
if ev[1].TLSCipherSuite == "" {
|
|
t.Fatal("unexpected TLSCipherSuite")
|
|
}
|
|
if ev[1].TLSNegotiatedProto != "h2" {
|
|
t.Fatal("unexpected TLSNegotiatedProto")
|
|
}
|
|
if !reflect.DeepEqual(ev[1].TLSNextProtos, nextprotos) {
|
|
t.Fatal("unexpected TLSNextProtos")
|
|
}
|
|
if ev[1].TLSPeerCerts == nil {
|
|
t.Fatal("unexpected TLSPeerCerts")
|
|
}
|
|
if ev[1].TLSServerName != "www.google.com" {
|
|
t.Fatal("unexpected TLSServerName")
|
|
}
|
|
if ev[1].TLSVersion == "" {
|
|
t.Fatal("unexpected TLSVersion")
|
|
}
|
|
if ev[1].Time.Before(ev[0].Time) {
|
|
t.Fatal("unexpected Time")
|
|
}
|
|
}
|
|
|
|
func TestSaverTLSHandshakerHostnameError(t *testing.T) {
|
|
if testing.Short() {
|
|
t.Skip("skip test in short mode")
|
|
}
|
|
saver := &Saver{}
|
|
tlsdlr := &netxlite.TLSDialerLegacy{
|
|
Dialer: &netxlite.DialerSystem{},
|
|
TLSHandshaker: saver.WrapTLSHandshaker(&netxlite.TLSHandshakerConfigurable{}),
|
|
}
|
|
conn, err := tlsdlr.DialTLSContext(
|
|
context.Background(), "tcp", "wrong.host.badssl.com:443")
|
|
if err == nil {
|
|
t.Fatal("expected an error here")
|
|
}
|
|
if conn != nil {
|
|
t.Fatal("expected nil conn here")
|
|
}
|
|
for _, ev := range saver.Read() {
|
|
if ev.Name != "tls_handshake_done" {
|
|
continue
|
|
}
|
|
if ev.NoTLSVerify == true {
|
|
t.Fatal("expected NoTLSVerify to be false")
|
|
}
|
|
if len(ev.TLSPeerCerts) < 1 {
|
|
t.Fatal("expected at least a certificate here")
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSaverTLSHandshakerInvalidCertError(t *testing.T) {
|
|
if testing.Short() {
|
|
t.Skip("skip test in short mode")
|
|
}
|
|
saver := &Saver{}
|
|
tlsdlr := &netxlite.TLSDialerLegacy{
|
|
Dialer: &netxlite.DialerSystem{},
|
|
TLSHandshaker: saver.WrapTLSHandshaker(&netxlite.TLSHandshakerConfigurable{}),
|
|
}
|
|
conn, err := tlsdlr.DialTLSContext(
|
|
context.Background(), "tcp", "expired.badssl.com:443")
|
|
if err == nil {
|
|
t.Fatal("expected an error here")
|
|
}
|
|
if conn != nil {
|
|
t.Fatal("expected nil conn here")
|
|
}
|
|
for _, ev := range saver.Read() {
|
|
if ev.Name != "tls_handshake_done" {
|
|
continue
|
|
}
|
|
if ev.NoTLSVerify == true {
|
|
t.Fatal("expected NoTLSVerify to be false")
|
|
}
|
|
if len(ev.TLSPeerCerts) < 1 {
|
|
t.Fatal("expected at least a certificate here")
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSaverTLSHandshakerAuthorityError(t *testing.T) {
|
|
if testing.Short() {
|
|
t.Skip("skip test in short mode")
|
|
}
|
|
saver := &Saver{}
|
|
tlsdlr := &netxlite.TLSDialerLegacy{
|
|
Dialer: &netxlite.DialerSystem{},
|
|
TLSHandshaker: saver.WrapTLSHandshaker(&netxlite.TLSHandshakerConfigurable{}),
|
|
}
|
|
conn, err := tlsdlr.DialTLSContext(
|
|
context.Background(), "tcp", "self-signed.badssl.com:443")
|
|
if err == nil {
|
|
t.Fatal("expected an error here")
|
|
}
|
|
if conn != nil {
|
|
t.Fatal("expected nil conn here")
|
|
}
|
|
for _, ev := range saver.Read() {
|
|
if ev.Name != "tls_handshake_done" {
|
|
continue
|
|
}
|
|
if ev.NoTLSVerify == true {
|
|
t.Fatal("expected NoTLSVerify to be false")
|
|
}
|
|
if len(ev.TLSPeerCerts) < 1 {
|
|
t.Fatal("expected at least a certificate here")
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSaverTLSHandshakerNoTLSVerify(t *testing.T) {
|
|
if testing.Short() {
|
|
t.Skip("skip test in short mode")
|
|
}
|
|
saver := &Saver{}
|
|
tlsdlr := &netxlite.TLSDialerLegacy{
|
|
Config: &tls.Config{InsecureSkipVerify: true},
|
|
Dialer: &netxlite.DialerSystem{},
|
|
TLSHandshaker: saver.WrapTLSHandshaker(&netxlite.TLSHandshakerConfigurable{}),
|
|
}
|
|
conn, err := tlsdlr.DialTLSContext(
|
|
context.Background(), "tcp", "self-signed.badssl.com:443")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if conn == nil {
|
|
t.Fatal("expected non-nil conn here")
|
|
}
|
|
conn.Close()
|
|
for _, ev := range saver.Read() {
|
|
if ev.Name != "tls_handshake_done" {
|
|
continue
|
|
}
|
|
if ev.NoTLSVerify != true {
|
|
t.Fatal("expected NoTLSVerify to be true")
|
|
}
|
|
if len(ev.TLSPeerCerts) < 1 {
|
|
t.Fatal("expected at least a certificate here")
|
|
}
|
|
}
|
|
}
|