test_17_ssl_use.py 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177
  1. #!/usr/bin/env python3
  2. # -*- coding: utf-8 -*-
  3. #***************************************************************************
  4. # _ _ ____ _
  5. # Project ___| | | | _ \| |
  6. # / __| | | | |_) | |
  7. # | (__| |_| | _ <| |___
  8. # \___|\___/|_| \_\_____|
  9. #
  10. # Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  11. #
  12. # This software is licensed as described in the file COPYING, which
  13. # you should have received as part of this distribution. The terms
  14. # are also available at https://curl.se/docs/copyright.html.
  15. #
  16. # You may opt to use, copy, modify, merge, publish, distribute and/or sell
  17. # copies of the Software, and permit persons to whom the Software is
  18. # furnished to do so, under the terms of the COPYING file.
  19. #
  20. # This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  21. # KIND, either express or implied.
  22. #
  23. # SPDX-License-Identifier: curl
  24. #
  25. ###########################################################################
  26. #
  27. import difflib
  28. import filecmp
  29. import json
  30. import logging
  31. import os
  32. from datetime import timedelta
  33. import pytest
  34. from testenv import Env, CurlClient, LocalClient, ExecResult
  35. log = logging.getLogger(__name__)
  36. class TestSSLUse:
  37. @pytest.fixture(autouse=True, scope='class')
  38. def _class_scope(self, env, httpd, nghttpx):
  39. if env.have_h3():
  40. nghttpx.start_if_needed()
  41. httpd.clear_extra_configs()
  42. httpd.reload()
  43. def test_17_01_sslinfo_plain(self, env: Env, httpd, nghttpx, repeat):
  44. proto = 'http/1.1'
  45. curl = CurlClient(env=env)
  46. url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
  47. r = curl.http_get(url=url, alpn_proto=proto)
  48. assert r.json['HTTPS'] == 'on', f'{r.json}'
  49. assert 'SSL_SESSION_ID' in r.json, f'{r.json}'
  50. assert 'SSL_SESSION_RESUMED' in r.json, f'{r.json}'
  51. assert r.json['SSL_SESSION_RESUMED'] == 'Initial', f'{r.json}'
  52. @pytest.mark.parametrize("tls_max", ['1.2', '1.3'])
  53. def test_17_02_sslinfo_reconnect(self, env: Env, httpd, nghttpx, tls_max, repeat):
  54. proto = 'http/1.1'
  55. count = 3
  56. exp_resumed = 'Resumed'
  57. xargs = ['--sessionid', '--tls-max', tls_max, f'--tlsv{tls_max}']
  58. if env.curl_uses_lib('gnutls'):
  59. if tls_max == '1.3':
  60. exp_resumed = 'Initial' # 1.2 works in gnutls, but 1.3 does not, TODO
  61. if env.curl_uses_lib('libressl'):
  62. if tls_max == '1.3':
  63. exp_resumed = 'Initial' # 1.2 works in libressl, but 1.3 does not, TODO
  64. if env.curl_uses_lib('wolfssl'):
  65. xargs = ['--sessionid', f'--tlsv{tls_max}']
  66. if tls_max == '1.3':
  67. exp_resumed = 'Initial' # 1.2 works in wolfssl, but 1.3 does not, TODO
  68. if env.curl_uses_lib('rustls-ffi'):
  69. exp_resumed = 'Initial' # rustls does not support sessions, TODO
  70. if env.curl_uses_lib('bearssl') and tls_max == '1.3':
  71. pytest.skip('BearSSL does not support TLSv1.3')
  72. if env.curl_uses_lib('mbedtls') and tls_max == '1.3' and \
  73. not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
  74. pytest.skip('mbedtls does not support TLSv1.3')
  75. curl = CurlClient(env=env)
  76. # tell the server to close the connection after each request
  77. urln = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo?'\
  78. f'id=[0-{count-1}]&close'
  79. r = curl.http_download(urls=[urln], alpn_proto=proto, with_stats=True,
  80. extra_args=xargs)
  81. r.check_response(count=count, http_status=200)
  82. # should have used one connection for each request, sessions after
  83. # first should have been resumed
  84. assert r.total_connects == count, r.dump_logs()
  85. for i in range(count):
  86. dfile = curl.download_file(i)
  87. assert os.path.exists(dfile)
  88. with open(dfile) as f:
  89. djson = json.load(f)
  90. assert djson['HTTPS'] == 'on', f'{i}: {djson}'
  91. if i == 0:
  92. assert djson['SSL_SESSION_RESUMED'] == 'Initial', f'{i}: {djson}'
  93. else:
  94. assert djson['SSL_SESSION_RESUMED'] == exp_resumed, f'{i}: {djson}'
  95. # use host name with trailing dot, verify handshake
  96. @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
  97. def test_17_03_trailing_dot(self, env: Env, httpd, nghttpx, repeat, proto):
  98. if env.curl_uses_lib('gnutls'):
  99. pytest.skip("gnutls does not match hostnames with trailing dot")
  100. if proto == 'h3' and not env.have_h3():
  101. pytest.skip("h3 not supported")
  102. curl = CurlClient(env=env)
  103. domain = f'{env.domain1}.'
  104. url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
  105. r = curl.http_get(url=url, alpn_proto=proto)
  106. assert r.exit_code == 0, f'{r}'
  107. assert r.json, f'{r}'
  108. if proto != 'h3': # we proxy h3
  109. # the SNI the server received is without trailing dot
  110. assert r.json['SSL_TLS_SNI'] == env.domain1, f'{r.json}'
  111. # use host name with double trailing dot, verify handshake
  112. @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
  113. def test_17_04_double_dot(self, env: Env, httpd, nghttpx, repeat, proto):
  114. if proto == 'h3' and not env.have_h3():
  115. pytest.skip("h3 not supported")
  116. if proto == 'h3' and env.curl_uses_lib('wolfssl'):
  117. pytest.skip("wolfSSL HTTP/3 peer verification does not properly check")
  118. curl = CurlClient(env=env)
  119. domain = f'{env.domain1}..'
  120. url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
  121. r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
  122. '-H', f'Host: {env.domain1}',
  123. ])
  124. if r.exit_code == 0:
  125. assert r.json, f'{r.stdout}'
  126. # the SNI the server received is without trailing dot
  127. if proto != 'h3': # we proxy h3
  128. assert r.json['SSL_TLS_SNI'] == env.domain1, f'{r.json}'
  129. assert False, f'should not have succeeded: {r.json}'
  130. # 7 - rustls rejects a servername with .. during setup
  131. # 35 - libressl rejects setting an SNI name with trailing dot
  132. # 60 - peer name matching failed against certificate
  133. assert r.exit_code in [7, 35, 60], f'{r}'
  134. # use ip address for connect
  135. @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
  136. def test_17_05_ip_addr(self, env: Env, httpd, nghttpx, repeat, proto):
  137. if env.curl_uses_lib('bearssl'):
  138. pytest.skip("bearssl does not support cert verification with IP addresses")
  139. if env.curl_uses_lib('mbedtls'):
  140. pytest.skip("mbedtls does not support cert verification with IP addresses")
  141. if proto == 'h3' and not env.have_h3():
  142. pytest.skip("h3 not supported")
  143. curl = CurlClient(env=env)
  144. domain = f'127.0.0.1'
  145. url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
  146. r = curl.http_get(url=url, alpn_proto=proto)
  147. assert r.exit_code == 0, f'{r}'
  148. assert r.json, f'{r}'
  149. if proto != 'h3': # we proxy h3
  150. # the SNI should not have been used
  151. assert 'SSL_TLS_SNI' not in r.json, f'{r.json}'
  152. # use localhost for connect
  153. @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
  154. def test_17_06_localhost(self, env: Env, httpd, nghttpx, repeat, proto):
  155. if proto == 'h3' and not env.have_h3():
  156. pytest.skip("h3 not supported")
  157. curl = CurlClient(env=env)
  158. domain = f'localhost'
  159. url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
  160. r = curl.http_get(url=url, alpn_proto=proto)
  161. assert r.exit_code == 0, f'{r}'
  162. assert r.json, f'{r}'
  163. if proto != 'h3': # we proxy h3
  164. assert r.json['SSL_TLS_SNI'] == domain, f'{r.json}'