1
0

test_tls.py 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293
  1. # -*- coding: utf-8 -*-
  2. # Copyright 2019 New Vector Ltd
  3. # Copyright 2019 Matrix.org Foundation C.I.C.
  4. #
  5. # Licensed under the Apache License, Version 2.0 (the "License");
  6. # you may not use this file except in compliance with the License.
  7. # You may obtain a copy of the License at
  8. #
  9. # http://www.apache.org/licenses/LICENSE-2.0
  10. #
  11. # Unless required by applicable law or agreed to in writing, software
  12. # distributed under the License is distributed on an "AS IS" BASIS,
  13. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14. # See the License for the specific language governing permissions and
  15. # limitations under the License.
  16. import os
  17. import idna
  18. import yaml
  19. from OpenSSL import SSL
  20. from synapse.config._base import Config, RootConfig
  21. from synapse.config.tls import ConfigError, TlsConfig
  22. from synapse.crypto.context_factory import FederationPolicyForHTTPS
  23. from tests.unittest import TestCase
  24. class FakeServer(Config):
  25. section = "server"
  26. def has_tls_listener(self):
  27. return False
  28. class TestConfig(RootConfig):
  29. config_classes = [FakeServer, TlsConfig]
  30. class TLSConfigTests(TestCase):
  31. def test_warn_self_signed(self):
  32. """
  33. Synapse will give a warning when it loads a self-signed certificate.
  34. """
  35. config_dir = self.mktemp()
  36. os.mkdir(config_dir)
  37. with open(os.path.join(config_dir, "cert.pem"), "w") as f:
  38. f.write(
  39. """-----BEGIN CERTIFICATE-----
  40. MIID6DCCAtACAws9CjANBgkqhkiG9w0BAQUFADCBtzELMAkGA1UEBhMCVFIxDzAN
  41. BgNVBAgMBsOHb3J1bTEUMBIGA1UEBwwLQmHFn21ha8OnxLExEjAQBgNVBAMMCWxv
  42. Y2FsaG9zdDEcMBoGA1UECgwTVHdpc3RlZCBNYXRyaXggTGFiczEkMCIGA1UECwwb
  43. QXV0b21hdGVkIFRlc3RpbmcgQXV0aG9yaXR5MSkwJwYJKoZIhvcNAQkBFhpzZWN1
  44. cml0eUB0d2lzdGVkbWF0cml4LmNvbTAgFw0xNzA3MTIxNDAxNTNaGA8yMTE3MDYx
  45. ODE0MDE1M1owgbcxCzAJBgNVBAYTAlRSMQ8wDQYDVQQIDAbDh29ydW0xFDASBgNV
  46. BAcMC0JhxZ9tYWvDp8SxMRIwEAYDVQQDDAlsb2NhbGhvc3QxHDAaBgNVBAoME1R3
  47. aXN0ZWQgTWF0cml4IExhYnMxJDAiBgNVBAsMG0F1dG9tYXRlZCBUZXN0aW5nIEF1
  48. dGhvcml0eTEpMCcGCSqGSIb3DQEJARYac2VjdXJpdHlAdHdpc3RlZG1hdHJpeC5j
  49. b20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDwT6kbqtMUI0sMkx4h
  50. I+L780dA59KfksZCqJGmOsMD6hte9EguasfkZzvCF3dk3NhwCjFSOvKx6rCwiteo
  51. WtYkVfo+rSuVNmt7bEsOUDtuTcaxTzIFB+yHOYwAaoz3zQkyVW0c4pzioiLCGCmf
  52. FLdiDBQGGp74tb+7a0V6kC3vMLFoM3L6QWq5uYRB5+xLzlPJ734ltyvfZHL3Us6p
  53. cUbK+3WTWvb4ER0W2RqArAj6Bc/ERQKIAPFEiZi9bIYTwvBH27OKHRz+KoY/G8zY
  54. +l+WZoJqDhupRAQAuh7O7V/y6bSP+KNxJRie9QkZvw1PSaGSXtGJI3WWdO12/Ulg
  55. epJpAgMBAAEwDQYJKoZIhvcNAQEFBQADggEBAJXEq5P9xwvP9aDkXIqzcD0L8sf8
  56. ewlhlxTQdeqt2Nace0Yk18lIo2oj1t86Y8jNbpAnZJeI813Rr5M7FbHCXoRc/SZG
  57. I8OtG1xGwcok53lyDuuUUDexnK4O5BkjKiVlNPg4HPim5Kuj2hRNFfNt/F2BVIlj
  58. iZupikC5MT1LQaRwidkSNxCku1TfAyueiBwhLnFwTmIGNnhuDCutEVAD9kFmcJN2
  59. SznugAcPk4doX2+rL+ila+ThqgPzIkwTUHtnmjI0TI6xsDUlXz5S3UyudrE2Qsfz
  60. s4niecZKPBizL6aucT59CsunNmmb5Glq8rlAcU+1ZTZZzGYqVYhF6axB9Qg=
  61. -----END CERTIFICATE-----"""
  62. )
  63. config = {
  64. "tls_certificate_path": os.path.join(config_dir, "cert.pem"),
  65. "tls_fingerprints": [],
  66. }
  67. t = TestConfig()
  68. t.read_config(config, config_dir_path="", data_dir_path="")
  69. t.read_certificate_from_disk(require_cert_and_key=False)
  70. warnings = self.flushWarnings()
  71. self.assertEqual(len(warnings), 1)
  72. self.assertEqual(
  73. warnings[0]["message"],
  74. (
  75. "Self-signed TLS certificates will not be accepted by "
  76. "Synapse 1.0. Please either provide a valid certificate, "
  77. "or use Synapse's ACME support to provision one."
  78. ),
  79. )
  80. def test_tls_client_minimum_default(self):
  81. """
  82. The default client TLS version is 1.0.
  83. """
  84. config = {}
  85. t = TestConfig()
  86. t.read_config(config, config_dir_path="", data_dir_path="")
  87. self.assertEqual(t.federation_client_minimum_tls_version, "1")
  88. def test_tls_client_minimum_set(self):
  89. """
  90. The default client TLS version can be set to 1.0, 1.1, and 1.2.
  91. """
  92. config = {"federation_client_minimum_tls_version": 1}
  93. t = TestConfig()
  94. t.read_config(config, config_dir_path="", data_dir_path="")
  95. self.assertEqual(t.federation_client_minimum_tls_version, "1")
  96. config = {"federation_client_minimum_tls_version": 1.1}
  97. t = TestConfig()
  98. t.read_config(config, config_dir_path="", data_dir_path="")
  99. self.assertEqual(t.federation_client_minimum_tls_version, "1.1")
  100. config = {"federation_client_minimum_tls_version": 1.2}
  101. t = TestConfig()
  102. t.read_config(config, config_dir_path="", data_dir_path="")
  103. self.assertEqual(t.federation_client_minimum_tls_version, "1.2")
  104. # Also test a string version
  105. config = {"federation_client_minimum_tls_version": "1"}
  106. t = TestConfig()
  107. t.read_config(config, config_dir_path="", data_dir_path="")
  108. self.assertEqual(t.federation_client_minimum_tls_version, "1")
  109. config = {"federation_client_minimum_tls_version": "1.2"}
  110. t = TestConfig()
  111. t.read_config(config, config_dir_path="", data_dir_path="")
  112. self.assertEqual(t.federation_client_minimum_tls_version, "1.2")
  113. def test_tls_client_minimum_1_point_3_missing(self):
  114. """
  115. If TLS 1.3 support is missing and it's configured, it will raise a
  116. ConfigError.
  117. """
  118. # thanks i hate it
  119. if hasattr(SSL, "OP_NO_TLSv1_3"):
  120. OP_NO_TLSv1_3 = SSL.OP_NO_TLSv1_3
  121. delattr(SSL, "OP_NO_TLSv1_3")
  122. self.addCleanup(setattr, SSL, "SSL.OP_NO_TLSv1_3", OP_NO_TLSv1_3)
  123. assert not hasattr(SSL, "OP_NO_TLSv1_3")
  124. config = {"federation_client_minimum_tls_version": 1.3}
  125. t = TestConfig()
  126. with self.assertRaises(ConfigError) as e:
  127. t.read_config(config, config_dir_path="", data_dir_path="")
  128. self.assertEqual(
  129. e.exception.args[0],
  130. (
  131. "federation_client_minimum_tls_version cannot be 1.3, "
  132. "your OpenSSL does not support it"
  133. ),
  134. )
  135. def test_tls_client_minimum_1_point_3_exists(self):
  136. """
  137. If TLS 1.3 support exists and it's configured, it will be settable.
  138. """
  139. # thanks i hate it, still
  140. if not hasattr(SSL, "OP_NO_TLSv1_3"):
  141. SSL.OP_NO_TLSv1_3 = 0x00
  142. self.addCleanup(lambda: delattr(SSL, "OP_NO_TLSv1_3"))
  143. assert hasattr(SSL, "OP_NO_TLSv1_3")
  144. config = {"federation_client_minimum_tls_version": 1.3}
  145. t = TestConfig()
  146. t.read_config(config, config_dir_path="", data_dir_path="")
  147. self.assertEqual(t.federation_client_minimum_tls_version, "1.3")
  148. def test_tls_client_minimum_set_passed_through_1_2(self):
  149. """
  150. The configured TLS version is correctly configured by the ContextFactory.
  151. """
  152. config = {"federation_client_minimum_tls_version": 1.2}
  153. t = TestConfig()
  154. t.read_config(config, config_dir_path="", data_dir_path="")
  155. cf = FederationPolicyForHTTPS(t)
  156. options = _get_ssl_context_options(cf._verify_ssl_context)
  157. # The context has had NO_TLSv1_1 and NO_TLSv1_0 set, but not NO_TLSv1_2
  158. self.assertNotEqual(options & SSL.OP_NO_TLSv1, 0)
  159. self.assertNotEqual(options & SSL.OP_NO_TLSv1_1, 0)
  160. self.assertEqual(options & SSL.OP_NO_TLSv1_2, 0)
  161. def test_tls_client_minimum_set_passed_through_1_0(self):
  162. """
  163. The configured TLS version is correctly configured by the ContextFactory.
  164. """
  165. config = {"federation_client_minimum_tls_version": 1}
  166. t = TestConfig()
  167. t.read_config(config, config_dir_path="", data_dir_path="")
  168. cf = FederationPolicyForHTTPS(t)
  169. options = _get_ssl_context_options(cf._verify_ssl_context)
  170. # The context has not had any of the NO_TLS set.
  171. self.assertEqual(options & SSL.OP_NO_TLSv1, 0)
  172. self.assertEqual(options & SSL.OP_NO_TLSv1_1, 0)
  173. self.assertEqual(options & SSL.OP_NO_TLSv1_2, 0)
  174. def test_acme_disabled_in_generated_config_no_acme_domain_provied(self):
  175. """
  176. Checks acme is disabled by default.
  177. """
  178. conf = TestConfig()
  179. conf.read_config(
  180. yaml.safe_load(
  181. TestConfig().generate_config(
  182. "/config_dir_path",
  183. "my_super_secure_server",
  184. "/data_dir_path",
  185. tls_certificate_path="/tls_cert_path",
  186. tls_private_key_path="tls_private_key",
  187. acme_domain=None, # This is the acme_domain
  188. )
  189. ),
  190. "/config_dir_path",
  191. )
  192. self.assertFalse(conf.acme_enabled)
  193. def test_acme_enabled_in_generated_config_domain_provided(self):
  194. """
  195. Checks acme is enabled if the acme_domain arg is set to some string.
  196. """
  197. conf = TestConfig()
  198. conf.read_config(
  199. yaml.safe_load(
  200. TestConfig().generate_config(
  201. "/config_dir_path",
  202. "my_super_secure_server",
  203. "/data_dir_path",
  204. tls_certificate_path="/tls_cert_path",
  205. tls_private_key_path="tls_private_key",
  206. acme_domain="my_supe_secure_server", # This is the acme_domain
  207. )
  208. ),
  209. "/config_dir_path",
  210. )
  211. self.assertTrue(conf.acme_enabled)
  212. def test_whitelist_idna_failure(self):
  213. """
  214. The federation certificate whitelist will not allow IDNA domain names.
  215. """
  216. config = {
  217. "federation_certificate_verification_whitelist": [
  218. "example.com",
  219. "*.ドメイン.テスト",
  220. ]
  221. }
  222. t = TestConfig()
  223. e = self.assertRaises(
  224. ConfigError, t.read_config, config, config_dir_path="", data_dir_path=""
  225. )
  226. self.assertIn("IDNA domain names", str(e))
  227. def test_whitelist_idna_result(self):
  228. """
  229. The federation certificate whitelist will match on IDNA encoded names.
  230. """
  231. config = {
  232. "federation_certificate_verification_whitelist": [
  233. "example.com",
  234. "*.xn--eckwd4c7c.xn--zckzah",
  235. ]
  236. }
  237. t = TestConfig()
  238. t.read_config(config, config_dir_path="", data_dir_path="")
  239. cf = FederationPolicyForHTTPS(t)
  240. # Not in the whitelist
  241. opts = cf.get_options(b"notexample.com")
  242. self.assertTrue(opts._verifier._verify_certs)
  243. # Caught by the wildcard
  244. opts = cf.get_options(idna.encode("テスト.ドメイン.テスト"))
  245. self.assertFalse(opts._verifier._verify_certs)
  246. def _get_ssl_context_options(ssl_context: SSL.Context) -> int:
  247. """get the options bits from an openssl context object"""
  248. # the OpenSSL.SSL.Context wrapper doesn't expose get_options, so we have to
  249. # use the low-level interface
  250. return SSL._lib.SSL_CTX_get_options(ssl_context._context)