summaryrefslogtreecommitdiffstats
path: root/netwerk/test/unit/head_trr.js
diff options
context:
space:
mode:
Diffstat (limited to 'netwerk/test/unit/head_trr.js')
-rw-r--r--netwerk/test/unit/head_trr.js550
1 files changed, 550 insertions, 0 deletions
diff --git a/netwerk/test/unit/head_trr.js b/netwerk/test/unit/head_trr.js
new file mode 100644
index 0000000000..8262c735de
--- /dev/null
+++ b/netwerk/test/unit/head_trr.js
@@ -0,0 +1,550 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+/* import-globals-from head_cache.js */
+/* import-globals-from head_cookies.js */
+/* import-globals-from head_channels.js */
+/* import-globals-from head_servers.js */
+
+/* globals require, __dirname, global, Buffer, process */
+
+/// Sets the TRR related prefs and adds the certificate we use for the HTTP2
+/// server.
+function trr_test_setup() {
+ dump("start!\n");
+
+ let h2Port = Services.env.get("MOZHTTP2_PORT");
+ Assert.notEqual(h2Port, null);
+ Assert.notEqual(h2Port, "");
+
+ // Set to allow the cert presented by our H2 server
+ do_get_profile();
+
+ Services.prefs.setBoolPref("network.http.http2.enabled", true);
+ // the TRR server is on 127.0.0.1
+ if (AppConstants.platform == "android") {
+ Services.prefs.setCharPref("network.trr.bootstrapAddr", "10.0.2.2");
+ } else {
+ Services.prefs.setCharPref("network.trr.bootstrapAddr", "127.0.0.1");
+ }
+
+ // make all native resolve calls "secretly" resolve localhost instead
+ Services.prefs.setBoolPref("network.dns.native-is-localhost", true);
+
+ Services.prefs.setBoolPref("network.trr.wait-for-portal", false);
+ // don't confirm that TRR is working, just go!
+ Services.prefs.setCharPref("network.trr.confirmationNS", "skip");
+ // some tests rely on the cache not being cleared on pref change.
+ // we specifically test that this works
+ Services.prefs.setBoolPref("network.trr.clear-cache-on-pref-change", false);
+
+ // The moz-http2 cert is for foo.example.com and is signed by http2-ca.pem
+ // so add that cert to the trust list as a signing cert. // the foo.example.com domain name.
+ let certdb = Cc["@mozilla.org/security/x509certdb;1"].getService(
+ Ci.nsIX509CertDB
+ );
+ addCertFromFile(certdb, "http2-ca.pem", "CTu,u,u");
+
+ // Turn off strict fallback mode and TRR retry for most tests,
+ // it is tested specifically.
+ Services.prefs.setBoolPref("network.trr.strict_native_fallback", false);
+ Services.prefs.setBoolPref("network.trr.retry_on_recoverable_errors", false);
+
+ // Turn off temp blocklist feature in tests. When enabled we may issue a
+ // lookup to resolve a parent name when blocklisting, which may bleed into
+ // and interfere with subsequent tasks.
+ Services.prefs.setBoolPref("network.trr.temp_blocklist", false);
+
+ // We intentionally don't set the TRR mode. Each test should set it
+ // after setup in the first test.
+
+ return h2Port;
+}
+
+/// Clears the prefs that we're likely to set while testing TRR code
+function trr_clear_prefs() {
+ Services.prefs.clearUserPref("network.trr.mode");
+ Services.prefs.clearUserPref("network.trr.uri");
+ Services.prefs.clearUserPref("network.trr.credentials");
+ Services.prefs.clearUserPref("network.trr.wait-for-portal");
+ Services.prefs.clearUserPref("network.trr.allow-rfc1918");
+ Services.prefs.clearUserPref("network.trr.useGET");
+ Services.prefs.clearUserPref("network.trr.confirmationNS");
+ Services.prefs.clearUserPref("network.trr.bootstrapAddr");
+ Services.prefs.clearUserPref("network.trr.temp_blocklist_duration_sec");
+ Services.prefs.clearUserPref("network.trr.request_timeout_ms");
+ Services.prefs.clearUserPref("network.trr.request_timeout_mode_trronly_ms");
+ Services.prefs.clearUserPref("network.trr.disable-ECS");
+ Services.prefs.clearUserPref("network.trr.early-AAAA");
+ Services.prefs.clearUserPref("network.trr.excluded-domains");
+ Services.prefs.clearUserPref("network.trr.builtin-excluded-domains");
+ Services.prefs.clearUserPref("network.trr.clear-cache-on-pref-change");
+ Services.prefs.clearUserPref("network.trr.fetch_off_main_thread");
+ Services.prefs.clearUserPref("captivedetect.canonicalURL");
+
+ Services.prefs.clearUserPref("network.http.http2.enabled");
+ Services.prefs.clearUserPref("network.dns.localDomains");
+ Services.prefs.clearUserPref("network.dns.native-is-localhost");
+ Services.prefs.clearUserPref(
+ "network.trr.send_empty_accept-encoding_headers"
+ );
+ Services.prefs.clearUserPref("network.trr.strict_native_fallback");
+ Services.prefs.clearUserPref("network.trr.temp_blocklist");
+}
+
+/// This class sends a DNS query and can be awaited as a promise to get the
+/// response.
+class TRRDNSListener {
+ constructor(...args) {
+ if (args.length < 2) {
+ Assert.ok(false, "TRRDNSListener requires at least two arguments");
+ }
+ this.name = args[0];
+ if (typeof args[1] == "object") {
+ this.options = args[1];
+ } else {
+ this.options = {
+ expectedAnswer: args[1],
+ expectedSuccess: args[2] ?? true,
+ delay: args[3],
+ trrServer: args[4] ?? "",
+ expectEarlyFail: args[5] ?? "",
+ flags: args[6] ?? 0,
+ type: args[7] ?? Ci.nsIDNSService.RESOLVE_TYPE_DEFAULT,
+ port: args[8] ?? -1,
+ };
+ }
+ this.expectedAnswer = this.options.expectedAnswer ?? undefined;
+ this.expectedSuccess = this.options.expectedSuccess ?? true;
+ this.delay = this.options.delay;
+ this.promise = new Promise(resolve => {
+ this.resolve = resolve;
+ });
+ this.type = this.options.type ?? Ci.nsIDNSService.RESOLVE_TYPE_DEFAULT;
+ let trrServer = this.options.trrServer || "";
+ let port = this.options.port || -1;
+
+ // This may be called in a child process that doesn't have Services available.
+ // eslint-disable-next-line mozilla/use-services
+ const threadManager = Cc["@mozilla.org/thread-manager;1"].getService(
+ Ci.nsIThreadManager
+ );
+ const currentThread = threadManager.currentThread;
+
+ this.additionalInfo =
+ trrServer == "" && port == -1
+ ? null
+ : Services.dns.newAdditionalInfo(trrServer, port);
+ try {
+ this.request = Services.dns.asyncResolve(
+ this.name,
+ this.type,
+ this.options.flags || 0,
+ this.additionalInfo,
+ this,
+ currentThread,
+ this.options.originAttributes || {} // defaultOriginAttributes
+ );
+ Assert.ok(!this.options.expectEarlyFail, "asyncResolve ok");
+ } catch (e) {
+ Assert.ok(this.options.expectEarlyFail, "asyncResolve fail");
+ this.resolve({ error: e });
+ }
+ }
+
+ onLookupComplete(inRequest, inRecord, inStatus) {
+ Assert.ok(
+ inRequest == this.request,
+ "Checking that this is the correct callback"
+ );
+
+ // If we don't expect success here, just resolve and the caller will
+ // decide what to do with the results.
+ if (!this.expectedSuccess) {
+ this.resolve({ inRequest, inRecord, inStatus });
+ return;
+ }
+
+ Assert.equal(inStatus, Cr.NS_OK, "Checking status");
+
+ if (this.type != Ci.nsIDNSService.RESOLVE_TYPE_DEFAULT) {
+ this.resolve({ inRequest, inRecord, inStatus });
+ return;
+ }
+
+ inRecord.QueryInterface(Ci.nsIDNSAddrRecord);
+ let answer = inRecord.getNextAddrAsString();
+ Assert.equal(
+ answer,
+ this.expectedAnswer,
+ `Checking result for ${this.name}`
+ );
+ inRecord.rewind(); // In case the caller also checks the addresses
+
+ if (this.delay !== undefined) {
+ Assert.greaterOrEqual(
+ inRecord.trrFetchDurationNetworkOnly,
+ this.delay,
+ `the response should take at least ${this.delay}`
+ );
+
+ Assert.greaterOrEqual(
+ inRecord.trrFetchDuration,
+ this.delay,
+ `the response should take at least ${this.delay}`
+ );
+
+ if (this.delay == 0) {
+ // The response timing should be really 0
+ Assert.equal(
+ inRecord.trrFetchDurationNetworkOnly,
+ 0,
+ `the response time should be 0`
+ );
+
+ Assert.equal(
+ inRecord.trrFetchDuration,
+ this.delay,
+ `the response time should be 0`
+ );
+ }
+ }
+
+ this.resolve({ inRequest, inRecord, inStatus });
+ }
+
+ QueryInterface(aIID) {
+ if (aIID.equals(Ci.nsIDNSListener) || aIID.equals(Ci.nsISupports)) {
+ return this;
+ }
+ throw Components.Exception("", Cr.NS_ERROR_NO_INTERFACE);
+ }
+
+ // Implement then so we can await this as a promise.
+ then() {
+ return this.promise.then.apply(this.promise, arguments);
+ }
+
+ cancel(aStatus = Cr.NS_ERROR_ABORT) {
+ Services.dns.cancelAsyncResolve(
+ this.name,
+ this.type,
+ this.options.flags || 0,
+ this.resolverInfo,
+ this,
+ aStatus,
+ {}
+ );
+ }
+}
+
+// This is for reteriiving the raw bytes from a DNS answer.
+function answerHandler(req, resp) {
+ let searchParams = new URL(req.url, "http://example.com").searchParams;
+ console.log("req.searchParams:" + searchParams);
+ if (!searchParams.get("host")) {
+ resp.writeHead(400);
+ resp.end("Missing search parameter");
+ return;
+ }
+
+ function processRequest(req1, resp1) {
+ let domain = searchParams.get("host");
+ let type = searchParams.get("type");
+ let response = global.dns_query_answers[`${domain}/${type}`] || {};
+ let buf = global.dnsPacket.encode({
+ type: "response",
+ id: 0,
+ flags: 0,
+ questions: [],
+ answers: response.answers || [],
+ additionals: response.additionals || [],
+ });
+ let writeResponse = (resp2, buf2, context) => {
+ try {
+ let data = buf2.toString("hex");
+ resp2.setHeader("Content-Length", data.length);
+ resp2.writeHead(200, { "Content-Type": "plain/text" });
+ resp2.write(data);
+ resp2.end("");
+ } catch (e) {}
+ };
+
+ writeResponse(resp1, buf, response);
+ }
+
+ processRequest(req, resp);
+}
+
+/// This is the default handler for /dns-query
+/// It implements basic functionality for parsing the DoH packet, then
+/// queries global.dns_query_answers for available answers for the DNS query.
+function trrQueryHandler(req, resp, url) {
+ let requestBody = Buffer.from("");
+ let method = req.headers[global.http2.constants.HTTP2_HEADER_METHOD];
+ let contentLength = req.headers["content-length"];
+
+ if (method == "POST") {
+ req.on("data", chunk => {
+ requestBody = Buffer.concat([requestBody, chunk]);
+ if (requestBody.length == contentLength) {
+ processRequest(req, resp, requestBody);
+ }
+ });
+ } else if (method == "GET") {
+ if (!url.query.dns) {
+ resp.writeHead(400);
+ resp.end("Missing dns parameter");
+ return;
+ }
+
+ requestBody = Buffer.from(url.query.dns, "base64");
+ processRequest(req, resp, requestBody);
+ } else {
+ // unexpected method.
+ resp.writeHead(405);
+ resp.end("Unexpected method");
+ }
+
+ function processRequest(req1, resp1, payload) {
+ let dnsQuery = global.dnsPacket.decode(payload);
+ let domain = dnsQuery.questions[0].name;
+ let type = dnsQuery.questions[0].type;
+ let response = global.dns_query_answers[`${domain}/${type}`] || {};
+
+ if (!global.dns_query_counts[domain]) {
+ global.dns_query_counts[domain] = {};
+ }
+ global.dns_query_counts[domain][type] =
+ global.dns_query_counts[domain][type] + 1 || 1;
+
+ let flags = global.dnsPacket.RECURSION_DESIRED;
+ if (!response.answers && !response.flags) {
+ flags |= 2; // SERVFAIL
+ }
+ flags |= response.flags || 0;
+ let buf = global.dnsPacket.encode({
+ type: "response",
+ id: dnsQuery.id,
+ flags,
+ questions: dnsQuery.questions,
+ answers: response.answers || [],
+ additionals: response.additionals || [],
+ });
+
+ let writeResponse = (resp2, buf2, context) => {
+ try {
+ if (context.error) {
+ // If the error is a valid HTTP response number just write it out.
+ if (context.error < 600) {
+ resp2.writeHead(context.error);
+ resp2.end("Intentional error");
+ return;
+ }
+
+ // Bigger error means force close the session
+ req1.stream.session.close();
+ return;
+ }
+ resp2.setHeader("Content-Length", buf2.length);
+ resp2.writeHead(200, { "Content-Type": "application/dns-message" });
+ resp2.write(buf2);
+ resp2.end("");
+ } catch (e) {}
+ };
+
+ if (response.delay) {
+ // This function is handled within the httpserver where setTimeout is
+ // available.
+ // eslint-disable-next-line no-undef
+ setTimeout(
+ arg => {
+ writeResponse(arg[0], arg[1], arg[2]);
+ },
+ response.delay,
+ [resp1, buf, response]
+ );
+ return;
+ }
+
+ writeResponse(resp1, buf, response);
+ }
+}
+
+function getRequestCount(domain, type) {
+ if (!global.dns_query_counts[domain]) {
+ return 0;
+ }
+ return global.dns_query_counts[domain][type] || 0;
+}
+
+// A convenient wrapper around NodeServer
+class TRRServer extends NodeHTTP2Server {
+ /// Starts the server
+ /// @port - default 0
+ /// when provided, will attempt to listen on that port.
+ async start(port = 0) {
+ await super.start(port);
+ await this.execute(`( () => {
+ // key: string "name/type"
+ // value: array [answer1, answer2]
+ global.dns_query_answers = {};
+
+ // key: domain
+ // value: a map containing {key: type, value: number of requests}
+ global.dns_query_counts = {};
+
+ global.dnsPacket = require(\`\${__dirname}/../dns-packet\`);
+ global.ip = require(\`\${__dirname}/../node_ip\`);
+ global.http2 = require("http2");
+ })()`);
+ await this.registerPathHandler("/dns-query", trrQueryHandler);
+ await this.registerPathHandler("/dnsAnswer", answerHandler);
+ await this.execute(getRequestCount);
+ }
+
+ /// @name : string - name we're providing answers for. eg: foo.example.com
+ /// @type : string - the DNS query type. eg: "A", "AAAA", "CNAME", etc
+ /// @response : a map containing the response
+ /// answers: array of answers (hashmap) that dnsPacket can parse
+ /// eg: [{
+ /// name: "bar.example.com",
+ /// ttl: 55,
+ /// type: "A",
+ /// flush: false,
+ /// data: "1.2.3.4",
+ /// }]
+ /// additionals - array of answers (hashmap) to be added to the additional section
+ /// delay: int - if not 0 the response will be sent with after `delay` ms.
+ /// flags: int - flags to be set on the answer
+ /// error: int - HTTP status. If truthy then the response will send this status
+ async registerDoHAnswers(name, type, response = {}) {
+ let text = `global.dns_query_answers["${name}/${type}"] = ${JSON.stringify(
+ response
+ )}`;
+ return this.execute(text);
+ }
+
+ async requestCount(domain, type) {
+ return this.execute(`getRequestCount("${domain}", "${type}")`);
+ }
+}
+
+// Implements a basic HTTP2 proxy server
+class TRRProxyCode {
+ static async startServer(endServerPort) {
+ const fs = require("fs");
+ const options = {
+ key: fs.readFileSync(__dirname + "/http2-cert.key"),
+ cert: fs.readFileSync(__dirname + "/http2-cert.pem"),
+ };
+
+ const http2 = require("http2");
+ global.proxy = http2.createSecureServer(options);
+ this.setupProxy();
+ global.endServerPort = endServerPort;
+
+ await global.proxy.listen(0);
+
+ let serverPort = global.proxy.address().port;
+ return serverPort;
+ }
+
+ static closeProxy() {
+ global.proxy.closeSockets();
+ return new Promise(resolve => {
+ global.proxy.close(resolve);
+ });
+ }
+
+ static proxyRequestCount() {
+ return global.proxy_stream_count;
+ }
+
+ static setupProxy() {
+ if (!global.proxy) {
+ throw new Error("proxy is null");
+ }
+
+ global.proxy_stream_count = 0;
+
+ // We need to track active connections so we can forcefully close keep-alive
+ // connections when shutting down the proxy.
+ global.proxy.socketIndex = 0;
+ global.proxy.socketMap = {};
+ global.proxy.on("connection", function (socket) {
+ let index = global.proxy.socketIndex++;
+ global.proxy.socketMap[index] = socket;
+ socket.on("close", function () {
+ delete global.proxy.socketMap[index];
+ });
+ });
+ global.proxy.closeSockets = function () {
+ for (let i in global.proxy.socketMap) {
+ global.proxy.socketMap[i].destroy();
+ }
+ };
+
+ global.proxy.on("stream", (stream, headers) => {
+ if (headers[":method"] !== "CONNECT") {
+ // Only accept CONNECT requests
+ stream.respond({ ":status": 405 });
+ stream.end();
+ return;
+ }
+ global.proxy_stream_count++;
+ const net = require("net");
+ const socket = net.connect(global.endServerPort, "127.0.0.1", () => {
+ try {
+ stream.respond({ ":status": 200 });
+ socket.pipe(stream);
+ stream.pipe(socket);
+ } catch (exception) {
+ console.log(exception);
+ stream.close();
+ }
+ });
+ socket.on("error", error => {
+ throw new Error(
+ `Unxpected error when conneting the HTTP/2 server from the HTTP/2 proxy during CONNECT handling: '${error}'`
+ );
+ });
+ });
+ }
+}
+
+class TRRProxy {
+ // Starts the proxy
+ async start(port) {
+ info("TRRProxy start!");
+ this.processId = await NodeServer.fork();
+ info("processid=" + this.processId);
+ await this.execute(TRRProxyCode);
+ this.port = await this.execute(`TRRProxyCode.startServer(${port})`);
+ Assert.notEqual(this.port, null);
+ }
+
+ // Executes a command in the context of the node server
+ async execute(command) {
+ return NodeServer.execute(this.processId, command);
+ }
+
+ // Stops the server
+ async stop() {
+ if (this.processId) {
+ await NodeServer.execute(this.processId, `TRRProxyCode.closeProxy()`);
+ await NodeServer.kill(this.processId);
+ }
+ }
+
+ async request_count() {
+ let data = await NodeServer.execute(
+ this.processId,
+ `TRRProxyCode.proxyRequestCount()`
+ );
+ return parseInt(data);
+ }
+}