Adding upstream version 16.2.11+ds.upstream/16.2.11+dsupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 542 insertions, 0 deletions

diff --git a/src/jaegertracing/thrift/lib/c_glib/test/testtransportsslsocket.c b/src/jaegertracing/thrift/lib/c_glib/test/testtransportsslsocket.c
new file mode 100644
index 000000000..3c2644d8d
--- /dev/null
+++ b/src/jaegertracing/thrift/lib/c_glib/test/testtransportsslsocket.c
@@ -0,0 +1,542 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+#define _POSIX_C_SOURCE 200112L /* https://stackoverflow.com/questions/37541985/storage-size-of-addrinfo-isnt-known */
+
+
+#include <sys/wait.h>
+#include <arpa/inet.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netdb.h>
+
+#include <thrift/c_glib/transport/thrift_transport.h>
+#include <thrift/c_glib/transport/thrift_buffered_transport.h>
+#include <thrift/c_glib/transport/thrift_server_transport.h>
+#include <thrift/c_glib/transport/thrift_server_socket.h>
+#include <thrift/c_glib/transport/thrift_ssl_socket.h>
+
+/* #define TEST_DATA { 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j' } */
+#define TEST_DATA { "GET / HTTP/1.1\n\n" }
+
+
+/* substituted functions to test failures of system and library calls */
+static int socket_error = 0;
+int
+my_socket(int domain, int type, int protocol)
+{
+  if (socket_error == 0)
+    {
+      return socket (domain, type, protocol);
+    }
+  return -1;
+}
+
+static int recv_error = 0;
+ssize_t
+my_recv(int socket, void *buffer, size_t length, int flags)
+{
+  if (recv_error == 0)
+    {
+      return recv (socket, buffer, length, flags);
+    }
+  return -1;
+}
+
+static int send_error = 0;
+ssize_t
+my_send(int socket, const void *buffer, size_t length, int flags)
+{
+  if (send_error == 0)
+    {
+      return send (socket, buffer, length, flags);
+    }
+  return -1;
+}
+
+#define socket my_socket
+#define recv my_recv
+#define send my_send
+#include "../src/thrift/c_glib/transport/thrift_ssl_socket.c"
+#undef socket
+#undef recv
+#undef send
+
+static void thrift_socket_server (const int port);
+
+/* test object creation and destruction */
+static void
+test_ssl_create_and_destroy(void)
+{
+  gchar *hostname = NULL;
+  guint port = 0;
+
+  GObject *object = NULL;
+  object = g_object_new (THRIFT_TYPE_SSL_SOCKET, NULL);
+  g_assert (object != NULL);
+  g_object_get (G_OBJECT(object), "hostname", &hostname, "port", &port, NULL);
+  g_free (hostname);
+  g_object_unref (object);
+}
+
+static void
+test_ssl_create_and_set_properties(void)
+{
+  gchar *hostname = NULL;
+  guint port = 0;
+  SSL_CTX* ssl_ctx= NULL;
+  GError *error=NULL;
+
+  GObject *object = NULL;
+  object = thrift_ssl_socket_new(SSLTLS, &error);
+  g_object_get (G_OBJECT(object), "hostname", &hostname, "port", &port, "ssl_context", &ssl_ctx, NULL);
+  g_assert (ssl_ctx!=NULL);
+
+  g_free (hostname);
+  g_object_unref (object);
+}
+
+static void
+test_ssl_open_and_close_non_ssl_server(void)
+{
+  ThriftSSLSocket *tSSLSocket = NULL;
+  ThriftTransport *transport = NULL;
+  GError *error=NULL;
+  pid_t pid;
+  int non_ssl_port = 51198;
+  char errormsg[255];
+
+
+  pid = fork ();
+  g_assert ( pid >= 0 );
+
+  if ( pid == 0 )
+    {
+      /* child listens */
+      /* This is a non SSL server */
+      thrift_socket_server (non_ssl_port);
+      exit (0);
+    } else {
+	/* parent connects, wait a bit for the socket to be created */
+	sleep (1);
+
+	/* open a connection and close it */
+	tSSLSocket = thrift_ssl_socket_new_with_host(SSLTLS, "localhost", non_ssl_port, &error);
+
+	transport = THRIFT_TRANSPORT (tSSLSocket);
+	g_assert (thrift_ssl_socket_open (transport, &error) == FALSE);
+	g_assert_cmpstr(error->message, == ,"Error while connect/bind: 68 -> Connection reset by peer");
+	g_clear_error (&error);
+	g_assert (thrift_ssl_socket_is_open (transport) == FALSE);
+	thrift_ssl_socket_close (transport, NULL);
+	g_assert (thrift_ssl_socket_is_open (transport) == FALSE);
+
+	/* test close failure */
+	THRIFT_SOCKET(tSSLSocket)->sd = -1;
+	thrift_ssl_socket_close (transport, NULL);
+	g_object_unref (tSSLSocket);
+
+	/* try a hostname lookup failure */
+	tSSLSocket = thrift_ssl_socket_new_with_host(SSLTLS, "localhost.broken", non_ssl_port, &error);
+	transport = THRIFT_TRANSPORT (tSSLSocket);
+	g_assert (thrift_ssl_socket_open (transport, &error) == FALSE);
+	snprintf(errormsg, 255, "host lookup failed for localhost.broken:%d - Unknown host", non_ssl_port);
+	g_assert_cmpstr(error->message, ==, errormsg);
+	g_clear_error (&error);
+	g_object_unref (tSSLSocket);
+	error = NULL;
+
+		/* try an error call to socket() */
+	/*
+		tSSLSocket = thrift_ssl_socket_new_with_host(SSLTLS, "localhost", port, &error);
+		transport = THRIFT_TRANSPORT (tSSLSocket);
+		socket_error = 1;
+		assert (thrift_ssl_socket_open (transport, &error) == FALSE);
+		socket_error = 0;
+		g_object_unref (tSSLSocket);
+		g_error_free (error);
+	 */
+    }
+}
+
+static void
+test_ssl_write_invalid_socket(void)
+{
+  ThriftSSLSocket *tSSLSocket = NULL;
+  ThriftTransport *transport = NULL;
+  GError *error=NULL;
+  char buffer[] = "this must not break";
+
+  /* open a connection and close it */
+  tSSLSocket = thrift_ssl_socket_new_with_host(SSLTLS, "localhost", 51188+1, &error);
+
+  transport = THRIFT_TRANSPORT (tSSLSocket);
+  g_assert (thrift_ssl_socket_open (transport, NULL) == FALSE);
+  g_assert (thrift_ssl_socket_is_open (transport) == FALSE);
+
+  /* FIXME This must be tested but since the assertion inside thrift_ssl_socket_write breaks the test unit
+   it's disabled. They idea is to disable trap/coredump during this test
+  g_assert (thrift_ssl_socket_write(transport, buffer, sizeof(buffer), &error) == FALSE);
+  g_message ("write_failed_with_error: %s",
+	     error != NULL ? error->message : "No");
+  g_clear_error (&error);
+  */
+  thrift_ssl_socket_close (transport, NULL);
+  g_assert (thrift_ssl_socket_is_open (transport) == FALSE);
+
+  /* test close failure */
+  THRIFT_SOCKET(tSSLSocket)->sd = -1;
+  thrift_ssl_socket_close (transport, NULL);
+  g_object_unref (tSSLSocket);
+}
+
+
+
+/**
+ * Print the common name of certificate
+ */
+unsigned char * get_cn_name(X509_NAME* const name)
+{
+  int idx = -1;
+  unsigned char *utf8 = NULL;
+
+  do
+    {
+      if(!name) break; /* failed */
+
+      idx = X509_NAME_get_index_by_NID(name, NID_commonName, -1);
+      if(!(idx > -1))  break; /* failed */
+
+      X509_NAME_ENTRY* entry = X509_NAME_get_entry(name, idx);
+      if(!entry) break; /* failed */
+
+      ASN1_STRING* data = X509_NAME_ENTRY_get_data(entry);
+      if(!data) break; /* failed */
+
+      int length = ASN1_STRING_to_UTF8(&utf8, data);
+      if(!utf8 || !(length > 0))  break; /* failed */
+
+    } while (0);
+  return utf8;
+}
+
+/*
+ * Handle IPV4 and IPV6 addr
+ */
+void *get_in_addr(struct sockaddr *sa)
+{
+  if (sa->sa_family == AF_INET)
+    return &(((struct sockaddr_in*)sa)->sin_addr);
+  return &(((struct sockaddr_in6*)sa)->sin6_addr);
+}
+
+int verify_ip(char * hostname, struct sockaddr_storage *addr)
+{
+  struct addrinfo *addr_info,*p;
+  struct addrinfo hints;
+  int res;
+  int retval = 0;
+
+
+  memset(&hints, 0, sizeof (struct addrinfo));
+  hints.ai_family = AF_UNSPEC; /* use AF_INET6 to force IPv6 */
+  hints.ai_socktype = SOCK_STREAM;
+
+
+  if ( (res = getaddrinfo(hostname, NULL, &hints, &addr_info) ) != 0)
+    {
+      /* get the host info */
+      g_error("Cannot get the host address");
+      return retval;
+    }
+  /* loop through all the results and connect to the first we can */
+  char dnshost[INET6_ADDRSTRLEN]; /* bigger addr supported IPV6 */
+  char socket_ip[INET6_ADDRSTRLEN];
+  if(inet_ntop(addr->ss_family, get_in_addr(addr), socket_ip, INET6_ADDRSTRLEN)==socket_ip){
+      g_debug("We are connected to host %s checking against certificate...", socket_ip);
+      int sizeip = socket_ip!=NULL ? strlen(socket_ip) : 0;
+      for(p = addr_info; p != NULL; p = p->ai_next) {
+	  if(inet_ntop(p->ai_family, get_in_addr((struct sockaddr *)p->ai_addr), dnshost, INET6_ADDRSTRLEN)==dnshost){
+	      if(dnshost!=NULL){
+		  g_info("DNS address [%i -> %s]", p->ai_addr, dnshost);
+		  if(!strncmp(dnshost, socket_ip, sizeip)){
+		      retval=1;
+		      break; /* if we get here, we must have connected successfully */
+		  }
+	      }
+	  }
+      }
+  }
+
+  if(addr_info)
+    freeaddrinfo(addr_info);
+
+  return retval;
+}
+
+static void
+read_from_file(char *buffer, long size, const char *file_name)
+{
+  char ch;
+  long index=0;
+  FILE *fp;
+
+  fp = fopen(file_name,"r"); /* read mode */
+
+  if( fp == NULL )
+    {
+      perror("Error while opening the file.\n");
+      exit(EXIT_FAILURE);
+    }
+
+  printf("The contents of %s file are :\n", file_name);
+
+  while(index<size && ( ch = fgetc(fp) ) != EOF ){
+      buffer[index++] = ch;
+  }
+
+  fclose(fp);
+}
+
+#define ISSUER_CN_PINNING "The Apache Software Foundation"
+#define SUBJECT_CN_PINNING "localhost"
+#define CERT_SERIAL_NUMBER "1"
+
+gboolean verify_certificate_sn(X509 *cert, const unsigned char *serial_number)
+{
+  gboolean retval = FALSE;
+
+  ASN1_INTEGER *serial = X509_get_serialNumber(cert);
+
+  BIGNUM *bn = ASN1_INTEGER_to_BN(serial, NULL);
+  if (!bn) {
+      fprintf(stderr, "unable to convert ASN1INTEGER to BN\n");
+      return EXIT_FAILURE;
+  }
+  char *tmp = BN_bn2dec(bn);
+  if (!tmp) {
+      g_warning(stderr, "unable to convert BN to decimal string.\n");
+      BN_free(bn);
+      return EXIT_FAILURE;
+  }
+  /*
+    if (strlen(tmp) >= len) {
+      g_warn(stderr, "buffer length shorter than serial number\n");
+      BN_free(bn);
+      OPENSSL_free(tmp);
+      return EXIT_FAILURE;
+    }
+  */
+  if(!strncmp(serial_number, tmp, strlen(serial_number))){
+      retval=TRUE;
+  }else{
+      g_warning("Serial number is not valid");
+  }
+
+  BN_free(bn);
+  OPENSSL_free(tmp);
+  return retval;
+}
+
+gboolean my_access_manager(ThriftTransport * transport, X509 *cert, struct sockaddr_storage *addr, GError **error)
+{
+  ThriftSSLSocket *sslSocket = THRIFT_SSL_SOCKET (transport);
+
+  g_info("Processing access to the server");
+  X509_NAME* iname = cert ? X509_get_issuer_name(cert) : NULL;
+  X509_NAME* sname = cert ? X509_get_subject_name(cert) : NULL;
+
+  /* Issuer is the authority we trust that warrants nothing useful */
+  const unsigned char * issuer = get_cn_name(iname);
+  if(issuer){
+      gboolean valid = TRUE;
+      g_info("Issuer (cn) %s", issuer);
+
+      /* Issuer pinning */
+      if(strncmp(ISSUER_CN_PINNING, issuer, strlen(ISSUER_CN_PINNING))){
+	  g_warning("The Issuer of the certificate is not valid");
+	  valid=FALSE;
+      }
+      OPENSSL_free(issuer);
+      if(!valid)
+	return valid;
+  }
+
+
+  /* Subject is who the certificate is issued to by the authority  */
+  const unsigned char * subject = get_cn_name(sname);
+  if(subject){
+      g_info("Subject (cn) %s", subject);
+      gboolean valid = TRUE;
+
+      /* Subject pinning */
+      if(strncmp(SUBJECT_CN_PINNING, subject, strlen(SUBJECT_CN_PINNING))){
+	  g_warning("The subject of the certificate is not valid");
+	  valid=FALSE;
+      }
+
+      if(!valid)
+	return valid;
+
+      /* Host pinning       */
+      if(verify_ip(subject, addr)){
+	  g_info("Verified subject");
+      }else{
+	  g_info("Cannot verify subject");
+	  valid=FALSE;
+      }
+      OPENSSL_free(subject);
+
+      if(!valid)
+	return valid;
+  }
+
+  if(!verify_certificate_sn(cert, CERT_SERIAL_NUMBER)){
+      return FALSE;
+  }else{
+      g_info("Verified serial number");
+  }
+
+  return TRUE;
+
+}
+
+
+
+
+#ifdef BUILD_SERVER
+static void
+test_ssl_authorization_manager(void)
+{
+  int status=0;
+  pid_t pid;
+  ThriftSSLSocket *tSSLsocket = NULL;
+  ThriftTransport *transport = NULL;
+  /*  int port = 51199; */
+  int port = 443;
+  GError *error=NULL;
+
+  guchar buf[17] = TEST_DATA; /* a buffer */
+
+/*
+  pid = fork ();
+    g_assert ( pid >= 0 );
+
+    if ( pid == 0 )
+    {
+      thrift_ssl_socket_server (port);
+      exit (0);
+    } else {
+	*/
+  /* parent connects, wait a bit for the socket to be created */
+  sleep (1);
+
+  /* Test against level2 owncloud certificate */
+  tSSLsocket = thrift_ssl_socket_new_with_host(SSLTLS, "localhost", port, &error);
+  thrift_ssl_socket_set_manager(tSSLsocket, my_access_manager);           /* Install pinning manager */
+  /* thrift_ssl_load_cert_from_file(tSSLsocket, "./owncloud.level2crm.pem"); */
+  unsigned char cert_buffer[65534];
+  read_from_file(cert_buffer, 65534, "../../keys/client.pem");
+  if(!thrift_ssl_load_cert_from_buffer(tSSLsocket, cert_buffer)){
+      g_warning("Certificates cannot be loaded!");
+  }
+
+  transport = THRIFT_TRANSPORT (tSSLsocket);
+  g_assert (thrift_ssl_socket_open (transport, NULL) == TRUE);
+  g_assert (thrift_ssl_socket_is_open (transport));
+
+  thrift_ssl_socket_write (transport, buf, 17, NULL);
+
+  /* write fail */
+  send_error = 1;
+  /*
+      thrift_ssl_socket_write (transport, buf, 1, NULL);
+     send_error = 0;
+      thrift_ssl_socket_write_end (transport, NULL);
+      thrift_ssl_socket_flush (transport, NULL);
+      */
+  thrift_ssl_socket_close (transport, NULL);
+  g_object_unref (tSSLsocket);
+
+  /*    g_assert ( wait (&status) == pid ); */
+  g_assert ( status == 0 );
+  /*  } */
+}
+#endif
+
+
+static void
+thrift_socket_server (const int port)
+{
+  int bytes = 0;
+  ThriftServerTransport *transport = NULL;
+  ThriftTransport *client = NULL;
+  guchar buf[10]; /* a buffer */
+  guchar match[10] = TEST_DATA;
+
+  ThriftServerSocket *tsocket = g_object_new (THRIFT_TYPE_SERVER_SOCKET,
+					      "port", port, NULL);
+
+  transport = THRIFT_SERVER_TRANSPORT (tsocket);
+  thrift_server_transport_listen (transport, NULL);
+  client = thrift_server_transport_accept (transport, NULL);
+  g_assert (client != NULL);
+
+  /* read 10 bytes */
+  bytes = thrift_ssl_socket_read (client, buf, 10, NULL);
+  g_assert (bytes == 10); /* make sure we've read 10 bytes */
+  g_assert ( memcmp(buf, match, 10) == 0 ); /* make sure what we got matches */
+
+  /* failed read */
+  recv_error = 1;
+  thrift_ssl_socket_read (client, buf, 1, NULL);
+  recv_error = 0;
+
+  thrift_ssl_socket_read_end (client, NULL);
+  thrift_ssl_socket_close (client, NULL);
+  g_object_unref (tsocket);
+  g_object_unref (client);
+}
+
+int
+main(int argc, char *argv[])
+{
+  int retval;
+#if (!GLIB_CHECK_VERSION (2, 36, 0))
+  g_type_init();
+#endif
+
+  g_test_init (&argc, &argv, NULL);
+
+  thrift_ssl_socket_initialize_openssl();
+
+  g_test_add_func ("/testtransportsslsocket/CreateAndDestroy", test_ssl_create_and_destroy);
+  g_test_add_func ("/testtransportsslsocket/CreateAndSetProperties", test_ssl_create_and_set_properties);
+  g_test_add_func ("/testtransportsslsocket/OpenAndCloseNonSSLServer", test_ssl_open_and_close_non_ssl_server);
+  g_test_add_func ("/testtransportsslsocket/OpenAndWriteInvalidSocket", test_ssl_write_invalid_socket);
+
+
+
+
+  retval = g_test_run ();
+
+  thrift_ssl_socket_finalize_openssl();
+
+  return retval;
+}
+