diff options
Diffstat (limited to 'netwerk/test/unit/test_httpssvc_ech_with_alpn.js')
| -rw-r--r-- | netwerk/test/unit/test_httpssvc_ech_with_alpn.js | 246 |
1 files changed, 246 insertions, 0 deletions
diff --git a/netwerk/test/unit/test_httpssvc_ech_with_alpn.js b/netwerk/test/unit/test_httpssvc_ech_with_alpn.js new file mode 100644 index 0000000000..bd41eec964 --- /dev/null +++ b/netwerk/test/unit/test_httpssvc_ech_with_alpn.js @@ -0,0 +1,246 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +"use strict"; + +let trrServer; + +const certOverrideService = Cc[ + "@mozilla.org/security/certoverride;1" +].getService(Ci.nsICertOverrideService); + +add_setup(async function setup() { + // Allow telemetry probes which may otherwise be disabled for some + // applications (e.g. Thunderbird). + Services.prefs.setBoolPref( + "toolkit.telemetry.testing.overrideProductsCheck", + true + ); + + trr_test_setup(); + + Services.prefs.setBoolPref("network.dns.upgrade_with_https_rr", true); + Services.prefs.setBoolPref("network.dns.use_https_rr_as_altsvc", true); + Services.prefs.setBoolPref("network.dns.echconfig.enabled", true); + Services.prefs.setBoolPref("network.dns.http3_echconfig.enabled", false); + Services.prefs.setIntPref("network.http.speculative-parallel-limit", 0); + Services.prefs.setIntPref("network.trr.mode", Ci.nsIDNSService.MODE_TRRONLY); + + // Set the server to always select http/1.1 + Services.env.set("MOZ_TLS_ECH_ALPN_FLAG", 1); + + await asyncStartTLSTestServer( + "EncryptedClientHelloServer", + "../../../security/manager/ssl/tests/unit/test_encrypted_client_hello" + ); +}); + +registerCleanupFunction(async () => { + trr_clear_prefs(); + Services.prefs.clearUserPref("network.trr.mode"); + Services.prefs.clearUserPref("network.trr.uri"); + Services.prefs.clearUserPref("network.dns.upgrade_with_https_rr"); + Services.prefs.clearUserPref("network.dns.use_https_rr_as_altsvc"); + Services.prefs.clearUserPref("network.dns.echconfig.enabled"); + Services.prefs.clearUserPref("network.dns.http3_echconfig.enabled"); + Services.prefs.clearUserPref( + "network.dns.echconfig.fallback_to_origin_when_all_failed" + ); + Services.prefs.clearUserPref("network.http.speculative-parallel-limit"); + Services.prefs.clearUserPref("network.dns.port_prefixed_qname_https_rr"); + Services.env.set("MOZ_TLS_ECH_ALPN_FLAG", ""); + if (trrServer) { + await trrServer.stop(); + } +}); + +function makeChan(url) { + let chan = NetUtil.newChannel({ + uri: url, + loadUsingSystemPrincipal: true, + contentPolicyType: Ci.nsIContentPolicy.TYPE_DOCUMENT, + }).QueryInterface(Ci.nsIHttpChannel); + return chan; +} + +function channelOpenPromise(chan, flags) { + return new Promise(resolve => { + function finish(req, buffer) { + certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData( + false + ); + resolve([req, buffer]); + } + certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData( + true + ); + let internal = chan.QueryInterface(Ci.nsIHttpChannelInternal); + internal.setWaitForHTTPSSVCRecord(); + chan.asyncOpen(new ChannelListener(finish, null, flags)); + }); +} + +function ActivityObserver() {} + +ActivityObserver.prototype = { + activites: [], + observeConnectionActivity( + aHost, + aPort, + aSSL, + aHasECH, + aIsHttp3, + aActivityType, + aActivitySubtype, + aTimestamp, + aExtraStringData + ) { + dump( + "*** Connection Activity 0x" + + aActivityType.toString(16) + + " 0x" + + aActivitySubtype.toString(16) + + " " + + aExtraStringData + + "\n" + ); + this.activites.push({ host: aHost, subType: aActivitySubtype }); + }, +}; + +function checkHttpActivities(activites) { + let foundDNSAndSocket = false; + let foundSettingECH = false; + let foundConnectionCreated = false; + for (let activity of activites) { + switch (activity.subType) { + case Ci.nsIHttpActivityObserver.ACTIVITY_SUBTYPE_DNSANDSOCKET_CREATED: + case Ci.nsIHttpActivityObserver + .ACTIVITY_SUBTYPE_SPECULATIVE_DNSANDSOCKET_CREATED: + foundDNSAndSocket = true; + break; + case Ci.nsIHttpActivityDistributor.ACTIVITY_SUBTYPE_ECH_SET: + foundSettingECH = true; + break; + case Ci.nsIHttpActivityDistributor.ACTIVITY_SUBTYPE_CONNECTION_CREATED: + foundConnectionCreated = true; + break; + default: + break; + } + } + + Assert.equal(foundDNSAndSocket, true, "Should have one DnsAndSock created"); + Assert.equal(foundSettingECH, true, "Should have echConfig"); + Assert.equal( + foundConnectionCreated, + true, + "Should have one connection created" + ); +} + +async function testWrapper(alpnAdvertisement) { + const ECH_CONFIG_FIXED = + "AEn+DQBFTQAgACCKB1Y5SfrGIyk27W82xPpzWTDs3q72c04xSurDWlb9CgAEAAEAA2QWZWNoLXB1YmxpYy5leGFtcGxlLmNvbQAA"; + trrServer = new TRRServer(); + await trrServer.start(); + + let observerService = Cc[ + "@mozilla.org/network/http-activity-distributor;1" + ].getService(Ci.nsIHttpActivityDistributor); + let observer = new ActivityObserver(); + observerService.addObserver(observer); + observerService.observeConnection = true; + + Services.prefs.setCharPref( + "network.trr.uri", + `https://foo.example.com:${trrServer.port}/dns-query` + ); + + // Only the last record is valid to use. + await trrServer.registerDoHAnswers("ech-private.example.com", "HTTPS", { + answers: [ + { + name: "ech-private.example.com", + ttl: 55, + type: "HTTPS", + flush: false, + data: { + priority: 1, + name: "ech-private.example.com", + values: [ + { key: "alpn", value: alpnAdvertisement }, + { key: "port", value: 8443 }, + { + key: "echconfig", + value: ECH_CONFIG_FIXED, + needBase64Decode: true, + }, + ], + }, + }, + ], + }); + + await trrServer.registerDoHAnswers("ech-private.example.com", "A", { + answers: [ + { + name: "ech-private.example.com", + ttl: 55, + type: "A", + flush: false, + data: "127.0.0.1", + }, + ], + }); + + await new TRRDNSListener("ech-private.example.com", { + type: Ci.nsIDNSService.RESOLVE_TYPE_HTTPSSVC, + }); + + HandshakeTelemetryHelpers.resetHistograms(); + let chan = makeChan(`https://ech-private.example.com`); + await channelOpenPromise(chan, CL_ALLOW_UNKNOWN_CL); + let securityInfo = chan.securityInfo; + Assert.ok(securityInfo.isAcceptedEch, "This host should have accepted ECH"); + + // Only check telemetry if network process is disabled. + if (!mozinfo.socketprocess_networking) { + HandshakeTelemetryHelpers.checkSuccess(["", "_ECH", "_FIRST_TRY"]); + HandshakeTelemetryHelpers.checkEmpty(["_CONSERVATIVE", "_ECH_GREASE"]); + } + + await trrServer.stop(); + observerService.removeObserver(observer); + observerService.observeConnection = false; + + let filtered = observer.activites.filter( + activity => activity.host === "ech-private.example.com" + ); + checkHttpActivities(filtered); +} + +add_task(async function h1Advertised() { + await testWrapper(["http/1.1"]); +}); + +add_task(async function h2Advertised() { + await testWrapper(["h2"]); +}); + +add_task(async function h3Advertised() { + await testWrapper(["h3"]); +}); + +add_task(async function h1h2Advertised() { + await testWrapper(["http/1.1", "h2"]); +}); + +add_task(async function h2h3Advertised() { + await testWrapper(["h3", "h2"]); +}); + +add_task(async function unknownAdvertised() { + await testWrapper(["foo"]); +}); |