CoCalc -- test_17_ssl

GitHub Repository: freebsd/pkg
Path: blob/main/external/curl/tests/http/test_17_ssl_use.py
²⁶⁵⁴ views
1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
#***************************************************************************
4
#                                  _   _ ____  _
5
#  Project                     ___| | | |  _ \| |
6
#                             / __| | | | |_) | |
7
#                            | (__| |_| |  _ <| |___
8
#                             \___|\___/|_| \_\_____|
9
#
10
# Copyright (C) Daniel Stenberg, <[email protected]>, et al.
11
#
12
# This software is licensed as described in the file COPYING, which
13
# you should have received as part of this distribution. The terms
14
# are also available at https://curl.se/docs/copyright.html.
15
#
16
# You may opt to use, copy, modify, merge, publish, distribute and/or sell
17
# copies of the Software, and permit persons to whom the Software is
18
# furnished to do so, under the terms of the COPYING file.
19
#
20
# This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
21
# KIND, either express or implied.
22
#
23
# SPDX-License-Identifier: curl
24
#
25
###########################################################################
26
#
27
import json
28
import logging
29
import os
30
import re
31
import pytest
32

33
from testenv import Env, CurlClient, LocalClient
34

35

36
log = logging.getLogger(__name__)
37

38

39
class TLSDefs:
40
    TLS_VERSIONS = ['TLSv1', 'TLSv1.1', 'TLSv1.2', 'TLSv1.3']
41
    TLS_VERSION_IDS = {
42
        'TLSv1': 0x301,
43
        'TLSv1.1': 0x302,
44
        'TLSv1.2': 0x303,
45
        'TLSv1.3': 0x304
46
    }
47
    CURL_ARG_MIN_VERSION_ID = {
48
        'none': 0x0,
49
        'tlsv1': 0x301,
50
        'tlsv1.0': 0x301,
51
        'tlsv1.1': 0x302,
52
        'tlsv1.2': 0x303,
53
        'tlsv1.3': 0x304,
54
    }
55
    CURL_ARG_MAX_VERSION_ID = {
56
        'none': 0x0,
57
        '1.0': 0x301,
58
        '1.1': 0x302,
59
        '1.2': 0x303,
60
        '1.3': 0x304,
61
    }
62

63

64
class TestSSLUse:
65

66
    @pytest.fixture(autouse=True, scope='class')
67
    def _class_scope(self, env, httpd, nghttpx):
68
        env.make_data_file(indir=httpd.docs_dir, fname="data-10k", fsize=10*1024)
69

70
    def test_17_01_sslinfo_plain(self, env: Env, httpd):
71
        proto = 'http/1.1'
72
        curl = CurlClient(env=env)
73
        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
74
        r = curl.http_get(url=url, alpn_proto=proto)
75
        assert r.json['HTTPS'] == 'on', f'{r.json}'
76
        assert 'SSL_SESSION_ID' in r.json, f'{r.json}'
77
        assert 'SSL_SESSION_RESUMED' in r.json, f'{r.json}'
78
        assert r.json['SSL_SESSION_RESUMED'] == 'Initial', f'{r.json}'
79

80
    @pytest.mark.parametrize("tls_max", ['1.2', '1.3'])
81
    def test_17_02_sslinfo_reconnect(self, env: Env, tls_max, httpd):
82
        proto = 'http/1.1'
83
        count = 3
84
        exp_resumed = 'Resumed'
85
        xargs = ['--sessionid', '--tls-max', tls_max, f'--tlsv{tls_max}']
86
        if env.curl_uses_lib('libressl'):
87
            if tls_max == '1.3':
88
                exp_resumed = 'Initial'  # 1.2 works in LibreSSL, but 1.3 does not, TODO
89
        if env.curl_uses_lib('rustls-ffi'):
90
            exp_resumed = 'Initial'  # Rustls does not support sessions, TODO
91
        if env.curl_uses_lib('mbedtls') and tls_max == '1.3' and \
92
           not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
93
            pytest.skip('mbedtls TLSv1.3 session resume not working in 3.6.0')
94

95
        run_env = os.environ.copy()
96
        run_env['CURL_DEBUG'] = 'ssl'
97
        curl = CurlClient(env=env, run_env=run_env)
98
        # tell the server to close the connection after each request
99
        urln = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo?'\
100
            f'id=[0-{count-1}]&close'
101
        r = curl.http_download(urls=[urln], alpn_proto=proto, with_stats=True,
102
                               extra_args=xargs)
103
        r.check_response(count=count, http_status=200)
104
        # should have used one connection for each request, sessions after
105
        # first should have been resumed
106
        assert r.total_connects == count, r.dump_logs()
107
        for i in range(count):
108
            dfile = curl.download_file(i)
109
            assert os.path.exists(dfile)
110
            with open(dfile) as f:
111
                djson = json.load(f)
112
            assert djson['HTTPS'] == 'on', f'{i}: {djson}'
113
            if i == 0:
114
                assert djson['SSL_SESSION_RESUMED'] == 'Initial', f'{i}: {djson}\n{r.dump_logs()}'
115
            else:
116
                assert djson['SSL_SESSION_RESUMED'] == exp_resumed, f'{i}: {djson}\n{r.dump_logs()}'
117

118
    # use host name with trailing dot, verify handshake
119
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
120
    def test_17_03_trailing_dot(self, env: Env, proto, httpd, nghttpx):
121
        if proto == 'h3' and not env.have_h3():
122
            pytest.skip("h3 not supported")
123
        curl = CurlClient(env=env)
124
        domain = f'{env.domain1}.'
125
        url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
126
        r = curl.http_get(url=url, alpn_proto=proto)
127
        assert r.exit_code == 0, f'{r}'
128
        assert r.json, f'{r}'
129
        if proto != 'h3':  # we proxy h3
130
            # the SNI the server received is without trailing dot
131
            assert r.json['SSL_TLS_SNI'] == env.domain1, f'{r.json}'
132

133
    # use host name with double trailing dot, verify handshake
134
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
135
    def test_17_04_double_dot(self, env: Env, proto, httpd, nghttpx):
136
        if proto == 'h3' and not env.have_h3():
137
            pytest.skip("h3 not supported")
138
        curl = CurlClient(env=env)
139
        domain = f'{env.domain1}..'
140
        url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
141
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
142
            '-H', f'Host: {env.domain1}',
143
        ])
144
        if r.exit_code == 0:
145
            assert r.json, f'{r.stdout}'
146
            # the SNI the server received is without trailing dot
147
            if proto != 'h3':  # we proxy h3
148
                assert r.json['SSL_TLS_SNI'] == env.domain1, f'{r.json}'
149
            assert False, f'should not have succeeded: {r.json}'
150
        # 7 - Rustls rejects a servername with .. during setup
151
        # 35 - LibreSSL rejects setting an SNI name with trailing dot
152
        # 60 - peer name matching failed against certificate
153
        assert r.exit_code in [7, 35, 60], f'{r}'
154

155
    # use ip address for connect
156
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
157
    def test_17_05_good_ip_addr(self, env: Env, proto, httpd, nghttpx):
158
        if env.curl_uses_lib('mbedtls'):
159
            pytest.skip("mbedTLS does use IP addresses in SNI")
160
        if proto == 'h3' and not env.have_h3():
161
            pytest.skip("h3 not supported")
162
        curl = CurlClient(env=env)
163
        domain = '127.0.0.1'
164
        url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
165
        r = curl.http_get(url=url, alpn_proto=proto)
166
        assert r.exit_code == 0, f'{r}'
167
        assert r.json, f'{r}'
168
        if proto != 'h3':  # we proxy h3
169
            # the SNI should not have been used
170
            assert 'SSL_TLS_SNI' not in r.json, f'{r.json}'
171

172
    # use IP address that is not in cert
173
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
174
    def test_17_05_bad_ip_addr(self, env: Env, proto,
175
                               httpd, configures_httpd,
176
                               nghttpx, configures_nghttpx):
177
        if proto == 'h3' and not env.have_h3():
178
            pytest.skip("h3 not supported")
179
        httpd.set_domain1_cred_name('domain1-no-ip')
180
        httpd.reload_if_config_changed()
181
        if proto == 'h3':
182
            nghttpx.set_cred_name('domain1-no-ip')
183
            nghttpx.reload_if_config_changed()
184
        curl = CurlClient(env=env)
185
        url = f'https://127.0.0.1:{env.port_for(proto)}/curltest/sslinfo'
186
        r = curl.http_get(url=url, alpn_proto=proto)
187
        assert r.exit_code == 60, f'{r}'
188

189
    # use IP address that is in cert as DNS name (not really legal)
190
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
191
    def test_17_05_very_bad_ip_addr(self, env: Env, proto,
192
                                    httpd, configures_httpd,
193
                                    nghttpx, configures_nghttpx):
194
        if proto == 'h3' and not env.have_h3():
195
            pytest.skip("h3 not supported")
196
        if env.curl_uses_lib('mbedtls'):
197
            pytest.skip("mbedtls falsely verifies a DNS: altname as IP address")
198
        if env.curl_uses_lib('wolfssl'):
199
            pytest.skip("wolfSSL falsely verifies a DNS: altname as IP address")
200
        httpd.set_domain1_cred_name('domain1-very-bad')
201
        httpd.reload_if_config_changed()
202
        if proto == 'h3':
203
            nghttpx.set_cred_name('domain1-very-bad')
204
            nghttpx.reload_if_config_changed()
205
        curl = CurlClient(env=env)
206
        url = f'https://127.0.0.1:{env.port_for(proto)}/curltest/sslinfo'
207
        r = curl.http_get(url=url, alpn_proto=proto)
208
        assert r.exit_code == 60, f'{r}'
209

210
    # use localhost for connect
211
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
212
    def test_17_06_localhost(self, env: Env, proto, httpd, nghttpx):
213
        if proto == 'h3' and not env.have_h3():
214
            pytest.skip("h3 not supported")
215
        curl = CurlClient(env=env)
216
        domain = 'localhost'
217
        url = f'https://{env.authority_for(domain, proto)}/curltest/sslinfo'
218
        r = curl.http_get(url=url, alpn_proto=proto)
219
        assert r.exit_code == 0, f'{r}'
220
        assert r.json, f'{r}'
221
        if proto != 'h3':  # we proxy h3
222
            assert r.json['SSL_TLS_SNI'] == domain, f'{r.json}'
223

224
    @staticmethod
225
    def gen_test_17_07_list():
226
        tls13_tests = [
227
            ['def', None, True],
228
            ['AES128SHA256', ['TLS_AES_128_GCM_SHA256'], True],
229
            ['AES128SHA384', ['TLS_AES_256_GCM_SHA384'], False],
230
            ['CHACHA20SHA256', ['TLS_CHACHA20_POLY1305_SHA256'], True],
231
            ['AES128SHA384+CHACHA20SHA256', ['TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256'], True],
232
        ]
233
        tls12_tests = [
234
            ['def', None, True],
235
            ['AES128ish', ['ECDHE-ECDSA-AES128-GCM-SHA256', 'ECDHE-RSA-AES128-GCM-SHA256'], True],
236
            ['AES256ish', ['ECDHE-ECDSA-AES256-GCM-SHA384', 'ECDHE-RSA-AES256-GCM-SHA384'], False],
237
            ['CHACHA20ish', ['ECDHE-ECDSA-CHACHA20-POLY1305', 'ECDHE-RSA-CHACHA20-POLY1305'], True],
238
            ['AES256ish+CHACHA20ish', ['ECDHE-ECDSA-AES256-GCM-SHA384', 'ECDHE-RSA-AES256-GCM-SHA384',
239
              'ECDHE-ECDSA-CHACHA20-POLY1305', 'ECDHE-RSA-CHACHA20-POLY1305'], True],
240
        ]
241
        ret = []
242
        for tls_id, tls_proto in {
243
                'TLSv1.2+3': 'TLSv1.3 +TLSv1.2',
244
                'TLSv1.3': 'TLSv1.3',
245
                'TLSv1.2': 'TLSv1.2'}.items():
246
            for [cid13, ciphers13, succeed13] in tls13_tests:
247
                for [cid12, ciphers12, succeed12] in tls12_tests:
248
                    id = f'{tls_id}-{cid13}-{cid12}'
249
                    ret.append(pytest.param(tls_proto, ciphers13, ciphers12, succeed13, succeed12, id=id))
250
        return ret
251

252
    @pytest.mark.parametrize(
253
        "tls_proto, ciphers13, ciphers12, succeed13, succeed12",
254
        gen_test_17_07_list())
255
    def test_17_07_ssl_ciphers(self, env: Env, httpd, configures_httpd,
256
                               tls_proto, ciphers13, ciphers12,
257
                               succeed13, succeed12):
258
        # to test setting cipher suites, the AES 256 ciphers are disabled in the test server
259
        httpd.set_extra_config('base', [
260
            'SSLCipherSuite SSL'
261
            ' ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256'
262
            ':ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305',
263
            'SSLCipherSuite TLSv1.3'
264
            ' TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256',
265
            f'SSLProtocol {tls_proto}'
266
        ])
267
        httpd.reload_if_config_changed()
268
        proto = 'http/1.1'
269
        curl = CurlClient(env=env)
270
        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
271
        # SSL backend specifics
272
        if env.curl_uses_lib('gnutls'):
273
            pytest.skip('GnuTLS does not support setting ciphers')
274
        elif env.curl_uses_lib('boringssl'):
275
            if ciphers13 is not None:
276
                pytest.skip('BoringSSL does not support setting TLSv1.3 ciphers')
277
        elif env.curl_uses_lib('schannel'):  # not in CI, so untested
278
            if ciphers12 is not None:
279
                pytest.skip('Schannel does not support setting TLSv1.2 ciphers by name')
280
        elif env.curl_uses_lib('mbedtls') and not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
281
            if tls_proto == 'TLSv1.3':
282
                pytest.skip('mbedTLS < 3.6.0 does not support TLSv1.3')
283
        # test
284
        extra_args = ['--tls13-ciphers', ':'.join(ciphers13)] if ciphers13 else []
285
        extra_args += ['--ciphers', ':'.join(ciphers12)] if ciphers12 else []
286
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=extra_args)
287
        if tls_proto != 'TLSv1.2' and succeed13:
288
            assert r.exit_code == 0, r.dump_logs()
289
            assert r.json['HTTPS'] == 'on', r.dump_logs()
290
            assert r.json['SSL_PROTOCOL'] == 'TLSv1.3', r.dump_logs()
291
            assert ciphers13 is None or r.json['SSL_CIPHER'] in ciphers13, r.dump_logs()
292
        elif tls_proto == 'TLSv1.2' and succeed12:
293
            assert r.exit_code == 0, r.dump_logs()
294
            assert r.json['HTTPS'] == 'on', r.dump_logs()
295
            assert r.json['SSL_PROTOCOL'] == 'TLSv1.2', r.dump_logs()
296
            assert ciphers12 is None or r.json['SSL_CIPHER'] in ciphers12, r.dump_logs()
297
        else:
298
            assert r.exit_code != 0, r.dump_logs()
299

300
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
301
    def test_17_08_cert_status(self, env: Env, proto, httpd, nghttpx):
302
        if proto == 'h3' and not env.have_h3():
303
            pytest.skip("h3 not supported")
304
        if not env.curl_uses_lib('openssl') and \
305
           not env.curl_uses_lib('gnutls') and \
306
           not env.curl_uses_lib('quictls'):
307
            pytest.skip("TLS library does not support --cert-status")
308
        curl = CurlClient(env=env)
309
        domain = 'localhost'
310
        url = f'https://{env.authority_for(domain, proto)}/'
311
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
312
            '--cert-status'
313
        ])
314
        # CURLE_SSL_INVALIDCERTSTATUS, our certs have no OCSP info
315
        assert r.exit_code == 91, f'{r}'
316

317
    @staticmethod
318
    def gen_test_17_09_list():
319
        return [
320
            [server_tls, min_arg, max_arg]
321
            for server_tls in TLSDefs.TLS_VERSIONS
322
            for min_arg in TLSDefs.CURL_ARG_MIN_VERSION_ID
323
            for max_arg in TLSDefs.CURL_ARG_MAX_VERSION_ID
324
        ]
325

326
    @pytest.mark.parametrize("server_tls, min_arg, max_arg", gen_test_17_09_list())
327
    def test_17_09_ssl_min_max(self, env: Env, httpd, configures_httpd, server_tls, min_arg, max_arg):
328
        # We test if curl using min/max versions arguments (and defaults) can connect
329
        # to a server using 'server_tls' version only
330
        httpd.set_extra_config('base', [
331
            f'SSLProtocol {server_tls}',
332
            'SSLCipherSuite ALL:@SECLEVEL=0',
333
        ])
334
        httpd.reload_if_config_changed()
335
        # curl's TLS backend supported version
336
        if env.curl_uses_lib('gnutls') or \
337
           env.curl_uses_lib('quiche') or \
338
           env.curl_uses_lib('aws-lc') or \
339
           env.curl_uses_lib('boringssl'):
340
            curl_supported = [0x301, 0x302, 0x303, 0x304]
341
        elif env.curl_uses_lib('openssl') and \
342
             env.curl_lib_version_before('openssl', '3.0.0'):
343
            curl_supported = [0x301, 0x302, 0x303, 0x304]
344
        else:  # most SSL backends dropped support for TLSv1.0, TLSv1.1
345
            curl_supported = [0x303, 0x304]
346

347
        extra_args = ['--trace-config', 'ssl']
348

349
        # determine effective min/max version used by curl with these args
350
        if max_arg != 'none':
351
            extra_args.extend(['--tls-max', max_arg])
352
            curl_max_ver = TLSDefs.CURL_ARG_MAX_VERSION_ID[max_arg]
353
        else:
354
            curl_max_ver = max(TLSDefs.TLS_VERSION_IDS.values())
355
        if min_arg != 'none':
356
            extra_args.append(f'--{min_arg}')
357
            curl_min_ver = TLSDefs.CURL_ARG_MIN_VERSION_ID[min_arg]
358
        else:
359
            curl_min_ver = min(0x303, curl_max_ver)  # TLSv1.2 is the default now
360

361
        # collect all versions that curl is allowed with this command lines and supports
362
        curl_allowed = [tid for tid in sorted(TLSDefs.TLS_VERSION_IDS.values())
363
                        if curl_min_ver <= tid <= curl_max_ver and
364
                        tid in curl_supported]
365
        # we expect a successful transfer, when the server TLS version is allowed
366
        server_ver = TLSDefs.TLS_VERSION_IDS[server_tls]
367
        # do the transfer
368
        proto = 'http/1.1'
369
        run_env = os.environ.copy()
370
        if env.curl_uses_lib('gnutls'):
371
            # we need to override any default system configuration since
372
            # we want to test all protocol versions. Ubuntu (or the GH image)
373
            # disable TSL1.0 and TLS1.1 system wide. We do not want.
374
            our_config = os.path.join(env.gen_dir, 'gnutls_config')
375
            if not os.path.exists(our_config):
376
                with open(our_config, 'w') as fd:
377
                    fd.write('# empty\n')
378
            run_env['GNUTLS_SYSTEM_PRIORITY_FILE'] = our_config
379
        curl = CurlClient(env=env, run_env=run_env)
380
        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
381
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=extra_args)
382

383
        if server_ver in curl_allowed:
384
            assert r.exit_code == 0, f'should succeed, server={server_ver:04x}, curl=[{curl_min_ver:04x}, {curl_max_ver:04x}], allowed={curl_allowed}\n{r.dump_logs()}'
385
            assert r.json['HTTPS'] == 'on', r.dump_logs()
386
            assert r.json['SSL_PROTOCOL'] == server_tls, r.dump_logs()
387
        else:
388
            assert r.exit_code != 0, f'should fail, server={server_ver:04x}, curl=[{curl_min_ver:04x}, {curl_max_ver:04x}]\n{r.dump_logs()}'
389

390
    @pytest.mark.skipif(condition=not Env.curl_is_debug(), reason="needs curl debug")
391
    @pytest.mark.skipif(condition=not Env.curl_is_verbose(), reason="needs curl verbose strings")
392
    def test_17_10_h3_session_reuse(self, env: Env, httpd, nghttpx):
393
        if not env.have_h3():
394
            pytest.skip("h3 not supported")
395
        if not env.curl_uses_lib('quictls') and \
396
           not (env.curl_uses_lib('openssl') and env.curl_uses_lib('ngtcp2')) and \
397
           not env.curl_uses_lib('gnutls') and \
398
           not env.curl_uses_lib('wolfssl'):
399
            pytest.skip("QUIC session reuse not implemented")
400
        count = 2
401
        docname = 'data-10k'
402
        url = f'https://localhost:{env.https_port}/{docname}'
403
        client = LocalClient(name='cli_hx_download', env=env)
404
        if not client.exists():
405
            pytest.skip(f'example client not built: {client.name}')
406
        r = client.run(args=[
407
             '-n', f'{count}',
408
             '-f',  # forbid reuse of connections
409
             '-r', f'{env.domain1}:{env.port_for("h3")}:127.0.0.1',
410
             '-V', 'h3', url
411
        ])
412
        r.check_exit_code(0)
413
        # check that TLS session was reused as expected
414
        reused_session = False
415
        for line in r.trace_lines:
416
            if re.match(r'.*\[1-1] (\* )?SSL reusing session.*', line):
417
                reused_session = True
418
        assert reused_session, f'{r}\n{r.dump_logs()}'
419

420
    # use host name server has no certificate for
421
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
422
    def test_17_11_wrong_host(self, env: Env, proto, httpd, nghttpx):
423
        if proto == 'h3' and not env.have_h3():
424
            pytest.skip("h3 not supported")
425
        curl = CurlClient(env=env)
426
        domain = f'insecure.{env.tld}'
427
        url = f'https://{domain}:{env.port_for(proto)}/curltest/sslinfo'
428
        r = curl.http_get(url=url, alpn_proto=proto)
429
        assert r.exit_code == 60, f'{r}'
430

431
    # use host name server has no cert for with --insecure
432
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
433
    def test_17_12_insecure(self, env: Env, proto, httpd, nghttpx):
434
        if proto == 'h3' and not env.have_h3():
435
            pytest.skip("h3 not supported")
436
        curl = CurlClient(env=env)
437
        domain = f'insecure.{env.tld}'
438
        url = f'https://{domain}:{env.port_for(proto)}/curltest/sslinfo'
439
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
440
            '--insecure'
441
        ])
442
        assert r.exit_code == 0, f'{r}'
443
        assert r.json, f'{r}'
444

445
    # connect to an expired certificate
446
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2'])
447
    def test_17_14_expired_cert(self, env: Env, proto, httpd):
448
        if proto == 'h3' and not env.have_h3():
449
            pytest.skip("h3 not supported")
450
        curl = CurlClient(env=env)
451
        url = f'https://{env.expired_domain}:{env.port_for(proto)}/'
452
        r = curl.http_get(url=url, alpn_proto=proto)
453
        assert r.exit_code == 60, f'{r}'  # peer failed verification
454
        exp_trace = None
455
        match_trace = None
456
        if env.curl_uses_lib('openssl') or env.curl_uses_lib('quictls'):
457
            exp_trace = r'.*SSL certificate OpenSSL verify result: certificate has expired.*$'
458
        elif env.curl_uses_lib('gnutls'):
459
            exp_trace = r'.*SSL certificate verification failed: certificate has expired\..*'
460
        elif env.curl_uses_lib('wolfssl'):
461
            exp_trace = r'.*server verification failed: certificate has expired\.$'
462
        if exp_trace is not None:
463
            for line in r.trace_lines:
464
                if re.match(exp_trace, line):
465
                    match_trace = line
466
                    break
467
            assert match_trace, f'Did not find "{exp_trace}" in trace\n{r.dump_logs()}'
468

469
    @pytest.mark.skipif(condition=not Env.curl_has_feature('SSLS-EXPORT'),
470
                        reason='curl lacks SSL session export support')
471
    def test_17_15_session_export(self, env: Env, httpd):
472
        proto = 'http/1.1'
473
        if env.curl_uses_lib('libressl'):
474
            pytest.skip('Libressl resumption does not work inTLSv1.3')
475
        if env.curl_uses_lib('rustls-ffi'):
476
            pytest.skip('rustsls does not expose sessions')
477
        if env.curl_uses_lib('mbedtls') and \
478
           not env.curl_lib_version_at_least('mbedtls', '3.6.0'):
479
            pytest.skip('mbedtls TLSv1.3 session resume not working before 3.6.0')
480
        run_env = os.environ.copy()
481
        run_env['CURL_DEBUG'] = 'ssl,ssls'
482
        # clean session file first, then reuse
483
        session_file = os.path.join(env.gen_dir, 'test_17_15.sessions')
484
        if os.path.exists(session_file):
485
            return os.remove(session_file)
486
        xargs = ['--tls-max', '1.3', '--tlsv1.3', '--ssl-sessions', session_file]
487
        curl = CurlClient(env=env, run_env=run_env)
488
        # tell the server to close the connection after each request
489
        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
490
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=xargs)
491
        assert r.exit_code == 0, f'{r}'
492
        assert r.json['HTTPS'] == 'on', f'{r.json}'
493
        assert r.json['SSL_SESSION_RESUMED'] == 'Initial', f'{r.json}\n{r.dump_logs()}'
494
        # ok, run again, sessions should be imported
495
        run_dir2 = os.path.join(env.gen_dir, 'curl2')
496
        curl = CurlClient(env=env, run_env=run_env, run_dir=run_dir2)
497
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=xargs)
498
        assert r.exit_code == 0, f'{r}'
499
        assert r.json['SSL_SESSION_RESUMED'] == 'Resumed', f'{r.json}\n{r.dump_logs()}'
500

501
    # verify the ciphers are ignored when talking TLSv1.3 only
502
    # see issue #16232
503
    def test_17_16_h3_ignore_ciphers12(self, env: Env, httpd, nghttpx):
504
        proto = 'h3'
505
        if proto == 'h3' and not env.have_h3():
506
            pytest.skip("h3 not supported")
507
        if env.curl_uses_lib('gnutls'):
508
            pytest.skip("gnutls does not ignore --ciphers on TLSv1.3")
509
        curl = CurlClient(env=env)
510
        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
511
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
512
            '--ciphers', 'NONSENSE'
513
        ])
514
        assert r.exit_code == 0, f'{r}'
515

516
    def test_17_17_h1_ignore_ciphers13(self, env: Env, httpd):
517
        proto = 'http/1.1'
518
        curl = CurlClient(env=env)
519
        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
520
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
521
            '--tls13-ciphers', 'NONSENSE', '--tls-max', '1.2'
522
        ])
523
        assert r.exit_code == 0, f'{r}'
524

525
    @pytest.mark.parametrize("priority, tls_proto, ciphers, success", [
526
        pytest.param("", "", [], False, id='prio-empty'),
527
        pytest.param("NONSENSE", "", [], False, id='nonsense'),
528
        pytest.param("+NONSENSE", "", [], False, id='+nonsense'),
529
        pytest.param("NORMAL:-VERS-ALL:+VERS-TLS1.2", "TLSv1.2", ['ECDHE-RSA-CHACHA20-POLY1305'], True, id='TLSv1.2-normal-only'),
530
        pytest.param("-VERS-ALL:+VERS-TLS1.2", "TLSv1.2", ['ECDHE-RSA-CHACHA20-POLY1305'], True, id='TLSv1.2-only'),
531
        pytest.param("NORMAL", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-normal'),
532
        pytest.param("NORMAL:-VERS-ALL:+VERS-TLS1.3", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-normal-only'),
533
        pytest.param("-VERS-ALL:+VERS-TLS1.3", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-only'),
534
        pytest.param("!CHACHA20-POLY1305", "TLSv1.3", ['TLS_AES_128_GCM_SHA256'], True, id='TLSv1.3-no-chacha'),
535
        pytest.param("-CIPHER-ALL:+CHACHA20-POLY1305", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-only-chacha'),
536
        pytest.param("-CIPHER-ALL:+AES-256-GCM", "", [], False, id='only-AES256'),
537
        pytest.param("-CIPHER-ALL:+AES-128-GCM", "TLSv1.3", ['TLS_AES_128_GCM_SHA256'], True, id='TLSv1.3-only-AES128'),
538
        pytest.param("SECURE:-CIPHER-ALL:+AES-128-GCM:-VERS-ALL:+VERS-TLS1.2", "TLSv1.2", ['ECDHE-RSA-AES128-GCM-SHA256'], True, id='TLSv1.2-secure'),
539
        pytest.param("-MAC-ALL:+SHA256", "", [], False, id='MAC-only-SHA256'),
540
        pytest.param("-MAC-ALL:+AEAD", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-MAC-only-AEAD'),
541
        pytest.param("-GROUP-ALL:+GROUP-X25519", "TLSv1.3", ['TLS_CHACHA20_POLY1305_SHA256'], True, id='TLSv1.3-group-only-X25519'),
542
        pytest.param("-GROUP-ALL:+GROUP-SECP192R1", "", [], False, id='group-only-SECP192R1'),
543
        ])
544
    def test_17_18_gnutls_priority(self, env: Env, httpd, configures_httpd, priority, tls_proto, ciphers, success):
545
        # to test setting cipher suites, the AES 256 ciphers are disabled in the test server
546
        httpd.set_extra_config('base', [
547
            'SSLCipherSuite SSL'
548
            ' ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256'
549
            ':ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305',
550
            'SSLCipherSuite TLSv1.3'
551
            ' TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256',
552
        ])
553
        httpd.reload_if_config_changed()
554
        proto = 'http/1.1'
555
        curl = CurlClient(env=env)
556
        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
557
        # SSL backend specifics
558
        if not env.curl_uses_lib('gnutls'):
559
            pytest.skip('curl not build with GnuTLS')
560
        # test
561
        extra_args = ['--ciphers', f'{priority}']
562
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=extra_args)
563
        if success:
564
            assert r.exit_code == 0, r.dump_logs()
565
            assert r.json['HTTPS'] == 'on', r.dump_logs()
566
            if tls_proto:
567
                assert r.json['SSL_PROTOCOL'] == tls_proto, r.dump_logs()
568
            assert r.json['SSL_CIPHER'] in ciphers, r.dump_logs()
569
        else:
570
            assert r.exit_code != 0, r.dump_logs()
571

572
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
573
    def test_17_19_wrong_pin(self, env: Env, proto, httpd):
574
        if proto == 'h3' and not env.have_h3():
575
            pytest.skip("h3 not supported")
576
        if env.curl_uses_lib('rustls-ffi'):
577
            pytest.skip('TLS backend ignores --pinnedpubkey')
578
        curl = CurlClient(env=env)
579
        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
580
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
581
            '--pinnedpubkey', 'sha256//ffff'
582
        ])
583
        # expect NOT_IMPLEMENTED or CURLE_SSL_PINNEDPUBKEYNOTMATCH
584
        assert r.exit_code in [2, 90], f'{r.dump_logs()}'
585

586
    @pytest.mark.parametrize("proto", ['http/1.1', 'h2', 'h3'])
587
    def test_17_20_correct_pin(self, env: Env, proto, httpd):
588
        if proto == 'h3' and not env.have_h3():
589
            pytest.skip("h3 not supported")
590
        curl = CurlClient(env=env)
591
        creds = env.get_credentials(env.domain1)
592
        assert creds
593
        url = f'https://{env.authority_for(env.domain1, proto)}/curltest/sslinfo'
594
        r = curl.http_get(url=url, alpn_proto=proto, extra_args=[
595
            '--pinnedpubkey', f'sha256//{creds.pub_sha256_b64()}'
596
        ])
597
        # expect NOT_IMPLEMENTED or OK
598
        assert r.exit_code in [0, 2], f'{r.dump_logs()}'
599

600
Product

Resources

Company
