mirror of
https://github.com/AdguardTeam/AdGuardHome.git
synced 2024-12-16 11:52:58 +03:00
f717776c64
Updates #3056. Squashed commit of the following: commit 875954fc8d59980a39b03032007cbc15d87801ea Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Wed May 5 19:54:24 2021 +0300 all: imp err msgs commit c6ea471038ce28f608084b59d3447ff64124260f Author: Ainar Garipov <A.Garipov@AdGuard.COM> Date: Wed May 5 17:55:12 2021 +0300 dhcpd: imp normalization, validation
275 lines
6.6 KiB
Go
275 lines
6.6 KiB
Go
package dnsforward
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"net"
|
|
"net/http"
|
|
"net/url"
|
|
"testing"
|
|
|
|
"github.com/AdguardTeam/dnsproxy/proxy"
|
|
"github.com/lucas-clemente/quic-go"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// testTLSConn is a tlsConn for tests.
|
|
type testTLSConn struct {
|
|
// Conn is embedded here simply to make testTLSConn a net.Conn without
|
|
// actually implementing all methods.
|
|
net.Conn
|
|
|
|
serverName string
|
|
}
|
|
|
|
// ConnectionState implements the tlsConn interface for testTLSConn.
|
|
func (c testTLSConn) ConnectionState() (cs tls.ConnectionState) {
|
|
cs.ServerName = c.serverName
|
|
|
|
return cs
|
|
}
|
|
|
|
// testQUICSession is a quicSession for tests.
|
|
type testQUICSession struct {
|
|
// Session is embedded here simply to make testQUICSession
|
|
// a quic.Session without acctually implementing all methods.
|
|
quic.Session
|
|
|
|
serverName string
|
|
}
|
|
|
|
// ConnectionState implements the quicSession interface for testQUICSession.
|
|
func (c testQUICSession) ConnectionState() (cs quic.ConnectionState) {
|
|
cs.TLS.ServerName = c.serverName
|
|
|
|
return cs
|
|
}
|
|
|
|
func TestProcessClientID(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
proto string
|
|
hostSrvName string
|
|
cliSrvName string
|
|
wantClientID string
|
|
wantErrMsg string
|
|
wantRes resultCode
|
|
strictSNI bool
|
|
}{{
|
|
name: "udp",
|
|
proto: proxy.ProtoUDP,
|
|
hostSrvName: "",
|
|
cliSrvName: "",
|
|
wantClientID: "",
|
|
wantErrMsg: "",
|
|
wantRes: resultCodeSuccess,
|
|
strictSNI: false,
|
|
}, {
|
|
name: "tls_no_client_id",
|
|
proto: proxy.ProtoTLS,
|
|
hostSrvName: "example.com",
|
|
cliSrvName: "example.com",
|
|
wantClientID: "",
|
|
wantErrMsg: "",
|
|
wantRes: resultCodeSuccess,
|
|
strictSNI: true,
|
|
}, {
|
|
name: "tls_no_client_server_name",
|
|
proto: proxy.ProtoTLS,
|
|
hostSrvName: "example.com",
|
|
cliSrvName: "",
|
|
wantClientID: "",
|
|
wantErrMsg: `client id check: client server name "" ` +
|
|
`doesn't match host server name "example.com"`,
|
|
wantRes: resultCodeError,
|
|
strictSNI: true,
|
|
}, {
|
|
name: "tls_no_client_server_name_no_strict",
|
|
proto: proxy.ProtoTLS,
|
|
hostSrvName: "example.com",
|
|
cliSrvName: "",
|
|
wantClientID: "",
|
|
wantErrMsg: "",
|
|
wantRes: resultCodeSuccess,
|
|
strictSNI: false,
|
|
}, {
|
|
name: "tls_client_id",
|
|
proto: proxy.ProtoTLS,
|
|
hostSrvName: "example.com",
|
|
cliSrvName: "cli.example.com",
|
|
wantClientID: "cli",
|
|
wantErrMsg: "",
|
|
wantRes: resultCodeSuccess,
|
|
strictSNI: true,
|
|
}, {
|
|
name: "tls_client_id_hostname_error",
|
|
proto: proxy.ProtoTLS,
|
|
hostSrvName: "example.com",
|
|
cliSrvName: "cli.example.net",
|
|
wantClientID: "",
|
|
wantErrMsg: `client id check: client server name "cli.example.net" ` +
|
|
`doesn't match host server name "example.com"`,
|
|
wantRes: resultCodeError,
|
|
strictSNI: true,
|
|
}, {
|
|
name: "tls_invalid_client_id",
|
|
proto: proxy.ProtoTLS,
|
|
hostSrvName: "example.com",
|
|
cliSrvName: "!!!.example.com",
|
|
wantClientID: "",
|
|
wantErrMsg: `client id check: invalid client id "!!!": ` +
|
|
`invalid char '!' at index 0`,
|
|
wantRes: resultCodeError,
|
|
strictSNI: true,
|
|
}, {
|
|
name: "tls_client_id_too_long",
|
|
proto: proxy.ProtoTLS,
|
|
hostSrvName: "example.com",
|
|
cliSrvName: `abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmno` +
|
|
`pqrstuvwxyz0123456789.example.com`,
|
|
wantClientID: "",
|
|
wantErrMsg: `client id check: invalid client id "abcdefghijklmno` +
|
|
`pqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz0123456789": ` +
|
|
`label is too long, max: 63`,
|
|
wantRes: resultCodeError,
|
|
strictSNI: true,
|
|
}, {
|
|
name: "quic_client_id",
|
|
proto: proxy.ProtoQUIC,
|
|
hostSrvName: "example.com",
|
|
cliSrvName: "cli.example.com",
|
|
wantClientID: "cli",
|
|
wantErrMsg: "",
|
|
wantRes: resultCodeSuccess,
|
|
strictSNI: true,
|
|
}}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
tlsConf := TLSConfig{
|
|
ServerName: tc.hostSrvName,
|
|
StrictSNICheck: tc.strictSNI,
|
|
}
|
|
srv := &Server{
|
|
conf: ServerConfig{TLSConfig: tlsConf},
|
|
}
|
|
|
|
var conn net.Conn
|
|
if tc.proto == proxy.ProtoTLS {
|
|
conn = testTLSConn{
|
|
serverName: tc.cliSrvName,
|
|
}
|
|
}
|
|
|
|
var qs quic.Session
|
|
if tc.proto == proxy.ProtoQUIC {
|
|
qs = testQUICSession{
|
|
serverName: tc.cliSrvName,
|
|
}
|
|
}
|
|
|
|
dctx := &dnsContext{
|
|
srv: srv,
|
|
proxyCtx: &proxy.DNSContext{
|
|
Proto: tc.proto,
|
|
Conn: conn,
|
|
QUICSession: qs,
|
|
},
|
|
}
|
|
|
|
res := processClientID(dctx)
|
|
assert.Equal(t, tc.wantRes, res)
|
|
assert.Equal(t, tc.wantClientID, dctx.clientID)
|
|
|
|
if tc.wantErrMsg == "" {
|
|
assert.NoError(t, dctx.err)
|
|
} else {
|
|
require.Error(t, dctx.err)
|
|
assert.Equal(t, tc.wantErrMsg, dctx.err.Error())
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestProcessClientID_https(t *testing.T) {
|
|
testCases := []struct {
|
|
name string
|
|
path string
|
|
wantClientID string
|
|
wantErrMsg string
|
|
wantRes resultCode
|
|
}{{
|
|
name: "no_client_id",
|
|
path: "/dns-query",
|
|
wantClientID: "",
|
|
wantErrMsg: "",
|
|
wantRes: resultCodeSuccess,
|
|
}, {
|
|
name: "no_client_id_slash",
|
|
path: "/dns-query/",
|
|
wantClientID: "",
|
|
wantErrMsg: "",
|
|
wantRes: resultCodeSuccess,
|
|
}, {
|
|
name: "client_id",
|
|
path: "/dns-query/cli",
|
|
wantClientID: "cli",
|
|
wantErrMsg: "",
|
|
wantRes: resultCodeSuccess,
|
|
}, {
|
|
name: "client_id_slash",
|
|
path: "/dns-query/cli/",
|
|
wantClientID: "cli",
|
|
wantErrMsg: "",
|
|
wantRes: resultCodeSuccess,
|
|
}, {
|
|
name: "bad_url",
|
|
path: "/foo",
|
|
wantClientID: "",
|
|
wantErrMsg: `client id check: invalid path "/foo"`,
|
|
wantRes: resultCodeError,
|
|
}, {
|
|
name: "extra",
|
|
path: "/dns-query/cli/foo",
|
|
wantClientID: "",
|
|
wantErrMsg: `client id check: invalid path "/dns-query/cli/foo": extra parts`,
|
|
wantRes: resultCodeError,
|
|
}, {
|
|
name: "invalid_client_id",
|
|
path: "/dns-query/!!!",
|
|
wantClientID: "",
|
|
wantErrMsg: `client id check: invalid client id "!!!": ` +
|
|
`invalid char '!' at index 0`,
|
|
wantRes: resultCodeError,
|
|
}}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
r := &http.Request{
|
|
URL: &url.URL{
|
|
Path: tc.path,
|
|
},
|
|
}
|
|
|
|
dctx := &dnsContext{
|
|
proxyCtx: &proxy.DNSContext{
|
|
Proto: proxy.ProtoHTTPS,
|
|
HTTPRequest: r,
|
|
},
|
|
}
|
|
|
|
res := processClientID(dctx)
|
|
assert.Equal(t, tc.wantRes, res)
|
|
assert.Equal(t, tc.wantClientID, dctx.clientID)
|
|
|
|
if tc.wantErrMsg == "" {
|
|
assert.NoError(t, dctx.err)
|
|
} else {
|
|
require.Error(t, dctx.err)
|
|
|
|
assert.Equal(t, tc.wantErrMsg, dctx.err.Error())
|
|
}
|
|
})
|
|
}
|
|
}
|