tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

test_httpssvc_retry_without_ech.js (3911B)

      1 /* This Source Code Form is subject to the terms of the Mozilla Public
      2 * License, v. 2.0. If a copy of the MPL was not distributed with this
      3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
      4 
      5 "use strict";
      6 
      7 let trrServer;
      8 
      9 const certOverrideService = Cc[
     10  "@mozilla.org/security/certoverride;1"
     11 ].getService(Ci.nsICertOverrideService);
     12 
     13 add_setup(async function setup() {
     14  trr_test_setup();
     15 
     16  Services.prefs.setIntPref("network.trr.mode", Ci.nsIDNSService.MODE_TRRFIRST);
     17  Services.prefs.setBoolPref("network.dns.upgrade_with_https_rr", true);
     18  Services.prefs.setBoolPref("network.dns.use_https_rr_as_altsvc", true);
     19  Services.prefs.setBoolPref("network.dns.echconfig.enabled", true);
     20 
     21  // An arbitrary, non-ECH server.
     22  await asyncStartTLSTestServer(
     23    "DelegatedCredentialsServer",
     24    "../../../security/manager/ssl/tests/unit/test_delegated_credentials"
     25  );
     26 
     27  let nssComponent = Cc["@mozilla.org/psm;1"].getService(Ci.nsINSSComponent);
     28  await nssComponent.asyncClearSSLExternalAndInternalSessionCache();
     29 });
     30 
     31 registerCleanupFunction(async () => {
     32  trr_clear_prefs();
     33  Services.prefs.clearUserPref("network.dns.upgrade_with_https_rr");
     34  Services.prefs.clearUserPref("network.dns.use_https_rr_as_altsvc");
     35  Services.prefs.clearUserPref("network.dns.echconfig.enabled");
     36  Services.prefs.clearUserPref(
     37    "network.dns.echconfig.fallback_to_origin_when_all_failed"
     38  );
     39  if (trrServer) {
     40    await trrServer.stop();
     41  }
     42 });
     43 
     44 function makeChan(url) {
     45  let chan = NetUtil.newChannel({
     46    uri: url,
     47    loadUsingSystemPrincipal: true,
     48    contentPolicyType: Ci.nsIContentPolicy.TYPE_DOCUMENT,
     49  }).QueryInterface(Ci.nsIHttpChannel);
     50  return chan;
     51 }
     52 
     53 function channelOpenPromise(chan, flags) {
     54  return new Promise(resolve => {
     55    function finish(req, buffer) {
     56      certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData(
     57        false
     58      );
     59      resolve([req, buffer]);
     60    }
     61    certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData(
     62      false
     63    );
     64    chan.asyncOpen(new ChannelListener(finish, null, flags));
     65  });
     66 }
     67 
     68 add_task(async function testRetryWithoutECH() {
     69  const ECH_CONFIG_FIXED =
     70    "AEn+DQBFTQAgACCKB1Y5SfrGIyk27W82xPpzWTDs3q72c04xSurDWlb9CgAEAAEAA2QWZWNoLXB1YmxpYy5leGFtcGxlLmNvbQAA";
     71  trrServer = new TRRServer();
     72  await trrServer.start();
     73 
     74  Services.prefs.setIntPref("network.trr.mode", 3);
     75  Services.prefs.setCharPref(
     76    "network.trr.uri",
     77    `https://foo.example.com:${trrServer.port()}/dns-query`
     78  );
     79  Services.prefs.setBoolPref(
     80    "network.dns.echconfig.fallback_to_origin_when_all_failed",
     81    true
     82  );
     83 
     84  // Only the last record is valid to use.
     85  await trrServer.registerDoHAnswers(
     86    "delegated-disabled.example.com",
     87    "HTTPS",
     88    {
     89      answers: [
     90        {
     91          name: "delegated-disabled.example.com",
     92          ttl: 55,
     93          type: "HTTPS",
     94          flush: false,
     95          data: {
     96            priority: 1,
     97            name: "delegated-disabled.example.com",
     98            values: [
     99              {
    100                key: "echconfig",
    101                value: ECH_CONFIG_FIXED,
    102                needBase64Decode: true,
    103              },
    104            ],
    105          },
    106        },
    107      ],
    108    }
    109  );
    110 
    111  await trrServer.registerDoHAnswers("delegated-disabled.example.com", "A", {
    112    answers: [
    113      {
    114        name: "delegated-disabled.example.com",
    115        ttl: 55,
    116        type: "A",
    117        flush: false,
    118        data: "127.0.0.1",
    119      },
    120    ],
    121  });
    122 
    123  await new TRRDNSListener("delegated-disabled.example.com", {
    124    type: Ci.nsIDNSService.RESOLVE_TYPE_HTTPSSVC,
    125  });
    126 
    127  let chan = makeChan(`https://delegated-disabled.example.com:8443`);
    128  await channelOpenPromise(chan, CL_ALLOW_UNKNOWN_CL);
    129  let securityInfo = chan.securityInfo;
    130 
    131  Assert.ok(
    132    !securityInfo.isAcceptedEch,
    133    "This host should not have accepted ECH"
    134  );
    135  await trrServer.stop();
    136 });