tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

test_encrypted_client_hello.js (2996B)

      1 /* This Source Code Form is subject to the terms of the Mozilla Public
      2 * License, v. 2.0. If a copy of the MPL was not distributed with this
      3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
      4 "use strict";
      5 
      6 // Tests handling of Encrypted Client Hello. These ECHConfigs
      7 // can be regenerated by running EncryptedClientHelloServer
      8 // and dumping the output of SSL_EncodeEchConfig. They do not
      9 // expire. An update here is only needed if the host or ECH
     10 // ciphersuite configuration changes, or if the keypair in
     11 // EncryptedClientHelloServer.cpp is modified.
     12 
     13 // Public name: ech-public.example.com
     14 const ECH_CONFIG_FIXED =
     15  "AEn+DQBFTQAgACCKB1Y5SfrGIyk27W82xPpzWTDs3q72c04xSurDWlb9CgAEAAEAA2QWZWNoLXB1YmxpYy5leGFtcGxlLmNvbQAA";
     16 
     17 // Public name: ech-public.example.com, Unsupported AEAD to prompt retry_configs from a trusted host.
     18 const ECH_CONFIG_TRUSTED_RETRY =
     19  "AEn+DQBFTQAgACCKB1Y5SfrGIyk27W82xPpzWTDs3q72c04xSurDWlb9CgAEAAMAA2QWZWNoLXB1YmxpYy5leGFtcGxlLmNvbQAA";
     20 
     21 // Public name: selfsigned.example.com. Unsupported AEAD to prompt retry_configs from an untrusted host.
     22 const ECH_CONFIG_UNTRUSTED_RETRY =
     23  "AEn+DQBFTQAgACCKB1Y5SfrGIyk27W82xPpzWTDs3q72c04xSurDWlb9CgAEAAMAA2QWc2VsZnNpZ25lZC5leGFtcGxlLmNvbQAA";
     24 
     25 function shouldBeAcceptedEch(aTransportSecurityInfo) {
     26  Assert.ok(
     27    aTransportSecurityInfo.isAcceptedEch,
     28    "This host should have accepted ECH"
     29  );
     30  Assert.ok(
     31    !aTransportSecurityInfo.usedPrivateDNS,
     32    "This connection does not use DoH"
     33  );
     34 }
     35 
     36 function shouldBeRejectedEch(aTransportSecurityInfo) {
     37  Assert.ok(
     38    !aTransportSecurityInfo.isAcceptedEch,
     39    "This host should have rejected ECH"
     40  );
     41  Assert.ok(
     42    !aTransportSecurityInfo.usedPrivateDNS,
     43    "This connection does not use DoH"
     44  );
     45 }
     46 
     47 do_get_profile();
     48 
     49 add_tls_server_setup(
     50  "EncryptedClientHelloServer",
     51  "test_encrypted_client_hello"
     52 );
     53 
     54 // Connect directly without ECH first
     55 add_connection_test(
     56  "ech-public.example.com",
     57  PRErrorCodeSuccess,
     58  null,
     59  shouldBeRejectedEch
     60 );
     61 
     62 // Connect with ECH
     63 add_connection_test(
     64  "ech-private.example.com",
     65  PRErrorCodeSuccess,
     66  null,
     67  shouldBeAcceptedEch,
     68  null,
     69  null,
     70  ECH_CONFIG_FIXED
     71 );
     72 
     73 // Trigger retry_configs by setting an ECHConfig with a different.
     74 // AEAD than the server supports.
     75 add_connection_test(
     76  "ech-private.example.com",
     77  SSL_ERROR_ECH_RETRY_WITH_ECH,
     78  null,
     79  null,
     80  null,
     81  null,
     82  ECH_CONFIG_TRUSTED_RETRY
     83 );
     84 
     85 // Trigger retry_configs, but from a host that is untrusted
     86 // (due to a self-signed certificate for the public name).
     87 // Retry_configs must not be used or reported as available.
     88 add_connection_test(
     89  "ech-private.example.com",
     90  MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT,
     91  null,
     92  null,
     93  null,
     94  null,
     95  ECH_CONFIG_UNTRUSTED_RETRY
     96 );
     97 
     98 // A client-only (retry_without_ech) test is located in
     99 // test_encrypted_client_hello_client_only.js We can't easily restart
    100 // a different server (one without ECHConfigs) here, so put that
    101 // test in a different file that launches a non-ECH server.