nim-lsquic/tests/test_verifier.nim at c531346c8f4af355622e1da1489bc29d4a38683c · vacp2p/nim-lsquic · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
# SPDX-License-Identifier: Apache-2.0 OR MIT
# Copyright (c) Status Research & Development GmbH

{.used.}

import std/sets
import chronos, chronos/unittest2/asynctests, results, chronicles
import lsquic
import ./helpers/certificate

trace "chronicles has to be imported to fix Error: undeclared identifier: 'activeChroniclesStream'"

initializeLsquic(true, true)

type RejectVerifierRecorder = ref object
  rejectCount: int

proc singleAlpn(name: string = "test"): HashSet[string] =
  var alpn = initHashSet[string]()
  alpn.incl(name)
  alpn

proc acceptingCertificateCb(
    serverName: string, derCertificates: seq[seq[byte]]
): bool {.gcsafe.} =
  discard serverName
  derCertificates.len > 0

proc rejectingCertificateCb(
    serverName: string, derCertificates: seq[seq[byte]]
): bool {.gcsafe.} =
  discard serverName
  discard derCertificates
  false

proc raisingCertificateCb(
    serverName: string, derCertificates: seq[seq[byte]]
): bool {.gcsafe.} =
  discard serverName
  discard derCertificates
  raise newException(ValueError, "verifier failed")

proc makeRejectingCertificateCb(
    recorder: RejectVerifierRecorder
): certificateVerifierCB =
  return proc(serverName: string, derCertificates: seq[seq[byte]]): bool {.gcsafe.} =
    discard serverName
    discard derCertificates
    inc recorder.rejectCount
    false

proc makeClientWithVerifier(
    verifier: CertificateVerifier, alpn: HashSet[string] = singleAlpn()
): QuicClient =
  let tlsConfig =
    TLSConfig.new(testCertificate(), testPrivateKey(), alpn, Opt.some(verifier))
  QuicClient.new(tlsConfig)

proc makeServerWithVerifier(
    verifier: CertificateVerifier, alpn: HashSet[string] = singleAlpn()
): QuicServer =
  let tlsConfig =
    TLSConfig.new(testCertificate(), testPrivateKey(), alpn, Opt.some(verifier))
  QuicServer.new(tlsConfig)

suite "certificate verifier":
  teardown:
    cleanupLsquic()

  asyncTest "accepting custom verifier allows handshake":
    let client =
      makeClientWithVerifier(CustomCertificateVerifier.init(acceptingCertificateCb))
    let server =
      makeServerWithVerifier(CustomCertificateVerifier.init(acceptingCertificateCb))
    let listener = server.listen(initTAddress("127.0.0.1:0"))
    defer:
      await allFutures(client.stop(), listener.stop())

    let accepting = listener.accept()
    let outgoing = await client.dial(listener.localAddress())
    let incoming = await accepting

    check:
      outgoing.certificates().len == 1
      incoming.certificates().len == 1

    outgoing.close()
    incoming.close()

  asyncTest "rejecting client verifier rejects handshake":
    let client =
      makeClientWithVerifier(CustomCertificateVerifier.init(rejectingCertificateCb))
    let server =
      makeServerWithVerifier(CustomCertificateVerifier.init(acceptingCertificateCb))
    let listener = server.listen(initTAddress("127.0.0.1:0"))
    defer:
      await allFutures(client.stop(), listener.stop())

    expect DialError:
      discard await client.dial(listener.localAddress())

  asyncTest "raising client verifier rejects handshake":
    let client =
      makeClientWithVerifier(CustomCertificateVerifier.init(raisingCertificateCb))
    let server =
      makeServerWithVerifier(CustomCertificateVerifier.init(acceptingCertificateCb))
    let listener = server.listen(initTAddress("127.0.0.1:0"))
    defer:
      await allFutures(client.stop(), listener.stop())

    expect DialError:
      discard await client.dial(listener.localAddress())

  asyncTest "alpn mismatch rejects handshake":
    let client = makeClientWithVerifier(
      CustomCertificateVerifier.init(acceptingCertificateCb), singleAlpn("client-proto")
    )
    let server = makeServerWithVerifier(
      CustomCertificateVerifier.init(acceptingCertificateCb), singleAlpn("server-proto")
    )
    let listener = server.listen(initTAddress("127.0.0.1:0"))
    defer:
      await allFutures(client.stop(), listener.stop())

    expect DialError:
      discard await client.dial(listener.localAddress())

  asyncTest "server-side verifier callback does not fail handshake without client auth":
    let recorder = RejectVerifierRecorder()
    let client =
      makeClientWithVerifier(CustomCertificateVerifier.init(acceptingCertificateCb))
    let server = makeServerWithVerifier(
      CustomCertificateVerifier.init(recorder.makeRejectingCertificateCb())
    )
    let listener = server.listen(initTAddress("127.0.0.1:0"))
    defer:
      await allFutures(client.stop(), listener.stop())

    let outgoing = await client.dial(listener.localAddress())
    await sleepAsync(100.milliseconds)

    check:
      outgoing.certificates().len == 1
      recorder.rejectCount == 1

    outgoing.close()

  asyncTest "insecure verifier allows handshake":
    let client = makeClientWithVerifier(InsecureCertificateVerifier.init())
    let server =
      makeServerWithVerifier(CustomCertificateVerifier.init(acceptingCertificateCb))
    let listener = server.listen(initTAddress("127.0.0.1:0"))
    defer:
      await allFutures(client.stop(), listener.stop())

    let accepting = listener.accept()
    let outgoing = await client.dial(listener.localAddress())
    let incoming = await accepting

    check:
      outgoing.certificates().len == 1
      incoming.certificates().len == 1

    outgoing.close()
    incoming.close()