-
Notifications
You must be signed in to change notification settings - Fork 705
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
test(s2n-tls-hyper): Add localhost http tests
- Loading branch information
Showing
8 changed files
with
275 additions
and
25 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,14 @@ | ||
-----BEGIN CERTIFICATE----- | ||
MIICLTCCAdOgAwIBAgIUEck98wr+WHfwlEQZ7FynMbi/XZ8wCgYIKoZIzj0EAwIw | ||
azELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkFaMQ4wDAYDVQQHDAVUZW1wZTEPMA0G | ||
A1UECgwGQW1hem9uMRowGAYDVQQLDBFBbWF6b25XZWJTZXJ2aWNlczESMBAGA1UE | ||
AwwJbG9jYWxob3N0MCAXDTI0MDkyNjIyMTc1MVoYDzIxMjQwOTAyMjIxNzUxWjBr | ||
MQswCQYDVQQGEwJVUzELMAkGA1UECAwCQVoxDjAMBgNVBAcMBVRlbXBlMQ8wDQYD | ||
VQQKDAZBbWF6b24xGjAYBgNVBAsMEUFtYXpvbldlYlNlcnZpY2VzMRIwEAYDVQQD | ||
DAlsb2NhbGhvc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATJ3u7mGyF7tZV6 | ||
5po7ZYrbvcNEnBTjRhUqpHuh0CDTFjqzld5uNl5SLMzzgNYVhnpUI0oZl26APPnu | ||
RUyHk1z0o1MwUTAdBgNVHQ4EFgQUizNu1CP7DugWrbpDNpe53rhnTwswHwYDVR0j | ||
BBgwFoAUizNu1CP7DugWrbpDNpe53rhnTwswDwYDVR0TAQH/BAUwAwEB/zAKBggq | ||
hkjOPQQDAgNIADBFAiEA/OQhpG1qNsxPG0PpBTPxUhjRdGJqEtpKAoZQVPujGKAC | ||
IETtPrOuddbfbGtaIWNbxTPCzHInidCPl4VWZwmMCq0d | ||
-----END CERTIFICATE----- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
# SPDX-License-Identifier: Apache-2.0 | ||
|
||
echo "generating ec key and cert" | ||
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -keyout key.pem -out cert.pem -sha256 -days 36500 -nodes -subj "/C=US/ST=AZ/L=Tempe/O=Amazon/OU=AmazonWebServices/CN=localhost" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,5 @@ | ||
-----BEGIN PRIVATE KEY----- | ||
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg8KTDTTja1jS2raS8 | ||
y3vIyWoL2nDrlNUWr9MAAIiRkeehRANCAATJ3u7mGyF7tZV65po7ZYrbvcNEnBTj | ||
RhUqpHuh0CDTFjqzld5uNl5SLMzzgNYVhnpUI0oZl26APPnuRUyHk1z0 | ||
-----END PRIVATE KEY----- |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,79 @@ | ||
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
// SPDX-License-Identifier: Apache-2.0 | ||
|
||
use bytes::Bytes; | ||
use http::{Request, Response}; | ||
use http_body_util::{combinators::BoxBody, BodyExt}; | ||
use hyper::service::service_fn; | ||
use hyper_util::rt::{TokioExecutor, TokioIo}; | ||
use s2n_tls::connection::Builder; | ||
use s2n_tls_tokio::TlsAcceptor; | ||
use std::{error::Error, future::Future}; | ||
use tokio::net::TcpListener; | ||
|
||
async fn echo( | ||
req: Request<hyper::body::Incoming>, | ||
) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> { | ||
Ok(Response::new(req.into_body().boxed())) | ||
} | ||
|
||
async fn serve_echo<B>( | ||
tcp_listener: TcpListener, | ||
builder: B, | ||
) -> Result<(), Box<dyn Error + Send + Sync>> | ||
where | ||
B: Builder, | ||
<B as Builder>::Output: Unpin + Send + Sync + 'static, | ||
{ | ||
let (tcp_stream, _) = tcp_listener.accept().await?; | ||
let acceptor = TlsAcceptor::new(builder); | ||
let tls_stream = acceptor.accept(tcp_stream).await?; | ||
let io = TokioIo::new(tls_stream); | ||
|
||
let server = hyper_util::server::conn::auto::Builder::new(TokioExecutor::new()); | ||
if let Err(err) = server.serve_connection(io, service_fn(echo)).await { | ||
// The hyper client doesn't gracefully terminate by waiting for the server's shutdown. | ||
// Instead, the client sends its shutdown and then immediately closes the socket. This can | ||
// cause a NotConnected error to be emitted when the server attempts to send its shutdown. | ||
// | ||
// For now, NotConnected errors are ignored. After the hyper client can be configured to | ||
// gracefully shutdown, this exception can be removed. | ||
if let Some(hyper_err) = err.downcast_ref::<hyper::Error>() { | ||
if let Some(source) = hyper_err.source() { | ||
if let Some(io_err) = source.downcast_ref::<tokio::io::Error>() { | ||
if io_err.kind() == std::io::ErrorKind::NotConnected { | ||
return Ok(()); | ||
} | ||
} | ||
} | ||
} | ||
|
||
return Err(err); | ||
} | ||
|
||
Ok(()) | ||
} | ||
|
||
pub async fn make_echo_request<B, F, Fut>( | ||
server_builder: B, | ||
send_client_request: F, | ||
) -> Result<(), Box<dyn Error + Send + Sync>> | ||
where | ||
B: Builder + Send + Sync + 'static, | ||
<B as Builder>::Output: Unpin + Send + Sync + 'static, | ||
F: FnOnce(u16) -> Fut, | ||
Fut: Future<Output = Result<(), Box<dyn Error + Send + Sync>>> + Send + 'static, | ||
{ | ||
let listener = TcpListener::bind("127.0.0.1:0").await?; | ||
let addr = listener.local_addr()?; | ||
|
||
let mut tasks = tokio::task::JoinSet::new(); | ||
tasks.spawn(serve_echo(listener, server_builder)); | ||
tasks.spawn(send_client_request(addr.port())); | ||
|
||
while let Some(res) = tasks.join_next().await { | ||
res.unwrap()?; | ||
} | ||
|
||
Ok(()) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,31 @@ | ||
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
// SPDX-License-Identifier: Apache-2.0 | ||
|
||
use s2n_tls::{callbacks::VerifyHostNameCallback, config, error::Error, security::DEFAULT_TLS13}; | ||
|
||
pub mod echo; | ||
|
||
/// NOTE: this certificate and key are used for testing purposes only! | ||
pub static CERT_PEM: &[u8] = include_bytes!(concat!( | ||
env!("CARGO_MANIFEST_DIR"), | ||
"/tests/common/certs/cert.pem" | ||
)); | ||
pub static KEY_PEM: &[u8] = include_bytes!(concat!( | ||
env!("CARGO_MANIFEST_DIR"), | ||
"/tests/common/certs/key.pem" | ||
)); | ||
|
||
pub fn config() -> Result<config::Builder, Error> { | ||
let mut builder = config::Config::builder(); | ||
builder.set_security_policy(&DEFAULT_TLS13)?; | ||
builder.trust_pem(CERT_PEM)?; | ||
builder.load_pem(CERT_PEM, KEY_PEM)?; | ||
Ok(builder) | ||
} | ||
|
||
pub struct InsecureAcceptAllCertificatesHandler {} | ||
impl VerifyHostNameCallback for InsecureAcceptAllCertificatesHandler { | ||
fn verify_host_name(&self, _host_name: &str) -> bool { | ||
true | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,140 @@ | ||
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. | ||
// SPDX-License-Identifier: Apache-2.0 | ||
|
||
use crate::common::InsecureAcceptAllCertificatesHandler; | ||
use bytes::Bytes; | ||
use http::{Method, Request, Uri}; | ||
use http_body_util::{BodyExt, Empty, Full}; | ||
use hyper_util::{client::legacy::Client, rt::TokioExecutor}; | ||
use s2n_tls::{ | ||
callbacks::{ClientHelloCallback, ConnectionFuture}, | ||
connection::Connection, | ||
}; | ||
use s2n_tls_hyper::connector::HttpsConnector; | ||
use std::{error::Error, pin::Pin, str::FromStr}; | ||
|
||
pub mod common; | ||
|
||
const TEST_DATA: &[u8] = "hello world".as_bytes(); | ||
|
||
// The maximum TLS record payload is 2^14 bytes. | ||
// Send more to ensure multiple records. | ||
const LARGE_TEST_DATA: &[u8] = &[5; (1 << 15)]; | ||
|
||
#[tokio::test] | ||
async fn test_get_request() -> Result<(), Box<dyn Error + Send + Sync>> { | ||
let config = common::config()?.build()?; | ||
common::echo::make_echo_request(config.clone(), |port| async move { | ||
let connector = HttpsConnector::new(config.clone()); | ||
let client: Client<_, Empty<Bytes>> = | ||
Client::builder(TokioExecutor::new()).build(connector); | ||
|
||
let uri = Uri::from_str(format!("https://localhost:{}", port).as_str())?; | ||
let response = client.get(uri).await?; | ||
assert_eq!(response.status(), 200); | ||
|
||
Ok(()) | ||
}) | ||
.await?; | ||
|
||
Ok(()) | ||
} | ||
|
||
#[tokio::test] | ||
async fn test_http_methods() -> Result<(), Box<dyn Error + Send + Sync>> { | ||
let methods = [Method::GET, Method::POST, Method::PUT, Method::DELETE]; | ||
for method in methods { | ||
let config = common::config()?.build()?; | ||
common::echo::make_echo_request(config.clone(), |port| async move { | ||
let connector = HttpsConnector::new(config.clone()); | ||
let client: Client<_, Full<Bytes>> = | ||
Client::builder(TokioExecutor::new()).build(connector); | ||
let request: Request<Full<Bytes>> = Request::builder() | ||
.method(method) | ||
.uri(Uri::from_str( | ||
format!("https://localhost:{}", port).as_str(), | ||
)?) | ||
.body(Full::from(TEST_DATA))?; | ||
|
||
let response = client.request(request).await?; | ||
assert_eq!(response.status(), 200); | ||
|
||
let body = response.into_body().collect().await?.to_bytes(); | ||
assert_eq!(body.to_vec().as_slice(), TEST_DATA); | ||
|
||
Ok(()) | ||
}) | ||
.await?; | ||
} | ||
|
||
Ok(()) | ||
} | ||
|
||
#[tokio::test] | ||
async fn test_large_request() -> Result<(), Box<dyn Error + Send + Sync>> { | ||
let config = common::config()?.build()?; | ||
common::echo::make_echo_request(config.clone(), |port| async move { | ||
let connector = HttpsConnector::new(config.clone()); | ||
let client: Client<_, Full<Bytes>> = Client::builder(TokioExecutor::new()).build(connector); | ||
let request: Request<Full<Bytes>> = Request::builder() | ||
.method(Method::POST) | ||
.uri(Uri::from_str( | ||
format!("https://localhost:{}", port).as_str(), | ||
)?) | ||
.body(Full::from(LARGE_TEST_DATA))?; | ||
|
||
let response = client.request(request).await?; | ||
assert_eq!(response.status(), 200); | ||
|
||
let body = response.into_body().collect().await?.to_bytes(); | ||
assert_eq!(body.to_vec().as_slice(), LARGE_TEST_DATA); | ||
|
||
Ok(()) | ||
}) | ||
.await?; | ||
|
||
Ok(()) | ||
} | ||
|
||
#[tokio::test] | ||
async fn test_sni() -> Result<(), Box<dyn Error + Send + Sync>> { | ||
struct TestClientHelloHandler { | ||
expected_server_name: &'static str, | ||
} | ||
impl ClientHelloCallback for TestClientHelloHandler { | ||
fn on_client_hello( | ||
&self, | ||
connection: &mut Connection, | ||
) -> Result<Option<Pin<Box<dyn ConnectionFuture>>>, s2n_tls::error::Error> { | ||
let server_name = connection.server_name().unwrap(); | ||
assert_eq!(server_name, self.expected_server_name); | ||
Ok(None) | ||
} | ||
} | ||
|
||
for hostname in ["localhost", "127.0.0.1"] { | ||
let mut config = common::config()?; | ||
config.set_client_hello_callback(TestClientHelloHandler { | ||
// Ensure that the HttpsConnector correctly sets the SNI according to the hostname in | ||
// the URI. | ||
expected_server_name: hostname, | ||
})?; | ||
config.set_verify_host_callback(InsecureAcceptAllCertificatesHandler {})?; | ||
let config = config.build()?; | ||
|
||
common::echo::make_echo_request(config.clone(), |port| async move { | ||
let connector = HttpsConnector::new(config.clone()); | ||
let client: Client<_, Empty<Bytes>> = | ||
Client::builder(TokioExecutor::new()).build(connector); | ||
|
||
let uri = Uri::from_str(format!("https://{}:{}", hostname, port).as_str())?; | ||
let response = client.get(uri).await?; | ||
assert_eq!(response.status(), 200); | ||
|
||
Ok(()) | ||
}) | ||
.await?; | ||
} | ||
|
||
Ok(()) | ||
} |
This file was deleted.
Oops, something went wrong.