netwerk/test/unit/test_httpssvc_retry_without_ech.js

   1 /* This Source Code Form is subject to the terms of the Mozilla Public
   2  * License, v. 2.0. If a copy of the MPL was not distributed with this
   3  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   4
   5 "use strict";
   6
   7 let trrServer;
   8
   9 const certOverrideService = Cc[
  10   "@mozilla.org/security/certoverride;1"
  11 ].getService(Ci.nsICertOverrideService);
  12
  13 add_setup(async function setup() {
  14   trr_test_setup();
  15
  16   Services.prefs.setIntPref("network.trr.mode", Ci.nsIDNSService.MODE_TRRFIRST);
  17   Services.prefs.setBoolPref("network.dns.upgrade_with_https_rr", true);
  18   Services.prefs.setBoolPref("network.dns.use_https_rr_as_altsvc", true);
  19   Services.prefs.setBoolPref("network.dns.echconfig.enabled", true);
  20
  21   // An arbitrary, non-ECH server.
  22   await asyncStartTLSTestServer(
  23     "DelegatedCredentialsServer",
  24     "../../../security/manager/ssl/tests/unit/test_delegated_credentials"
  25   );
  26
  27   let nssComponent = Cc["@mozilla.org/psm;1"].getService(Ci.nsINSSComponent);
  28   await nssComponent.asyncClearSSLExternalAndInternalSessionCache();
  29 });
  30
  31 registerCleanupFunction(async () => {
  32   trr_clear_prefs();
  33   Services.prefs.clearUserPref("network.dns.upgrade_with_https_rr");
  34   Services.prefs.clearUserPref("network.dns.use_https_rr_as_altsvc");
  35   Services.prefs.clearUserPref("network.dns.echconfig.enabled");
  36   Services.prefs.clearUserPref(
  37     "network.dns.echconfig.fallback_to_origin_when_all_failed"
  38   );
  39   if (trrServer) {
  40     await trrServer.stop();
  41   }
  42 });
  43
  44 function makeChan(url) {
  45   let chan = NetUtil.newChannel({
  46     uri: url,
  47     loadUsingSystemPrincipal: true,
  48     contentPolicyType: Ci.nsIContentPolicy.TYPE_DOCUMENT,
  49   }).QueryInterface(Ci.nsIHttpChannel);
  50   return chan;
  51 }
  52
  53 function channelOpenPromise(chan, flags) {
  54   return new Promise(resolve => {
  55     function finish(req, buffer) {
  56       certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData(
  57         false
  58       );
  59       resolve([req, buffer]);
  60     }
  61     certOverrideService.setDisableAllSecurityChecksAndLetAttackersInterceptMyData(
  62       false
  63     );
  64     chan.asyncOpen(new ChannelListener(finish, null, flags));
  65   });
  66 }
  67
  68 add_task(async function testRetryWithoutECH() {
  69   const ECH_CONFIG_FIXED =
  70     "AEn+DQBFTQAgACCKB1Y5SfrGIyk27W82xPpzWTDs3q72c04xSurDWlb9CgAEAAEAA2QWZWNoLXB1YmxpYy5leGFtcGxlLmNvbQAA";
  71   trrServer = new TRRServer();
  72   await trrServer.start();
  73
  74   Services.prefs.setIntPref("network.trr.mode", 3);
  75   Services.prefs.setCharPref(
  76     "network.trr.uri",
  77     `https://foo.example.com:${trrServer.port()}/dns-query`
  78   );
  79   Services.prefs.setBoolPref(
  80     "network.dns.echconfig.fallback_to_origin_when_all_failed",
  81     true
  82   );
  83
  84   // Only the last record is valid to use.
  85   await trrServer.registerDoHAnswers(
  86     "delegated-disabled.example.com",
  87     "HTTPS",
  88     {
  89       answers: [
  90         {
  91           name: "delegated-disabled.example.com",
  92           ttl: 55,
  93           type: "HTTPS",
  94           flush: false,
  95           data: {
  96             priority: 1,
  97             name: "delegated-disabled.example.com",
  98             values: [
  99               {
 100                 key: "echconfig",
 101                 value: ECH_CONFIG_FIXED,
 102                 needBase64Decode: true,
 103               },
 104             ],
 105           },
 106         },
 107       ],
 108     }
 109   );
 110
 111   await trrServer.registerDoHAnswers("delegated-disabled.example.com", "A", {
 112     answers: [
 113       {
 114         name: "delegated-disabled.example.com",
 115         ttl: 55,
 116         type: "A",
 117         flush: false,
 118         data: "127.0.0.1",
 119       },
 120     ],
 121   });
 122
 123   await new TRRDNSListener("delegated-disabled.example.com", {
 124     type: Ci.nsIDNSService.RESOLVE_TYPE_HTTPSSVC,
 125   });
 126
 127   let chan = makeChan(`https://delegated-disabled.example.com:8443`);
 128   await channelOpenPromise(chan, CL_ALLOW_UNKNOWN_CL);
 129   let securityInfo = chan.securityInfo;
 130
 131   Assert.ok(
 132     !securityInfo.isAcceptedEch,
 133     "This host should not have accepted ECH"
 134   );
 135   await trrServer.stop();
 136 });