mirror of
https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake.git
synced 2025-10-13 20:11:19 -04:00
Fix uTLS RoundTripper Inconsistent Key for host:port
This commit fixes an issue described at: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/issues/40224 This bug has been fixed, with test case describing this bug added.
This commit is contained in:
Shelikhoo
parent
56f15a5db7
commit
d8d3e538f1
2 changed files with 301 additions and 1 deletions
|
|
@ -4,6 +4,7 @@ import (
|
||||||
"context"
|
"context"
|
||||||
"crypto/tls"
|
"crypto/tls"
|
||||||
"errors"
|
"errors"
|
||||||
|
"fmt"
|
||||||
"net"
|
"net"
|
||||||
"net/http"
|
"net/http"
|
||||||
"sync"
|
"sync"
|
||||||
|
|
@ -66,7 +67,11 @@ func (r *uTLSHTTPRoundTripperImpl) RoundTrip(req *http.Request) (*http.Response,
|
||||||
return r.backdropTransport.RoundTrip(req)
|
return r.backdropTransport.RoundTrip(req)
|
||||||
}
|
}
|
||||||
for retryCount := 0; retryCount < 5; retryCount++ {
|
for retryCount := 0; retryCount < 5; retryCount++ {
|
||||||
if r.getShouldConnectWithH1(req.URL.Host) {
|
effectivePort := req.URL.Port()
|
||||||
|
if effectivePort == "" {
|
||||||
|
effectivePort = "443"
|
||||||
|
}
|
||||||
|
if r.getShouldConnectWithH1(fmt.Sprintf("%v:%v", req.URL.Hostname(), effectivePort)) {
|
||||||
resp, err := r.httpsH1Transport.RoundTrip(req)
|
resp, err := r.httpsH1Transport.RoundTrip(req)
|
||||||
if errors.Is(err, errEAGAIN) {
|
if errors.Is(err, errEAGAIN) {
|
||||||
continue
|
continue
|
||||||
|
|
|
||||||
|
|
@ -8,6 +8,7 @@ import (
|
||||||
"math/big"
|
"math/big"
|
||||||
"math/rand"
|
"math/rand"
|
||||||
"net/http"
|
"net/http"
|
||||||
|
"os"
|
||||||
"testing"
|
"testing"
|
||||||
"time"
|
"time"
|
||||||
|
|
||||||
|
|
@ -162,3 +163,297 @@ func TestRoundTripper(t *testing.T) {
|
||||||
|
|
||||||
cancel()
|
cancel()
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func TestRoundTripperOnH1DefaultPort(t *testing.T) {
|
||||||
|
if os.Getuid() != 0 {
|
||||||
|
t.SkipNow()
|
||||||
|
}
|
||||||
|
var selfSignedCert []byte
|
||||||
|
var selfSignedPrivateKey *rsa.PrivateKey
|
||||||
|
httpServerContext, cancel := stdcontext.WithCancel(stdcontext.Background())
|
||||||
|
Convey("[Test]Set up http servers", t, func(c C) {
|
||||||
|
c.Convey("[Test]Generate Self-Signed Cert", func(c C) {
|
||||||
|
// Ported from https://gist.github.com/samuel/8b500ddd3f6118d052b5e6bc16bc4c09
|
||||||
|
|
||||||
|
// note that we use the insecure math/rand here because some platforms
|
||||||
|
// fail the test suite at build time in Debian, due to entropy starvation.
|
||||||
|
// since that's not a problem at test time, we do *not* use a secure
|
||||||
|
// mechanism for key generation.
|
||||||
|
//
|
||||||
|
// DO NOT REUSE THIS CODE IN PRODUCTION, IT IS DANGEROUS
|
||||||
|
insecureRandReader := rand.New(rand.NewSource(1337))
|
||||||
|
priv, err := rsa.GenerateKey(insecureRandReader, 4096)
|
||||||
|
c.So(err, ShouldBeNil)
|
||||||
|
template := x509.Certificate{
|
||||||
|
SerialNumber: big.NewInt(1),
|
||||||
|
Subject: pkix.Name{
|
||||||
|
CommonName: "Testing Certificate",
|
||||||
|
},
|
||||||
|
NotBefore: time.Now(),
|
||||||
|
NotAfter: time.Now().Add(time.Hour * 24 * 180),
|
||||||
|
|
||||||
|
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
|
||||||
|
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||||
|
BasicConstraintsValid: true,
|
||||||
|
}
|
||||||
|
derBytes, err := x509.CreateCertificate(insecureRandReader, &template, &template, priv.Public(), priv)
|
||||||
|
c.So(err, ShouldBeNil)
|
||||||
|
selfSignedPrivateKey = priv
|
||||||
|
selfSignedCert = derBytes
|
||||||
|
})
|
||||||
|
c.Convey("[Test]Setup http2 server", func(c C) {
|
||||||
|
listener, err := tls.Listen("tcp", "127.0.0.1:23802", &tls.Config{
|
||||||
|
NextProtos: []string{http2.NextProtoTLS},
|
||||||
|
Certificates: []tls.Certificate{
|
||||||
|
tls.Certificate{Certificate: [][]byte{selfSignedCert}, PrivateKey: selfSignedPrivateKey},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
c.So(err, ShouldBeNil)
|
||||||
|
s := http.Server{}
|
||||||
|
go s.Serve(listener)
|
||||||
|
go func() {
|
||||||
|
<-httpServerContext.Done()
|
||||||
|
s.Close()
|
||||||
|
}()
|
||||||
|
})
|
||||||
|
c.Convey("[Test]Setup http1 server", func(c C) {
|
||||||
|
listener, err := tls.Listen("tcp", "127.0.0.1:443", &tls.Config{
|
||||||
|
NextProtos: []string{"http/1.1"},
|
||||||
|
Certificates: []tls.Certificate{
|
||||||
|
tls.Certificate{Certificate: [][]byte{selfSignedCert}, PrivateKey: selfSignedPrivateKey},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
c.So(err, ShouldBeNil)
|
||||||
|
s := http.Server{}
|
||||||
|
go s.Serve(listener)
|
||||||
|
go func() {
|
||||||
|
<-httpServerContext.Done()
|
||||||
|
s.Close()
|
||||||
|
}()
|
||||||
|
})
|
||||||
|
})
|
||||||
|
for _, v := range []struct {
|
||||||
|
id utls.ClientHelloID
|
||||||
|
name string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_58,
|
||||||
|
name: "HelloChrome_58",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_62,
|
||||||
|
name: "HelloChrome_62",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_70,
|
||||||
|
name: "HelloChrome_70",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_72,
|
||||||
|
name: "HelloChrome_72",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_83,
|
||||||
|
name: "HelloChrome_83",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloFirefox_55,
|
||||||
|
name: "HelloFirefox_55",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloFirefox_55,
|
||||||
|
name: "HelloFirefox_55",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloFirefox_63,
|
||||||
|
name: "HelloFirefox_63",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloFirefox_65,
|
||||||
|
name: "HelloFirefox_65",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloIOS_11_1,
|
||||||
|
name: "HelloIOS_11_1",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloIOS_12_1,
|
||||||
|
name: "HelloIOS_12_1",
|
||||||
|
},
|
||||||
|
} {
|
||||||
|
t.Run("Testing fingerprint for "+v.name, func(t *testing.T) {
|
||||||
|
rtter := NewUTLSHTTPRoundTripper(v.id, &utls.Config{
|
||||||
|
InsecureSkipVerify: true,
|
||||||
|
}, http.DefaultTransport, false)
|
||||||
|
|
||||||
|
for count := 0; count <= 10; count++ {
|
||||||
|
Convey("HTTP 1.1 Test", t, func(c C) {
|
||||||
|
{
|
||||||
|
req, err := http.NewRequest("GET", "https://127.0.0.1/", nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
_, err = rtter.RoundTrip(req)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
Convey("HTTP 2 Test", t, func(c C) {
|
||||||
|
{
|
||||||
|
req, err := http.NewRequest("GET", "https://127.0.0.1:23802/", nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
_, err = rtter.RoundTrip(req)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
cancel()
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestRoundTripperOnH2DefaultPort(t *testing.T) {
|
||||||
|
if os.Getuid() != 0 {
|
||||||
|
t.SkipNow()
|
||||||
|
}
|
||||||
|
var selfSignedCert []byte
|
||||||
|
var selfSignedPrivateKey *rsa.PrivateKey
|
||||||
|
httpServerContext, cancel := stdcontext.WithCancel(stdcontext.Background())
|
||||||
|
Convey("[Test]Set up http servers", t, func(c C) {
|
||||||
|
c.Convey("[Test]Generate Self-Signed Cert", func(c C) {
|
||||||
|
// Ported from https://gist.github.com/samuel/8b500ddd3f6118d052b5e6bc16bc4c09
|
||||||
|
|
||||||
|
// note that we use the insecure math/rand here because some platforms
|
||||||
|
// fail the test suite at build time in Debian, due to entropy starvation.
|
||||||
|
// since that's not a problem at test time, we do *not* use a secure
|
||||||
|
// mechanism for key generation.
|
||||||
|
//
|
||||||
|
// DO NOT REUSE THIS CODE IN PRODUCTION, IT IS DANGEROUS
|
||||||
|
insecureRandReader := rand.New(rand.NewSource(1337))
|
||||||
|
priv, err := rsa.GenerateKey(insecureRandReader, 4096)
|
||||||
|
c.So(err, ShouldBeNil)
|
||||||
|
template := x509.Certificate{
|
||||||
|
SerialNumber: big.NewInt(1),
|
||||||
|
Subject: pkix.Name{
|
||||||
|
CommonName: "Testing Certificate",
|
||||||
|
},
|
||||||
|
NotBefore: time.Now(),
|
||||||
|
NotAfter: time.Now().Add(time.Hour * 24 * 180),
|
||||||
|
|
||||||
|
KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
|
||||||
|
ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
|
||||||
|
BasicConstraintsValid: true,
|
||||||
|
}
|
||||||
|
derBytes, err := x509.CreateCertificate(insecureRandReader, &template, &template, priv.Public(), priv)
|
||||||
|
c.So(err, ShouldBeNil)
|
||||||
|
selfSignedPrivateKey = priv
|
||||||
|
selfSignedCert = derBytes
|
||||||
|
})
|
||||||
|
c.Convey("[Test]Setup http2 server", func(c C) {
|
||||||
|
listener, err := tls.Listen("tcp", "127.0.0.1:443", &tls.Config{
|
||||||
|
NextProtos: []string{http2.NextProtoTLS},
|
||||||
|
Certificates: []tls.Certificate{
|
||||||
|
tls.Certificate{Certificate: [][]byte{selfSignedCert}, PrivateKey: selfSignedPrivateKey},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
c.So(err, ShouldBeNil)
|
||||||
|
s := http.Server{}
|
||||||
|
go s.Serve(listener)
|
||||||
|
go func() {
|
||||||
|
<-httpServerContext.Done()
|
||||||
|
s.Close()
|
||||||
|
}()
|
||||||
|
})
|
||||||
|
c.Convey("[Test]Setup http1 server", func(c C) {
|
||||||
|
listener, err := tls.Listen("tcp", "127.0.0.1:23801", &tls.Config{
|
||||||
|
NextProtos: []string{"http/1.1"},
|
||||||
|
Certificates: []tls.Certificate{
|
||||||
|
tls.Certificate{Certificate: [][]byte{selfSignedCert}, PrivateKey: selfSignedPrivateKey},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
c.So(err, ShouldBeNil)
|
||||||
|
s := http.Server{}
|
||||||
|
go s.Serve(listener)
|
||||||
|
go func() {
|
||||||
|
<-httpServerContext.Done()
|
||||||
|
s.Close()
|
||||||
|
}()
|
||||||
|
})
|
||||||
|
})
|
||||||
|
for _, v := range []struct {
|
||||||
|
id utls.ClientHelloID
|
||||||
|
name string
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_58,
|
||||||
|
name: "HelloChrome_58",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_62,
|
||||||
|
name: "HelloChrome_62",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_70,
|
||||||
|
name: "HelloChrome_70",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_72,
|
||||||
|
name: "HelloChrome_72",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloChrome_83,
|
||||||
|
name: "HelloChrome_83",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloFirefox_55,
|
||||||
|
name: "HelloFirefox_55",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloFirefox_55,
|
||||||
|
name: "HelloFirefox_55",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloFirefox_63,
|
||||||
|
name: "HelloFirefox_63",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloFirefox_65,
|
||||||
|
name: "HelloFirefox_65",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloIOS_11_1,
|
||||||
|
name: "HelloIOS_11_1",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
id: utls.HelloIOS_12_1,
|
||||||
|
name: "HelloIOS_12_1",
|
||||||
|
},
|
||||||
|
} {
|
||||||
|
t.Run("Testing fingerprint for "+v.name, func(t *testing.T) {
|
||||||
|
rtter := NewUTLSHTTPRoundTripper(v.id, &utls.Config{
|
||||||
|
InsecureSkipVerify: true,
|
||||||
|
}, http.DefaultTransport, false)
|
||||||
|
|
||||||
|
for count := 0; count <= 10; count++ {
|
||||||
|
Convey("HTTP 1.1 Test", t, func(c C) {
|
||||||
|
{
|
||||||
|
req, err := http.NewRequest("GET", "https://127.0.0.1:23801/", nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
_, err = rtter.RoundTrip(req)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
|
||||||
|
Convey("HTTP 2 Test", t, func(c C) {
|
||||||
|
{
|
||||||
|
req, err := http.NewRequest("GET", "https://127.0.0.1/", nil)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
_, err = rtter.RoundTrip(req)
|
||||||
|
So(err, ShouldBeNil)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
|
||||||
|
cancel()
|
||||||
|
}
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue