SSL certificate verify GitHub action (#13697)
* Implement SSL/TLS certificate checking #782 * SSL: Add nimDisableCertificateValidation Remove NIM_SSL_CERT_VALIDATION env var tests/untestable/thttpclient_ssl.nim ran successfully on Linux with libssl 1.1.1d * SSL: update integ test to skip flapping tests * Revert .travis.yml change * nimDisableCertificateValidation disable imports Prevent loading symbols that are not defined on older SSL libs * SSL: disable verification in net.nim ..when nimDisableCertificateValidation is set * Update changelog * Fix peername type * Add define check for windows * Disable test on windows * Add exprimental GitHub action CI for SSL * Test nimDisableCertificateValidation
This commit is contained in:
Federico Ceratto
GitHub
parent
1d665adecd
commit
5b85444244
13 changed files with 872 additions and 12 deletions
126
tests/stdlib/thttpclient_ssl.nim
Normal file
126
tests/stdlib/thttpclient_ssl.nim
Normal file
|
|
@ -0,0 +1,126 @@
|
|||
discard """
|
||||
cmd: "nim $target --threads:on -d:ssl $options $file"
|
||||
"""
|
||||
|
||||
# Nim - Basic SSL integration tests
|
||||
# (c) Copyright 2018 Nim contributors
|
||||
#
|
||||
# See the file "copying.txt", included in this
|
||||
# distribution, for details about the copyright.
|
||||
#
|
||||
## Warning: this test performs local networking.
|
||||
## Test with:
|
||||
## ./bin/nim c -d:ssl -p:. --threads:on -r tests/stdlib/thttpclient_ssl.nim
|
||||
|
||||
when not defined(windows):
|
||||
# Disabled on Windows due to old OpenSSL version
|
||||
|
||||
import
|
||||
httpclient,
|
||||
net,
|
||||
openssl,
|
||||
os,
|
||||
strutils,
|
||||
threadpool,
|
||||
times,
|
||||
unittest
|
||||
|
||||
# bogus self-signed certificate
|
||||
const
|
||||
certFile = "tests/stdlib/thttpclient_ssl_cert.pem"
|
||||
keyFile = "tests/stdlib/thttpclient_ssl_key.pem"
|
||||
|
||||
proc log(msg: string) =
|
||||
when defined(ssldebug):
|
||||
echo " [" & $epochTime() & "] " & msg
|
||||
# FIXME
|
||||
echo " [" & $epochTime() & "] " & msg
|
||||
discard
|
||||
|
||||
proc runServer(port: Port): bool {.thread.} =
|
||||
## Run a trivial HTTPS server in a {.thread.}
|
||||
## Exit after serving one request
|
||||
|
||||
var socket = newSocket()
|
||||
socket.setSockOpt(OptReusePort, true)
|
||||
socket.bindAddr(port)
|
||||
|
||||
var ctx = newContext(certFile=certFile, keyFile=keyFile)
|
||||
|
||||
## Handle one connection
|
||||
socket.listen()
|
||||
|
||||
var client: Socket
|
||||
var address = ""
|
||||
|
||||
log "server: ready"
|
||||
socket.acceptAddr(client, address)
|
||||
log "server: incoming connection"
|
||||
|
||||
var ssl: SslPtr = SSL_new(ctx.context)
|
||||
discard SSL_set_fd(ssl, client.getFd())
|
||||
log "server: accepting connection"
|
||||
if SSL_accept(ssl) <= 0:
|
||||
ERR_print_errors_fp(stderr)
|
||||
else:
|
||||
const reply = "HTTP/1.0 200 OK\r\nServer: test\r\nContent-type: text/html\r\nContent-Length: 0\r\n\r\n"
|
||||
log "server: sending reply"
|
||||
discard SSL_write(ssl, reply.cstring, reply.len)
|
||||
|
||||
log "server: receiving a line"
|
||||
let line = client.recvLine()
|
||||
log "server: received $# bytes" % $line.len
|
||||
log "closing"
|
||||
SSL_free(ssl)
|
||||
close(client)
|
||||
close(socket)
|
||||
log "server: exited"
|
||||
|
||||
|
||||
suite "SSL self signed certificate check":
|
||||
|
||||
test "TCP socket":
|
||||
const port = 12347.Port
|
||||
let t = spawn runServer(port)
|
||||
sleep(100)
|
||||
var sock = newSocket()
|
||||
var ctx = newContext()
|
||||
ctx.wrapSocket(sock)
|
||||
try:
|
||||
log "client: connect"
|
||||
sock.connect("127.0.0.1", port)
|
||||
fail()
|
||||
except:
|
||||
let msg = getCurrentExceptionMsg()
|
||||
check(msg.contains("certificate verify failed"))
|
||||
|
||||
test "HttpClient default: no check":
|
||||
const port = 12345.Port
|
||||
let t = spawn runServer(port)
|
||||
sleep(100)
|
||||
|
||||
var client = newHttpClient()
|
||||
try:
|
||||
log "client: connect"
|
||||
discard client.getContent("https://127.0.0.1:12345")
|
||||
except:
|
||||
let msg = getCurrentExceptionMsg()
|
||||
log "client: unexpected exception: " & msg
|
||||
fail()
|
||||
|
||||
test "HttpClient with CVerifyPeer":
|
||||
const port = 12346.Port
|
||||
let t = spawn runServer(port)
|
||||
sleep(100)
|
||||
|
||||
var client = newHttpClient(sslContext=newContext(verifyMode=CVerifyPeer))
|
||||
try:
|
||||
log "client: connect"
|
||||
discard client.getContent("https://127.0.0.1:12346")
|
||||
log "getContent should have raised an exception"
|
||||
fail()
|
||||
except:
|
||||
let msg = getCurrentExceptionMsg()
|
||||
log "client: exception: " & msg
|
||||
# SSL_shutdown:shutdown while in init
|
||||
check(msg.contains("shutdown while in init") or msg.contains("alert number 48"))
|
||||
29
tests/stdlib/thttpclient_ssl_cert.pem
Normal file
29
tests/stdlib/thttpclient_ssl_cert.pem
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIFCTCCAvGgAwIBAgIURYQOmGzeh3Vy7Gk6Go4uAPwcNwAwDQYJKoZIhvcNAQEL
|
||||
BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTE5MDEyMzAwMTgzNFoXDTQ2MDYw
|
||||
OTAwMTgzNFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIICIjANBgkqhkiG9w0BAQEF
|
||||
AAOCAg8AMIICCgKCAgEAzoEVEl7yqY+RqIagXDD4JB7LyONDvh8aJvBMnJVBgjaL
|
||||
JdkfQjvPGUzUkEbU5nc6u7lqFxzEv7hXrssQCB7TwJwfS2PT1Rj14IFlYPyw4DEe
|
||||
P1RVS/awurtv3jwumarVl7LR+IQfo59kJ/P8jZt8H3HscDbyhXcHeOWI6q+XlfdV
|
||||
mTUJVvABdUuOiIFjgfFVTpo+CKxy7c5caRDK7g1s9xB1/M9PUfJvHY1WrBWFOZf0
|
||||
Bl8iwn+ahuxfIVqsFL9leqLykgi1f4L20p7RaAK95TXCo3CszZm4Fsw9zhzkjoU7
|
||||
2h0nuYl197LZvRs3u/JJjzZERmsfVPIs5BtO8/MN1MvRn6hIGU5Q3kOVWqWxSkSl
|
||||
njrf+uwUdn/24uSCnygNeDuJzwW/2q4N9YI3oovqNIGpkT3FbAm7UKwI4lwhwmqw
|
||||
7WH+92ELj0BinmsMMRPD2OqvK+vzLVqwUIQkYug+Hjys6QGXMlrL0krrj7XOKSc3
|
||||
SvZa4j0S/Y5CKkw5xuZXxITsdaV6hGi3d/kuT+1ttOSfIIXJXDEiu4pYRfziKU1a
|
||||
8EhHMEajEi6ueLw7QmEPVx398erRwiUuP2y43yZ4mwVwvN3i5jlVztl4XsglDmQ+
|
||||
hahstVdMMA34K2rK0U8q8YjdYm+z99NmGEPYrS6Qnpr1xrICN83FOWFI0k7ttyMC
|
||||
AwEAAaNTMFEwHQYDVR0OBBYEFLqMY6eP3h3gu+ANs77xDBRnElxyMB8GA1UdIwQY
|
||||
MBaAFLqMY6eP3h3gu+ANs77xDBRnElxyMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZI
|
||||
hvcNAQELBQADggIBAJS+wyy0r+tVAlCa6V/xxlCDtW9n6L2nsqJXEjME0VvwGs3m
|
||||
ima68LyTQJqCSjjxSotaNOYKzUu4vRA3JssV+fUDR+NpmhpRuM74XmO05HUQkp9U
|
||||
dBEHyXp2aRQ9LSdvHo5D+RW+J4sHFb3PbU8NPx/t5Dg7il92S2QJQz1jNl+Nezc6
|
||||
2O8Vt1YbvWXfqM47URTpnQbWoo38pI44AgAuW3QagucKWsyounmhx65XcdtLn99g
|
||||
oZt496pU+hBpYu/IpXuBKNC4FvOrXTWAPkAbbYP39UFyiKwIyTosK+qdbhBlt1xi
|
||||
bBPn6N1W9L2BvUwM8fEB/qBuR9UfcMsIYJsWbbXMfyeF6lbaP7xD01rm+yU5PMMI
|
||||
Co40abixMntz4J3T2ixdCptf0He1U/UegOHwG1ZGgQzvOG6qI/xkNktDaSA75KR7
|
||||
BvPV1CmZC4ovVo1L4STrwnoRz5J49PNOHi9Okj9zJ99H7nsmsK16oxpIYkYHJWn+
|
||||
45jpG8SlDp7oev1OGGk/z+ZOTz+LcNxyvsRQVN8w5zNmjCSWiGqz+UUgppCZg8qd
|
||||
ECWokNQ5Lr20t1whynrX5bH0l887WPCQmm5VduRoyKFGhCRBSzcCtowSpiwZglUk
|
||||
CV0jgFKoteItdzZgsND5I1GaNOxZlnK3wN4H0pgZv7HlW6SP1OYd2Y67waJ7
|
||||
-----END CERTIFICATE-----
|
||||
52
tests/stdlib/thttpclient_ssl_key.pem
Normal file
52
tests/stdlib/thttpclient_ssl_key.pem
Normal file
|
|
@ -0,0 +1,52 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDOgRUSXvKpj5Go
|
||||
hqBcMPgkHsvI40O+Hxom8EyclUGCNosl2R9CO88ZTNSQRtTmdzq7uWoXHMS/uFeu
|
||||
yxAIHtPAnB9LY9PVGPXggWVg/LDgMR4/VFVL9rC6u2/ePC6ZqtWXstH4hB+jn2Qn
|
||||
8/yNm3wfcexwNvKFdwd45Yjqr5eV91WZNQlW8AF1S46IgWOB8VVOmj4IrHLtzlxp
|
||||
EMruDWz3EHX8z09R8m8djVasFYU5l/QGXyLCf5qG7F8hWqwUv2V6ovKSCLV/gvbS
|
||||
ntFoAr3lNcKjcKzNmbgWzD3OHOSOhTvaHSe5iXX3stm9Gze78kmPNkRGax9U8izk
|
||||
G07z8w3Uy9GfqEgZTlDeQ5VapbFKRKWeOt/67BR2f/bi5IKfKA14O4nPBb/arg31
|
||||
gjeii+o0gamRPcVsCbtQrAjiXCHCarDtYf73YQuPQGKeawwxE8PY6q8r6/MtWrBQ
|
||||
hCRi6D4ePKzpAZcyWsvSSuuPtc4pJzdK9lriPRL9jkIqTDnG5lfEhOx1pXqEaLd3
|
||||
+S5P7W205J8ghclcMSK7ilhF/OIpTVrwSEcwRqMSLq54vDtCYQ9XHf3x6tHCJS4/
|
||||
bLjfJnibBXC83eLmOVXO2XheyCUOZD6FqGy1V0wwDfgrasrRTyrxiN1ib7P302YY
|
||||
Q9itLpCemvXGsgI3zcU5YUjSTu23IwIDAQABAoICAQCdR60/57cUs/dxjs/2R4nH
|
||||
IPl/ELEYzeGCRMVlATz6qwZCFmN7c8ghceX32SrwOWEvd2G5Jr0ndIS76YdVV/1Z
|
||||
ls8zAV5m0HL8wjDvtKYWqvJps5afm80w+++RKO8pNPcnahgIGsFqQszqrSbux7y6
|
||||
ym8VbJQ8WNMFHnWwoXpnyxCT9tQdNgE2UAzIJRwf7SpXCp0yx/1k6CZ0E0ksFGeo
|
||||
qQ3kNhUoyegdbvfTazSkD/rZG36C+uM73i36Xm/wAXKN/CuaVC3AZ4QMGNBPUr9F
|
||||
IzQSfY/vrCOMoZR1NoZRkmJqlogaBPsnZD34jRFfAYNLIz7PD2m2rhjIx4/Tt4wQ
|
||||
5mUwga9ud0ly5wSzswudw07mTYtsLbWrUn6QdFxSwbQ0tXh9PJrqCSJDmYIptuu/
|
||||
6zjg8hQLg7y37xMDMCdKtviHx+ndVpW3StTwB/z7lDA6yuYY6nYN0dJTJS3qQheo
|
||||
maPG4Xf4FBcD4Is73BjBCf3QR6WIv0ZOG3/GZ1OqLRrPg1u/3UJkpa4LE/6qNUxf
|
||||
zdBZSPyQZExBvOqdklEI+1OcqofmWq2n7Amct45buDbFryehEhfJ1HHtkXkTEsut
|
||||
azfQeaGem/jKxcTD+1bWs/Q5Nn+QFfKr0NFjXSLoITWQkgQD1qISw3DC72jYXlsm
|
||||
S4CmCDW1dHZlmWZq+Mh34QKCAQEA+2JFRa1yYZ0tPt88sOjJYyw9yUxB9Nv9cKrs
|
||||
kdkhKHKevF+0BUbRLfp9bod+Wlv66pgQi6ZGKkGD7lCam/3FIBlmmiG8AOoXdoGy
|
||||
t17XCzlYy348mnHra2X+JBAN51ivPemdlGZShLbNMkGdL1khtjHL9vSr1KgFn3F/
|
||||
8nstVQ9nzHTCK0HWpBGn/EK3dd8lcYZDd7Fcgjz7E3xQDz/XZt0HMwwGaLnQ1L7T
|
||||
glIyeNdqLBp4v0NT6L1AAk5rQJONo57AepblwacYhoW9mR5K0bm/BMo5+xwMtYz9
|
||||
69ZuMNW8qdaWrzeEsxM1PDbcOoVqChF10w0Ih/MkhKGpN/GxUQKCAQEA0kvWUkEK
|
||||
1BBhwGyuKrMnUC3jnQ36KpsjlryMUArdjS2gVBztGW2p2CUWasEgZdxpwQmnqKyz
|
||||
4hcZaU/JUleutTI5raxzju4Ve87c+koOiamhw/zaiLCpLn2j0Rh2qxp7QvPPRO0V
|
||||
1MN347wjCTx/5/j8WffgWqWfqdrd8JheKal/OHlTZA3DG77FIVnUyov8Np+lTd1x
|
||||
NpWr/AOreZlMBq/X/kmWCe+fP901fGdi3cdsKcJcdLPv9KFciSjBlAlaLMnBgLWo
|
||||
RrIuNxdH3dRX4rzBSpdNq72n8NaH+A10eoXrlC4eWLo7vRSTe4WRgUAIbhVifnJk
|
||||
z4B5FqC/aVgkMwKCAQEAtq983h0lcbDy76z2Ay65I/xDzqU/jX3OGfHtSDS+NxHN
|
||||
L+JxBiCn5b0TKJ8JAQu1NoVaCNLGTPEdurQTF+f9OM2c1chMQ3HbqUCqKz6eEscT
|
||||
M5dC3Y6KYptVbMnKAOVfPSQoY29U6qOaTbqHS6B/slNQAeFfeoS8yVmHfSVtFVLD
|
||||
wT7c2OjY3pUCOn4Vq3CGWpETOMnJC9DbOhbua5aeqF9aWwuTIMpg7CrdtOidS1pp
|
||||
CzIVrBF2yj22ZbatlNlmZpD5Gl3NDMWtOh25Yqwz/WP6YLXCGy4QQmP7KEfF/nFl
|
||||
0RtkmGNFaYo89sx7kX/hRv3XXZAsMfhOAqElQ8W+cQKCAQAdL/lnIS/njv6CPpNN
|
||||
yd/C+RuGSNJX54BhA3pWAawOVC7Ufc9KoDXakgsydeuRN65V5IkomA+/aYVVYIWI
|
||||
sDLHY1kuCalgRRsmO+fftTefU7PoB8gtAJf6o+WAt+yAgwRonn4+Csnk5dxV917F
|
||||
gWgfQieENSsmaaZnZME5C2zGS4gkxnIUiPRzfV7O6jDmi9dNnYrL69gyw0NDjx7V
|
||||
mbk7lFxeJsh0SJXJv2IVCiRms68HfLpoWDENuvek8cssSMADR11cB9p7NW/Epa6L
|
||||
01T/W0NYnvdgxsnwW1Yzz2pDNyMjReNgXTi9XYW6tyci0UhaPw2Ujzv+sM4dneHz
|
||||
NRCRAoIBAHqXaeC1uTGSzfLvRz81ifgDRP8H9L1HLt7ZWL6XMp1ph+P6yYFXM4JK
|
||||
WeP3cdKO/kQOD/fLuhYT92T2hHEadT8CQqpsBMQt29Zlm4oYWHB7ERiZqaGX3/T0
|
||||
U1TlL0WxthoHPY2HwA6pmDTmUzDk3tFlgk+XOmLsDacBdC6EsFwA+tyEPVxmkb0J
|
||||
H+j7D4NxwysAyWCB9fWU1FV+JJJel+nz88i7Gb8uJ+kSktnFxjv/G9p+OkDYlaUt
|
||||
j8lc6LOuNOA9M7XT1BIKpZytnSVtwZWkMmu23OLMM/d07tPJYtHIa92On7XKBPc2
|
||||
6THbQsJpR5AalTVvXs3X1RnCLnHiNYg=
|
||||
-----END PRIVATE KEY-----
|
||||
Loading…
Add table
Add a link
Reference in a new issue