mirror of https://github.com/lukechilds/node.git
Browse Source
Conflicts: AUTHORS ChangeLog Makefile doc/about/index.html doc/api/tls.markdown doc/community/index.html doc/index.html doc/logos/index.html doc/template.html lib/http.js lib/tls.js src/node_version.h src/platform_win32.cc test/simple/test-tls-connect-given-socket.jsv0.9.1-release
isaacs
13 years ago
28 changed files with 707 additions and 316 deletions
@ -0,0 +1,100 @@ |
|||
// Copyright Joyent, Inc. and other Node contributors.
|
|||
//
|
|||
// Permission is hereby granted, free of charge, to any person obtaining a
|
|||
// copy of this software and associated documentation files (the
|
|||
// "Software"), to deal in the Software without restriction, including
|
|||
// without limitation the rights to use, copy, modify, merge, publish,
|
|||
// distribute, sublicense, and/or sell copies of the Software, and to permit
|
|||
// persons to whom the Software is furnished to do so, subject to the
|
|||
// following conditions:
|
|||
//
|
|||
// The above copyright notice and this permission notice shall be included
|
|||
// in all copies or substantial portions of the Software.
|
|||
//
|
|||
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|||
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|||
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
|
|||
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
|||
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
|||
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
|||
// USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|||
|
|||
var common = require('../common'); |
|||
var assert = require('assert'); |
|||
var spawn = require('child_process').spawn; |
|||
var tls = require('tls'); |
|||
var fs = require('fs'); |
|||
|
|||
// renegotiation limits to test
|
|||
var LIMITS = [0, 1, 2, 3, 5, 10, 16]; |
|||
|
|||
if (process.platform === 'win32') { |
|||
console.log("Skipping test, you probably don't have openssl installed."); |
|||
process.exit(); |
|||
} |
|||
|
|||
(function() { |
|||
var n = 0; |
|||
function next() { |
|||
if (n >= LIMITS.length) return; |
|||
tls.CLIENT_RENEG_LIMIT = LIMITS[n++]; |
|||
test(next); |
|||
} |
|||
next(); |
|||
})(); |
|||
|
|||
function test(next) { |
|||
var options = { |
|||
cert: fs.readFileSync(common.fixturesDir + '/test_cert.pem'), |
|||
key: fs.readFileSync(common.fixturesDir + '/test_key.pem') |
|||
}; |
|||
|
|||
var server = tls.createServer(options, function(conn) { |
|||
conn.on('error', function(err) { |
|||
console.error('Caught exception: ' + err); |
|||
assert(/TLS session renegotiation attack/.test(err)); |
|||
conn.destroy(); |
|||
}); |
|||
conn.pipe(conn); |
|||
}); |
|||
|
|||
server.listen(common.PORT, function() { |
|||
var args = ('s_client -connect 127.0.0.1:' + common.PORT).split(' '); |
|||
var child = spawn('openssl', args); |
|||
|
|||
child.stdout.pipe(process.stdout); |
|||
child.stderr.pipe(process.stderr); |
|||
|
|||
// count handshakes, start the attack after the initial handshake is done
|
|||
var handshakes = 0; |
|||
child.stderr.on('data', function(data) { |
|||
handshakes += (('' + data).match(/verify return:1/g) || []).length; |
|||
if (handshakes === 2) spam(); |
|||
}); |
|||
|
|||
child.on('exit', function() { |
|||
// with a renegotiation limit <= 1, we always see 4 handshake markers:
|
|||
// two for the initial handshake and another two for the attempted
|
|||
// renegotiation
|
|||
assert.equal(handshakes, 2 * Math.max(2, tls.CLIENT_RENEG_LIMIT)); |
|||
server.close(); |
|||
process.nextTick(next); |
|||
}); |
|||
|
|||
var closed = false; |
|||
child.stdin.on('error', function(err) { |
|||
assert.equal(err.code, 'EPIPE'); |
|||
closed = true; |
|||
}); |
|||
child.stdin.on('close', function() { |
|||
closed = true; |
|||
}); |
|||
|
|||
// simulate renegotiation attack
|
|||
function spam() { |
|||
if (closed) return; |
|||
child.stdin.write("R\n"); |
|||
setTimeout(spam, 250); |
|||
} |
|||
}); |
|||
} |
|||
@ -1,77 +0,0 @@ |
|||
// Copyright Joyent, Inc. and other Node contributors.
|
|||
//
|
|||
// Permission is hereby granted, free of charge, to any person obtaining a
|
|||
// copy of this software and associated documentation files (the
|
|||
// "Software"), to deal in the Software without restriction, including
|
|||
// without limitation the rights to use, copy, modify, merge, publish,
|
|||
// distribute, sublicense, and/or sell copies of the Software, and to permit
|
|||
// persons to whom the Software is furnished to do so, subject to the
|
|||
// following conditions:
|
|||
//
|
|||
// The above copyright notice and this permission notice shall be included
|
|||
// in all copies or substantial portions of the Software.
|
|||
//
|
|||
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|||
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|||
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
|
|||
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
|||
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
|||
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
|||
// USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|||
|
|||
// This test starts two clustered HTTP servers on the same port. It expects the
|
|||
// first cluster to succeed and the second cluster to fail with EADDRINUSE.
|
|||
|
|||
var common = require('../common'); |
|||
var assert = require('assert'); |
|||
var cluster = require('cluster'); |
|||
var fork = require('child_process').fork; |
|||
var http = require('http'); |
|||
|
|||
var id = process.argv[2]; |
|||
|
|||
if (!id) { |
|||
var a = fork(__filename, ['one']); |
|||
var b = fork(__filename, ['two']); |
|||
|
|||
a.on('message', function(m) { |
|||
assert.equal(m, 'READY'); |
|||
b.send('START'); |
|||
}); |
|||
|
|||
var ok = false; |
|||
|
|||
b.on('message', function(m) { |
|||
assert.equal(m, 'EADDRINUSE'); |
|||
a.kill(); |
|||
b.kill(); |
|||
ok = true; |
|||
}); |
|||
|
|||
process.on('exit', function() { |
|||
a.kill(); |
|||
b.kill(); |
|||
assert(ok); |
|||
}); |
|||
} |
|||
else if (id === 'one') { |
|||
if (cluster.isMaster) cluster.fork(); |
|||
http.createServer(assert.fail).listen(common.PORT, function() { |
|||
process.send('READY'); |
|||
}); |
|||
} |
|||
else if (id === 'two') { |
|||
if (cluster.isMaster) cluster.fork(); |
|||
process.on('message', function(m) { |
|||
assert.equal(m, 'START'); |
|||
var server = http.createServer(assert.fail); |
|||
server.listen(common.PORT, assert.fail); |
|||
server.on('error', function(e) { |
|||
assert.equal(e.code, 'EADDRINUSE'); |
|||
process.send(e.code); |
|||
}); |
|||
}); |
|||
} |
|||
else { |
|||
assert(0); // bad command line argument
|
|||
} |
|||
@ -0,0 +1,35 @@ |
|||
// Copyright Joyent, Inc. and other Node contributors.
|
|||
//
|
|||
// Permission is hereby granted, free of charge, to any person obtaining a
|
|||
// copy of this software and associated documentation files (the
|
|||
// "Software"), to deal in the Software without restriction, including
|
|||
// without limitation the rights to use, copy, modify, merge, publish,
|
|||
// distribute, sublicense, and/or sell copies of the Software, and to permit
|
|||
// persons to whom the Software is furnished to do so, subject to the
|
|||
// following conditions:
|
|||
//
|
|||
// The above copyright notice and this permission notice shall be included
|
|||
// in all copies or substantial portions of the Software.
|
|||
//
|
|||
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|||
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|||
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
|
|||
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
|||
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
|||
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
|||
// USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|||
|
|||
// Ensure that if a dgram socket is closed before the DNS lookup completes, it
|
|||
// won't crash.
|
|||
|
|||
var assert = require('assert'), |
|||
common = require('../common'), |
|||
dgram = require('dgram'); |
|||
|
|||
var buf = new Buffer(1024); |
|||
buf.fill(42); |
|||
|
|||
var socket = dgram.createSocket('udp4'); |
|||
|
|||
socket.send(buf, 0, buf.length, common.port, 'localhost'); |
|||
socket.close(); |
|||
@ -0,0 +1,156 @@ |
|||
// Copyright Joyent, Inc. and other Node contributors.
|
|||
//
|
|||
// Permission is hereby granted, free of charge, to any person obtaining a
|
|||
// copy of this software and associated documentation files (the
|
|||
// "Software"), to deal in the Software without restriction, including
|
|||
// without limitation the rights to use, copy, modify, merge, publish,
|
|||
// distribute, sublicense, and/or sell copies of the Software, and to permit
|
|||
// persons to whom the Software is furnished to do so, subject to the
|
|||
// following conditions:
|
|||
//
|
|||
// The above copyright notice and this permission notice shall be included
|
|||
// in all copies or substantial portions of the Software.
|
|||
//
|
|||
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|||
// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|||
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
|
|||
// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
|
|||
// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
|||
// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
|||
// USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|||
|
|||
|
|||
|
|||
|
|||
if (!process.versions.openssl) { |
|||
console.error('Skipping because node compiled without OpenSSL.'); |
|||
process.exit(0); |
|||
} |
|||
|
|||
var common = require('../common'); |
|||
var assert = require('assert'); |
|||
|
|||
var fs = require('fs'); |
|||
var net = require('net'); |
|||
var http = require('http'); |
|||
var https = require('https'); |
|||
|
|||
var proxyPort = common.PORT + 1; |
|||
var gotRequest = false; |
|||
|
|||
var key = fs.readFileSync(common.fixturesDir + '/keys/agent1-key.pem'); |
|||
var cert = fs.readFileSync(common.fixturesDir + '/keys/agent1-cert.pem'); |
|||
|
|||
var options = { |
|||
key: key, |
|||
cert: cert |
|||
}; |
|||
|
|||
var server = https.createServer(options, function(req, res) { |
|||
console.log('SERVER: got request'); |
|||
res.writeHead(200, { |
|||
'content-type': 'text/plain', |
|||
}); |
|||
console.log('SERVER: sending response'); |
|||
res.end('hello world\n'); |
|||
}); |
|||
|
|||
var proxy = net.createServer(function(clientSocket) { |
|||
console.log('PROXY: got a client connection'); |
|||
|
|||
var serverSocket = null; |
|||
|
|||
clientSocket.on('data', function(chunk) { |
|||
if (!serverSocket) { |
|||
// Verify the CONNECT request
|
|||
assert.equal('CONNECT localhost:' + common.PORT + ' HTTP/1.1\r\n' + |
|||
'Proxy-Connections: keep-alive\r\nContent-Length:' + |
|||
' 0\r\nHost: localhost:' + proxyPort + '\r\n\r\n', |
|||
chunk); |
|||
|
|||
console.log('PROXY: got CONNECT request'); |
|||
console.log('PROXY: creating a tunnel'); |
|||
|
|||
// create the tunnel
|
|||
serverSocket = net.connect(common.PORT, function() { |
|||
console.log('PROXY: replying to client CONNECT request'); |
|||
|
|||
// Send the response
|
|||
clientSocket.write('HTTP/1.1 200 OK\r\nProxy-Connections: keep' + |
|||
'-alive\r\nConnections: keep-alive\r\nVia: ' + |
|||
'localhost:' + proxyPort + '\r\n\r\n'); |
|||
}); |
|||
|
|||
serverSocket.on('data', function(chunk) { |
|||
clientSocket.write(chunk); |
|||
}); |
|||
|
|||
serverSocket.on('end', function() { |
|||
clientSocket.destroy(); |
|||
}); |
|||
} else { |
|||
serverSocket.write(chunk); |
|||
} |
|||
}); |
|||
|
|||
clientSocket.on('end', function() { |
|||
serverSocket.destroy(); |
|||
}); |
|||
}); |
|||
|
|||
server.listen(common.PORT); |
|||
|
|||
proxy.listen(proxyPort, function() { |
|||
console.log('CLIENT: Making CONNECT request'); |
|||
|
|||
http.request({ |
|||
port: proxyPort, |
|||
method: 'CONNECT', |
|||
path: 'localhost:' + common.PORT, |
|||
headers: { |
|||
'Proxy-Connections': 'keep-alive', |
|||
'Content-Length': 0 |
|||
} |
|||
}, function(res) { |
|||
assert.equal(200, res.statusCode); |
|||
console.log('CLIENT: got CONNECT response'); |
|||
|
|||
// detach the socket
|
|||
res.socket.emit('agentRemove'); |
|||
res.socket.removeAllListeners('data'); |
|||
res.socket.removeAllListeners('close'); |
|||
res.socket.removeAllListeners('error'); |
|||
res.socket.removeAllListeners('drain'); |
|||
res.socket.removeAllListeners('end'); |
|||
res.socket.ondata = null; |
|||
res.socket.onend = null; |
|||
res.socket.ondrain = null; |
|||
|
|||
console.log('CLIENT: Making HTTPS request'); |
|||
|
|||
https.get({ |
|||
path: '/foo', |
|||
key: key, |
|||
cert: cert, |
|||
socket: res.socket, // reuse the socket
|
|||
agent: false, |
|||
}, function(res) { |
|||
assert.equal(200, res.statusCode); |
|||
|
|||
res.on('data', function(chunk) { |
|||
assert.equal('hello world\n', chunk); |
|||
console.log('CLIENT: got HTTPS response'); |
|||
gotRequest = true; |
|||
}); |
|||
|
|||
res.on('end', function() { |
|||
proxy.close(); |
|||
server.close(); |
|||
}); |
|||
}).end(); |
|||
}).end(); |
|||
}); |
|||
|
|||
process.on('exit', function() { |
|||
assert.ok(gotRequest); |
|||
}); |
|||
Loading…
Reference in new issue