From 460ead61b6feec048a66914fe9281676fef21018 Mon Sep 17 00:00:00 2001 From: sftcd Date: Fri, 25 Apr 2025 18:26:04 +0100 Subject: [PATCH] tests: add basic ECH tests Test 4000 and 4001 Closes #17192 --- docs/ECH.md | 17 ++++++++++++++ lib/vtls/rustls.c | 7 ++++-- lib/vtls/wolfssl.c | 4 +--- tests/data/Makefile.am | 4 +++- tests/data/test4000 | 51 ++++++++++++++++++++++++++++++++++++++++++ tests/data/test4001 | 46 +++++++++++++++++++++++++++++++++++++ tests/runtests.pl | 1 + 7 files changed, 124 insertions(+), 6 deletions(-) create mode 100644 tests/data/test4000 create mode 100644 tests/data/test4001 diff --git a/docs/ECH.md b/docs/ECH.md index e82fadd4a1..2c29015a87 100644 --- a/docs/ECH.md +++ b/docs/ECH.md @@ -476,3 +476,20 @@ and then reuse that in another invocation. Both our OpenSSL fork and BoringSSL/AWS-LC have APIs for both controlling GREASE and accessing and logging ``retry_configs``, it seems wolfSSL has neither. + +### Testing ECH + +We have yet to add a robust test setup for ECH as that requires an ECH-enabled +test server. + +We have added two basic tests though, aiming to ensure that the client sends a +GREASE or real ECH extension when requested, and reacts correctly to the +failure of ECH in the latter case. (Given that `stunnel` has no ECH support.) + +As with other similar tests, those tests require the `stunnel` tool be +installed. On Ubuntu `sudo apt install stunnel4` achieves that. + +The test cases are: + +- data/test4000: GREASE ECH, expected result: connection succeeds +- data/test4001: real ECH, connection fails with error 101 (ECH required) diff --git a/lib/vtls/rustls.c b/lib/vtls/rustls.c index 24ab09caa9..7835a8dd0d 100644 --- a/lib/vtls/rustls.c +++ b/lib/vtls/rustls.c @@ -961,8 +961,7 @@ init_config_builder_ech(struct Curl_easy *data, return CURLE_OK; } - if(data->set.tls_ech & CURLECH_CLA_CFG - && data->set.str[STRING_ECH_CONFIG]) { + if(data->set.tls_ech & CURLECH_CLA_CFG && data->set.str[STRING_ECH_CONFIG]) { const char *b64 = data->set.str[STRING_ECH_CONFIG]; size_t decode_result; if(!b64) { @@ -1008,6 +1007,10 @@ init_config_builder_ech(struct Curl_easy *data, goto cleanup; } cleanup: + /* if we base64 decoded, we can free now */ + if(data->set.tls_ech & CURLECH_CLA_CFG && data->set.str[STRING_ECH_CONFIG]) { + free(ech_config); + } if(dns) { Curl_resolv_unlink(data, &dns); } diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c index 2e1523a4dc..006a17c463 100644 --- a/lib/vtls/wolfssl.c +++ b/lib/vtls/wolfssl.c @@ -1352,9 +1352,7 @@ CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx, goto out; } if(data->set.tls_ech == CURLECH_GREASE) { - infof(data, "ECH: GREASE'd ECH not yet supported for wolfSSL"); - result = CURLE_SSL_CONNECT_ERROR; - goto out; + infof(data, "ECH: GREASE is done by default by wolfSSL: no need to ask"); } if(data->set.tls_ech & CURLECH_CLA_CFG && data->set.str[STRING_ECH_CONFIG]) { diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am index 88cbd49bcb..cf372baa41 100644 --- a/tests/data/Makefile.am +++ b/tests/data/Makefile.am @@ -276,6 +276,8 @@ test3032 \ test3100 test3101 test3102 test3103 test3104 test3105 \ \ test3200 test3201 test3202 test3203 test3204 test3205 test3207 test3208 \ -test3209 test3210 test3211 test3212 test3213 +test3209 test3210 test3211 test3212 test3213 \ +\ +test4000 test4001 EXTRA_DIST = $(TESTCASES) DISABLED diff --git a/tests/data/test4000 b/tests/data/test4000 new file mode 100644 index 0000000000..0f9e0d528f --- /dev/null +++ b/tests/data/test4000 @@ -0,0 +1,51 @@ + + + +ECH GREASE + + + +# +# Server-side + + +HTTP/1.1 200 OK +Date: Tue, 09 Nov 2010 14:49:00 GMT +Server: test-server/fake +Content-Length: 7 + +MooMoo + + + +# +# Client-side + + +ECH + + +https + + +HTTPS GET with ECH GREASE + +# Using '-k' over '--insecure' to also test the short form +# Add ECH grease + +--ech grease -k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER + + + +# +# Verify data after the test has been "shot" + + +GET /%TESTNUMBER HTTP/1.1 +Host: %HOSTIP:%HTTPSPORT +User-Agent: curl/%VERSION +Accept: */* + + + + diff --git a/tests/data/test4001 b/tests/data/test4001 new file mode 100644 index 0000000000..f02a4b94d8 --- /dev/null +++ b/tests/data/test4001 @@ -0,0 +1,46 @@ + + + +ECH try real and fail + + + +# +# Server-side + + + +# +# Client-side + + +ECH + + +https + + +Make real ECH attempt and fail with "ech required" error (101) + +# Using '-k' over '--insecure' to also test the short form + +--ech ecl:AEv+DQBHdAAgACCCU49qdxKOUXJPs3wlsM06v/t42sMH5xQOL37MAd3HaAAEAAEAAQAYb3RoZXJwdWJsaWMudGVzdC5kZWZvLmllAAA= -k https://%HOSTIP:%HTTPSPORT/%TESTNUMBER + + + +# +# Verify data after the test has been "shot" + + +%if !wolfssl +%if !rustls +101 +%else +35 +%endif +%else +35 +%endif + + + diff --git a/tests/runtests.pl b/tests/runtests.pl index 7c4f43ae54..6aa0b54973 100755 --- a/tests/runtests.pl +++ b/tests/runtests.pl @@ -716,6 +716,7 @@ sub checksystemfeatures { # Thread-safe init $feature{"threadsafe"} = $feat =~ /threadsafe/i; $feature{"HTTPSRR"} = $feat =~ /HTTPSRR/; + $feature{"ECH"} = $feat =~ /ECH/; } # # Test harness currently uses a non-stunnel server in order to -- 2.47.3