aboutsummaryrefslogtreecommitdiffstats
path: root/tests
diff options
context:
space:
mode:
Diffstat (limited to 'tests')
-rw-r--r--tests/lib/Http/Client/DnsPinMiddlewareTest.php563
1 files changed, 563 insertions, 0 deletions
diff --git a/tests/lib/Http/Client/DnsPinMiddlewareTest.php b/tests/lib/Http/Client/DnsPinMiddlewareTest.php
new file mode 100644
index 00000000000..2fa868e6963
--- /dev/null
+++ b/tests/lib/Http/Client/DnsPinMiddlewareTest.php
@@ -0,0 +1,563 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2023 Daniel Kesselberg <mail@danielkesselberg.de>
+ *
+ * @author Daniel Kesselberg <mail@danielkesselberg.de>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+namespace lib\Http\Client;
+
+use GuzzleHttp\Handler\MockHandler;
+use GuzzleHttp\HandlerStack;
+use GuzzleHttp\Psr7\Request;
+use GuzzleHttp\Psr7\Response;
+use OC\Http\Client\DnsPinMiddleware;
+use OC\Http\Client\NegativeDnsCache;
+use OC\Memcache\NullCache;
+use OC\Net\IpAddressClassifier;
+use OCP\Http\Client\LocalServerException;
+use OCP\ICacheFactory;
+use Psr\Http\Message\RequestInterface;
+use Test\TestCase;
+
+class DnsPinMiddlewareTest extends TestCase {
+ private DnsPinMiddleware $dnsPinMiddleware;
+
+ protected function setUp(): void {
+ parent::setUp();
+
+ $cacheFactory = $this->createMock(ICacheFactory::class);
+ $cacheFactory
+ ->method('createLocal')
+ ->willReturn(new NullCache());
+
+ $ipAddressClassifier = new IpAddressClassifier();
+ $negativeDnsCache = new NegativeDnsCache($cacheFactory);
+
+ $this->dnsPinMiddleware = $this->getMockBuilder(DnsPinMiddleware::class)
+ ->setConstructorArgs([$negativeDnsCache, $ipAddressClassifier])
+ ->onlyMethods(['dnsGetRecord'])
+ ->getMock();
+ }
+
+ public function testPopulateDnsCacheIPv4() {
+ $mockHandler = new MockHandler([
+ static function (RequestInterface $request, array $options) {
+ self::arrayHasKey('curl', $options);
+ self::arrayHasKey(CURLOPT_RESOLVE, $options['curl']);
+ self::assertEquals([
+ 'www.example.com:80:1.1.1.1',
+ 'www.example.com:443:1.1.1.1'
+ ], $options['curl'][CURLOPT_RESOLVE]);
+ return new Response(200);
+ },
+ ]);
+
+ $this->dnsPinMiddleware
+ ->method('dnsGetRecord')
+ ->willReturnCallback(function (string $hostname, int $type) {
+ // example.com SOA
+ if ($hostname === 'example.com') {
+ return match ($type) {
+ DNS_SOA => [
+ [
+ 'host' => 'example.com',
+ 'class' => 'IN',
+ 'ttl' => 7079,
+ 'type' => 'SOA',
+ 'minimum-ttl' => 3600,
+ ]
+ ],
+ };
+ }
+
+ // example.com A, AAAA, CNAME
+ if ($hostname === 'www.example.com') {
+ return match ($type) {
+ DNS_A => [],
+ DNS_AAAA => [],
+ DNS_CNAME => [
+ [
+ 'host' => 'www.example.com',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'A',
+ 'target' => 'www.example.net'
+ ]
+ ],
+ };
+ }
+
+ // example.net SOA
+ if ($hostname === 'example.net') {
+ return match ($type) {
+ DNS_SOA => [
+ [
+ 'host' => 'example.net',
+ 'class' => 'IN',
+ 'ttl' => 7079,
+ 'type' => 'SOA',
+ 'minimum-ttl' => 3600,
+ ]
+ ],
+ };
+ }
+
+ // example.net A, AAAA, CNAME
+ if ($hostname === 'www.example.net') {
+ return match ($type) {
+ DNS_A => [
+ [
+ 'host' => 'www.example.net',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'A',
+ 'ip' => '1.1.1.1'
+ ]
+ ],
+ DNS_AAAA => [],
+ DNS_CNAME => [],
+ };
+ }
+
+ return false;
+ });
+
+ $stack = new HandlerStack($mockHandler);
+ $stack->push($this->dnsPinMiddleware->addDnsPinning());
+ $handler = $stack->resolve();
+
+ $handler(
+ new Request('GET', 'https://www.example.com'),
+ ['nextcloud' => ['allow_local_address' => false]]
+ );
+ }
+
+ public function testPopulateDnsCacheIPv6() {
+ $mockHandler = new MockHandler([
+ static function (RequestInterface $request, array $options) {
+ self::arrayHasKey('curl', $options);
+ self::arrayHasKey(CURLOPT_RESOLVE, $options['curl']);
+ self::assertEquals([
+ 'www.example.com:80:1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001',
+ 'www.example.com:443:1.1.1.1,1.0.0.1,2606:4700:4700::1111,2606:4700:4700::1001'
+ ], $options['curl'][CURLOPT_RESOLVE]);
+ return new Response(200);
+ },
+ ]);
+
+ $this->dnsPinMiddleware
+ ->method('dnsGetRecord')
+ ->willReturnCallback(function (string $hostname, int $type) {
+ // example.com SOA
+ if ($hostname === 'example.com') {
+ return match ($type) {
+ DNS_SOA => [
+ [
+ 'host' => 'example.com',
+ 'class' => 'IN',
+ 'ttl' => 7079,
+ 'type' => 'SOA',
+ 'minimum-ttl' => 3600,
+ ]
+ ],
+ };
+ }
+
+ // example.com A, AAAA, CNAME
+ if ($hostname === 'www.example.com') {
+ return match ($type) {
+ DNS_A => [],
+ DNS_AAAA => [],
+ DNS_CNAME => [
+ [
+ 'host' => 'www.example.com',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'A',
+ 'target' => 'www.example.net'
+ ]
+ ],
+ };
+ }
+
+ // example.net SOA
+ if ($hostname === 'example.net') {
+ return match ($type) {
+ DNS_SOA => [
+ [
+ 'host' => 'example.net',
+ 'class' => 'IN',
+ 'ttl' => 7079,
+ 'type' => 'SOA',
+ 'minimum-ttl' => 3600,
+ ]
+ ],
+ };
+ }
+
+ // example.net A, AAAA, CNAME
+ if ($hostname === 'www.example.net') {
+ return match ($type) {
+ DNS_A => [
+ [
+ 'host' => 'www.example.net',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'A',
+ 'ip' => '1.1.1.1'
+ ],
+ [
+ 'host' => 'www.example.net',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'A',
+ 'ip' => '1.0.0.1'
+ ],
+ ],
+ DNS_AAAA => [
+ [
+ 'host' => 'www.example.net',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'AAAA',
+ 'ip' => '2606:4700:4700::1111'
+ ],
+ [
+ 'host' => 'www.example.net',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'AAAA',
+ 'ip' => '2606:4700:4700::1001'
+ ],
+ ],
+ DNS_CNAME => [],
+ };
+ }
+
+ return false;
+ });
+
+ $stack = new HandlerStack($mockHandler);
+ $stack->push($this->dnsPinMiddleware->addDnsPinning());
+ $handler = $stack->resolve();
+
+ $handler(
+ new Request('GET', 'https://www.example.com'),
+ ['nextcloud' => ['allow_local_address' => false]]
+ );
+ }
+
+ public function testAllowLocalAddress() {
+ $mockHandler = new MockHandler([
+ static function (RequestInterface $request, array $options) {
+ self::assertArrayNotHasKey('curl', $options);
+ return new Response(200);
+ },
+ ]);
+
+ $stack = new HandlerStack($mockHandler);
+ $stack->push($this->dnsPinMiddleware->addDnsPinning());
+ $handler = $stack->resolve();
+
+ $handler(
+ new Request('GET', 'https://www.example.com'),
+ ['nextcloud' => ['allow_local_address' => true]]
+ );
+ }
+
+ public function testRejectIPv4() {
+ $this->expectException(LocalServerException::class);
+ $this->expectExceptionMessage('Host violates local access rules');
+
+ $mockHandler = new MockHandler([
+ static function (RequestInterface $request, array $options) {
+ // The handler should not be called
+ },
+ ]);
+
+ $this->dnsPinMiddleware
+ ->method('dnsGetRecord')
+ ->willReturnCallback(function (string $hostname, int $type) {
+ return match ($type) {
+ DNS_SOA => [
+ [
+ 'host' => 'example.com',
+ 'class' => 'IN',
+ 'ttl' => 7079,
+ 'type' => 'SOA',
+ 'minimum-ttl' => 3600,
+ ]
+ ],
+ DNS_A => [
+ [
+ 'host' => 'example.com',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'A',
+ 'ip' => '192.168.0.1'
+ ]
+ ],
+ DNS_AAAA => [],
+ DNS_CNAME => [],
+ };
+ });
+
+ $stack = new HandlerStack($mockHandler);
+ $stack->push($this->dnsPinMiddleware->addDnsPinning());
+ $handler = $stack->resolve();
+
+ $handler(
+ new Request('GET', 'https://www.example.com'),
+ ['nextcloud' => ['allow_local_address' => false]]
+ );
+ }
+
+ public function testRejectIPv6() {
+ $this->expectException(LocalServerException::class);
+ $this->expectExceptionMessage('Host violates local access rules');
+
+ $mockHandler = new MockHandler([
+ static function (RequestInterface $request, array $options) {
+ // The handler should not be called
+ },
+ ]);
+
+ $this->dnsPinMiddleware
+ ->method('dnsGetRecord')
+ ->willReturnCallback(function (string $hostname, int $type) {
+ return match ($type) {
+ DNS_SOA => [
+ [
+ 'host' => 'example.com',
+ 'class' => 'IN',
+ 'ttl' => 7079,
+ 'type' => 'SOA',
+ 'minimum-ttl' => 3600,
+ ]
+ ],
+ DNS_A => [],
+ DNS_AAAA => [
+ [
+ 'host' => 'ipv6.example.com',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'AAAA',
+ 'ipv6' => 'fd12:3456:789a:1::1'
+ ]
+ ],
+ DNS_CNAME => [],
+ };
+ });
+
+ $stack = new HandlerStack($mockHandler);
+ $stack->push($this->dnsPinMiddleware->addDnsPinning());
+ $handler = $stack->resolve();
+
+ $handler(
+ new Request('GET', 'https://ipv6.example.com'),
+ ['nextcloud' => ['allow_local_address' => false]]
+ );
+ }
+
+ public function testRejectCanonicalName() {
+ $this->expectException(LocalServerException::class);
+ $this->expectExceptionMessage('Host violates local access rules');
+
+ $mockHandler = new MockHandler([
+ static function (RequestInterface $request, array $options) {
+ // The handler should not be called
+ },
+ ]);
+
+ $this->dnsPinMiddleware
+ ->method('dnsGetRecord')
+ ->willReturnCallback(function (string $hostname, int $type) {
+ // example.com SOA
+ if ($hostname === 'example.com') {
+ return match ($type) {
+ DNS_SOA => [
+ [
+ 'host' => 'example.com',
+ 'class' => 'IN',
+ 'ttl' => 7079,
+ 'type' => 'SOA',
+ 'minimum-ttl' => 3600,
+ ]
+ ],
+ };
+ }
+
+ // example.com A, AAAA, CNAME
+ if ($hostname === 'www.example.com') {
+ return match ($type) {
+ DNS_A => [],
+ DNS_AAAA => [],
+ DNS_CNAME => [
+ [
+ 'host' => 'www.example.com',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'A',
+ 'target' => 'www.example.net'
+ ]
+ ],
+ };
+ }
+
+ // example.net SOA
+ if ($hostname === 'example.net') {
+ return match ($type) {
+ DNS_SOA => [
+ [
+ 'host' => 'example.net',
+ 'class' => 'IN',
+ 'ttl' => 7079,
+ 'type' => 'SOA',
+ 'minimum-ttl' => 3600,
+ ]
+ ],
+ };
+ }
+
+ // example.net A, AAAA, CNAME
+ if ($hostname === 'www.example.net') {
+ return match ($type) {
+ DNS_A => [
+ [
+ 'host' => 'www.example.net',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'A',
+ 'ip' => '192.168.0.2'
+ ]
+ ],
+ DNS_AAAA => [],
+ DNS_CNAME => [],
+ };
+ }
+
+ return false;
+ });
+
+ $stack = new HandlerStack($mockHandler);
+ $stack->push($this->dnsPinMiddleware->addDnsPinning());
+ $handler = $stack->resolve();
+
+ $handler(
+ new Request('GET', 'https://www.example.com'),
+ ['nextcloud' => ['allow_local_address' => false]]
+ );
+ }
+
+ public function testRejectFaultyResponse() {
+ $this->expectException(LocalServerException::class);
+ $this->expectExceptionMessage('No DNS record found for www.example.com');
+
+ $mockHandler = new MockHandler([
+ static function (RequestInterface $request, array $options) {
+ // The handler should not be called
+ },
+ ]);
+
+ $this->dnsPinMiddleware
+ ->method('dnsGetRecord')
+ ->willReturnCallback(function (string $hostname, int $type) {
+ return false;
+ });
+
+ $stack = new HandlerStack($mockHandler);
+ $stack->push($this->dnsPinMiddleware->addDnsPinning());
+ $handler = $stack->resolve();
+
+ $handler(
+ new Request('GET', 'https://www.example.com'),
+ ['nextcloud' => ['allow_local_address' => false]]
+ );
+ }
+
+ public function testIgnoreSubdomainForSoaQuery() {
+ $mockHandler = new MockHandler([
+ static function (RequestInterface $request, array $options) {
+ // The handler should not be called
+ },
+ ]);
+
+ $dnsQueries = [];
+
+ $this->dnsPinMiddleware
+ ->method('dnsGetRecord')
+ ->willReturnCallback(function (string $hostname, int $type) use (&$dnsQueries) {
+ // log query
+ $dnsQueries[] = $hostname . $type;
+
+ // example.com SOA
+ if ($hostname === 'example.com') {
+ return match ($type) {
+ DNS_SOA => [
+ [
+ 'host' => 'example.com',
+ 'class' => 'IN',
+ 'ttl' => 7079,
+ 'type' => 'SOA',
+ 'minimum-ttl' => 3600,
+ ]
+ ],
+ };
+ }
+
+ // example.net A, AAAA, CNAME
+ if ($hostname === 'subsubdomain.subdomain.example.com') {
+ return match ($type) {
+ DNS_A => [
+ [
+ 'host' => 'subsubdomain.subdomain.example.com',
+ 'class' => 'IN',
+ 'ttl' => 1800,
+ 'type' => 'A',
+ 'ip' => '1.1.1.1'
+ ]
+ ],
+ DNS_AAAA => [],
+ DNS_CNAME => [],
+ };
+ }
+
+ return false;
+ });
+
+ $stack = new HandlerStack($mockHandler);
+ $stack->push($this->dnsPinMiddleware->addDnsPinning());
+ $handler = $stack->resolve();
+
+ $handler(
+ new Request('GET', 'https://subsubdomain.subdomain.example.com'),
+ ['nextcloud' => ['allow_local_address' => false]]
+ );
+
+ $this->assertCount(4, $dnsQueries);
+ $this->assertContains('example.com' . DNS_SOA, $dnsQueries);
+ $this->assertContains('subsubdomain.subdomain.example.com' . DNS_A, $dnsQueries);
+ $this->assertContains('subsubdomain.subdomain.example.com' . DNS_AAAA, $dnsQueries);
+ $this->assertContains('subsubdomain.subdomain.example.com' . DNS_CNAME, $dnsQueries);
+ }
+}
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 12:54:06 +0000