base_test_server.h revision 5f1c94371a64b3196d4be9466099bb892df9b88e
1// Copyright 2013 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#ifndef NET_TEST_SPAWNED_TEST_SERVER_BASE_TEST_SERVER_H_
6#define NET_TEST_SPAWNED_TEST_SERVER_BASE_TEST_SERVER_H_
7
8#include <string>
9#include <utility>
10#include <vector>
11
12#include "base/compiler_specific.h"
13#include "base/files/file_path.h"
14#include "base/memory/scoped_ptr.h"
15#include "net/base/host_port_pair.h"
16#include "net/ssl/ssl_client_cert_type.h"
17
18class GURL;
19
20namespace base {
21class DictionaryValue;
22}
23
24namespace net {
25
26class AddressList;
27class ScopedPortException;
28
29// The base class of Test server implementation.
30class BaseTestServer {
31 public:
32  typedef std::pair<std::string, std::string> StringPair;
33
34  // Following types represent protocol schemes. See also
35  // http://www.iana.org/assignments/uri-schemes.html
36  enum Type {
37    TYPE_BASIC_AUTH_PROXY,
38    TYPE_FTP,
39    TYPE_HTTP,
40    TYPE_HTTPS,
41    TYPE_WS,
42    TYPE_WSS,
43    TYPE_TCP_ECHO,
44    TYPE_UDP_ECHO,
45  };
46
47  // Container for various options to control how the HTTPS or WSS server is
48  // initialized.
49  struct SSLOptions {
50    enum ServerCertificate {
51      CERT_OK,
52
53      // CERT_AUTO causes the testserver to generate a test certificate issued
54      // by "Testing CA" (see net/data/ssl/certificates/ocsp-test-root.pem).
55      CERT_AUTO,
56
57      CERT_MISMATCHED_NAME,
58      CERT_EXPIRED,
59      // Cross-signed certificate to test PKIX path building. Contains an
60      // intermediate cross-signed by an unknown root, while the client (via
61      // TestRootStore) is expected to have a self-signed version of the
62      // intermediate.
63      CERT_CHAIN_WRONG_ROOT,
64    };
65
66    // OCSPStatus enumerates the types of OCSP response that the testserver
67    // can produce.
68    enum OCSPStatus {
69      OCSP_OK,
70      OCSP_REVOKED,
71      OCSP_INVALID,
72      OCSP_UNAUTHORIZED,
73      OCSP_UNKNOWN,
74    };
75
76    // Bitmask of key exchange algorithms that the test server supports and that
77    // can be selectively enabled or disabled.
78    enum KeyExchange {
79      // Special value used to indicate that any algorithm the server supports
80      // is acceptable. Preferred over explicitly OR-ing all key exchange
81      // algorithms.
82      KEY_EXCHANGE_ANY     = 0,
83
84      KEY_EXCHANGE_RSA     = (1 << 0),
85      KEY_EXCHANGE_DHE_RSA = (1 << 1),
86    };
87
88    // Bitmask of bulk encryption algorithms that the test server supports
89    // and that can be selectively enabled or disabled.
90    enum BulkCipher {
91      // Special value used to indicate that any algorithm the server supports
92      // is acceptable. Preferred over explicitly OR-ing all ciphers.
93      BULK_CIPHER_ANY    = 0,
94
95      BULK_CIPHER_RC4    = (1 << 0),
96      BULK_CIPHER_AES128 = (1 << 1),
97      BULK_CIPHER_AES256 = (1 << 2),
98
99      // NOTE: 3DES support in the Python test server has external
100      // dependencies and not be available on all machines. Clients may not
101      // be able to connect if only 3DES is specified.
102      BULK_CIPHER_3DES   = (1 << 3),
103    };
104
105    // NOTE: the values of these enumerators are passed to the the Python test
106    // server. Do not change them.
107    enum TLSIntolerantLevel {
108      TLS_INTOLERANT_NONE = 0,
109      TLS_INTOLERANT_ALL = 1,  // Intolerant of all TLS versions.
110      TLS_INTOLERANT_TLS1_1 = 2,  // Intolerant of TLS 1.1 or higher.
111      TLS_INTOLERANT_TLS1_2 = 3,  // Intolerant of TLS 1.2 or higher.
112    };
113
114    // Values which control how the server reacts in response to a ClientHello
115    // it is intolerant of.
116    enum TLSIntoleranceType {
117      TLS_INTOLERANCE_ALERT = 0,  // Send a handshake_failure alert.
118      TLS_INTOLERANCE_CLOSE = 1,  // Close the connection.
119      TLS_INTOLERANCE_RESET = 2,  // Send a TCP reset.
120    };
121
122    // Initialize a new SSLOptions using CERT_OK as the certificate.
123    SSLOptions();
124
125    // Initialize a new SSLOptions that will use the specified certificate.
126    explicit SSLOptions(ServerCertificate cert);
127    ~SSLOptions();
128
129    // Returns the relative filename of the file that contains the
130    // |server_certificate|.
131    base::FilePath GetCertificateFile() const;
132
133    // GetOCSPArgument returns the value of any OCSP argument to testserver or
134    // the empty string if there is none.
135    std::string GetOCSPArgument() const;
136
137    // The certificate to use when serving requests.
138    ServerCertificate server_certificate;
139
140    // If |server_certificate==CERT_AUTO| then this determines the type of OCSP
141    // response returned.
142    OCSPStatus ocsp_status;
143
144    // If not zero, |cert_serial| will be the serial number of the
145    // auto-generated leaf certificate when |server_certificate==CERT_AUTO|.
146    uint64 cert_serial;
147
148    // True if a CertificateRequest should be sent to the client during
149    // handshaking.
150    bool request_client_certificate;
151
152    // If |request_client_certificate| is true, an optional list of files,
153    // each containing a single, PEM-encoded X.509 certificates. The subject
154    // from each certificate will be added to the certificate_authorities
155    // field of the CertificateRequest.
156    std::vector<base::FilePath> client_authorities;
157
158    // If |request_client_certificate| is true, an optional list of
159    // SSLClientCertType values to populate the certificate_types field of the
160    // CertificateRequest.
161    std::vector<SSLClientCertType> client_cert_types;
162
163    // A bitwise-OR of KeyExchnage that should be used by the
164    // HTTPS server, or KEY_EXCHANGE_ANY to indicate that all implemented
165    // key exchange algorithms are acceptable.
166    int key_exchanges;
167
168    // A bitwise-OR of BulkCipher that should be used by the
169    // HTTPS server, or BULK_CIPHER_ANY to indicate that all implemented
170    // ciphers are acceptable.
171    int bulk_ciphers;
172
173    // If true, pass the --https-record-resume argument to testserver.py which
174    // causes it to log session cache actions and echo the log on
175    // /ssl-session-cache.
176    bool record_resume;
177
178    // If not TLS_INTOLERANT_NONE, the server will abort any handshake that
179    // negotiates an intolerant TLS version in order to test version fallback.
180    TLSIntolerantLevel tls_intolerant;
181
182    // If |tls_intolerant| is not TLS_INTOLERANT_NONE, how the server reacts to
183    // an intolerant TLS version.
184    TLSIntoleranceType tls_intolerance_type;
185
186    // fallback_scsv_enabled, if true, causes the server to process the
187    // TLS_FALLBACK_SCSV cipher suite. This cipher suite is sent by Chrome
188    // when performing TLS version fallback in response to an SSL handshake
189    // failure. If this option is enabled then the server will reject fallback
190    // connections.
191    bool fallback_scsv_enabled;
192
193    // Temporary glue for testing: validation of SCTs is application-controlled
194    // and can be appropriately mocked out, so sending fake data here does not
195    // affect handshaking behaviour.
196    // TODO(ekasper): replace with valid SCT files for test certs.
197    // (Fake) SignedCertificateTimestampList (as a raw binary string) to send in
198    // a TLS extension.
199    std::string signed_cert_timestamps_tls_ext;
200
201    // Whether to staple the OCSP response.
202    bool staple_ocsp_response;
203
204    // Whether to enable NPN support.
205    bool enable_npn;
206
207    // Whether to disable TLS session caching. When session caching is
208    // disabled, the server will generate a new Session ID for every connection.
209    bool disable_session_cache;
210  };
211
212  // Pass as the 'host' parameter during construction to server on 127.0.0.1
213  static const char kLocalhost[];
214
215  // Initialize a TestServer listening on a specific host (IP or hostname).
216  BaseTestServer(Type type,  const std::string& host);
217
218  // Initialize a TestServer with a specific set of SSLOptions for HTTPS or WSS.
219  BaseTestServer(Type type, const SSLOptions& ssl_options);
220
221  // Returns the host port pair used by current Python based test server only
222  // if the server is started.
223  const HostPortPair& host_port_pair() const;
224
225  const base::FilePath& document_root() const { return document_root_; }
226  const base::DictionaryValue& server_data() const;
227  std::string GetScheme() const;
228  bool GetAddressList(AddressList* address_list) const WARN_UNUSED_RESULT;
229
230  GURL GetURL(const std::string& path) const;
231
232  GURL GetURLWithUser(const std::string& path,
233                      const std::string& user) const;
234
235  GURL GetURLWithUserAndPassword(const std::string& path,
236                                 const std::string& user,
237                                 const std::string& password) const;
238
239  static bool GetFilePathWithReplacements(
240      const std::string& original_path,
241      const std::vector<StringPair>& text_to_replace,
242      std::string* replacement_path);
243
244  static bool UsingSSL(Type type) {
245    return type == BaseTestServer::TYPE_HTTPS ||
246           type == BaseTestServer::TYPE_WSS;
247  }
248
249  // Enable HTTP basic authentication. Currently this only works for TYPE_WS and
250  // TYPE_WSS.
251  void set_websocket_basic_auth(bool ws_basic_auth) {
252    ws_basic_auth_ = ws_basic_auth;
253  }
254
255 protected:
256  virtual ~BaseTestServer();
257  Type type() const { return type_; }
258
259  // Gets port currently assigned to host_port_pair_ without checking
260  // whether it's available (server started) or not.
261  uint16 GetPort();
262
263  // Sets |port| as the actual port used by Python based test server.
264  void SetPort(uint16 port);
265
266  // Set up internal status when the server is started.
267  bool SetupWhenServerStarted() WARN_UNUSED_RESULT;
268
269  // Clean up internal status when starting to stop server.
270  void CleanUpWhenStoppingServer();
271
272  // Set path of test resources.
273  void SetResourcePath(const base::FilePath& document_root,
274                       const base::FilePath& certificates_dir);
275
276  // Parses the server data read from the test server.  Returns true
277  // on success.
278  bool ParseServerData(const std::string& server_data) WARN_UNUSED_RESULT;
279
280  // Generates a DictionaryValue with the arguments for launching the external
281  // Python test server.
282  bool GenerateArguments(base::DictionaryValue* arguments) const
283    WARN_UNUSED_RESULT;
284
285  // Subclasses can override this to add arguments that are specific to their
286  // own test servers.
287  virtual bool GenerateAdditionalArguments(
288      base::DictionaryValue* arguments) const WARN_UNUSED_RESULT;
289
290 private:
291  void Init(const std::string& host);
292
293  // Marks the root certificate of an HTTPS test server as trusted for
294  // the duration of tests.
295  bool LoadTestRootCert() const WARN_UNUSED_RESULT;
296
297  // Document root of the test server.
298  base::FilePath document_root_;
299
300  // Directory that contains the SSL certificates.
301  base::FilePath certificates_dir_;
302
303  // Address the test server listens on.
304  HostPortPair host_port_pair_;
305
306  // Holds the data sent from the server (e.g., port number).
307  scoped_ptr<base::DictionaryValue> server_data_;
308
309  // If |type_| is TYPE_HTTPS or TYPE_WSS, the TLS settings to use for the test
310  // server.
311  SSLOptions ssl_options_;
312
313  Type type_;
314
315  // Has the server been started?
316  bool started_;
317
318  // Enables logging of the server to the console.
319  bool log_to_console_;
320
321  // Is WebSocket basic HTTP authentication enabled?
322  bool ws_basic_auth_;
323
324  scoped_ptr<ScopedPortException> allowed_port_;
325
326  DISALLOW_COPY_AND_ASSIGN(BaseTestServer);
327};
328
329}  // namespace net
330
331#endif  // NET_TEST_SPAWNED_TEST_SERVER_BASE_TEST_SERVER_H_
332