You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
90 lines
3.6 KiB
90 lines
3.6 KiB
<?php
|
|
namespace p3k\HTTP\Tests;
|
|
|
|
use p3k\HTTP;
|
|
use p3k\HTTP\Curl;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
// Real requests through curl to PHP's built-in server on 127.0.0.1.
|
|
class CurlPinningTest extends TestCase {
|
|
|
|
private static $server;
|
|
private static $port;
|
|
|
|
public static function setUpBeforeClass(): void {
|
|
self::$port = 20000 + random_int(0, 9999);
|
|
// A command string rather than an array, which proc_open only accepts as
|
|
// of PHP 7.4. exec replaces the shell with the server, so proc_terminate
|
|
// stops the server itself rather than just the shell.
|
|
self::$server = proc_open(
|
|
'exec ' . escapeshellarg(PHP_BINARY) . ' -S 127.0.0.1:' . self::$port . ' -t ' . escapeshellarg(__DIR__ . '/server'),
|
|
[1 => ['file', '/dev/null', 'w'], 2 => ['file', '/dev/null', 'w']],
|
|
$pipes
|
|
);
|
|
for($i = 0; $i < 50; $i++) {
|
|
$socket = @fsockopen('127.0.0.1', self::$port);
|
|
if($socket) { fclose($socket); return; }
|
|
usleep(100000);
|
|
}
|
|
self::fail('The test server did not start');
|
|
}
|
|
|
|
public static function tearDownAfterClass(): void {
|
|
proc_terminate(self::$server);
|
|
}
|
|
|
|
private function http() {
|
|
$http = new HTTP('test');
|
|
// "pinned.example" exists only in this resolver; curl can reach it only
|
|
// through the pinned address.
|
|
$http->set_safe_mode(true, ['127.0.0.1'], function($host) { return $host === 'pinned.example' ? ['127.0.0.1'] : []; });
|
|
return $http;
|
|
}
|
|
|
|
public function testConnectsToThePinnedAddress() {
|
|
$response = $this->http()->get('http://pinned.example:' . self::$port . '/');
|
|
$this->assertSame(200, $response['code']);
|
|
$this->assertSame('host=pinned.example:' . self::$port, $response['body']);
|
|
}
|
|
|
|
// curl keeps only the last CURLOPT_RESOLVE entry for a host and port, so
|
|
// every resolved address has to go in a single entry. Otherwise a host with
|
|
// both IPv6 and IPv4 addresses is only tried on the last one.
|
|
public function testTriesEveryPinnedAddress() {
|
|
$http = new HTTP('test');
|
|
$http->set_safe_mode(true, ['127.0.0.0/8'], function($host) {
|
|
// Nothing listens on 127.0.0.3, so this only succeeds if curl can fall back to 127.0.0.1
|
|
return $host === 'pinned.example' ? ['127.0.0.1', '127.0.0.3'] : [];
|
|
});
|
|
$response = $http->get('http://pinned.example:' . self::$port . '/');
|
|
$this->assertSame(200, $response['code']);
|
|
$this->assertSame('host=pinned.example:' . self::$port, $response['body']);
|
|
}
|
|
|
|
public function testRedirectsAreCheckedHopByHop() {
|
|
$port = self::$port;
|
|
$response = $this->http()->get("http://pinned.example:$port/?to=" . rawurlencode("http://127.0.0.1:$port/"));
|
|
$this->assertSame(200, $response['code']);
|
|
$this->assertSame("http://127.0.0.1:$port/", $response['url']);
|
|
|
|
$response = $this->http()->get("http://pinned.example:$port/?to=" . rawurlencode("http://127.0.0.2:$port/"));
|
|
$this->assertSame('blocked_url', $response['error']);
|
|
}
|
|
|
|
public function testPinnedCurlRefusesOtherProtocols() {
|
|
$curl = new Curl();
|
|
$curl->pin_addresses([]);
|
|
$response = $curl->get('dict://127.0.0.1:' . self::$port . '/info');
|
|
$this->assertSame(0, $response['code']);
|
|
$this->assertNotSame('', $response['error_description']);
|
|
}
|
|
|
|
// HTTP/2 is only negotiated over TLS. Plain http stays on HTTP/1.1 rather
|
|
// than sending an h2c Upgrade request, which some servers mishandle (PHP
|
|
// 7.3's built-in server drops the connection).
|
|
public function testPlainHttpDoesNotAttemptHttp2Upgrade() {
|
|
$response = (new HTTP('test'))->get('http://127.0.0.1:' . self::$port . '/?upgrade=1');
|
|
$this->assertSame(200, $response['code']);
|
|
$this->assertSame('upgrade=', $response['body']);
|
|
}
|
|
}
|