The client sends it every HTTP request and its IMQ connection; it makes them with current TLS and certificates, upgrades IMVU's plain-HTTP hosts to HTTPS, and refuses IMVU's reporting endpoints. CI tests it and publishes t5de-proxy.exe as nightlies and tagged releases. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
dhkatzandClaude Opus 5.5 committed
commit
2551888ed6
19 files changed
+1498
No files matched your search
@@ -0,0 +1,342 @@
|
||||
package proxy
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"encoding/base64"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"strings"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
const token = "secret"
|
||||
|
||||
var auth = "Basic " + base64.StdEncoding.EncodeToString([]byte("t5de:"+token))
|
||||
|
||||
// send makes a raw request to the proxy, as the client does, and returns the response.
|
||||
func send(t *testing.T, proxy *httptest.Server, raw string) *http.Response {
|
||||
t.Helper()
|
||||
conn, err := net.Dial("tcp", proxy.Listener.Addr().String())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Cleanup(func() { conn.Close() })
|
||||
if _, err := io.WriteString(conn, raw); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
resp, err := http.ReadResponse(bufio.NewReader(conn), nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Cleanup(func() { resp.Body.Close() })
|
||||
return resp
|
||||
}
|
||||
|
||||
func body(t *testing.T, resp *http.Response) string {
|
||||
t.Helper()
|
||||
b, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return string(b)
|
||||
}
|
||||
|
||||
// logBuffer collects the proxy's log, written from its handlers' goroutines.
|
||||
type logBuffer struct {
|
||||
mu sync.Mutex
|
||||
buf bytes.Buffer
|
||||
}
|
||||
|
||||
func (b *logBuffer) Write(p []byte) (int, error) {
|
||||
b.mu.Lock()
|
||||
defer b.mu.Unlock()
|
||||
return b.buf.Write(p)
|
||||
}
|
||||
|
||||
func (b *logBuffer) String() string {
|
||||
b.mu.Lock()
|
||||
defer b.mu.Unlock()
|
||||
return b.buf.String()
|
||||
}
|
||||
|
||||
func newProxy(t *testing.T, s *Server) (*httptest.Server, *logBuffer) {
|
||||
logs := &logBuffer{}
|
||||
s.Token = token
|
||||
s.Log = log.New(logs, "", 0)
|
||||
p := httptest.NewServer(s)
|
||||
t.Cleanup(p.Close)
|
||||
return p, logs
|
||||
}
|
||||
|
||||
func TestRefusesRequestsWithoutTheToken(t *testing.T) {
|
||||
origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
t.Error("an unauthorized request reached the server")
|
||||
}))
|
||||
defer origin.Close()
|
||||
p, _ := newProxy(t, &Server{})
|
||||
for _, header := range []string{"", "Proxy-Authorization: Basic " + base64.StdEncoding.EncodeToString([]byte("t5de:wrong")) + "\r\n"} {
|
||||
resp := send(t, p, "GET "+origin.URL+"/ HTTP/1.1\r\nHost: x\r\n"+header+"\r\n")
|
||||
if resp.StatusCode != http.StatusProxyAuthRequired {
|
||||
t.Fatalf("got %d, want 407", resp.StatusCode)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestForwardsAsTheClientAsked(t *testing.T) {
|
||||
var got *http.Request
|
||||
var gotBody string
|
||||
origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
got = r
|
||||
b, _ := io.ReadAll(r.Body)
|
||||
gotBody = string(b)
|
||||
w.Header().Set("Content-Encoding", "gzip")
|
||||
w.Header().Set("Set-Cookie", "a=b")
|
||||
w.Header().Set("Location", "https://example.invalid/next")
|
||||
w.WriteHeader(http.StatusFound)
|
||||
io.WriteString(w, "compressed bytes")
|
||||
}))
|
||||
defer origin.Close()
|
||||
p, logs := newProxy(t, &Server{})
|
||||
resp := send(t, p, "POST "+origin.URL+"/api/xmlrpc/client.php?sid=1 HTTP/1.1\r\nHost: ignored\r\n"+
|
||||
"Proxy-Authorization: "+auth+"\r\nX-imvu-auth: abc\r\nAccept-Encoding: gzip\r\nConnection: close\r\n"+
|
||||
"Content-Length: 5\r\n\r\nhello")
|
||||
// The response comes back as the server sent it: the redirect not followed, the body not decompressed.
|
||||
if resp.StatusCode != http.StatusFound || resp.Header.Get("Location") != "https://example.invalid/next" ||
|
||||
resp.Header.Get("Content-Encoding") != "gzip" || resp.Header.Get("Set-Cookie") != "a=b" {
|
||||
t.Fatalf("response: %d %v", resp.StatusCode, resp.Header)
|
||||
}
|
||||
if b := body(t, resp); b != "compressed bytes" {
|
||||
t.Fatalf("body %q", b)
|
||||
}
|
||||
if got.URL.RequestURI() != "/api/xmlrpc/client.php?sid=1" || gotBody != "hello" || got.Header.Get("X-imvu-auth") != "abc" ||
|
||||
got.Header.Get("Accept-Encoding") != "gzip" {
|
||||
t.Fatalf("request: %s %v %q", got.URL, got.Header, gotBody)
|
||||
}
|
||||
// Neither the proxy's token nor a user agent the client didn't send reach the server.
|
||||
if got.Header.Get("Proxy-Authorization") != "" || got.Header.Get("User-Agent") != "" {
|
||||
t.Fatalf("request headers: %v", got.Header)
|
||||
}
|
||||
if got.Host != strings.TrimPrefix(origin.URL, "http://") {
|
||||
t.Fatalf("Host %q", got.Host)
|
||||
}
|
||||
// The log leaves out queries.
|
||||
if !strings.Contains(logs.String(), "/api/xmlrpc/client.php?… 302") || strings.Contains(logs.String(), "sid=1") {
|
||||
t.Fatalf("log: %s", logs)
|
||||
}
|
||||
}
|
||||
|
||||
func TestForwardsHTTPS(t *testing.T) {
|
||||
origin := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
io.WriteString(w, "secure "+r.URL.Path)
|
||||
}))
|
||||
defer origin.Close()
|
||||
p, _ := newProxy(t, &Server{Transport: origin.Client().Transport})
|
||||
resp := send(t, p, "GET "+origin.URL+"/x HTTP/1.1\r\nHost: x\r\nProxy-Authorization: "+auth+"\r\n\r\n")
|
||||
if b := body(t, resp); resp.StatusCode != 200 || b != "secure /x" {
|
||||
t.Fatalf("%d %q", resp.StatusCode, b)
|
||||
}
|
||||
}
|
||||
|
||||
// recorder is a transport that records requests and answers them itself.
|
||||
type recorder struct {
|
||||
mu sync.Mutex
|
||||
urls []string
|
||||
fail func(*http.Request) error
|
||||
}
|
||||
|
||||
func (r *recorder) RoundTrip(req *http.Request) (*http.Response, error) {
|
||||
r.mu.Lock()
|
||||
r.urls = append(r.urls, req.URL.String())
|
||||
r.mu.Unlock()
|
||||
if r.fail != nil {
|
||||
if err := r.fail(req); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
return &http.Response{StatusCode: 200, Header: http.Header{}, Body: io.NopCloser(strings.NewReader("ok")), Request: req}, nil
|
||||
}
|
||||
|
||||
func TestUpgradesIMVUHostsToHTTPS(t *testing.T) {
|
||||
rec := &recorder{}
|
||||
p, _ := newProxy(t, &Server{Transport: rec})
|
||||
for _, u := range []string{"http://client-dynamic.imvu.com/api/xmlrpc/client.php", "http://userimages03-akm.imvu.com/a.png", "http://example.com/a", "http://www.imvu.com:8080/a", "http://product.virtual.imvu.com/a"} {
|
||||
body(t, send(t, p, "GET "+u+" HTTP/1.1\r\nHost: x\r\nProxy-Authorization: "+auth+"\r\n\r\n"))
|
||||
}
|
||||
want := []string{"https://client-dynamic.imvu.com/api/xmlrpc/client.php", "https://userimages03-akm.imvu.com/a.png", "http://example.com/a", "http://www.imvu.com:8080/a", "http://product.virtual.imvu.com/a"}
|
||||
if fmt.Sprint(rec.urls) != fmt.Sprint(want) {
|
||||
t.Fatalf("got %v, want %v", rec.urls, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestFallsBackToHTTPWhenHTTPSFails(t *testing.T) {
|
||||
rec := &recorder{fail: func(r *http.Request) error {
|
||||
if r.URL.Scheme == "https" {
|
||||
return errors.New("tls: handshake failure")
|
||||
}
|
||||
return nil
|
||||
}}
|
||||
p, _ := newProxy(t, &Server{Transport: rec})
|
||||
resp := send(t, p, "GET http://userimages.imvu.com/a.png HTTP/1.1\r\nHost: x\r\nProxy-Authorization: "+auth+"\r\n\r\n")
|
||||
if b := body(t, resp); resp.StatusCode != 200 || b != "ok" {
|
||||
t.Fatalf("%d %q", resp.StatusCode, b)
|
||||
}
|
||||
want := []string{"https://userimages.imvu.com/a.png", "http://userimages.imvu.com/a.png"}
|
||||
if fmt.Sprint(rec.urls) != fmt.Sprint(want) {
|
||||
t.Fatalf("got %v, want %v", rec.urls, want)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBlocksReportingEndpoints(t *testing.T) {
|
||||
rec := &recorder{}
|
||||
p, logs := newProxy(t, &Server{Transport: rec})
|
||||
for _, u := range []string{"http://bugs.imvu.com/x", "https://www.imvu.com/catalog/web_submit_logs.php", "https://api.imvu.com/events/1"} {
|
||||
if resp := send(t, p, "POST "+u+" HTTP/1.1\r\nHost: x\r\nProxy-Authorization: "+auth+"\r\nContent-Length: 0\r\n\r\n"); resp.StatusCode != http.StatusForbidden {
|
||||
t.Fatalf("%s: %d", u, resp.StatusCode)
|
||||
}
|
||||
}
|
||||
if len(rec.urls) != 0 || strings.Count(logs.String(), "blocked") != 3 {
|
||||
t.Fatalf("forwarded %v; log %s", rec.urls, logs)
|
||||
}
|
||||
for _, u := range []string{"https://api.imvu.com/eventsx", "https://api.imvu.com/user/1"} {
|
||||
parsed, _ := url.Parse(u)
|
||||
if Blocked(parsed) {
|
||||
t.Fatalf("%s blocked", u)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRejectsOriginFormRequests(t *testing.T) {
|
||||
p, _ := newProxy(t, &Server{Transport: &recorder{}})
|
||||
if resp := send(t, p, "GET /a HTTP/1.1\r\nHost: www.imvu.com\r\nProxy-Authorization: "+auth+"\r\n\r\n"); resp.StatusCode != http.StatusBadRequest {
|
||||
t.Fatalf("got %d", resp.StatusCode)
|
||||
}
|
||||
}
|
||||
|
||||
// imqFrame encodes an IMQ frame.
|
||||
func imqFrame(typ uint64, data string) []byte {
|
||||
b := []byte{0x08, byte(typ) | 0x80, byte(typ >> 7), 0x12, byte(len(data))}
|
||||
return append(b, data...)
|
||||
}
|
||||
|
||||
func TestConnectSpeaksTLSUpstream(t *testing.T) {
|
||||
// A TLS echo server stands in for IMQ's gateway.
|
||||
gateway := httptest.NewUnstartedServer(nil)
|
||||
gateway.StartTLS()
|
||||
gateway.Close() // only for its certificate
|
||||
cert := gateway.TLS.Certificates[0]
|
||||
ln, err := tls.Listen("tcp", "127.0.0.1:0", &tls.Config{Certificates: []tls.Certificate{cert}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer ln.Close()
|
||||
go func() {
|
||||
c, err := ln.Accept()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
defer c.Close()
|
||||
io.Copy(c, c)
|
||||
}()
|
||||
|
||||
roots := gateway.Client().Transport.(*http.Transport).TLSClientConfig.RootCAs
|
||||
p, logs := newProxy(t, &Server{TLSConfig: &tls.Config{RootCAs: roots}, Trace: true,
|
||||
Dial: func(ctx context.Context, network, addr string) (net.Conn, error) {
|
||||
if addr != "example.com:443" {
|
||||
return nil, fmt.Errorf("dialed %s", addr)
|
||||
}
|
||||
return net.Dial(network, ln.Addr().String())
|
||||
}})
|
||||
conn, err := net.Dial("tcp", p.Listener.Addr().String())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer conn.Close()
|
||||
// The test certificate is for example.com. The client's first frame comes with its CONNECT.
|
||||
hello := imqFrame(1302, "connect")
|
||||
fmt.Fprintf(conn, "CONNECT example.com:443 HTTP/1.1\r\nProxy-authorization: %s\r\n\r\n%s", auth, hello)
|
||||
r := bufio.NewReader(conn)
|
||||
status, err := r.ReadString('\n')
|
||||
if err != nil {
|
||||
t.Fatalf("%v; log %s", err, logs)
|
||||
}
|
||||
if !strings.HasPrefix(status, "HTTP/1.1 200") {
|
||||
t.Fatalf("status %q; log %s", status, logs)
|
||||
}
|
||||
for line, _ := r.ReadString('\n'); line != "\r\n"; line, _ = r.ReadString('\n') {
|
||||
}
|
||||
echo := make([]byte, len(hello))
|
||||
if _, err := io.ReadFull(r, echo); err != nil || !bytes.Equal(echo, hello) {
|
||||
t.Fatalf("echo %q %v", echo, err)
|
||||
}
|
||||
conn.Close()
|
||||
// The log names the frames each way.
|
||||
for i := 0; i < 200 && !strings.Contains(logs.String(), "closed"); i++ {
|
||||
time.Sleep(10 * time.Millisecond)
|
||||
}
|
||||
if !strings.Contains(logs.String(), "c2g C2gConnect 7B") || !strings.Contains(logs.String(), "g2c C2gConnect 7B") {
|
||||
t.Fatalf("log: %s", logs)
|
||||
}
|
||||
}
|
||||
|
||||
func TestReportsUnreachableServers(t *testing.T) {
|
||||
rec := &recorder{fail: func(*http.Request) error { return errors.New("dial tcp: no such host") }}
|
||||
p, _ := newProxy(t, &Server{Transport: rec})
|
||||
resp := send(t, p, "GET https://nowhere.imvu.com/ HTTP/1.1\r\nHost: x\r\nProxy-Authorization: "+auth+"\r\n\r\n")
|
||||
if resp.StatusCode != http.StatusBadGateway || !strings.Contains(resp.Header.Get(ErrorHeader), "no such host") {
|
||||
t.Fatalf("%d %v", resp.StatusCode, resp.Header)
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuffersBodiesToSendAgain(t *testing.T) {
|
||||
// Go's transport sends a request again when the server closed a pooled connection as it went out, if it can
|
||||
// get the body again (GetBody); without it, it fails with "cannot rewind body after connection loss".
|
||||
in := httptest.NewRequest("POST", "http://x/", strings.NewReader("hello"))
|
||||
out := in.Clone(in.Context())
|
||||
if ok, err := bufferBody(out, in); !ok || err != nil || out.GetBody == nil || out.ContentLength != 5 {
|
||||
t.Fatalf("%v %v %d", ok, err, out.ContentLength)
|
||||
}
|
||||
for i := 0; i < 2; i++ {
|
||||
body, _ := out.GetBody()
|
||||
if b, _ := io.ReadAll(body); string(b) != "hello" {
|
||||
t.Fatalf("body %q", b)
|
||||
}
|
||||
}
|
||||
// Bodies over maxBuffered are streamed whole, and can't be sent again.
|
||||
big := strings.Repeat("x", maxBuffered+10)
|
||||
in = httptest.NewRequest("POST", "http://x/", strings.NewReader(big))
|
||||
out = in.Clone(in.Context())
|
||||
if ok, err := bufferBody(out, in); ok || err != nil || out.GetBody != nil {
|
||||
t.Fatalf("%v %v", ok, err)
|
||||
}
|
||||
if b, _ := io.ReadAll(out.Body); len(b) != len(big) {
|
||||
t.Fatalf("streamed %d bytes", len(b))
|
||||
}
|
||||
}
|
||||
|
||||
func TestFallsBackToHTTPWithTheBody(t *testing.T) {
|
||||
var got []string
|
||||
rec := &recorder{fail: func(r *http.Request) error {
|
||||
b, _ := io.ReadAll(r.Body)
|
||||
got = append(got, r.URL.Scheme+" "+string(b))
|
||||
if r.URL.Scheme == "https" {
|
||||
return errors.New("tls: handshake failure")
|
||||
}
|
||||
return nil
|
||||
}}
|
||||
p, _ := newProxy(t, &Server{Transport: rec})
|
||||
resp := send(t, p, "POST http://client-dynamic.imvu.com/api/xmlrpc/client.php HTTP/1.1\r\nHost: x\r\nProxy-Authorization: "+auth+"\r\nContent-Length: 4\r\n\r\nbody")
|
||||
if resp.StatusCode != 200 || fmt.Sprint(got) != "[https body http body]" {
|
||||
t.Fatalf("%d %q", resp.StatusCode, got)
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user