Skip to content

Commit 1a8a72d

Browse files
author
Ruben Bridgewater
committed
Improve tls tests
Removed redundant tests. Skip the tests on windows instead of not even showing them. Add a faulty cert to check proper cert validation. Reject unauthorized certs
1 parent 4f3c4a2 commit 1a8a72d

File tree

2 files changed

+98
-172
lines changed

2 files changed

+98
-172
lines changed

‎test/conf/faulty.cert‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDATCCAemgAwIBAgIJALkMmVkQOERnMA0GCSqGSIb3DQEBBQUAMBcxFTATBgNV
3+
BAMMDHJlZGlzLmpzLm9yZzAeFw0xNTEwMTkxMjIzMjRaFw0yNTEwMTYxMjIzMjRa
4+
MBcxFTATBgNVBAMMDHJlZGlzLmpzLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEP
5+
ADCCAQoCggEBAJ/DmMTJHf7kyspxI1A/JmOc+KI9vxEcN5qn7IiZuGN7ghE43Q3q
6+
XB2GUkMAuW1POkmM5yi3SuT1UXDR/4Gk7KlbHKMs37AV6PgJXX6oX0zu12LTAT7V
7+
5byNrYtehSo42l1188dGEMCGaaf0cDntc7A3aW0ZtzrJt+2pu31Uatl2SEJCMra6
8+
+v6O0c9aHMF1cArKeawGqR+jHw6vXFZQbUd06nW5nQlUA6wVt1JjlLPwBwYsWLsi
9+
YQxMC8NqpgAIg5tULSCpKwx5isL/CeotVVGDNZ/G8R1nTrxuygPlc3Qskj57hmV4
10+
tZK4JJxQFi7/9ehvjAvHohKrEPeqV5XL87cCAwEAAaNQME4wHQYDVR0OBBYEFCn/
11+
5hB+XY4pVOnaqvrmZMxrLFjLMB8GA1UdIwQYMBaAFCn/5hB+XY4pVOnaqvrmZMxr
12+
LFjLMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAEduPyTHpXkCVZRQ
13+
v6p+Ug4iVeXpxGCVr34y7EDUMgmuDdqsz1SrmqeDd0VmjZT8htbWw7QBKDPEBsbi
14+
wl606aAn01iM+oUrwbtXxid1xfZj/j6pIhQVkGu7e/8A7Pr4QOP4OMdHB7EmqkAo
15+
d/OLHa9LdKv2UtJHD6U7oVQbdBHrRV62125GMmotpQuSkEfZM6edKNzHPlqV/zJc
16+
2kGCw3lZC21mTrsSMIC/FQiobPnig4kAvfh0of2rK/XAntlwT8ie1v1aK+jERsfm
17+
uzMihl6XXBdzheq6KdIlf+5STHBIIRcvBoRKr5Va7EhnO03tTzeJowtqDv47yPC6
18+
w4kLcP8=
19+
-----END CERTIFICATE-----

‎test/tls.spec.js‎

Lines changed: 79 additions & 172 deletions
Original file line numberDiff line numberDiff line change
@@ -6,25 +6,33 @@ var fs = require('fs');
66
var helper = require('./helper');
77
var path = require('path');
88
var redis = config.redis;
9+
var utils = require('../lib/utils');
910

1011
var tls_options = {
1112
servername: "redis.js.org",
12-
rejectUnauthorized: false,
13+
rejectUnauthorized: true,
1314
ca: [ String(fs.readFileSync(path.resolve(__dirname, "./conf/redis.js.org.cert"))) ]
1415
};
1516

1617
var tls_port = 6380;
17-
18-
if (process.platform === 'win32') {
19-
return;
20-
}
18+
// Use skip instead of returning to indicate what tests really got skipped
19+
var skip = false;
2120

2221
// Wait until stunnel4 is in the travis whitelist
2322
// Check: https://github.com/travis-ci/apt-package-whitelist/issues/403
2423
// If this is merged, remove the travis env checks
2524
describe("TLS connection tests", function () {
25+
2626
before(function (done) {
27-
if (process.env.TRAVIS === 'true') {
27+
// Print the warning when the tests run instead of while starting mocha
28+
if (process.platform === 'win32') {
29+
skip = true;
30+
console.warn('\nStunnel tests do not work on windows atm. If you think you can fix that, it would be warmly welcome.\n');
31+
} else if (process.env.TRAVIS === 'true') {
32+
skip = true;
33+
console.warn('\nTravis does not support stunnel right now. Skipping tests.\nCheck: https://github.com/travis-ci/apt-package-whitelist/issues/403\n');
34+
}
35+
if (skip) {
2836
done();
2937
return;
3038
}
@@ -34,188 +42,87 @@ describe("TLS connection tests", function () {
3442
});
3543

3644
after(function (done) {
37-
if (process.env.TRAVIS === 'true') {
45+
if (skip) {
3846
done();
3947
return;
4048
}
4149
helper.stopStunnel(done);
4250
});
4351

44-
helper.allTests(function(parser, ip, args) {
52+
var client;
4553

46-
describe("using " + parser + " and " + ip, function () {
47-
48-
var client;
54+
afterEach(function () {
55+
client.end(true);
56+
});
4957

50-
afterEach(function () {
51-
client.end(true);
58+
describe("on lost connection", function () {
59+
it("emit an error after max retry timeout and do not try to reconnect afterwards", function (done) {
60+
if (skip) this.skip();
61+
var connect_timeout = 500; // in ms
62+
client = redis.createClient({
63+
connect_timeout: connect_timeout,
64+
port: tls_port,
65+
tls: tls_options
5266
});
67+
var time = 0;
5368

54-
describe("on lost connection", function () {
55-
it("emit an error after max retry attempts and do not try to reconnect afterwards", function (done) {
56-
if (process.env.TRAVIS === 'true') this.skip();
57-
var max_attempts = 4;
58-
var options = {
59-
parser: parser,
60-
max_attempts: max_attempts,
61-
port: tls_port,
62-
tls: tls_options
63-
};
64-
client = redis.createClient(options);
65-
var calls = 0;
66-
67-
client.once('ready', function() {
68-
helper.killConnection(client);
69-
});
70-
71-
client.on("reconnecting", function (params) {
72-
calls++;
73-
});
74-
75-
client.on('error', function(err) {
76-
if (/Redis connection in broken state: maximum connection attempts.*?exceeded./.test(err.message)) {
77-
setTimeout(function () {
78-
assert.strictEqual(calls, max_attempts - 1);
79-
done();
80-
}, 500);
81-
}
82-
});
83-
});
84-
85-
it("emit an error after max retry timeout and do not try to reconnect afterwards", function (done) {
86-
if (process.env.TRAVIS === 'true') this.skip();
87-
var connect_timeout = 500; // in ms
88-
client = redis.createClient({
89-
parser: parser,
90-
connect_timeout: connect_timeout,
91-
port: tls_port,
92-
tls: tls_options
93-
});
94-
var time = 0;
95-
96-
client.once('ready', function() {
97-
helper.killConnection(client);
98-
});
99-
100-
client.on("reconnecting", function (params) {
101-
time += params.delay;
102-
});
103-
104-
client.on('error', function(err) {
105-
if (/Redis connection in broken state: connection timeout.*?exceeded./.test(err.message)) {
106-
setTimeout(function () {
107-
assert(time === connect_timeout);
108-
done();
109-
}, 500);
110-
}
111-
});
112-
});
113-
114-
it("end connection while retry is still ongoing", function (done) {
115-
if (process.env.TRAVIS === 'true') this.skip();
116-
var connect_timeout = 1000; // in ms
117-
client = redis.createClient({
118-
parser: parser,
119-
connect_timeout: connect_timeout,
120-
port: tls_port,
121-
tls: tls_options
122-
});
123-
124-
client.once('ready', function() {
125-
helper.killConnection(client);
126-
});
127-
128-
client.on("reconnecting", function (params) {
129-
client.end(true);
130-
setTimeout(done, 100);
131-
});
132-
});
133-
134-
it("can not connect with wrong host / port in the options object", function (done) {
135-
if (process.env.TRAVIS === 'true') this.skip();
136-
var options = {
137-
host: 'somewhere',
138-
max_attempts: 1,
139-
port: tls_port,
140-
tls: tls_options
141-
};
142-
client = redis.createClient(options);
143-
var end = helper.callFuncAfter(done, 2);
144-
145-
client.on('error', function (err) {
146-
assert(/CONNECTION_BROKEN|ENOTFOUND|EAI_AGAIN/.test(err.code));
147-
end();
148-
});
149-
150-
});
69+
client.once('ready', function() {
70+
helper.killConnection(client);
15171
});
15272

153-
describe("when not connected", function () {
154-
155-
it("connect with host and port provided in the options object", function (done) {
156-
if (process.env.TRAVIS === 'true') this.skip();
157-
client = redis.createClient({
158-
host: 'localhost',
159-
parser: parser,
160-
connect_timeout: 1000,
161-
port: tls_port,
162-
tls: tls_options
163-
});
73+
client.on("reconnecting", function (params) {
74+
time += params.delay;
75+
});
16476

165-
client.once('ready', function() {
77+
client.on('error', function(err) {
78+
if (/Redis connection in broken state: connection timeout.*?exceeded./.test(err.message)) {
79+
setTimeout(function () {
80+
assert(time === connect_timeout);
16681
done();
167-
});
168-
});
169-
170-
it("connects correctly with args", function (done) {
171-
if (process.env.TRAVIS === 'true') this.skip();
172-
var args_host = args[1];
173-
var args_options = args[2] || {};
174-
args_options.tls = tls_options;
175-
client = redis.createClient(tls_port, args_host, args_options);
176-
client.on("error", done);
177-
178-
client.once("ready", function () {
179-
client.removeListener("error", done);
180-
client.get("recon 1", function (err, res) {
181-
done(err);
182-
});
183-
});
184-
});
185-
186-
if (ip === 'IPv4') {
187-
it('allows connecting with the redis url and no auth and options as second parameter', function (done) {
188-
if (process.env.TRAVIS === 'true') this.skip();
189-
var options = {
190-
detect_buffers: false,
191-
magic: Math.random(),
192-
port: tls_port,
193-
tls: tls_options
194-
};
195-
client = redis.createClient('redis://' + config.HOST[ip] + ':' + tls_port, options);
196-
// verify connection is using TCP, not UNIX socket
197-
assert.strictEqual(client.connection_options.host, config.HOST[ip]);
198-
assert.strictEqual(client.connection_options.port, tls_port);
199-
assert(typeof client.stream.getCipher === 'function');
200-
// verify passed options are in use
201-
assert.strictEqual(client.options.magic, options.magic);
202-
client.on("ready", function () {
203-
return done();
204-
});
205-
});
206-
207-
it('allows connecting with the redis url and no auth and options as third parameter', function (done) {
208-
if (process.env.TRAVIS === 'true') this.skip();
209-
client = redis.createClient('redis://' + config.HOST[ip] + ':' + tls_port, null, {
210-
detect_buffers: false,
211-
tls: tls_options
212-
});
213-
client.on("ready", function () {
214-
return done();
215-
});
216-
});
82+
}, 100);
21783
}
21884
});
21985
});
22086
});
87+
88+
describe("when not connected", function () {
89+
90+
it("connect with host and port provided in the options object", function (done) {
91+
if (skip) this.skip();
92+
client = redis.createClient({
93+
host: 'localhost',
94+
connect_timeout: 1000,
95+
port: tls_port,
96+
tls: tls_options
97+
});
98+
99+
// verify connection is using TCP, not UNIX socket
100+
assert.strictEqual(client.connection_options.host, 'localhost');
101+
assert.strictEqual(client.connection_options.port, tls_port);
102+
assert(client.stream.encrypted);
103+
104+
client.set('foo', 'bar');
105+
client.get('foo', helper.isString('bar', done));
106+
});
107+
108+
it('fails to connect because the cert is not correct', function (done) {
109+
if (skip) this.skip();
110+
var faulty_cert = utils.clone(tls_options);
111+
faulty_cert.ca = [ String(fs.readFileSync(path.resolve(__dirname, "./conf/faulty.cert"))) ];
112+
client = redis.createClient({
113+
host: 'localhost',
114+
connect_timeout: 1000,
115+
port: tls_port,
116+
tls: faulty_cert
117+
});
118+
client.on('error', function (err) {
119+
assert.strictEqual(err.code, 'DEPTH_ZERO_SELF_SIGNED_CERT');
120+
client.end(true);
121+
});
122+
client.set('foo', 'bar', function (err, res) {
123+
done(res);
124+
});
125+
});
126+
127+
});
221128
});

0 commit comments

Comments
 (0)