413 lines
16 KiB
Python
413 lines
16 KiB
Python
|
#!/usr/bin/env vpython3
|
||
|
|
# Copyright 2013 The Chromium Authors
|
||
|
|
# Use of this source code is governed by a BSD-style license that can be
|
||
|
|
# found in the LICENSE file.
|
||
|
|
|
||
|
|
"""This is a simple HTTP/TCP/PROXY/BASIC_AUTH_PROXY/WEBSOCKET server used for
|
||
|
|
testing Chrome.
|
||
|
|
|
||
|
|
It supports several test URLs, as specified by the handlers in TestPageHandler.
|
||
|
|
By default, it listens on an ephemeral port and sends the port number back to
|
||
|
|
the originating process over a pipe. The originating process can specify an
|
||
|
|
explicit port if necessary.
|
||
|
|
"""
|
||
|
|
|
||
|
|
from __future__ import print_function
|
||
|
|
|
||
|
|
import base64
|
||
|
|
import logging
|
||
|
|
import os
|
||
|
|
import select
|
||
|
|
from six.moves import BaseHTTPServer, socketserver
|
||
|
|
import six.moves.urllib.parse as urlparse
|
||
|
|
import socket
|
||
|
|
import ssl
|
||
|
|
import sys
|
||
|
|
|
||
|
|
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
|
||
|
|
ROOT_DIR = os.path.dirname(os.path.dirname(os.path.dirname(BASE_DIR)))
|
||
|
|
|
||
|
|
# Insert at the beginning of the path, we want to use our copies of the library
|
||
|
|
# unconditionally (since they contain modifications from anything that might be
|
||
|
|
# obtained from e.g. PyPi).
|
||
|
|
sys.path.insert(0, os.path.join(ROOT_DIR, 'third_party', 'pywebsocket3', 'src'))
|
||
|
|
|
||
|
|
import mod_pywebsocket.standalone
|
||
|
|
from mod_pywebsocket.standalone import WebSocketServer
|
||
|
|
# import manually
|
||
|
|
mod_pywebsocket.standalone.ssl = ssl
|
||
|
|
|
||
|
|
import testserver_base
|
||
|
|
|
||
|
|
SERVER_UNSET = 0
|
||
|
|
SERVER_BASIC_AUTH_PROXY = 1
|
||
|
|
SERVER_WEBSOCKET = 2
|
||
|
|
SERVER_PROXY = 3
|
||
|
|
|
||
|
|
# Default request queue size for WebSocketServer.
|
||
|
|
_DEFAULT_REQUEST_QUEUE_SIZE = 128
|
||
|
|
|
||
|
|
class WebSocketOptions:
|
||
|
|
"""Holds options for WebSocketServer."""
|
||
|
|
|
||
|
|
def __init__(self, host, port, data_dir):
|
||
|
|
self.request_queue_size = _DEFAULT_REQUEST_QUEUE_SIZE
|
||
|
|
self.server_host = host
|
||
|
|
self.port = port
|
||
|
|
self.websock_handlers = data_dir
|
||
|
|
self.scan_dir = None
|
||
|
|
self.allow_handlers_outside_root_dir = False
|
||
|
|
self.websock_handlers_map_file = None
|
||
|
|
self.cgi_directories = []
|
||
|
|
self.is_executable_method = None
|
||
|
|
|
||
|
|
self.use_tls = False
|
||
|
|
self.private_key = None
|
||
|
|
self.certificate = None
|
||
|
|
self.tls_client_auth = False
|
||
|
|
self.tls_client_ca = None
|
||
|
|
self.use_basic_auth = False
|
||
|
|
self.basic_auth_credential = 'Basic ' + base64.b64encode(
|
||
|
|
b'test:test').decode()
|
||
|
|
|
||
|
|
|
||
|
|
class ThreadingHTTPServer(socketserver.ThreadingMixIn,
|
||
|
|
testserver_base.ClientRestrictingServerMixIn,
|
||
|
|
testserver_base.BrokenPipeHandlerMixIn,
|
||
|
|
testserver_base.StoppableHTTPServer):
|
||
|
|
"""This is a specialization of StoppableHTTPServer that adds client
|
||
|
|
verification and creates a new thread for every connection. It
|
||
|
|
should only be used with handlers that are known to be threadsafe."""
|
||
|
|
|
||
|
|
pass
|
||
|
|
|
||
|
|
|
||
|
|
class TestPageHandler(testserver_base.BasePageHandler):
|
||
|
|
def __init__(self, request, client_address, socket_server):
|
||
|
|
connect_handlers = [self.DefaultConnectResponseHandler]
|
||
|
|
get_handlers = [self.DefaultResponseHandler]
|
||
|
|
post_handlers = get_handlers
|
||
|
|
put_handlers = get_handlers
|
||
|
|
head_handlers = [self.DefaultResponseHandler]
|
||
|
|
testserver_base.BasePageHandler.__init__(self, request, client_address,
|
||
|
|
socket_server, connect_handlers,
|
||
|
|
get_handlers, head_handlers,
|
||
|
|
post_handlers, put_handlers)
|
||
|
|
|
||
|
|
def DefaultResponseHandler(self):
|
||
|
|
"""This is the catch-all response handler for requests that aren't handled
|
||
|
|
by one of the special handlers above.
|
||
|
|
Note that we specify the content-length as without it the https connection
|
||
|
|
is not closed properly (and the browser keeps expecting data)."""
|
||
|
|
|
||
|
|
contents = "Default response given for path: " + self.path
|
||
|
|
self.send_response(200)
|
||
|
|
self.send_header('Content-Type', 'text/html')
|
||
|
|
self.send_header('Content-Length', len(contents))
|
||
|
|
self.end_headers()
|
||
|
|
if (self.command != 'HEAD'):
|
||
|
|
self.wfile.write(contents.encode('utf8'))
|
||
|
|
return True
|
||
|
|
|
||
|
|
def DefaultConnectResponseHandler(self):
|
||
|
|
"""This is the catch-all response handler for CONNECT requests that aren't
|
||
|
|
handled by one of the special handlers above. Real Web servers respond
|
||
|
|
with 400 to CONNECT requests."""
|
||
|
|
|
||
|
|
contents = "Your client has issued a malformed or illegal request."
|
||
|
|
self.send_response(400) # bad request
|
||
|
|
self.send_header('Content-Type', 'text/html')
|
||
|
|
self.send_header('Content-Length', len(contents))
|
||
|
|
self.end_headers()
|
||
|
|
self.wfile.write(contents.encode('utf8'))
|
||
|
|
return True
|
||
|
|
|
||
|
|
|
||
|
|
class ProxyRequestHandler(BaseHTTPServer.BaseHTTPRequestHandler):
|
||
|
|
"""A request handler that behaves as a proxy server. Only CONNECT, GET and
|
||
|
|
HEAD methods are supported.
|
||
|
|
"""
|
||
|
|
|
||
|
|
redirect_connect_to_localhost = False;
|
||
|
|
|
||
|
|
def _start_read_write(self, sock):
|
||
|
|
sock.setblocking(0)
|
||
|
|
self.request.setblocking(0)
|
||
|
|
rlist = [self.request, sock]
|
||
|
|
while True:
|
||
|
|
ready_sockets, _unused, errors = select.select(rlist, [], [])
|
||
|
|
if errors:
|
||
|
|
self.send_response(500)
|
||
|
|
self.end_headers()
|
||
|
|
return
|
||
|
|
for s in ready_sockets:
|
||
|
|
received = s.recv(1024)
|
||
|
|
if len(received) == 0:
|
||
|
|
return
|
||
|
|
if s == self.request:
|
||
|
|
other = sock
|
||
|
|
else:
|
||
|
|
other = self.request
|
||
|
|
# This will lose data if the kernel write buffer fills up.
|
||
|
|
# TODO(ricea): Correctly use the return value to track how much was
|
||
|
|
# written and buffer the rest. Use select to determine when the socket
|
||
|
|
# becomes writable again.
|
||
|
|
other.send(received)
|
||
|
|
|
||
|
|
def _do_common_method(self):
|
||
|
|
url = urlparse.urlparse(self.path)
|
||
|
|
port = url.port
|
||
|
|
if not port:
|
||
|
|
if url.scheme == 'http':
|
||
|
|
port = 80
|
||
|
|
elif url.scheme == 'https':
|
||
|
|
port = 443
|
||
|
|
if not url.hostname or not port:
|
||
|
|
self.send_response(400)
|
||
|
|
self.end_headers()
|
||
|
|
return
|
||
|
|
|
||
|
|
if len(url.path) == 0:
|
||
|
|
path = '/'
|
||
|
|
else:
|
||
|
|
path = url.path
|
||
|
|
if len(url.query) > 0:
|
||
|
|
path = '%s?%s' % (url.path, url.query)
|
||
|
|
|
||
|
|
sock = None
|
||
|
|
try:
|
||
|
|
sock = socket.create_connection((url.hostname, port))
|
||
|
|
sock.send(('%s %s %s\r\n' %
|
||
|
|
(self.command, path, self.protocol_version)).encode('utf-8'))
|
||
|
|
for name, value in self.headers.items():
|
||
|
|
if (name.lower().startswith('connection')
|
||
|
|
or name.lower().startswith('proxy')):
|
||
|
|
continue
|
||
|
|
# HTTP headers are encoded in Latin-1.
|
||
|
|
sock.send(b'%s: %s\r\n' %
|
||
|
|
(name.encode('latin-1'), value.encode('latin-1')))
|
||
|
|
sock.send(b'\r\n')
|
||
|
|
# This is wrong: it will pass through connection-level headers and
|
||
|
|
# misbehave on connection reuse. The only reason it works at all is that
|
||
|
|
# our test servers have never supported connection reuse.
|
||
|
|
# TODO(ricea): Use a proper HTTP client library instead.
|
||
|
|
self._start_read_write(sock)
|
||
|
|
except Exception:
|
||
|
|
logging.exception('failure in common method: %s %s', self.command, path)
|
||
|
|
self.send_response(500)
|
||
|
|
self.end_headers()
|
||
|
|
finally:
|
||
|
|
if sock is not None:
|
||
|
|
sock.close()
|
||
|
|
|
||
|
|
def do_CONNECT(self):
|
||
|
|
try:
|
||
|
|
pos = self.path.rfind(':')
|
||
|
|
host = self.path[:pos]
|
||
|
|
port = int(self.path[pos+1:])
|
||
|
|
except Exception:
|
||
|
|
self.send_response(400)
|
||
|
|
self.end_headers()
|
||
|
|
|
||
|
|
if ProxyRequestHandler.redirect_connect_to_localhost:
|
||
|
|
host = "127.0.0.1"
|
||
|
|
|
||
|
|
sock = None
|
||
|
|
try:
|
||
|
|
sock = socket.create_connection((host, port))
|
||
|
|
self.send_response(200, 'Connection established')
|
||
|
|
self.end_headers()
|
||
|
|
self._start_read_write(sock)
|
||
|
|
except Exception:
|
||
|
|
logging.exception('failure in CONNECT: %s', path)
|
||
|
|
self.send_response(500)
|
||
|
|
self.end_headers()
|
||
|
|
finally:
|
||
|
|
if sock is not None:
|
||
|
|
sock.close()
|
||
|
|
|
||
|
|
def do_GET(self):
|
||
|
|
self._do_common_method()
|
||
|
|
|
||
|
|
def do_HEAD(self):
|
||
|
|
self._do_common_method()
|
||
|
|
|
||
|
|
class BasicAuthProxyRequestHandler(ProxyRequestHandler):
|
||
|
|
"""A request handler that behaves as a proxy server which requires
|
||
|
|
basic authentication.
|
||
|
|
"""
|
||
|
|
|
||
|
|
_AUTH_CREDENTIAL = 'Basic Zm9vOmJhcg==' # foo:bar
|
||
|
|
|
||
|
|
def parse_request(self):
|
||
|
|
"""Overrides parse_request to check credential."""
|
||
|
|
|
||
|
|
if not ProxyRequestHandler.parse_request(self):
|
||
|
|
return False
|
||
|
|
|
||
|
|
auth = self.headers.get('Proxy-Authorization', None)
|
||
|
|
if auth != self._AUTH_CREDENTIAL:
|
||
|
|
self.send_response(407)
|
||
|
|
self.send_header('Proxy-Authenticate', 'Basic realm="MyRealm1"')
|
||
|
|
self.end_headers()
|
||
|
|
return False
|
||
|
|
|
||
|
|
return True
|
||
|
|
|
||
|
|
|
||
|
|
class ServerRunner(testserver_base.TestServerRunner):
|
||
|
|
"""TestServerRunner for the net test servers."""
|
||
|
|
|
||
|
|
def __init__(self):
|
||
|
|
super(ServerRunner, self).__init__()
|
||
|
|
|
||
|
|
def __make_data_dir(self):
|
||
|
|
if self.options.data_dir:
|
||
|
|
if not os.path.isdir(self.options.data_dir):
|
||
|
|
raise testserver_base.OptionError('specified data dir not found: ' +
|
||
|
|
self.options.data_dir + ' exiting...')
|
||
|
|
my_data_dir = self.options.data_dir
|
||
|
|
else:
|
||
|
|
# Create the default path to our data dir, relative to the exe dir.
|
||
|
|
my_data_dir = os.path.join(BASE_DIR, "..", "..", "data")
|
||
|
|
|
||
|
|
return my_data_dir
|
||
|
|
|
||
|
|
def create_server(self, server_data):
|
||
|
|
port = self.options.port
|
||
|
|
host = self.options.host
|
||
|
|
|
||
|
|
logging.basicConfig()
|
||
|
|
|
||
|
|
# Work around a bug in Mac OS 10.6. Spawning a WebSockets server
|
||
|
|
# will result in a call to |getaddrinfo|, which fails with "nodename
|
||
|
|
# nor servname provided" for localhost:0 on 10.6.
|
||
|
|
# TODO(ricea): Remove this if no longer needed.
|
||
|
|
if self.options.server_type == SERVER_WEBSOCKET and \
|
||
|
|
host == "localhost" and \
|
||
|
|
port == 0:
|
||
|
|
host = "127.0.0.1"
|
||
|
|
|
||
|
|
# Construct the subjectAltNames for any ad-hoc generated certificates.
|
||
|
|
# As host can be either a DNS name or IP address, attempt to determine
|
||
|
|
# which it is, so it can be placed in the appropriate SAN.
|
||
|
|
dns_sans = None
|
||
|
|
ip_sans = None
|
||
|
|
ip = None
|
||
|
|
try:
|
||
|
|
ip = socket.inet_aton(host)
|
||
|
|
ip_sans = [ip]
|
||
|
|
except socket.error:
|
||
|
|
pass
|
||
|
|
if ip is None:
|
||
|
|
dns_sans = [host]
|
||
|
|
|
||
|
|
if self.options.server_type == SERVER_UNSET:
|
||
|
|
raise testserver_base.OptionError('no server type specified')
|
||
|
|
elif self.options.server_type == SERVER_WEBSOCKET:
|
||
|
|
# TODO(toyoshim): Remove following os.chdir. Currently this operation
|
||
|
|
# is required to work correctly. It should be fixed from pywebsocket side.
|
||
|
|
os.chdir(self.__make_data_dir())
|
||
|
|
websocket_options = WebSocketOptions(host, port, '.')
|
||
|
|
scheme = "ws"
|
||
|
|
if self.options.cert_and_key_file:
|
||
|
|
scheme = "wss"
|
||
|
|
websocket_options.use_tls = True
|
||
|
|
key_path = os.path.join(ROOT_DIR, self.options.cert_and_key_file)
|
||
|
|
if not os.path.isfile(key_path):
|
||
|
|
raise testserver_base.OptionError(
|
||
|
|
'specified server cert file not found: ' +
|
||
|
|
self.options.cert_and_key_file + ' exiting...')
|
||
|
|
websocket_options.private_key = key_path
|
||
|
|
websocket_options.certificate = key_path
|
||
|
|
|
||
|
|
if self.options.ssl_client_auth:
|
||
|
|
websocket_options.tls_client_cert_optional = False
|
||
|
|
websocket_options.tls_client_auth = True
|
||
|
|
if len(self.options.ssl_client_ca) != 1:
|
||
|
|
raise testserver_base.OptionError(
|
||
|
|
'one trusted client CA file should be specified')
|
||
|
|
if not os.path.isfile(self.options.ssl_client_ca[0]):
|
||
|
|
raise testserver_base.OptionError(
|
||
|
|
'specified trusted client CA file not found: ' +
|
||
|
|
self.options.ssl_client_ca[0] + ' exiting...')
|
||
|
|
websocket_options.tls_client_ca = self.options.ssl_client_ca[0]
|
||
|
|
print('Trying to start websocket server on %s://%s:%d...' %
|
||
|
|
(scheme, websocket_options.server_host, websocket_options.port))
|
||
|
|
server = WebSocketServer(websocket_options)
|
||
|
|
print('WebSocket server started on %s://%s:%d...' %
|
||
|
|
(scheme, host, server.server_port))
|
||
|
|
server_data['port'] = server.server_port
|
||
|
|
websocket_options.use_basic_auth = self.options.ws_basic_auth
|
||
|
|
elif self.options.server_type == SERVER_PROXY:
|
||
|
|
ProxyRequestHandler.redirect_connect_to_localhost = \
|
||
|
|
self.options.redirect_connect_to_localhost
|
||
|
|
server = ThreadingHTTPServer((host, port), ProxyRequestHandler)
|
||
|
|
print('Proxy server started on port %d...' % server.server_port)
|
||
|
|
server_data['port'] = server.server_port
|
||
|
|
elif self.options.server_type == SERVER_BASIC_AUTH_PROXY:
|
||
|
|
ProxyRequestHandler.redirect_connect_to_localhost = \
|
||
|
|
self.options.redirect_connect_to_localhost
|
||
|
|
server = ThreadingHTTPServer((host, port), BasicAuthProxyRequestHandler)
|
||
|
|
print('BasicAuthProxy server started on port %d...' % server.server_port)
|
||
|
|
server_data['port'] = server.server_port
|
||
|
|
else:
|
||
|
|
raise testserver_base.OptionError('unknown server type' +
|
||
|
|
self.options.server_type)
|
||
|
|
|
||
|
|
return server
|
||
|
|
|
||
|
|
def add_options(self):
|
||
|
|
testserver_base.TestServerRunner.add_options(self)
|
||
|
|
self.option_parser.add_option('--proxy',
|
||
|
|
action='store_const',
|
||
|
|
const=SERVER_PROXY,
|
||
|
|
default=SERVER_UNSET,
|
||
|
|
dest='server_type',
|
||
|
|
help='start up a proxy server.')
|
||
|
|
self.option_parser.add_option('--basic-auth-proxy',
|
||
|
|
action='store_const',
|
||
|
|
const=SERVER_BASIC_AUTH_PROXY,
|
||
|
|
default=SERVER_UNSET,
|
||
|
|
dest='server_type',
|
||
|
|
help='start up a proxy server which requires '
|
||
|
|
'basic authentication.')
|
||
|
|
self.option_parser.add_option('--websocket',
|
||
|
|
action='store_const',
|
||
|
|
const=SERVER_WEBSOCKET,
|
||
|
|
default=SERVER_UNSET,
|
||
|
|
dest='server_type',
|
||
|
|
help='start up a WebSocket server.')
|
||
|
|
self.option_parser.add_option('--cert-and-key-file',
|
||
|
|
dest='cert_and_key_file', help='specify the '
|
||
|
|
'path to the file containing the certificate '
|
||
|
|
'and private key for the server in PEM '
|
||
|
|
'format')
|
||
|
|
self.option_parser.add_option('--ssl-client-auth', action='store_true',
|
||
|
|
help='Require SSL client auth on every '
|
||
|
|
'connection.')
|
||
|
|
self.option_parser.add_option('--ssl-client-ca', action='append',
|
||
|
|
default=[], help='Specify that the client '
|
||
|
|
'certificate request should include the CA '
|
||
|
|
'named in the subject of the DER-encoded '
|
||
|
|
'certificate contained in the specified '
|
||
|
|
'file. This option may appear multiple '
|
||
|
|
'times, indicating multiple CA names should '
|
||
|
|
'be sent in the request.')
|
||
|
|
self.option_parser.add_option('--file-root-url', default='/files/',
|
||
|
|
help='Specify a root URL for files served.')
|
||
|
|
# TODO(ricea): Generalize this to support basic auth for HTTP too.
|
||
|
|
self.option_parser.add_option('--ws-basic-auth', action='store_true',
|
||
|
|
dest='ws_basic_auth',
|
||
|
|
help='Enable basic-auth for WebSocket')
|
||
|
|
self.option_parser.add_option('--redirect-connect-to-localhost',
|
||
|
|
dest='redirect_connect_to_localhost',
|
||
|
|
default=False, action='store_true',
|
||
|
|
help='If set, the Proxy server will connect '
|
||
|
|
'to localhost instead of the requested URL '
|
||
|
|
'on CONNECT requests')
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == '__main__':
|
||
|
|
sys.exit(ServerRunner().main())
|