Merge lp:~chipaca/ubuntu-push/check-certificate into lp:ubuntu-push/automatic

[John Lenton]

Add the ServerName to tls config from gethosts domain; client checks the server certificate.

Add the ServerName to tls config from gethosts domain; client checks the server certificate.

[lp:~chipaca/ubuntu-push/check-certificate]

128. By John Lenton on 2014-04-16

made the tests a bit better

[Samuele Pedroni (pedronis)]

review: Approve

=== modified file 'client/session/session.go'
--- client/session/session.go	2014-04-16 10:44:20 +0000
+++ client/session/session.go	2014-04-16 13:28:44 +0000
@@ -142,7 +142,7 @@
 		Log:                 log,
 		Protocolator:        protocol.NewProtocol0,
 		Levels:              levels,
-		TLS:                 &tls.Config{InsecureSkipVerify: true}, // XXX
+		TLS:                 &tls.Config{},
 		stateP:              &state,
 		timeSince:           time.Since,
 		auth:                conf.Authorization,
@@ -192,6 +192,9 @@
 		}
 		sess.deliveryHostsTimestamp = time.Now()
 		sess.deliveryHosts = host.Hosts
+		if sess.TLS != nil {
+			sess.TLS.ServerName = host.Domain
+		}
 	} else {
 		sess.deliveryHosts = sess.fallbackHosts
 	}

=== modified file 'client/session/session_test.go'
--- client/session/session_test.go	2014-04-16 10:44:20 +0000
+++ client/session/session_test.go	2014-04-16 13:28:44 +0000
@@ -1091,9 +1091,64 @@
 
 var (
 	dialTestTimeout = 100 * time.Millisecond
-	dialTestConf    = ClientSessionConfig{ExchangeTimeout: dialTestTimeout}
+	dialTestConf    = ClientSessionConfig{
+		ExchangeTimeout: dialTestTimeout,
+		PEM:             helpers.TestCertPEMBlock,
+	}
 )
 
+func (cs *clientSessionSuite) TestDialBadServerName(c *C) {
+	// a borked server name
+	cert, err := tls.X509KeyPair(helpers.TestCertPEMBlock, helpers.TestKeyPEMBlock)
+	c.Assert(err, IsNil)
+	tlsCfg := &tls.Config{
+		Certificates:           []tls.Certificate{cert},
+		SessionTicketsDisabled: true,
+	}
+
+	lst, err := tls.Listen("tcp", "localhost:0", tlsCfg)
+	c.Assert(err, IsNil)
+	// advertise
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		b, err := json.Marshal(map[string]interface{}{
+			"domain": "xyzzy", // <-- *** THIS *** is the bit that'll break it
+			"hosts":  []string{"nowhere", lst.Addr().String()},
+		})
+		if err != nil {
+			panic(err)
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.Write(b)
+	}))
+	defer ts.Close()
+
+	sess, err := NewSession(ts.URL, dialTestConf, "wah", cs.lvls, cs.log)
+	c.Assert(err, IsNil)
+	tconn := &testConn{}
+	sess.Connection = tconn
+
+	upCh := make(chan interface{}, 5)
+	downCh := make(chan interface{}, 5)
+	errCh := make(chan error, 1)
+	proto := &testProtocol{up: upCh, down: downCh}
+	sess.Protocolator = func(net.Conn) protocol.Protocol { return proto }
+
+	go func() {
+		errCh <- sess.Dial()
+	}()
+
+	srv, err := lst.Accept()
+	c.Assert(err, IsNil)
+
+	// connect done
+
+	_, err = protocol.ReadWireFormatVersion(srv, dialTestTimeout)
+	c.Check(err, NotNil)
+
+	c.Check(<-errCh, NotNil)
+	c.Check(sess.State(), Equals, Error)
+}
+
 func (cs *clientSessionSuite) TestDialWorks(c *C) {
 	// happy path thoughts
 	cert, err := tls.X509KeyPair(helpers.TestCertPEMBlock, helpers.TestKeyPEMBlock)