ooni / probe-cli / 6255251967

72%

push

github

refactor: adapt to netem pinning certificates to hosts (#1287)

As explained in https://github.com/ooni/netem/pull/40, netem used to
generate on the fly certificates for any host.

I then discovered that this behavior is not desirable because the
internet doesn't work like that. Specifically, TLS dialing to, say,
www.example.com with www.google.com as the SNI must return a TLS error
(`ssl_invalid_hostname` in OONI).

This wrong behavior of netem has become a bottleneck for writing new
tests for the beacons functionality, so it must change.

I have already changed netem and this diff updates the probe-cli tree to
use a netem version that behaves more correctly.

While there, I noticed that sniblocking tests were wrong because of the
previous netem behavior and asserted that the control should return a
nil failure, while it should have been `ssl_invalid_hostname`.

Part of https://github.com/ooni/probe/issues/2531

123 of 131 new or added lines in 12 files covered. (93.89%)

23459 of 28786 relevant lines covered (81.49%)

34.06 hits per line