enbility / ship-go / 35367173385

93%

Build Type

push

github

Committed by web-flow

Commit Message

fix(hub): abort TLS handshake on spoofed server certificate (TC_SHIP_SEC_001/002) (#119)

Fixes #117 

Runs the existing `validateRemoteCertificate` from a
`VerifyPeerCertificate` hook on the client
TLS config, so a spoofed server certificate is rejected while the TLS
handshake is still
  running instead of after the WebSocket upgrade.

- `createWebSocketDialer` installs the hook; `expectedSKI` is threaded
through
    `establishWebSocketConnection` from `connectFoundService`
- a rejected certificate no longer triggers the path-less retry dial
(one `bad_certificate`
    alert instead of two)
  - no new validation logic and no `api/` changes

Tests: new `hub/hub_connections_sec_test.go` covers both TestSpec
variants (SEC_001: own SKI
corrupted; SEC_002: a trusted `SKI_T1` forged onto a new key pair)
end-to-end against a TLS
server with a spoofed certificate, asserting the peer never sees an HTTP
request, plus a table
test on the hook and a server-role subtest in
`TestVerifyPeerCertificate`.

  Verified the end-to-end test fails without the fix.

  `Test_ConnectFoundService_CertificateSkiValidationError` asserted on
`"certificate validation failed"`, a message from the post-upgrade path
the certificate no
longer reaches; the assertion now checks the earlier rejection instead.

Coverage Stats

40 of 40 new or added lines in 1 file covered. (100.0%)

12 existing lines in 3 files now uncovered.

6134 of 6599 relevant lines covered (92.95%)

11589.88 hits per line