test: command pipe permissions, error-body sanitisation, TLS minimum

Self-contained cram tests (POSIX sh, no bash helper) for the security
hardening:
- security.t: the command pipe is created 0o600 (F8); a handler error returns
  a generic body, never the OCaml exception (F4).
- security-tls.t: an HTTPS listener accepts TLS 1.2 and refuses TLS 1.1 (F5).

Author: balat

test/security-tls.t/dune

@@ -0,0 +1,3 @@
+(executable
+ (name test)
+ (libraries ocsigenserver))

test/security-tls.t/dune-project

@@ -0,0 +1 @@
+(lang dune 3.18)

test/security-tls.t/run.t

@@ -0,0 +1,23 @@
+F5: the HTTPS server must require TLS 1.2 at minimum (TLS 1.0/1.1 deprecated).
+Self-contained POSIX sh.
+
+  $ mkdir -p log data
+  $ openssl req -x509 -newkey rsa:2048 -nodes -keyout privkey.pem \
+  >   -out cert.pem -days 2 -subj /CN=localhost >/dev/null 2>&1
+  $ dune build ./test.exe 2>&1
+  $ dune exec -- ./test.exe >server.log 2>&1 &
+  $ trap 'echo shutdown > local.cmd 2>/dev/null; wait' EXIT
+  $ i=0; while [ ! -e local.cmd ]; do
+  >   i=$((i+1)); [ $i -gt 200 ] && break; sleep 0.05; done
+  $ i=0; while ! curl -sk --tls-max 1.2 https://127.0.0.1:8453/ >/dev/null 2>&1; do
+  >   i=$((i+1)); [ $i -gt 200 ] && break; sleep 0.05; done
+
+A TLS 1.2 client succeeds:
+
+  $ curl -sk --tlsv1.2 --tls-max 1.2 -o /dev/null -w '%{http_code}\n' https://127.0.0.1:8453/
+  200
+
+A TLS 1.1 client is refused (curl returns a non-zero exit code):
+
+  $ curl -sk --tls-max 1.1 https://127.0.0.1:8453/ >/dev/null 2>&1 && echo accepted || echo rejected
+  rejected

test/security-tls.t/test.ml

@@ -0,0 +1,25 @@
+(* F5: the HTTPS server must require TLS 1.2 at minimum. This starts an HTTPS
+   listener with a self-signed certificate (generated by the cram test). The
+   handler is irrelevant: the test only checks the TLS handshake. *)
+
+let respond _vh _config_info _path _request_state =
+  Lwt.return
+    (Ocsigen.Extensions.Ext_found
+       (fun () ->
+         Lwt.return
+           (Ocsigen.Response.make
+              (Cohttp.Response.make ~status:`OK ()))))
+
+let () =
+  Ocsigen.Server.start ~ports:[]
+    ~ssl_ports:[ (`All, 8453) ]
+    ~ssl_info:
+      (Some
+         { Ocsigen.Config.ssl_certificate = Some "cert.pem"
+         ; ssl_privatekey = Some "privkey.pem"
+         ; ssl_ciphers = None
+         ; ssl_dhfile = None
+         ; ssl_curve = None })
+    ~logdir:"log" ~datadir:"data" ~uploaddir:None ~usedefaulthostname:true
+    ~command_pipe:"local.cmd" ~default_charset:(Some "utf-8")
+    [ Ocsigen.Server.host [ respond ] ]

test/security.t/dune

@@ -0,0 +1,3 @@
+(executable
+ (name test)
+ (libraries ocsigenserver))

test/security.t/dune-project

@@ -0,0 +1 @@
+(lang dune 3.18)

test/security.t/run.t

@@ -0,0 +1,26 @@
+Security hardening checks: command pipe permissions (F8) and error-body
+sanitisation (F4). Self-contained (POSIX sh, no bash helper) so it runs
+regardless of the cram shell.
+
+  $ mkdir -p log data
+  $ dune build ./test.exe 2>&1
+  $ dune exec -- ./test.exe >server.log 2>&1 &
+  $ trap 'echo shutdown > local.cmd 2>/dev/null; wait' EXIT
+  $ i=0; while [ ! -e local.sock ] || [ ! -e local.cmd ]; do
+  >   i=$((i+1)); [ $i -gt 200 ] && break; sleep 0.05; done
+
+F8: the command pipe is created with mode 0o600, so that only the server's own
+user can send it control commands.
+
+  $ stat -c '%a' local.cmd
+  600
+
+F4: a handler error returns the generic HTTP status reason phrase, never the
+OCaml exception (the word "secret" from the exception must not appear).
+
+  $ curl --unix-socket local.sock -s -o /dev/null -w '%{http_code}\n' http://x/anything
+  500
+  $ curl --unix-socket local.sock -s http://x/anything
+  Error: Internal Server Error
+  $ curl --unix-socket local.sock -s http://x/anything | grep -c secret || true
+  0

test/security.t/test.ml

@@ -0,0 +1,17 @@
+(* End-to-end checks for the security hardening:
+   - F4: a handler error must not leak the OCaml exception in the response
+     body; the client gets the generic HTTP status reason phrase.
+   - F8: the command pipe must be created with mode 0o600.
+
+   The [boom] instruction intercepts every request and fails with an
+   exception carrying a "secret" message that must never reach the client. *)
+
+let boom _vh _config_info _path _request_state =
+  Lwt.fail (Failure "secret internal detail that must not leak to the client")
+
+let () =
+  Ocsigen.Server.start
+    ~ports:[ (`Unix "./local.sock", 0) ]
+    ~logdir:"log" ~datadir:"data" ~uploaddir:None ~usedefaulthostname:true
+    ~command_pipe:"local.cmd" ~default_charset:(Some "utf-8")
+    [ Ocsigen.Server.host [ boom ] ]