quic-transport: serverCertificateHashes browser test

Author: yoursunny

integ/browser-tests/README.md

@@ -23,7 +23,7 @@ docker run -it --rm \
   --cap-add SYS_ADMIN \
   --user $(id -u):$(id -g) \
   --workdir $(pwd)/integ/browser-tests \
-  satantime/puppeteer-node:24-slim bash
+  satantime/puppeteer-node:24-trixie-slim bash
 ```
 
 Type `corepack pnpm test` to run the tests.

integ/browser-tests/tests/transport/api.ts

@@ -3,4 +3,6 @@ import type { TestRecord } from "@ndn/l3face/test-fixture/transport";
 declare global {
   function connectWsTransportPair(uri: string): Promise<void>;
   function testWsTransportPair(): Promise<TestRecord>;
+  function connectH3TransportPair(uri: string, certHash: string): Promise<void>;
+  function testH3TransportPair(): Promise<TestRecord>;
 }

integ/browser-tests/tests/transport/browser.ts

@@ -21,6 +21,18 @@ globalThis.connectWsTransportPair = async (uri) => {
 
 globalThis.testWsTransportPair = async () => testTransport(...wsPair);
 
+let h3Pair: [H3Transport, H3Transport];
+
+globalThis.connectH3TransportPair = async (uri, certHash) => {
+  const serverCertificateHashes = [{ algorithm: "sha-256", value: fromHex(certHash) }];
+  h3Pair = await Promise.all([
+    H3Transport.connect(uri, { serverCertificateHashes }),
+    H3Transport.connect(uri, { serverCertificateHashes }),
+  ]);
+};
+
+globalThis.testH3TransportPair = async () => testTransport(...h3Pair);
+
 async function facePing(pingPrefix: string) {
   const names: string[] = [];
   const rtts: number[] = [];

integ/browser-tests/tests/transport/test.t.ts

@@ -1,26 +1,39 @@
 import "./api";
 
 import * as TestTransport from "@ndn/l3face/test-fixture/transport";
-import { Closers } from "@ndn/util";
+import { bridgeSessions, WtServer } from "@ndn/quic-transport/test-fixture/wt-server";
+import { Closers, toHex } from "@ndn/util";
 import { bridgeWebSockets, WsServer } from "@ndn/ws-transport/test-fixture/ws-server";
 import { beforeEach, test } from "vitest";
 
 import { navigateToPage, pageInvoke } from "../../test-fixture/pptr";
 
 const closers = new Closers();
-let server: WsServer;
 beforeEach(async () => {
-  server = await WsServer.create();
-  closers.push(server);
   await navigateToPage(import.meta);
   return closers.close;
 });
 
-test("pair", async () => {
+test("WebSocket pair", async () => {
+  const server = await WsServer.create();
+  closers.push(server);
+
   await pageInvoke<typeof globalThis.connectWsTransportPair>("connectWsTransportPair", server.uri);
   const sockets = await server.waitNClients(2);
   bridgeWebSockets(sockets);
 
   const result = await pageInvoke<typeof globalThis.testWsTransportPair>("testWsTransportPair");
   TestTransport.check(result);
 });
+
+test("HTTP/3 pair", async () => {
+  const server = await WtServer.create();
+  closers.push(server);
+
+  await pageInvoke<typeof globalThis.connectH3TransportPair>("connectH3TransportPair", server.uri, toHex(server.certHash));
+  const sessions = await server.waitNClients(2);
+  bridgeSessions(sessions);
+
+  const result = await pageInvoke<typeof globalThis.testH3TransportPair>("testH3TransportPair");
+  TestTransport.check(result);
+});

package.json

@@ -13,7 +13,7 @@
     "test": "vitest",
     "typedoc": "bash mk/typedoc.sh"
   },
-  "packageManager": "pnpm@11.19.0+sha512.7881f3ed590d472c4a955e2b88b2121791116066dcc88cbca3849ec9b60f1bbaa6d2ccb221fa91da4e1c65bef2bcbe379365aea7ac539c7bf86dedc3a1b22dce",
+  "packageManager": "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee",
   "devDependencies": {
     "@types/node": "26.1.2",
     "@typescript/native": "npm:typescript@^7.0.2",

pkg/quic-transport/package.json

@@ -32,6 +32,7 @@
     "tslib": "^2.8.1"
   },
   "devDependencies": {
-    "@ndn/node-transport": "workspace:*"
+    "@ndn/node-transport": "workspace:*",
+    "selfsigned": "^5.5.0"
   }
 }

pkg/quic-transport/src/wt_node.ts

@@ -1,14 +1,14 @@
-import { WebTransport as bunWebTransport } from "@webtransport-bun/webtransport";
+import { WebTransport as bunWebTransport, type WebTransportClientOptions } from "@webtransport-bun/webtransport";
 
 import type { H3Transport } from "./h3-transport";
 
 export const supported = true;
 
 export function makeWebTransport(uri: string, opts: WebTransportOptions): WebTransport {
-  const { insecureSkipVerify = false } = opts as H3Transport.Options;
-  void opts;
+  const { insecureSkipVerify = false, serverCertificateHashes } = opts as H3Transport.Options;
   return new bunWebTransport(uri, {
     strictW3CErrors: true,
+    serverCertificateHashes: serverCertificateHashes as WebTransportClientOptions["serverCertificateHashes"],
     tls: { insecureSkipVerify },
   }) as unknown as WebTransport;
 }

pkg/quic-transport/test-fixture/wt-server.ts

@@ -1,29 +1,61 @@
 import { TestServer } from "@ndn/node-transport/test-fixture/net-server";
-import { assert } from "@ndn/util";
-import { type ClientSession, createServer, type ServerSession, type WebTransportServer } from "@webtransport-bun/webtransport";
+import { assert, sha256 } from "@ndn/util";
+import { type ClientSession, createServer, type ServerSession, type ServerTlsSniEntry, type WebTransportServer } from "@webtransport-bun/webtransport";
+import selfsigned from "selfsigned";
+
+export async function makeSelfSigned(): Promise<ServerTlsSniEntry & { certHash: Uint8Array<ArrayBuffer> }> {
+  const serverName = "127.0.0.1";
+  const notBeforeDate = new Date();
+  const notAfterDate = new Date(notBeforeDate.getTime() + 86400_000);
+  const generated = await selfsigned.generate([
+    { name: "commonName", value: serverName },
+  ], {
+    notBeforeDate,
+    notAfterDate,
+    keyType: "ec",
+    curve: "P-256",
+    algorithm: "sha256",
+    extensions: [
+      { name: "subjectAltName", altNames: [{ type: 7, ip: serverName }] },
+    ],
+  });
+
+  const certDer = Buffer.from(generated.cert.replaceAll(/(-----(BEGIN|END) CERTIFICATE-----)|\s/g, ""), "base64");
+  return {
+    serverName,
+    certPem: generated.cert,
+    keyPem: generated.private,
+    certHash: await sha256(certDer),
+  };
+}
 
 /** WebTransport test server. */
 export class WtServer extends TestServer<WebTransportServer, ServerSession> {
   public static async create(): Promise<WtServer> {
     let self!: WtServer; // eslint-disable-line prefer-const
 
+    const { certHash, ...tls } = await makeSelfSigned();
     const port = 16384 + Math.trunc(Math.random() * 16384);
     const server = createServer({
       port,
-      tls: { certPem: "", keyPem: "", allowSelfSigned: true },
+      tls,
       onSession: (sess) => self.onSession(sess),
     });
 
-    self = new WtServer(server, port);
+    self = new WtServer(server, `https://127.0.0.1:${port}`, certHash);
     return self;
   }
 
-  /** WebTransport server URI. */
-  public readonly uri: string;
-
-  constructor(server: WebTransportServer, port: number) {
+  /**
+   * @param port - WebTransport server URI.
+   * @param certHash - WebTransport server certificate hash.
+   */
+  constructor(server: WebTransportServer, public readonly uri: string, public readonly certHash: Uint8Array<ArrayBuffer>) {
     super(server);
-    this.uri = `https://127.0.0.1:${port}`;
+  }
+
+  public get serverCertificateHashes(): WebTransportHash[] {
+    return [{ algorithm: "sha-256", value: this.certHash }];
   }
 
   private waitNewSession?: () => void;

pkg/quic-transport/tests/h3-transport.t.ts

@@ -15,13 +15,14 @@ beforeEach(async () => {
 });
 
 test("pair", async () => {
+  const { uri } = server;
   const [tA, tB, sockets] = await Promise.all([
-    H3Transport.connect(server.uri, { insecureSkipVerify: true }),
-    H3Transport.connect(server.uri, { insecureSkipVerify: true }),
+    H3Transport.connect(uri, { insecureSkipVerify: true }),
+    H3Transport.connect(uri, { insecureSkipVerify: true }),
     server.waitNClients(2),
   ]);
 
-  expect(tA.toString()).toBe(`H3(${server.uri})`);
+  expect(tA.toString()).toBe(`H3(${uri})`);
 
   bridgeSessions(sockets);
   TestTransport.check(await TestTransport.execute(tA, tB));
@@ -34,7 +35,8 @@ test("connect error", async () => {
 });
 
 test("reopen", async () => {
-  const transport = await H3Transport.connect(server.uri, { insecureSkipVerify: true });
+  const { uri } = server;
+  const transport = await H3Transport.connect(uri, { insecureSkipVerify: true });
   await TestReopen.run(
     transport,
     server.waitNClients,

pkg/util/src/crypto.ts

@@ -7,7 +7,7 @@ export function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {
 }
 
 /** Compute SHA256 digest. */
-export async function sha256(input: Uint8Array): Promise<Uint8Array> {
+export async function sha256(input: Uint8Array): Promise<Uint8Array<ArrayBuffer>> {
   const digest = await crypto.subtle.digest("SHA-256", asBufferSource(input));
   return new Uint8Array(digest);
 }