This commit adds a new `connect-tests/tests/ech.rs` module that performs
a DNS over HTTPS lookup for HTTPS type records, finding `EchConfig`s and
testing we can deserialize the raw form into the Rustls representation
without error.
Presently it tests against:
* `crypto.cloudflare.com`
* `defo.ie`
* `tls-ech.dev`
Since these are network based tests they need to live in `connect-tests`
to avoid flakyness during normal CI runs.
In previous WIP branches this was done as part of an overall end-to-end
example of using ECH, but we can test this in isolation ahead of having
full ECH support.
In an effort to reduce our feature list, this commit replaces the
`dangerous_configuration` feature flag with separate `danger` modules.
Cargo features are additive, which means transitive dependencies could
enable them for you without explicit opt-in. Using obviously named
modules will maintain the property that it's easy to grep for imports,
but avoids feature flag bloat and the additive downsides.
After discussion we've chosen to not include the webpki verifier and
helper functions as part of the dangerous API surface. Functionality for
setting a custom verifier, or implementing one to make assertions about
verification status, remain marked as dangerous via their module name.
The `badssl.rs` and `topsites.rs` unit tests reach out to remote servers
and so can be sources of flakes, slow down local testing, and may not
operate correctly in the presence of HTTP(S) proxies.
This commit pulls those tests out of the `examples` crate and into
a `connect-tests` crate that *isn't* part of our default workspace. This
means running `cargo test --all-targets` and similar won't run these
tests. Instead they must be explicitly run from within the
`connect-tests` directory, or by specifying the crate's `Cargo.toml` as
a `--manifest-path`.
To ensure we don't have bitrot/formatting errors we continue to lint
the connectivity examples during our regular CI, but don't actually run
the tests. Instead a separate cron-based workflow runs the tests once
a week. Hopefully this will be a good balance between maintaining the
coverage and not slowing down local tests, bumping into user HTTP(S)
proxies, or hitting flakes.
Daniel McCarney
Dirkjan Ochtman
Joseph Birr-Pixton