Mercurial > hg > nginx-tests

annotate ssl_reject_handshake.t @ 1943:1786f49cca17

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: fixed spurious http_resolver_ipv4.t failures. Previously, to get resolved addresses, the test relied on cached random rotation in resolver, such that a chosen address is eventually changed, which may not happen after several client requests. For this reason, the test is rewritten to get all addresses by switching to the next upstream.
author Sergey Kandaurov <pluknet@nginx.com>
date Mon, 22 Jan 2024 14:11:12 +0400
parents c04134b0290b
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1601
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1 #!/usr/bin/perl
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
3 # (C) Sergey Kandaurov
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
4 # (C) Nginx, Inc.
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
5
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
6 # Tests for http ssl module, ssl_reject_handshake.
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 ###############################################################################
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
9
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
10 use warnings;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
11 use strict;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
12
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
13 use Test::More;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
14
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
15 BEGIN { use FindBin; chdir($FindBin::Bin); }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
16
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
17 use lib 'lib';
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
18 use Test::Nginx;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
19
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
20 ###############################################################################
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
21
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
22 select STDERR; $| = 1;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
23 select STDOUT; $| = 1;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
24
1858
cdcd75657e52 Tests: added has_feature() tests for IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1850
diff changeset
25 my $t = Test::Nginx->new()->has(qw/http http_ssl sni socket_ssl/)
1904
c04134b0290b Tests: removed deprecated "ssl" directive tests.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1866
diff changeset
26 ->has_daemon('openssl')->plan(7);
1601
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
27
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
28 $t->write_file_expand('nginx.conf', <<'EOF');
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
29
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
30 %%TEST_GLOBALS%%
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
31
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
32 daemon off;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
33
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
34 events {
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
35 }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
36
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
37 http {
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
38 %%TEST_GLOBALS_HTTP%%
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
39
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
40 add_header X-Name $ssl_server_name;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
41
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
42 server {
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
43 listen 127.0.0.1:8080 ssl;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
44 server_name localhost;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
45
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
46 ssl_reject_handshake on;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
47 }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
48
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
49 server {
1850
2a7fc70900a5 Tests: improved "ssl" directive test in ssl_reject_handshake.t.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1693
diff changeset
50 listen 127.0.0.1:8080;
1601
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
51 server_name virtual;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
52
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
53 ssl_certificate localhost.crt;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
54 ssl_certificate_key localhost.key;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
55 }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
56
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
57 server {
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
58 listen 127.0.0.1:8082 ssl;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
59 server_name localhost;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
60
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
61 ssl_certificate localhost.crt;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
62 ssl_certificate_key localhost.key;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
63 }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
64
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
65 server {
1850
2a7fc70900a5 Tests: improved "ssl" directive test in ssl_reject_handshake.t.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1693
diff changeset
66 listen 127.0.0.1:8082;
1601
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
67 server_name virtual1;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
68 }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
69
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
70 server {
1850
2a7fc70900a5 Tests: improved "ssl" directive test in ssl_reject_handshake.t.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1693
diff changeset
71 listen 127.0.0.1:8082;
1601
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
72 server_name virtual2;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
73
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
74 ssl_reject_handshake on;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
75 }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
76 }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
77
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
78 EOF
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
79
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
80 $t->write_file('openssl.conf', <<EOF);
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
81 [ req ]
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
82 default_bits = 2048
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
83 encrypt_key = no
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
84 distinguished_name = req_distinguished_name
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
85 [ req_distinguished_name ]
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
86 EOF
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
87
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
88 my $d = $t->testdir();
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
89
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
90 foreach my $name ('localhost') {
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
91 system('openssl req -x509 -new '
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
92 . "-config $d/openssl.conf -subj /CN=$name/ "
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
93 . "-out $d/$name.crt -keyout $d/$name.key "
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
94 . ">>$d/openssl.out 2>&1") == 0
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
95 or die "Can't create certificate for $name: $!\n";
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
96 }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
97
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
98 $t->write_file('index.html', '');
1904
c04134b0290b Tests: removed deprecated "ssl" directive tests.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1866
diff changeset
99 $t->run();
1601
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
100
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
101 ###############################################################################
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
102
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
103 # default virtual server rejected
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
104
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
105 like(get('default', 8080), qr/unrecognized name/, 'default rejected');
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
106 like(get(undef, 8080), qr/unrecognized name/, 'absent sni rejected');
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
107 like(get('virtual', 8080), qr/virtual/, 'virtual accepted');
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
108
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
109 # non-default server "virtual2" rejected
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
110
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
111 like(get('default', 8082), qr/default/, 'default accepted');
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
112 like(get(undef, 8082), qr/200 OK(?!.*X-Name)/is, 'absent sni accepted');
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
113 like(get('virtual1', 8082), qr/virtual1/, 'virtual 1 accepted');
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
114 like(get('virtual2', 8082), qr/unrecognized name/, 'virtual 2 rejected');
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
115
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
116 ###############################################################################
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
117
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
118 sub get {
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
119 my ($host, $port) = @_;
1866
a797d7428fa5 Tests: simplified http SSL tests with IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1858
diff changeset
120 my $r = http(
a797d7428fa5 Tests: simplified http SSL tests with IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1858
diff changeset
121 "GET / HTTP/1.0\nHost: " . ($host || 'localhost') . "\n\n",
a797d7428fa5 Tests: simplified http SSL tests with IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1858
diff changeset
122 PeerAddr => '127.0.0.1:' . port($port),
a797d7428fa5 Tests: simplified http SSL tests with IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1858
diff changeset
123 SSL => 1,
a797d7428fa5 Tests: simplified http SSL tests with IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1858
diff changeset
124 SSL_hostname => $host
a797d7428fa5 Tests: simplified http SSL tests with IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1858
diff changeset
125 )
a797d7428fa5 Tests: simplified http SSL tests with IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1858
diff changeset
126 or return "$@";
1601
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
127 return $r;
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
128 }
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
129
376cbc2c2b20 Tests: ssl_reject_handshake tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
130 ###############################################################################