annotate h2_proxy_ssl.t @ 1571:1b4ceab9cb1c

Tests: fixed ssl_certificate.t with LibreSSL client. Net::SSLeay::connect() that manages TLS handshake could return unexpected error when receiving server alert, as seen in server certificate tests if it could not been selected. Typically, it returns the expected error -1, but with certain libssl implementations it can be 0, as explained below. The error is propagated from libssl's SSL_connect(), which is usually -1. In modern OpenSSL versions, it is the default error code used in the state machine returned when something went wrong with parsing TLS message header. In versions up to OpenSSL 1.0.2, with SSLv23_method() used by default, -1 is the only error code in the ssl_connect() method implementation which is used as well if receiving alert while parsing ServerHello. BoringSSL also seems to return -1. But it is not so with LibreSSL that returns zero. Previously, tests failed with client built with LibreSSL with SSLv3 removed. Here, the error is propagated directly from ssl_read_bytes() method, which is always implemented as ssl3_read_bytes() in all TLS methods. It could be also seen with OpenSSL up to 1.0.2 with non-default methods explicitly set.
author Sergey Kandaurov <pluknet@nginx.com>
date Fri, 29 May 2020 23:10:20 +0300
parents dbce8fb5f5f8
children 236d038dc04a
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
886
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1 #!/usr/bin/perl
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
3 # (C) Sergey Kandaurov
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
4 # (C) Nginx, Inc.
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
5
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
6 # Tests for HTTP/2 protocol with proxy to ssl backend.
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 ###############################################################################
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
9
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
10 use warnings;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
11 use strict;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
12
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
13 use Test::More;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
14
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
15 BEGIN { use FindBin; chdir($FindBin::Bin); }
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
16
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
17 use lib 'lib';
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
18 use Test::Nginx;
948
4dc302d8e04f Tests: changed HTTP2 package to act as a class.
Sergey Kandaurov <pluknet@nginx.com>
parents: 889
diff changeset
19 use Test::Nginx::HTTP2;
886
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
20
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
21 ###############################################################################
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
22
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
23 select STDERR; $| = 1;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
24 select STDOUT; $| = 1;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
25
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
26 my $t = Test::Nginx->new()->has(qw/http http_ssl http_v2 proxy/)
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
27 ->has_daemon('openssl')->plan(1);
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
28
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
29 $t->write_file_expand('nginx.conf', <<'EOF');
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
30
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
31 %%TEST_GLOBALS%%
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
32
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
33 daemon off;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
34
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
35 events {
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
36 }
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
37
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
38 http {
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
39 %%TEST_GLOBALS_HTTP%%
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
40
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
41 server {
974
882267679006 Tests: simplified parallel modifications in tests.
Andrey Zelenkov <zelenkov@nginx.com>
parents: 952
diff changeset
42 listen 127.0.0.1:8080 http2;
882267679006 Tests: simplified parallel modifications in tests.
Andrey Zelenkov <zelenkov@nginx.com>
parents: 952
diff changeset
43 listen 127.0.0.1:8081 ssl;
886
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
44 server_name localhost;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
45
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
46 ssl_certificate_key localhost.key;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
47 ssl_certificate localhost.crt;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
48
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
49 location / { }
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
50 location /proxy_ssl/ {
974
882267679006 Tests: simplified parallel modifications in tests.
Andrey Zelenkov <zelenkov@nginx.com>
parents: 952
diff changeset
51 proxy_pass https://127.0.0.1:8081/;
886
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
52 }
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
53 }
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
54 }
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
55
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
56 EOF
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
57
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
58 $t->write_file('openssl.conf', <<EOF);
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
59 [ req ]
1488
dbce8fb5f5f8 Tests: align with OpenSSL security level 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1220
diff changeset
60 default_bits = 2048
886
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
61 encrypt_key = no
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
62 distinguished_name = req_distinguished_name
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
63 [ req_distinguished_name ]
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
64 EOF
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
65
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
66 my $d = $t->testdir();
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
67
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
68 foreach my $name ('localhost') {
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
69 system('openssl req -x509 -new '
1220
0af58b78df35 Tests: removed single quotes from system() calls.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1116
diff changeset
70 . "-config $d/openssl.conf -subj /CN=$name/ "
0af58b78df35 Tests: removed single quotes from system() calls.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1116
diff changeset
71 . "-out $d/$name.crt -keyout $d/$name.key "
886
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
72 . ">>$d/openssl.out 2>&1") == 0
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
73 or die "Can't create certificate for $name: $!\n";
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
74 }
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
75
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
76 $t->write_file('index.html', '');
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
77 $t->run();
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
78
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
79 ###############################################################################
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
80
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
81 # request body with an empty DATA frame proxied to ssl backend
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
82 # "zero size buf in output" alerts seen
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
83
948
4dc302d8e04f Tests: changed HTTP2 package to act as a class.
Sergey Kandaurov <pluknet@nginx.com>
parents: 889
diff changeset
84 my $s = Test::Nginx::HTTP2->new();
4dc302d8e04f Tests: changed HTTP2 package to act as a class.
Sergey Kandaurov <pluknet@nginx.com>
parents: 889
diff changeset
85 my $sid = $s->new_stream({ path => '/proxy_ssl/', body_more => 1 });
4dc302d8e04f Tests: changed HTTP2 package to act as a class.
Sergey Kandaurov <pluknet@nginx.com>
parents: 889
diff changeset
86 $s->h2_body('');
4dc302d8e04f Tests: changed HTTP2 package to act as a class.
Sergey Kandaurov <pluknet@nginx.com>
parents: 889
diff changeset
87 my $frames = $s->read(all => [{ sid => $sid, fin => 1 }]);
886
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
88
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
89 my ($frame) = grep { $_->{type} eq "HEADERS" } @$frames;
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
90 is($frame->{headers}->{':status'}, 200, 'empty request body');
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
91
af2cd0ba6ca7 Tests: fixed HTTP/2 test for empty request body proxied with https.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
92 ###############################################################################