Mercurial > hg > nginx-tests

annotate ssl_engine_keys.t @ 540:481d705b8610

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: SSL support in mail backends. Socket is now embedded into every mail module. Socket methods are wrapped where appropriate. The new "SSL" extra flag specifies to accept connection over SSL.
author Sergey Kandaurov <pluknet@nginx.com>
date Fri, 03 Apr 2015 00:11:38 +0300
parents 2bc470a58621
children 907e89fba9c3
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
516
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1 #!/usr/bin/perl
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
3 # (C) Sergey Kandaurov
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
4 # (C) Nginx, Inc.
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
5
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
6 # Tests for http ssl module, loading "engine:..." keys.
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 ###############################################################################
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
9
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
10 use warnings;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
11 use strict;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
12
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
13 use Test::More;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
14
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
15 BEGIN { use FindBin; chdir($FindBin::Bin); }
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
16
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
17 use lib 'lib';
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
18 use Test::Nginx;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
19
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
20 ###############################################################################
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
21
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
22 select STDERR; $| = 1;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
23 select STDOUT; $| = 1;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
24
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
25 plan(skip_all => 'win32') if $^O eq 'MSWin32';
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
26
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
27 plan(skip_all => 'may not work, leaves coredump')
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
28 unless $ENV{TEST_NGINX_UNSAFE};
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
29
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
30 my $t = Test::Nginx->new()->has(qw/http http_ssl/)->has_daemon('openssl')
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
31 ->has_daemon('softhsm')->has_daemon('pkcs11-tool')->plan(1);
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
32
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
33 $t->write_file_expand('nginx.conf', <<'EOF');
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
34
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
35 %%TEST_GLOBALS%%
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
36
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
37 daemon off;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
38
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
39 events {
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
40 }
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
41
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
42 http {
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
43 %%TEST_GLOBALS_HTTP%%
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
44
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
45 server {
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
46 listen 127.0.0.1:8443 ssl;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
47 listen 127.0.0.1:8080;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
48 server_name localhost;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
49
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
50 ssl_certificate_key engine:pkcs11:slot_0-id_00;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
51 ssl_certificate localhost.crt;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
52
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
53 location / {
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
54 # index index.html by default
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
55 }
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
56 location /proxy {
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
57 proxy_pass https://127.0.0.1:8443/;
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
58 }
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
59 }
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
60 }
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
61
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
62 EOF
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
63
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
64 # Create a SoftHSM token with a secret key, and configure OpenSSL
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
65 # to access it using the pkcs11 engine, see detailed example
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
66 # posted by Dmitrii Pichulin here:
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
67 #
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
68 # http://mailman.nginx.org/pipermail/nginx-devel/2014-October/006151.html
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
69 #
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
70 # Note that library paths may differ on different systems,
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
71 # and may need to be adjusted.
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
72
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
73 $t->write_file('openssl.conf', <<EOF);
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
74 openssl_conf = openssl_def
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
75
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
76 [openssl_def]
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
77 engines = engine_section
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
78
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
79 [engine_section]
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
80 pkcs11 = pkcs11_section
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
81
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
82 [pkcs11_section]
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
83 engine_id = pkcs11
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
84 dynamic_path = /usr/local/lib/engines/engine_pkcs11.so
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
85 MODULE_PATH = /usr/local/lib/softhsm/libsofthsm.so
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
86 init = 0
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
87 PIN = 1234
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
88
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
89 [ req ]
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
90 default_bits = 2048
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
91 encrypt_key = no
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
92 distinguished_name = req_distinguished_name
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
93 [ req_distinguished_name ]
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
94 EOF
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
95
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
96 my $d = $t->testdir();
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
97
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
98 $t->write_file('softhsm.conf', <<EOF);
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
99 0:$d/slot0.db
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
100 EOF
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
101
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
102 $ENV{SOFTHSM_CONF} = "$d/softhsm.conf";
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
103 $ENV{OPENSSL_CONF} = "$d/openssl.conf";
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
104
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
105 foreach my $name ('localhost') {
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
106 system('softhsm --init-token --slot 0 --label "NginxZero" '
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
107 . '--pin 1234 --so-pin 1234 '
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
108 . ">>$d/openssl.out 2>&1");
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
109
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
110 system('pkcs11-tool --module=/usr/local/lib/softhsm/libsofthsm.so '
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
111 . '-p 1234 -l -k -d 0 -a nx_key_0 --key-type rsa:2048 '
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
112 . ">>$d/openssl.out 2>&1");
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
113
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
114 system('openssl req -x509 -new -engine pkcs11 '
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
115 . "-config '$d/openssl.conf' -subj '/CN=$name/' "
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
116 . "-out '$d/$name.crt' -keyform engine -text -key id_00 "
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
117 . ">>$d/openssl.out 2>&1") == 0
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
118 or die "Can't create certificate for $name: $!\n";
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
119 }
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
120
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
121 $t->try_run('no ssl_certificate_key engine');
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
122
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
123 $t->write_file('index.html', '');
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
124
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
125 ###############################################################################
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
126
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
127 like(http_get('/proxy'), qr/200 OK/, 'ssl engine keys');
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
128
2bc470a58621 Tests: test for loading "engine:..." keys.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
129 ###############################################################################