Mercurial > hg > nginx-tests

annotate ssl_sni_sessions.t @ 1838:a68d1313c3fc

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: disabled ssl_sni_sessions.t with LibreSSL and BoringSSL. With TLSv1.3, LibreSSL does not provide session reuse at all, and BoringSSL only supports session tickets, and not server-side session cache. Since the test is focused on session cache usage, it is now skipped.
author Maxim Dounin <mdounin@mdounin.ru>
date Thu, 23 Mar 2023 19:50:06 +0300
parents 0c5f0c016d2b
children cdcd75657e52
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
1 #!/usr/bin/perl
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
2
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
3 # (C) Maxim Dounin
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
4
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
5 # Tests for SSL session resumption with SNI.
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
6
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
7 ###############################################################################
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
8
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
9 use warnings;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
10 use strict;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
11
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
12 use Test::More;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
13
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
14 BEGIN { use FindBin; chdir($FindBin::Bin); }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
15
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
16 use lib 'lib';
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
17 use Test::Nginx;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
18
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
19 ###############################################################################
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
20
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
21 select STDERR; $| = 1;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
22 select STDOUT; $| = 1;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
23
1233
4a57ca616f8e Tests: skip ssl_sni_sessions.t on win32 prior to 1.13.5.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1220
diff changeset
24 my $t = Test::Nginx->new()->has(qw/http http_ssl sni rewrite/);
4a57ca616f8e Tests: skip ssl_sni_sessions.t on win32 prior to 1.13.5.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1220
diff changeset
25
4a57ca616f8e Tests: skip ssl_sni_sessions.t on win32 prior to 1.13.5.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1220
diff changeset
26 $t->has_daemon('openssl')->write_file_expand('nginx.conf', <<'EOF');
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
27
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
28 %%TEST_GLOBALS%%
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
29
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
30 daemon off;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
31
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
32 events {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
33 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
34
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
35 http {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
36 %%TEST_GLOBALS_HTTP%%
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
37
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
38 ssl_certificate_key localhost.key;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
39 ssl_certificate localhost.crt;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
40
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
41 server {
1837
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
42 listen 127.0.0.1:8443 ssl;
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
43 server_name default;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
44
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
45 ssl_session_tickets off;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
46 ssl_session_cache shared:cache1:1m;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
47
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
48 location / {
1478
f9718a0773b9 Tests: skip TLS 1.3 session reuse tests with older Perl modules.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1421
diff changeset
49 return 200 $ssl_server_name:$ssl_session_reused:$ssl_protocol;
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
50 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
51 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
52
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
53 server {
1837
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
54 listen 127.0.0.1:8443;
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
55 server_name nocache;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
56
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
57 ssl_session_tickets off;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
58 ssl_session_cache shared:cache2:1m;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
59
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
60 location / {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
61 return 200 $ssl_server_name:$ssl_session_reused;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
62 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
63 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
64
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
65 server {
1837
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
66 listen 127.0.0.1:8444 ssl;
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
67 server_name default;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
68
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
69 ssl_session_ticket_key ticket1.key;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
70
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
71 location / {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
72 return 200 $ssl_server_name:$ssl_session_reused;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
73 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
74 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
75
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
76 server {
1837
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
77 listen 127.0.0.1:8444;
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
78 server_name tickets;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
79
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
80 ssl_session_ticket_key ticket2.key;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
81
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
82 location / {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
83 return 200 $ssl_server_name:$ssl_session_reused;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
84 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
85 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
86 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
87
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
88 EOF
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
89
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
90 eval { require IO::Socket::SSL; die if $IO::Socket::SSL::VERSION < 1.56; };
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
91 plan(skip_all => 'IO::Socket::SSL version >= 1.56 required') if $@;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
92
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
93 eval {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
94 if (IO::Socket::SSL->can('can_client_sni')) {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
95 IO::Socket::SSL->can_client_sni() or die;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
96 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
97 };
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
98 plan(skip_all => 'IO::Socket::SSL with OpenSSL SNI support required') if $@;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
99
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
100 eval {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
101 my $ctx = Net::SSLeay::CTX_new() or die;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
102 my $ssl = Net::SSLeay::new($ctx) or die;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
103 Net::SSLeay::set_tlsext_host_name($ssl, 'example.org') == 1 or die;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
104 };
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
105 plan(skip_all => 'Net::SSLeay with OpenSSL SNI support required') if $@;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
106
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
107 $t->write_file('openssl.conf', <<EOF);
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
108 [ req ]
1488
dbce8fb5f5f8 Tests: align with OpenSSL security level 2.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1478
diff changeset
109 default_bits = 2048
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
110 encrypt_key = no
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
111 distinguished_name = req_distinguished_name
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
112 [ req_distinguished_name ]
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
113 EOF
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
114
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
115 my $d = $t->testdir();
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
116
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
117 foreach my $name ('localhost') {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
118 system('openssl req -x509 -new '
1220
0af58b78df35 Tests: removed single quotes from system() calls.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1132
diff changeset
119 . "-config $d/openssl.conf -subj /CN=$name/ "
0af58b78df35 Tests: removed single quotes from system() calls.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1132
diff changeset
120 . "-out $d/$name.crt -keyout $d/$name.key "
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
121 . ">>$d/openssl.out 2>&1") == 0
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
122 or die "Can't create certificate for $name: $!\n";
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
123 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
124
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
125 $t->write_file('ticket1.key', '1' x 48);
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
126 $t->write_file('ticket2.key', '2' x 48);
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
127
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
128 $t->run();
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
129
1478
f9718a0773b9 Tests: skip TLS 1.3 session reuse tests with older Perl modules.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1421
diff changeset
130 plan(skip_all => 'no TLS 1.3 sessions')
1837
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
131 if get('default', port(8443), get_ssl_context()) =~ /TLSv1.3/
1478
f9718a0773b9 Tests: skip TLS 1.3 session reuse tests with older Perl modules.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1421
diff changeset
132 && ($Net::SSLeay::VERSION < 1.88 || $IO::Socket::SSL::VERSION < 2.061);
1838
a68d1313c3fc Tests: disabled ssl_sni_sessions.t with LibreSSL and BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1837
diff changeset
133 plan(skip_all => 'no TLS 1.3 sessions in LibreSSL')
a68d1313c3fc Tests: disabled ssl_sni_sessions.t with LibreSSL and BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1837
diff changeset
134 if get('default', port(8443), get_ssl_context()) =~ /TLSv1.3/
a68d1313c3fc Tests: disabled ssl_sni_sessions.t with LibreSSL and BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1837
diff changeset
135 && $t->has_module('LibreSSL');
a68d1313c3fc Tests: disabled ssl_sni_sessions.t with LibreSSL and BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1837
diff changeset
136 plan(skip_all => 'no TLS 1.3 session cache in BoringSSL')
a68d1313c3fc Tests: disabled ssl_sni_sessions.t with LibreSSL and BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1837
diff changeset
137 if get('default', port(8443), get_ssl_context()) =~ /TLSv1.3/
a68d1313c3fc Tests: disabled ssl_sni_sessions.t with LibreSSL and BoringSSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1837
diff changeset
138 && $t->has_module('BoringSSL');
1478
f9718a0773b9 Tests: skip TLS 1.3 session reuse tests with older Perl modules.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1421
diff changeset
139
f9718a0773b9 Tests: skip TLS 1.3 session reuse tests with older Perl modules.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1421
diff changeset
140 $t->plan(6);
f9718a0773b9 Tests: skip TLS 1.3 session reuse tests with older Perl modules.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1421
diff changeset
141
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
142 ###############################################################################
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
143
752
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
144 # check that everything works fine with default server
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
145
752
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
146 my $ctx = get_ssl_context();
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
147
1837
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
148 like(get('default', port(8443), $ctx), qr!default:\.!, 'default server');
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
149 like(get('default', port(8443), $ctx), qr!default:r!, 'default server reused');
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
150
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
151 # check that sessions are still properly saved and restored
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
152 # when using an SNI-based virtual server with different session cache;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
153 # as session resumption happens before SNI, only default server
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
154 # settings are expected to matter
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
155
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
156 # this didn't work before nginx 1.9.6 (and caused segfaults if no session
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
157 # cache was configured the SNI-based virtual server), because OpenSSL, when
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
158 # creating new sessions, uses callbacks from the default server context, but
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
159 # provides access to the SNI-selected server context only (ticket #235)
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
160
752
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
161 $ctx = get_ssl_context();
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
162
1837
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
163 like(get('nocache', port(8443), $ctx), qr!nocache:\.!, 'without cache');
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
164 like(get('nocache', port(8443), $ctx), qr!nocache:r!, 'without cache reused');
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
165
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
166 # make sure tickets can be used if an SNI-based virtual server
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
167 # uses a different set of session ticket keys explicitly set
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
168
752
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
169 $ctx = get_ssl_context();
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
170
1837
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
171 like(get('tickets', port(8444), $ctx), qr!tickets:\.!, 'tickets');
0c5f0c016d2b Tests: restored proper port numbers in ssl_sni_sessions.t.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1488
diff changeset
172 like(get('tickets', port(8444), $ctx), qr!tickets:r!, 'tickets reused');
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
173
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
174 ###############################################################################
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
175
752
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
176 sub get_ssl_context {
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
177 return IO::Socket::SSL::SSL_Context->new(
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
178 SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE(),
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
179 SSL_session_cache_size => 100
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
180 );
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
181 }
80e17d44088c Tests: avoid using SSL_session_key.
Maxim Dounin <mdounin@mdounin.ru>
parents: 751
diff changeset
182
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
183 sub get_ssl_socket {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
184 my ($host, $port, $ctx) = @_;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
185 my $s;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
186
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
187 eval {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
188 local $SIG{ALRM} = sub { die "timeout\n" };
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
189 local $SIG{PIPE} = sub { die "sigpipe\n" };
1421
4e48bf51714f Tests: aligned various generic read timeouts to http_end().
Sergey Kandaurov <pluknet@nginx.com>
parents: 1407
diff changeset
190 alarm(8);
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
191 $s = IO::Socket::SSL->new(
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
192 Proto => 'tcp',
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
193 PeerAddr => '127.0.0.1',
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
194 PeerPort => $port,
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
195 SSL_hostname => $host,
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
196 SSL_reuse_ctx => $ctx,
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
197 SSL_error_trap => sub { die $_[1] }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
198 );
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
199 alarm(0);
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
200 };
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
201 alarm(0);
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
202
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
203 if ($@) {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
204 log_in("died: $@");
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
205 return undef;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
206 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
207
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
208 return $s;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
209 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
210
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
211 sub get {
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
212 my ($host, $port, $ctx) = @_;
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
213
1132
3d312b6a1a19 Tests: avoid $ssl_session_reused tests failure with OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1116
diff changeset
214 my $s = get_ssl_socket($host, $port, $ctx) or return;
3d312b6a1a19 Tests: avoid $ssl_session_reused tests failure with OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1116
diff changeset
215 my $r = http(<<EOF, socket => $s);
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
216 GET / HTTP/1.0
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
217 Host: $host
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
218
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
219 EOF
1132
3d312b6a1a19 Tests: avoid $ssl_session_reused tests failure with OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1116
diff changeset
220
3d312b6a1a19 Tests: avoid $ssl_session_reused tests failure with OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1116
diff changeset
221 $s->close();
3d312b6a1a19 Tests: avoid $ssl_session_reused tests failure with OpenSSL 1.1.0.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1116
diff changeset
222 return $r;
751
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
223 }
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
224
f17f83b3d8c9 Tests: session resumption with SNI.
Maxim Dounin <mdounin@mdounin.ru>
parents:
diff changeset
225 ###############################################################################