nginx-tests: mail_ssl_conf_command.t annotate

annotate mail_ssl_conf_command.t @ 1938:e1059682aeef

Tests: fixed ClientHello with resending Initial QUIC packets. Previously it was rebuilt each time using distinct ClientHello.random resulting in different CRYPTO payload. As such, it led to TLS digest hash and derived secrets mismatch when resending Initial packet. Now ClientHello is built once and reused when resending Initial packets. Additionally, this required to preserve a generated secret value used in shared secret calculation as part of TLS key schedule. Previously it was regenerated when receiving a Retry packet, but this won't work with reused ClientHello as the resulting shared secrets won't match.

author	Sergey Kandaurov <pluknet@nginx.com>
date	Wed, 30 Aug 2023 02:22:58 +0400
parents	7b7b64569f55
children	3cae7b54841e

rev	line source
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	1 #!/usr/bin/perl
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	2
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	3 # (C) Sergey Kandaurov
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	4 # (C) Nginx, Inc.
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	5
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	6 # Tests for mail ssl module, ssl_conf_command.
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	7
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	8 ###############################################################################
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	9
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	10 use warnings;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	11 use strict;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	12
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	13 use Test::More;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	14
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	15 BEGIN { use FindBin; chdir($FindBin::Bin); }
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	16
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	17 use lib 'lib';
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	18 use Test::Nginx;
1861 7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	19 use Test::Nginx::IMAP;
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	20
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	21 ###############################################################################
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	22
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	23 select STDERR; $\| = 1;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	24 select STDOUT; $\| = 1;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	25
1856 ce4a06d72256 Tests: SIGPIPE handling in mail tests. Maxim Dounin <mdounin@mdounin.ru> parents: 1696 diff changeset	26 local $SIG{PIPE} = 'IGNORE';
ce4a06d72256 Tests: SIGPIPE handling in mail tests. Maxim Dounin <mdounin@mdounin.ru> parents: 1696 diff changeset	27
1861 7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	28 my $t = Test::Nginx->new()
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	29 ->has(qw/mail mail_ssl imap openssl:1.0.2 socket_ssl_reused/)
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	30 ->has_daemon('openssl');
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	31
1696 4baeba0e0da2 Tests: skip ssl_conf_command tests with BoringSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 1693 diff changeset	32 plan(skip_all => 'no ssl_conf_command') if $t->has_module('BoringSSL');
1692 f6795e2e6a4b Tests: skip ssl_conf_command tests on too old OpenSSL explicitly. Sergey Kandaurov <pluknet@nginx.com> parents: 1603 diff changeset	33
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	34 $t->write_file_expand('nginx.conf', <<'EOF');
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	35
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	36 %%TEST_GLOBALS%%
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	37
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	38 daemon off;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	39
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	40 events {
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	41 }
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	42
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	43 mail {
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	44 auth_http http://127.0.0.1:8080; # unused
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	45
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	46 server {
1861 7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	47 listen 127.0.0.1:8993 ssl;
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	48 protocol imap;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	49
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	50 ssl_protocols TLSv1.2;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	51
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	52 ssl_session_tickets off;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	53 ssl_conf_command Options SessionTicket;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	54
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	55 ssl_prefer_server_ciphers on;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	56 ssl_conf_command Options -ServerPreference;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	57 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	58
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	59 ssl_certificate localhost.crt;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	60 ssl_certificate_key localhost.key;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	61 ssl_conf_command Certificate override.crt;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	62 ssl_conf_command PrivateKey override.key;
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	63 }
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	64 }
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	65
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	66 EOF
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	67
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	68 $t->write_file('openssl.conf', <<EOF);
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	69 [ req ]
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	70 default_bits = 2048
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	71 encrypt_key = no
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	72 distinguished_name = req_distinguished_name
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	73 [ req_distinguished_name ]
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	74 EOF
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	75
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	76 my $d = $t->testdir();
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	77
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	78 foreach my $name ('localhost', 'override') {
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	79 system('openssl req -x509 -new '
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	80 . "-config $d/openssl.conf -subj /CN=$name/ "
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	81 . "-out $d/$name.crt -keyout $d/$name.key "
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	82 . ">>$d/openssl.out 2>&1") == 0
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	83 or die "Can't create certificate for $name: $!\n";
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	84 }
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	85
1693 5ac6efbe5552 Tests: removed TODO and try_run() checks for legacy versions. Sergey Kandaurov <pluknet@nginx.com> parents: 1692 diff changeset	86 $t->run()->plan(3);
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	87
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	88 ###############################################################################
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	89
1861 7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	90 my $s;
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	91
1861 7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	92 $s = Test::Nginx::IMAP->new(
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	93 SSL => 1,
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	94 SSL_session_cache_size => 100
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	95 );
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	96 $s->read();
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	97
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	98 like($s->socket()->dump_peer_certificate(), qr/CN=override/, 'Certificate');
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	99
1861 7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	100 $s = Test::Nginx::IMAP->new(
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	101 SSL => 1,
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	102 SSL_reuse_ctx => $s->socket()
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	103 );
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	104 ok($s->socket()->get_session_reused(), 'SessionTicket');
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	105
1861 7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	106 $s = Test::Nginx::IMAP->new(
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	107 SSL => 1,
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	108 SSL_cipher_list =>
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	109 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384'
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	110 );
7b7b64569f55 Tests: reworked mail SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1860 diff changeset	111 is($s->socket()->get_cipher(),
1603 8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	112 'ECDHE-RSA-AES128-GCM-SHA256', 'ServerPreference');
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	113
8d2d37a4b48e Tests: ssl_conf_command tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	114 ###############################################################################

Mercurial > hg > nginx-tests

annotate mail_ssl_conf_command.t @ 1938:e1059682aeef