Mercurial > hg > nginx-tests

comparison mail_imap_ssl.t @ 1724:1522ab9d37b4

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: Auth-SSL-Protocol and Auth-SSL-Cipher tests (ticket #2134).
author Sergey Kandaurov <pluknet@nginx.com>
date Wed, 18 Aug 2021 17:43:43 +0300
parents f0a02a429a59
children cdcd75657e52
comparison
equal deleted inserted replaced
1723:3581dc3c1937 1724:1522ab9d37b4
32 plan(skip_all => 'IO::Socket::SSL too old') if $@; 32 plan(skip_all => 'IO::Socket::SSL too old') if $@;
33 33
34 local $SIG{PIPE} = 'IGNORE'; 34 local $SIG{PIPE} = 'IGNORE';
35 35
36 my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap http rewrite/) 36 my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap http rewrite/)
37 ->has_daemon('openssl')->plan(12) 37 ->has_daemon('openssl')->plan(13)
38 ->write_file_expand('nginx.conf', <<'EOF'); 38 ->write_file_expand('nginx.conf', <<'EOF');
39 39
40 %%TEST_GLOBALS%% 40 %%TEST_GLOBALS%%
41 41
42 daemon off; 42 daemon off;
97 97
98 log_format test '$http_auth_ssl:$http_auth_ssl_verify:' 98 log_format test '$http_auth_ssl:$http_auth_ssl_verify:'
99 '$http_auth_ssl_subject:$http_auth_ssl_issuer:' 99 '$http_auth_ssl_subject:$http_auth_ssl_issuer:'
100 '$http_auth_ssl_serial:$http_auth_ssl_fingerprint:' 100 '$http_auth_ssl_serial:$http_auth_ssl_fingerprint:'
101 '$http_auth_ssl_cert:$http_auth_pass'; 101 '$http_auth_ssl_cert:$http_auth_pass';
102 log_format test2 '$http_auth_ssl_cipher:$http_auth_ssl_protocol';
102 103
103 server { 104 server {
104 listen 127.0.0.1:8080; 105 listen 127.0.0.1:8080;
105 server_name localhost; 106 server_name localhost;
106 107
107 location = /mail/auth { 108 location = /mail/auth {
108 access_log auth.log test; 109 access_log auth.log test;
110 access_log auth2.log test2;
109 111
110 add_header Auth-Status OK; 112 add_header Auth-Status OK;
111 add_header Auth-Server 127.0.0.1; 113 add_header Auth-Server 127.0.0.1;
112 add_header Auth-Port %%PORT_8144%%; 114 add_header Auth-Port %%PORT_8144%%;
113 add_header Auth-Wait 1; 115 add_header Auth-Wait 1;
206 %ssl, 208 %ssl,
207 ); 209 );
208 $s->ok('trusted cert'); 210 $s->ok('trusted cert');
209 $s->send('1 AUTHENTICATE PLAIN ' . $cred->("s5")); 211 $s->send('1 AUTHENTICATE PLAIN ' . $cred->("s5"));
210 $s->read(); 212 $s->read();
213
214 # Auth-SSL-Protocol and Auth-SSL-Cipher headers
215
216 my ($cipher, $sslversion);
217
218 if ($IO::Socket::SSL::VERSION >= 1.964) {
219 $s = get_ssl_socket(8143);
220 $cipher = $s->get_cipher();
221 $sslversion = $s->get_sslversion();
222 $sslversion =~ s/_/./;
223 }
224
211 undef $s; 225 undef $s;
212 226
213 # test auth_http request header fields with access_log 227 # test auth_http request header fields with access_log
214 228
215 $t->stop(); 229 $t->stop();
223 like($f, qr!^on:SUCCESS:(/?CN=2.example.com):\1:\w+:\w+:[^:]+:s4$!m, 237 like($f, qr!^on:SUCCESS:(/?CN=2.example.com):\1:\w+:\w+:[^:]+:s4$!m,
224 'log - good cert'); 238 'log - good cert');
225 like($f, qr!^on:SUCCESS:(/?CN=3.example.com):\1:\w+:\w+:[^:]+:s5$!m, 239 like($f, qr!^on:SUCCESS:(/?CN=3.example.com):\1:\w+:\w+:[^:]+:s5$!m,
226 'log - trusted cert'); 240 'log - trusted cert');
227 241
228 ############################################################################### 242 SKIP: {
243 skip 'IO::Socket::SSL version >= 1.964 required', 1
244 if $IO::Socket::SSL::VERSION < 1.964;
245
246 TODO: {
247 local $TODO = 'not yet' unless $t->has_version('1.21.2');
248
249 $f = $t->read_file('auth2.log');
250 like($f, qr|^$cipher:$sslversion$|m, 'log - cipher sslversion');
251
252 }
253
254 }
255
256 ###############################################################################
257
258 sub get_ssl_socket {
259 my ($port) = @_;
260 my $s;
261
262 eval {
263 local $SIG{ALRM} = sub { die "timeout\n" };
264 local $SIG{PIPE} = sub { die "sigpipe\n" };
265 alarm(8);
266 $s = IO::Socket::SSL->new(
267 Proto => 'tcp',
268 PeerAddr => '127.0.0.1:' . port($port),
269 SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE(),
270 SSL_error_trap => sub { die $_[1] }
271 );
272 alarm(0);
273 };
274 alarm(0);
275
276 if ($@) {
277 log_in("died: $@");
278 return undef;
279 }
280
281 return $s;
282 }
283
284 ###############################################################################