Mercurial > hg > nginx-tests

comparison proxy_ssl_verify.t @ 393:3c9aeeb09ac8

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: proxy_ssl_name and proxy_ssl_verify tests.
author Maxim Dounin <mdounin@mdounin.ru>
date Fri, 18 Apr 2014 18:42:33 +0400
parents
children 907e89fba9c3
comparison
equal deleted inserted replaced
392:c28ecaef065f 393:3c9aeeb09ac8
1 #!/usr/bin/perl
2
3 # (C) Maxim Dounin
4 # (C) Nginx, Inc.
5
6 # Tests for proxy to ssl backend, backend certificate verification.
7
8 ###############################################################################
9
10 use warnings;
11 use strict;
12
13 use Test::More;
14
15 BEGIN { use FindBin; chdir($FindBin::Bin); }
16
17 use lib 'lib';
18 use Test::Nginx;
19
20 ###############################################################################
21
22 select STDERR; $| = 1;
23 select STDOUT; $| = 1;
24
25 my $t = Test::Nginx->new()->has(qw/http http_ssl proxy/)
26 ->has_daemon('openssl')
27 ->write_file_expand('nginx.conf', <<'EOF');
28
29 %%TEST_GLOBALS%%
30
31 daemon off;
32
33 events {
34 }
35
36 http {
37 %%TEST_GLOBALS_HTTP%%
38
39 server {
40 listen 127.0.0.1:8080;
41 server_name localhost;
42
43 location /verify {
44 proxy_pass https://127.0.0.1:8081/;
45 proxy_ssl_name example.com;
46 proxy_ssl_verify on;
47 proxy_ssl_trusted_certificate 1.example.com.crt;
48 }
49
50 location /wildcard {
51 proxy_pass https://127.0.0.1:8081/;
52 proxy_ssl_name foo.example.com;
53 proxy_ssl_verify on;
54 proxy_ssl_trusted_certificate 1.example.com.crt;
55 }
56
57 location /fail {
58 proxy_pass https://127.0.0.1:8081/;
59 proxy_ssl_name no.match.example.com;
60 proxy_ssl_verify on;
61 proxy_ssl_trusted_certificate 1.example.com.crt;
62 }
63
64 location /cn {
65 proxy_pass https://127.0.0.1:8082/;
66 proxy_ssl_name 2.example.com;
67 proxy_ssl_verify on;
68 proxy_ssl_trusted_certificate 2.example.com.crt;
69 }
70
71 location /cn/fail {
72 proxy_pass https://127.0.0.1:8082/;
73 proxy_ssl_name bad.example.com;
74 proxy_ssl_verify on;
75 proxy_ssl_trusted_certificate 2.example.com.crt;
76 }
77
78 location /untrusted {
79 proxy_pass https://127.0.0.1:8082/;
80 proxy_ssl_verify on;
81 proxy_ssl_trusted_certificate 1.example.com.crt;
82 proxy_ssl_session_reuse off;
83 }
84 }
85
86 server {
87 listen 127.0.0.1:8081 ssl;
88 server_name 1.example.com;
89
90 ssl_certificate 1.example.com.crt;
91 ssl_certificate_key 1.example.com.key;
92
93 add_header X-Name $ssl_server_name;
94 }
95
96 server {
97 listen 127.0.0.1:8082 ssl;
98 server_name 2.example.com;
99
100 ssl_certificate 2.example.com.crt;
101 ssl_certificate_key 2.example.com.key;
102
103 add_header X-Name $ssl_server_name;
104 }
105 }
106
107 EOF
108
109 $t->write_file('openssl.1.example.com.conf', <<EOF);
110 [ req ]
111 prompt = no
112 default_bits = 1024
113 encrypt_key = no
114 distinguished_name = req_distinguished_name
115 x509_extensions = v3_req
116
117 [ req_distinguished_name ]
118 commonName=no.match.example.com
119
120 [ v3_req ]
121 subjectAltName = DNS:example.com,DNS:*.example.com
122 EOF
123
124 $t->write_file('openssl.2.example.com.conf', <<EOF);
125 [ req ]
126 prompt = no
127 default_bits = 1024
128 encrypt_key = no
129 distinguished_name = req_distinguished_name
130
131 [ req_distinguished_name ]
132 commonName=2.example.com
133 EOF
134
135 my $d = $t->testdir();
136
137 foreach my $name ('1.example.com', '2.example.com') {
138 system('openssl req -x509 -new '
139 . "-config '$d/openssl.$name.conf' "
140 . "-out '$d/$name.crt' -keyout '$d/$name.key' "
141 . ">>$d/openssl.out 2>&1") == 0
142 or die "Can't create certificate for $name: $!\n";
143 }
144
145 $t->write_file('index.html', '');
146
147 $t->try_run('no proxy_ssl_verify')->plan(6);
148
149 ###############################################################################
150
151 # subjectAltName
152
153 like(http_get('/verify'), qr/200 OK/ms, 'verify');
154 like(http_get('/wildcard'), qr/200 OK/ms, 'verify wildcard');
155 like(http_get('/fail'), qr/502 Bad/ms, 'verify fail');
156
157 # commonName
158
159 like(http_get('/cn'), qr/200 OK/ms, 'verify cn');
160 like(http_get('/cn/fail'), qr/502 Bad/ms, 'verify cn fail');
161
162 # untrusted
163
164 like(http_get('/untrusted'), qr/502 Bad/ms, 'untrusted');
165
166 ###############################################################################