Mercurial > hg > nginx-tests
comparison proxy_ssl_verify.t @ 393:3c9aeeb09ac8
Tests: proxy_ssl_name and proxy_ssl_verify tests.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Fri, 18 Apr 2014 18:42:33 +0400 |
parents | |
children | 907e89fba9c3 |
comparison
equal
deleted
inserted
replaced
392:c28ecaef065f | 393:3c9aeeb09ac8 |
---|---|
1 #!/usr/bin/perl | |
2 | |
3 # (C) Maxim Dounin | |
4 # (C) Nginx, Inc. | |
5 | |
6 # Tests for proxy to ssl backend, backend certificate verification. | |
7 | |
8 ############################################################################### | |
9 | |
10 use warnings; | |
11 use strict; | |
12 | |
13 use Test::More; | |
14 | |
15 BEGIN { use FindBin; chdir($FindBin::Bin); } | |
16 | |
17 use lib 'lib'; | |
18 use Test::Nginx; | |
19 | |
20 ############################################################################### | |
21 | |
22 select STDERR; $| = 1; | |
23 select STDOUT; $| = 1; | |
24 | |
25 my $t = Test::Nginx->new()->has(qw/http http_ssl proxy/) | |
26 ->has_daemon('openssl') | |
27 ->write_file_expand('nginx.conf', <<'EOF'); | |
28 | |
29 %%TEST_GLOBALS%% | |
30 | |
31 daemon off; | |
32 | |
33 events { | |
34 } | |
35 | |
36 http { | |
37 %%TEST_GLOBALS_HTTP%% | |
38 | |
39 server { | |
40 listen 127.0.0.1:8080; | |
41 server_name localhost; | |
42 | |
43 location /verify { | |
44 proxy_pass https://127.0.0.1:8081/; | |
45 proxy_ssl_name example.com; | |
46 proxy_ssl_verify on; | |
47 proxy_ssl_trusted_certificate 1.example.com.crt; | |
48 } | |
49 | |
50 location /wildcard { | |
51 proxy_pass https://127.0.0.1:8081/; | |
52 proxy_ssl_name foo.example.com; | |
53 proxy_ssl_verify on; | |
54 proxy_ssl_trusted_certificate 1.example.com.crt; | |
55 } | |
56 | |
57 location /fail { | |
58 proxy_pass https://127.0.0.1:8081/; | |
59 proxy_ssl_name no.match.example.com; | |
60 proxy_ssl_verify on; | |
61 proxy_ssl_trusted_certificate 1.example.com.crt; | |
62 } | |
63 | |
64 location /cn { | |
65 proxy_pass https://127.0.0.1:8082/; | |
66 proxy_ssl_name 2.example.com; | |
67 proxy_ssl_verify on; | |
68 proxy_ssl_trusted_certificate 2.example.com.crt; | |
69 } | |
70 | |
71 location /cn/fail { | |
72 proxy_pass https://127.0.0.1:8082/; | |
73 proxy_ssl_name bad.example.com; | |
74 proxy_ssl_verify on; | |
75 proxy_ssl_trusted_certificate 2.example.com.crt; | |
76 } | |
77 | |
78 location /untrusted { | |
79 proxy_pass https://127.0.0.1:8082/; | |
80 proxy_ssl_verify on; | |
81 proxy_ssl_trusted_certificate 1.example.com.crt; | |
82 proxy_ssl_session_reuse off; | |
83 } | |
84 } | |
85 | |
86 server { | |
87 listen 127.0.0.1:8081 ssl; | |
88 server_name 1.example.com; | |
89 | |
90 ssl_certificate 1.example.com.crt; | |
91 ssl_certificate_key 1.example.com.key; | |
92 | |
93 add_header X-Name $ssl_server_name; | |
94 } | |
95 | |
96 server { | |
97 listen 127.0.0.1:8082 ssl; | |
98 server_name 2.example.com; | |
99 | |
100 ssl_certificate 2.example.com.crt; | |
101 ssl_certificate_key 2.example.com.key; | |
102 | |
103 add_header X-Name $ssl_server_name; | |
104 } | |
105 } | |
106 | |
107 EOF | |
108 | |
109 $t->write_file('openssl.1.example.com.conf', <<EOF); | |
110 [ req ] | |
111 prompt = no | |
112 default_bits = 1024 | |
113 encrypt_key = no | |
114 distinguished_name = req_distinguished_name | |
115 x509_extensions = v3_req | |
116 | |
117 [ req_distinguished_name ] | |
118 commonName=no.match.example.com | |
119 | |
120 [ v3_req ] | |
121 subjectAltName = DNS:example.com,DNS:*.example.com | |
122 EOF | |
123 | |
124 $t->write_file('openssl.2.example.com.conf', <<EOF); | |
125 [ req ] | |
126 prompt = no | |
127 default_bits = 1024 | |
128 encrypt_key = no | |
129 distinguished_name = req_distinguished_name | |
130 | |
131 [ req_distinguished_name ] | |
132 commonName=2.example.com | |
133 EOF | |
134 | |
135 my $d = $t->testdir(); | |
136 | |
137 foreach my $name ('1.example.com', '2.example.com') { | |
138 system('openssl req -x509 -new ' | |
139 . "-config '$d/openssl.$name.conf' " | |
140 . "-out '$d/$name.crt' -keyout '$d/$name.key' " | |
141 . ">>$d/openssl.out 2>&1") == 0 | |
142 or die "Can't create certificate for $name: $!\n"; | |
143 } | |
144 | |
145 $t->write_file('index.html', ''); | |
146 | |
147 $t->try_run('no proxy_ssl_verify')->plan(6); | |
148 | |
149 ############################################################################### | |
150 | |
151 # subjectAltName | |
152 | |
153 like(http_get('/verify'), qr/200 OK/ms, 'verify'); | |
154 like(http_get('/wildcard'), qr/200 OK/ms, 'verify wildcard'); | |
155 like(http_get('/fail'), qr/502 Bad/ms, 'verify fail'); | |
156 | |
157 # commonName | |
158 | |
159 like(http_get('/cn'), qr/200 OK/ms, 'verify cn'); | |
160 like(http_get('/cn/fail'), qr/502 Bad/ms, 'verify cn fail'); | |
161 | |
162 # untrusted | |
163 | |
164 like(http_get('/untrusted'), qr/502 Bad/ms, 'untrusted'); | |
165 | |
166 ############################################################################### |