Mercurial > hg > nginx-tests

comparison ssl_certificate_perl.t @ 1457:80911c4fe023

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: loading "data:..." certificates with perl module.
author Sergey Kandaurov <pluknet@nginx.com>
date Wed, 27 Mar 2019 15:10:50 +0300
parents
children dbce8fb5f5f8
comparison
equal deleted inserted replaced
1456:f4ae08adc23f 1457:80911c4fe023
1 #!/usr/bin/perl
2
3 # (C) Sergey Kandaurov
4 # (C) Nginx, Inc.
5
6 # Tests for http ssl module, loading certificates from memory with perl module.
7
8 ###############################################################################
9
10 use warnings;
11 use strict;
12
13 use Test::More;
14
15 use Socket;
16
17 BEGIN { use FindBin; chdir($FindBin::Bin); }
18
19 use lib 'lib';
20 use Test::Nginx;
21
22 ###############################################################################
23
24 select STDERR; $| = 1;
25 select STDOUT; $| = 1;
26
27 eval {
28 require Net::SSLeay;
29 Net::SSLeay::load_error_strings();
30 Net::SSLeay::SSLeay_add_ssl_algorithms();
31 Net::SSLeay::randomize();
32 };
33 plan(skip_all => 'Net::SSLeay not installed') if $@;
34
35 eval {
36 my $ctx = Net::SSLeay::CTX_new() or die;
37 my $ssl = Net::SSLeay::new($ctx) or die;
38 Net::SSLeay::set_tlsext_host_name($ssl, 'example.org') == 1 or die;
39 };
40 plan(skip_all => 'Net::SSLeay with OpenSSL SNI support required') if $@;
41
42 my $t = Test::Nginx->new()->has(qw/http http_ssl perl/)->has_daemon('openssl');
43
44 $t->{_configure_args} =~ /OpenSSL ([\d\.]+)/;
45 plan(skip_all => 'OpenSSL too old') unless defined $1 and $1 ge '1.0.2';
46
47 $t->write_file_expand('nginx.conf', <<'EOF');
48
49 %%TEST_GLOBALS%%
50
51 daemon off;
52
53 events {
54 }
55
56 http {
57 %%TEST_GLOBALS_HTTP%%
58
59 perl_set $pem '
60 sub {
61 my $r = shift;
62 local $/;
63 my $sni = $r->variable("ssl_server_name");
64 open my $fh, "<", "%%TESTDIR%%/$sni.crt";
65 my $content = <$fh>;
66 close $fh;
67 return $content;
68 }
69 ';
70
71 server {
72 listen 127.0.0.1:8080 ssl;
73 server_name localhost;
74
75 ssl_certificate data:$pem;
76 ssl_certificate_key data:$pem;
77 }
78 }
79
80 EOF
81
82 $t->write_file('openssl.conf', <<EOF);
83 [ req ]
84 default_bits = 1024
85 encrypt_key = no
86 distinguished_name = req_distinguished_name
87 [ req_distinguished_name ]
88 EOF
89
90 my $d = $t->testdir();
91
92 foreach my $name ('one', 'two') {
93 system('openssl req -x509 -new '
94 . "-config $d/openssl.conf -subj /CN=$name/ "
95 . "-out $d/$name.crt -keyout $d/$name.crt "
96 . ">>$d/openssl.out 2>&1") == 0
97 or die "Can't create certificate for $name: $!\n";
98 }
99
100 $t->try_run('no ssl_certificate variables')->plan(2);
101
102 ###############################################################################
103
104 like(cert('one', 8080), qr/CN=one/, 'certificate');
105 like(cert('two', 8080), qr/CN=two/, 'certificate 2');
106
107 ###############################################################################
108
109 sub cert {
110 my ($host, $port) = @_;
111 my ($s, $ssl) = get_ssl_socket($host, $port) or return;
112 Net::SSLeay::dump_peer_certificate($ssl);
113 }
114
115 sub get_ssl_socket {
116 my ($host, $port) = @_;
117 my $s;
118
119 my $dest_ip = inet_aton('127.0.0.1');
120 $port = port($port);
121 my $dest_serv_params = sockaddr_in($port, $dest_ip);
122
123 socket($s, &AF_INET, &SOCK_STREAM, 0) or die "socket: $!";
124 connect($s, $dest_serv_params) or die "connect: $!";
125
126 my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!");
127 my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!");
128 Net::SSLeay::set_tlsext_host_name($ssl, $host);
129 Net::SSLeay::set_fd($ssl, fileno($s));
130 Net::SSLeay::connect($ssl) or die("ssl connect");
131 return ($s, $ssl);
132 }
133
134 ###############################################################################