Mercurial > hg > nginx-tests
annotate ssl_curve.t @ 1858:cdcd75657e52
Tests: added has_feature() tests for IO::Socket::SSL.
The following distinct features supported:
- "socket_ssl", which requires IO::Socket::SSL and also implies
existance of the IO::Socket::SSL::SSL_VERIFY_NONE() symbol.
It is used by most of the tests.
- "socket_ssl_sni", which requires IO::Socket::SSL with the can_client_sni()
function (1.84), and SNI support available in Net::SSLeay and the OpenSSL
library being used. Used by ssl_sni.t, ssl_sni_sessions.t,
stream_ssl_preread.t. Additional Net::SSLeay testing is believed to be
unneeded and was removed.
- "socket_ssl_alpn", which requires IO::Socket::SSL with ALPN support (2.009),
and ALPN support in Net::SSLeay and the OpenSSL library being used.
Used by h2_ssl.t, h2_ssl_verify_client.t, stream_ssl_alpn.t,
stream_ssl_preread_alpn.t.
- "socket_ssl_sslversion", which requires IO::Socket::SSL with
the get_sslversion() and get_sslversion_int() methods (1.964).
Used by mail_imap_ssl.t.
- "socket_ssl_reused", which requires IO::Socket::SSL with
the get_session_reused() method (2.057). To be used in the following
patches.
This makes it possible to simplify and unify various SSL tests.
| author | Maxim Dounin <mdounin@mdounin.ru> |
|---|---|
| date | Thu, 18 May 2023 18:07:02 +0300 |
| parents | 34fc85598287 |
| children | 58951cf933e1 |
| rev | line source |
|---|---|
| 1749 | 1 #!/usr/bin/perl |
| 2 | |
| 3 # (C) Sergey Kandaurov | |
| 4 # (C) Nginx, Inc. | |
| 5 | |
| 6 # Tests for http ssl module, $ssl_curve variable. | |
| 7 | |
| 8 ############################################################################### | |
| 9 | |
| 10 use warnings; | |
| 11 use strict; | |
| 12 | |
| 13 use Test::More; | |
| 14 | |
| 15 BEGIN { use FindBin; chdir($FindBin::Bin); } | |
| 16 | |
| 17 use lib 'lib'; | |
| 18 use Test::Nginx; | |
| 19 | |
| 20 ############################################################################### | |
| 21 | |
| 22 select STDERR; $| = 1; | |
| 23 select STDOUT; $| = 1; | |
| 24 | |
|
1858
cdcd75657e52
Tests: added has_feature() tests for IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents:
1749
diff
changeset
|
25 my $t = Test::Nginx->new()->has(qw/http http_ssl rewrite socket_ssl/) |
| 1749 | 26 ->has_daemon('openssl'); |
| 27 | |
| 28 $t->{_configure_args} =~ /OpenSSL (\d+)/; | |
| 29 plan(skip_all => 'OpenSSL too old') unless defined $1 and $1 >= 3; | |
| 30 | |
| 31 $t->write_file_expand('nginx.conf', <<'EOF'); | |
| 32 | |
| 33 %%TEST_GLOBALS%% | |
| 34 | |
| 35 daemon off; | |
| 36 | |
| 37 events { | |
| 38 } | |
| 39 | |
| 40 http { | |
| 41 %%TEST_GLOBALS_HTTP%% | |
| 42 | |
| 43 ssl_certificate_key localhost.key; | |
| 44 ssl_certificate localhost.crt; | |
| 45 | |
| 46 ssl_ecdh_curve prime256v1; | |
| 47 | |
| 48 server { | |
| 49 listen 127.0.0.1:8443 ssl; | |
| 50 server_name localhost; | |
| 51 | |
| 52 return 200 "$ssl_curve $ssl_curves"; | |
| 53 } | |
| 54 } | |
| 55 | |
| 56 EOF | |
| 57 | |
| 58 $t->write_file('openssl.conf', <<EOF); | |
| 59 [ req ] | |
| 60 default_bits = 2048 | |
| 61 encrypt_key = no | |
| 62 distinguished_name = req_distinguished_name | |
| 63 [ req_distinguished_name ] | |
| 64 EOF | |
| 65 | |
| 66 my $d = $t->testdir(); | |
| 67 | |
| 68 foreach my $name ('localhost') { | |
| 69 system('openssl req -x509 -new ' | |
| 70 . "-config $d/openssl.conf -subj /CN=$name/ " | |
| 71 . "-out $d/$name.crt -keyout $d/$name.key " | |
| 72 . ">>$d/openssl.out 2>&1") == 0 | |
| 73 or die "Can't create certificate for $name: $!\n"; | |
| 74 } | |
| 75 | |
| 76 $t->try_run('no $ssl_curve')->plan(1); | |
| 77 | |
| 78 ############################################################################### | |
| 79 | |
| 80 like(get('/curve'), qr/^prime256v1 /m, 'ssl curve'); | |
| 81 | |
| 82 ############################################################################### | |
| 83 | |
| 84 sub get { | |
| 85 my ($uri, $port, $ctx) = @_; | |
| 86 my $s = get_ssl_socket($port) or return; | |
| 87 my $r = http_get($uri, socket => $s); | |
| 88 $s->close(); | |
| 89 return $r; | |
| 90 } | |
| 91 | |
| 92 sub get_ssl_socket { | |
| 93 my ($port, $ctx) = @_; | |
| 94 my $s; | |
| 95 | |
| 96 eval { | |
| 97 local $SIG{ALRM} = sub { die "timeout\n" }; | |
| 98 local $SIG{PIPE} = sub { die "sigpipe\n" }; | |
| 99 alarm(8); | |
| 100 $s = IO::Socket::SSL->new( | |
| 101 Proto => 'tcp', | |
| 102 PeerAddr => '127.0.0.1', | |
| 103 PeerPort => port(8443), | |
| 104 SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_NONE(), | |
| 105 SSL_error_trap => sub { die $_[1] }, | |
| 106 ); | |
| 107 alarm(0); | |
| 108 }; | |
| 109 alarm(0); | |
| 110 | |
| 111 if ($@) { | |
| 112 log_in("died: $@"); | |
| 113 return undef; | |
| 114 } | |
| 115 | |
| 116 return $s; | |
| 117 } | |
| 118 | |
| 119 ############################################################################### |