Mercurial > hg > nginx-tests

annotate ssl_conf_command.t @ 1912:f61d1b4ac638

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled. Although CCM ciphers are disabled in a stock OpenSSL as rarely used, "to reduce ClientHello bloat", AEAD_AES_128_CCM is apparently turned back in certain distributions such as RHEL. Previously, this caused testing connections to fail as the CCM cipher being negotiated isn't supported yet in nginx. Now the test is skipped instead on failure. While here, fixed nearby style.
author Sergey Kandaurov <pluknet@nginx.com>
date Wed, 14 Jun 2023 16:57:01 +0400
parents 0e1865aa9b33
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1603
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1 #!/usr/bin/perl
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
3 # (C) Sergey Kandaurov
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
4 # (C) Nginx, Inc.
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
5
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
6 # Tests for http ssl module, ssl_conf_command.
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 ###############################################################################
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
9
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
10 use warnings;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
11 use strict;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
12
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
13 use Test::More;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
14
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
15 BEGIN { use FindBin; chdir($FindBin::Bin); }
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
16
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
17 use lib 'lib';
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
18 use Test::Nginx qw/ :DEFAULT http_end /;
1603
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
19
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
20 ###############################################################################
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
21
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
22 select STDERR; $| = 1;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
23 select STDOUT; $| = 1;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
24
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
25 my $t = Test::Nginx->new()
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
26 ->has(qw/http http_ssl openssl:1.0.2 socket_ssl_reused/)
1603
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
27 ->has_daemon('openssl');
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
28
1696
4baeba0e0da2 Tests: skip ssl_conf_command tests with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1693
diff changeset
29 plan(skip_all => 'no ssl_conf_command') if $t->has_module('BoringSSL');
1692
f6795e2e6a4b Tests: skip ssl_conf_command tests on too old OpenSSL explicitly.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1603
diff changeset
30
1603
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
31 $t->write_file_expand('nginx.conf', <<'EOF');
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
32
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
33 %%TEST_GLOBALS%%
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
34
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
35 daemon off;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
36
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
37 events {
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
38 }
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
39
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
40 http {
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
41 %%TEST_GLOBALS_HTTP%%
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
42
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
43 server {
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
44 listen 127.0.0.1:8443 ssl;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
45 server_name localhost;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
46
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
47 ssl_protocols TLSv1.2;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
48
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
49 ssl_session_tickets off;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
50 ssl_conf_command Options SessionTicket;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
51
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
52 ssl_prefer_server_ciphers on;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
53 ssl_conf_command Options -ServerPreference;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
54 ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
55
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
56 ssl_certificate localhost.crt;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
57 ssl_certificate_key localhost.key;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
58 ssl_conf_command Certificate override.crt;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
59 ssl_conf_command PrivateKey override.key;
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
60 }
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
61 }
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
62
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
63 EOF
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
64
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
65 $t->write_file('openssl.conf', <<EOF);
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
66 [ req ]
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
67 default_bits = 2048
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
68 encrypt_key = no
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
69 distinguished_name = req_distinguished_name
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
70 [ req_distinguished_name ]
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
71 EOF
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
72
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
73 my $d = $t->testdir();
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
74
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
75 foreach my $name ('localhost', 'override') {
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
76 system('openssl req -x509 -new '
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
77 . "-config $d/openssl.conf -subj /CN=$name/ "
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
78 . "-out $d/$name.crt -keyout $d/$name.key "
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
79 . ">>$d/openssl.out 2>&1") == 0
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
80 or die "Can't create certificate for $name: $!\n";
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
81 }
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
82
1693
5ac6efbe5552 Tests: removed TODO and try_run() checks for legacy versions.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1692
diff changeset
83 $t->run()->plan(3);
1603
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
84
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
85 ###############################################################################
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
86
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
87 my $s;
1603
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
88
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
89 $s = http_get(
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
90 '/', start => 1,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
91 SSL => 1,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
92 SSL_session_cache_size => 100
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
93 );
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
94
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
95 like($s->dump_peer_certificate(), qr/CN=override/, 'Certificate');
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
96 http_end($s);
1603
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
97
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
98 $s = http_get(
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
99 '/', start => 1,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
100 SSL => 1,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
101 SSL_reuse_ctx => $s
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
102 );
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
103
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
104 ok($s->get_session_reused(), 'SessionTicket');
1603
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
105
1865
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
106 $s = http_get(
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
107 '/', start => 1,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
108 SSL => 1,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
109 SSL_cipher_list =>
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
110 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384'
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
111 );
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
112
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL.
Maxim Dounin <mdounin@mdounin.ru>
parents: 1860
diff changeset
113 is($s->get_cipher(), 'ECDHE-RSA-AES128-GCM-SHA256', 'ServerPreference');
1603
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
114
8d2d37a4b48e Tests: ssl_conf_command tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
115 ###############################################################################