Mercurial > hg > nginx-tests
view ssl_certificates.t @ 1912:f61d1b4ac638
Tests: unbreak quic_ciphers.t with AEAD_AES_128_CCM enabled.
Although CCM ciphers are disabled in a stock OpenSSL as rarely used,
"to reduce ClientHello bloat", AEAD_AES_128_CCM is apparently turned
back in certain distributions such as RHEL. Previously, this caused
testing connections to fail as the CCM cipher being negotiated isn't
supported yet in nginx. Now the test is skipped instead on failure.
While here, fixed nearby style.
author | Sergey Kandaurov <pluknet@nginx.com> |
---|---|
date | Wed, 14 Jun 2023 16:57:01 +0400 |
parents | 1ba5108b6c24 |
children | 0a93f101925a |
line wrap: on
line source
#!/usr/bin/perl # (C) Sergey Kandaurov # (C) Nginx, Inc. # Tests for http ssl module with multiple certificates. ############################################################################### use warnings; use strict; use Test::More; BEGIN { use FindBin; chdir($FindBin::Bin); } use lib 'lib'; use Test::Nginx; ############################################################################### select STDERR; $| = 1; select STDOUT; $| = 1; my $t = Test::Nginx->new()->has(qw/http http_ssl socket_ssl/) ->has_daemon('openssl'); plan(skip_all => 'no multiple certificates') if $t->has_module('BoringSSL'); $t->write_file_expand('nginx.conf', <<'EOF'); %%TEST_GLOBALS%% daemon off; events { } http { %%TEST_GLOBALS_HTTP%% ssl_certificate_key rsa.key; ssl_certificate rsa.crt; ssl_ciphers DEFAULT:ECCdraft; add_header X-SSL-Protocol $ssl_protocol; server { listen 127.0.0.1:8443 ssl; server_name localhost; ssl_certificate_key ec.key; ssl_certificate ec.crt; ssl_certificate_key rsa.key; ssl_certificate rsa.crt; ssl_certificate_key rsa.key; ssl_certificate rsa.crt; } } EOF $t->write_file('openssl.conf', <<EOF); [ req ] default_bits = 2048 encrypt_key = no distinguished_name = req_distinguished_name [ req_distinguished_name ] EOF my $d = $t->testdir(); system("openssl ecparam -genkey -out $d/ec.key -name prime256v1 " . ">>$d/openssl.out 2>&1") == 0 or die "Can't create EC pem: $!\n"; system("openssl genrsa -out $d/rsa.key 2048 >>$d/openssl.out 2>&1") == 0 or die "Can't create RSA pem: $!\n"; foreach my $name ('ec', 'rsa') { system("openssl req -x509 -new -key $d/$name.key " . "-config $d/openssl.conf -subj /CN=$name/ " . "-out $d/$name.crt -keyout $d/$name.key " . ">>$d/openssl.out 2>&1") == 0 or die "Can't create certificate for $name: $!\n"; } $t->write_file('index.html', ''); $t->run()->plan(2); ############################################################################### TODO: { local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL' if $t->has_module('LibreSSL') && test_tls13(); like(cert('RSA'), qr/CN=rsa/, 'ssl cert RSA'); } like(cert('ECDSA'), qr/CN=ec/, 'ssl cert ECDSA'); ############################################################################### sub test_tls13 { return http_get('/', SSL => 1) =~ /TLSv1.3/; } sub cert { my $s = get_socket(@_) || return; return $s->dump_peer_certificate(); } sub get_socket { my ($type) = @_; my $ctx_cb = sub { my $ctx = shift; return unless defined $type; my $ssleay = Net::SSLeay::SSLeay(); return if ($ssleay < 0x1000200f || $ssleay == 0x20000000); my @sigalgs = ('RSA+SHA256:PSS+SHA256', 'RSA+SHA256'); @sigalgs = ($type . '+SHA256') unless $type eq 'RSA'; # SSL_CTRL_SET_SIGALGS_LIST Net::SSLeay::CTX_ctrl($ctx, 98, 0, $sigalgs[0]) or Net::SSLeay::CTX_ctrl($ctx, 98, 0, $sigalgs[1]) or die("Failed to set sigalgs"); }; return http_get( '/', start => 1, SSL => 1, SSL_cipher_list => $type, SSL_create_ctx_callback => $ctx_cb ); } ###############################################################################