Skip to content

Commit e2a6840

Browse files
pluknetpluknet
committed
Tests: caching SSL certificates with variables.
1 parent a73193b commit e2a6840

File tree

2 files changed

+320
-0
lines changed

2 files changed

+320
-0
lines changed

‎ssl_certificate_cache.t

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Sergey Kandaurov
4+
# (C) Nginx, Inc.
5+
6+
# Tests for http ssl module, ssl_certificate_cache directive.
7+
8+
###############################################################################
9+
10+
use warnings;
11+
use strict;
12+
13+
use Test::More;
14+
15+
BEGIN { use FindBin; chdir($FindBin::Bin); }
16+
17+
use lib 'lib';
18+
use Test::Nginx;
19+
20+
###############################################################################
21+
22+
select STDERR; $| = 1;
23+
select STDOUT; $| = 1;
24+
25+
my $t = Test::Nginx->new()
26+
->has(qw/http http_ssl openssl:1.0.2 socket_ssl_sni/)
27+
->has_daemon('openssl');
28+
29+
$t->write_file_expand('nginx.conf', <<'EOF');
30+
31+
%%TEST_GLOBALS%%
32+
33+
daemon off;
34+
35+
events {
36+
}
37+
38+
http {
39+
%%TEST_GLOBALS_HTTP%%
40+
41+
ssl_certificate $ssl_server_name.crt;
42+
ssl_certificate_key $ssl_server_name.key;
43+
44+
ssl_certificate_cache max=4 valid=1s;
45+
46+
server {
47+
listen 127.0.0.1:8443 ssl;
48+
server_name localhost;
49+
}
50+
51+
server {
52+
listen 127.0.0.1:8443 ssl;
53+
server_name 4.example.com;
54+
55+
ssl_certificate_cache off;
56+
}
57+
58+
server {
59+
listen 127.0.0.1:8444 ssl;
60+
server_name 5.example.com;
61+
62+
ssl_certificate_cache max=4 inactive=1s;
63+
}
64+
}
65+
66+
EOF
67+
68+
my $d = $t->testdir();
69+
70+
$t->write_file('openssl.conf', <<EOF);
71+
[ req ]
72+
default_bits = 2048
73+
encrypt_key = no
74+
distinguished_name = req_distinguished_name
75+
[ req_distinguished_name ]
76+
EOF
77+
78+
foreach my $name ('1.example.com', '2.example.com', '3.example.com',
79+
'4.example.com', '5.example.com', 'dummy')
80+
{
81+
system('openssl req -x509 -new '
82+
. "-config $d/openssl.conf -subj /CN=$name/ "
83+
. "-out $d/$name.crt -keyout $d/$name.key "
84+
. ">>$d/openssl.out 2>&1") == 0
85+
or die "Can't create certificate for $name: $!\n";
86+
}
87+
88+
update($t, '4b.example.com', '4.example.com');
89+
90+
$t->try_run('no ssl_certificate_cache')->plan(14);
91+
92+
###############################################################################
93+
94+
like(get('1.example.com'), qr/CN=1.example.com/, 'certificate 1');
95+
96+
update($t, '1.example.com');
97+
like(get('1.example.com'), qr/CN=1.example.com/, 'certificate 1 cached');
98+
99+
like(get('2.example.com'), qr/CN=2.example.com/, 'certificate 2');
100+
like(get('3.example.com'), qr/CN=3.example.com/, 'certificate 3');
101+
102+
# eviction after inserting 4 new items
103+
104+
ok(!get('1.example.com'), 'certificate 1 evicted');
105+
106+
update($t, '2.example.com', 'dummy');
107+
update($t, '3.example.com');
108+
109+
# replaced or removed certificates do not affect caching
110+
111+
like(get('2.example.com'), qr/CN=2.example.com/, 'certificate 2 cached');
112+
like(get('3.example.com'), qr/CN=3.example.com/, 'certificate 3 cached');
113+
114+
like(get('4.example.com'), qr/CN=4.example.com/, 'no cache');
115+
116+
update($t, '4.example.com', 'dummy');
117+
like(get('4.example.com'), qr/CN=dummy/, 'no cache updated');
118+
119+
like(get('5.example.com', 8444), qr/CN=5.example.com/, 'inactive');
120+
121+
select undef, undef, undef, 3.1;
122+
123+
like(get('2.example.com'), qr/CN=dummy/, 'certificate 2 expired');
124+
ok(!get('3.example.com'), 'certificate 3 expired');
125+
126+
# eviction after inactive time
127+
128+
update($t, '5.example.com', 'dummy');
129+
130+
like(get('4b.example.com', 8444), qr/CN=4.example.com/, 'inactive expire');
131+
like(get('5.example.com', 8444), qr/CN=dummy/, 'inactive expired');
132+
133+
###############################################################################
134+
135+
sub get {
136+
my ($host, $port) = @_;
137+
my $s = http('',
138+
start => 1,
139+
PeerAddr => '127.0.0.1:' . port($port || 8443),
140+
SSL => 1,
141+
SSL_hostname => $host) or return;
142+
return $s->dump_peer_certificate();
143+
}
144+
145+
sub update {
146+
my ($t, $old, $new) = @_;
147+
148+
for my $ext ("crt", "key") {
149+
if (defined $new) {
150+
$t->write_file("$old.$ext.tmp",
151+
$t->read_file("$new.$ext"));
152+
rename("$d/$old.$ext.tmp", "$d/$old.$ext");
153+
154+
} else {
155+
unlink "$d/$old.$ext";
156+
}
157+
}
158+
}
159+
160+
###############################################################################

‎stream_ssl_certificate_cache.t

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Sergey Kandaurov
4+
# (C) Nginx, Inc.
5+
6+
# Tests for stream ssl module, ssl_certificate_cache directive.
7+
8+
###############################################################################
9+
10+
use warnings;
11+
use strict;
12+
13+
use Test::More;
14+
15+
BEGIN { use FindBin; chdir($FindBin::Bin); }
16+
17+
use lib 'lib';
18+
use Test::Nginx;
19+
20+
###############################################################################
21+
22+
select STDERR; $| = 1;
23+
select STDOUT; $| = 1;
24+
25+
my $t = Test::Nginx->new()
26+
->has(qw/stream stream_ssl openssl:1.0.2 socket_ssl_sni/)
27+
->has_daemon('openssl');
28+
29+
$t->write_file_expand('nginx.conf', <<'EOF');
30+
31+
%%TEST_GLOBALS%%
32+
33+
daemon off;
34+
35+
events {
36+
}
37+
38+
stream {
39+
%%TEST_GLOBALS_STREAM%%
40+
41+
ssl_certificate $ssl_server_name.crt;
42+
ssl_certificate_key $ssl_server_name.key;
43+
44+
ssl_certificate_cache max=4 valid=1s;
45+
46+
server {
47+
listen 127.0.0.1:8443 ssl;
48+
server_name localhost;
49+
}
50+
51+
server {
52+
listen 127.0.0.1:8443 ssl;
53+
server_name 4.example.com;
54+
55+
ssl_certificate_cache off;
56+
}
57+
58+
server {
59+
listen 127.0.0.1:8444 ssl;
60+
server_name 5.example.com;
61+
62+
ssl_certificate_cache max=4 inactive=1s;
63+
}
64+
}
65+
66+
EOF
67+
68+
my $d = $t->testdir();
69+
70+
$t->write_file('openssl.conf', <<EOF);
71+
[ req ]
72+
default_bits = 2048
73+
encrypt_key = no
74+
distinguished_name = req_distinguished_name
75+
[ req_distinguished_name ]
76+
EOF
77+
78+
foreach my $name ('1.example.com', '2.example.com', '3.example.com',
79+
'4.example.com', '5.example.com', 'dummy')
80+
{
81+
system('openssl req -x509 -new '
82+
. "-config $d/openssl.conf -subj /CN=$name/ "
83+
. "-out $d/$name.crt -keyout $d/$name.key "
84+
. ">>$d/openssl.out 2>&1") == 0
85+
or die "Can't create certificate for $name: $!\n";
86+
}
87+
88+
update($t, '4b.example.com', '4.example.com');
89+
90+
$t->try_run('no ssl_certificate_cache')->plan(14);
91+
92+
###############################################################################
93+
94+
like(get('1.example.com'), qr/CN=1.example.com/, 'certificate 1');
95+
96+
update($t, '1.example.com');
97+
like(get('1.example.com'), qr/CN=1.example.com/, 'certificate 1 cached');
98+
99+
like(get('2.example.com'), qr/CN=2.example.com/, 'certificate 2');
100+
like(get('3.example.com'), qr/CN=3.example.com/, 'certificate 3');
101+
102+
# eviction after inserting 4 new items
103+
104+
ok(!get('1.example.com'), 'certificate 1 evicted');
105+
106+
update($t, '2.example.com', 'dummy');
107+
update($t, '3.example.com');
108+
109+
# replaced or removed certificates do not affect caching
110+
111+
like(get('2.example.com'), qr/CN=2.example.com/, 'certificate 2 cached');
112+
like(get('3.example.com'), qr/CN=3.example.com/, 'certificate 3 cached');
113+
114+
like(get('4.example.com'), qr/CN=4.example.com/, 'no cache');
115+
116+
update($t, '4.example.com', 'dummy');
117+
like(get('4.example.com'), qr/CN=dummy/, 'no cache updated');
118+
119+
like(get('5.example.com', 8444), qr/CN=5.example.com/, 'inactive');
120+
121+
select undef, undef, undef, 3.1;
122+
123+
like(get('2.example.com'), qr/CN=dummy/, 'certificate 2 expired');
124+
ok(!get('3.example.com'), 'certificate 3 expired');
125+
126+
# eviction after inactive time
127+
128+
update($t, '5.example.com', 'dummy');
129+
130+
like(get('4b.example.com', 8444), qr/CN=4.example.com/, 'inactive expire');
131+
like(get('5.example.com', 8444), qr/CN=dummy/, 'inactive expired');
132+
133+
###############################################################################
134+
135+
sub get {
136+
my ($host, $port) = @_;
137+
my $s = http('',
138+
PeerAddr => '127.0.0.1:' . port($port || 8443),
139+
start => 1,
140+
SSL => 1,
141+
SSL_hostname => $host) or return;
142+
return $s->dump_peer_certificate();
143+
}
144+
145+
sub update {
146+
my ($t, $old, $new) = @_;
147+
148+
for my $ext ("crt", "key") {
149+
if (defined $new) {
150+
$t->write_file("$old.$ext.tmp",
151+
$t->read_file("$new.$ext"));
152+
rename("$d/$old.$ext.tmp", "$d/$old.$ext");
153+
154+
} else {
155+
unlink "$d/$old.$ext";
156+
}
157+
}
158+
}
159+
160+
###############################################################################

0 commit comments

Comments
 (0)