Skip to content

Commit fedca4f

Browse files
pluknetpluknet
committed
Tests: more uwsgi tests with SSL.
This covers tests for client certificate (including encrypted) to SSL backend and backend certificate verification.
1 parent 432a50d commit fedca4f

File tree

3 files changed

+473
-0
lines changed

3 files changed

+473
-0
lines changed

‎uwsgi_ssl_certificate.t

+145
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Sergey Kandaurov
4+
# (C) Nginx, Inc.
5+
6+
# Tests for http uwsgi module with client certificate to ssl backend.
7+
# The uwsgi_ssl_certificate and uwsgi_ssl_password_file directives.
8+
9+
###############################################################################
10+
11+
use warnings;
12+
use strict;
13+
14+
use Test::More;
15+
16+
BEGIN { use FindBin; chdir($FindBin::Bin); }
17+
18+
use lib 'lib';
19+
use Test::Nginx;
20+
21+
###############################################################################
22+
23+
select STDERR; $| = 1;
24+
select STDOUT; $| = 1;
25+
26+
my $t = Test::Nginx->new()->has(qw/http http_ssl uwsgi/)
27+
->has_daemon('openssl')->plan(5);
28+
29+
$t->write_file_expand('nginx.conf', <<'EOF');
30+
31+
%%TEST_GLOBALS%%
32+
33+
daemon off;
34+
35+
events {
36+
}
37+
38+
http {
39+
%%TEST_GLOBALS_HTTP%%
40+
41+
server {
42+
listen 127.0.0.1:8080;
43+
server_name localhost;
44+
45+
uwsgi_ssl_session_reuse off;
46+
47+
location /verify {
48+
uwsgi_pass suwsgi://127.0.0.1:8081;
49+
uwsgi_ssl_certificate 1.example.com.crt;
50+
uwsgi_ssl_certificate_key 1.example.com.key;
51+
}
52+
53+
location /fail {
54+
uwsgi_pass suwsgi://127.0.0.1:8081;
55+
uwsgi_ssl_certificate 2.example.com.crt;
56+
uwsgi_ssl_certificate_key 2.example.com.key;
57+
}
58+
59+
location /encrypted {
60+
uwsgi_pass suwsgi://127.0.0.1:8082;
61+
uwsgi_ssl_certificate 3.example.com.crt;
62+
uwsgi_ssl_certificate_key 3.example.com.key;
63+
uwsgi_ssl_password_file password;
64+
}
65+
}
66+
67+
# stub to implement SSL logic for tests
68+
69+
server {
70+
listen 127.0.0.1:8081 ssl;
71+
server_name localhost;
72+
73+
ssl_certificate 2.example.com.crt;
74+
ssl_certificate_key 2.example.com.key;
75+
76+
ssl_verify_client optional_no_ca;
77+
ssl_trusted_certificate 1.example.com.crt;
78+
79+
add_header X-Verify $ssl_client_verify always;
80+
add_header X-Name $ssl_client_s_dn always;
81+
}
82+
83+
server {
84+
listen 127.0.0.1:8082 ssl;
85+
server_name localhost;
86+
87+
ssl_certificate 1.example.com.crt;
88+
ssl_certificate_key 1.example.com.key;
89+
90+
ssl_verify_client optional_no_ca;
91+
ssl_trusted_certificate 3.example.com.crt;
92+
93+
add_header X-Verify $ssl_client_verify always;
94+
}
95+
}
96+
97+
EOF
98+
99+
$t->write_file('openssl.conf', <<EOF);
100+
[ req ]
101+
default_bits = 2048
102+
encrypt_key = no
103+
distinguished_name = req_distinguished_name
104+
[ req_distinguished_name ]
105+
EOF
106+
107+
my $d = $t->testdir();
108+
109+
foreach my $name ('1.example.com', '2.example.com') {
110+
system('openssl req -x509 -new '
111+
. "-config $d/openssl.conf -subj /CN=$name/ "
112+
. "-out $d/$name.crt -keyout $d/$name.key "
113+
. ">>$d/openssl.out 2>&1") == 0
114+
or die "Can't create certificate for $name: $!\n";
115+
}
116+
117+
foreach my $name ('3.example.com') {
118+
system("openssl genrsa -out $d/$name.key -passout pass:$name "
119+
. "-aes128 2048 >>$d/openssl.out 2>&1") == 0
120+
or die "Can't create private key: $!\n";
121+
system('openssl req -x509 -new '
122+
. "-config $d/openssl.conf -subj /CN=$name/ "
123+
. "-out $d/$name.crt "
124+
. "-key $d/$name.key -passin pass:$name"
125+
. ">>$d/openssl.out 2>&1") == 0
126+
or die "Can't create certificate for $name: $!\n";
127+
}
128+
129+
sleep 1 if $^O eq 'MSWin32';
130+
131+
$t->write_file('password', '3.example.com');
132+
$t->write_file('index.html', '');
133+
134+
$t->run();
135+
136+
###############################################################################
137+
138+
like(http_get('/verify'), qr/X-Verify: SUCCESS/ms, 'verify certificate');
139+
like(http_get('/fail'), qr/X-Verify: FAILED/ms, 'fail certificate');
140+
like(http_get('/encrypted'), qr/X-Verify: SUCCESS/ms, 'with encrypted key');
141+
142+
like(http_get('/verify'), qr!X-Name: /?CN=1.example!, 'valid certificate');
143+
unlike(http_get('/fail'), qr!X-Name: /?CN=1.example!, 'invalid certificate');
144+
145+
###############################################################################

‎uwsgi_ssl_certificate_vars.t

+146
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Sergey Kandaurov
4+
# (C) Nginx, Inc.
5+
6+
# Tests for http uwsgi module with variables in ssl certificates.
7+
8+
###############################################################################
9+
10+
use warnings;
11+
use strict;
12+
13+
use Test::More;
14+
15+
BEGIN { use FindBin; chdir($FindBin::Bin); }
16+
17+
use lib 'lib';
18+
use Test::Nginx;
19+
20+
###############################################################################
21+
22+
select STDERR; $| = 1;
23+
select STDOUT; $| = 1;
24+
25+
my $t = Test::Nginx->new()->has(qw/http http_ssl uwsgi/)
26+
->has_daemon('openssl');
27+
28+
$t->write_file_expand('nginx.conf', <<'EOF');
29+
30+
%%TEST_GLOBALS%%
31+
32+
daemon off;
33+
34+
events {
35+
}
36+
37+
http {
38+
%%TEST_GLOBALS_HTTP%%
39+
40+
server {
41+
listen 127.0.0.1:8080;
42+
server_name localhost;
43+
44+
uwsgi_ssl_session_reuse off;
45+
46+
location / {
47+
uwsgi_pass suwsgi://127.0.0.1:8081;
48+
uwsgi_ssl_certificate $arg_cert.example.com.crt;
49+
uwsgi_ssl_certificate_key $arg_cert.example.com.key;
50+
}
51+
52+
location /encrypted {
53+
uwsgi_pass suwsgi://127.0.0.1:8082;
54+
uwsgi_ssl_certificate $arg_cert.example.com.crt;
55+
uwsgi_ssl_certificate_key $arg_cert.example.com.key;
56+
uwsgi_ssl_password_file password;
57+
}
58+
59+
location /none {
60+
uwsgi_pass suwsgi://127.0.0.1:8082;
61+
uwsgi_ssl_certificate $arg_cert;
62+
uwsgi_ssl_certificate_key $arg_cert;
63+
}
64+
}
65+
66+
# stub to implement SSL logic for tests
67+
68+
server {
69+
listen 127.0.0.1:8081 ssl;
70+
server_name localhost;
71+
72+
ssl_certificate 2.example.com.crt;
73+
ssl_certificate_key 2.example.com.key;
74+
75+
ssl_verify_client optional_no_ca;
76+
ssl_trusted_certificate 1.example.com.crt;
77+
78+
add_header X-Verify $ssl_client_verify always;
79+
add_header X-Name $ssl_client_s_dn always;
80+
}
81+
82+
server {
83+
listen 127.0.0.1:8082 ssl;
84+
server_name localhost;
85+
86+
ssl_certificate 1.example.com.crt;
87+
ssl_certificate_key 1.example.com.key;
88+
89+
ssl_verify_client optional_no_ca;
90+
ssl_trusted_certificate 3.example.com.crt;
91+
92+
add_header X-Verify $ssl_client_verify always;
93+
}
94+
}
95+
96+
EOF
97+
98+
$t->write_file('openssl.conf', <<EOF);
99+
[ req ]
100+
default_bits = 2048
101+
encrypt_key = no
102+
distinguished_name = req_distinguished_name
103+
[ req_distinguished_name ]
104+
EOF
105+
106+
my $d = $t->testdir();
107+
108+
foreach my $name ('1.example.com', '2.example.com') {
109+
system('openssl req -x509 -new '
110+
. "-config $d/openssl.conf -subj /CN=$name/ "
111+
. "-out $d/$name.crt -keyout $d/$name.key "
112+
. ">>$d/openssl.out 2>&1") == 0
113+
or die "Can't create certificate for $name: $!\n";
114+
}
115+
116+
foreach my $name ('3.example.com') {
117+
system("openssl genrsa -out $d/$name.key -passout pass:$name "
118+
. "-aes128 2048 >>$d/openssl.out 2>&1") == 0
119+
or die "Can't create private key: $!\n";
120+
system('openssl req -x509 -new '
121+
. "-config $d/openssl.conf -subj /CN=$name/ "
122+
. "-out $d/$name.crt "
123+
. "-key $d/$name.key -passin pass:$name"
124+
. ">>$d/openssl.out 2>&1") == 0
125+
or die "Can't create certificate for $name: $!\n";
126+
}
127+
128+
sleep 1 if $^O eq 'MSWin32';
129+
130+
$t->write_file('password', '3.example.com');
131+
$t->write_file('index.html', '');
132+
133+
$t->try_run('no upstream ssl_certificate variables')->plan(4);
134+
135+
###############################################################################
136+
137+
like(http_get('/?cert=1'),
138+
qr/X-Verify: SUCCESS/ms, 'variable - verify certificate');
139+
like(http_get('/?cert=2'),
140+
qr/X-Verify: FAILED/ms, 'variable - fail certificate');
141+
like(http_get('/encrypted?cert=3'),
142+
qr/X-Verify: SUCCESS/ms, 'variable - with encrypted key');
143+
like(http_get('/none'),
144+
qr/X-Verify: NONE/ms, 'variable - no certificate');
145+
146+
###############################################################################

0 commit comments

Comments
 (0)