@@ -12,7 +12,7 @@ if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
12
12
plan(skip_all => " too old OpenSSL, need 1.0.2e, was $1 " );
13
13
14
14
} else {
15
- plan tests => repeat_each() * (blocks() * 5 + 1 );
15
+ plan tests => repeat_each() * (blocks() * 4 + 6 );
16
16
}
17
17
18
18
$ENV {TEST_NGINX_HTML_DIR } ||= html_dir();
@@ -63,6 +63,9 @@ ffi.cdef[[
63
63
void ngx_http_lua_ffi_free_priv_key(void *cdata);
64
64
65
65
int ngx_http_lua_ffi_ssl_clear_certs(void *r, char **err);
66
+
67
+ int ngx_http_lua_ffi_ssl_verify_client(void *r, int depth, void *cdata, char **err);
68
+
66
69
]]
67
70
_EOC_
68
71
}
@@ -812,3 +815,195 @@ lua ssl server name: "test.com"
812
815
--- no_error_log
813
816
[error]
814
817
[alert]
818
+
819
+
820
+
821
+ === TEST 6: verify client with CA certificates
822
+ --- http_config
823
+ server {
824
+ listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
825
+ server_name test.com;
826
+
827
+ ssl_certificate_by_lua_block {
828
+ collectgarbage()
829
+
830
+ require "defines"
831
+ local ffi = require "ffi"
832
+
833
+ local errmsg = ffi.new("char *[1]")
834
+
835
+ local r = require "resty.core.base" .get_request()
836
+ if r == nil then
837
+ ngx.log(ngx.ERR, "no request found")
838
+ return
839
+ end
840
+
841
+ local f = assert(io.open("t/cert/test.crt", "rb"))
842
+ local cert_data = f:read("*all")
843
+ f:close()
844
+
845
+ local cert = ffi.C.ngx_http_lua_ffi_parse_pem_cert(cert_data, #cert_data, errmsg)
846
+ if not cert then
847
+ ngx.log(ngx.ERR, "failed to parse PEM cert: ",
848
+ ffi.string(errmsg[0]))
849
+ return
850
+ end
851
+
852
+ local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, cert, errmsg)
853
+ if rc ~= 0 then
854
+ ngx.log(ngx.ERR, "failed to verify client: ",
855
+ ffi.string(errmsg[0]))
856
+ return
857
+ end
858
+ }
859
+
860
+ ssl_certificate ../../cert/test.crt;
861
+ ssl_certificate_key ../../cert/test.key;
862
+
863
+ server_tokens off;
864
+ location / {
865
+ default_type 'text/plain';
866
+ content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
867
+ more_clear_headers Date;
868
+ }
869
+ }
870
+ --- config
871
+ server_tokens off;
872
+ lua_ssl_trusted_certificate ../../cert/test.crt;
873
+
874
+ location /t {
875
+ proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
876
+ proxy_ssl_certificate ../../cert/test.crt;
877
+ proxy_ssl_certificate_key ../../cert/test.key;
878
+ }
879
+
880
+ --- request
881
+ GET /t
882
+ --- response_body
883
+ SUCCESS
884
+
885
+ --- error_log
886
+
887
+ --- no_error_log
888
+ [error]
889
+ [alert]
890
+
891
+
892
+
893
+ === TEST 7: verify client without CA certificates
894
+ --- http_config
895
+ server {
896
+ listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
897
+ server_name test.com;
898
+
899
+ ssl_certificate_by_lua_block {
900
+ collectgarbage()
901
+
902
+ require "defines"
903
+ local ffi = require "ffi"
904
+
905
+ local errmsg = ffi.new("char *[1]")
906
+
907
+ local r = require "resty.core.base" .get_request()
908
+ if r == nil then
909
+ ngx.log(ngx.ERR, "no request found")
910
+ return
911
+ end
912
+
913
+ local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
914
+ if rc ~= 0 then
915
+ ngx.log(ngx.ERR, "failed to verify client: ",
916
+ ffi.string(errmsg[0]))
917
+ return
918
+ end
919
+ }
920
+
921
+ ssl_certificate ../../cert/test.crt;
922
+ ssl_certificate_key ../../cert/test.key;
923
+
924
+ server_tokens off;
925
+ location / {
926
+ default_type 'text/plain';
927
+ content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
928
+ more_clear_headers Date;
929
+ }
930
+ }
931
+ --- config
932
+ server_tokens off;
933
+ lua_ssl_trusted_certificate ../../cert/test.crt;
934
+
935
+ location /t {
936
+ proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
937
+ proxy_ssl_certificate ../../cert/test.crt;
938
+ proxy_ssl_certificate_key ../../cert/test.key;
939
+ }
940
+
941
+ --- request
942
+ GET /t
943
+ --- response_body
944
+ FAILED:self signed certificate
945
+
946
+ --- error_log
947
+
948
+ --- no_error_log
949
+ [error]
950
+ [alert]
951
+
952
+
953
+
954
+ === TEST 8: verify client but client provides no certificate
955
+ --- http_config
956
+ server {
957
+ listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
958
+ server_name test.com;
959
+
960
+ ssl_certificate_by_lua_block {
961
+ collectgarbage()
962
+
963
+ require "defines"
964
+ local ffi = require "ffi"
965
+
966
+ local errmsg = ffi.new("char *[1]")
967
+
968
+ local r = require "resty.core.base" .get_request()
969
+ if r == nil then
970
+ ngx.log(ngx.ERR, "no request found")
971
+ return
972
+ end
973
+
974
+ local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
975
+ if rc ~= 0 then
976
+ ngx.log(ngx.ERR, "failed to verify client: ",
977
+ ffi.string(errmsg[0]))
978
+ return
979
+ end
980
+ }
981
+
982
+ ssl_certificate ../../cert/test.crt;
983
+ ssl_certificate_key ../../cert/test.key;
984
+
985
+ server_tokens off;
986
+ location / {
987
+ default_type 'text/plain';
988
+ content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
989
+ more_clear_headers Date;
990
+ }
991
+ }
992
+ --- config
993
+ server_tokens off;
994
+ lua_ssl_trusted_certificate ../../cert/test.crt;
995
+
996
+ location /t {
997
+ proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
998
+ }
999
+
1000
+ --- request
1001
+ GET /t
1002
+ --- response_body
1003
+ NONE
1004
+
1005
+ --- error_log
1006
+
1007
+ --- no_error_log
1008
+ [error]
1009
+ [alert]
0 commit comments