Skip to content

Commit e1be8ce

Browse files
committed
tests: add unit tests for client certificate verification API
1 parent 8460fbf commit e1be8ce

File tree

1 file changed

+196
-1
lines changed

1 file changed

+196
-1
lines changed

t/140-ssl-c-api.t

Lines changed: 196 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
1212
plan(skip_all => "too old OpenSSL, need 1.0.2e, was $1");
1313

1414
} else {
15-
plan tests => repeat_each() * (blocks() * 5 + 1);
15+
plan tests => repeat_each() * (blocks() * 4 + 6);
1616
}
1717

1818
$ENV{TEST_NGINX_HTML_DIR} ||= html_dir();
@@ -63,6 +63,9 @@ ffi.cdef[[
6363
void ngx_http_lua_ffi_free_priv_key(void *cdata);
6464
6565
int ngx_http_lua_ffi_ssl_clear_certs(void *r, char **err);
66+
67+
int ngx_http_lua_ffi_ssl_verify_client(void *r, int depth, void *cdata, char **err);
68+
6669
]]
6770
_EOC_
6871
}
@@ -812,3 +815,195 @@ lua ssl server name: "test.com"
812815
--- no_error_log
813816
[error]
814817
[alert]
818+
819+
820+
821+
=== TEST 6: verify client with CA certificates
822+
--- http_config
823+
server {
824+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
825+
server_name test.com;
826+
827+
ssl_certificate_by_lua_block {
828+
collectgarbage()
829+
830+
require "defines"
831+
local ffi = require "ffi"
832+
833+
local errmsg = ffi.new("char *[1]")
834+
835+
local r = require "resty.core.base" .get_request()
836+
if r == nil then
837+
ngx.log(ngx.ERR, "no request found")
838+
return
839+
end
840+
841+
local f = assert(io.open("t/cert/test.crt", "rb"))
842+
local cert_data = f:read("*all")
843+
f:close()
844+
845+
local cert = ffi.C.ngx_http_lua_ffi_parse_pem_cert(cert_data, #cert_data, errmsg)
846+
if not cert then
847+
ngx.log(ngx.ERR, "failed to parse PEM cert: ",
848+
ffi.string(errmsg[0]))
849+
return
850+
end
851+
852+
local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, cert, errmsg)
853+
if rc ~= 0 then
854+
ngx.log(ngx.ERR, "failed to verify client: ",
855+
ffi.string(errmsg[0]))
856+
return
857+
end
858+
}
859+
860+
ssl_certificate ../../cert/test.crt;
861+
ssl_certificate_key ../../cert/test.key;
862+
863+
server_tokens off;
864+
location / {
865+
default_type 'text/plain';
866+
content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
867+
more_clear_headers Date;
868+
}
869+
}
870+
--- config
871+
server_tokens off;
872+
lua_ssl_trusted_certificate ../../cert/test.crt;
873+
874+
location /t {
875+
proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
876+
proxy_ssl_certificate ../../cert/test.crt;
877+
proxy_ssl_certificate_key ../../cert/test.key;
878+
}
879+
880+
--- request
881+
GET /t
882+
--- response_body
883+
SUCCESS
884+
885+
--- error_log
886+
887+
--- no_error_log
888+
[error]
889+
[alert]
890+
891+
892+
893+
=== TEST 7: verify client without CA certificates
894+
--- http_config
895+
server {
896+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
897+
server_name test.com;
898+
899+
ssl_certificate_by_lua_block {
900+
collectgarbage()
901+
902+
require "defines"
903+
local ffi = require "ffi"
904+
905+
local errmsg = ffi.new("char *[1]")
906+
907+
local r = require "resty.core.base" .get_request()
908+
if r == nil then
909+
ngx.log(ngx.ERR, "no request found")
910+
return
911+
end
912+
913+
local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
914+
if rc ~= 0 then
915+
ngx.log(ngx.ERR, "failed to verify client: ",
916+
ffi.string(errmsg[0]))
917+
return
918+
end
919+
}
920+
921+
ssl_certificate ../../cert/test.crt;
922+
ssl_certificate_key ../../cert/test.key;
923+
924+
server_tokens off;
925+
location / {
926+
default_type 'text/plain';
927+
content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
928+
more_clear_headers Date;
929+
}
930+
}
931+
--- config
932+
server_tokens off;
933+
lua_ssl_trusted_certificate ../../cert/test.crt;
934+
935+
location /t {
936+
proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
937+
proxy_ssl_certificate ../../cert/test.crt;
938+
proxy_ssl_certificate_key ../../cert/test.key;
939+
}
940+
941+
--- request
942+
GET /t
943+
--- response_body
944+
FAILED:self signed certificate
945+
946+
--- error_log
947+
948+
--- no_error_log
949+
[error]
950+
[alert]
951+
952+
953+
954+
=== TEST 8: verify client but client provides no certificate
955+
--- http_config
956+
server {
957+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
958+
server_name test.com;
959+
960+
ssl_certificate_by_lua_block {
961+
collectgarbage()
962+
963+
require "defines"
964+
local ffi = require "ffi"
965+
966+
local errmsg = ffi.new("char *[1]")
967+
968+
local r = require "resty.core.base" .get_request()
969+
if r == nil then
970+
ngx.log(ngx.ERR, "no request found")
971+
return
972+
end
973+
974+
local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
975+
if rc ~= 0 then
976+
ngx.log(ngx.ERR, "failed to verify client: ",
977+
ffi.string(errmsg[0]))
978+
return
979+
end
980+
}
981+
982+
ssl_certificate ../../cert/test.crt;
983+
ssl_certificate_key ../../cert/test.key;
984+
985+
server_tokens off;
986+
location / {
987+
default_type 'text/plain';
988+
content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
989+
more_clear_headers Date;
990+
}
991+
}
992+
--- config
993+
server_tokens off;
994+
lua_ssl_trusted_certificate ../../cert/test.crt;
995+
996+
location /t {
997+
proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
998+
}
999+
1000+
--- request
1001+
GET /t
1002+
--- response_body
1003+
NONE
1004+
1005+
--- error_log
1006+
1007+
--- no_error_log
1008+
[error]
1009+
[alert]

0 commit comments

Comments
 (0)