@@ -12,7 +12,7 @@ if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
12
12
plan(skip_all => " too old OpenSSL, need 1.0.2e, was $1 " );
13
13
14
14
} else {
15
- plan tests => repeat_each() * (blocks() * 5 + 1) ;
15
+ plan tests => repeat_each() * 38 ;
16
16
}
17
17
18
18
$ENV {TEST_NGINX_HTML_DIR } ||= html_dir();
@@ -63,6 +63,9 @@ ffi.cdef[[
63
63
void ngx_http_lua_ffi_free_priv_key(void *cdata);
64
64
65
65
int ngx_http_lua_ffi_ssl_clear_certs(void *r, char **err);
66
+
67
+ int ngx_http_lua_ffi_ssl_verify_client(void *r, int depth, void *cdata, char **err);
68
+
66
69
]]
67
70
_EOC_
68
71
}
@@ -812,3 +815,186 @@ lua ssl server name: "test.com"
812
815
--- no_error_log
813
816
[error]
814
817
[alert]
818
+
819
+
820
+
821
+ === TEST 6: verify client with CA certificates
822
+ --- http_config
823
+ server {
824
+ listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
825
+ server_name test.com;
826
+
827
+ ssl_certificate_by_lua_block {
828
+ collectgarbage()
829
+
830
+ require "defines"
831
+ local ffi = require "ffi"
832
+
833
+ local errmsg = ffi.new("char *[1]")
834
+
835
+ local r = require "resty.core.base" .get_request()
836
+ if r == nil then
837
+ ngx.log(ngx.ERR, "no request found")
838
+ return
839
+ end
840
+
841
+ local f = assert(io.open("t/cert/test.crt", "rb"))
842
+ local cert_data = f:read("*all")
843
+ f:close()
844
+
845
+ local cert = ffi.C.ngx_http_lua_ffi_parse_pem_cert(cert_data, #cert_data, errmsg)
846
+ if not cert then
847
+ ngx.log(ngx.ERR, "failed to parse PEM cert: ",
848
+ ffi.string(errmsg[0]))
849
+ return
850
+ end
851
+
852
+ local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, cert, errmsg)
853
+ if rc ~= 0 then
854
+ ngx.log(ngx.ERR, "failed to verify client: ",
855
+ ffi.string(errmsg[0]))
856
+ return
857
+ end
858
+ }
859
+
860
+ ssl_certificate ../../cert/test.crt;
861
+ ssl_certificate_key ../../cert/test.key;
862
+
863
+ server_tokens off;
864
+ location / {
865
+ default_type 'text/plain';
866
+ content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
867
+ more_clear_headers Date;
868
+ }
869
+ }
870
+ --- config
871
+ server_tokens off;
872
+ lua_ssl_trusted_certificate ../../cert/test.crt;
873
+
874
+ location /t {
875
+ proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
876
+ proxy_ssl_certificate ../../cert/test.crt;
877
+ proxy_ssl_certificate_key ../../cert/test.key;
878
+ }
879
+
880
+ --- request
881
+ GET /t
882
+ --- response_body
883
+ SUCCESS
884
+ --- no_error_log
885
+ [error]
886
+ [alert]
887
+
888
+
889
+
890
+ === TEST 7: verify client without CA certificates
891
+ --- http_config
892
+ server {
893
+ listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
894
+ server_name test.com;
895
+
896
+ ssl_certificate_by_lua_block {
897
+ collectgarbage()
898
+
899
+ require "defines"
900
+ local ffi = require "ffi"
901
+
902
+ local errmsg = ffi.new("char *[1]")
903
+
904
+ local r = require "resty.core.base" .get_request()
905
+ if r == nil then
906
+ ngx.log(ngx.ERR, "no request found")
907
+ return
908
+ end
909
+
910
+ local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
911
+ if rc ~= 0 then
912
+ ngx.log(ngx.ERR, "failed to verify client: ",
913
+ ffi.string(errmsg[0]))
914
+ return
915
+ end
916
+ }
917
+
918
+ ssl_certificate ../../cert/test.crt;
919
+ ssl_certificate_key ../../cert/test.key;
920
+
921
+ server_tokens off;
922
+ location / {
923
+ default_type 'text/plain';
924
+ content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
925
+ more_clear_headers Date;
926
+ }
927
+ }
928
+ --- config
929
+ server_tokens off;
930
+ lua_ssl_trusted_certificate ../../cert/test.crt;
931
+
932
+ location /t {
933
+ proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
934
+ proxy_ssl_certificate ../../cert/test.crt;
935
+ proxy_ssl_certificate_key ../../cert/test.key;
936
+ }
937
+
938
+ --- request
939
+ GET /t
940
+ --- response_body
941
+ FAILED:self signed certificate
942
+ --- no_error_log
943
+ [error]
944
+ [alert]
945
+
946
+
947
+
948
+ === TEST 8: verify client but client provides no certificate
949
+ --- http_config
950
+ server {
951
+ listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
952
+ server_name test.com;
953
+
954
+ ssl_certificate_by_lua_block {
955
+ collectgarbage()
956
+
957
+ require "defines"
958
+ local ffi = require "ffi"
959
+
960
+ local errmsg = ffi.new("char *[1]")
961
+
962
+ local r = require "resty.core.base" .get_request()
963
+ if r == nil then
964
+ ngx.log(ngx.ERR, "no request found")
965
+ return
966
+ end
967
+
968
+ local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
969
+ if rc ~= 0 then
970
+ ngx.log(ngx.ERR, "failed to verify client: ",
971
+ ffi.string(errmsg[0]))
972
+ return
973
+ end
974
+ }
975
+
976
+ ssl_certificate ../../cert/test.crt;
977
+ ssl_certificate_key ../../cert/test.key;
978
+
979
+ server_tokens off;
980
+ location / {
981
+ default_type 'text/plain';
982
+ content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
983
+ more_clear_headers Date;
984
+ }
985
+ }
986
+ --- config
987
+ server_tokens off;
988
+ lua_ssl_trusted_certificate ../../cert/test.crt;
989
+
990
+ location /t {
991
+ proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
992
+ }
993
+
994
+ --- request
995
+ GET /t
996
+ --- response_body
997
+ NONE
998
+ --- no_error_log
999
+ [error]
1000
+ [alert]
0 commit comments