Skip to content

Commit 09cb269

Browse files
committed
tests: add unit tests for client certificate verification API
1 parent 8460fbf commit 09cb269

File tree

1 file changed

+187
-1
lines changed

1 file changed

+187
-1
lines changed

t/140-ssl-c-api.t

+187-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
1212
plan(skip_all => "too old OpenSSL, need 1.0.2e, was $1");
1313

1414
} else {
15-
plan tests => repeat_each() * (blocks() * 5 + 1);
15+
plan tests => repeat_each() * 38;
1616
}
1717

1818
$ENV{TEST_NGINX_HTML_DIR} ||= html_dir();
@@ -63,6 +63,9 @@ ffi.cdef[[
6363
void ngx_http_lua_ffi_free_priv_key(void *cdata);
6464
6565
int ngx_http_lua_ffi_ssl_clear_certs(void *r, char **err);
66+
67+
int ngx_http_lua_ffi_ssl_verify_client(void *r, int depth, void *cdata, char **err);
68+
6669
]]
6770
_EOC_
6871
}
@@ -812,3 +815,186 @@ lua ssl server name: "test.com"
812815
--- no_error_log
813816
[error]
814817
[alert]
818+
819+
820+
821+
=== TEST 6: verify client with CA certificates
822+
--- http_config
823+
server {
824+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
825+
server_name test.com;
826+
827+
ssl_certificate_by_lua_block {
828+
collectgarbage()
829+
830+
require "defines"
831+
local ffi = require "ffi"
832+
833+
local errmsg = ffi.new("char *[1]")
834+
835+
local r = require "resty.core.base" .get_request()
836+
if r == nil then
837+
ngx.log(ngx.ERR, "no request found")
838+
return
839+
end
840+
841+
local f = assert(io.open("t/cert/test.crt", "rb"))
842+
local cert_data = f:read("*all")
843+
f:close()
844+
845+
local cert = ffi.C.ngx_http_lua_ffi_parse_pem_cert(cert_data, #cert_data, errmsg)
846+
if not cert then
847+
ngx.log(ngx.ERR, "failed to parse PEM cert: ",
848+
ffi.string(errmsg[0]))
849+
return
850+
end
851+
852+
local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, cert, errmsg)
853+
if rc ~= 0 then
854+
ngx.log(ngx.ERR, "failed to verify client: ",
855+
ffi.string(errmsg[0]))
856+
return
857+
end
858+
}
859+
860+
ssl_certificate ../../cert/test.crt;
861+
ssl_certificate_key ../../cert/test.key;
862+
863+
server_tokens off;
864+
location / {
865+
default_type 'text/plain';
866+
content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
867+
more_clear_headers Date;
868+
}
869+
}
870+
--- config
871+
server_tokens off;
872+
lua_ssl_trusted_certificate ../../cert/test.crt;
873+
874+
location /t {
875+
proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
876+
proxy_ssl_certificate ../../cert/test.crt;
877+
proxy_ssl_certificate_key ../../cert/test.key;
878+
}
879+
880+
--- request
881+
GET /t
882+
--- response_body
883+
SUCCESS
884+
--- no_error_log
885+
[error]
886+
[alert]
887+
888+
889+
890+
=== TEST 7: verify client without CA certificates
891+
--- http_config
892+
server {
893+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
894+
server_name test.com;
895+
896+
ssl_certificate_by_lua_block {
897+
collectgarbage()
898+
899+
require "defines"
900+
local ffi = require "ffi"
901+
902+
local errmsg = ffi.new("char *[1]")
903+
904+
local r = require "resty.core.base" .get_request()
905+
if r == nil then
906+
ngx.log(ngx.ERR, "no request found")
907+
return
908+
end
909+
910+
local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
911+
if rc ~= 0 then
912+
ngx.log(ngx.ERR, "failed to verify client: ",
913+
ffi.string(errmsg[0]))
914+
return
915+
end
916+
}
917+
918+
ssl_certificate ../../cert/test.crt;
919+
ssl_certificate_key ../../cert/test.key;
920+
921+
server_tokens off;
922+
location / {
923+
default_type 'text/plain';
924+
content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
925+
more_clear_headers Date;
926+
}
927+
}
928+
--- config
929+
server_tokens off;
930+
lua_ssl_trusted_certificate ../../cert/test.crt;
931+
932+
location /t {
933+
proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
934+
proxy_ssl_certificate ../../cert/test.crt;
935+
proxy_ssl_certificate_key ../../cert/test.key;
936+
}
937+
938+
--- request
939+
GET /t
940+
--- response_body
941+
FAILED:self signed certificate
942+
--- no_error_log
943+
[error]
944+
[alert]
945+
946+
947+
948+
=== TEST 8: verify client but client provides no certificate
949+
--- http_config
950+
server {
951+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
952+
server_name test.com;
953+
954+
ssl_certificate_by_lua_block {
955+
collectgarbage()
956+
957+
require "defines"
958+
local ffi = require "ffi"
959+
960+
local errmsg = ffi.new("char *[1]")
961+
962+
local r = require "resty.core.base" .get_request()
963+
if r == nil then
964+
ngx.log(ngx.ERR, "no request found")
965+
return
966+
end
967+
968+
local rc = ffi.C.ngx_http_lua_ffi_ssl_verify_client(r, 1, nil, errmsg)
969+
if rc ~= 0 then
970+
ngx.log(ngx.ERR, "failed to verify client: ",
971+
ffi.string(errmsg[0]))
972+
return
973+
end
974+
}
975+
976+
ssl_certificate ../../cert/test.crt;
977+
ssl_certificate_key ../../cert/test.key;
978+
979+
server_tokens off;
980+
location / {
981+
default_type 'text/plain';
982+
content_by_lua_block { ngx.say(ngx.var.ssl_client_verify) }
983+
more_clear_headers Date;
984+
}
985+
}
986+
--- config
987+
server_tokens off;
988+
lua_ssl_trusted_certificate ../../cert/test.crt;
989+
990+
location /t {
991+
proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
992+
}
993+
994+
--- request
995+
GET /t
996+
--- response_body
997+
NONE
998+
--- no_error_log
999+
[error]
1000+
[alert]

0 commit comments

Comments
 (0)