Skip to content

Commit 8d975a8

Browse files
ArchangelSDYArchangelSDY
committed
tests: add unit tests for client certificate verification API
1 parent 978e012 commit 8d975a8

File tree

2 files changed

+313
-0
lines changed

2 files changed

+313
-0
lines changed

‎t/ssl.t

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2330,3 +2330,176 @@ got TLS1 version: TLSv1.3,
23302330
[error]
23312331
[alert]
23322332
[emerg]
2333+
2334+
2335+
2336+
=== TEST 23: verify client with CA certificates
2337+
--- http_config
2338+
lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
2339+
2340+
server {
2341+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
2342+
server_name test.com;
2343+
ssl_certificate_by_lua_block {
2344+
local ssl = require "ngx.ssl"
2345+
2346+
local f = assert(io.open("t/cert/test.crt"))
2347+
local cert_data = f:read("*a")
2348+
f:close()
2349+
2350+
local cert, err = ssl.parse_pem_cert(cert_data)
2351+
if not cert then
2352+
ngx.log(ngx.ERR, "failed to parse pem cert: ", err)
2353+
return
2354+
end
2355+
2356+
local ok, err = ssl.verify_client(1, cert)
2357+
if not ok then
2358+
ngx.log(ngx.ERR, "failed to verify client: ", err)
2359+
return
2360+
end
2361+
}
2362+
2363+
ssl_certificate ../../cert/test.crt;
2364+
ssl_certificate_key ../../cert/test.key;
2365+
2366+
server_tokens off;
2367+
location / {
2368+
default_type 'text/plain';
2369+
content_by_lua_block {
2370+
print('client certificate subject: ', ngx.var.ssl_client_s_dn)
2371+
ngx.say(ngx.var.ssl_client_verify)
2372+
}
2373+
more_clear_headers Date;
2374+
}
2375+
}
2376+
--- config
2377+
server_tokens off;
2378+
lua_ssl_trusted_certificate ../../cert/test.crt;
2379+
2380+
location /t {
2381+
proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
2382+
proxy_ssl_certificate ../../cert/test.crt;
2383+
proxy_ssl_certificate_key ../../cert/test.key;
2384+
}
2385+
2386+
--- request
2387+
GET /t
2388+
--- response_body
2389+
SUCCESS
2390+
2391+
--- error_log
2392+
client certificate subject: [email protected],CN=test.com
2393+
2394+
--- no_error_log
2395+
[error]
2396+
[alert]
2397+
[emerg]
2398+
2399+
2400+
2401+
=== TEST 24: verify client without CA certificates
2402+
--- http_config
2403+
lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
2404+
2405+
server {
2406+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
2407+
server_name test.com;
2408+
ssl_certificate_by_lua_block {
2409+
local ssl = require "ngx.ssl"
2410+
2411+
local ok, err = ssl.verify_client(1, nil)
2412+
if not ok then
2413+
ngx.log(ngx.ERR, "failed to verify client: ", err)
2414+
return
2415+
end
2416+
}
2417+
2418+
ssl_certificate ../../cert/test.crt;
2419+
ssl_certificate_key ../../cert/test.key;
2420+
2421+
server_tokens off;
2422+
location / {
2423+
default_type 'text/plain';
2424+
content_by_lua_block {
2425+
print('client certificate subject: ', ngx.var.ssl_client_s_dn)
2426+
ngx.say(ngx.var.ssl_client_verify)
2427+
}
2428+
more_clear_headers Date;
2429+
}
2430+
}
2431+
--- config
2432+
server_tokens off;
2433+
lua_ssl_trusted_certificate ../../cert/test.crt;
2434+
2435+
location /t {
2436+
proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
2437+
proxy_ssl_certificate ../../cert/test.crt;
2438+
proxy_ssl_certificate_key ../../cert/test.key;
2439+
}
2440+
2441+
--- request
2442+
GET /t
2443+
--- response_body
2444+
FAILED:self signed certificate
2445+
2446+
--- error_log
2447+
client certificate subject: [email protected],CN=test.com
2448+
2449+
--- no_error_log
2450+
[error]
2451+
[alert]
2452+
[emerg]
2453+
2454+
2455+
2456+
=== TEST 25: verify client but client provides no certificate
2457+
--- http_config
2458+
lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
2459+
2460+
server {
2461+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
2462+
server_name test.com;
2463+
ssl_certificate_by_lua_block {
2464+
local ssl = require "ngx.ssl"
2465+
2466+
local ok, err = ssl.verify_client(1, nil)
2467+
if not ok then
2468+
ngx.log(ngx.ERR, "failed to verify client: ", err)
2469+
return
2470+
end
2471+
}
2472+
2473+
ssl_certificate ../../cert/test.crt;
2474+
ssl_certificate_key ../../cert/test.key;
2475+
2476+
server_tokens off;
2477+
location / {
2478+
default_type 'text/plain';
2479+
content_by_lua_block {
2480+
print('client certificate subject: ', ngx.var.ssl_client_s_dn)
2481+
ngx.say(ngx.var.ssl_client_verify)
2482+
}
2483+
more_clear_headers Date;
2484+
}
2485+
}
2486+
--- config
2487+
server_tokens off;
2488+
lua_ssl_trusted_certificate ../../cert/test.crt;
2489+
2490+
location /t {
2491+
proxy_pass https://unix:$TEST_NGINX_HTML_DIR/nginx.sock;
2492+
}
2493+
2494+
--- request
2495+
GET /t
2496+
--- response_body
2497+
NONE
2498+
2499+
--- error_log
2500+
client certificate subject: nil
2501+
2502+
--- no_error_log
2503+
[error]
2504+
[alert]
2505+
[emerg]

‎t/stream/ssl.t

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1887,3 +1887,143 @@ got TLS1 version: TLSv1.3,
18871887
[error]
18881888
[alert]
18891889
[emerg]
1890+
1891+
1892+
1893+
=== TEST 23: verify client with CA certificates
1894+
--- stream_config
1895+
server {
1896+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
1897+
1898+
ssl_certificate ../../cert/test2.crt;
1899+
ssl_certificate_key ../../cert/test2.key;
1900+
1901+
ssl_certificate_by_lua_block {
1902+
local ssl = require "ngx.ssl"
1903+
1904+
local f = assert(io.open("t/cert/test.crt", "rb"))
1905+
local cert_data = f:read("*all")
1906+
f:close()
1907+
1908+
local cert = ssl.parse_pem_cert(cert_data)
1909+
if not cert then
1910+
ngx.log(ngx.ERR, "failed to parse pem cert: ", err)
1911+
return
1912+
end
1913+
1914+
local ok, err = ssl.verify_client(1, cert)
1915+
if not ok then
1916+
ngx.log(ngx.ERR, "failed to verify client: ", err)
1917+
return
1918+
end
1919+
}
1920+
1921+
content_by_lua_block {
1922+
print('client certificate subject: ', ngx.var.ssl_client_s_dn)
1923+
ngx.say(ngx.var.ssl_client_verify)
1924+
}
1925+
}
1926+
--- stream_server_config
1927+
lua_ssl_trusted_certificate ../../cert/test.crt;
1928+
1929+
proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
1930+
proxy_ssl on;
1931+
proxy_ssl_certificate ../../cert/test.crt;
1932+
proxy_ssl_certificate_key ../../cert/test.key;
1933+
1934+
--- stream_response
1935+
SUCCESS
1936+
1937+
--- error_log
1938+
client certificate subject: [email protected],CN=test.com
1939+
1940+
--- no_error_log
1941+
[error]
1942+
[alert]
1943+
[emerg]
1944+
1945+
1946+
1947+
=== TEST 24: verify client without CA certificates
1948+
--- stream_config
1949+
server {
1950+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
1951+
1952+
ssl_certificate ../../cert/test2.crt;
1953+
ssl_certificate_key ../../cert/test2.key;
1954+
1955+
ssl_certificate_by_lua_block {
1956+
local ssl = require "ngx.ssl"
1957+
1958+
local ok, err = ssl.verify_client(1, nil)
1959+
if not ok then
1960+
ngx.log(ngx.ERR, "failed to verify client: ", err)
1961+
return
1962+
end
1963+
}
1964+
1965+
content_by_lua_block {
1966+
print('client certificate subject: ', ngx.var.ssl_client_s_dn)
1967+
ngx.say(ngx.var.ssl_client_verify)
1968+
}
1969+
}
1970+
--- stream_server_config
1971+
lua_ssl_trusted_certificate ../../cert/test.crt;
1972+
1973+
proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
1974+
proxy_ssl on;
1975+
proxy_ssl_certificate ../../cert/test.crt;
1976+
proxy_ssl_certificate_key ../../cert/test.key;
1977+
1978+
--- stream_response
1979+
FAILED:self signed certificate
1980+
1981+
--- error_log
1982+
client certificate subject: [email protected],CN=test.com
1983+
1984+
--- no_error_log
1985+
[error]
1986+
[alert]
1987+
[emerg]
1988+
1989+
1990+
1991+
=== TEST 25: verify client but client provides no certificate
1992+
--- stream_config
1993+
server {
1994+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
1995+
1996+
ssl_certificate ../../cert/test2.crt;
1997+
ssl_certificate_key ../../cert/test2.key;
1998+
1999+
ssl_certificate_by_lua_block {
2000+
local ssl = require "ngx.ssl"
2001+
2002+
local ok, err = ssl.verify_client(1, nil)
2003+
if not ok then
2004+
ngx.log(ngx.ERR, "failed to verify client: ", err)
2005+
return
2006+
end
2007+
}
2008+
2009+
content_by_lua_block {
2010+
print('client certificate subject: ', ngx.var.ssl_client_s_dn)
2011+
ngx.say(ngx.var.ssl_client_verify)
2012+
}
2013+
}
2014+
--- stream_server_config
2015+
lua_ssl_trusted_certificate ../../cert/test.crt;
2016+
2017+
proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
2018+
proxy_ssl on;
2019+
2020+
--- stream_response
2021+
NONE
2022+
2023+
--- error_log
2024+
client certificate subject: nil
2025+
2026+
--- no_error_log
2027+
[error]
2028+
[alert]
2029+
[emerg]

0 commit comments

Comments
 (0)