RepoMirrors
/
haproxy
mirror of http://git.haproxy.org/git/haproxy.git/
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
haproxy/reg-tests/ssl/set_ssl_cert.vtc

204 lines
6.5 KiB
Plaintext
Raw Normal View History

REGTEST: ssl/cli: change test type to devel Change the type of test from slow to devel for add_ssl-crt-list.vtc and set_ssl_cert.vtc.
2020-03-31 12:48:34 +00:00
#REGTEST_TYPE=devel
REGTEST: ssl: test the "set ssl cert" CLI command Add a reg-test which test the update of a certificate over the CLI. This test requires socat and curl. This commit also adds an ECDSA certificate in the ssl directory.
2019-12-19 10:25:19 +00:00
# This reg-test uses the "set ssl cert" command to update a certificate over the CLI.
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
# It requires socat to upload the certificate
#
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
# This check has two separate parts.
# In the first part, there are 3 requests, the first one will use "www.test1.com" as SNI,
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
# the second one with the same but that must fail and the third one will use
# "localhost". Since vtest can't do SSL, we use haproxy as an SSL client with 2
# chained listen section.
#
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
# In the second part, we check the update of a default certificate in a crt-list.
# This corresponds to a bug raised in https://github.com/haproxy/haproxy/issues/1143.
# A certificate is used as default certificate as well as regular one, and during the update
# the default certificate would not be properly updated if the default instance did not have
# any SNI. The test consists in checking that the used certificate is the right one after
# updating it via a "set ssl cert" call.
#
REGTEST: ssl: test the "set ssl cert" CLI command Add a reg-test which test the update of a certificate over the CLI. This test requires socat and curl. This commit also adds an ECDSA certificate in the ssl directory.
2019-12-19 10:25:19 +00:00
# If this test does not work anymore:
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
# - Check that you have socat
REGTEST: ssl: test the "set ssl cert" CLI command Add a reg-test which test the update of a certificate over the CLI. This test requires socat and curl. This commit also adds an ECDSA certificate in the ssl directory.
2019-12-19 10:25:19 +00:00
varnishtest "Test the 'set ssl cert' feature of the CLI"
REGTESTS: make the set_ssl_cert test require version 2.2 It doesn't only use "set ssl cert" but also relies on "show ssl cert" which is only available in 2.2.
2020-01-24 12:49:42 +00:00
#REQUIRE_VERSION=2.2
REGTEST: ssl: test the "set ssl cert" CLI command Add a reg-test which test the update of a certificate over the CLI. This test requires socat and curl. This commit also adds an ECDSA certificate in the ssl directory.
2019-12-19 10:25:19 +00:00
#REQUIRE_OPTIONS=OPENSSL
REGTESTS: Replace REQUIRE_BINARIES with 'command -v' This migrates the tests to the native `feature cmd` functionality of VTest.
2021-06-11 17:56:17 +00:00
feature cmd "command -v socat"
REGTEST: ssl: test the "set ssl cert" CLI command Add a reg-test which test the update of a certificate over the CLI. This test requires socat and curl. This commit also adds an ECDSA certificate in the ssl directory.
2019-12-19 10:25:19 +00:00
feature ignore_unknown_macro
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
server s1 -repeat 9 {
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
rxreq
txresp
} -start
REGTEST: ssl: test the "set ssl cert" CLI command Add a reg-test which test the update of a certificate over the CLI. This test requires socat and curl. This commit also adds an ECDSA certificate in the ssl directory.
2019-12-19 10:25:19 +00:00
haproxy h1 -conf {
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
global
tune.ssl.default-dh-param 2048
tune.ssl.capture-cipherlist-size 1
stats socket "${tmpdir}/h1/stats" level admin
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
crt-base ${testdir}
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
defaults
mode http
option httplog
log stderr local0 debug err
option logasap
timeout connect 100ms
timeout client 1s
timeout server 1s
listen clear-lst
bind "fd@${clearlst}"
balance roundrobin
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
http-response set-header X-SSL-Server-SHA1 %[ssl_s_sha1,hex]
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
retries 0 # 2nd SSL connection must fail so skip the retry
server s1 "${tmpdir}/ssl.sock" ssl verify none sni str(www.test1.com)
server s2 "${tmpdir}/ssl.sock" ssl verify none sni str(www.test1.com)
server s3 "${tmpdir}/ssl.sock" ssl verify none sni str(localhost)
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
server s4 "${tmpdir}/other-ssl.sock" ssl verify none sni str(www.test1.com)
server s5 "${tmpdir}/other-ssl.sock" ssl verify none sni str(other.test1.com) # uses the default certificate
server s6 "${tmpdir}/other-ssl.sock" ssl verify none sni str(www.test1.com)
server s7 "${tmpdir}/other-ssl.sock" ssl verify none sni str(other.test1.com) # uses the default certificate
server s8 "${tmpdir}/other-ssl.sock" ssl verify none sni str(www.test1.com)
server s9 "${tmpdir}/other-ssl.sock" ssl verify none sni str(other.test1.com) # uses the default certificate
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
listen ssl-lst
bind "${tmpdir}/ssl.sock" ssl crt ${testdir}/common.pem strict-sni
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
server s1 ${s1_addr}:${s1_port}
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
listen other-ssl-lst
bind "${tmpdir}/other-ssl.sock" ssl crt-list ${testdir}/set_default_cert.crt-list
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
server s1 ${s1_addr}:${s1_port}
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
REGTEST: ssl: test the "set ssl cert" CLI command Add a reg-test which test the update of a certificate over the CLI. This test requires socat and curl. This commit also adds an ECDSA certificate in the ssl directory.
2019-12-19 10:25:19 +00:00
} -start
haproxy h1 -cli {
send "show ssl cert ${testdir}/common.pem"
expect ~ ".*SHA1 FingerPrint: 2195C9F0FD58470313013FC27C1B9CF9864BD1C6"
}
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.status == 200
} -run
REGTEST: ssl: test the "set ssl cert" CLI command Add a reg-test which test the update of a certificate over the CLI. This test requires socat and curl. This commit also adds an ECDSA certificate in the ssl directory.
2019-12-19 10:25:19 +00:00
shell {
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
printf "set ssl cert ${testdir}/common.pem <<\n$(cat ${testdir}/ecdsa.pem)\n\n" | socat "${tmpdir}/h1/stats" -
echo "commit ssl cert ${testdir}/common.pem" | socat "${tmpdir}/h1/stats" -
REGTEST: ssl: test the "set ssl cert" CLI command Add a reg-test which test the update of a certificate over the CLI. This test requires socat and curl. This commit also adds an ECDSA certificate in the ssl directory.
2019-12-19 10:25:19 +00:00
}
haproxy h1 -cli {
send "show ssl cert ${testdir}/common.pem"
expect ~ ".*SHA1 FingerPrint: A490D069DBAFBEE66DE434BEC34030ADE8BCCBF1"
}
REGTEST: ssl: improve the "set ssl cert" test Improve the test by removing the curl command and using the same proxy chaining technique as in commit 3ed722f ("REGTEST: ssl: remove curl from the "add ssl crt-list" test"). A 3rd request was added which must fail, to ensure that the SNI was effectively removed from HAProxy. This patch also adds timeouts in the default section, logs on stderr and fix some indentation issues.
2020-04-30 08:19:40 +00:00
# check that the "www.test1.com" SNI was removed
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.status == 503
} -run
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.status == 200
} -run
BUG/MEDIUM: ssl/cli: abort ssl cert is freeing the old store The "abort ssl cert" command is buggy and removes the current ckch store, and instances, leading to SNI removal. It must only removes the new one. This patch also adds a check in set_ssl_cert.vtc and set_ssl_server_cert.vtc. Must be backported as far as 2.2.
2021-02-01 14:31:00 +00:00
shell {
printf "set ssl cert ${testdir}/common.pem <<\n$(cat ${testdir}/common.pem)\n\n" | socat "${tmpdir}/h1/stats" -
echo "abort ssl cert ${testdir}/common.pem" | socat "${tmpdir}/h1/stats" -
}
haproxy h1 -cli {
send "show ssl cert ${testdir}/common.pem"
expect ~ ".*SHA1 FingerPrint: A490D069DBAFBEE66DE434BEC34030ADE8BCCBF1"
}
BUG/MINOR: ssl: Fix update of default certificate The default SSL_CTX used by a specific frontend is the one of the first ckch instance created for this frontend. If this instance has SNIs, then the SSL context is linked to the instance through the list of SNIs contained in it. If the instance does not have any SNIs though, then the SSL_CTX is only referenced by the bind_conf structure and the instance itself has no link to it. When trying to update a certificate used by the default instance through a cli command, a new version of the default instance was rebuilt but the default SSL context referenced in the bind_conf structure would not be changed, resulting in a buggy behavior in which depending on the SNI used by the client, he could either use the new version of the updated certificate or the original one. This patch adds a reference to the default SSL context in the default ckch instances so that it can be hot swapped during a certificate update. This should fix GitHub issue #1143. It can be backported as far as 2.2.
2021-03-17 13:56:54 +00:00
# The following requests are aimed at a backend that uses the set_default_cert.crt-list file
# Uses the www.test1.com sni
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.http.X-SSL-Server-SHA1 == "9DC18799428875976DDE706E9956035EE88A4CB3"
expect resp.status == 200
} -run
# Uses the other.test1.com sni and the default line of the crt-list
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.http.X-SSL-Server-SHA1 == "9DC18799428875976DDE706E9956035EE88A4CB3"
expect resp.status == 200
} -run
shell {
printf "set ssl cert ${testdir}/set_default_cert.pem <<\n$(cat ${testdir}/common.pem)\n\n" | socat "${tmpdir}/h1/stats" -
}
# Certificate should not have changed yet
haproxy h1 -cli {
send "show ssl cert ${testdir}/set_default_cert.pem"
expect ~ ".*SHA1 FingerPrint: 9DC18799428875976DDE706E9956035EE88A4CB3"
}
shell {
echo "commit ssl cert ${testdir}/set_default_cert.pem" | socat "${tmpdir}/h1/stats" -
}
haproxy h1 -cli {
send "show ssl cert ${testdir}/set_default_cert.pem"
expect ~ ".*SHA1 FingerPrint: 2195C9F0FD58470313013FC27C1B9CF9864BD1C6"
}
# Uses the www.test1.com sni
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.http.X-SSL-Server-SHA1 == "2195C9F0FD58470313013FC27C1B9CF9864BD1C6"
expect resp.status == 200
} -run
# Uses the other.test1.com sni and the default line of the crt-list
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.http.X-SSL-Server-SHA1 == "2195C9F0FD58470313013FC27C1B9CF9864BD1C6"
expect resp.status == 200
} -run
# Restore original certificate
shell {
printf "set ssl cert ${testdir}/set_default_cert.pem <<\n$(cat ${testdir}/set_default_cert.pem)\n\n" | socat "${tmpdir}/h1/stats" -
echo "commit ssl cert ${testdir}/set_default_cert.pem" | socat "${tmpdir}/h1/stats" -
}
haproxy h1 -cli {
send "show ssl cert ${testdir}/set_default_cert.pem"
expect ~ ".*SHA1 FingerPrint: 9DC18799428875976DDE706E9956035EE88A4CB"
}
# Uses the www.test1.com sni
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.http.X-SSL-Server-SHA1 == "9DC18799428875976DDE706E9956035EE88A4CB3"
expect resp.status == 200
} -run
# Uses the other.test1.com sni and the default line of the crt-list
client c1 -connect ${h1_clearlst_sock} {
txreq
rxresp
expect resp.http.X-SSL-Server-SHA1 == "9DC18799428875976DDE706E9956035EE88A4CB3"
expect resp.status == 200
} -run