REGTESTS: ssl: Add test for "generate-certificates" SSL option
The 'generate-certificates' bind line option that allows to create server certificates on-the-fly for newly used SNIs was not tested yet.
This commit is contained in:
Remi Tricot-Le Breton
William Lallemand
parent
c11e7e1d94
commit
3f269bb370
|
|
@ -0,0 +1,23 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIICOjCCAcCgAwIBAgIUf+VQOeilN1b1jiOroaMItFRozf8wCgYIKoZIzj0EAwIw
|
||||
VDELMAkGA1UEBhMCRlIxEzARBgNVBAgMClNvbWUtU3RhdGUxHTAbBgNVBAoMFEhB
|
||||
UHJveHkgVGVjaG5vbG9naWVzMREwDwYDVQQDDAhFQ0RTQSBDQTAeFw0yMjAxMTIx
|
||||
NDAzNTlaFw00OTA1MzAxNDAzNTlaMFQxCzAJBgNVBAYTAkZSMRMwEQYDVQQIDApT
|
||||
b21lLVN0YXRlMR0wGwYDVQQKDBRIQVByb3h5IFRlY2hub2xvZ2llczERMA8GA1UE
|
||||
AwwIRUNEU0EgQ0EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARyx1wAgb1/fuAflF73
|
||||
j3Z1intP7+11kGtVZ1EAKd//xqtxFuJ+98/gc5cpiOBMWcn6FyEZ+GShTpQeqsFs
|
||||
2C4k0LTtKadXwuQaIs05QMpahTN2vmc6LPgzOrEJxFafjdejUzBRMB0GA1UdDgQW
|
||||
BBTX2Q6ojJB88kEKjdnoufDv8TGphzAfBgNVHSMEGDAWgBTX2Q6ojJB88kEKjdno
|
||||
ufDv8TGphzAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA2gAMGUCMQCLVP3+
|
||||
dvfS2k6GYplmmkyC7YVlmNre5gZwIE9zYDDvKDxsS95oqXLT5dTVm9W0MhACMAgB
|
||||
D9uOlqoGaHbRGBE8wlV33bVdpzD6JEqVyGCdEtdCW4T5Vsg3pAsUiG2tPWQ2LA==
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN EC PARAMETERS-----
|
||||
BgUrgQQAIg==
|
||||
-----END EC PARAMETERS-----
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MIGkAgEBBDDosJpJuqxVdp/wuJYM1k2OTK8Pri+ChDRVlDySnHYP92aFT0GXX8A5
|
||||
X5rLNDtbaCGgBwYFK4EEACKhZANiAARyx1wAgb1/fuAflF73j3Z1intP7+11kGtV
|
||||
Z1EAKd//xqtxFuJ+98/gc5cpiOBMWcn6FyEZ+GShTpQeqsFs2C4k0LTtKadXwuQa
|
||||
Is05QMpahTN2vmc6LPgzOrEJxFafjdc=
|
||||
-----END EC PRIVATE KEY-----
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIBujCCAV8CAQEwCgYIKoZIzj0EAwIwWDELMAkGA1UEBhMCRlIxEzARBgNVBAgM
|
||||
ClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDER
|
||||
MA8GA1UEAwwIRUNEU0EgQ0EwHhcNMjIwMjA4MTU0MjMxWhcNNDkwNjI2MTU0MjMx
|
||||
WjBcMQswCQYDVQQGEwJGUjETMBEGA1UECAwKU29tZS1TdGF0ZTEdMBsGA1UECgwU
|
||||
SEFQcm94eSBUZWNobm9sb2dpZXMxGTAXBgNVBAMMEHNlcnZlci5lY2RzYS5jb20w
|
||||
djAQBgcqhkjOPQIBBgUrgQQAIgNiAARXlODrnr208aoToRb8MqTp4GYgnk9V4LJ5
|
||||
XE8HyM7EWbqx46PdUpLUseFOtF/Yr9nyzMcdd6GNZrHkgM2NaQ/13tTbLJ84wXRQ
|
||||
jS9FSqFmDmmgbEARiyEf0K8D9lxI0bgwCgYIKoZIzj0EAwIDSQAwRgIhAJlwV5oJ
|
||||
Uz4nYUEWIrgFd7de5GZseFBIbW+UWr17Ip6gAiEAhrVEpmd4Tl5JPTwQznPa6ZlJ
|
||||
Zc8S6ipcwXPCJzsSOnQ=
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDD6ONh7kiRD6TxwQGIa
|
||||
bY5kUclHcPXiWO1QNscmeVtObmTKYiVcRR+Mj4tNRXWH6lyhZANiAARXlODrnr20
|
||||
8aoToRb8MqTp4GYgnk9V4LJ5XE8HyM7EWbqx46PdUpLUseFOtF/Yr9nyzMcdd6GN
|
||||
ZrHkgM2NaQ/13tTbLJ84wXRQjS9FSqFmDmmgbEARiyEf0K8D9lxI0bg=
|
||||
-----END PRIVATE KEY-----
|
||||
|
|
@ -0,0 +1,168 @@
|
|||
#REGTEST_TYPE=devel
|
||||
|
||||
# This reg-test checks that the 'generate-certificates' SSL option works
|
||||
# properly. This option allows to generate server-side certificates on the fly
|
||||
# for clients that use an SNI for which no certificate was specified in the
|
||||
# configuration file.
|
||||
# This test also aims at checking that the 'generate-certificates' and the
|
||||
# 'ecdhe' bind options work correctly together.
|
||||
# Any bind line having a 'generate-certificates' needs to have a ca-sign-file
|
||||
# option as well that specifies the path to a CA pem file (containing a
|
||||
# certificate as well as its private key). For this reason, a new
|
||||
# ssl_gen_ca.pem CA certificate was created, along with the ssl_gen_server.pem
|
||||
# server certificate signed by the CA. This server certificate will be used as
|
||||
# a default certificate and will serve as a base for any newly created
|
||||
# certificate.
|
||||
|
||||
varnishtest "Test the 'generate-certificates' SSL option"
|
||||
feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
|
||||
feature cmd "command -v openssl && command -v grep"
|
||||
feature ignore_unknown_macro
|
||||
|
||||
server s1 -repeat 6 {
|
||||
rxreq
|
||||
txresp
|
||||
} -start
|
||||
|
||||
|
||||
haproxy h1 -conf {
|
||||
global
|
||||
tune.ssl.default-dh-param 2048
|
||||
tune.ssl.capture-buffer-size 2048
|
||||
|
||||
defaults
|
||||
mode http
|
||||
option httpslog
|
||||
log stderr local0 debug err
|
||||
option logasap
|
||||
timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||
timeout client "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||
timeout server "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||
option httpslog
|
||||
|
||||
listen clear-lst
|
||||
bind "fd@${clearlst}"
|
||||
http-request set-var(sess.sni) hdr(x-sni)
|
||||
|
||||
use_backend P-384_backend if { path /P-384 }
|
||||
default_backend default_backend
|
||||
|
||||
backend default_backend
|
||||
server s1 "${tmpdir}/ssl.sock" ssl verify none ssl-max-ver TLSv1.2 sni var(sess.sni)
|
||||
|
||||
backend P-384_backend
|
||||
server s1 "${tmpdir}/ssl_P-384.sock" ssl verify none ssl-max-ver TLSv1.2 sni var(sess.sni)
|
||||
|
||||
listen ssl-lst
|
||||
bind "${tmpdir}/ssl.sock" ssl generate-certificates crt ${testdir}/generate_certificates/gen_cert_server.pem ca-sign-file ${testdir}/generate_certificates/gen_cert_ca.pem ca-file ${testdir}/generate_certificates/gen_cert_ca.pem verify optional
|
||||
http-response add-header x-ssl-s_dn %[ssl_f_s_dn(CN)]
|
||||
http-response add-header x-ssl-i_dn %[ssl_f_i_dn(CN)]
|
||||
http-response add-header x-ssl-sig_alg %[ssl_f_sig_alg]
|
||||
http-response add-header x-ssl-key_alg %[ssl_f_key_alg]
|
||||
http-response add-header x-ssl-sha1 %[ssl_f_sha1,hex]
|
||||
|
||||
server s1 ${s1_addr}:${s1_port}
|
||||
|
||||
listen ssl-lst-P-384
|
||||
bind "${tmpdir}/ssl_P-384.sock" ssl generate-certificates crt ${testdir}/generate_certificates/gen_cert_server.pem ca-sign-file ${testdir}/generate_certificates/gen_cert_ca.pem ca-file ${testdir}/generate_certificates/gen_cert_ca.pem verify optional ecdhe secp384r1
|
||||
http-response add-header x-ssl-s_dn %[ssl_f_s_dn(CN)]
|
||||
http-response add-header x-ssl-i_dn %[ssl_f_i_dn(CN)]
|
||||
http-response add-header x-ssl-sig_alg %[ssl_f_sig_alg]
|
||||
http-response add-header x-ssl-key_alg %[ssl_f_key_alg]
|
||||
http-response add-header x-ssl-sha1 %[ssl_f_sha1,hex]
|
||||
|
||||
server s1 ${s1_addr}:${s1_port}
|
||||
|
||||
} -start
|
||||
|
||||
# Use default certificate
|
||||
client c1 -connect ${h1_clearlst_sock} {
|
||||
txreq
|
||||
rxresp
|
||||
expect resp.status == 200
|
||||
expect resp.http.x-ssl-sig_alg == "ecdsa-with-SHA256"
|
||||
expect resp.http.x-ssl-i_dn == "ECDSA CA"
|
||||
expect resp.http.x-ssl-s_dn == "server.ecdsa.com"
|
||||
expect resp.http.x-ssl-key_alg == "id-ecPublicKey"
|
||||
expect resp.http.x-ssl-sha1 == "66AC64728CEA0C1F614A89C278FA2F94EDE9AB11"
|
||||
} -run
|
||||
|
||||
|
||||
# Use default certificate's sni
|
||||
client c2 -connect ${h1_clearlst_sock} {
|
||||
txreq -hdr "x-sni: server.ecdsa.com"
|
||||
rxresp
|
||||
expect resp.status == 200
|
||||
expect resp.http.x-ssl-sig_alg == "ecdsa-with-SHA256"
|
||||
expect resp.http.x-ssl-i_dn == "ECDSA CA"
|
||||
expect resp.http.x-ssl-s_dn == "server.ecdsa.com"
|
||||
expect resp.http.x-ssl-key_alg == "id-ecPublicKey"
|
||||
expect resp.http.x-ssl-sha1 == "66AC64728CEA0C1F614A89C278FA2F94EDE9AB11"
|
||||
} -run
|
||||
|
||||
|
||||
|
||||
# Use another SNI - the server certificate should be generated and different
|
||||
# than the default one
|
||||
client c3 -connect ${h1_clearlst_sock} {
|
||||
txreq -hdr "x-sni: unknown-sni.com"
|
||||
rxresp
|
||||
expect resp.status == 200
|
||||
expect resp.http.x-ssl-sig_alg == "ecdsa-with-SHA256"
|
||||
expect resp.http.x-ssl-i_dn == "ECDSA CA"
|
||||
expect resp.http.x-ssl-s_dn == "ECDSA CA"
|
||||
expect resp.http.x-ssl-key_alg == "id-ecPublicKey"
|
||||
expect resp.http.x-ssl-sha1 != "66AC64728CEA0C1F614A89C278FA2F94EDE9AB11"
|
||||
} -run
|
||||
|
||||
|
||||
# Use default certificate
|
||||
client c4 -connect ${h1_clearlst_sock} {
|
||||
txreq -url "/P-384"
|
||||
rxresp
|
||||
expect resp.status == 200
|
||||
expect resp.http.x-ssl-sig_alg == "ecdsa-with-SHA256"
|
||||
expect resp.http.x-ssl-i_dn == "ECDSA CA"
|
||||
expect resp.http.x-ssl-s_dn == "server.ecdsa.com"
|
||||
expect resp.http.x-ssl-key_alg == "id-ecPublicKey"
|
||||
expect resp.http.x-ssl-sha1 == "66AC64728CEA0C1F614A89C278FA2F94EDE9AB11"
|
||||
} -run
|
||||
|
||||
|
||||
# Use default certificate's sni
|
||||
client c5 -connect ${h1_clearlst_sock} {
|
||||
txreq -url "/P-384" -hdr "x-sni: server.ecdsa.com"
|
||||
rxresp
|
||||
expect resp.status == 200
|
||||
expect resp.http.x-ssl-sig_alg == "ecdsa-with-SHA256"
|
||||
expect resp.http.x-ssl-i_dn == "ECDSA CA"
|
||||
expect resp.http.x-ssl-s_dn == "server.ecdsa.com"
|
||||
expect resp.http.x-ssl-key_alg == "id-ecPublicKey"
|
||||
expect resp.http.x-ssl-sha1 == "66AC64728CEA0C1F614A89C278FA2F94EDE9AB11"
|
||||
} -run
|
||||
|
||||
|
||||
# Use another SNI - the server certificate should be generated and different
|
||||
# than the default one
|
||||
client c6 -connect ${h1_clearlst_sock} {
|
||||
txreq -url "/P-384" -hdr "x-sni: unknown-sni.com"
|
||||
rxresp
|
||||
expect resp.status == 200
|
||||
expect resp.http.x-ssl-sig_alg == "ecdsa-with-SHA256"
|
||||
expect resp.http.x-ssl-i_dn == "ECDSA CA"
|
||||
expect resp.http.x-ssl-s_dn == "ECDSA CA"
|
||||
expect resp.http.x-ssl-key_alg == "id-ecPublicKey"
|
||||
expect resp.http.x-ssl-sha1 != "66AC64728CEA0C1F614A89C278FA2F94EDE9AB11"
|
||||
} -run
|
||||
|
||||
# Check that the curves that the server accepts to use correspond to what we
|
||||
# expect it to be (according to ecdhe option).
|
||||
# The curve with the highest priority is X25519 for OpenSSL 1.1.1 and later,
|
||||
# and P-256 for OpenSSL 1.0.2.
|
||||
shell {
|
||||
echo "Q" | openssl s_client -unix "${tmpdir}/ssl.sock" -servername server.ecdsa.com -tls1_2 2>/dev/null | grep -E "Server Temp Key: (ECDH, P-256, 256 bits|X25519, 253 bits)"
|
||||
}
|
||||
|
||||
shell {
|
||||
echo "Q" | openssl s_client -unix "${tmpdir}/ssl_P-384.sock" -servername server.ecdsa.com 2>/dev/null| grep "Server Temp Key: ECDH, P-384, 384 bits"
|
||||
}
|
||||
Loading…
Reference in New Issue