Skip to content

Commit 56d02c7

Browse files
pluknetpluknet
committed
Tests: protocol selection with SNI.
1 parent af39716 commit 56d02c7

File tree

2 files changed

+221
-0
lines changed

2 files changed

+221
-0
lines changed

‎ssl_sni_protocols.t‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Sergey Kandaurov
4+
# (C) Nginx, Inc.
5+
6+
# Tests for SSL/TLS protocol selection with SNI.
7+
8+
###############################################################################
9+
10+
use warnings;
11+
use strict;
12+
13+
use Test::More;
14+
15+
BEGIN { use FindBin; chdir($FindBin::Bin); }
16+
17+
use lib 'lib';
18+
use Test::Nginx;
19+
20+
###############################################################################
21+
22+
select STDERR; $| = 1;
23+
select STDOUT; $| = 1;
24+
25+
my $t = Test::Nginx->new()->has(qw/http http_ssl openssl:1.1.1 socket_ssl_sni/)
26+
->has_daemon('openssl')->plan(4)
27+
->write_file_expand('nginx.conf', <<'EOF');
28+
29+
%%TEST_GLOBALS%%
30+
31+
daemon off;
32+
33+
events {
34+
}
35+
36+
http {
37+
%%TEST_GLOBALS_HTTP%%
38+
39+
ssl_certificate localhost.crt;
40+
ssl_certificate_key localhost.key;
41+
42+
server {
43+
listen 127.0.0.1:8443 ssl default_server;
44+
listen 127.0.0.1:8444 ssl;
45+
server_name one;
46+
47+
ssl_protocols TLSv1.2;
48+
49+
add_header X-SSL $ssl_protocol;
50+
}
51+
52+
server {
53+
listen 127.0.0.1:8443;
54+
listen 127.0.0.1:8444 default_server;
55+
server_name two;
56+
57+
ssl_protocols TLSv1.3;
58+
59+
add_header X-SSL $ssl_protocol;
60+
}
61+
}
62+
63+
EOF
64+
65+
$t->write_file('openssl.conf', <<EOF);
66+
[ req ]
67+
default_bits = 2048
68+
encrypt_key = no
69+
distinguished_name = req_distinguished_name
70+
[ req_distinguished_name ]
71+
EOF
72+
73+
my $d = $t->testdir();
74+
75+
foreach my $name ('localhost') {
76+
system('openssl req -x509 -new '
77+
. "-config $d/openssl.conf -subj /CN=$name/ "
78+
. "-out $d/$name.crt -keyout $d/$name.key "
79+
. ">>$d/openssl.out 2>&1") == 0
80+
or die "Can't create certificate for $name: $!\n";
81+
}
82+
83+
$t->write_file('index.html', '');
84+
$t->run();
85+
86+
###############################################################################
87+
88+
like(get('one', 8443), qr!TLSv1.2!, 'default server - TLSv1.2');
89+
like(get('two', 8444), qr!TLSv1.3!, 'default server - TLSv1.3');
90+
91+
TODO: {
92+
local $TODO = 'not yet' unless $t->has_version('1.29.2');
93+
94+
like(get('two', 8443), qr!TLSv1.3!, 'protocol change - TLSv1.3');
95+
like(get('one', 8444), qr!TLSv1.2!, 'protocol change - TLSv1.2');
96+
97+
}
98+
99+
###############################################################################
100+
101+
sub get {
102+
my ($host, $port) = @_;
103+
return http(
104+
"GET / HTTP/1.0\nHost: $host\n\n",
105+
PeerAddr => '127.0.0.1:' . port($port),
106+
SSL => 1,
107+
SSL_hostname => $host
108+
);
109+
}
110+
111+
###############################################################################

‎stream_ssl_sni_protocols.t‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Sergey Kandaurov
4+
# (C) Nginx, Inc.
5+
6+
# Tests for SSL/TLS protocol selection with SNI.
7+
8+
###############################################################################
9+
10+
use warnings;
11+
use strict;
12+
13+
use Test::More;
14+
15+
BEGIN { use FindBin; chdir($FindBin::Bin); }
16+
17+
use lib 'lib';
18+
use Test::Nginx;
19+
20+
###############################################################################
21+
22+
select STDERR; $| = 1;
23+
select STDOUT; $| = 1;
24+
25+
my $t = Test::Nginx->new()
26+
->has(qw/stream stream_ssl stream_return openssl:1.1.1 socket_ssl_sni/)
27+
->has_daemon('openssl')->plan(4)
28+
->write_file_expand('nginx.conf', <<'EOF');
29+
30+
%%TEST_GLOBALS%%
31+
32+
daemon off;
33+
34+
events {
35+
}
36+
37+
stream {
38+
%%TEST_GLOBALS_STREAM%%
39+
40+
ssl_certificate localhost.crt;
41+
ssl_certificate_key localhost.key;
42+
43+
server {
44+
listen 127.0.0.1:8443 ssl default_server;
45+
listen 127.0.0.1:8444 ssl;
46+
server_name one;
47+
48+
ssl_protocols TLSv1.2;
49+
50+
return "X-SSL $ssl_protocol";
51+
}
52+
53+
server {
54+
listen 127.0.0.1:8443;
55+
listen 127.0.0.1:8444 default_server;
56+
server_name two;
57+
58+
ssl_protocols TLSv1.3;
59+
60+
return "X-SSL $ssl_protocol";
61+
}
62+
}
63+
64+
EOF
65+
66+
$t->write_file('openssl.conf', <<EOF);
67+
[ req ]
68+
default_bits = 2048
69+
encrypt_key = no
70+
distinguished_name = req_distinguished_name
71+
[ req_distinguished_name ]
72+
EOF
73+
74+
my $d = $t->testdir();
75+
76+
foreach my $name ('localhost') {
77+
system('openssl req -x509 -new '
78+
. "-config $d/openssl.conf -subj /CN=$name/ "
79+
. "-out $d/$name.crt -keyout $d/$name.key "
80+
. ">>$d/openssl.out 2>&1") == 0
81+
or die "Can't create certificate for $name: $!\n";
82+
}
83+
84+
$t->run();
85+
86+
###############################################################################
87+
88+
like(get('one', 8443), qr!TLSv1.2!, 'default server - TLSv1.2');
89+
like(get('two', 8444), qr!TLSv1.3!, 'default server - TLSv1.3');
90+
91+
TODO: {
92+
local $TODO = 'not yet' unless $t->has_version('1.29.2');
93+
94+
like(get('two', 8443), qr!TLSv1.3!, 'protocol change - TLSv1.3');
95+
like(get('one', 8444), qr!TLSv1.2!, 'protocol change - TLSv1.2');
96+
97+
}
98+
99+
###############################################################################
100+
101+
sub get {
102+
my ($host, $port) = @_;
103+
return http('',
104+
PeerAddr => '127.0.0.1:' . port($port),
105+
SSL => 1,
106+
SSL_hostname => $host
107+
);
108+
}
109+
110+
###############################################################################

0 commit comments

Comments
 (0)