Skip to content

Commit 57a7bd4

Browse files
bavshin-f5bavshin-f5
committed
Tests: ACME client tests.
1 parent 8970dab commit 57a7bd4

File tree

8 files changed

+1234
-0
lines changed

8 files changed

+1234
-0
lines changed

‎t/acme_http.t‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Aleksei Bavshin
4+
# (C) Nginx, Inc.
5+
6+
# Tests for ACME client: HTTP-01 challenge.
7+
8+
###############################################################################
9+
10+
use warnings;
11+
use strict;
12+
13+
use Test::More;
14+
15+
use IO::Select;
16+
17+
BEGIN { use FindBin; chdir($FindBin::Bin); }
18+
19+
use lib 'lib';
20+
use Test::Nginx;
21+
use Test::Nginx::ACME;
22+
use Test::Nginx::DNS;
23+
24+
###############################################################################
25+
26+
select STDERR; $| = 1;
27+
select STDOUT; $| = 1;
28+
29+
my $t = Test::Nginx->new()->has(qw/http socket_ssl/)
30+
->has_daemon('openssl')->has_daemon('pebble');
31+
32+
$t->write_file_expand('nginx.conf', <<'EOF');
33+
34+
%%TEST_GLOBALS%%
35+
36+
daemon off;
37+
38+
events {
39+
}
40+
41+
http {
42+
%%TEST_GLOBALS_HTTP%%
43+
44+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
45+
46+
acme_issuer default {
47+
uri https://acme.test:%%PORT_9000%%/dir;
48+
ssl_trusted_certificate acme.test.crt;
49+
state_path %%TESTDIR%%;
50+
accept_terms_of_service;
51+
}
52+
53+
server {
54+
listen 127.0.0.1:8080;
55+
server_name example.test;
56+
}
57+
58+
server {
59+
listen 127.0.0.1:8443 ssl;
60+
server_name example.test;
61+
62+
acme_certificate default;
63+
64+
ssl_certificate $acme_certificate;
65+
ssl_certificate_key $acme_certificate_key;
66+
}
67+
}
68+
69+
EOF
70+
71+
$t->write_file('openssl.conf', <<EOF);
72+
[ req ]
73+
default_bits = 2048
74+
encrypt_key = no
75+
distinguished_name = req_distinguished_name
76+
[ req_distinguished_name ]
77+
EOF
78+
79+
my $d = $t->testdir();
80+
81+
foreach my $name ('acme.test') {
82+
system('openssl req -x509 -new '
83+
. "-config $d/openssl.conf -subj /CN=$name/ "
84+
. "-out $d/$name.crt -keyout $d/$name.key "
85+
. ">>$d/openssl.out 2>&1") == 0
86+
or die "Can't create certificate for $name: $!\n";
87+
}
88+
89+
my $dp = port(8980, udp=>1);
90+
my @dc = (
91+
{ name => 'acme.test', A => '127.0.0.1' },
92+
{ name => 'example.test', A => '127.0.0.1' }
93+
);
94+
95+
my $acme = Test::Nginx::ACME->new($t, port(9000), port(9001),
96+
$t->testdir . '/acme.test.crt',
97+
$t->testdir . '/acme.test.key',
98+
http_port => port(8080),
99+
tls_port => port(8443),
100+
dns_port => $dp,
101+
nosleep => 1,
102+
validity => 60,
103+
);
104+
105+
$t->run_daemon(\&Test::Nginx::DNS::dns_test_daemon, $t, $dp, \@dc);
106+
$t->waitforfile($t->testdir . '/' . $dp);
107+
108+
$t->run_daemon(\&Test::Nginx::ACME::acme_test_daemon, $t, $acme);
109+
$t->waitforsocket('127.0.0.1:' . $acme->port());
110+
$t->write_file('acme-root.crt', $acme->trusted_ca());
111+
112+
$t->write_file('index.html', 'SUCCESS');
113+
$t->plan(1)->run();
114+
115+
###############################################################################
116+
117+
$acme->wait_certificate('example.test') or die "no certificate";
118+
119+
like(get(8443, 'example.test', 'acme-root'), qr/SUCCESS/, 'tls request');
120+
121+
###############################################################################
122+
123+
sub get {
124+
my ($port, $host, $ca) = @_;
125+
126+
$ca = undef if $IO::Socket::SSL::VERSION < 2.062
127+
|| !eval { Net::SSLeay::X509_V_FLAG_PARTIAL_CHAIN() };
128+
129+
http_get('/',
130+
PeerAddr => '127.0.0.1:' . port($port),
131+
SSL => 1,
132+
SSL_hostname => $host,
133+
$ca ? (
134+
SSL_ca_file => "$d/$ca.crt",
135+
SSL_verifycn_name => $host,
136+
SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_PEER(),
137+
) : ()
138+
);
139+
}
140+
141+
###############################################################################

‎t/acme_key_type.t‎

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Aleksei Bavshin
4+
# (C) Nginx, Inc.
5+
6+
# Tests for ACME client: key algorithm configuration.
7+
8+
###############################################################################
9+
10+
use warnings;
11+
use strict;
12+
13+
use Test::More;
14+
15+
use IO::Select;
16+
17+
BEGIN { use FindBin; chdir($FindBin::Bin); }
18+
19+
use lib 'lib';
20+
use Test::Nginx;
21+
use Test::Nginx::ACME;
22+
use Test::Nginx::DNS;
23+
24+
###############################################################################
25+
26+
select STDERR; $| = 1;
27+
select STDOUT; $| = 1;
28+
29+
my $t = Test::Nginx->new()->has(qw/http http_ssl socket_ssl/)
30+
->has_daemon('openssl')->has_daemon('pebble');
31+
32+
$t->write_file_expand('nginx.conf', <<'EOF');
33+
34+
%%TEST_GLOBALS%%
35+
36+
daemon off;
37+
38+
events {
39+
}
40+
41+
http {
42+
%%TEST_GLOBALS_HTTP%%
43+
44+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
45+
46+
acme_issuer default {
47+
uri https://acme.test:%%PORT_9000%%/dir;
48+
ssl_trusted_certificate acme.test.crt;
49+
state_path %%TESTDIR%%;
50+
accept_terms_of_service;
51+
}
52+
53+
server {
54+
listen 127.0.0.1:8080;
55+
server_name .example.test;
56+
}
57+
58+
server {
59+
listen 127.0.0.1:8443 ssl;
60+
server_name ecdsa.example.test;
61+
62+
acme_certificate default
63+
ecdsa.example.test
64+
example.test
65+
key=ecdsa;
66+
67+
ssl_certificate $acme_certificate;
68+
ssl_certificate_key $acme_certificate_key;
69+
}
70+
71+
server {
72+
listen 127.0.0.1:8443 ssl;
73+
server_name rsa.example.test;
74+
75+
acme_certificate default
76+
rsa.example.test
77+
example.test
78+
key=rsa;
79+
80+
ssl_certificate $acme_certificate;
81+
ssl_certificate_key $acme_certificate_key;
82+
}
83+
}
84+
85+
EOF
86+
87+
$t->write_file('openssl.conf', <<EOF);
88+
[ req ]
89+
default_bits = 2048
90+
encrypt_key = no
91+
distinguished_name = req_distinguished_name
92+
[ req_distinguished_name ]
93+
EOF
94+
95+
my $d = $t->testdir();
96+
97+
foreach my $name ('acme.test') {
98+
system('openssl req -x509 -new '
99+
. "-config $d/openssl.conf -subj /CN=$name/ "
100+
. "-out $d/$name.crt -keyout $d/$name.key "
101+
. ">>$d/openssl.out 2>&1") == 0
102+
or die "Can't create certificate for $name: $!\n";
103+
}
104+
105+
my $dp = port(8980, udp=>1);
106+
my @dc = (
107+
{ name => 'acme.test', A => '127.0.0.1' },
108+
{ match => qr/^(\w+\.)?example.test$/, A => '127.0.0.1' }
109+
);
110+
111+
my $acme = Test::Nginx::ACME->new($t, port(9000), port(9001),
112+
$t->testdir . '/acme.test.crt',
113+
$t->testdir . '/acme.test.key',
114+
http_port => port(8080),
115+
tls_port => port(8443),
116+
dns_port => $dp,
117+
nosleep => 1,
118+
validity => 60,
119+
);
120+
121+
$t->run_daemon(\&Test::Nginx::DNS::dns_test_daemon, $t, $dp, \@dc);
122+
$t->waitforfile($t->testdir . '/' . $dp);
123+
124+
$t->run_daemon(\&Test::Nginx::ACME::acme_test_daemon, $t, $acme);
125+
$t->waitforsocket('127.0.0.1:' . $acme->port());
126+
$t->write_file('acme-root.crt', $acme->trusted_ca());
127+
128+
$t->write_file('index.html', 'SUCCESS');
129+
$t->plan(2)->run();
130+
131+
###############################################################################
132+
133+
$acme->wait_certificate('ecdsa.example.test') or die "no certificate";
134+
$acme->wait_certificate('rsa.example.test') or die "no certificate";
135+
136+
like(get(8443, 'rsa.example.test', 'acme-root', 'RSA'), qr/SUCCESS/ms,
137+
'ACME cert RSA');
138+
like(get(8443, 'ecdsa.example.test', 'acme-root', 'ECDSA'), qr/SUCCESS/ms,
139+
'ACME cert ECDSA');
140+
141+
###############################################################################
142+
143+
sub get {
144+
my ($port, $host, $ca, $type) = @_;
145+
146+
my $ctx_cb = sub {
147+
my $ctx = shift;
148+
return unless defined $type;
149+
my $ssleay = Net::SSLeay::SSLeay();
150+
return if ($ssleay < 0x1000200f || $ssleay == 0x20000000);
151+
my @sigalgs = ('RSA+SHA256:PSS+SHA256', 'RSA+SHA256');
152+
@sigalgs = ($type . '+SHA256') unless $type eq 'RSA';
153+
# SSL_CTRL_SET_SIGALGS_LIST
154+
Net::SSLeay::CTX_ctrl($ctx, 98, 0, $sigalgs[0])
155+
or Net::SSLeay::CTX_ctrl($ctx, 98, 0, $sigalgs[1])
156+
or die("Failed to set sigalgs");
157+
};
158+
159+
$ca = undef if $IO::Socket::SSL::VERSION < 2.062
160+
|| !eval { Net::SSLeay::X509_V_FLAG_PARTIAL_CHAIN() };
161+
162+
return http_get('/',
163+
PeerAddr => '127.0.0.1:' . port($port),
164+
SSL => 1,
165+
SSL_cipher_list => $type,
166+
SSL_create_ctx_callback => $ctx_cb,
167+
SSL_hostname => $host,
168+
$ca ? (
169+
SSL_ca_file => "$d/$ca.crt",
170+
SSL_verifycn_name => $host,
171+
SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_PEER(),
172+
) : (),
173+
);
174+
}
175+
176+
###############################################################################

0 commit comments

Comments
 (0)