Skip to content

Commit d867989

Browse files
bavshin-f5bavshin-f5
committed
Tests: ACME client tests.
1 parent b34480c commit d867989

File tree

11 files changed

+1308
-2
lines changed

11 files changed

+1308
-2
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,19 +81,30 @@ jobs:
8181
toolchain: ${{ matrix.rust-version }}
8282
components: clippy, rustfmt
8383

84+
- uses: perl-actions/install-with-cpm@8b1a9840b26cc3885ae2889749a48629be2501b0 # v1.9
85+
with:
86+
install: IO::Socket::SSL
87+
8488
- uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
8589
with:
8690
path: |
8791
~/.cargo/bin/
8892
~/.cargo/registry/index/
8993
~/.cargo/registry/cache/
9094
~/.cargo/git/db/
95+
bin/pebble
9196
nginx/objs/**/CACHEDIR.TAG
9297
nginx/objs/**/ngx-debug
9398
nginx/objs/**/ngx-release
99+
target/
94100
key: ${{ runner.os }}-nginx-${{ hashFiles('**/Cargo.lock') }}
95101
restore-keys: ${{ runner.os }}-nginx-
96102

103+
- name: download pebble
104+
run: |
105+
build/get-pebble.sh
106+
echo TEST_NGINX_PEBBLE_BINARY="$PWD/bin/pebble" >> "$GITHUB_ENV"
107+
97108
- name: build
98109
id: build
99110
run: make BUILD=${{ matrix.build }} -j $(nproc) build

‎.github/workflows/sanitizers.yaml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ env:
1515
cargo rust-src rustfmt
1616
clang compiler-rt llvm
1717
git-core
18-
make patch
18+
make openssl patch which
19+
perl-Digest-SHA
1920
perl-FindBin
2021
perl-IO-Socket-SSL
2122
perl-Test-Harness
@@ -56,12 +57,18 @@ jobs:
5657
~/.cargo/registry/index/
5758
~/.cargo/registry/cache/
5859
~/.cargo/git/db/
60+
bin/pebble
5961
nginx/objs/**/CACHEDIR.TAG
6062
nginx/objs/**/ngx-debug
6163
nginx/objs/**/ngx-release
6264
key: ${{ runner.os }}-cargo-asan-${{ hashFiles('**/Cargo.lock') }}
6365
restore-keys: ${{ runner.os }}-cargo-asan-
6466

67+
- name: download pebble
68+
run: |
69+
build/get-pebble.sh
70+
echo TEST_NGINX_PEBBLE_BINARY="$PWD/bin/pebble" >> "$GITHUB_ENV"
71+
6572
- name: Configure and build nginx
6673
run: |
6774
make -j$(nproc) BUILD=sanitize build
@@ -75,4 +82,4 @@ jobs:
7582
TEST_NGINX_GLOBALS: >-
7683
user root;
7784
run: |
78-
make -j$(nproc) BUILD=sanitize test
85+
make -j$(nproc) BUILD=sanitize TEST_PREREQ= test

‎build/get-pebble.sh‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/bin/sh
2+
3+
set -e
4+
5+
VERSION="${1:-2.8.0}"
6+
SHA256SUM="$2"
7+
TARGET=${3:-$PWD/bin/pebble}
8+
9+
SHA256SUM_darwin_amd64=9b9625651f8ce47706235179503fec149f8f38bce2b2554efe8c0f2a021f877c
10+
SHA256SUM_darwin_arm64=39e07d63dc776521f2ffe0584e5f4f081c984ac02742c882b430891d89f0c866
11+
SHA256SUM_linux_amd64=34595d915bbc2fc827affb3f58593034824df57e95353b031c8d5185724485ce
12+
SHA256SUM_linux_arm64=0e70f2537353f61cbf06aa54740bf7f7bb5f963ba00e909f23af5f85bc13fd1a
13+
14+
if "$TARGET" -version | grep "$VERSION"; then
15+
exit 0
16+
fi
17+
18+
SYSTEM=$(uname -s | tr "[:upper:]" "[:lower:]")
19+
MACHINE=$(uname -m)
20+
case "$MACHINE" in
21+
aarch64)
22+
MACHINE=arm64;;
23+
x86_64)
24+
MACHINE=amd64;;
25+
esac
26+
27+
if [ -z "$SHA256SUM" ]; then
28+
eval "SHA256SUM=\$SHA256SUM_${SYSTEM}_${MACHINE}"
29+
fi
30+
31+
if echo "$SHA256SUM $TARGET" | shasum -a 256 -c; then
32+
exit 0;
33+
fi
34+
35+
PREFIX="pebble-${SYSTEM}-${MACHINE}"
36+
37+
WORKDIR=$(mktemp -d)
38+
trap 'rm -rf "$WORKDIR"' EXIT
39+
40+
cd "$WORKDIR"
41+
42+
curl -L -o "$PREFIX.tar.gz" \
43+
"https://github.com/letsencrypt/pebble/releases/download/v${VERSION}/${PREFIX}.tar.gz"
44+
45+
if ! echo "$SHA256SUM $PREFIX.tar.gz" | shasum -a 256 -c; then
46+
echo "checksum mismatch"
47+
exit 1;
48+
fi
49+
50+
tar -xzf "$PREFIX.tar.gz"
51+
52+
mkdir -p "$(dirname "$TARGET")"
53+
mv "$PREFIX/$SYSTEM/$MACHINE/pebble" "$TARGET"
54+
chmod +x "$TARGET"

‎t/acme_http.t‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
#!/usr/bin/perl
2+
3+
# (C) Aleksei Bavshin
4+
# (C) Nginx, Inc.
5+
6+
# Tests for ACME client: HTTP-01 challenge.
7+
8+
###############################################################################
9+
10+
use warnings;
11+
use strict;
12+
13+
use Test::More;
14+
15+
use IO::Select;
16+
17+
BEGIN { use FindBin; chdir($FindBin::Bin); }
18+
19+
use lib 'lib';
20+
use Test::Nginx;
21+
use Test::Nginx::ACME;
22+
use Test::Nginx::DNS;
23+
24+
###############################################################################
25+
26+
select STDERR; $| = 1;
27+
select STDOUT; $| = 1;
28+
29+
my $t = Test::Nginx->new()->has(qw/http http_ssl socket_ssl/)
30+
->has_daemon('openssl');
31+
32+
$t->write_file_expand('nginx.conf', <<'EOF');
33+
34+
%%TEST_GLOBALS%%
35+
36+
daemon off;
37+
38+
events {
39+
}
40+
41+
http {
42+
%%TEST_GLOBALS_HTTP%%
43+
44+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
45+
46+
acme_issuer default {
47+
uri https://acme.test:%%PORT_9000%%/dir;
48+
ssl_trusted_certificate acme.test.crt;
49+
state_path %%TESTDIR%%;
50+
accept_terms_of_service;
51+
}
52+
53+
server {
54+
listen 127.0.0.1:8080;
55+
server_name example.test;
56+
}
57+
58+
server {
59+
listen 127.0.0.1:8443 ssl;
60+
server_name example.test;
61+
62+
acme_certificate default;
63+
64+
ssl_certificate $acme_certificate;
65+
ssl_certificate_key $acme_certificate_key;
66+
}
67+
}
68+
69+
EOF
70+
71+
$t->write_file('openssl.conf', <<EOF);
72+
[ req ]
73+
default_bits = 2048
74+
encrypt_key = no
75+
distinguished_name = req_distinguished_name
76+
[ req_distinguished_name ]
77+
EOF
78+
79+
my $d = $t->testdir();
80+
81+
foreach my $name ('acme.test') {
82+
system('openssl req -x509 -new '
83+
. "-config $d/openssl.conf -subj /CN=$name/ "
84+
. "-out $d/$name.crt -keyout $d/$name.key "
85+
. ">>$d/openssl.out 2>&1") == 0
86+
or die "Can't create certificate for $name: $!\n";
87+
}
88+
89+
my $dp = port(8980, udp=>1);
90+
my @dc = (
91+
{ name => 'acme.test', A => '127.0.0.1' },
92+
{ name => 'example.test', A => '127.0.0.1' }
93+
);
94+
95+
my $acme = Test::Nginx::ACME->new($t, port(9000), port(9001),
96+
$t->testdir . '/acme.test.crt',
97+
$t->testdir . '/acme.test.key',
98+
http_port => port(8080),
99+
tls_port => port(8443),
100+
dns_port => $dp,
101+
nosleep => 1,
102+
validity => 60,
103+
);
104+
105+
$t->run_daemon(\&Test::Nginx::DNS::dns_test_daemon, $t, $dp, \@dc);
106+
$t->waitforfile($t->testdir . '/' . $dp);
107+
108+
$t->run_daemon(\&Test::Nginx::ACME::acme_test_daemon, $t, $acme);
109+
$t->waitforsocket('127.0.0.1:' . $acme->port());
110+
$t->write_file('acme-root.crt', $acme->trusted_ca());
111+
112+
$t->write_file('index.html', 'SUCCESS');
113+
$t->plan(1)->run();
114+
115+
###############################################################################
116+
117+
$acme->wait_certificate('example.test') or die "no certificate";
118+
119+
like(get(8443, 'example.test', 'acme-root'), qr/SUCCESS/, 'tls request');
120+
121+
###############################################################################
122+
123+
sub get {
124+
my ($port, $host, $ca) = @_;
125+
126+
$ca = undef if $IO::Socket::SSL::VERSION < 2.062
127+
|| !eval { Net::SSLeay::X509_V_FLAG_PARTIAL_CHAIN() };
128+
129+
http_get('/',
130+
PeerAddr => '127.0.0.1:' . port($port),
131+
SSL => 1,
132+
$ca ? (
133+
SSL_ca_file => "$d/$ca.crt",
134+
SSL_verifycn_name => $host,
135+
SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_PEER(),
136+
) : ()
137+
);
138+
}
139+
140+
###############################################################################

0 commit comments

Comments
 (0)