Skip to content

Commit e9d7233

Browse files
bavshin-f5bavshin-f5
committed
Tests: ACME client tests.
1 parent a957b37 commit e9d7233

File tree

11 files changed

+1321
-2
lines changed

11 files changed

+1321
-2
lines changed

‎.github/workflows/ci.yaml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,19 +81,30 @@ jobs:
8181
toolchain: ${{ matrix.rust-version }}
8282
components: clippy, rustfmt
8383

84+
- uses: perl-actions/install-with-cpm@8b1a9840b26cc3885ae2889749a48629be2501b0 # v1.9
85+
with:
86+
install: IO::Socket::SSL
87+
8488
- uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
8589
with:
8690
path: |
8791
~/.cargo/bin/
8892
~/.cargo/registry/index/
8993
~/.cargo/registry/cache/
9094
~/.cargo/git/db/
95+
bin/pebble
9196
nginx/objs/**/CACHEDIR.TAG
9297
nginx/objs/**/ngx-debug
9398
nginx/objs/**/ngx-release
99+
target/
94100
key: ${{ runner.os }}-nginx-${{ hashFiles('**/Cargo.lock') }}
95101
restore-keys: ${{ runner.os }}-nginx-
96102

103+
- name: download pebble
104+
run: |
105+
build/get-pebble.sh
106+
echo TEST_NGINX_PEBBLE_BINARY="$PWD/bin/pebble" >> "$GITHUB_ENV"
107+
97108
- name: build
98109
id: build
99110
run: make BUILD=${{ matrix.build }} -j $(nproc) build

‎.github/workflows/sanitizers.yaml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ env:
1515
cargo rust-src rustfmt
1616
clang compiler-rt llvm
1717
git-core
18-
make patch
18+
make openssl patch which
19+
perl-Digest-SHA
1920
perl-FindBin
2021
perl-IO-Socket-SSL
2122
perl-Test-Harness
@@ -56,12 +57,18 @@ jobs:
5657
~/.cargo/registry/index/
5758
~/.cargo/registry/cache/
5859
~/.cargo/git/db/
60+
bin/pebble
5961
nginx/objs/**/CACHEDIR.TAG
6062
nginx/objs/**/ngx-debug
6163
nginx/objs/**/ngx-release
6264
key: ${{ runner.os }}-cargo-asan-${{ hashFiles('**/Cargo.lock') }}
6365
restore-keys: ${{ runner.os }}-cargo-asan-
6466

67+
- name: download pebble
68+
run: |
69+
build/get-pebble.sh
70+
echo TEST_NGINX_PEBBLE_BINARY="$PWD/bin/pebble" >> "$GITHUB_ENV"
71+
6572
- name: Configure and build nginx
6673
run: |
6774
make -j$(nproc) BUILD=sanitize build
@@ -75,4 +82,4 @@ jobs:
7582
TEST_NGINX_GLOBALS: >-
7683
user root;
7784
run: |
78-
make -j$(nproc) BUILD=sanitize test
85+
make -j$(nproc) BUILD=sanitize TEST_PREREQ= test

‎build/get-pebble.sh

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
#!/bin/sh
2+
3+
# Copyright (c) F5, Inc.
4+
#
5+
# This source code is licensed under the Apache License, Version 2.0 license
6+
# found in the LICENSE file in the root directory of this source tree.
7+
8+
set -e
9+
10+
VERSION="${1:-2.8.0}"
11+
SHA256SUM="$2"
12+
TARGET=${3:-$PWD/bin/pebble}
13+
14+
SHA256SUM_darwin_amd64=9b9625651f8ce47706235179503fec149f8f38bce2b2554efe8c0f2a021f877c
15+
SHA256SUM_darwin_arm64=39e07d63dc776521f2ffe0584e5f4f081c984ac02742c882b430891d89f0c866
16+
SHA256SUM_linux_amd64=34595d915bbc2fc827affb3f58593034824df57e95353b031c8d5185724485ce
17+
SHA256SUM_linux_arm64=0e70f2537353f61cbf06aa54740bf7f7bb5f963ba00e909f23af5f85bc13fd1a
18+
19+
if "$TARGET" -version | grep "$VERSION"; then
20+
exit 0
21+
fi
22+
23+
SYSTEM=$(uname -s | tr "[:upper:]" "[:lower:]")
24+
MACHINE=$(uname -m)
25+
case "$MACHINE" in
26+
aarch64)
27+
MACHINE=arm64;;
28+
x86_64)
29+
MACHINE=amd64;;
30+
esac
31+
32+
if [ -z "$SHA256SUM" ]; then
33+
eval "SHA256SUM=\$SHA256SUM_${SYSTEM}_${MACHINE}"
34+
fi
35+
36+
if echo "$SHA256SUM $TARGET" | shasum -a 256 -c; then
37+
exit 0;
38+
fi
39+
40+
PREFIX="pebble-${SYSTEM}-${MACHINE}"
41+
42+
WORKDIR=$(mktemp -d)
43+
trap 'rm -rf "$WORKDIR"' EXIT
44+
45+
cd "$WORKDIR"
46+
47+
curl -L -o "$PREFIX.tar.gz" \
48+
"https://github.com/letsencrypt/pebble/releases/download/v${VERSION}/${PREFIX}.tar.gz"
49+
50+
if ! echo "$SHA256SUM $PREFIX.tar.gz" | shasum -a 256 -c; then
51+
echo "checksum mismatch"
52+
exit 1;
53+
fi
54+
55+
tar -xzf "$PREFIX.tar.gz"
56+
57+
mkdir -p "$(dirname "$TARGET")"
58+
mv "$PREFIX/$SYSTEM/$MACHINE/pebble" "$TARGET"
59+
chmod +x "$TARGET"

‎t/acme_http.t

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
#!/usr/bin/perl
2+
3+
# Copyright (c) F5, Inc.
4+
#
5+
# This source code is licensed under the Apache License, Version 2.0 license
6+
# found in the LICENSE file in the root directory of this source tree.
7+
8+
# Tests for ACME client: HTTP-01 challenge.
9+
10+
###############################################################################
11+
12+
use warnings;
13+
use strict;
14+
15+
use Test::More;
16+
17+
use IO::Select;
18+
19+
BEGIN { use FindBin; chdir($FindBin::Bin); }
20+
21+
use lib 'lib';
22+
use Test::Nginx;
23+
use Test::Nginx::ACME;
24+
use Test::Nginx::DNS;
25+
26+
###############################################################################
27+
28+
select STDERR; $| = 1;
29+
select STDOUT; $| = 1;
30+
31+
my $t = Test::Nginx->new()->has(qw/http http_ssl socket_ssl/)
32+
->has_daemon('openssl');
33+
34+
$t->write_file_expand('nginx.conf', <<'EOF');
35+
36+
%%TEST_GLOBALS%%
37+
38+
daemon off;
39+
40+
events {
41+
}
42+
43+
http {
44+
%%TEST_GLOBALS_HTTP%%
45+
46+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
47+
48+
acme_issuer default {
49+
uri https://acme.test:%%PORT_9000%%/dir;
50+
ssl_trusted_certificate acme.test.crt;
51+
state_path %%TESTDIR%%;
52+
accept_terms_of_service;
53+
}
54+
55+
server {
56+
listen 127.0.0.1:8080;
57+
server_name example.test;
58+
}
59+
60+
server {
61+
listen 127.0.0.1:8443 ssl;
62+
server_name example.test;
63+
64+
acme_certificate default;
65+
66+
ssl_certificate $acme_certificate;
67+
ssl_certificate_key $acme_certificate_key;
68+
}
69+
}
70+
71+
EOF
72+
73+
$t->write_file('openssl.conf', <<EOF);
74+
[ req ]
75+
default_bits = 2048
76+
encrypt_key = no
77+
distinguished_name = req_distinguished_name
78+
[ req_distinguished_name ]
79+
EOF
80+
81+
my $d = $t->testdir();
82+
83+
foreach my $name ('acme.test') {
84+
system('openssl req -x509 -new '
85+
. "-config $d/openssl.conf -subj /CN=$name/ "
86+
. "-out $d/$name.crt -keyout $d/$name.key "
87+
. ">>$d/openssl.out 2>&1") == 0
88+
or die "Can't create certificate for $name: $!\n";
89+
}
90+
91+
my $dp = port(8980, udp=>1);
92+
my @dc = (
93+
{ name => 'acme.test', A => '127.0.0.1' },
94+
{ name => 'example.test', A => '127.0.0.1' }
95+
);
96+
97+
my $acme = Test::Nginx::ACME->new($t, port(9000), port(9001),
98+
$t->testdir . '/acme.test.crt',
99+
$t->testdir . '/acme.test.key',
100+
http_port => port(8080),
101+
tls_port => port(8443),
102+
dns_port => $dp,
103+
nosleep => 1,
104+
validity => 60,
105+
);
106+
107+
$t->run_daemon(\&Test::Nginx::DNS::dns_test_daemon, $t, $dp, \@dc);
108+
$t->waitforfile($t->testdir . '/' . $dp);
109+
110+
$t->run_daemon(\&Test::Nginx::ACME::acme_test_daemon, $t, $acme);
111+
$t->waitforsocket('127.0.0.1:' . $acme->port());
112+
$t->write_file('acme-root.crt', $acme->trusted_ca());
113+
114+
$t->write_file('index.html', 'SUCCESS');
115+
$t->plan(1)->run();
116+
117+
###############################################################################
118+
119+
$acme->wait_certificate('example.test') or die "no certificate";
120+
121+
like(get(8443, 'example.test', 'acme-root'), qr/SUCCESS/, 'tls request');
122+
123+
###############################################################################
124+
125+
sub get {
126+
my ($port, $host, $ca) = @_;
127+
128+
$ca = undef if $IO::Socket::SSL::VERSION < 2.062
129+
|| !eval { Net::SSLeay::X509_V_FLAG_PARTIAL_CHAIN() };
130+
131+
http_get('/',
132+
PeerAddr => '127.0.0.1:' . port($port),
133+
SSL => 1,
134+
$ca ? (
135+
SSL_ca_file => "$d/$ca.crt",
136+
SSL_verifycn_name => $host,
137+
SSL_verify_mode => IO::Socket::SSL::SSL_VERIFY_PEER(),
138+
) : ()
139+
);
140+
}
141+
142+
###############################################################################

0 commit comments

Comments
 (0)