Mercurial > hg > nginx-tests

changeset 1831:f6d1f82f314b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: separate SSL session reuse tests in mail. Instead of being mixed with generic SSL tests, session reuse variants are now tested in a separate file.
author Maxim Dounin <mdounin@mdounin.ru>
date Thu, 23 Mar 2023 19:49:51 +0300
parents 8dec885fa3da
children 2e541778e5d8
files mail_ssl.t mail_ssl_session_reuse.t
diffstat 2 files changed, 180 insertions(+), 58 deletions(-) [+]
line wrap: on
line diff
--- a/mail_ssl.t	Thu Mar 23 19:49:49 2023 +0300
+++ b/mail_ssl.t	Thu Mar 23 19:49:51 2023 +0300
@@ -37,7 +37,7 @@
 plan(skip_all => 'Net::SSLeay with OpenSSL ALPN support required') if $@;
 
 my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap pop3 smtp/)
-	->has_daemon('openssl')->plan(22);
+	->has_daemon('openssl')->plan(18);
 
 $t->write_file_expand('nginx.conf', <<'EOF');
 
@@ -51,44 +51,25 @@
 mail {
     ssl_certificate_key localhost.key;
     ssl_certificate localhost.crt;
-    ssl_session_tickets off;
 
     ssl_password_file password;
 
     auth_http  http://127.0.0.1:8080;	# unused
 
-    ssl_session_cache none;
-
     server {
         listen             127.0.0.1:8143;
         listen             127.0.0.1:8145 ssl;
         protocol           imap;
-
-        ssl_session_cache  builtin;
     }
 
     server {
-        listen             127.0.0.1:8146 ssl;
-        protocol           imap;
-
-        ssl_session_cache  off;
-    }
-
-    server {
-        listen             127.0.0.1:8147;
+        listen             127.0.0.1:8148;
         protocol           imap;
 
         # Special case for enabled "ssl" directive.
 
         ssl on;
-        ssl_session_cache  builtin:1000;
-    }
 
-    server {
-        listen             127.0.0.1:8148 ssl;
-        protocol           imap;
-
-        ssl_session_cache shared:SSL:1m;
         ssl_certificate_key inherits.key;
         ssl_certificate inherits.crt;
     }
@@ -169,46 +150,16 @@
 
 ###############################################################################
 
+my ($s, $ssl);
+
 # simple tests to ensure that nothing broke with ssl_password_file directive
 
-my $s = Test::Nginx::IMAP->new();
+$s = Test::Nginx::IMAP->new();
 $s->ok('greeting');
 
 $s->send('1 AUTHENTICATE LOGIN');
 $s->check(qr/\+ VXNlcm5hbWU6/, 'login');
 
-# ssl_session_cache
-
-my ($ssl, $ses);
-
-($s, $ssl) = get_ssl_socket(8145);
-Net::SSLeay::read($ssl);
-$ses = Net::SSLeay::get_session($ssl);
-
-($s, $ssl) = get_ssl_socket(8145, $ses);
-is(Net::SSLeay::session_reused($ssl), 1, 'builtin session reused');
-
-($s, $ssl) = get_ssl_socket(8146);
-Net::SSLeay::read($ssl);
-$ses = Net::SSLeay::get_session($ssl);
-
-($s, $ssl) = get_ssl_socket(8146, $ses);
-is(Net::SSLeay::session_reused($ssl), 0, 'session not reused');
-
-($s, $ssl) = get_ssl_socket(8147);
-Net::SSLeay::read($ssl);
-$ses = Net::SSLeay::get_session($ssl);
-
-($s, $ssl) = get_ssl_socket(8147, $ses);
-is(Net::SSLeay::session_reused($ssl), 1, 'builtin size session reused');
-
-($s, $ssl) = get_ssl_socket(8148);
-Net::SSLeay::read($ssl);
-$ses = Net::SSLeay::get_session($ssl);
-
-($s, $ssl) = get_ssl_socket(8148, $ses);
-is(Net::SSLeay::session_reused($ssl), 1, 'shared session reused');
-
 # ssl_certificate inheritance
 
 ($s, $ssl) = get_ssl_socket(8145);
@@ -219,7 +170,7 @@
 
 # alpn
 
-ok(get_ssl_socket(8148, undef, ['imap']), 'alpn');
+ok(get_ssl_socket(8148, ['imap']), 'alpn');
 
 SKIP: {
 $t->{_configure_args} =~ /LibreSSL ([\d\.]+)/;
@@ -230,7 +181,7 @@
 TODO: {
 local $TODO = 'not yet' unless $t->has_version('1.21.4');
 
-ok(!get_ssl_socket(8148, undef, ['unknown']), 'alpn rejected');
+ok(!get_ssl_socket(8148, ['unknown']), 'alpn rejected');
 
 }
 
@@ -317,11 +268,10 @@
 ###############################################################################
 
 sub get_ssl_socket {
-	my ($port, $ses, $alpn) = @_;
+	my ($port, $alpn) = @_;
 
 	my $s = IO::Socket::INET->new('127.0.0.1:' . port($port));
 	my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!");
-	Net::SSLeay::set_session($ssl, $ses) if defined $ses;
 	Net::SSLeay::set_alpn_protos($ssl, $alpn) if defined $alpn;
 	Net::SSLeay::set_fd($ssl, fileno($s));
 	Net::SSLeay::connect($ssl) == 1 or return;
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/mail_ssl_session_reuse.t	Thu Mar 23 19:49:51 2023 +0300
@@ -0,0 +1,172 @@
+#!/usr/bin/perl
+
+# (C) Andrey Zelenkov
+# (C) Maxim Dounin
+# (C) Nginx, Inc.
+
+# Tests for mail ssl module, session reuse.
+
+###############################################################################
+
+use warnings;
+use strict;
+
+use Test::More;
+
+BEGIN { use FindBin; chdir($FindBin::Bin); }
+
+use lib 'lib';
+use Test::Nginx;
+
+###############################################################################
+
+select STDERR; $| = 1;
+select STDOUT; $| = 1;
+
+eval {
+	require Net::SSLeay;
+	Net::SSLeay::load_error_strings();
+	Net::SSLeay::SSLeay_add_ssl_algorithms();
+	Net::SSLeay::randomize();
+};
+plan(skip_all => 'Net::SSLeay not installed') if $@;
+
+my $t = Test::Nginx->new()->has(qw/mail mail_ssl imap/)
+	->has_daemon('openssl')->plan(7);
+
+$t->write_file_expand('nginx.conf', <<'EOF');
+
+%%TEST_GLOBALS%%
+
+daemon off;
+
+events {
+}
+
+mail {
+    auth_http  http://127.0.0.1:8080;
+
+    ssl_certificate localhost.crt;
+    ssl_certificate_key localhost.key;
+
+    server {
+        listen    127.0.0.1:8993 ssl;
+        protocol  imap;
+    }
+
+    server {
+        listen    127.0.0.1:8994 ssl;
+        protocol  imap;
+
+        ssl_session_cache shared:SSL:1m;
+        ssl_session_tickets on;
+    }
+
+    server {
+        listen    127.0.0.1:8995 ssl;
+        protocol  imap;
+
+        ssl_session_cache shared:SSL:1m;
+        ssl_session_tickets off;
+    }
+
+    server {
+        listen    127.0.0.1:8996 ssl;
+        protocol  imap;
+
+        ssl_session_cache builtin;
+        ssl_session_tickets off;
+    }
+
+    server {
+        listen    127.0.0.1:8997 ssl;
+        protocol  imap;
+
+        ssl_session_cache builtin:1000;
+        ssl_session_tickets off;
+    }
+
+    server {
+        listen    127.0.0.1:8998 ssl;
+        protocol  imap;
+
+        ssl_session_cache none;
+        ssl_session_tickets off;
+    }
+
+    server {
+        listen    127.0.0.1:8999 ssl;
+        protocol  imap;
+
+        ssl_session_cache off;
+        ssl_session_tickets off;
+    }
+}
+
+EOF
+
+$t->write_file('openssl.conf', <<EOF);
+[ req ]
+default_bits = 2048
+encrypt_key = no
+distinguished_name = req_distinguished_name
+[ req_distinguished_name ]
+EOF
+
+my $d = $t->testdir();
+
+foreach my $name ('localhost') {
+	system('openssl req -x509 -new '
+		. "-config $d/openssl.conf -subj /CN=$name/ "
+		. "-out $d/$name.crt -keyout $d/$name.key "
+		. ">>$d/openssl.out 2>&1") == 0
+		or die "Can't create certificate for $name: $!\n";
+}
+
+my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!");
+
+$t->run();
+
+###############################################################################
+
+# session reuse:
+#
+# - only tickets, the default
+# - tickets and shared cache, should work always
+# - only shared cache
+# - only builtin cache
+# - only builtin cache with explicitly configured size
+# - only cache none
+# - only cache off
+
+is(test_reuse(8993), 1, 'tickets reused');
+is(test_reuse(8994), 1, 'tickets and cache reused');
+is(test_reuse(8995), 1, 'cache shared reused');
+is(test_reuse(8996), 1, 'cache builtin reused');
+is(test_reuse(8997), 1, 'cache builtin size reused');
+is(test_reuse(8998), 0, 'cache none not reused');
+is(test_reuse(8999), 0, 'cache off not reused');
+
+###############################################################################
+
+sub test_reuse {
+	my ($port) = @_;
+	my ($s, $ssl) = get_ssl_socket($port);
+	Net::SSLeay::read($ssl);
+	my $ses = Net::SSLeay::get_session($ssl);
+	($s, $ssl) = get_ssl_socket($port, $ses);
+	return Net::SSLeay::session_reused($ssl);
+}
+
+sub get_ssl_socket {
+	my ($port, $ses) = @_;
+
+	my $s = IO::Socket::INET->new('127.0.0.1:' . port($port));
+	my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!");
+	Net::SSLeay::set_session($ssl, $ses) if defined $ses;
+	Net::SSLeay::set_fd($ssl, fileno($s));
+	Net::SSLeay::connect($ssl) == 1 or return;
+	return ($s, $ssl);
+}
+
+###############################################################################