1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
|
#REGTEST_TYPE=devel
# This reg-test ensures that SSL related configuration specified in a
# default-server option are properly taken into account by the servers
# (frontend). It mainly focuses on the client certificate used by the frontend,
# that can either be defined in the server line itself, in the default-server
# line or in both.
#
# It was created following a bug raised in redmine (issue #3906) in which a
# server used an "empty" SSL context instead of the proper one.
#
varnishtest "Test the 'set ssl cert' feature of the CLI"
feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'"
feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
feature ignore_unknown_macro
server s1 -repeat 7 {
rxreq
txresp
} -start
haproxy h1 -conf {
global
.if feature(THREAD)
thread-groups 1
.endif
.if !ssllib_name_startswith(AWS-LC)
tune.ssl.default-dh-param 2048
.endif
tune.ssl.capture-buffer-size 1
stats socket "${tmpdir}/h1/stats" level admin
crt-base ${testdir}
ca-base ${testdir}
defaults
mode http
option httplog
log stderr local0 debug err
option logasap
timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
timeout client "${HAPROXY_TEST_TIMEOUT-5s}"
timeout server "${HAPROXY_TEST_TIMEOUT-5s}"
listen clear-lst
bind "fd@${clearlst}"
use_backend first_be if { path /first }
use_backend second_be if { path /second }
use_backend third_be if { path /third }
use_backend fourth_be if { path /fourth }
use_backend fifth_be if { path /fifth }
backend first_be
default-server ssl crt client1.pem ca-file ca-auth.crt verify none
server s1 "${tmpdir}/ssl.sock"
backend second_be
default-server ssl ca-file ca-auth.crt verify none
server s1 "${tmpdir}/ssl.sock" crt client1.pem
backend third_be
default-server ssl crt client1.pem ca-file ca-auth.crt verify none
server s1 "${tmpdir}/ssl.sock" crt client2_expired.pem
backend fourth_be
default-server ssl crt client1.pem verify none
server s1 "${tmpdir}/ssl.sock" ca-file ca-auth.crt
backend fifth_be
balance roundrobin
default-server ssl crt client1.pem verify none
server s1 "${tmpdir}/ssl.sock"
server s2 "${tmpdir}/ssl.sock" crt client2_expired.pem
server s3 "${tmpdir}/ssl.sock"
listen ssl-lst
bind "${tmpdir}/ssl.sock" ssl crt ${testdir}/common.pem ca-file ca-auth.crt verify required crt-ignore-err all
acl cert_expired ssl_c_verify 10
acl cert_revoked ssl_c_verify 23
acl cert_ok ssl_c_verify 0
http-response add-header X-SSL Ok if cert_ok
http-response add-header X-SSL Expired if cert_expired
http-response add-header X-SSL Revoked if cert_revoked
server s1 ${s1_addr}:${s1_port}
} -start
client c1 -connect ${h1_clearlst_sock} {
txreq -url "/first"
rxresp
expect resp.status == 200
expect resp.http.x-ssl == "Ok"
} -run
client c1 -connect ${h1_clearlst_sock} {
txreq -url "/second"
txreq
rxresp
expect resp.status == 200
expect resp.http.x-ssl == "Ok"
} -run
client c1 -connect ${h1_clearlst_sock} {
txreq -url "/third"
txreq
rxresp
expect resp.status == 200
expect resp.http.x-ssl == "Expired"
} -run
client c1 -connect ${h1_clearlst_sock} {
txreq -url "/fourth"
txreq
rxresp
expect resp.status == 200
expect resp.http.x-ssl == "Ok"
} -run
client c1 -connect ${h1_clearlst_sock} {
txreq -url "/fifth"
txreq
rxresp
expect resp.status == 200
expect resp.http.x-ssl == "Ok"
} -run
client c1 -connect ${h1_clearlst_sock} {
txreq -url "/fifth"
txreq
rxresp
expect resp.status == 200
expect resp.http.x-ssl == "Expired"
} -run
client c1 -connect ${h1_clearlst_sock} {
txreq -url "/fifth"
txreq
rxresp
expect resp.status == 200
expect resp.http.x-ssl == "Ok"
} -run
|
