blob: f42e3af538b5264f418c831b5f1c6ef379397fc9 [file] [log] [blame]
William Lallemand4781fad2020-03-31 14:48:34 +02001#REGTEST_TYPE=devel
William Lallemand2be4a2e2020-03-31 12:13:34 +02002
3# This reg-test uses the "add ssl crt-list" command to add a certificate over the CLI.
William Lallemand3ed722f2020-04-30 09:47:08 +02004# It requires socat to upload the certificate
5
6# this check does 2 requests, the first one will use "www.test1.com" as SNI, and
7# the second one will use "localhost". Since vtest can't do SSL, we use haproxy
8# as an SSL client with 2 chained listen section.
William Lallemand2be4a2e2020-03-31 12:13:34 +02009
10# If this test does not work anymore:
William Lallemand3ed722f2020-04-30 09:47:08 +020011# - Check that you have socat
William Lallemand2be4a2e2020-03-31 12:13:34 +020012
13varnishtest "Test the 'add ssl crt-list' feature of the CLI"
14#REQUIRE_VERSION=2.2
15#REQUIRE_OPTIONS=OPENSSL
William Lallemand3ed722f2020-04-30 09:47:08 +020016#REQUIRE_BINARIES=socat
William Lallemand2be4a2e2020-03-31 12:13:34 +020017feature ignore_unknown_macro
18
William Lallemand3ed722f2020-04-30 09:47:08 +020019server s1 -repeat 2 {
20 rxreq
21 txresp
22} -start
William Lallemand2be4a2e2020-03-31 12:13:34 +020023
24haproxy h1 -conf {
William Lallemand3ed722f2020-04-30 09:47:08 +020025 global
26 tune.ssl.default-dh-param 2048
27 tune.ssl.capture-cipherlist-size 1
28 crt-base ${testdir}
29 stats socket "${tmpdir}/h1/stats" level admin
30
31 defaults
32 mode http
33 option httplog
34 ${no-htx} option http-use-htx
35 log stderr local0 debug err
36 option logasap
37 timeout connect 1s
38 timeout client 1s
39 timeout server 1s
William Lallemand2be4a2e2020-03-31 12:13:34 +020040
William Lallemand3ed722f2020-04-30 09:47:08 +020041
42 listen clear-lst
43 bind "fd@${clearlst}"
44 balance roundrobin
45 server s1 "${tmpdir}/ssl.sock" ssl verify none sni str(www.test1.com)
46 server s2 "${tmpdir}/ssl.sock" ssl verify none sni str(localhost)
47
48
49 listen ssl-lst
50 mode http
51 ${no-htx} option http-use-htx
52 bind "${tmpdir}/ssl.sock" ssl strict-sni crt-list ${testdir}/localhost.crt-list
53
54 server s1 ${s1_addr}:${s1_port}
William Lallemand2be4a2e2020-03-31 12:13:34 +020055} -start
56
57
58haproxy h1 -cli {
59 send "show ssl cert ${testdir}/common.pem"
60 expect ~ ".*SHA1 FingerPrint: 2195C9F0FD58470313013FC27C1B9CF9864BD1C6"
61}
62
William Lallemand3ed722f2020-04-30 09:47:08 +020063client c1 -connect ${h1_clearlst_sock} {
64 txreq
65 rxresp
66 expect resp.status == 200
67} -run
William Lallemand2be4a2e2020-03-31 12:13:34 +020068
69shell {
William Lallemand3ed722f2020-04-30 09:47:08 +020070 echo "new ssl cert ${testdir}/ecdsa.pem" | socat "${tmpdir}/h1/stats" -
71 printf "set ssl cert ${testdir}/ecdsa.pem <<\n$(cat ${testdir}/ecdsa.pem)\n\n" | socat "${tmpdir}/h1/stats" -
72 echo "commit ssl cert ${testdir}/ecdsa.pem" | socat "${tmpdir}/h1/stats" -
William Lallemand99cc2182020-06-25 15:19:51 +020073 printf "add ssl crt-list ${testdir}/localhost.crt-list/ <<\n${testdir}/ecdsa.pem [ssl-min-ver SSLv3 verify none allow-0rtt] localhost !www.test1.com\n\n" | socat "${tmpdir}/h1/stats" -
William Lallemand3ed722f2020-04-30 09:47:08 +020074 printf "add ssl crt-list ${testdir}/localhost.crt-list <<\n${testdir}/ecdsa.pem [verify none allow-0rtt]\n\n" | socat "${tmpdir}/h1/stats" -
William Lallemand99cc2182020-06-25 15:19:51 +020075 printf "add ssl crt-list ${testdir}/localhost.crt-list/// <<\n${testdir}/ecdsa.pem localhost !www.test1.com\n\n" | socat "${tmpdir}/h1/stats" -
76 printf "add ssl crt-list ${testdir}/localhost.crt-list///// <<\n${testdir}/ecdsa.pem\n\n" | socat "${tmpdir}/h1/stats" -
77 printf "add ssl crt-list ${testdir}/localhost.crt-list// ${testdir}/ecdsa.pem\n" | socat "${tmpdir}/h1/stats" -
William Lallemand2be4a2e2020-03-31 12:13:34 +020078}
79
80haproxy h1 -cli {
81 send "show ssl cert ${testdir}/ecdsa.pem"
82 expect ~ ".*SHA1 FingerPrint: A490D069DBAFBEE66DE434BEC34030ADE8BCCBF1"
83}
84
85haproxy h1 -cli {
William Lallemand99cc2182020-06-25 15:19:51 +020086 send "show ssl crt-list ${testdir}/localhost.crt-list//"
William Lallemandfdb6db42020-04-01 17:13:22 +020087 # check the options and the filters in any order
William Lallemand8177ad92020-05-20 16:49:02 +020088 expect ~ ".*${testdir}/ecdsa.pem \\[(?=.*verify none)(?=.*allow-0rtt)(?=.*ssl-min-ver SSLv3).*\\](?=.*!www.test1.com)(?=.*localhost).*"
William Lallemand2be4a2e2020-03-31 12:13:34 +020089}
90
William Lallemand3ed722f2020-04-30 09:47:08 +020091client c1 -connect ${h1_clearlst_sock} {
92 txreq
93 rxresp
94 expect resp.status == 200
95} -run
Remi Tricot-Le Bretonbcec63e2021-03-23 16:41:53 +010096
97
98# Try to add a new line that mentions an "unknown" CA file (not loaded yet).
99# It should fail since no disk access are allowed during runtime.
100shell {
101 printf "add ssl crt-list ${testdir}/localhost.crt-list/ <<\n${testdir}/ecdsa.pem [ca-file ${testdir}/ca-auth.crt] localhost\n\n" | socat "${tmpdir}/h1/stats" - | grep "unable to load ${testdir}/ca-auth.crt"
102}
103shell {
104 printf "add ssl crt-list ${testdir}/localhost.crt-list/ <<\n${testdir}/ecdsa.pem [ca-verify-file ${testdir}/ca-auth.crt] localhost\n\n" | socat "${tmpdir}/h1/stats" - | grep "unable to load ${testdir}/ca-auth.crt"
105}
106shell {
107 printf "add ssl crt-list ${testdir}/localhost.crt-list/ <<\n${testdir}/ecdsa.pem [crl-file ${testdir}/ca-auth.crt] localhost\n\n" | socat "${tmpdir}/h1/stats" - | grep "unable to load ${testdir}/ca-auth.crt"
108}
109
110# Check that the new line was not added to the crt-list.
111haproxy h1 -cli {
112 send "show ssl crt-list ${testdir}/localhost.crt-list//"
113 expect !~ ".*ca-file ${testdir}/ca-auth.crt"
114}