blob: bbc34a40088d90dc3183b80e388677aa7499d73f [file] [log] [blame]
William Lallemandcb7bcf52021-04-02 17:01:25 +02001#REGTEST_TYPE=broken
William Lallemand2185c972021-04-02 15:23:14 +02002
3# This reg-test uses the "set ssl cert" command to update a multi-certificate
4# bundle over the CLI.
5# It requires socat to upload the certificate
6#
7# This regtests loads a multi-certificates bundle "cert1-example.com.pem"
8# composed of a .rsa and a .ecdsa
9#
10# After verifying that the RSA and ECDSA algorithms were avalailble with the
11# right certificate, the test changes the certificates and try new requests.
12#
13# If this test does not work anymore:
14# - Check that you have socat
William Lallemandcb7bcf52021-04-02 17:01:25 +020015# - Check that you have at least OpenSSL 1.1.0
William Lallemand2185c972021-04-02 15:23:14 +020016
17varnishtest "Test the 'set ssl cert' feature of the CLI with bundles"
18#REQUIRE_VERSION=2.3
19#REQUIRE_OPTIONS=OPENSSL
20#REQUIRE_BINARIES=socat
21feature ignore_unknown_macro
22
23server s1 -repeat 9 {
24 rxreq
25 txresp
26} -start
27
28haproxy h1 -conf {
29 global
30 tune.ssl.default-dh-param 2048
31 tune.ssl.capture-cipherlist-size 1
32 stats socket "${tmpdir}/h1/stats" level admin
33 crt-base ${testdir}
34
35 defaults
36 mode http
37 option httplog
38 ${no-htx} option http-use-htx
39 log stderr local0 debug err
40 option logasap
41 timeout connect 100ms
42 timeout client 1s
43 timeout server 1s
44
45 listen clear-lst
46 bind "fd@${clearlst}"
47 balance roundrobin
48
49 http-response set-header X-SSL-Server-SHA1 %[ssl_s_sha1,hex]
50
51 retries 0 # 2nd SSL connection must fail so skip the retry
52 server s1 "${tmpdir}/ssl.sock" ssl verify none sni str(example.com) force-tlsv12 ciphers ECDHE-RSA-AES128-GCM-SHA256
53 server s2 "${tmpdir}/ssl.sock" ssl verify none sni str(example.com) force-tlsv12 ciphers ECDHE-ECDSA-AES256-GCM-SHA384
54
55 server s3 "${tmpdir}/ssl.sock" ssl verify none sni str(example.com) force-tlsv12 ciphers ECDHE-RSA-AES128-GCM-SHA256
56 server s4 "${tmpdir}/ssl.sock" ssl verify none sni str(example.com) force-tlsv12 ciphers ECDHE-ECDSA-AES256-GCM-SHA384
57
58 listen ssl-lst
59 bind "${tmpdir}/ssl.sock" ssl crt ${testdir}/cert1-example.com.pem
60 server s1 ${s1_addr}:${s1_port}
61
62} -start
63
64
65haproxy h1 -cli {
66 send "show ssl cert ${testdir}/cert1-example.com.pem.rsa"
67 expect ~ ".*SHA1 FingerPrint: 94F720DACA71B8B1A0AC9BD48C65BA688FF047DE"
68 send "show ssl cert ${testdir}/cert1-example.com.pem.ecdsa"
69 expect ~ ".*SHA1 FingerPrint: C1BA055D452F92EB02D449F0498C289F50698300"
70}
71
72client c1 -connect ${h1_clearlst_sock} {
73# RSA
74 txreq
75 rxresp
76 expect resp.http.X-SSL-Server-SHA1 == "94F720DACA71B8B1A0AC9BD48C65BA688FF047DE"
77 expect resp.status == 200
78# ECDSA
79 txreq
80 rxresp
81 expect resp.http.X-SSL-Server-SHA1 == "C1BA055D452F92EB02D449F0498C289F50698300"
82 expect resp.status == 200
83} -run
84
85shell {
86 printf "set ssl cert ${testdir}/cert1-example.com.pem.rsa <<\n$(cat ${testdir}/cert2-example.com.pem.rsa)\n\n" | socat "${tmpdir}/h1/stats" -
87 echo "commit ssl cert ${testdir}/cert1-example.com.pem.rsa" | socat "${tmpdir}/h1/stats" -
88 printf "set ssl cert ${testdir}/cert1-example.com.pem.ecdsa <<\n$(cat ${testdir}/cert2-example.com.pem.ecdsa)\n\n" | socat "${tmpdir}/h1/stats" -
89 echo "commit ssl cert ${testdir}/cert1-example.com.pem.ecdsa" | socat "${tmpdir}/h1/stats" -
90}
91
92haproxy h1 -cli {
93 send "show ssl cert ${testdir}/cert1-example.com.pem.rsa"
94 expect ~ ".*SHA1 FingerPrint: ADC863817FC40C2A9CA913CE45C9A92232558F90"
95 send "show ssl cert ${testdir}/cert1-example.com.pem.ecdsa"
96 expect ~ ".*SHA1 FingerPrint: F49FFA446D072262445C197B85D2F400B3F58808"
97}
98
99client c1 -connect ${h1_clearlst_sock} {
100# RSA
101 txreq
102 rxresp
103 expect resp.http.X-SSL-Server-SHA1 == "ADC863817FC40C2A9CA913CE45C9A92232558F90"
104 expect resp.status == 200
105# ECDSA
106 txreq
107 rxresp
108 expect resp.http.X-SSL-Server-SHA1 == "F49FFA446D072262445C197B85D2F400B3F58808"
109 expect resp.status == 200
110} -run
111