Skip to content

Commit e3cf946

Browse files
shinricha-a-ron
shinrich
authored and
a-a-ron
committed
Add test to catch regressions in sni and override configs (#6170)
1 parent a65926a commit e3cf946

File tree

1 file changed

+135
-0
lines changed

1 file changed

+135
-0
lines changed

‎tests/gold_tests/tls/tls_verify_override_sni.test.py‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
'''
2+
'''
3+
# Licensed to the Apache Software Foundation (ASF) under one
4+
# or more contributor license agreements. See the NOTICE file
5+
# distributed with this work for additional information
6+
# regarding copyright ownership. The ASF licenses this file
7+
# to you under the Apache License, Version 2.0 (the
8+
# "License"); you may not use this file except in compliance
9+
# with the License. You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing, software
14+
# distributed under the License is distributed on an "AS IS" BASIS,
15+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
# See the License for the specific language governing permissions and
17+
# limitations under the License.
18+
19+
import os
20+
Test.Summary = '''
21+
Test tls server certificate verification options. Exercise conf_remap
22+
'''
23+
24+
# Define default ATS
25+
ts = Test.MakeATSProcess("ts", select_ports=True)
26+
cafile = "{0}/signer.pem".format(Test.RunDirectory)
27+
28+
server_foo = Test.MakeOriginServer("server_foo", ssl=True, options = {"--key": "{0}/signed-foo.key".format(Test.RunDirectory), "--cert": "{0}/signed-foo.pem".format(Test.RunDirectory), "--clientCA": cafile, "--clientverify": ""}, clientcert="{0}/signed-bar.pem".format(Test.RunDirectory), clientkey="{0}/signed-bar.key".format(Test.RunDirectory))
29+
server_bar = Test.MakeOriginServer("server_bar", ssl=True, options = {"--key": "{0}/signed-foo.key".format(Test.RunDirectory), "--cert": "{0}/signed-foo.pem".format(Test.RunDirectory), "--clientCA": cafile, "--clientverify": ""}, clientcert="{0}/signed-bar.pem".format(Test.RunDirectory), clientkey="{0}/signed-bar.key".format(Test.RunDirectory))
30+
31+
dns = Test.MakeDNServer("dns")
32+
33+
request_foo_header = {"headers": "GET / HTTP/1.1\r\nHost: foo.com\r\n\r\n", "timestamp": "1469733493.993", "body": ""}
34+
request_bad_foo_header = {"headers": "GET / HTTP/1.1\r\nHost: bad_foo.com\r\n\r\n", "timestamp": "1469733493.993", "body": ""}
35+
request_bar_header = {"headers": "GET / HTTP/1.1\r\nHost: bar.com\r\n\r\n", "timestamp": "1469733493.993", "body": ""}
36+
request_bad_bar_header = {"headers": "GET / HTTP/1.1\r\nHost: bad_bar.com\r\n\r\n", "timestamp": "1469733493.993", "body": ""}
37+
response_header = {"headers": "HTTP/1.1 200 OK\r\nConnection: close\r\n\r\n", "timestamp": "1469733493.993", "body": ""}
38+
server_foo.addResponse("sessionlog.json", request_foo_header, response_header)
39+
server_foo.addResponse("sessionlog.json", request_bad_foo_header, response_header)
40+
server_bar.addResponse("sessionlog.json", request_bar_header, response_header)
41+
server_bar.addResponse("sessionlog.json", request_bad_bar_header, response_header)
42+
43+
server_bar.Setup.Copy("ssl/signer.pem")
44+
server_bar.Setup.Copy("ssl/signer2.pem")
45+
server_foo.Setup.Copy("ssl/signer.pem")
46+
server_foo.Setup.Copy("ssl/signer2.pem")
47+
48+
# add ssl materials like key, certificates for the server
49+
ts.addSSLfile("ssl/signed-foo.pem")
50+
ts.addSSLfile("ssl/signed-foo.key")
51+
ts.addSSLfile("ssl/signed-bar.pem")
52+
ts.addSSLfile("ssl/signed-bar.key")
53+
ts.addSSLfile("ssl/server.pem")
54+
ts.addSSLfile("ssl/server.key")
55+
ts.addSSLfile("ssl/signer.pem")
56+
ts.addSSLfile("ssl/signer.key")
57+
58+
ts.Disk.remap_config.AddLine(
59+
'map http://foo.com/defaultbar https://bar.com:{0}'.format(server_bar.Variables.SSL_Port))
60+
ts.Disk.remap_config.AddLine(
61+
'map http://foo.com/default https://foo.com:{0}'.format(server_foo.Variables.SSL_Port))
62+
ts.Disk.remap_config.AddLine(
63+
'map http://foo.com/overridepolicy https://bar.com:{0} @plugin=conf_remap.so @pparam=proxy.config.ssl.client.verify.server.policy=ENFORCED'.format(server_foo.Variables.SSL_Port))
64+
ts.Disk.remap_config.AddLine(
65+
'map http://foo.com/overrideproperties https://bar.com:{0} @plugin=conf_remap.so @pparam=proxy.config.ssl.client.verify.server.properties=SIGNATURE'.format(server_foo.Variables.SSL_Port))
66+
67+
ts.Disk.ssl_multicert_config.AddLine(
68+
'dest_ip=* ssl_cert_name=server.pem ssl_key_name=server.key'
69+
)
70+
71+
# global config policy=permissive properties=all
72+
ts.Disk.records_config.update({
73+
'proxy.config.diags.debug.enabled': 1,
74+
'proxy.config.diags.debug.tags': 'ssl',
75+
'proxy.config.ssl.server.cert.path': '{0}'.format(ts.Variables.SSLDir),
76+
'proxy.config.ssl.server.private_key.path': '{0}'.format(ts.Variables.SSLDir),
77+
'proxy.config.ssl.server.cipher_suite': 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:RC4-SHA:RC4-MD5:AES128-SHA:AES256-SHA:DES-CBC3-SHA!SRP:!DSS:!PSK:!aNULL:!eNULL:!SSLv2',
78+
# set global policy
79+
'proxy.config.ssl.client.verify.server.policy': 'PERMISSIVE',
80+
'proxy.config.ssl.client.verify.server.properties': 'ALL',
81+
'proxy.config.ssl.client.CA.cert.path': '{0}'.format(ts.Variables.SSLDir),
82+
'proxy.config.ssl.client.CA.cert.filename': 'signer.pem',
83+
'proxy.config.url_remap.pristine_host_hdr': 1,
84+
'proxy.config.dns.nameservers': '127.0.0.1:{0}'.format(dns.Variables.Port),
85+
'proxy.config.dns.resolv_conf': 'NULL',
86+
'proxy.config.exec_thread.autoconfig.scale': 1.0,
87+
'proxy.config.ssl.client.sni_policy': 'remap'
88+
})
89+
90+
ts.Disk.sni_yaml.AddLines([
91+
'sni:',
92+
'- fqdn: bar.com',
93+
' client_cert: "{0}/signed-foo.pem"'.format(ts.Variables.SSLDir),
94+
' client_key: "{0}/signed-foo.key"'.format(ts.Variables.SSLDir),
95+
])
96+
97+
dns.addRecords(records={"foo.com.": ["127.0.0.1"]})
98+
dns.addRecords(records={"bar.com.": ["127.0.0.1"]})
99+
dns.addRecords(records={"random.com.": ["127.0.0.1"]})
100+
101+
# Should succeed with message
102+
# exercise default settings
103+
tr = Test.AddTestRun("default-permissive-success")
104+
tr.Setup.Copy("ssl/signed-foo.key")
105+
tr.Setup.Copy("ssl/signed-foo.pem")
106+
tr.Setup.Copy("ssl/signed-bar.key")
107+
tr.Setup.Copy("ssl/signed-bar.pem")
108+
tr.Processes.Default.Command = 'curl -k -H \"host: foo.com\" http://127.0.0.1:{0}/defaultbar'.format(ts.Variables.port)
109+
tr.ReturnCode = 0
110+
tr.Processes.Default.StartBefore(dns)
111+
tr.Processes.Default.StartBefore(server_foo)
112+
tr.Processes.Default.StartBefore(server_bar)
113+
tr.Processes.Default.StartBefore(Test.Processes.ts)
114+
tr.StillRunningAfter = ts
115+
tr.Processes.Default.Streams.stdout = Testers.ExcludesExpression("Could Not Connect", "Curl attempt should have succeeded")
116+
117+
# should fail. Exercise the override
118+
tr2 = Test.AddTestRun("policy-override-fail")
119+
tr2.Processes.Default.Command = "curl -k -H \"host: foo.com\" http://127.0.0.1:{0}/overridepolicy".format(ts.Variables.port)
120+
tr2.ReturnCode = 0
121+
tr2.StillRunningAfter = ts
122+
tr2.Processes.Default.Streams.stdout = Testers.ContainsExpression("Could Not Connect", "Curl attempt should fail")
123+
124+
# should succeed with an error message
125+
tr2 = Test.AddTestRun("properties-override-permissive")
126+
tr2.Processes.Default.Command = "curl -k -H \"host: foo.com\" http://127.0.0.1:{0}/overrideproperties".format(ts.Variables.port)
127+
tr2.ReturnCode = 0
128+
tr2.StillRunningAfter = ts
129+
tr2.Processes.Default.Streams.stdout = Testers.ExcludesExpression("Could Not Connect", "Curl attempt should have succeeded")
130+
131+
132+
# Over riding the built in ERROR check since we expect some cases to fail
133+
ts.Disk.diags_log.Content = Testers.ContainsExpression("WARNING: SNI \(bar.com\) not in certificate. Action=Continue server=bar.com", "Warning for mismatch name not enforcing")
134+
ts.Disk.diags_log.Content += Testers.ContainsExpression(" WARNING: SNI \(bar.com\) not in certificate. Action=Terminate server=bar.com", "Warning for enforcing mismatch")
135+

0 commit comments

Comments
 (0)