Skip to content

Commit 69e416c

Browse files
GUIGUI
committed
Add test for the new "generate_certs" option.
1 parent f80daf7 commit 69e416c

File tree

2 files changed

+266
-1
lines changed

2 files changed

+266
-1
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ Additional configuration options can be set on the `auto_ssl` instance that is c
281281
*Example:*
282282

283283
```lua
284-
auto_ssl:ssl_certificate({ generate_certs=false })
284+
auto_ssl:ssl_certificate({ generate_certs = false })
285285
```
286286

287287

‎t/option_generate_certs.t

Lines changed: 265 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,265 @@
1+
use strict;
2+
use warnings;
3+
use Test::Nginx::Socket::Lua;
4+
require "./t/inc/setup.pl";
5+
AutoSsl::setup();
6+
7+
repeat_each(1);
8+
9+
plan tests => repeat_each() * (blocks() * 7);
10+
11+
check_accum_error_log();
12+
no_long_string();
13+
no_shuffle();
14+
15+
run_tests();
16+
17+
__DATA__
18+
19+
=== TEST 1: generate_certs disables generation of new SSL certs
20+
--- http_config
21+
resolver $TEST_NGINX_RESOLVER;
22+
lua_shared_dict auto_ssl 1m;
23+
lua_shared_dict auto_ssl_settings 64k;
24+
25+
init_by_lua_block {
26+
auto_ssl = (require "resty.auto-ssl").new({
27+
dir = "$TEST_NGINX_RESTY_AUTO_SSL_DIR",
28+
ca = "https://acme-staging.api.letsencrypt.org/directory",
29+
allow_domain = function(domain)
30+
return true
31+
end,
32+
})
33+
auto_ssl:init()
34+
}
35+
36+
init_worker_by_lua_block {
37+
auto_ssl:init_worker()
38+
}
39+
40+
server {
41+
listen 9443 ssl;
42+
ssl_certificate $TEST_NGINX_ROOT_DIR/t/certs/example_fallback.crt;
43+
ssl_certificate_key $TEST_NGINX_ROOT_DIR/t/certs/example_fallback.key;
44+
ssl_certificate_by_lua_block {
45+
auto_ssl:ssl_certificate({
46+
generate_certs = false,
47+
})
48+
}
49+
50+
location /foo {
51+
server_tokens off;
52+
more_clear_headers Date;
53+
echo "generate_certs = false server";
54+
}
55+
}
56+
57+
server {
58+
listen 9444 ssl;
59+
ssl_certificate $TEST_NGINX_ROOT_DIR/t/certs/example_fallback.crt;
60+
ssl_certificate_key $TEST_NGINX_ROOT_DIR/t/certs/example_fallback.key;
61+
ssl_certificate_by_lua_block {
62+
auto_ssl:ssl_certificate()
63+
}
64+
65+
location /foo {
66+
server_tokens off;
67+
more_clear_headers Date;
68+
echo "generate_certs = default server";
69+
}
70+
}
71+
72+
server {
73+
listen 9080;
74+
location /.well-known/acme-challenge/ {
75+
content_by_lua_block {
76+
auto_ssl:challenge_server()
77+
}
78+
}
79+
}
80+
81+
server {
82+
listen 127.0.0.1:8999;
83+
client_body_buffer_size 128k;
84+
client_max_body_size 128k;
85+
location / {
86+
content_by_lua_block {
87+
auto_ssl:hook_server()
88+
}
89+
}
90+
}
91+
--- config
92+
lua_ssl_trusted_certificate $TEST_NGINX_ROOT_DIR/t/certs/letsencrypt_staging_chain.pem;
93+
lua_ssl_verify_depth 5;
94+
location /t {
95+
content_by_lua_block {
96+
-- Make an initial request against the "generate_certs = false" server to
97+
-- ensure we don't get back a valid SSL cert.
98+
local sock = ngx.socket.tcp()
99+
sock:settimeout(30000)
100+
local ok, err = sock:connect("127.0.0.1:9443")
101+
if not ok then
102+
ngx.say("failed to connect: ", err)
103+
return
104+
end
105+
106+
-- Make sure we got back the self-signed certificate (we expect this to
107+
-- fail).
108+
local sess, err = sock:sslhandshake(nil, "$TEST_NGINX_NGROK_HOSTNAME", true)
109+
if not sess then
110+
ngx.say("failed to do SSL handshake: ", err)
111+
112+
-- Reconnect and try again with ssl verification disabled.
113+
ok, err = sock:connect("127.0.0.1:9443")
114+
if not ok then
115+
ngx.say("failed to connect: ", err)
116+
return
117+
end
118+
sess, err = sock:sslhandshake(nil, "$TEST_NGINX_NGROK_HOSTNAME", false)
119+
if not sess then
120+
ngx.say("failed to do SSL handshake: ", err)
121+
return
122+
end
123+
end
124+
125+
local req = "GET /foo HTTP/1.0\r\nHost: $TEST_NGINX_NGROK_HOSTNAME\r\nConnection: close\r\n\r\n"
126+
local bytes, err = sock:send(req)
127+
if not bytes then
128+
ngx.say("failed to send http request: ", err)
129+
return
130+
end
131+
132+
while true do
133+
local line, err = sock:receive()
134+
if not line then
135+
break
136+
end
137+
138+
ngx.say("received: ", line)
139+
end
140+
141+
local ok, err = sock:close()
142+
if not ok then
143+
ngx.say("failed to close: ", err)
144+
return
145+
end
146+
147+
-- Make a request to a different server block that uses the default
148+
-- generate_certs value (true) and ensure that this does still generate
149+
-- the cert.
150+
ngx.print("\n")
151+
local sock = ngx.socket.tcp()
152+
sock:settimeout(30000)
153+
local ok, err = sock:connect("127.0.0.1:9444")
154+
if not ok then
155+
ngx.say("failed to connect: ", err)
156+
return
157+
end
158+
159+
local sess, err = sock:sslhandshake(nil, "$TEST_NGINX_NGROK_HOSTNAME", true)
160+
if not sess then
161+
ngx.say("failed to do SSL handshake: ", err)
162+
return
163+
else
164+
ngx.say("SSL handshake success")
165+
end
166+
167+
local req = "GET /foo HTTP/1.0\r\nHost: $TEST_NGINX_NGROK_HOSTNAME\r\nConnection: close\r\n\r\n"
168+
local bytes, err = sock:send(req)
169+
if not bytes then
170+
ngx.say("failed to send http request: ", err)
171+
return
172+
end
173+
174+
while true do
175+
local line, err = sock:receive()
176+
if not line then
177+
break
178+
end
179+
180+
ngx.say("received: ", line)
181+
end
182+
183+
local ok, err = sock:close()
184+
if not ok then
185+
ngx.say("failed to close: ", err)
186+
return
187+
end
188+
189+
-- Make a 3rd request back to the "generate_certs = false" server and
190+
-- ensure that it now returns a valid certificate (since it should still
191+
-- return already existing certs).
192+
ngx.print("\n")
193+
local sock = ngx.socket.tcp()
194+
sock:settimeout(30000)
195+
local ok, err = sock:connect("127.0.0.1:9443")
196+
if not ok then
197+
ngx.say("failed to connect: ", err)
198+
return
199+
end
200+
201+
local sess, err = sock:sslhandshake(nil, "$TEST_NGINX_NGROK_HOSTNAME", true)
202+
if not sess then
203+
ngx.say("failed to do SSL handshake: ", err)
204+
return
205+
else
206+
ngx.say("SSL handshake success")
207+
end
208+
209+
local req = "GET /foo HTTP/1.0\r\nHost: $TEST_NGINX_NGROK_HOSTNAME\r\nConnection: close\r\n\r\n"
210+
local bytes, err = sock:send(req)
211+
if not bytes then
212+
ngx.say("failed to send http request: ", err)
213+
return
214+
end
215+
216+
while true do
217+
local line, err = sock:receive()
218+
if not line then
219+
break
220+
end
221+
222+
ngx.say("received: ", line)
223+
end
224+
225+
local ok, err = sock:close()
226+
if not ok then
227+
ngx.say("failed to close: ", err)
228+
return
229+
end
230+
}
231+
}
232+
--- timeout: 30s
233+
--- request
234+
GET /t
235+
--- response_body
236+
failed to do SSL handshake: 18: self signed certificate
237+
received: HTTP/1.1 200 OK
238+
received: Server: openresty
239+
received: Content-Type: text/plain
240+
received: Connection: close
241+
received:
242+
received: generate_certs = false server
243+
244+
SSL handshake success
245+
received: HTTP/1.1 200 OK
246+
received: Server: openresty
247+
received: Content-Type: text/plain
248+
received: Connection: close
249+
received:
250+
received: generate_certs = default server
251+
252+
SSL handshake success
253+
received: HTTP/1.1 200 OK
254+
received: Server: openresty
255+
received: Content-Type: text/plain
256+
received: Connection: close
257+
received:
258+
received: generate_certs = false server
259+
--- error_log
260+
using fallback - did not issue certificate, because the generate_certs setting is false
261+
auto-ssl: issuing new certificate for
262+
--- no_error_log
263+
[warn]
264+
[alert]
265+
[emerg]

0 commit comments

Comments
 (0)