mirror of
https://github.com/bunkerity/bunkerweb
synced 2026-05-24 09:28:37 +00:00
Squashed 'src/deps/src/stream-lua-nginx-module/' changes from bea8a0c0de..982ce52831
982ce52831 bumped stream-lua-nginx-module to 15. 9b4c301d2c tests: updated ci for stream >= 1.25.5. ebcf8617e1 travis: bumped the NGINX core to 1.27.0. 5954e22fa1 bugfix: fixed keepalive error in cosocket. f56c53bc63 bugfix: treat shdict entries with ttl equal to 0 as expired. 97937e20b8 feature: add ssl trusted certificate. e974e57a4b dev: util/build.sh: fixed command line argument validation and environment variable usage. 65014a8216 feature: support lua balancer set proxy bind dynamic git-subtree-dir: src/deps/src/stream-lua-nginx-module git-subtree-split: 982ce5283172fd5ac5cba21bfc55b579568a0994
This commit is contained in:
Théophile Diot
parent
530d65989a
commit
e36d18ca47
27 changed files with 779 additions and 54 deletions
|
|
@ -44,16 +44,14 @@ env:
|
|||
- TEST_NGINX_SLEEP=0.006
|
||||
matrix:
|
||||
#- NGINX_VERSION=1.21.4 OPENSSL_VER=1.1.12
|
||||
- NGINX_VERSION=1.25.1 OPENSSL_VER=1.1.1w
|
||||
- NGINX_VERSION=1.25.1 OPENSSL_VER=1.1.1w USE_PCRE2=Y
|
||||
- NGINX_VERSION=1.27.0 OPENSSL_VER=1.1.1w
|
||||
- NGINX_VERSION=1.27.0 OPENSSL_VER=1.1.1w USE_PCRE2=Y
|
||||
|
||||
services:
|
||||
- memcache
|
||||
- redis-server
|
||||
|
||||
install:
|
||||
- sudo apt update
|
||||
- sudo apt install --only-upgrade ca-certificates
|
||||
- if [ "$USE_PCRE2" != "Y" ] && [ ! -f download-cache/pcre-$PCRE_VER.tar.gz ]; then wget -P download-cache/ https://downloads.sourceforge.net/project/pcre/pcre/${PCRE_VER}/pcre-${PCRE_VER}.tar.gz; fi
|
||||
- if [ "$USE_PCRE2" = "Y" ] && [ ! -f download-cache/pcre2-$PCRE2_VER.tar.gz ]; then wget -P download-cache https://downloads.sourceforge.net/project/pcre/pcre2/${PCRE2_VER}/pcre2-${PCRE2_VER}.tar.gz; fi
|
||||
- if [ ! -f download-cache/openssl-$OPENSSL_VER.tar.gz ]; then wget -P download-cache https://www.openssl.org/source/openssl-$OPENSSL_VER.tar.gz || wget -P download-cache https://www.openssl.org/source/old/${OPENSSL_VER//[a-z]/}/openssl-$OPENSSL_VER.tar.gz; fi
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@
|
|||
/* Public API for other Nginx modules */
|
||||
|
||||
|
||||
#define ngx_stream_lua_version 14
|
||||
#define ngx_stream_lua_version 15
|
||||
|
||||
|
||||
typedef struct {
|
||||
|
|
|
|||
|
|
@ -752,4 +752,74 @@ ngx_stream_lua_ffi_balancer_get_last_failure(ngx_stream_lua_request_t *r,
|
|||
}
|
||||
|
||||
|
||||
int
|
||||
ngx_stream_lua_ffi_balancer_bind_to_local_addr(ngx_stream_lua_request_t *r,
|
||||
const u_char *addr, size_t addr_len, u_char *errbuf, size_t *errbuf_size)
|
||||
{
|
||||
u_char *p;
|
||||
ngx_int_t rc;
|
||||
ngx_str_t addr_str;
|
||||
ngx_addr_t *addr_val;
|
||||
ngx_stream_lua_ctx_t *ctx;
|
||||
ngx_stream_upstream_t *u;
|
||||
|
||||
if (r == NULL) {
|
||||
p = ngx_snprintf(errbuf, *errbuf_size, "no request found");
|
||||
*errbuf_size = p - errbuf;
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
u = r->session->upstream;
|
||||
if (u == NULL) {
|
||||
p = ngx_snprintf(errbuf, *errbuf_size, "no upstream found");
|
||||
*errbuf_size = p - errbuf;
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
ctx = ngx_stream_lua_get_module_ctx(r, ngx_stream_lua_module);
|
||||
if (ctx == NULL) {
|
||||
p = ngx_snprintf(errbuf, *errbuf_size, "no ctx found");
|
||||
*errbuf_size = p - errbuf;
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
if ((ctx->context & NGX_STREAM_LUA_CONTEXT_BALANCER) == 0) {
|
||||
p = ngx_snprintf(errbuf, *errbuf_size,
|
||||
"API disabled in the current context");
|
||||
*errbuf_size = p - errbuf;
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
addr_val = ngx_pcalloc(r->pool, sizeof(ngx_addr_t));
|
||||
if (addr_val == NULL) {
|
||||
p = ngx_snprintf(errbuf, *errbuf_size, "no memory");
|
||||
*errbuf_size = p - errbuf;
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
addr_str.len = addr_len;
|
||||
addr_str.data = ngx_palloc(r->pool, addr_len);
|
||||
if (addr_str.data == NULL) {
|
||||
p = ngx_snprintf(errbuf, *errbuf_size, "no memory");
|
||||
*errbuf_size = p - errbuf;
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
ngx_memcpy(addr_str.data, addr, addr_len);
|
||||
|
||||
rc = ngx_parse_addr_port(r->pool, addr_val, addr_str.data, addr_str.len);
|
||||
if (rc != NGX_OK) {
|
||||
p = ngx_snprintf(errbuf, *errbuf_size, "parse addr port failed");
|
||||
*errbuf_size = p - errbuf;
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
addr_val->name = addr_str;
|
||||
|
||||
u->peer.local = addr_val;
|
||||
|
||||
return NGX_OK;
|
||||
}
|
||||
|
||||
|
||||
/* vi:set ft=c ts=4 sw=4 et fdm=marker: */
|
||||
|
|
|
|||
|
|
@ -225,7 +225,7 @@ ngx_stream_lua_shdict_lookup(ngx_shm_zone_t *shm_zone, ngx_uint_t hash,
|
|||
|
||||
dd("time to live: %lld", (long long) ms);
|
||||
|
||||
if (ms < 0) {
|
||||
if (ms <= 0) {
|
||||
dd("node already expired");
|
||||
return NGX_DONE;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5618,6 +5618,16 @@ ngx_stream_lua_socket_keepalive_close_handler(ngx_event_t *ev)
|
|||
"check stale events");
|
||||
|
||||
n = recv(c->fd, buf, 1, MSG_PEEK);
|
||||
#if (NGX_STREAM_SSL)
|
||||
/* ignore ssl protocol data like change cipher spec */
|
||||
if (n == 1 && c->ssl != NULL) {
|
||||
n = c->recv(c, (unsigned char *) buf, 1);
|
||||
if (n == NGX_AGAIN) {
|
||||
n = -1;
|
||||
ngx_socket_errno = NGX_EAGAIN;
|
||||
}
|
||||
}
|
||||
#endif /* NGX_STREAM_SSL */
|
||||
|
||||
if (n == -1 && ngx_socket_errno == NGX_EAGAIN) {
|
||||
/* stale event */
|
||||
|
|
|
|||
|
|
@ -1472,7 +1472,7 @@ ngx_stream_lua_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
|
|||
|
||||
int
|
||||
ngx_stream_lua_ffi_ssl_verify_client(ngx_stream_lua_request_t *r,
|
||||
void *ca_certs, int depth, char **err)
|
||||
void *client_cert, void *trusted_certs, int depth, char **err)
|
||||
{
|
||||
#ifdef LIBRESSL_VERSION_NUMBER
|
||||
|
||||
|
|
@ -1488,7 +1488,8 @@ ngx_stream_lua_ffi_ssl_verify_client(ngx_stream_lua_request_t *r,
|
|||
#else
|
||||
ngx_stream_ssl_conf_t *sscf;
|
||||
#endif
|
||||
STACK_OF(X509) *chain = ca_certs;
|
||||
STACK_OF(X509) *client_chain = client_cert;
|
||||
STACK_OF(X509) *trusted_chain = trusted_certs;
|
||||
STACK_OF(X509_NAME) *name_chain = NULL;
|
||||
X509 *x509 = NULL;
|
||||
X509_NAME *subject = NULL;
|
||||
|
|
@ -1544,54 +1545,75 @@ ngx_stream_lua_ffi_ssl_verify_client(ngx_stream_lua_request_t *r,
|
|||
|
||||
/* set CA chain */
|
||||
|
||||
if (chain != NULL) {
|
||||
if (client_chain != NULL || trusted_chain != NULL) {
|
||||
|
||||
ca_store = X509_STORE_new();
|
||||
if (ca_store == NULL) {
|
||||
*err = "X509_STORE_new() failed";
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
/* construct name chain */
|
||||
if (client_chain != NULL) {
|
||||
|
||||
name_chain = sk_X509_NAME_new_null();
|
||||
if (name_chain == NULL) {
|
||||
*err = "sk_X509_NAME_new_null() failed";
|
||||
goto failed;
|
||||
/* construct name chain */
|
||||
name_chain = sk_X509_NAME_new_null();
|
||||
if (name_chain == NULL) {
|
||||
*err = "sk_X509_NAME_new_null() failed";
|
||||
goto failed;
|
||||
}
|
||||
|
||||
for (i = 0; i < sk_X509_num(client_chain); i++) {
|
||||
x509 = sk_X509_value(client_chain, i);
|
||||
if (x509 == NULL) {
|
||||
*err = "sk_X509_value() failed";
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* add subject to name chain, which will be sent to client */
|
||||
subject = X509_NAME_dup(X509_get_subject_name(x509));
|
||||
if (subject == NULL) {
|
||||
*err = "X509_get_subject_name() failed";
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (!sk_X509_NAME_push(name_chain, subject)) {
|
||||
*err = "sk_X509_NAME_push() failed";
|
||||
X509_NAME_free(subject);
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* add to trusted CA store */
|
||||
if (X509_STORE_add_cert(ca_store, x509) == 0) {
|
||||
*err = "X509_STORE_add_cert() failed";
|
||||
goto failed;
|
||||
}
|
||||
}
|
||||
|
||||
/* clean subject name list, and set it for send to client */
|
||||
SSL_set_client_CA_list(ssl_conn, name_chain);
|
||||
}
|
||||
|
||||
for (i = 0; i < sk_X509_num(chain); i++) {
|
||||
x509 = sk_X509_value(chain, i);
|
||||
if (x509 == NULL) {
|
||||
*err = "sk_X509_value() failed";
|
||||
goto failed;
|
||||
}
|
||||
if (trusted_chain != NULL) {
|
||||
for (i = 0; i < sk_X509_num(trusted_chain); i++) {
|
||||
x509 = sk_X509_value(trusted_chain, i);
|
||||
if (x509 == NULL) {
|
||||
*err = "sk_X509_value() failed";
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* add subject to name chain, which will be sent to client */
|
||||
subject = X509_NAME_dup(X509_get_subject_name(x509));
|
||||
if (subject == NULL) {
|
||||
*err = "X509_get_subject_name() failed";
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (!sk_X509_NAME_push(name_chain, subject)) {
|
||||
*err = "sk_X509_NAME_push() failed";
|
||||
X509_NAME_free(subject);
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* add to trusted CA store */
|
||||
if (X509_STORE_add_cert(ca_store, x509) == 0) {
|
||||
*err = "X509_STORE_add_cert() failed";
|
||||
goto failed;
|
||||
/* add to trusted CA store */
|
||||
if (X509_STORE_add_cert(ca_store, x509) == 0) {
|
||||
*err = "X509_STORE_add_cert() failed";
|
||||
goto failed;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* clean ca_store, and store new ca_store */
|
||||
if (SSL_set0_verify_cert_store(ssl_conn, ca_store) == 0) {
|
||||
*err = "SSL_set0_verify_cert_store() failed";
|
||||
goto failed;
|
||||
}
|
||||
|
||||
SSL_set_client_CA_list(ssl_conn, name_chain);
|
||||
}
|
||||
|
||||
return NGX_OK;
|
||||
|
|
|
|||
|
|
@ -334,6 +334,7 @@ delete thread 1
|
|||
[error]
|
||||
--- error_log
|
||||
client prematurely closed connection
|
||||
--- skip_nginx: 4: >= 1.25.5
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -391,6 +391,7 @@ finalize stream session: 200
|
|||
--- no_error_log
|
||||
[warn]
|
||||
[error]
|
||||
--- skip_nginx: 5: >= 1.25.5
|
||||
|
||||
|
||||
|
||||
|
|
@ -509,6 +510,7 @@ received: hello world
|
|||
attempt to peek on a consumed socket
|
||||
--- no_error_log
|
||||
[warn]
|
||||
--- skip_nginx: 4: >= 1.25.5
|
||||
|
||||
|
||||
|
||||
|
|
@ -568,3 +570,4 @@ $ssl_preread_server_name = my.sni.server.name while prereading client data
|
|||
[warn]
|
||||
assertion failed!
|
||||
lua entry thread aborted
|
||||
--- skip_nginx: 8: >= 1.25.5
|
||||
|
|
|
|||
|
|
@ -199,6 +199,7 @@ $ssl_preread_server_name = my.sni.server.name while prereading client data
|
|||
--- no_error_log
|
||||
[crit]
|
||||
[warn]
|
||||
--- skip_nginx: 5: >= 1.25.5
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,19 @@
|
|||
# vim:set ft= ts=4 sw=4 et fdm=marker:
|
||||
|
||||
use Test::Nginx::Socket::Lua::Stream;
|
||||
our $SkipReason;
|
||||
|
||||
BEGIN {
|
||||
use Test::Nginx::Util;
|
||||
|
||||
my $nginx_version = Test::Nginx::Util::get_nginx_version();
|
||||
|
||||
if (eval "$nginx_version >= 1.25.5") {
|
||||
$SkipReason = "Nginx version greater than 1.25.5 have changed behavior, current version $nginx_version";
|
||||
}
|
||||
}
|
||||
|
||||
use Test::Nginx::Socket::Lua::Stream $SkipReason ? (skip_all => $SkipReason) : ();
|
||||
|
||||
repeat_each(2);
|
||||
|
||||
plan tests => repeat_each() * (blocks() * 5);
|
||||
|
|
|
|||
|
|
@ -1,5 +1,17 @@
|
|||
# vim:set ft= ts=4 sw=4 et fdm=marker:
|
||||
|
||||
our $SkipReason;
|
||||
|
||||
BEGIN {
|
||||
use Test::Nginx::Util;
|
||||
|
||||
my $nginx_version = Test::Nginx::Util::get_nginx_version();
|
||||
|
||||
if (eval "$nginx_version >= 1.25.5") {
|
||||
$SkipReason = "Nginx version greater than 1.25.5 have changed behavior, current version $nginx_version";
|
||||
}
|
||||
}
|
||||
|
||||
BEGIN {
|
||||
if (!defined $ENV{LD_PRELOAD}) {
|
||||
$ENV{LD_PRELOAD} = '';
|
||||
|
|
@ -20,7 +32,7 @@ BEGIN {
|
|||
$ENV{MOCKEAGAIN_WRITE_TIMEOUT_PATTERN} = 'get helloworld';
|
||||
}
|
||||
|
||||
use Test::Nginx::Socket::Lua::Stream;
|
||||
use Test::Nginx::Socket::Lua::Stream $SkipReason ? (skip_all => $SkipReason) : ();
|
||||
repeat_each(2);
|
||||
|
||||
plan tests => repeat_each() * (blocks() * 4 + 8);
|
||||
|
|
|
|||
|
|
@ -1,6 +1,18 @@
|
|||
# vim:set ft= ts=4 sw=4 et fdm=marker:
|
||||
|
||||
use Test::Nginx::Socket::Lua::Stream;
|
||||
our $SkipReason;
|
||||
|
||||
BEGIN {
|
||||
use Test::Nginx::Util;
|
||||
|
||||
my $nginx_version = Test::Nginx::Util::get_nginx_version();
|
||||
|
||||
if (eval "$nginx_version >= 1.25.5") {
|
||||
$SkipReason = "Nginx version greater than 1.25.5 have changed behavior, current version $nginx_version";
|
||||
}
|
||||
}
|
||||
|
||||
use Test::Nginx::Socket::Lua::Stream $SkipReason ? (skip_all => $SkipReason) : ();
|
||||
repeat_each(2);
|
||||
|
||||
plan tests => repeat_each() * 24;
|
||||
|
|
|
|||
|
|
@ -1533,11 +1533,11 @@ set keepalive: 1 nil
|
|||
--- grep_error_log eval: qr/stream lua ssl (?:set|save|free) session: [0-9A-F]+/
|
||||
--- grep_error_log_out eval
|
||||
qr/^stream lua ssl save session: ([0-9A-F]+)
|
||||
stream lua ssl save session: \1
|
||||
stream lua ssl save session: \1
|
||||
stream lua ssl free session: \1
|
||||
stream lua ssl free session: \1
|
||||
stream lua ssl free session: \1
|
||||
stream lua ssl save session: ([0-9A-F]+)
|
||||
stream lua ssl save session: ([0-9A-F]+)
|
||||
stream lua ssl free session: ([0-9A-F]+)
|
||||
stream lua ssl free session: ([0-9A-F]+)
|
||||
stream lua ssl free session: ([0-9A-F]+)
|
||||
$/
|
||||
|
||||
--- error_log
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
|
|||
if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
|
||||
plan(skip_all => "too old OpenSSL, need 1.0.2e, was $1");
|
||||
} else {
|
||||
plan tests => repeat_each() * (blocks() * 5 + 1);
|
||||
plan tests => repeat_each() * (blocks() * 5 - 1);
|
||||
}
|
||||
|
||||
$ENV{TEST_NGINX_HTML_DIR} ||= html_dir();
|
||||
|
|
@ -67,7 +67,7 @@ ffi.cdef[[
|
|||
|
||||
void ngx_stream_lua_ffi_free_priv_key(void *cdata);
|
||||
|
||||
int ngx_stream_lua_ffi_ssl_verify_client(void *r, void *cdata, int depth, char **err);
|
||||
int ngx_stream_lua_ffi_ssl_verify_client(void *r, void *cdata, void *cdata, int depth, char **err);
|
||||
|
||||
int ngx_stream_lua_ffi_ssl_client_random(ngx_stream_lua_request_t *r,
|
||||
unsigned char *out, size_t *outlen, char **err);
|
||||
|
|
@ -722,7 +722,7 @@ lua ssl server name: "test.com"
|
|||
return
|
||||
end
|
||||
|
||||
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, cert, -1, errmsg)
|
||||
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, cert, nil, -1, errmsg)
|
||||
if rc ~= 0 then
|
||||
ngx.log(ngx.ERR, "failed to set cdata cert: ",
|
||||
ffi.string(errmsg[0]))
|
||||
|
|
@ -778,7 +778,7 @@ client certificate subject: emailAddress=agentzh@gmail.com,CN=test.com
|
|||
return
|
||||
end
|
||||
|
||||
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, nil, -1, errmsg)
|
||||
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, nil, nil, -1, errmsg)
|
||||
if rc ~= 0 then
|
||||
ngx.log(ngx.ERR, "failed to set cdata cert: ",
|
||||
ffi.string(errmsg[0]))
|
||||
|
|
@ -843,7 +843,7 @@ client certificate subject: emailAddress=agentzh@gmail.com,CN=test.com
|
|||
return
|
||||
end
|
||||
|
||||
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, cert, 1, errmsg)
|
||||
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, cert, nil, 1, errmsg)
|
||||
if rc ~= 0 then
|
||||
ngx.log(ngx.ERR, "failed to set cdata cert: ",
|
||||
ffi.string(errmsg[0]))
|
||||
|
|
@ -1236,3 +1236,141 @@ lua ssl server name: "test.com"
|
|||
--- no_error_log
|
||||
[error]
|
||||
[alert]
|
||||
|
||||
|
||||
|
||||
=== TEST 12: verify client, but server don't trust root ca
|
||||
--- stream_config
|
||||
server {
|
||||
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
|
||||
|
||||
ssl_certificate ../../cert/mtls_server.crt;
|
||||
ssl_certificate_key ../../cert/mtls_server.key;
|
||||
|
||||
ssl_certificate_by_lua_block {
|
||||
collectgarbage()
|
||||
|
||||
local ffi = require "ffi"
|
||||
require "defines"
|
||||
|
||||
local errmsg = ffi.new("char *[1]")
|
||||
|
||||
local r = require "resty.core.base" .get_request()
|
||||
if not r then
|
||||
ngx.log(ngx.ERR, "no request found")
|
||||
return
|
||||
end
|
||||
|
||||
local f = assert(io.open("t/cert/mtls_server.crt", "rb"))
|
||||
local cert_data = f:read("*all")
|
||||
f:close()
|
||||
|
||||
local client_certs = ffi.C.ngx_stream_lua_ffi_parse_pem_cert(cert_data, #cert_data, errmsg)
|
||||
if not client_certs then
|
||||
ngx.log(ngx.ERR, "failed to parse PEM client certs: ",
|
||||
ffi.string(errmsg[0]))
|
||||
return
|
||||
end
|
||||
|
||||
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, client_certs, nil, 1, errmsg)
|
||||
if rc ~= 0 then
|
||||
ngx.log(ngx.ERR, "failed to set cdata cert: ",
|
||||
ffi.string(errmsg[0]))
|
||||
return
|
||||
end
|
||||
|
||||
ffi.C.ngx_stream_lua_ffi_free_cert(client_certs)
|
||||
}
|
||||
|
||||
content_by_lua_block {
|
||||
ngx.say(ngx.var.ssl_client_verify)
|
||||
}
|
||||
}
|
||||
--- stream_server_config
|
||||
proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
|
||||
proxy_ssl on;
|
||||
proxy_ssl_certificate ../../cert/mtls_client.crt;
|
||||
proxy_ssl_certificate_key ../../cert/mtls_client.key;
|
||||
proxy_ssl_session_reuse off;
|
||||
|
||||
--- stream_response
|
||||
FAILED:unable to verify the first certificate
|
||||
|
||||
--- no_error_log
|
||||
[error]
|
||||
[alert]
|
||||
|
||||
|
||||
|
||||
=== TEST 13: verify client and server trust root ca
|
||||
--- stream_config
|
||||
server {
|
||||
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
|
||||
|
||||
ssl_certificate ../../cert/mtls_server.crt;
|
||||
ssl_certificate_key ../../cert/mtls_server.key;
|
||||
|
||||
ssl_certificate_by_lua_block {
|
||||
collectgarbage()
|
||||
|
||||
local ffi = require "ffi"
|
||||
require "defines"
|
||||
|
||||
local errmsg = ffi.new("char *[1]")
|
||||
|
||||
local r = require "resty.core.base" .get_request()
|
||||
if not r then
|
||||
ngx.log(ngx.ERR, "no request found")
|
||||
return
|
||||
end
|
||||
|
||||
local f = assert(io.open("t/cert/mtls_server.crt", "rb"))
|
||||
local cert_data = f:read("*all")
|
||||
f:close()
|
||||
|
||||
local client_certs = ffi.C.ngx_stream_lua_ffi_parse_pem_cert(cert_data, #cert_data, errmsg)
|
||||
if not client_certs then
|
||||
ngx.log(ngx.ERR, "failed to parse PEM client certs: ",
|
||||
ffi.string(errmsg[0]))
|
||||
return
|
||||
end
|
||||
|
||||
local f = assert(io.open("t/cert/mtls_ca.crt", "rb"))
|
||||
local cert_data = f:read("*all")
|
||||
f:close()
|
||||
|
||||
local trusted_certs = ffi.C.ngx_stream_lua_ffi_parse_pem_cert(cert_data, #cert_data, errmsg)
|
||||
if not trusted_certs then
|
||||
ngx.log(ngx.ERR, "failed to parse PEM trusted certs: ",
|
||||
ffi.string(errmsg[0]))
|
||||
return
|
||||
end
|
||||
|
||||
local rc = ffi.C.ngx_stream_lua_ffi_ssl_verify_client(r, client_certs, trusted_certs, 1, errmsg)
|
||||
if rc ~= 0 then
|
||||
ngx.log(ngx.ERR, "failed to set cdata cert: ",
|
||||
ffi.string(errmsg[0]))
|
||||
return
|
||||
end
|
||||
|
||||
ffi.C.ngx_stream_lua_ffi_free_cert(client_certs)
|
||||
ffi.C.ngx_stream_lua_ffi_free_cert(trusted_certs)
|
||||
}
|
||||
|
||||
content_by_lua_block {
|
||||
ngx.say(ngx.var.ssl_client_verify)
|
||||
}
|
||||
}
|
||||
--- stream_server_config
|
||||
proxy_pass unix:$TEST_NGINX_HTML_DIR/nginx.sock;
|
||||
proxy_ssl on;
|
||||
proxy_ssl_certificate ../../cert/mtls_client.crt;
|
||||
proxy_ssl_certificate_key ../../cert/mtls_client.key;
|
||||
proxy_ssl_session_reuse off;
|
||||
|
||||
--- stream_response
|
||||
SUCCESS
|
||||
|
||||
--- no_error_log
|
||||
[error]
|
||||
[alert]
|
||||
|
|
|
|||
78
t/cert/mtls_ca.crt
Normal file
78
t/cert/mtls_ca.crt
Normal file
|
|
@ -0,0 +1,78 @@
|
|||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number:
|
||||
32:ed:21:56:d8:4e:aa:03:89:a9:4a:a4:e2:85:2d:8a:3b:2b:89:22
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = California, O = OpenResty, CN = OpenResty Testing Root CA
|
||||
Validity
|
||||
Not Before: Mar 13 15:49:00 2022 GMT
|
||||
Not After : Mar 8 15:49:00 2042 GMT
|
||||
Subject: C = US, ST = California, O = OpenResty, CN = OpenResty Testing Root CA
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
RSA Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:e6:37:d2:c6:17:36:c7:b2:7f:7d:cf:d0:62:87:
|
||||
99:d9:21:b8:de:ff:d8:e2:3a:1c:68:90:8f:ce:17:
|
||||
68:22:b0:60:30:cc:29:e8:34:ee:ff:b2:25:de:6e:
|
||||
1a:d4:df:10:19:11:4b:40:61:d3:a9:4d:80:ed:97:
|
||||
81:4e:c5:74:e8:4d:63:e3:5f:21:bc:5a:6e:22:a0:
|
||||
17:91:c1:cb:25:53:9b:9d:4e:e1:51:5b:f6:52:e7:
|
||||
0a:27:f6:16:c2:31:cb:6c:47:f4:89:51:15:cc:06:
|
||||
be:31:3e:1c:ea:ee:81:9b:c4:97:96:fd:e5:1c:95:
|
||||
9e:c0:65:cd:a9:9a:cb:68:67:f2:62:a0:21:eb:5a:
|
||||
c5:a1:92:ed:32:41:28:f9:47:34:eb:44:ae:d6:e7:
|
||||
76:71:11:98:c9:2e:ce:6c:7c:10:1b:c7:4c:c3:14:
|
||||
89:4e:d9:4c:d9:c7:43:e9:3c:29:ca:62:a9:91:b3:
|
||||
87:e7:d7:b4:18:ab:65:f9:6b:ed:82:ca:a1:36:35:
|
||||
18:05:cb:5c:24:26:13:13:f8:99:ac:99:be:9b:a6:
|
||||
73:df:0d:16:95:b1:dc:be:fe:7a:c2:b6:dc:c8:93:
|
||||
cf:10:e0:29:03:0e:28:78:18:84:ee:14:92:ab:be:
|
||||
5a:a0:14:a2:4a:2f:d3:d0:b8:0e:00:d2:5a:cd:e4:
|
||||
bd:a1
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Key Usage: critical
|
||||
Certificate Sign, CRL Sign
|
||||
X509v3 Basic Constraints: critical
|
||||
CA:TRUE
|
||||
X509v3 Subject Key Identifier:
|
||||
F0:D7:4B:14:73:E1:67:00:6B:54:B4:19:20:76:12:9F:9D:8E:C8:09
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
6d:52:21:6d:6e:8c:e5:4a:28:07:65:6d:d8:7c:23:2e:c6:c1:
|
||||
d0:ec:27:b3:b0:c3:d3:e8:fa:72:b9:de:32:4e:ff:97:8d:86:
|
||||
a9:6d:b3:a9:b4:2d:77:ca:28:97:6a:3d:7b:a2:15:ed:34:dc:
|
||||
72:9f:6f:e7:01:0c:d3:28:6a:80:1b:50:09:fd:d7:2c:d8:92:
|
||||
d5:10:c4:73:15:20:7d:99:dc:de:30:7b:3c:6e:e9:66:b2:0e:
|
||||
4e:1a:c1:51:57:6e:5b:b0:a9:f6:ff:0b:8f:07:67:31:40:5b:
|
||||
11:a9:06:d3:d3:76:c5:d2:56:95:9a:9e:4a:16:44:4b:32:e5:
|
||||
af:dd:4b:4d:5d:57:b8:85:69:36:93:2a:c6:0c:8f:e1:42:35:
|
||||
be:8e:f3:e7:35:d3:2c:3a:03:31:40:75:8e:e8:dd:57:35:20:
|
||||
5e:18:a9:76:ce:85:be:7e:3a:cf:6e:08:58:5b:47:d5:e9:c4:
|
||||
ec:0e:e9:8e:3c:2d:5c:7b:59:20:5b:24:92:a0:e0:1e:a3:5a:
|
||||
67:d8:ff:7f:a5:82:f1:df:db:05:65:79:88:b1:3c:e6:01:d1:
|
||||
5a:c7:d2:6e:9a:e6:a2:da:4a:c7:19:78:d9:14:71:6e:1f:70:
|
||||
f3:41:e5:b3:78:31:d5:22:0e:7c:1a:b2:43:d9:86:ff:53:ea:
|
||||
2b:ba:d2:27
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDhDCCAmygAwIBAgIUMu0hVthOqgOJqUqk4oUtijsriSIwDQYJKoZIhvcNAQEL
|
||||
BQAwWjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEjAQBgNVBAoT
|
||||
CU9wZW5SZXN0eTEiMCAGA1UEAxMZT3BlblJlc3R5IFRlc3RpbmcgUm9vdCBDQTAe
|
||||
Fw0yMjAzMTMxNTQ5MDBaFw00MjAzMDgxNTQ5MDBaMFoxCzAJBgNVBAYTAlVTMRMw
|
||||
EQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQKEwlPcGVuUmVzdHkxIjAgBgNVBAMT
|
||||
GU9wZW5SZXN0eSBUZXN0aW5nIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IB
|
||||
DwAwggEKAoIBAQDmN9LGFzbHsn99z9Bih5nZIbje/9jiOhxokI/OF2gisGAwzCno
|
||||
NO7/siXebhrU3xAZEUtAYdOpTYDtl4FOxXToTWPjXyG8Wm4ioBeRwcslU5udTuFR
|
||||
W/ZS5won9hbCMctsR/SJURXMBr4xPhzq7oGbxJeW/eUclZ7AZc2pmstoZ/JioCHr
|
||||
WsWhku0yQSj5RzTrRK7W53ZxEZjJLs5sfBAbx0zDFIlO2UzZx0PpPCnKYqmRs4fn
|
||||
17QYq2X5a+2CyqE2NRgFy1wkJhMT+Jmsmb6bpnPfDRaVsdy+/nrCttzIk88Q4CkD
|
||||
Dih4GITuFJKrvlqgFKJKL9PQuA4A0lrN5L2hAgMBAAGjQjBAMA4GA1UdDwEB/wQE
|
||||
AwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTw10sUc+FnAGtUtBkgdhKf
|
||||
nY7ICTANBgkqhkiG9w0BAQsFAAOCAQEAbVIhbW6M5UooB2Vt2HwjLsbB0Owns7DD
|
||||
0+j6crneMk7/l42GqW2zqbQtd8ool2o9e6IV7TTccp9v5wEM0yhqgBtQCf3XLNiS
|
||||
1RDEcxUgfZnc3jB7PG7pZrIOThrBUVduW7Cp9v8LjwdnMUBbEakG09N2xdJWlZqe
|
||||
ShZESzLlr91LTV1XuIVpNpMqxgyP4UI1vo7z5zXTLDoDMUB1jujdVzUgXhipds6F
|
||||
vn46z24IWFtH1enE7A7pjjwtXHtZIFskkqDgHqNaZ9j/f6WC8d/bBWV5iLE85gHR
|
||||
WsfSbprmotpKxxl42RRxbh9w80Hls3gx1SIOfBqyQ9mG/1PqK7rSJw==
|
||||
-----END CERTIFICATE-----
|
||||
27
t/cert/mtls_ca.key
Normal file
27
t/cert/mtls_ca.key
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEA5jfSxhc2x7J/fc/QYoeZ2SG43v/Y4jocaJCPzhdoIrBgMMwp
|
||||
6DTu/7Il3m4a1N8QGRFLQGHTqU2A7ZeBTsV06E1j418hvFpuIqAXkcHLJVObnU7h
|
||||
UVv2UucKJ/YWwjHLbEf0iVEVzAa+MT4c6u6Bm8SXlv3lHJWewGXNqZrLaGfyYqAh
|
||||
61rFoZLtMkEo+Uc060Su1ud2cRGYyS7ObHwQG8dMwxSJTtlM2cdD6TwpymKpkbOH
|
||||
59e0GKtl+WvtgsqhNjUYBctcJCYTE/iZrJm+m6Zz3w0WlbHcvv56wrbcyJPPEOAp
|
||||
Aw4oeBiE7hSSq75aoBSiSi/T0LgOANJazeS9oQIDAQABAoIBAQDhH9+uNE8uUv/X
|
||||
MNvvLfklWpOlBf25o+fZ3NuzRjJgEafOsCee2fyI8FWVwIfeeE8OpFm5GLDZk1+r
|
||||
dwdM10xuSheO5Z1gyfF/TJwfvamA09SNrPArFkm3YhUNZNl2hykMtwSLL06oWEOu
|
||||
dbXjit4VS9aNIbTlEe7O5/6Ih0W3zmr1yvUua2swmAZMx3GFA4kbjZZ9vDs27sdu
|
||||
K+VY3DYRbq1HkiNFT0otfke5bObFBCG7Yp8JLyhYaIkGYFoBXuZ6JNY8EuU2+YyP
|
||||
6r40tJ7StR1Q6eZJh9/1leaYGZLCh5oFyKpilTuxHbRbr5A28RJKjKvPsdDgTtQn
|
||||
yHGg70FRAoGBAOhC3TQlFcT2WCCZHHql9JEEHnHVBWnL3Jg7VJuL1i6pEIz7qQkW
|
||||
AtBEIY/nnTcVNfJ6eXznYtutYvvRSgQTUsBNRoj3s1z9wKOo4uw4LoIUXDEmHCr+
|
||||
49DiQyIO21SNMHA+dVxvGRDDjLI9Uc+Scb64QOodoX75HLRZG++24mtdAoGBAP2/
|
||||
gCjga2p8Jx9UnhIcrEIIGANyxEQeBdhF56Nt9CJy/Iwi3a6qQ/GkbeoDm5FhXnXo
|
||||
xcBaHyv2lwi4uO/hONY8eRnYxAWMwAKMZe6VnU1hWI2Ytkh+OcMPMh7NIGQf6X1o
|
||||
JZrBtnTms060TuuDjLeIlaubDR/xDrMWTMKjKbsVAoGAVLuYAZ8J6xpIGlRhbGlA
|
||||
6OrMxJCHcgpahvsWKc0BLXKmRBjHmTX7fslsSRihZWgKj1SZH7U2fpgpxV6cFxKJ
|
||||
nPhUJEHhoKo+bjZ92tnANdqBq7iQjCsDJ8Bz52fuIlGD+1795+PsDA6bNKdkQkrV
|
||||
zlNf80kuEqmFDFJ5+6EHx00CgYAf+jkpbZa71aeMgDpnZ+uhaqm0DYuEVhBAgBa/
|
||||
9sRUbw86jc5IC7cCRcmAOzIosQ+ZZls9cV4KSUohVD4iJMzn2rkcM8AIPwOXjp/t
|
||||
4DbxoHnrZjpaimW3Gjwju5AAbjEbl7tddFoNA2HHYlurvGlIW9MYzDJsOxGyKfZE
|
||||
dRF2PQKBgQDUKNHgDYEjLJ99S5Fm5zN/64bKzzDtktGdqOxik5pBKcs/BvOdLM0i
|
||||
eCjGz/3qrEoenFIBwF/IRz3ug90Zr8bWOu6DudReflAKI/N13dZ2gOTAfaX4ljJF
|
||||
w0ohSi6xs+mu1GmtipGtNxHi/J3na2BeSnSRFSUg6Zd+oh8BZQKmNg==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
4
t/cert/mtls_cert_gen/.gitignore
vendored
Normal file
4
t/cert/mtls_cert_gen/.gitignore
vendored
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
*.pem
|
||||
*.csr
|
||||
cfssl
|
||||
cfssljson
|
||||
23
t/cert/mtls_cert_gen/generate.sh
Executable file
23
t/cert/mtls_cert_gen/generate.sh
Executable file
|
|
@ -0,0 +1,23 @@
|
|||
#!/bin/bash
|
||||
|
||||
rm *.pem *.csr cfssl cfssljson
|
||||
|
||||
wget -O cfssl https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssl_1.6.1_linux_amd64
|
||||
wget -O cfssljson https://github.com/cloudflare/cfssl/releases/download/v1.6.1/cfssljson_1.6.1_linux_amd64
|
||||
chmod +x cfssl cfssljson
|
||||
|
||||
./cfssl gencert -initca -config profile.json mtls_ca.json | ./cfssljson -bare mtls_ca
|
||||
|
||||
./cfssl gencert -ca mtls_ca.pem -ca-key mtls_ca-key.pem -config profile.json -profile=client mtls_client.json | ./cfssljson -bare mtls_client
|
||||
./cfssl gencert -ca mtls_ca.pem -ca-key mtls_ca-key.pem -config profile.json -profile=server mtls_server.json | ./cfssljson -bare mtls_server
|
||||
|
||||
openssl x509 -in mtls_ca.pem -text > ../mtls_ca.crt
|
||||
mv mtls_ca-key.pem ../mtls_ca.key
|
||||
|
||||
openssl x509 -in mtls_client.pem -text > ../mtls_client.crt
|
||||
mv mtls_client-key.pem ../mtls_client.key
|
||||
|
||||
openssl x509 -in mtls_server.pem -text > ../mtls_server.crt
|
||||
mv mtls_server-key.pem ../mtls_server.key
|
||||
|
||||
rm *.pem *.csr cfssl cfssljson
|
||||
18
t/cert/mtls_cert_gen/mtls_ca.json
Normal file
18
t/cert/mtls_cert_gen/mtls_ca.json
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"CA": {
|
||||
"expiry": "175200h",
|
||||
"pathlen": 0
|
||||
},
|
||||
"CN": "OpenResty Testing Root CA",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "US",
|
||||
"O": "OpenResty",
|
||||
"ST": "California"
|
||||
}
|
||||
]
|
||||
}
|
||||
18
t/cert/mtls_cert_gen/mtls_client.json
Normal file
18
t/cert/mtls_cert_gen/mtls_client.json
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"CN": "foo@example.com",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "US",
|
||||
"O": "OpenResty",
|
||||
"ST": "California"
|
||||
}
|
||||
],
|
||||
"hosts": [
|
||||
"foo@example.com",
|
||||
"bar@example.com"
|
||||
]
|
||||
}
|
||||
17
t/cert/mtls_cert_gen/mtls_server.json
Normal file
17
t/cert/mtls_cert_gen/mtls_server.json
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"CN": "example.com",
|
||||
"key": {
|
||||
"algo": "rsa",
|
||||
"size": 2048
|
||||
},
|
||||
"names": [
|
||||
{
|
||||
"C": "US",
|
||||
"O": "OpenResty",
|
||||
"ST": "California"
|
||||
}
|
||||
],
|
||||
"hosts": [
|
||||
"example.com"
|
||||
]
|
||||
}
|
||||
27
t/cert/mtls_cert_gen/profile.json
Normal file
27
t/cert/mtls_cert_gen/profile.json
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
{
|
||||
"signing": {
|
||||
"default": {
|
||||
"expiry": "175200h"
|
||||
},
|
||||
"profiles": {
|
||||
"server": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signing",
|
||||
"key encipherment",
|
||||
"server auth"
|
||||
],
|
||||
"expiry": "175199h"
|
||||
},
|
||||
"client": {
|
||||
"usages": [
|
||||
"signing",
|
||||
"digital signature",
|
||||
"key encipherment",
|
||||
"client auth"
|
||||
],
|
||||
"expiry": "175199h"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
87
t/cert/mtls_client.crt
Normal file
87
t/cert/mtls_client.crt
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number:
|
||||
19:0a:a3:a8:9c:d4:0f:dc:c6:fa:23:7b:f8:fc:bd:f4:73:4e:7e:b1
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = California, O = OpenResty, CN = OpenResty Testing Root CA
|
||||
Validity
|
||||
Not Before: Mar 13 15:49:00 2022 GMT
|
||||
Not After : Mar 8 14:49:00 2042 GMT
|
||||
Subject: C = US, ST = California, O = OpenResty, CN = foo@example.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
RSA Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:be:5b:09:4c:94:71:d3:82:54:4a:42:6a:76:aa:
|
||||
34:5d:28:d9:45:e6:44:9a:74:9f:a6:e6:78:49:9e:
|
||||
c6:20:75:32:5f:92:3b:ec:6e:4b:7b:b0:75:1c:75:
|
||||
09:00:05:77:d6:59:ca:55:5b:13:b6:76:3a:c6:18:
|
||||
dc:37:6a:20:93:e6:26:56:5d:0b:96:8c:01:f2:96:
|
||||
38:08:08:36:a2:64:12:21:a0:8d:48:cd:9a:26:78:
|
||||
92:29:b6:63:eb:14:d9:b6:e5:87:f7:d5:55:a4:cc:
|
||||
53:1c:a3:7c:b8:bd:ad:7c:a4:d4:86:1f:a7:1c:43:
|
||||
c5:1a:b5:f1:03:bd:fe:19:98:1d:b7:13:2b:93:a2:
|
||||
2a:0e:21:7e:42:a9:bb:28:69:49:59:e7:89:0e:7d:
|
||||
5a:ce:fb:d4:0c:20:6a:e1:db:b2:6a:e5:a7:55:e0:
|
||||
d0:58:4a:e2:08:78:82:b9:06:0c:65:f9:24:06:e6:
|
||||
8a:13:b2:9a:ef:1b:4a:b2:3a:b4:98:7f:dd:3c:0e:
|
||||
85:0b:a6:c6:47:2f:63:c2:73:52:41:db:7c:06:c3:
|
||||
2a:b5:2d:d1:e1:30:d5:c4:79:c9:b9:35:68:46:ad:
|
||||
c4:45:57:ea:11:88:27:37:ed:ac:49:2d:c4:d6:c6:
|
||||
a6:74:8d:d3:bc:e0:d9:69:25:0c:0c:b0:e3:b7:cb:
|
||||
8d:99
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Key Usage: critical
|
||||
Digital Signature, Key Encipherment
|
||||
X509v3 Extended Key Usage:
|
||||
TLS Web Client Authentication
|
||||
X509v3 Basic Constraints: critical
|
||||
CA:FALSE
|
||||
X509v3 Subject Key Identifier:
|
||||
22:70:5E:30:8C:4D:66:39:E7:60:C9:29:A2:ED:95:32:34:63:5C:C0
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:F0:D7:4B:14:73:E1:67:00:6B:54:B4:19:20:76:12:9F:9D:8E:C8:09
|
||||
|
||||
X509v3 Subject Alternative Name:
|
||||
email:foo@example.com, email:bar@example.com
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
96:e7:2a:fc:2a:56:16:80:e2:d3:79:0c:46:db:c3:88:ab:d3:
|
||||
ef:39:66:4b:a9:ab:6c:0e:30:08:07:7c:fc:03:6c:f7:dd:fb:
|
||||
3e:a8:c8:68:28:ab:4e:73:97:80:27:5d:c5:9d:52:00:aa:08:
|
||||
25:c8:f9:dc:df:64:73:a4:58:5b:bd:5f:1a:53:a4:33:a3:b1:
|
||||
45:38:2d:be:d7:f3:a4:c4:f4:7a:07:71:44:f1:a2:65:02:e4:
|
||||
71:84:01:b5:83:4b:de:83:b5:ad:ac:b9:3c:17:42:0c:9a:7d:
|
||||
eb:7f:ab:26:dd:9b:3a:fd:95:37:55:cc:01:c3:3f:20:df:e5:
|
||||
ed:49:51:7a:42:ea:f3:8a:3f:da:6e:c1:1a:11:b9:45:4d:6e:
|
||||
c9:21:f4:e3:4f:31:72:5b:bb:01:92:b6:7f:f1:8a:9e:6c:d0:
|
||||
7f:96:d7:eb:29:09:53:38:26:41:00:f2:33:04:77:bd:a9:ee:
|
||||
60:9e:06:b7:7d:26:ae:1c:4f:56:bd:a5:b6:50:40:be:be:84:
|
||||
2a:54:21:59:47:7d:a5:1e:63:6d:28:36:4d:a6:e4:62:69:9b:
|
||||
9b:fa:2b:48:e8:64:d7:14:f4:62:a2:26:17:a5:05:58:4a:38:
|
||||
d2:44:e7:33:90:b9:c1:8c:85:02:99:b8:03:1a:03:d2:cf:ac:
|
||||
a5:6b:44:98
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIID3DCCAsSgAwIBAgIUGQqjqJzUD9zG+iN7+Py99HNOfrEwDQYJKoZIhvcNAQEL
|
||||
BQAwWjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEjAQBgNVBAoT
|
||||
CU9wZW5SZXN0eTEiMCAGA1UEAxMZT3BlblJlc3R5IFRlc3RpbmcgUm9vdCBDQTAe
|
||||
Fw0yMjAzMTMxNTQ5MDBaFw00MjAzMDgxNDQ5MDBaMFAxCzAJBgNVBAYTAlVTMRMw
|
||||
EQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQKEwlPcGVuUmVzdHkxGDAWBgNVBAMM
|
||||
D2Zvb0BleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
|
||||
AL5bCUyUcdOCVEpCanaqNF0o2UXmRJp0n6bmeEmexiB1Ml+SO+xuS3uwdRx1CQAF
|
||||
d9ZZylVbE7Z2OsYY3DdqIJPmJlZdC5aMAfKWOAgINqJkEiGgjUjNmiZ4kim2Y+sU
|
||||
2bblh/fVVaTMUxyjfLi9rXyk1IYfpxxDxRq18QO9/hmYHbcTK5OiKg4hfkKpuyhp
|
||||
SVnniQ59Ws771AwgauHbsmrlp1Xg0FhK4gh4grkGDGX5JAbmihOymu8bSrI6tJh/
|
||||
3TwOhQumxkcvY8JzUkHbfAbDKrUt0eEw1cR5ybk1aEatxEVX6hGIJzftrEktxNbG
|
||||
pnSN07zg2WklDAyw47fLjZkCAwEAAaOBozCBoDAOBgNVHQ8BAf8EBAMCBaAwEwYD
|
||||
VR0lBAwwCgYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUInBeMIxN
|
||||
ZjnnYMkpou2VMjRjXMAwHwYDVR0jBBgwFoAU8NdLFHPhZwBrVLQZIHYSn52OyAkw
|
||||
KwYDVR0RBCQwIoEPZm9vQGV4YW1wbGUuY29tgQ9iYXJAZXhhbXBsZS5jb20wDQYJ
|
||||
KoZIhvcNAQELBQADggEBAJbnKvwqVhaA4tN5DEbbw4ir0+85Zkupq2wOMAgHfPwD
|
||||
bPfd+z6oyGgoq05zl4AnXcWdUgCqCCXI+dzfZHOkWFu9XxpTpDOjsUU4Lb7X86TE
|
||||
9HoHcUTxomUC5HGEAbWDS96Dta2suTwXQgyafet/qybdmzr9lTdVzAHDPyDf5e1J
|
||||
UXpC6vOKP9puwRoRuUVNbskh9ONPMXJbuwGStn/xip5s0H+W1+spCVM4JkEA8jME
|
||||
d72p7mCeBrd9Jq4cT1a9pbZQQL6+hCpUIVlHfaUeY20oNk2m5GJpm5v6K0joZNcU
|
||||
9GKiJhelBVhKONJE5zOQucGMhQKZuAMaA9LPrKVrRJg=
|
||||
-----END CERTIFICATE-----
|
||||
27
t/cert/mtls_client.key
Normal file
27
t/cert/mtls_client.key
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEAvlsJTJRx04JUSkJqdqo0XSjZReZEmnSfpuZ4SZ7GIHUyX5I7
|
||||
7G5Le7B1HHUJAAV31lnKVVsTtnY6xhjcN2ogk+YmVl0LlowB8pY4CAg2omQSIaCN
|
||||
SM2aJniSKbZj6xTZtuWH99VVpMxTHKN8uL2tfKTUhh+nHEPFGrXxA73+GZgdtxMr
|
||||
k6IqDiF+Qqm7KGlJWeeJDn1azvvUDCBq4duyauWnVeDQWEriCHiCuQYMZfkkBuaK
|
||||
E7Ka7xtKsjq0mH/dPA6FC6bGRy9jwnNSQdt8BsMqtS3R4TDVxHnJuTVoRq3ERVfq
|
||||
EYgnN+2sSS3E1samdI3TvODZaSUMDLDjt8uNmQIDAQABAoIBACqRsUKu78WdH7x7
|
||||
ndNrvMoYmH5JQI5KBmoMoFnWZ/haPSmiSkRVZgwDKi1y/tBCaMpGyjjMZVwolHw4
|
||||
kwbRdPeeQHSP2keQh974OQ+SxqUKPAPJI89kK1TvIcCySSYJQ6bjLcT+sGhqSSve
|
||||
Y8XspR96vQxBh92KSknu5jcwBeMy/eG0mmszzP3y2R0BPztuZdE6dq/KxWQ/R4/P
|
||||
JG9V1rNkIY+1JZvIICIH1Ehn4UKjiE+FJmyDbDlPKEi7W4CpRnShMLOF4cCFnQLW
|
||||
RQds3Dj9GcVY+8Q/GLZF0ATjekIyEsKZEgrMAUF5ZSGRpjJQEHX7oseAiQGQxtHT
|
||||
nj5b1AECgYEAwewXbbd1MqRQ6ohfsQ8j5HSMY6ahvUzs1dZUckr2jw8B98tfi/uj
|
||||
a6Jq1KZe12+4dfwruRSaYdTsSVuvNiSJOxElY0C1p+lXdprFf7XfoQ6UNtg22jcH
|
||||
9f8cftnlJoV5whh3YKjqnnnAWUQZ61FTNJ258/t+x0ZgpBJvqBoHwDUCgYEA+0qp
|
||||
FZ5xS4FLJMc+Xf/hUeXo+04e4OD/se3atYqyuh1ghmQZfRRPOC110HG99H+rzq/x
|
||||
xPMvRFahkAMyi+/3oIcBEuXvoQyqscIsAhkWD/e9t3Qc9OsWe1hlAgWKZxr6oR2U
|
||||
KKR1FD7UVecOH+FKCKaL5UpEt4yEigc1NtSlTFUCgYBnV5agrIyzQSex5J0CMWxS
|
||||
Od362PkGdXEc/8we4F4GnNvSnrm7Uo2jNXmy+zo9mtb1YT43sogXLK4C5e44bz4G
|
||||
kTuYagqkgdBPb2lihpy3KprHo2+P2JXQfXRFEX9xiN37Fqi/hSUK8R0VNRqO8dbi
|
||||
ik9nexXzwkiMBxsjvUN2JQKBgFy62FpZ9YTfWVNhEuqtGgCWzrqtwUdKwBBwrVyA
|
||||
qiNz48Kz/ZPigrlATVF2J5qp4kSLOLRs6OxW65exFl39V2utZgALSbosanDeLk83
|
||||
4qRRz3h7KJRYjBtIKz3rvX7+va3mtF2rEmk+Jizs7pFlGWTH0Kf0GBeDiwVEU6bA
|
||||
IZ9hAoGAQTjnRGMjvyhq0aPYP+mRFiMKSkcL1nyXizYInfAnbfbL/uEODH7D+iMf
|
||||
kak+UgmeD9ce5d/APmZp3/FzYH/M8ivBgG+MnaI+MLVMhmQdLZyMtbSKKaDpiim7
|
||||
DdN1wCXYbur0HlO2t+wemMZPpQu7wybgEOLlIG7Yj/0OWDcal1c=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
87
t/cert/mtls_server.crt
Normal file
87
t/cert/mtls_server.crt
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number:
|
||||
2f:d5:41:13:5a:ff:c7:1c:5b:ce:28:cd:a6:f7:a5:5a:0d:c0:e2:d2
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: C = US, ST = California, O = OpenResty, CN = OpenResty Testing Root CA
|
||||
Validity
|
||||
Not Before: Mar 13 15:49:00 2022 GMT
|
||||
Not After : Mar 8 14:49:00 2042 GMT
|
||||
Subject: C = US, ST = California, O = OpenResty, CN = example.com
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
RSA Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:d7:03:80:a7:42:7d:06:5a:7b:70:d8:11:96:dd:
|
||||
63:35:53:07:28:71:52:05:40:55:83:61:a7:14:ac:
|
||||
cf:4b:9b:ab:b7:4e:9d:79:e9:13:3d:bc:c3:67:8f:
|
||||
dd:88:d9:8b:c2:31:aa:b8:28:9e:13:70:db:76:b0:
|
||||
12:1c:f8:35:c6:2e:33:9c:b9:04:e3:47:e0:f9:e4:
|
||||
7f:a5:55:03:0c:2d:b2:54:17:29:12:dd:61:6e:5c:
|
||||
33:9f:e5:8f:8a:2b:41:53:dc:e1:98:49:63:df:e3:
|
||||
00:30:2d:1b:bb:f0:8f:cb:04:ec:c9:98:c4:09:5b:
|
||||
b4:ba:a9:a0:0a:77:d2:42:76:7c:ac:64:c3:97:85:
|
||||
50:5d:7d:02:61:2a:00:93:d0:69:5e:87:22:f0:c1:
|
||||
1e:53:46:02:40:37:c9:55:77:99:7d:9d:3d:35:14:
|
||||
74:84:e3:73:ca:e7:4a:ab:33:98:26:aa:41:4b:b5:
|
||||
e6:63:7c:a4:1e:25:6a:88:f4:56:d9:2c:63:dd:89:
|
||||
19:fa:25:41:44:95:87:40:a7:9b:4e:3a:91:29:32:
|
||||
79:66:05:f4:2f:68:2c:06:53:df:4d:60:be:ac:09:
|
||||
20:61:9c:6f:1a:a6:07:5a:e7:41:91:9d:36:77:38:
|
||||
18:3a:69:7b:67:29:9f:1d:e0:c2:d2:8f:16:5b:14:
|
||||
e8:e1
|
||||
Exponent: 65537 (0x10001)
|
||||
X509v3 extensions:
|
||||
X509v3 Key Usage: critical
|
||||
Digital Signature, Key Encipherment
|
||||
X509v3 Extended Key Usage:
|
||||
TLS Web Server Authentication
|
||||
X509v3 Basic Constraints: critical
|
||||
CA:FALSE
|
||||
X509v3 Subject Key Identifier:
|
||||
16:07:B5:C2:4C:B5:2D:4F:B8:E9:D6:FA:2F:3F:C0:1B:B6:4F:20:E6
|
||||
X509v3 Authority Key Identifier:
|
||||
keyid:F0:D7:4B:14:73:E1:67:00:6B:54:B4:19:20:76:12:9F:9D:8E:C8:09
|
||||
|
||||
X509v3 Subject Alternative Name:
|
||||
DNS:example.com
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
d9:c0:c0:d6:8b:44:04:26:b3:98:24:2c:12:82:6d:15:79:92:
|
||||
76:c9:77:94:c1:be:8f:8a:18:78:96:04:68:c9:0a:d1:84:c5:
|
||||
de:cd:ba:b5:a2:3b:d4:0a:70:be:00:49:19:c0:6e:ca:e9:e5:
|
||||
8b:b6:e3:a2:39:0d:d8:ee:55:1a:08:73:39:19:d3:07:07:33:
|
||||
8c:d8:1b:0f:1b:73:0e:84:72:cf:e6:c1:a1:da:39:aa:c0:2e:
|
||||
3d:b9:a6:8f:ec:98:3a:07:58:34:c2:5e:4c:1a:6b:db:ce:51:
|
||||
92:25:1d:ba:78:4b:11:b6:f1:69:02:cb:ac:32:bb:80:f9:15:
|
||||
91:bf:4e:6a:ab:51:51:7c:7b:1a:72:80:96:eb:0c:fa:56:0e:
|
||||
f2:87:3c:16:8a:04:aa:8a:9d:0c:d9:e0:c4:2a:20:42:5a:12:
|
||||
41:52:30:50:3d:85:f8:07:31:6b:af:a4:d2:44:38:69:ab:88:
|
||||
05:d4:5b:68:34:02:dc:99:5a:6c:b7:ea:fc:79:76:fe:68:29:
|
||||
df:94:22:58:46:f2:40:cb:e1:92:17:d8:1e:3d:fa:a2:56:4f:
|
||||
ac:3c:3d:ae:f7:90:12:ac:3b:6c:1e:1f:26:48:08:87:9a:0e:
|
||||
8d:9d:75:ef:86:1e:63:ac:e9:14:47:ad:3f:4f:10:57:2a:d1:
|
||||
95:ec:6f:24
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDwzCCAqugAwIBAgIUL9VBE1r/xxxbzijNpvelWg3A4tIwDQYJKoZIhvcNAQEL
|
||||
BQAwWjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEjAQBgNVBAoT
|
||||
CU9wZW5SZXN0eTEiMCAGA1UEAxMZT3BlblJlc3R5IFRlc3RpbmcgUm9vdCBDQTAe
|
||||
Fw0yMjAzMTMxNTQ5MDBaFw00MjAzMDgxNDQ5MDBaMEwxCzAJBgNVBAYTAlVTMRMw
|
||||
EQYDVQQIEwpDYWxpZm9ybmlhMRIwEAYDVQQKEwlPcGVuUmVzdHkxFDASBgNVBAMT
|
||||
C2V4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1wOA
|
||||
p0J9Blp7cNgRlt1jNVMHKHFSBUBVg2GnFKzPS5urt06deekTPbzDZ4/diNmLwjGq
|
||||
uCieE3DbdrASHPg1xi4znLkE40fg+eR/pVUDDC2yVBcpEt1hblwzn+WPiitBU9zh
|
||||
mElj3+MAMC0bu/CPywTsyZjECVu0uqmgCnfSQnZ8rGTDl4VQXX0CYSoAk9BpXoci
|
||||
8MEeU0YCQDfJVXeZfZ09NRR0hONzyudKqzOYJqpBS7XmY3ykHiVqiPRW2Sxj3YkZ
|
||||
+iVBRJWHQKebTjqRKTJ5ZgX0L2gsBlPfTWC+rAkgYZxvGqYHWudBkZ02dzgYOml7
|
||||
ZymfHeDC0o8WWxTo4QIDAQABo4GOMIGLMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUE
|
||||
DDAKBggrBgEFBQcDATAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBQWB7XCTLUtT7jp
|
||||
1vovP8Abtk8g5jAfBgNVHSMEGDAWgBTw10sUc+FnAGtUtBkgdhKfnY7ICTAWBgNV
|
||||
HREEDzANggtleGFtcGxlLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEA2cDA1otEBCaz
|
||||
mCQsEoJtFXmSdsl3lMG+j4oYeJYEaMkK0YTF3s26taI71ApwvgBJGcBuyunli7bj
|
||||
ojkN2O5VGghzORnTBwczjNgbDxtzDoRyz+bBodo5qsAuPbmmj+yYOgdYNMJeTBpr
|
||||
285RkiUdunhLEbbxaQLLrDK7gPkVkb9OaqtRUXx7GnKAlusM+lYO8oc8FooEqoqd
|
||||
DNngxCogQloSQVIwUD2F+Acxa6+k0kQ4aauIBdRbaDQC3JlabLfq/Hl2/mgp35Qi
|
||||
WEbyQMvhkhfYHj36olZPrDw9rveQEqw7bB4fJkgIh5oOjZ1174YeY6zpFEetP08Q
|
||||
VyrRlexvJA==
|
||||
-----END CERTIFICATE-----
|
||||
27
t/cert/mtls_server.key
Normal file
27
t/cert/mtls_server.key
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEowIBAAKCAQEA1wOAp0J9Blp7cNgRlt1jNVMHKHFSBUBVg2GnFKzPS5urt06d
|
||||
eekTPbzDZ4/diNmLwjGquCieE3DbdrASHPg1xi4znLkE40fg+eR/pVUDDC2yVBcp
|
||||
Et1hblwzn+WPiitBU9zhmElj3+MAMC0bu/CPywTsyZjECVu0uqmgCnfSQnZ8rGTD
|
||||
l4VQXX0CYSoAk9BpXoci8MEeU0YCQDfJVXeZfZ09NRR0hONzyudKqzOYJqpBS7Xm
|
||||
Y3ykHiVqiPRW2Sxj3YkZ+iVBRJWHQKebTjqRKTJ5ZgX0L2gsBlPfTWC+rAkgYZxv
|
||||
GqYHWudBkZ02dzgYOml7ZymfHeDC0o8WWxTo4QIDAQABAoIBAEnmZUiXnJsbbEPr
|
||||
r5f3vYptYA9xa2xsoTeHz8JWZuUouwtE1PE6v6c/grXMh6rqgpObOH8VTseFyZhw
|
||||
ibk1Ql48MPcTzG9FnDinZYvwvRxpdFpcn3xhZIRm4kN5xi0KEuj9CPireM1RmxXz
|
||||
2w1scC+qIKxlejNxNpvVgzE136mBqEFKJzecP+yZuH/A86MQCgwqqa3jSz5ApNg+
|
||||
1aJE34cGFieDbAN+9sdqWA3OkRrHoy8EakUf4JEvwX1AwUN832mj+N/LfmcCGMeD
|
||||
YhzybzlPBV2q2T1+pHIdNT99JVNPkgdTe1903EjnG5oSDGHt2i9MdnNkMsffDWNt
|
||||
pJiqSHECgYEA2hL6l8Py4oa5AJ2WXriuHRJykAs90K0akftQt4i4lWCbeRhaGh7h
|
||||
kPgpDS33RkE4SymVVr0c05abMCKabQBwbu4PNCqetCFtfmIQdQCTUbLbXjL8UuD2
|
||||
QnF7nbHiwyGBKRMU/F74oX3z7lXLgRtIiyyo5yYgIAQqpz3oJAaXNTUCgYEA/GhE
|
||||
Ziez8FXVAg3XwwrE3SexRFKv1JqipYE4mr+ouzfpn9yn8mttxbOORiAAEBl3ZPhd
|
||||
ZUBzLy19fdFZ8RJ0zPsqoZxsd09/XetaBU56C/g9u0fycj1L2elh9rQAlOW0Grus
|
||||
l8jBh01TGtlg0xobK0zjwdGPcbYkp1IzIqyD9n0CgYEAicBvVyrJ5FnhxwfEkrTq
|
||||
FycuAtt3Arg2DnzH8geFQaayzv2Y/OMA7Yg0tkSQ7GoKW0A7O31eFjIOeYuCLNSY
|
||||
MRpjtDov4e0zsx/S8XWZmYP3mjtutBOyuyngQi655TTm18FcAkcjmy9qxOShFj7b
|
||||
xj5BuzGUHWVEZDxwxUD8hvkCgYBnrcyqyZQ4HImqllUSYNIMpclC71QaWIqGwVWm
|
||||
+yMsBAOLDvBNu6MTmnXOiEZ+VnecmgiDFr45ms35aI0xYQtpR6JzT/Wd7KG8ynfn
|
||||
xhyL3iQ9UYhdNKB7mkoLNFUo1FHuyThUALq+AR0p4jDLheWzG5pSeuoZI2Ba+oDW
|
||||
tVZfYQKBgC5phtERR5LKU5Wkzm+uY2j+Nzh4kuKkdLosB9pUW8VnrwFDLZ+r1CxG
|
||||
L6CxOZ0AylCMIlrFeUXMa91kLDJYch0NUPHuGBkdIBDXi2kqN7GflTdV3Z8uev20
|
||||
uMjErA93yVOWHTR3Wo8WIHy5mdsNRQgGAPw1RVW7rnYIyXJW/mTs
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
|
@ -10,14 +10,19 @@ version=$1
|
|||
force=$2
|
||||
home=~
|
||||
|
||||
if [ -z "$version" ]; then
|
||||
echo "Usage: $0 <nginx-version> [force]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
add_http3_module=--with-http_v3_module
|
||||
answer=`$root/util/ver-ge "$NGINX_VERSION" 1.25.1`
|
||||
answer=`$root/util/ver-ge "$version" 1.25.1`
|
||||
if [ "$OPENSSL_VER" = "1.1.0l" ] || [ "$answer" = "N" ]; then
|
||||
add_http3_module=""
|
||||
fi
|
||||
|
||||
disable_pcre2=--without-pcre2
|
||||
answer=`$root/util/ver-ge "$NGINX_VERSION" 1.25.1`
|
||||
answer=`$root/util/ver-ge "$version" 1.25.1`
|
||||
if [ "$answer" = "N" ] || [ "$USE_PCRE2" = "Y" ]; then
|
||||
disable_pcre2=""
|
||||
fi
|
||||
|
|
|
|||
Loading…
Reference in a new issue