Skip to content

Commit 1060df8

Browse files
spacewanderspacewander
authored
feat: support client certificate in stream subsystem (#3)
1 parent 4aa2bee commit 1060df8

File tree

2 files changed

+248
-0
lines changed

2 files changed

+248
-0
lines changed

‎t/apisix/mtls.t

+25
Original file line numberDiff line numberDiff line change
@@ -162,3 +162,28 @@ GET /lua
162162
GET /lua
163163
--- error_log
164164
set client private key failed
165+
166+
167+
168+
=== TEST 6: no cert
169+
--- config
170+
location /lua {
171+
content_by_lua_block {
172+
local http = require "resty.http"
173+
local httpc = http.new()
174+
175+
local res, err = httpc:request_uri("https://127.0.0.1:8081", {
176+
ssl_verify = false,
177+
})
178+
if not res then
179+
ngx.log(ngx.ERR, err)
180+
else
181+
ngx.exit(res.status)
182+
end
183+
}
184+
}
185+
--- request
186+
GET /lua
187+
--- error_code: 400
188+
--- no_error_log
189+
[error]

‎t/apisix/stream_mtls.t

+223
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
use Test::Nginx::Socket::Lua::Stream 'no_plan';
2+
use Cwd qw(cwd);
3+
4+
my $pwd = cwd();
5+
6+
no_long_string();
7+
#no_diff();
8+
9+
add_block_preprocessor(sub {
10+
my ($block) = @_;
11+
12+
my $http_config = <<_EOC;
13+
server {
14+
listen *:8081 ssl;
15+
ssl_certificate ../../cert/mtls_client.crt;
16+
ssl_certificate_key ../../cert/mtls_client.key;
17+
ssl_verify_client on;
18+
ssl_client_certificate ../../cert/mtls_ca.crt;
19+
20+
location / {
21+
content_by_lua_block {
22+
}
23+
}
24+
}
25+
_EOC
26+
27+
$block->set_value("http_config", $http_config);
28+
29+
my $stream_config = <<_EOC;
30+
lua_package_path "$pwd/lib/?.lua;;";
31+
_EOC
32+
33+
$block->set_value("stream_config", $stream_config);
34+
35+
$block;
36+
});
37+
38+
run_tests();
39+
40+
__DATA__
41+
42+
=== TEST 1: sanity
43+
--- stream_server_config
44+
content_by_lua_block {
45+
local http = require "resty.http"
46+
local httpc = http.new()
47+
48+
local res, err = httpc:request_uri("https://127.0.0.1:8081", {
49+
ssl_verify = false,
50+
ssl_cert_path = "t/cert/mtls_client.crt",
51+
ssl_key_path = "t/cert/mtls_client.key",
52+
})
53+
if not res then
54+
ngx.log(ngx.ERR, err)
55+
else
56+
ngx.say(res.status)
57+
end
58+
}
59+
--- stream_response
60+
200
61+
--- no_error_log
62+
[error]
63+
64+
65+
66+
=== TEST 2: cert not found
67+
--- stream_server_config
68+
content_by_lua_block {
69+
local http = require "resty.http"
70+
local httpc = http.new()
71+
72+
local res, err = httpc:request_uri("https://127.0.0.1:8081", {
73+
ssl_verify = false,
74+
ssl_cert_path = "t/cert/test.crt",
75+
ssl_key_path = "../t/cert/test.key",
76+
})
77+
if not res then
78+
ngx.log(ngx.ERR, err)
79+
else
80+
ngx.say(res.status)
81+
end
82+
}
83+
--- error_log
84+
No such file or directory
85+
86+
87+
88+
=== TEST 3: key not found
89+
--- stream_server_config
90+
content_by_lua_block {
91+
local http = require "resty.http"
92+
local httpc = http.new()
93+
94+
local res, err = httpc:request_uri("https://127.0.0.1:8081", {
95+
ssl_verify = false,
96+
ssl_cert_path = "../t/cert/test.crt",
97+
ssl_key_path = "t/cert/test.key",
98+
})
99+
if not res then
100+
ngx.log(ngx.ERR, err)
101+
else
102+
ngx.say(res.status)
103+
end
104+
}
105+
--- error_log
106+
No such file or directory
107+
108+
109+
110+
=== TEST 4: untrusted cert
111+
--- stream_server_config
112+
content_by_lua_block {
113+
local http = require "resty.http"
114+
local httpc = http.new()
115+
116+
local res, err = httpc:request_uri("https://127.0.0.1:8081", {
117+
ssl_verify = false,
118+
ssl_cert_path = "t/cert/wrong.crt",
119+
ssl_key_path = "t/cert/wrong.key",
120+
})
121+
if not res then
122+
ngx.log(ngx.ERR, err)
123+
else
124+
ngx.say(res.status)
125+
end
126+
}
127+
--- stream_response
128+
400
129+
--- no_error_log
130+
[error]
131+
132+
133+
134+
=== TEST 5: mismatched cert & key
135+
--- stream_server_config
136+
content_by_lua_block {
137+
local http = require "resty.http"
138+
local httpc = http.new()
139+
140+
local res, err = httpc:request_uri("https://127.0.0.1:8081", {
141+
ssl_verify = false,
142+
ssl_cert_path = "t/cert/wrong.crt",
143+
ssl_key_path = "t/cert/mtls_client.key",
144+
})
145+
if not res then
146+
ngx.log(ngx.ERR, err)
147+
else
148+
ngx.say(res.status)
149+
end
150+
}
151+
--- error_log
152+
set client private key failed
153+
154+
155+
156+
=== TEST 6: no cert
157+
--- stream_server_config
158+
content_by_lua_block {
159+
local http = require "resty.http"
160+
local httpc = http.new()
161+
162+
local res, err = httpc:request_uri("https://127.0.0.1:8081", {
163+
ssl_verify = false,
164+
})
165+
if not res then
166+
ngx.log(ngx.ERR, err)
167+
else
168+
ngx.say(res.status)
169+
end
170+
}
171+
--- stream_response
172+
400
173+
--- no_error_log
174+
[error]
175+
176+
177+
178+
=== TEST 7: verify
179+
--- stream_server_config
180+
lua_ssl_trusted_certificate ../../cert/mtls_ca.crt;
181+
content_by_lua_block {
182+
local http = require "resty.http"
183+
local httpc = http.new()
184+
185+
local res, err = httpc:request_uri("https://127.0.0.1:8081", {
186+
ssl_verify = true,
187+
ssl_cert_path = "t/cert/mtls_client.crt",
188+
ssl_key_path = "t/cert/mtls_client.key",
189+
})
190+
if not res then
191+
ngx.log(ngx.ERR, err)
192+
else
193+
ngx.say(res.status)
194+
end
195+
}
196+
--- stream_response
197+
200
198+
--- no_error_log
199+
[error]
200+
201+
202+
203+
=== TEST 8: SNI
204+
--- stream_server_config
205+
lua_ssl_trusted_certificate ../../cert/mtls_ca.crt;
206+
content_by_lua_block {
207+
local http = require "resty.http"
208+
local httpc = http.new()
209+
210+
local res, err = httpc:request_uri("https://127.0.0.1:8081", {
211+
ssl_server_name = "aaa.com",
212+
ssl_verify = true,
213+
ssl_cert_path = "t/cert/mtls_client.crt",
214+
ssl_key_path = "t/cert/mtls_client.key",
215+
})
216+
if not res then
217+
ngx.log(ngx.ERR, err)
218+
else
219+
ngx.say(res.status)
220+
end
221+
}
222+
--- error_log
223+
certificate host mismatch

0 commit comments

Comments
 (0)