diff --git a/reg-tests/quic/ssl_simple_crt-list.vtc b/reg-tests/quic/ssl_simple_crt-list.vtc new file mode 100644 index 000000000..a0ea26de3 --- /dev/null +++ b/reg-tests/quic/ssl_simple_crt-list.vtc @@ -0,0 +1,9 @@ +#REGTEST_TYPE=bug +varnishtest "Test for the bug #940" +# Test that the SNI are correctly inserted with the same file multiple times. + +# QUIC backend are not supported with USE_QUIC_OPENSSL_COMPAT +feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'" + +setenv VTC_SOCK_TYPE quic +include ${testdir}/../ssl/ssl_simple_crt-list.vtci diff --git a/reg-tests/ssl/ssl_simple_crt-list.vtc b/reg-tests/ssl/ssl_simple_crt-list.vtc index 356e4f491..36f586ec8 100644 --- a/reg-tests/ssl/ssl_simple_crt-list.vtc +++ b/reg-tests/ssl/ssl_simple_crt-list.vtc @@ -3,53 +3,6 @@ varnishtest "Test for the bug #940" # Test that the SNI are correctly inserted with the same file multiple times. #REQUIRE_OPTIONS=OPENSSL -feature ignore_unknown_macro -server s1 -repeat 4 { - rxreq - txresp -} -start - -haproxy h1 -conf { - global - .if feature(THREAD) - thread-groups 1 - .endif - - .if !ssllib_name_startswith(AWS-LC) - tune.ssl.default-dh-param 2048 - .endif - crt-base ${testdir}/certs - stats socket "${tmpdir}/h1/stats" level admin - - defaults - mode http - option httplog - log stderr local0 debug err - option logasap - timeout connect "${HAPROXY_TEST_TIMEOUT-5s}" - timeout client "${HAPROXY_TEST_TIMEOUT-5s}" - timeout server "${HAPROXY_TEST_TIMEOUT-5s}" - - - listen clear-lst - bind "fd@${clearlst}" - balance roundrobin - server s1 "${tmpdir}/ssl.sock" ssl verify none sni str(record1.bug940.domain.tld) - server s2 "${tmpdir}/ssl.sock" ssl verify none sni str(record2.bug940.domain.tld) - server s3 "${tmpdir}/ssl.sock" ssl verify none sni str(record3.bug940.domain.tld) - server s4 "${tmpdir}/ssl.sock" ssl verify none sni str(record4.bug940.domain.tld) - - listen ssl-lst - mode http - bind "${tmpdir}/ssl.sock" ssl strict-sni crt-list ${testdir}/certs/simple.crt-list - - server s1 ${s1_addr}:${s1_port} -} -start - - -client c1 -repeat 4 -connect ${h1_clearlst_sock} { - txreq - rxresp - expect resp.status == 200 -} -run +setenv VTC_SOCK_TYPE stream +include ${testdir}/ssl_simple_crt-list.vtci diff --git a/reg-tests/ssl/ssl_simple_crt-list.vtci b/reg-tests/ssl/ssl_simple_crt-list.vtci new file mode 100644 index 000000000..4b715a94a --- /dev/null +++ b/reg-tests/ssl/ssl_simple_crt-list.vtci @@ -0,0 +1,54 @@ +feature ignore_unknown_macro + +server s1 -repeat 4 { + rxreq + txresp +} -start + +haproxy h1 -conf { + global + .if streq("$VTC_SOCK_TYPE",quic) + # required for backend connections + expose-experimental-directives + .endif + .if feature(THREAD) + thread-groups 1 + .endif + + .if !ssllib_name_startswith(AWS-LC) + tune.ssl.default-dh-param 2048 + .endif + crt-base ${testdir}/certs + stats socket "${tmpdir}/h1/stats" level admin + + defaults + mode http + option httplog + log stderr local0 debug err + option logasap + timeout connect "${HAPROXY_TEST_TIMEOUT-5s}" + timeout client "${HAPROXY_TEST_TIMEOUT-5s}" + timeout server "${HAPROXY_TEST_TIMEOUT-5s}" + + + listen clear-lst + bind "fd@${clearlst}" + balance roundrobin + server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none sni str(record1.bug940.domain.tld) + server s2 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none sni str(record2.bug940.domain.tld) + server s3 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none sni str(record3.bug940.domain.tld) + server s4 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none sni str(record4.bug940.domain.tld) + + listen ssl-lst + mode http + bind "${VTC_SOCK_TYPE}+fd@${ssl}" ssl strict-sni crt-list ${testdir}/certs/simple.crt-list + + server s1 ${s1_addr}:${s1_port} +} -start + + +client c1 -repeat 4 -connect ${h1_clearlst_sock} { + txreq + rxresp + expect resp.status == 200 +} -run