mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2025-12-04 17:21:12 +01:00
REGTESTS: quic: ssl_sni_auto.vtc code provision for QUIC
ssl/ssl_sni_auto.vtc was renamed to ssl/ssl_sni_auto.vtci
to produce a common part runnable both for QUIC and TCP listeners.
Then ssl_sni_auto.vtc files were created both under ssl and quic directories
to call this .vtci file with correct VTC_SOCK_TYPE environment values
("quic" for QUIC listeners and "stream" for TCP listeners);
Mark the test as broken for QUIC
This commit is contained in:
Frederic Lecaille
parent
3df87376e3
commit
8d40494b33
11
reg-tests/quic/ssl_sni_auto.vtc
Normal file
11
reg-tests/quic/ssl_sni_auto.vtc
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
# This teg-test verifies that automatic SNI selection for server connections and
|
||||||
|
# health checks.
|
||||||
|
#REGTEST_TYPE=broken
|
||||||
|
|
||||||
|
varnishtest "Test the bind 'alpn' setting"
|
||||||
|
# QUIC backend are not supported with USE_QUIC_OPENSSL_COMPAT
|
||||||
|
feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'"
|
||||||
|
|
||||||
|
setenv VTC_SOCK_TYPE quic
|
||||||
|
setenv SSL_OPT ssl
|
||||||
|
include ${testdir}/../ssl/ssl_sni_auto.vtci
|
||||||
@ -1,157 +1,10 @@
|
|||||||
# This teg-test verifies that automatic SNI selection for server conncetions and
|
# This teg-test verifies that automatic SNI selection for server connections and
|
||||||
# health checks.
|
# health checks.
|
||||||
|
|
||||||
varnishtest "Test the bind 'alpn' setting"
|
varnishtest "Test the bind 'alpn' setting"
|
||||||
feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(3.3-dev8)'"
|
feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(3.3-dev8)'"
|
||||||
feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
|
feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'"
|
||||||
feature ignore_unknown_macro
|
|
||||||
|
|
||||||
barrier b1 cond 7 -cyclic
|
setenv VTC_SOCK_TYPE stream
|
||||||
|
setenv SSL_OPT check-ssl
|
||||||
server s1 {
|
include ${testdir}/ssl_sni_auto.vtci
|
||||||
rxreq
|
|
||||||
expect req.http.x-sni == <undef>
|
|
||||||
txresp -status 200
|
|
||||||
barrier b1 sync
|
|
||||||
} -start
|
|
||||||
|
|
||||||
server s2 {
|
|
||||||
rxreq
|
|
||||||
expect req.http.x-sni == "www.check2.org"
|
|
||||||
txresp -status 200
|
|
||||||
barrier b1 sync
|
|
||||||
} -start
|
|
||||||
|
|
||||||
server s3 {
|
|
||||||
rxreq
|
|
||||||
expect req.http.x-sni == "www.check3.org"
|
|
||||||
txresp -status 200
|
|
||||||
barrier b1 sync
|
|
||||||
} -start
|
|
||||||
|
|
||||||
server s4 {
|
|
||||||
rxreq
|
|
||||||
expect req.http.x-sni == "www.other.org"
|
|
||||||
txresp -status 200
|
|
||||||
barrier b1 sync
|
|
||||||
} -start
|
|
||||||
|
|
||||||
server s5 {
|
|
||||||
rxreq
|
|
||||||
expect req.http.x-sni == <undef>
|
|
||||||
txresp -status 200
|
|
||||||
barrier b1 sync
|
|
||||||
} -start
|
|
||||||
|
|
||||||
server s6 {
|
|
||||||
rxreq
|
|
||||||
expect req.http.x-sni == <undef>
|
|
||||||
txresp -status 200
|
|
||||||
barrier b1 sync
|
|
||||||
} -start
|
|
||||||
|
|
||||||
|
|
||||||
haproxy h1 -conf {
|
|
||||||
global
|
|
||||||
.if feature(THREAD)
|
|
||||||
thread-groups 1
|
|
||||||
.endif
|
|
||||||
|
|
||||||
.if !ssllib_name_startswith(AWS-LC)
|
|
||||||
tune.ssl.default-dh-param 2048
|
|
||||||
.endif
|
|
||||||
|
|
||||||
defaults
|
|
||||||
mode http
|
|
||||||
option httplog
|
|
||||||
log stderr local0 debug err
|
|
||||||
timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
|
|
||||||
timeout client "${HAPROXY_TEST_TIMEOUT-5s}"
|
|
||||||
timeout server "${HAPROXY_TEST_TIMEOUT-5s}"
|
|
||||||
default-server inter 100ms
|
|
||||||
|
|
||||||
frontend fe_ssl
|
|
||||||
bind "fd@${fe_ssl}" ssl crt ${testdir}/certs/common.pem
|
|
||||||
|
|
||||||
http-request return status 200 if { path /test1 } { ssl_fc_sni www.test1.org }
|
|
||||||
http-request return status 500 if { path /test2 } { ssl_fc_sni -m found }
|
|
||||||
http-request return status 200 if { path /test3 } { ssl_fc_sni www.other.org }
|
|
||||||
http-request deny
|
|
||||||
|
|
||||||
listen li_check_ssl
|
|
||||||
bind "fd@${li_check_ssl}" ssl crt ${testdir}/certs/common.pem
|
|
||||||
http-request set-header x-sni %[ssl_fc_sni] if { ssl_fc_sni -m found }
|
|
||||||
|
|
||||||
use-server s1 if { path /test1 }
|
|
||||||
use-server s2 if { path /test2 }
|
|
||||||
use-server s3 if { path /test3 }
|
|
||||||
use-server s4 if { path /test4 }
|
|
||||||
use-server s5 if { path /test5 }
|
|
||||||
use-server s6 if { path /test6 }
|
|
||||||
|
|
||||||
server s1 ${s1_addr}:${s1_port}
|
|
||||||
server s2 ${s1_addr}:${s2_port}
|
|
||||||
server s3 ${s3_addr}:${s3_port}
|
|
||||||
server s4 ${s4_addr}:${s4_port}
|
|
||||||
server s5 ${s5_addr}:${s5_port}
|
|
||||||
server s6 ${s6_addr}:${s6_port}
|
|
||||||
|
|
||||||
listen li
|
|
||||||
bind "fd@${li}"
|
|
||||||
use-server s1 if { path /test1 }
|
|
||||||
use-server s2 if { path /test2 }
|
|
||||||
use-server s3 if { path /test3 }
|
|
||||||
|
|
||||||
server s1 ${h1_fe_ssl_addr}:${h1_fe_ssl_port} ssl verify none
|
|
||||||
server s2 ${h1_fe_ssl_addr}:${h1_fe_ssl_port} ssl verify none no-sni-auto
|
|
||||||
server s3 ${h1_fe_ssl_addr}:${h1_fe_ssl_port} ssl verify none sni str("www.other.org")
|
|
||||||
|
|
||||||
backend be1
|
|
||||||
option httpchk GET /test1 HTTP/1.1
|
|
||||||
server chk1 ${h1_li_check_ssl_addr}:${h1_li_check_ssl_port} check check-ssl verify none
|
|
||||||
|
|
||||||
backend be2
|
|
||||||
option httpchk GET /test2 HTTP/1.1 www.check2.org:443
|
|
||||||
server chk2 ${h1_li_check_ssl_addr}:${h1_li_check_ssl_port} check check-ssl verify none
|
|
||||||
|
|
||||||
backend be3
|
|
||||||
option httpchk
|
|
||||||
http-check send meth GET uri /test3 hdr host "www.check3.org:443"
|
|
||||||
server chk3 ${h1_li_check_ssl_addr}:${h1_li_check_ssl_port} check check-ssl verify none
|
|
||||||
|
|
||||||
backend be4
|
|
||||||
option httpchk
|
|
||||||
http-check send meth GET uri /test4 hdr host "www.check4.org:443"
|
|
||||||
server chk4 ${h1_li_check_ssl_addr}:${h1_li_check_ssl_port} check check-ssl verify none check-sni "www.other.org"
|
|
||||||
|
|
||||||
backend be5
|
|
||||||
option httpchk
|
|
||||||
http-check send meth GET uri /test5 hdr host "www.check5.org:443"
|
|
||||||
server chk5 ${h1_li_check_ssl_addr}:${h1_li_check_ssl_port} check check-ssl verify none no-check-sni-auto
|
|
||||||
|
|
||||||
backend be6
|
|
||||||
option httpchk GET /test6 HTTP/1.1 www.check6.org:443
|
|
||||||
http-check connect default
|
|
||||||
server chk2 ${h1_li_check_ssl_addr}:${h1_li_check_ssl_port} check check-ssl verify none
|
|
||||||
|
|
||||||
} -start
|
|
||||||
|
|
||||||
barrier b1 sync
|
|
||||||
|
|
||||||
client c1 -connect ${h1_li_sock} {
|
|
||||||
txreq -url "/test1" -hdr "host: www.test1.org:443"
|
|
||||||
rxresp
|
|
||||||
expect resp.status == 200
|
|
||||||
|
|
||||||
txreq -url "/test1"
|
|
||||||
rxresp
|
|
||||||
expect resp.status == 403
|
|
||||||
|
|
||||||
txreq -url "/test2" -hdr "host: www.test1.org"
|
|
||||||
rxresp
|
|
||||||
expect resp.status == 403
|
|
||||||
|
|
||||||
txreq -url "/test3" -hdr "host: www.test1.org"
|
|
||||||
rxresp
|
|
||||||
expect resp.status == 200
|
|
||||||
} -run
|
|
||||||
|
|||||||
155
reg-tests/ssl/ssl_sni_auto.vtci
Normal file
155
reg-tests/ssl/ssl_sni_auto.vtci
Normal file
@ -0,0 +1,155 @@
|
|||||||
|
feature ignore_unknown_macro
|
||||||
|
|
||||||
|
barrier b1 cond 7 -cyclic
|
||||||
|
|
||||||
|
server s1 {
|
||||||
|
rxreq
|
||||||
|
expect req.http.x-sni == <undef>
|
||||||
|
txresp -status 200
|
||||||
|
barrier b1 sync
|
||||||
|
} -start
|
||||||
|
|
||||||
|
server s2 {
|
||||||
|
rxreq
|
||||||
|
expect req.http.x-sni == "www.check2.org"
|
||||||
|
txresp -status 200
|
||||||
|
barrier b1 sync
|
||||||
|
} -start
|
||||||
|
|
||||||
|
server s3 {
|
||||||
|
rxreq
|
||||||
|
expect req.http.x-sni == "www.check3.org"
|
||||||
|
txresp -status 200
|
||||||
|
barrier b1 sync
|
||||||
|
} -start
|
||||||
|
|
||||||
|
server s4 {
|
||||||
|
rxreq
|
||||||
|
expect req.http.x-sni == "www.other.org"
|
||||||
|
txresp -status 200
|
||||||
|
barrier b1 sync
|
||||||
|
} -start
|
||||||
|
|
||||||
|
server s5 {
|
||||||
|
rxreq
|
||||||
|
expect req.http.x-sni == <undef>
|
||||||
|
txresp -status 200
|
||||||
|
barrier b1 sync
|
||||||
|
} -start
|
||||||
|
|
||||||
|
server s6 {
|
||||||
|
rxreq
|
||||||
|
expect req.http.x-sni == <undef>
|
||||||
|
txresp -status 200
|
||||||
|
barrier b1 sync
|
||||||
|
} -start
|
||||||
|
|
||||||
|
|
||||||
|
haproxy h1 -conf {
|
||||||
|
global
|
||||||
|
.if streq("$VTC_SOCK_TYPE",quic)
|
||||||
|
# required for backend connections
|
||||||
|
expose-experimental-directives
|
||||||
|
.endif
|
||||||
|
.if feature(THREAD)
|
||||||
|
thread-groups 1
|
||||||
|
.endif
|
||||||
|
|
||||||
|
.if !ssllib_name_startswith(AWS-LC)
|
||||||
|
tune.ssl.default-dh-param 2048
|
||||||
|
.endif
|
||||||
|
|
||||||
|
defaults
|
||||||
|
mode http
|
||||||
|
option httplog
|
||||||
|
log stderr local0 debug err
|
||||||
|
timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||||
|
timeout client "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||||
|
timeout server "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||||
|
default-server inter 100ms
|
||||||
|
|
||||||
|
frontend fe_ssl
|
||||||
|
bind "${VTC_SOCK_TYPE}+fd@${fe_ssl}" ssl crt ${testdir}/certs/common.pem
|
||||||
|
|
||||||
|
http-request return status 200 if { path /test1 } { ssl_fc_sni www.test1.org }
|
||||||
|
http-request return status 500 if { path /test2 } { ssl_fc_sni -m found }
|
||||||
|
http-request return status 200 if { path /test3 } { ssl_fc_sni www.other.org }
|
||||||
|
http-request deny
|
||||||
|
|
||||||
|
listen li_check_ssl
|
||||||
|
bind "${VTC_SOCK_TYPE}+fd@${li_check_ssl}" ssl crt ${testdir}/certs/common.pem
|
||||||
|
http-request set-header x-sni %[ssl_fc_sni] if { ssl_fc_sni -m found }
|
||||||
|
|
||||||
|
use-server s1 if { path /test1 }
|
||||||
|
use-server s2 if { path /test2 }
|
||||||
|
use-server s3 if { path /test3 }
|
||||||
|
use-server s4 if { path /test4 }
|
||||||
|
use-server s5 if { path /test5 }
|
||||||
|
use-server s6 if { path /test6 }
|
||||||
|
|
||||||
|
server s1 ${s1_sock}
|
||||||
|
server s2 ${s2_sock}
|
||||||
|
server s3 ${s3_sock}
|
||||||
|
server s4 ${s4_sock}
|
||||||
|
server s5 ${s5_sock}
|
||||||
|
server s6 ${s6_sock}
|
||||||
|
|
||||||
|
listen li
|
||||||
|
bind "fd@${li}"
|
||||||
|
use-server s1 if { path /test1 }
|
||||||
|
use-server s2 if { path /test2 }
|
||||||
|
use-server s3 if { path /test3 }
|
||||||
|
|
||||||
|
server s1 "${VTC_SOCK_TYPE}+${h1_fe_ssl_sock}" ssl verify none
|
||||||
|
server s2 "${VTC_SOCK_TYPE}+${h1_fe_ssl_sock}" ssl verify none no-sni-auto
|
||||||
|
server s3 "${VTC_SOCK_TYPE}+${h1_fe_ssl_sock}" ssl verify none sni str("www.other.org")
|
||||||
|
|
||||||
|
backend be1
|
||||||
|
option httpchk GET /test1 HTTP/1.1
|
||||||
|
server chk1 "${VTC_SOCK_TYPE}+${h1_li_check_ssl_sock}" check "${SSL_OPT}" verify none
|
||||||
|
|
||||||
|
backend be2
|
||||||
|
option httpchk GET /test2 HTTP/1.1 www.check2.org:443
|
||||||
|
server chk2 "${VTC_SOCK_TYPE}+${h1_li_check_ssl_sock}" check "${SSL_OPT}" verify none
|
||||||
|
|
||||||
|
backend be3
|
||||||
|
option httpchk
|
||||||
|
http-check send meth GET uri /test3 hdr host "www.check3.org:443"
|
||||||
|
server chk3 "${VTC_SOCK_TYPE}+${h1_li_check_ssl_sock}" check "${SSL_OPT}" verify none
|
||||||
|
|
||||||
|
backend be4
|
||||||
|
option httpchk
|
||||||
|
http-check send meth GET uri /test4 hdr host "www.check4.org:443"
|
||||||
|
server chk4 "${VTC_SOCK_TYPE}+${h1_li_check_ssl_sock}" check "${SSL_OPT}" verify none check-sni "www.other.org"
|
||||||
|
|
||||||
|
backend be5
|
||||||
|
option httpchk
|
||||||
|
http-check send meth GET uri /test5 hdr host "www.check5.org:443"
|
||||||
|
server chk5 "${VTC_SOCK_TYPE}+${h1_li_check_ssl_sock}" check "${SSL_OPT}" verify none no-check-sni-auto
|
||||||
|
|
||||||
|
backend be6
|
||||||
|
option httpchk GET /test6 HTTP/1.1 www.check6.org:443
|
||||||
|
http-check connect default
|
||||||
|
server chk2 "${VTC_SOCK_TYPE}+${h1_li_check_ssl_sock}" check "${SSL_OPT}" verify none
|
||||||
|
|
||||||
|
} -start
|
||||||
|
|
||||||
|
barrier b1 sync
|
||||||
|
|
||||||
|
client c1 -connect ${h1_li_sock} {
|
||||||
|
txreq -url "/test1" -hdr "host: www.test1.org:443"
|
||||||
|
rxresp
|
||||||
|
expect resp.status == 200
|
||||||
|
|
||||||
|
txreq -url "/test1"
|
||||||
|
rxresp
|
||||||
|
expect resp.status == 403
|
||||||
|
|
||||||
|
txreq -url "/test2" -hdr "host: www.test1.org"
|
||||||
|
rxresp
|
||||||
|
expect resp.status == 403
|
||||||
|
|
||||||
|
txreq -url "/test3" -hdr "host: www.test1.org"
|
||||||
|
rxresp
|
||||||
|
expect resp.status == 200
|
||||||
|
} -run
|
||||||
Loading…
x
Reference in New Issue
Block a user