From f84100cd0d6eafcab27db1f5cc1804846c501e6a Mon Sep 17 00:00:00 2001 From: Frederic Lecaille Date: Tue, 2 Dec 2025 07:28:32 +0100 Subject: [PATCH] REGTESTS: quic: new_del_ssl_crlfile.vtc supported by QUIC ssl/new_del_ssl_crlfile.vtc was renamed to ssl/new_del_ssl_crlfile.vtci to produce a common part runnable both for QUIC and TCP listeners. Then new_del_ssl_crlfile.vtc files were created both under ssl and quic directories to call this .vtci file with correct VTC_SOCK_TYPE environment values ("quic" for QUIC listeners and "stream" for TCP listeners); --- reg-tests/quic/new_del_ssl_crlfile.vtc | 17 ++++ reg-tests/ssl/new_del_ssl_crlfile.vtc | 132 +----------------------- reg-tests/ssl/new_del_ssl_crlfile.vtci | 135 +++++++++++++++++++++++++ 3 files changed, 154 insertions(+), 130 deletions(-) create mode 100644 reg-tests/quic/new_del_ssl_crlfile.vtc create mode 100644 reg-tests/ssl/new_del_ssl_crlfile.vtci diff --git a/reg-tests/quic/new_del_ssl_crlfile.vtc b/reg-tests/quic/new_del_ssl_crlfile.vtc new file mode 100644 index 000000000..727e7f84a --- /dev/null +++ b/reg-tests/quic/new_del_ssl_crlfile.vtc @@ -0,0 +1,17 @@ +#REGTEST_TYPE=devel + +# This test uses the "new ssl crl-file" and "del ssl crl-file" commands to create +# a new CRL file or delete an unused CRL file. +# +# It requires socat to upload the CRL file. +# +# If this test does not work anymore: +# - Check that you have socat + +varnishtest "Test the 'new ssl crl-file' and 'del ssl crl-file' commands of the CLI" +# QUIC backend are not supported with USE_QUIC_OPENSSL_COMPAT +feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'" +feature cmd "command -v socat" + +setenv VTC_SOCK_TYPE quic +include ${testdir}/../ssl/new_del_ssl_crlfile.vtci diff --git a/reg-tests/ssl/new_del_ssl_crlfile.vtc b/reg-tests/ssl/new_del_ssl_crlfile.vtc index ce8187102..10a8b9beb 100644 --- a/reg-tests/ssl/new_del_ssl_crlfile.vtc +++ b/reg-tests/ssl/new_del_ssl_crlfile.vtc @@ -12,134 +12,6 @@ varnishtest "Test the 'new ssl crl-file' and 'del ssl crl-file' commands of the feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'" feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL)'" feature cmd "command -v socat" -feature ignore_unknown_macro - -server s1 -repeat 3 { - rxreq - txresp -} -start - -haproxy h1 -conf { - global - .if feature(THREAD) - thread-groups 1 - .endif - - .if !ssllib_name_startswith(AWS-LC) - tune.ssl.default-dh-param 2048 - .endif - tune.ssl.capture-buffer-size 1 - stats socket "${tmpdir}/h1/stats" level admin - crt-base ${testdir}/certs - - defaults - mode http - option httplog - retries 0 - log stderr local0 debug err - option logasap - timeout connect "${HAPROXY_TEST_TIMEOUT-5s}" - timeout client "${HAPROXY_TEST_TIMEOUT-5s}" - timeout server "${HAPROXY_TEST_TIMEOUT-5s}" - - listen clear-lst - bind "fd@${clearlst}" - balance roundrobin - use_backend with_crl_be if { path /with-crl } - default_backend default_be - - backend default_be - server s1 "${tmpdir}/ssl.sock" ssl verify none crt ${testdir}/certs/client3_revoked.pem sni str(www.test1.com) - - backend with_crl_be - server s1 "${tmpdir}/ssl.sock" ssl verify none crt ${testdir}/certs/client3_revoked.pem sni str(with-crl.com) - - listen ssl-lst - bind "${tmpdir}/ssl.sock" ssl strict-sni crt-list ${testdir}/certs/localhost.crt-list ca-file ${testdir}/certs/ca-auth.crt verify required crt-ignore-err all - http-response add-header X-SSL-Client-Verify %[ssl_c_verify] - server s1 ${s1_addr}:${s1_port} -} -start - -# Request using the default backend and the www.test1.com sni -client c1 -connect ${h1_clearlst_sock} { - txreq - rxresp - expect resp.status == 200 - # The backend has no CRL so the connection should succeed - expect resp.http.X-SSL-Client-Verify == 0 -} -run - -# This connection should fail because the with-crl.com sni is not mentioned in the crt-list yet. -client c1 -connect ${h1_clearlst_sock} { - txreq -url "/with-crl" - rxresp - expect resp.status == 503 -} -run - -# Create a new unlinked CRL file -haproxy h1 -cli { - send "new ssl crl-file new_crlfile.crt" - expect ~ "New CRL file created 'new_crlfile.crt'!" -} - -shell { - printf "set ssl crl-file new_crlfile.crt <<\n$(cat ${testdir}/certs/crl-auth.pem)\n\n" | socat "${tmpdir}/h1/stats" - - echo "commit ssl crl-file new_crlfile.crt" | socat "${tmpdir}/h1/stats" - -} - -haproxy h1 -cli { - send "show ssl crl-file" - expect ~ ".*new_crlfile.crt" - - send "show ssl crl-file new_crlfile.crt" - expect ~ ".*Issuer:.*/CN=HAProxy Technologies CA Test Client Auth" -} - -# Add a new certificate that will use the new CA file -shell { - echo "new ssl cert ${testdir}/certs/set_cafile_server.pem" | socat "${tmpdir}/h1/stats" - - printf "set ssl cert ${testdir}/certs/set_cafile_server.pem <<\n$(cat ${testdir}/certs/set_cafile_server.pem)\n\n" | socat "${tmpdir}/h1/stats" - - echo "commit ssl cert ${testdir}/certs/set_cafile_server.pem" | socat "${tmpdir}/h1/stats" - -} - -# Create a new crt-list line that will use the new CA file -shell { - printf "add ssl crt-list ${testdir}/certs/localhost.crt-list <<\n${testdir}/certs/set_cafile_server.pem [crl-file new_crlfile.crt] with-crl.com\n\n" | socat "${tmpdir}/h1/stats" - -} - -client c1 -connect ${h1_clearlst_sock} { - txreq -url "/with-crl" - rxresp - expect resp.status == 200 - # The frontend's certificate is revoked in the newly added CRL, connection should fail - expect resp.http.X-SSL-Client-Verify == 23 -} -run - -# Request using the default backend and the www.test1.com sni -client c1 -connect ${h1_clearlst_sock} { - txreq - rxresp - expect resp.status == 200 - # The backend has no CRL for this SNI so the connection should still succeed - expect resp.http.X-SSL-Client-Verify == 0 -} -run - -# Delete the newly added crt-list line and CRL file -haproxy h1 -cli { - send "del ssl crt-list ${testdir}/certs/localhost.crt-list ${testdir}/certs/set_cafile_server.pem" - expect ~ "Entry '${testdir}/certs/set_cafile_server.pem' deleted in crtlist '${testdir}/certs/localhost.crt-list'!" - - send "del ssl crl-file new_crlfile.crt" - expect ~ "CRL file 'new_crlfile.crt' deleted!" - - send "show ssl crl-file" - expect !~ "new_crlfile.crt" -} - -# The connection should now fail since the crt-list line was deleted -client c1 -connect ${h1_clearlst_sock} { - txreq -url "/with-crl" - rxresp - expect resp.status == 503 -} -run +setenv VTC_SOCK_TYPE stream +include ${testdir}/new_del_ssl_crlfile.vtci diff --git a/reg-tests/ssl/new_del_ssl_crlfile.vtci b/reg-tests/ssl/new_del_ssl_crlfile.vtci new file mode 100644 index 000000000..ba316998b --- /dev/null +++ b/reg-tests/ssl/new_del_ssl_crlfile.vtci @@ -0,0 +1,135 @@ +feature ignore_unknown_macro + +server s1 -repeat 3 { + rxreq + txresp +} -start + +haproxy h1 -conf { + global + .if streq("$VTC_SOCK_TYPE",quic) + # required for backend connections + expose-experimental-directives + .endif + .if feature(THREAD) + thread-groups 1 + .endif + + .if !ssllib_name_startswith(AWS-LC) + tune.ssl.default-dh-param 2048 + .endif + tune.ssl.capture-buffer-size 1 + stats socket "${tmpdir}/h1/stats" level admin + crt-base ${testdir}/certs + + defaults + mode http + option httplog + retries 0 + log stderr local0 debug err + option logasap + timeout connect "${HAPROXY_TEST_TIMEOUT-5s}" + timeout client "${HAPROXY_TEST_TIMEOUT-5s}" + timeout server "${HAPROXY_TEST_TIMEOUT-5s}" + + listen clear-lst + bind "fd@${clearlst}" + balance roundrobin + use_backend with_crl_be if { path /with-crl } + default_backend default_be + + backend default_be + server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none crt ${testdir}/certs/client3_revoked.pem sni str(www.test1.com) + + backend with_crl_be + server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none crt ${testdir}/certs/client3_revoked.pem sni str(with-crl.com) + + listen ssl-lst + bind "${VTC_SOCK_TYPE}+fd@${ssl}" ssl strict-sni crt-list ${testdir}/certs/localhost.crt-list ca-file ${testdir}/certs/ca-auth.crt verify required crt-ignore-err all + http-response add-header X-SSL-Client-Verify %[ssl_c_verify] + server s1 ${s1_addr}:${s1_port} +} -start + +# Request using the default backend and the www.test1.com sni +client c1 -connect ${h1_clearlst_sock} { + txreq + rxresp + expect resp.status == 200 + # The backend has no CRL so the connection should succeed + expect resp.http.X-SSL-Client-Verify == 0 +} -run + +# This connection should fail because the with-crl.com sni is not mentioned in the crt-list yet. +client c1 -connect ${h1_clearlst_sock} { + txreq -url "/with-crl" + rxresp + expect resp.status == 503 +} -run + +# Create a new unlinked CRL file +haproxy h1 -cli { + send "new ssl crl-file new_crlfile.crt" + expect ~ "New CRL file created 'new_crlfile.crt'!" +} + +shell { + printf "set ssl crl-file new_crlfile.crt <<\n$(cat ${testdir}/certs/crl-auth.pem)\n\n" | socat "${tmpdir}/h1/stats" - + echo "commit ssl crl-file new_crlfile.crt" | socat "${tmpdir}/h1/stats" - +} + +haproxy h1 -cli { + send "show ssl crl-file" + expect ~ ".*new_crlfile.crt" + + send "show ssl crl-file new_crlfile.crt" + expect ~ ".*Issuer:.*/CN=HAProxy Technologies CA Test Client Auth" +} + +# Add a new certificate that will use the new CA file +shell { + echo "new ssl cert ${testdir}/certs/set_cafile_server.pem" | socat "${tmpdir}/h1/stats" - + printf "set ssl cert ${testdir}/certs/set_cafile_server.pem <<\n$(cat ${testdir}/certs/set_cafile_server.pem)\n\n" | socat "${tmpdir}/h1/stats" - + echo "commit ssl cert ${testdir}/certs/set_cafile_server.pem" | socat "${tmpdir}/h1/stats" - +} + +# Create a new crt-list line that will use the new CA file +shell { + printf "add ssl crt-list ${testdir}/certs/localhost.crt-list <<\n${testdir}/certs/set_cafile_server.pem [crl-file new_crlfile.crt] with-crl.com\n\n" | socat "${tmpdir}/h1/stats" - +} + +client c1 -connect ${h1_clearlst_sock} { + txreq -url "/with-crl" + rxresp + expect resp.status == 200 + # The frontend's certificate is revoked in the newly added CRL, connection should fail + expect resp.http.X-SSL-Client-Verify == 23 +} -run + +# Request using the default backend and the www.test1.com sni +client c1 -connect ${h1_clearlst_sock} { + txreq + rxresp + expect resp.status == 200 + # The backend has no CRL for this SNI so the connection should still succeed + expect resp.http.X-SSL-Client-Verify == 0 +} -run + +# Delete the newly added crt-list line and CRL file +haproxy h1 -cli { + send "del ssl crt-list ${testdir}/certs/localhost.crt-list ${testdir}/certs/set_cafile_server.pem" + expect ~ "Entry '${testdir}/certs/set_cafile_server.pem' deleted in crtlist '${testdir}/certs/localhost.crt-list'!" + + send "del ssl crl-file new_crlfile.crt" + expect ~ "CRL file 'new_crlfile.crt' deleted!" + + send "show ssl crl-file" + expect !~ "new_crlfile.crt" +} + +# The connection should now fail since the crt-list line was deleted +client c1 -connect ${h1_clearlst_sock} { + txreq -url "/with-crl" + rxresp + expect resp.status == 503 +} -run +