Skip to content
Snippets Groups Projects

Compare revisions

Changes are shown as if the source revision was being merged into the target revision. Learn more about comparing revisions.

Source

Select target project
No results found

Target

Select target project
  • fornari/ngx_http_voms_module
  • cnafsd/ngx_http_voms_module
2 results
Show changes
Hide whitespace changes
Inline Side-by-side
Showing
with 243 additions and 182 deletions
t/no_ta.t
View file @ 3c4a7183
use Test::Nginx::Socket 'no_plan';
run_tests();
__DATA__
=== TEST 1: Valid proxy, wrong client trust-anchor
=== TEST 1: Valid proxy, wrong client trust-anchor
--- main_config
env X509_VOMS_DIR=t/vomsdir;
env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
error_log logs/error.log debug;
listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca-2.pem;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca2.pem;
ssl_verify_depth 10;
ssl_verify_client on;
location = / {
location = / {
default_type text/plain;
return 200 "$voms_fqans\n";
}
......@@ -32,7 +36,7 @@ __DATA__
proxy_ssl_certificate_key ../../certs/3.key.pem;
}
--- request
GET /
GET /
--- error_code: 400
t/openssl.conf 0 → 100644
View file @ 3c4a7183
config_diagnostics = 1
[ ca ]
default_ca = ${ENV::CA_NAME}
.include conf.d
t/proxies.d/1.conf 0 → 100644
View file @ 3c4a7183
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/star_test_example.cert.pem
-hostkey=certs/star_test_example.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan="/test.vo"
-pastproxy=24:0
-hours=100
-pastac=24:0
-vomslife=12
t/proxies.d/2.conf 0 → 100644
View file @ 3c4a7183
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/star_test_example.cert.pem
-hostkey=certs/star_test_example.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan="/test.vo"
-pastproxy=24:0
-hours=12
-pastac=24:0
-vomslife=12
t/proxies.d/3.conf 0 → 100644
View file @ 3c4a7183
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/star_test_example.cert.pem
-hostkey=certs/star_test_example.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan=/test.vo/exp1
-fqan=/test.vo/exp2
-fqan=/test.vo/exp3/Role=PIPPO
-ga=nickname=sd
-ga=nickname=cnaf
-hours=12
-vomslife=12
-newserial=abcdef
t/proxies.d/4.conf 0 → 100644
View file @ 3c4a7183
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/star_test_example.cert.pem
-hostkey=certs/star_test_example.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan=/test.vo
-ga=nickname=sd
-ga=title=assegnista%di%ricerca@CNAF
-hours=12
-vomslife=12
t/proxies.d/5.conf 0 → 100644
View file @ 3c4a7183
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/untrusted_voms.cert.pem
-hostkey=certs/untrusted_voms.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan=/test.vo/exp1
-fqan=/test.vo/exp2
-fqan=/test.vo/exp3/Role=PIPPO
-ga=nickname=sd
-ga=nickname=cnaf
-hours=12
-vomslife=12
t/setup.sh 0 → 100755
View file @ 3c4a7183
#!/bin/bash
set -e
if [ ! -e "openssl.conf" ]; then
>&2 echo "The configuration file 'openssl.conf' doesn't exist in this directory"
exit 1
fi
base_dir=$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd)
certs_dir="${base_dir}"/certs
ta_dir="${base_dir}"/trust-anchors
vomsdir="${base_dir}"/vomsdir
rm -rf "${certs_dir}"
mkdir -p "${certs_dir}"
rm -rf "${ta_dir}"
mkdir -p "${ta_dir}"
rm -rf "${vomsdir}"
mkdir -p "${vomsdir}"
[ -d "igi_test_ca2" ] && remove_ca.sh igi_test_ca2
export CA_NAME=igi_test_ca2
make_ca.sh
make_crl.sh
install_ca.sh igi_test_ca2 "${ta_dir}"
make_cert.sh untrusted_voms
cp igi_test_ca2/certs/untrusted_voms.* "${certs_dir}"
[ -d "igi_test_ca" ] && remove_ca.sh igi_test_ca
export CA_NAME=igi_test_ca
make_ca.sh
make_crl.sh
install_ca.sh igi_test_ca "${ta_dir}"
export X509_CERT_DIR="${ta_dir}"
make_cert.sh test0
cp igi_test_ca/certs/test0.* "${certs_dir}"
make_cert.sh star_test_example
cp igi_test_ca/certs/star_test_example.* "${certs_dir}"
mkdir -p "${vomsdir}"/test.vo
openssl x509 -in "${certs_dir}"/star_test_example.cert.pem -noout -subject -issuer -nameopt compat \
| sed -e 's/subject=//' -e 's/issuer=//' > "${vomsdir}"/test.vo/voms.example.lsc
# test 1
echo | voms-proxy-init -cert "${certs_dir}"/test0.p12 --valid 10:0 --out "${certs_dir}"/0.pem --pwstdin
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/0.pem > "${certs_dir}"/0.key.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/0.pem > "${certs_dir}"/0.cert.pem
# test 3
cat "${certs_dir}"/test0.cert.pem "${ta_dir}"/igi_test_ca.pem > "${certs_dir}"/test0+ca.pem
# long-lived proxy certificate, with an expired AC
proxy_name=1
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# expired proxy certificate
proxy_name=2
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# valid proxy certificate with valid AC
proxy_name=3
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# proxy with VOMS generic attributes containing special characters
proxy_name=4
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# proxy with valid VOMS attributes, untrusted AC signature (LSC missing) and VOMS trust-anchor missing
proxy_name=5
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# proxy chain with 3 delegations, without VOMS attributes
proxy_name=6
env X509_USER_PROXY="${certs_dir}/3.pem" X509_CERT_DIR="${ta_dir}" voms-proxy-init2 --out "${certs_dir}"/${proxy_name}.pem -noregen -dont-verify-ac
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
t/socket.js 0 → 100644
View file @ 3c4a7183
function connect(r) {
r.log("vivo");
var sock = new TCPSocket("127.0.0.1", 8443);
if (!sock.status) {
r.log("failed to connect to upstream: ");
r.return(500);
}
r.log("successfully connected to upstream!");
sock.writeable.write("G");
sock.close();
r.return(200);
}
export default {connect}
\ No newline at end of file
t/ssl_log_voms_plain_http.t
View file @ 3c4a7183
use Test::Nginx::Socket 'no_plan';
use Test::Nginx::Socket skip_all => "to check later";
master_on();
......@@ -11,8 +11,15 @@ __DATA__
--- main_config
env X509_VOMS_DIR=t/vomsdir;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
load_module /etc/nginx/modules/ngx_http_echo_module.so;
load_module /etc/nginx/modules/ngx_http_js_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
js_path "/home/nginx/t";
js_import jslib from socket.js;
log_format voms '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" '
......@@ -21,33 +28,23 @@ __DATA__
error_log logs/error.log debug;
access_log logs/access.log voms;
listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca.pem;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10;
location = / {
location = / {
default_type text/plain;
echo $voms_user;
return 200 "$voms_user\n";
}
}
--- config
location = /lua {
location = /njs {
error_log logs/error-proxy.log debug;
access_log logs/access-proxy.log;
content_by_lua_block {
local sock = ngx.socket.tcp()
local ok, err = sock:connect("127.0.0.1", 8443)
if not ok then
ngx.say("failed to connect to upstream: ", err)
return
end
ngx.say("successfully connected to upstream!")
sock:send("G")
sock:close()
}
js_content socket.connect;
}
--- request
GET /lua
GET /njs
--- error_log
client prematurely closed connection
retrieve_voms_ac_from_proxy
......
t/ssl_no_client_authn.t
View file @ 3c4a7183
......@@ -10,14 +10,19 @@ __DATA__
env X509_VOMS_DIR=t/vomsdir;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
error_log logs/error.log debug;
listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca.pem;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10;
location = / {
location = / {
default_type text/plain;
return 200 "$voms_user\n";
}
......@@ -28,7 +33,7 @@ __DATA__
proxy_pass https://localhost:8443/;
}
--- request
GET /
GET /
--- response_body_like eval
qr/\n/
--- error_log
......
t/subrequest.t
View file @ 3c4a7183
use Test::Nginx::Socket 'no_plan';
run_tests();
......@@ -10,21 +9,24 @@ __DATA__
env X509_VOMS_DIR=t/vomsdir;
env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
load_module /etc/nginx/modules/ngx_http_echo_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
error_log logs/error.log debug;
listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca.pem;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10;
ssl_verify_client on;
location = / {
location = / {
auth_request /authz;
default_type text/plain;
echo $some_var;
return 200;
}
location = /authz {
internal;
......@@ -40,7 +42,7 @@ __DATA__
proxy_ssl_certificate_key ../../certs/3.key.pem;
}
--- request
GET /
GET /
--- response_body
/C=IT/O=IGI/CN=test0
--- error_code: 200
t/testvoms.js deleted 100644 → 0
View file @ 89acc143
function version(r) {
r.return(200, njs.version);
}
function hello(r) {
r.return(200, "Hello world!\n");
}
export default {version, hello}
t/trust-anchors/10b10516.0 deleted 100644 → 0
View file @ 89acc143
-----BEGIN CERTIFICATE-----
MIIDgDCCAmigAwIBAgIJAMzDwAv7o5VUMA0GCSqGSIb3DQEBBQUAMC0xCzAJBgNV
BAYTAklUMQwwCgYDVQQKDANJR0kxEDAOBgNVBAMMB1Rlc3QgQ0EwHhcNMTIwOTI2
MTUwMDU0WhcNMjIwOTI0MTUwMDU0WjAtMQswCQYDVQQGEwJJVDEMMAoGA1UECgwD
SUdJMRAwDgYDVQQDDAdUZXN0IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA9u4Fgtj7YpMRql3NAasEUmP6Byv/CH+dPZNzSxfNCMOPqARLBWS/2Ora
m5cRpoBByT0LpjDCFBJhLrBKvCvmWOTfS1jYsQwSpC/5scButthlcNOhLKQSZblS
8Pa7HoFS4zQFwCwWOYbOLF+FblYRgSY30WMi361giydeV8iei8KNH2FIoDyo9kjV
gYQKp76LFv7urGhc5sHA+HWq7+AfyivtZC+a55Rw6EHXOQ+vih5TPXa1t5RL7IkY
4U7Ld5ExptBIDx0UkSihYexAY4RGXVUaq535dGtJQ8/NYMrJ5NMGt2X0bRszArnE
EKc/qdAcgcalgoiaZtVkq45eXADXzwIDAQABo4GiMIGfMB0GA1UdDgQWBBSRdzZ7
LrRp8yfqt/YIi0ojohFJxjBdBgNVHSMEVjBUgBSRdzZ7LrRp8yfqt/YIi0ojohFJ
xqExpC8wLTELMAkGA1UEBhMCSVQxDDAKBgNVBAoMA0lHSTEQMA4GA1UEAwwHVGVz
dCBDQYIJAMzDwAv7o5VUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG
MA0GCSqGSIb3DQEBBQUAA4IBAQB379cvZmfCLvGdoGbW+6ppDNy3pT9hqYmZAlfV
FGZSEaTKjGCbPuErUNC6+7zhij5CmMtMRhccI3JswjPHPQGm12jiEC492J6Avj/x
PL8vcBRofe4whXefDVgUw8G1nkQYr2BF0jzeiN72ToISGMbt/q94QV70lYCo/Tog
UQQ6F+XhztffxQyRgsUXhR4qq1D4h7UifqfQGBzknS23RMLQUdKXG4MhTLMVmxJC
uY9Oi0It3hk9Qtn0nlZ7rvo5weJGxuRBbZ85Nvw2tIhH7G2osc6zqmHTmUAR4FXb
l8/ElwGVrURMMuJLDbISVXjBNFuVOS2BdlyEe4x5kfQAWITZ
-----END CERTIFICATE-----
t/trust-anchors/21ca5d6a.0 deleted 100644 → 0
View file @ 89acc143
-----BEGIN CERTIFICATE-----
MIIDhjCCAm6gAwIBAgIJAMCV/2NZUk0YMA0GCSqGSIb3DQEBBQUAMC8xCzAJBgNV
BAYTAklUMQwwCgYDVQQKDANJR0kxEjAQBgNVBAMMCVRlc3QgQ0EgMjAeFw0xNTAx
MjcxMzM5MjFaFw0yNTAxMjQxMzM5MjFaMC8xCzAJBgNVBAYTAklUMQwwCgYDVQQK
DANJR0kxEjAQBgNVBAMMCVRlc3QgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBANgKnBTosmSk8MKmSaVNp2c1HJplrWAML/bx+X6wpvoC6RoxH+5G
2VIHHZjdgUyBcyuYDI2piwE2ByTrD5F/ToDsLpUReAmZeRY5fURwP5Gp0DMszdRq
uZR74I59BRSzuCpK7o4Oq01DubSisXrIfgpuOrFcAADl/Pe4L2M4dNrB5Ck/SaR+
bRMN4CHBYAdlv3ncC3if31zwoMNMYoomhme0qmwWtRUzAlz8Hw5LM+Ngt43RiFWD
DqPD8QL6wxBtCxXUYaOPLt4pRsda5wsARWKGuutppzDPBbKVNTNMccnuUnk1UnzR
P4n6iRoPb8SR3P3uVx5dBdkI4xUpxEzNkn0CAwEAAaOBpDCBoTAdBgNVHQ4EFgQU
NwPLlkI6FI+9W3Iq7vBrqG1PjEQwXwYDVR0jBFgwVoAUNwPLlkI6FI+9W3Iq7vBr
qG1PjEShM6QxMC8xCzAJBgNVBAYTAklUMQwwCgYDVQQKDANJR0kxEjAQBgNVBAMM
CVRlc3QgQ0EgMoIJAMCV/2NZUk0YMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4IBAQCFbvyDXdzRPtlFpq0ZSh5IMNWy3V1N
CwLa8vmEVwEBsgMQD4NTdefcJ/QkW3CvokhvfCt3Na83J1U9uSp98xiyWNi1esuM
MG1kplM30uNOOZd0UK97VxX5A/IRawBZJoVzgla6rygQTG4SUaguXm1ZaPlGRwhn
cJvbtusuiFa805O021g7+se8yu1E9457nMj5rLvPJ/b5UnwK0e2iRbbJje9VAp77
/wcP2Ec/XfzDhfAksAsZAjg3+ngykvp4MDe56lExePOiIXDb7UMmnBSuQUpClsnB
2qYc7yWYRN279UUtMB81lXZdsc0FiwhMj6C141RrqP2girdwiJERoP7s
-----END CERTIFICATE-----
t/trust-anchors/7940b442.0 deleted 100644 → 0
View file @ 89acc143
-----BEGIN CERTIFICATE-----
MIIDhjCCAm6gAwIBAgIJAMCV/2NZUk0YMA0GCSqGSIb3DQEBBQUAMC8xCzAJBgNV
BAYTAklUMQwwCgYDVQQKDANJR0kxEjAQBgNVBAMMCVRlc3QgQ0EgMjAeFw0xNTAx
MjcxMzM5MjFaFw0yNTAxMjQxMzM5MjFaMC8xCzAJBgNVBAYTAklUMQwwCgYDVQQK
DANJR0kxEjAQBgNVBAMMCVRlc3QgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBANgKnBTosmSk8MKmSaVNp2c1HJplrWAML/bx+X6wpvoC6RoxH+5G
2VIHHZjdgUyBcyuYDI2piwE2ByTrD5F/ToDsLpUReAmZeRY5fURwP5Gp0DMszdRq
uZR74I59BRSzuCpK7o4Oq01DubSisXrIfgpuOrFcAADl/Pe4L2M4dNrB5Ck/SaR+
bRMN4CHBYAdlv3ncC3if31zwoMNMYoomhme0qmwWtRUzAlz8Hw5LM+Ngt43RiFWD
DqPD8QL6wxBtCxXUYaOPLt4pRsda5wsARWKGuutppzDPBbKVNTNMccnuUnk1UnzR
P4n6iRoPb8SR3P3uVx5dBdkI4xUpxEzNkn0CAwEAAaOBpDCBoTAdBgNVHQ4EFgQU
NwPLlkI6FI+9W3Iq7vBrqG1PjEQwXwYDVR0jBFgwVoAUNwPLlkI6FI+9W3Iq7vBr
qG1PjEShM6QxMC8xCzAJBgNVBAYTAklUMQwwCgYDVQQKDANJR0kxEjAQBgNVBAMM
CVRlc3QgQ0EgMoIJAMCV/2NZUk0YMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4IBAQCFbvyDXdzRPtlFpq0ZSh5IMNWy3V1N
CwLa8vmEVwEBsgMQD4NTdefcJ/QkW3CvokhvfCt3Na83J1U9uSp98xiyWNi1esuM
MG1kplM30uNOOZd0UK97VxX5A/IRawBZJoVzgla6rygQTG4SUaguXm1ZaPlGRwhn
cJvbtusuiFa805O021g7+se8yu1E9457nMj5rLvPJ/b5UnwK0e2iRbbJje9VAp77
/wcP2Ec/XfzDhfAksAsZAjg3+ngykvp4MDe56lExePOiIXDb7UMmnBSuQUpClsnB
2qYc7yWYRN279UUtMB81lXZdsc0FiwhMj6C141RrqP2girdwiJERoP7s
-----END CERTIFICATE-----
t/trust-anchors/d82942ab.0 deleted 100644 → 0
View file @ 89acc143
-----BEGIN CERTIFICATE-----
MIIDgDCCAmigAwIBAgIJAMzDwAv7o5VUMA0GCSqGSIb3DQEBBQUAMC0xCzAJBgNV
BAYTAklUMQwwCgYDVQQKDANJR0kxEDAOBgNVBAMMB1Rlc3QgQ0EwHhcNMTIwOTI2
MTUwMDU0WhcNMjIwOTI0MTUwMDU0WjAtMQswCQYDVQQGEwJJVDEMMAoGA1UECgwD
SUdJMRAwDgYDVQQDDAdUZXN0IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA9u4Fgtj7YpMRql3NAasEUmP6Byv/CH+dPZNzSxfNCMOPqARLBWS/2Ora
m5cRpoBByT0LpjDCFBJhLrBKvCvmWOTfS1jYsQwSpC/5scButthlcNOhLKQSZblS
8Pa7HoFS4zQFwCwWOYbOLF+FblYRgSY30WMi361giydeV8iei8KNH2FIoDyo9kjV
gYQKp76LFv7urGhc5sHA+HWq7+AfyivtZC+a55Rw6EHXOQ+vih5TPXa1t5RL7IkY
4U7Ld5ExptBIDx0UkSihYexAY4RGXVUaq535dGtJQ8/NYMrJ5NMGt2X0bRszArnE
EKc/qdAcgcalgoiaZtVkq45eXADXzwIDAQABo4GiMIGfMB0GA1UdDgQWBBSRdzZ7
LrRp8yfqt/YIi0ojohFJxjBdBgNVHSMEVjBUgBSRdzZ7LrRp8yfqt/YIi0ojohFJ
xqExpC8wLTELMAkGA1UEBhMCSVQxDDAKBgNVBAoMA0lHSTEQMA4GA1UEAwwHVGVz
dCBDQYIJAMzDwAv7o5VUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG
MA0GCSqGSIb3DQEBBQUAA4IBAQB379cvZmfCLvGdoGbW+6ppDNy3pT9hqYmZAlfV
FGZSEaTKjGCbPuErUNC6+7zhij5CmMtMRhccI3JswjPHPQGm12jiEC492J6Avj/x
PL8vcBRofe4whXefDVgUw8G1nkQYr2BF0jzeiN72ToISGMbt/q94QV70lYCo/Tog
UQQ6F+XhztffxQyRgsUXhR4qq1D4h7UifqfQGBzknS23RMLQUdKXG4MhTLMVmxJC
uY9Oi0It3hk9Qtn0nlZ7rvo5weJGxuRBbZ85Nvw2tIhH7G2osc6zqmHTmUAR4FXb
l8/ElwGVrURMMuJLDbISVXjBNFuVOS2BdlyEe4x5kfQAWITZ
-----END CERTIFICATE-----
t/trust-anchors/igi-test-ca-2.pem deleted 100644 → 0
View file @ 89acc143
-----BEGIN CERTIFICATE-----
MIIDhjCCAm6gAwIBAgIJAMCV/2NZUk0YMA0GCSqGSIb3DQEBBQUAMC8xCzAJBgNV
BAYTAklUMQwwCgYDVQQKDANJR0kxEjAQBgNVBAMMCVRlc3QgQ0EgMjAeFw0xNTAx
MjcxMzM5MjFaFw0yNTAxMjQxMzM5MjFaMC8xCzAJBgNVBAYTAklUMQwwCgYDVQQK
DANJR0kxEjAQBgNVBAMMCVRlc3QgQ0EgMjCCASIwDQYJKoZIhvcNAQEBBQADggEP
ADCCAQoCggEBANgKnBTosmSk8MKmSaVNp2c1HJplrWAML/bx+X6wpvoC6RoxH+5G
2VIHHZjdgUyBcyuYDI2piwE2ByTrD5F/ToDsLpUReAmZeRY5fURwP5Gp0DMszdRq
uZR74I59BRSzuCpK7o4Oq01DubSisXrIfgpuOrFcAADl/Pe4L2M4dNrB5Ck/SaR+
bRMN4CHBYAdlv3ncC3if31zwoMNMYoomhme0qmwWtRUzAlz8Hw5LM+Ngt43RiFWD
DqPD8QL6wxBtCxXUYaOPLt4pRsda5wsARWKGuutppzDPBbKVNTNMccnuUnk1UnzR
P4n6iRoPb8SR3P3uVx5dBdkI4xUpxEzNkn0CAwEAAaOBpDCBoTAdBgNVHQ4EFgQU
NwPLlkI6FI+9W3Iq7vBrqG1PjEQwXwYDVR0jBFgwVoAUNwPLlkI6FI+9W3Iq7vBr
qG1PjEShM6QxMC8xCzAJBgNVBAYTAklUMQwwCgYDVQQKDANJR0kxEjAQBgNVBAMM
CVRlc3QgQ0EgMoIJAMCV/2NZUk0YMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/
BAQDAgEGMA0GCSqGSIb3DQEBBQUAA4IBAQCFbvyDXdzRPtlFpq0ZSh5IMNWy3V1N
CwLa8vmEVwEBsgMQD4NTdefcJ/QkW3CvokhvfCt3Na83J1U9uSp98xiyWNi1esuM
MG1kplM30uNOOZd0UK97VxX5A/IRawBZJoVzgla6rygQTG4SUaguXm1ZaPlGRwhn
cJvbtusuiFa805O021g7+se8yu1E9457nMj5rLvPJ/b5UnwK0e2iRbbJje9VAp77
/wcP2Ec/XfzDhfAksAsZAjg3+ngykvp4MDe56lExePOiIXDb7UMmnBSuQUpClsnB
2qYc7yWYRN279UUtMB81lXZdsc0FiwhMj6C141RrqP2girdwiJERoP7s
-----END CERTIFICATE-----
t/trust-anchors/igi-test-ca.pem deleted 100644 → 0
View file @ 89acc143
-----BEGIN CERTIFICATE-----
MIIDgDCCAmigAwIBAgIJAMzDwAv7o5VUMA0GCSqGSIb3DQEBBQUAMC0xCzAJBgNV
BAYTAklUMQwwCgYDVQQKDANJR0kxEDAOBgNVBAMMB1Rlc3QgQ0EwHhcNMTIwOTI2
MTUwMDU0WhcNMjIwOTI0MTUwMDU0WjAtMQswCQYDVQQGEwJJVDEMMAoGA1UECgwD
SUdJMRAwDgYDVQQDDAdUZXN0IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA9u4Fgtj7YpMRql3NAasEUmP6Byv/CH+dPZNzSxfNCMOPqARLBWS/2Ora
m5cRpoBByT0LpjDCFBJhLrBKvCvmWOTfS1jYsQwSpC/5scButthlcNOhLKQSZblS
8Pa7HoFS4zQFwCwWOYbOLF+FblYRgSY30WMi361giydeV8iei8KNH2FIoDyo9kjV
gYQKp76LFv7urGhc5sHA+HWq7+AfyivtZC+a55Rw6EHXOQ+vih5TPXa1t5RL7IkY
4U7Ld5ExptBIDx0UkSihYexAY4RGXVUaq535dGtJQ8/NYMrJ5NMGt2X0bRszArnE
EKc/qdAcgcalgoiaZtVkq45eXADXzwIDAQABo4GiMIGfMB0GA1UdDgQWBBSRdzZ7
LrRp8yfqt/YIi0ojohFJxjBdBgNVHSMEVjBUgBSRdzZ7LrRp8yfqt/YIi0ojohFJ
xqExpC8wLTELMAkGA1UEBhMCSVQxDDAKBgNVBAoMA0lHSTEQMA4GA1UEAwwHVGVz
dCBDQYIJAMzDwAv7o5VUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEG
MA0GCSqGSIb3DQEBBQUAA4IBAQB379cvZmfCLvGdoGbW+6ppDNy3pT9hqYmZAlfV
FGZSEaTKjGCbPuErUNC6+7zhij5CmMtMRhccI3JswjPHPQGm12jiEC492J6Avj/x
PL8vcBRofe4whXefDVgUw8G1nkQYr2BF0jzeiN72ToISGMbt/q94QV70lYCo/Tog
UQQ6F+XhztffxQyRgsUXhR4qq1D4h7UifqfQGBzknS23RMLQUdKXG4MhTLMVmxJC
uY9Oi0It3hk9Qtn0nlZ7rvo5weJGxuRBbZ85Nvw2tIhH7G2osc6zqmHTmUAR4FXb
l8/ElwGVrURMMuJLDbISVXjBNFuVOS2BdlyEe4x5kfQAWITZ
-----END CERTIFICATE-----
t/untrusted_ac1.t
View file @ 3c4a7183
......@@ -11,15 +11,20 @@ __DATA__
env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
error_log logs/error.log debug;
listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca.pem;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10;
ssl_verify_client on;
location = / {
location = / {
default_type text/plain;
return 200 "$voms_user\n";
}
......@@ -32,7 +37,7 @@ __DATA__
proxy_ssl_certificate_key ../../certs/5.key.pem;
}
--- request
GET /
GET /
--- response_body_like eval
qr/\n/
--- error_log
......