Skip to content
Snippets Groups Projects

Compare revisions

Changes are shown as if the source revision was being merged into the target revision. Learn more about comparing revisions.

Source

Select target project
No results found
Select Git revision

Target

Select target project
  • fornari/ngx_http_voms_module
  • cnafsd/ngx_http_voms_module
2 results
Select Git revision
Show changes
Hide whitespace changes
Inline Side-by-side
Showing
with 544 additions and 50 deletions
t/eec_cert1.t 0 → 100644
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan';
run_tests();
__DATA__
=== TEST 1: RFC proxy certificate, no AC
--- main_config
env X509_VOMS_DIR=t/vomsdir;
env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
error_log logs/error.log debug;
listen 8443 ssl;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10;
ssl_verify_client on;
location = / {
default_type text/plain;
return 200 "$ssl_client_ee_s_dn\n$ssl_client_ee_i_dn\n$ssl_client_s_dn\n$ssl_client_i_dn\n";
}
}
--- config
location = / {
error_log logs/error-proxy.log debug;
proxy_pass https://localhost:8443/;
proxy_ssl_certificate ../../certs/0.cert.pem;
proxy_ssl_certificate_key ../../certs/0.key.pem;
}
--- request
GET /
--- response_body eval
my $ee_s = `openssl x509 -in t/certs/test0.cert.pem -noout -subject -nameopt RFC2253` =~ s/^subject=//r;
my $ee_i = `openssl x509 -in t/certs/test0.cert.pem -noout -issuer -nameopt RFC2253` =~ s/^issuer=//r;
my $pr_s = `openssl x509 -in t/certs/0.cert.pem -noout -subject -nameopt RFC2253` =~ s/^subject=//r;
my $pr_i = `openssl x509 -in t/certs/0.cert.pem -noout -issuer -nameopt RFC2253` =~ s/^issuer=//r;
"$ee_s$ee_i$pr_s$pr_i";
--- error_code: 200
t/eec_chain.t 0 → 100644
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan';
run_tests();
__DATA__
=== TEST 1: EEC chain containing CA certificate
--- main_config
env X509_VOMS_DIR=t/vomsdir;
env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
error_log logs/error.log debug;
listen 8443 ssl;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10;
ssl_verify_client on;
location = / {
default_type text/plain;
return 200 "$ssl_client_ee_s_dn\n";
}
}
--- config
location = / {
error_log logs/error-proxy.log debug;
proxy_pass https://localhost:8443/;
proxy_ssl_certificate ../../certs/test0+ca.pem;
proxy_ssl_certificate_key ../../certs/test0.key.pem;
}
--- request
GET /
--- response_body eval
`openssl x509 -in t/certs/test0.cert.pem -noout -subject -nameopt RFC2253` =~ s/^subject=//r;
--- error_code: 200
t/eec_subject2.t 0 → 100644
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan';
run_tests();
__DATA__
=== TEST 1: End-entity X.509 certificate
--- main_config
env X509_VOMS_DIR=t/vomsdir;
env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
error_log logs/error.log debug;
listen 8443 ssl;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10;
ssl_verify_client on;
location = / {
default_type text/plain;
return 200 "$ssl_client_ee_s_dn\n$ssl_client_s_dn\n$ssl_client_ee_i_dn\n$ssl_client_i_dn\n";
}
}
--- config
location = / {
error_log logs/error-proxy.log debug;
proxy_pass https://localhost:8443/;
proxy_ssl_certificate ../../certs/test0.cert.pem;
proxy_ssl_certificate_key ../../certs/test0.key.pem;
}
--- request
GET /
--- response_body eval
my $c_s = `openssl x509 -in t/certs/test0.cert.pem -noout -subject -nameopt RFC2253` =~ s/^subject=//r;
my $c_i = `openssl x509 -in t/certs/test0.cert.pem -noout -issuer -nameopt RFC2253` =~ s/^issuer=//r;
"$c_s$c_s$c_i$c_i";
--- error_code: 200
t/eec_subject3.t 0 → 100644
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan';
run_tests();
__DATA__
=== TEST 1: three delegations proxy
--- main_config
env X509_VOMS_DIR=t/vomsdir;
env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
error_log logs/error.log debug;
listen 8443 ssl;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10;
ssl_verify_client on;
location = / {
default_type text/plain;
return 200 "$ssl_client_ee_s_dn\n$ssl_client_ee_i_dn\n";
}
}
--- config
location = / {
error_log logs/error-proxy.log debug;
proxy_pass https://localhost:8443/;
proxy_ssl_certificate ../../certs/6.cert.pem;
proxy_ssl_certificate_key ../../certs/6.key.pem;
}
--- request
GET /
--- response_body eval
my $c_s = `openssl x509 -in t/certs/test0.cert.pem -noout -subject -nameopt RFC2253` =~ s/^subject=//r;
my $c_i = `openssl x509 -in t/certs/test0.cert.pem -noout -issuer -nameopt RFC2253` =~ s/^issuer=//r;
"$c_s$c_i";
--- error_code: 200
t/encoding.t
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan'; use Test::Nginx::Socket 'no_plan';
...@@ -7,21 +10,26 @@ __DATA__ ...@@ -7,21 +10,26 @@ __DATA__
=== TEST 1: valid AC, verification of VOMS generic attributes encoding === TEST 1: valid AC, verification of VOMS generic attributes encoding
--- main_config --- main_config
env OPENSSL_ALLOW_PROXY_CERTS=1;
env X509_VOMS_DIR=t/vomsdir; env X509_VOMS_DIR=t/vomsdir;
env X509_CERT_DIR=t/trust-anchors; env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config --- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server { server {
error_log logs/error.log debug; error_log logs/error.log debug;
listen 8443 ssl; listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem; ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem; ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca.pem; ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10; ssl_verify_depth 10;
ssl_verify_client on; ssl_verify_client on;
location = / { location = / {
default_type text/plain; default_type text/plain;
echo $voms_generic_attributes; return 200 "$voms_generic_attributes\n";
} }
} }
--- config --- config
...@@ -34,5 +42,5 @@ __DATA__ ...@@ -34,5 +42,5 @@ __DATA__
--- request --- request
GET / GET /
--- response_body --- response_body
n=nickname v=newland86 q=test.vo,n=title v=assegnista%25di%25ricerca%40CNAF q=test.vo n=nickname v=sd q=test.vo,n=title v=assegnista%25di%25ricerca%40CNAF q=test.vo
--- error_code: 200 --- error_code: 200
t/expired.t
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan'; use Test::Nginx::Socket 'no_plan';
...@@ -7,19 +10,24 @@ __DATA__ ...@@ -7,19 +10,24 @@ __DATA__
=== TEST 1: https with x509 client authentication, expired client certificate === TEST 1: https with x509 client authentication, expired client certificate
--- main_config --- main_config
env OPENSSL_ALLOW_PROXY_CERTS=1; load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config --- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server { server {
error_log logs/error.log debug; error_log logs/error.log debug;
listen 8443 ssl; listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem; ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem; ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca.pem; ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10; ssl_verify_depth 10;
ssl_verify_client on; ssl_verify_client on;
location = / { location = / {
default_type text/plain; default_type text/plain;
echo $ssl_client_s_dn; return 200 "$ssl_client_s_dn\n";
} }
} }
--- config --- config
......
t/expired_ac.t
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan'; use Test::Nginx::Socket 'no_plan';
...@@ -7,22 +10,26 @@ __DATA__ ...@@ -7,22 +10,26 @@ __DATA__
=== TEST 1: https with x509 client authentication, valid proxy certificate with expired VOMS attributes === TEST 1: https with x509 client authentication, valid proxy certificate with expired VOMS attributes
--- main_config --- main_config
env OPENSSL_ALLOW_PROXY_CERTS=1;
env X509_VOMS_DIR=t/vomsdir; env X509_VOMS_DIR=t/vomsdir;
env X509_CERT_DIR=t/trust-anchors; env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config --- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server { server {
error_log logs/error.log debug; error_log logs/error.log debug;
listen 8443 ssl; listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem; ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem; ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca.pem; ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10; ssl_verify_depth 10;
ssl_verify_client on; ssl_verify_client on;
location = / { location = / {
default_type text/plain; default_type text/plain;
echo $voms_fqans; return 200 "$voms_fqans\n$voms_user\n";
echo $voms_user;
} }
} }
--- config --- config
...@@ -33,7 +40,7 @@ __DATA__ ...@@ -33,7 +40,7 @@ __DATA__
proxy_ssl_certificate_key ../../certs/1.key.pem; proxy_ssl_certificate_key ../../certs/1.key.pem;
} }
--- request --- request
GET / GET /
--- response_body_like eval --- response_body_like eval
qr/\n\n/ qr/\n\n/
--- error_log --- error_log
......
t/no_ac.t
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan'; use Test::Nginx::Socket 'no_plan';
...@@ -5,23 +8,27 @@ run_tests(); ...@@ -5,23 +8,27 @@ run_tests();
__DATA__ __DATA__
=== TEST 1: https with x509 client authentication, valid proxy certificate with no VOMS attributes === TEST 1: HTTPS with X.509 client authentication, valid proxy certificate with no VOMS attributes
--- main_config --- main_config
env OPENSSL_ALLOW_PROXY_CERTS=1;
env X509_VOMS_DIR=t/vomsdir; env X509_VOMS_DIR=t/vomsdir;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config --- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server { server {
error_log logs/error.log debug; error_log logs/error.log debug;
listen 8443 ssl; listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem; ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem; ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca.pem; ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10; ssl_verify_depth 10;
ssl_verify_client on; ssl_verify_client on;
location = / { location = / {
default_type text/plain; default_type text/plain;
echo $voms_fqans; return 200 "$voms_fqans\n$voms_user\n";
echo $voms_user;
} }
} }
--- config --- config
...@@ -32,7 +39,7 @@ __DATA__ ...@@ -32,7 +39,7 @@ __DATA__
proxy_ssl_certificate_key ../../certs/0.key.pem; proxy_ssl_certificate_key ../../certs/0.key.pem;
} }
--- request --- request
GET / GET /
--- response_body_like eval --- response_body_like eval
qr/\n\n/ qr/\n\n/
--- error_log --- error_log
......
t/no_ssl.t
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan'; use Test::Nginx::Socket 'no_plan';
...@@ -7,15 +10,19 @@ __DATA__ ...@@ -7,15 +10,19 @@ __DATA__
=== TEST 1: HTTP connection, no SSL === TEST 1: HTTP connection, no SSL
--- main_config --- main_config
env OPENSSL_ALLOW_PROXY_CERTS=1; load_module /etc/nginx/modules/ngx_http_voms_module.so;
env X509_VOMS_DIR=t/vomsdir;
--- http_config --- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server { server {
error_log logs/error.log debug; error_log logs/error.log debug;
listen 8443; listen 8443;
location = / { location = / {
default_type text/plain; default_type text/plain;
echo $voms_user; return 200 "$voms_user\n";
} }
} }
--- config --- config
...@@ -24,7 +31,7 @@ __DATA__ ...@@ -24,7 +31,7 @@ __DATA__
proxy_pass http://localhost:8443/; proxy_pass http://localhost:8443/;
} }
--- request --- request
GET / GET /
--- response_body_like eval --- response_body_like eval
qr/\n/ qr/\n/
--- error_log --- error_log
......
t/no_ta.t
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan'; use Test::Nginx::Socket 'no_plan';
...@@ -5,23 +8,28 @@ run_tests(); ...@@ -5,23 +8,28 @@ run_tests();
__DATA__ __DATA__
=== TEST 1: Valid proxy, wrong client trust-anchor === TEST 1: Valid proxy, wrong client trust-anchor
--- main_config --- main_config
env OPENSSL_ALLOW_PROXY_CERTS=1;
env X509_VOMS_DIR=t/vomsdir; env X509_VOMS_DIR=t/vomsdir;
env X509_CERT_DIR=t/trust-anchors; env X509_CERT_DIR=t/trust-anchors;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config --- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server { server {
error_log logs/error.log debug; error_log logs/error.log debug;
listen 8443 ssl; listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem; ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem; ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca-2.pem; ssl_client_certificate ../../trust-anchors/igi_test_ca2.pem;
ssl_verify_depth 10; ssl_verify_depth 10;
ssl_verify_client on; ssl_verify_client on;
location = / { location = / {
default_type text/plain; default_type text/plain;
echo $voms_fqans; return 200 "$voms_fqans\n";
} }
} }
--- config --- config
...@@ -32,7 +40,7 @@ __DATA__ ...@@ -32,7 +40,7 @@ __DATA__
proxy_ssl_certificate_key ../../certs/3.key.pem; proxy_ssl_certificate_key ../../certs/3.key.pem;
} }
--- request --- request
GET / GET /
--- error_code: 400 --- error_code: 400
t/openssl.conf 0 → 100644
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
config_diagnostics = 1
[ ca ]
default_ca = ${ENV::CA_NAME}
.include conf.d
t/proxies.d/1.conf 0 → 100644
View file @ 048fb9a4
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/star_test_example.cert.pem
-hostkey=certs/star_test_example.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan="/test.vo"
-pastproxy=24:0
-hours=100
-pastac=24:0
-vomslife=12
t/proxies.d/2.conf 0 → 100644
View file @ 048fb9a4
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/star_test_example.cert.pem
-hostkey=certs/star_test_example.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan="/test.vo"
-pastproxy=24:0
-hours=12
-pastac=24:0
-vomslife=12
t/proxies.d/3.conf 0 → 100644
View file @ 048fb9a4
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/star_test_example.cert.pem
-hostkey=certs/star_test_example.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan=/test.vo/exp1
-fqan=/test.vo/exp2
-fqan=/test.vo/exp3/Role=PIPPO
-ga=nickname=sd
-ga=nickname=cnaf
-hours=12
-vomslife=12
-newserial=abcdef
t/proxies.d/4.conf 0 → 100644
View file @ 048fb9a4
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/star_test_example.cert.pem
-hostkey=certs/star_test_example.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan=/test.vo
-ga=nickname=sd
-ga=title=assegnista%di%ricerca@CNAF
-hours=12
-vomslife=12
t/proxies.d/5.conf 0 → 100644
View file @ 048fb9a4
-voms=test.vo
-cert=certs/test0.cert.pem
-key=certs/test0.key.pem
-hostcert=certs/untrusted_voms.cert.pem
-hostkey=certs/untrusted_voms.key.pem
-certdir=trust-anchors
-uri=voms.example:15000
-fqan=/test.vo/exp1
-fqan=/test.vo/exp2
-fqan=/test.vo/exp3/Role=PIPPO
-ga=nickname=sd
-ga=nickname=cnaf
-hours=12
-vomslife=12
t/setup.sh 0 → 100755
View file @ 048fb9a4
#!/bin/bash
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
set -e
if [ ! -e "openssl.conf" ]; then
>&2 echo "The configuration file 'openssl.conf' doesn't exist in this directory"
exit 1
fi
base_dir=$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd)
certs_dir="${base_dir}"/certs
ta_dir="${base_dir}"/trust-anchors
vomsdir="${base_dir}"/vomsdir
rm -rf "${certs_dir}"
mkdir -p "${certs_dir}"
rm -rf "${ta_dir}"
mkdir -p "${ta_dir}"
rm -rf "${vomsdir}"
mkdir -p "${vomsdir}"
[ -d "igi_test_ca2" ] && remove_ca.sh igi_test_ca2
export CA_NAME=igi_test_ca2
make_ca.sh
make_crl.sh
install_ca.sh igi_test_ca2 "${ta_dir}"
make_cert.sh untrusted_voms
cp igi_test_ca2/certs/untrusted_voms.* "${certs_dir}"
[ -d "igi_test_ca" ] && remove_ca.sh igi_test_ca
export CA_NAME=igi_test_ca
make_ca.sh
make_crl.sh
install_ca.sh igi_test_ca "${ta_dir}"
export X509_CERT_DIR="${ta_dir}"
make_cert.sh test0
cp igi_test_ca/certs/test0.* "${certs_dir}"
make_cert.sh star_test_example
cp igi_test_ca/certs/star_test_example.* "${certs_dir}"
mkdir -p "${vomsdir}"/test.vo
openssl x509 -in "${certs_dir}"/star_test_example.cert.pem -noout -subject -issuer -nameopt compat \
| sed -e 's/subject=//' -e 's/issuer=//' > "${vomsdir}"/test.vo/voms.example.lsc
# test 1
echo | voms-proxy-init -cert "${certs_dir}"/test0.p12 --valid 10:0 --out "${certs_dir}"/0.pem --pwstdin
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/0.pem > "${certs_dir}"/0.key.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/0.pem > "${certs_dir}"/0.cert.pem
# test 3
cat "${certs_dir}"/test0.cert.pem "${ta_dir}"/igi_test_ca.pem > "${certs_dir}"/test0+ca.pem
# long-lived proxy certificate, with an expired AC
proxy_name=1
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# expired proxy certificate
proxy_name=2
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# valid proxy certificate with valid AC
proxy_name=3
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# proxy with VOMS generic attributes containing special characters
proxy_name=4
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# proxy with valid VOMS attributes, untrusted AC signature (LSC missing) and VOMS trust-anchor missing
proxy_name=5
voms-proxy-fake --debug -conf proxies.d/${proxy_name}.conf -out "${certs_dir}"/${proxy_name}.pem
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
# proxy chain with 3 delegations, without VOMS attributes
proxy_name=6
env X509_USER_PROXY="${certs_dir}/3.pem" X509_CERT_DIR="${ta_dir}" voms-proxy-init2 --out "${certs_dir}"/${proxy_name}.pem -noregen -dont-verify-ac
awk '/BEGIN CERTIFICATE/,/END CERTIFICATE/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.cert.pem
awk '/BEGIN RSA PRIVATE KEY/,/END RSA PRIVATE KEY/' "${certs_dir}"/${proxy_name}.pem > "${certs_dir}"/${proxy_name}.key.pem
chmod 600 "${certs_dir}"/${proxy_name}.key.pem
t/socket.js 0 → 100644
View file @ 048fb9a4
// SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
//
// SPDX-License-Identifier: EUPL-1.2
function connect(r) {
r.log("vivo");
var sock = new TCPSocket("127.0.0.1", 8443);
if (!sock.status) {
r.log("failed to connect to upstream: ");
r.return(500);
}
r.log("successfully connected to upstream!");
sock.writeable.write("G");
sock.close();
r.return(200);
}
export default {connect}
\ No newline at end of file
t/ssl_log_voms_plain_http.t 0 → 100644
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket skip_all => "to check later";
master_on();
run_tests();
__DATA__
=== TEST 1: SSL server, logging a VOMS variabile, but plain HTTP request
--- main_config
env X509_VOMS_DIR=t/vomsdir;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
load_module /etc/nginx/modules/ngx_http_js_module.so;
--- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
js_path "/home/nginx/t";
js_import jslib from socket.js;
log_format voms '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" '
'[$voms_user]';
server {
error_log logs/error.log debug;
access_log logs/access.log voms;
listen 8443 ssl;
ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10;
location = / {
default_type text/plain;
return 200 "$voms_user\n";
}
}
--- config
location = /njs {
error_log logs/error-proxy.log debug;
access_log logs/access-proxy.log;
js_content socket.connect;
}
--- request
GET /njs
--- error_log
client prematurely closed connection
retrieve_voms_ac_from_proxy
plain HTTP
--- error_code: 200
t/ssl_no_client_authn.t
View file @ 048fb9a4
# SPDX-FileCopyrightText: 2018 Istituto Nazionale di Fisica Nucleare
#
# SPDX-License-Identifier: EUPL-1.2
use Test::Nginx::Socket 'no_plan'; use Test::Nginx::Socket 'no_plan';
...@@ -7,19 +10,24 @@ __DATA__ ...@@ -7,19 +10,24 @@ __DATA__
=== TEST 1: HTTPS with no X.509 client authentication === TEST 1: HTTPS with no X.509 client authentication
--- main_config --- main_config
env OPENSSL_ALLOW_PROXY_CERTS=1;
env X509_VOMS_DIR=t/vomsdir; env X509_VOMS_DIR=t/vomsdir;
load_module /etc/nginx/modules/ngx_http_voms_module.so;
--- http_config --- http_config
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp_path;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server { server {
error_log logs/error.log debug; error_log logs/error.log debug;
listen 8443 ssl; listen 8443 ssl;
ssl_certificate ../../certs/nginx_voms_example.cert.pem; ssl_certificate ../../certs/star_test_example.cert.pem;
ssl_certificate_key ../../certs/nginx_voms_example.key.pem; ssl_certificate_key ../../certs/star_test_example.key.pem;
ssl_client_certificate ../../trust-anchors/igi-test-ca.pem; ssl_client_certificate ../../trust-anchors/igi_test_ca.pem;
ssl_verify_depth 10; ssl_verify_depth 10;
location = / { location = / {
default_type text/plain; default_type text/plain;
echo $voms_user; return 200 "$voms_user\n";
} }
} }
--- config --- config
...@@ -28,7 +36,7 @@ __DATA__ ...@@ -28,7 +36,7 @@ __DATA__
proxy_pass https://localhost:8443/; proxy_pass https://localhost:8443/;
} }
--- request --- request
GET / GET /
--- response_body_like eval --- response_body_like eval
qr/\n/ qr/\n/
--- error_log --- error_log
......