fix(test): tls_verify_partial_chain
This commit is contained in:
William Yang
parent
a29a43e5fc
commit
43ad665dcf
|
|
@ -36,12 +36,6 @@ all() -> emqx_common_test_helpers:all(?MODULE).
|
|||
init_per_suite(Config) ->
|
||||
generate_tls_certs(Config),
|
||||
application:ensure_all_started(esockd),
|
||||
dbg:tracer(process, {fun dbg:dhandler/2, group_leader()}),
|
||||
dbg:p(all, c),
|
||||
dbg:tpl(emqx_listeners, esockd_opts, cx),
|
||||
dbg:tpl(emqx_listeners, inject_root_fun, cx),
|
||||
dbg:tpl(esockd, open, cx),
|
||||
|
||||
[{ssl_config, ssl_config_verify_partial_chain()} | Config].
|
||||
|
||||
end_per_suite(_Config) ->
|
||||
|
|
@ -51,11 +45,12 @@ t_conn_success_with_server_intermediate_cacert_and_client_cert(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -75,11 +70,12 @@ t_conn_success_with_intermediate_cacert_bundle(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "server1-intermediate1-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -99,11 +95,12 @@ t_conn_success_with_renewed_intermediate_cacert(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1_renewed.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -123,11 +120,12 @@ t_conn_fail_with_renewed_intermediate_cacert_and_client_using_old_complete_bundl
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2_renewed.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -147,11 +145,12 @@ t_conn_fail_with_renewed_intermediate_cacert_and_client_using_old_bundle(Config)
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2_renewed.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -173,12 +172,13 @@ t_conn_success_with_old_and_renewed_intermediate_cacert_and_client_provides_rene
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2_renewed_old-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")},
|
||||
{partial_chain, two_cacerts_from_cacertfile}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -201,11 +201,12 @@ t_conn_success_with_new_intermediate_cacert_and_client_provides_renewed_client_c
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2_renewed.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -226,12 +227,13 @@ t_conn_success_with_old_and_renewed_intermediate_cacert_and_client_provides_clie
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2_renewed_old-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")},
|
||||
{partial_chain, two_cacerts_from_cacertfile}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -252,11 +254,12 @@ t_conn_fail_with_renewed_and_old_intermediate_cacert_and_client_using_old_bundle
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2_renewed_old-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -273,16 +276,19 @@ t_conn_fail_with_renewed_and_old_intermediate_cacert_and_client_using_old_bundle
|
|||
ssl:close(Socket).
|
||||
|
||||
%% @doc verify when config (two_cacerts_from_cacertfile) allows two versions of certs from same trusted CA.
|
||||
t_conn_success_with_old_and_renewed_intermediate_cacert_bundle_and_client_using_old_bundle(Config) ->
|
||||
t_001_conn_success_with_old_and_renewed_intermediate_cacert_bundle_and_client_using_old_bundle(
|
||||
Config
|
||||
) ->
|
||||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2_renewed_old-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")},
|
||||
{partial_chain, two_cacerts_from_cacertfile}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -304,16 +310,17 @@ t_conn_success_with_old_and_renewed_intermediate_cacert_bundle_and_client_using_
|
|||
%% OTP should still fail the validation since the client1 cert is not signed by
|
||||
%% Oldintermediate2Cert (trusted CA cert).
|
||||
%% @end
|
||||
t_fail_success_with_old_and_renewed_intermediate_cacert_bundle_and_client_using_all_CAcerts(Config) ->
|
||||
t_conn_fail_with_old_and_renewed_intermediate_cacert_bundle_and_client_using_all_CAcerts(Config) ->
|
||||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2_renewed_old-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")},
|
||||
{partial_chain, two_cacerts_from_cacertfile}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -333,11 +340,12 @@ t_conn_fail_with_renewed_intermediate_cacert_other_client(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1_renewed.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -357,11 +365,12 @@ t_conn_fail_with_intermediate_cacert_bundle_but_incorrect_order(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1-server1-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -381,11 +390,12 @@ t_conn_fail_when_singed_by_other_intermediate_ca(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -405,11 +415,12 @@ t_conn_success_with_complete_chain_that_server_root_cacert_and_client_complete_c
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "root.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -429,11 +440,12 @@ t_conn_fail_with_other_client_complete_cert_chain(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -453,11 +465,12 @@ t_conn_fail_with_server_intermediate_and_other_client_complete_cert_chain(Config
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1-root-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -477,11 +490,12 @@ t_conn_success_with_server_intermediate_cacert_and_client_complete_chain(Config)
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -501,11 +515,12 @@ t_conn_fail_with_server_intermediate_chain_and_client_other_incomplete_cert_chai
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -525,11 +540,12 @@ t_conn_fail_with_server_intermediate_and_other_client_root_chain(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -549,11 +565,12 @@ t_conn_success_with_server_intermediate_and_client_root_chain(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate2.pem")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -574,11 +591,12 @@ t_conn_success_with_server_all_CA_bundle_and_client_root_chain(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "all-CAcerts-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -598,11 +616,12 @@ t_conn_fail_with_server_two_IA_bundle_and_client_root_chain(Config) ->
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "two-intermediates-bundle.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -622,12 +641,13 @@ t_conn_fail_with_server_partial_chain_false_intermediate_cacert_and_client_cert(
|
|||
Port = emqx_test_tls_certs_helper:select_free_port(ssl),
|
||||
DataDir = ?config(data_dir, Config),
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "intermediate1.pem")},
|
||||
{certfile, filename:join(DataDir, "server1.pem")},
|
||||
{keyfile, filename:join(DataDir, "server1.key")},
|
||||
{partial_chain, false}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
emqx_start_listener(?FUNCTION_NAME, ssl, Port, Options),
|
||||
|
|
@ -648,11 +668,12 @@ t_error_handling_invalid_cacertfile(Config) ->
|
|||
DataDir = ?config(data_dir, Config),
|
||||
%% trigger error
|
||||
Options = [
|
||||
{ssl_options, [
|
||||
{ssl_options,
|
||||
?config(ssl_config, Config) ++
|
||||
[
|
||||
{cacertfile, filename:join(DataDir, "server2.key")},
|
||||
{certfile, filename:join(DataDir, "server2.pem")},
|
||||
{keyfile, filename:join(DataDir, "server2.key")}
|
||||
| ?config(ssl_config, Config)
|
||||
]}
|
||||
],
|
||||
?assertException(
|
||||
|
|
|
|||
Loading…
Reference in New Issue