REGTESTS: ssl: add ssl_c_policies test

Add a VTC covering both modes of ssl_c_policies(): the full list of
Certificate Policies OIDs, and the "-m found" single-OID check (both
a present and an absent OID).

reg-tests/ssl/certs/client1.pem (used by the other ssl_c_* sample
tests) is an X509v1 certificate and carries no extensions at all, so
it cannot be reused here. A dedicated, disposable CA and client
certificate (ca_policies.crt / client_policies.pem) were generated
for this test only, with a Certificate Policies extension containing
0.4.0.1862.1.4 and a filler OID. No personal or production data is
involved, only generic placeholder subject fields consistent with
the other certs in this directory.

Verified locally with vtest (VTest2, "last" tag), alongside
ssl_client_samples.vtc and ssl_client_auth.vtc to confirm no
regressions. checkpatch.pl clean (only the generic, inapplicable
"does MAINTAINERS need updating?" notice, since there is no SSL
maintainer entry).

diff --git a/reg-tests/ssl/certs/ca_policies.crt b/reg-tests/ssl/certs/ca_policies.crt
new file mode 100644 (file)
index 0000000..393f47f
--- /dev/null
+++ b/reg-tests/ssl/certs/ca_policies.crt
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDlTCCAn2gAwIBAgIUW4gbCnEmFLzc61v5RFetOH6ARpQwDQYJKoZIhvcNAQEL
+BQAwUjELMAkGA1UEBhMCRVMxIjAgBgNVBAoMGUhBUHJveHkgVGVjaG5vbG9naWVz
+IFRlc3QxHzAdBgNVBAMMFnNzbF9jX3BvbGljaWVzIHRlc3QgQ0EwHhcNMjYwODA2
+MTQwOTI2WhcNNDYwODAxMTQwOTI2WjBSMQswCQYDVQQGEwJFUzEiMCAGA1UECgwZ
+SEFQcm94eSBUZWNobm9sb2dpZXMgVGVzdDEfMB0GA1UEAwwWc3NsX2NfcG9saWNp
+ZXMgdGVzdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANxt23In
+UaMt1UjvU/nyDK4Fs5mcR3tBdjHdTG3IjPmfcYnQfvoq+3JhLOrddriAo1i1TKY2
+dAJF5d50KKZfJXhZB+vGRZj+BJ/HOI2MDsznj8zEYr7l83257FjBSDguuod0Zl3t
+b5GXVodU/N8EjvYb46cF2nRNK2D11Juh//aIYlkjejyFc+VDKdEDWkfMKzqouTWU
+k7eaYQRLoehG1+AtRb6Q9xHXB0gLKcjZt89i9CQmPt4SOKHnBEIytiSA+w/iFeZ+
+e4ojaJTyXv+u2xk2S/E6rm4rxiiPhreuxC8Amy/s5Cn9kWgoBjPvvgW4KWyTjhKI
+ug7aU+0AmPZcULECAwEAAaNjMGEwHQYDVR0OBBYEFCmKJjwF8SpB7kBwa/cYBhE/
+4PPNMB8GA1UdIwQYMBaAFCmKJjwF8SpB7kBwa/cYBhE/4PPNMA8GA1UdEwEB/wQF
+MAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQBbo7/6wpGd
+YiHai/pzTviEWk7FsiM5C4rKxq643aHQkc+alGZj1lUTp8v3ajeqegvv6xMb4OHP
+k3hxy7TqIccwPb5SbkOdgJQlP/Pk0vuDzUz5xPRADs6EKaYOIgnXWTSl09hrd+DM
+LoMXpdnKA47FUsYG+ChzbI+JoEo0PgYtJEMHzHHU515A2XtX/gfVgwsKB+5SZKuA
+Pim45S13iDALonry6i6vqqcMoe40p/ipPnK+dO42nDccsado+bydfKcDY1HYNwGd
+t7RItASsTFw4RFgjLnPSu2Z27uMzkGEFw91esau6EVB5uONHhr5RFA9HopWNYdNn
+2gqn6ajSXGUv
+-----END CERTIFICATE-----

diff --git a/reg-tests/ssl/certs/client_policies.pem b/reg-tests/ssl/certs/client_policies.pem
new file mode 100644 (file)
index 0000000..8f07a4d
--- /dev/null
+++ b/reg-tests/ssl/certs/client_policies.pem
@@ -0,0 +1,51 @@
+-----BEGIN CERTIFICATE-----
+MIIDyjCCArKgAwIBAgIUZ2FYHdVGLXz7+B+9BMXaNRWfJs4wDQYJKoZIhvcNAQEL
+BQAwUjELMAkGA1UEBhMCRVMxIjAgBgNVBAoMGUhBUHJveHkgVGVjaG5vbG9naWVz
+IFRlc3QxHzAdBgNVBAMMFnNzbF9jX3BvbGljaWVzIHRlc3QgQ0EwHhcNMjYwODA2
+MTQwOTI2WhcNNDYwODAxMTQwOTI2WjBRMQswCQYDVQQGEwJFUzEiMCAGA1UECgwZ
+SEFQcm94eSBUZWNobm9sb2dpZXMgVGVzdDEeMBwGA1UEAwwVc3NsX2NfcG9saWNp
+ZXMgY2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAojSK3Aln
+ADeGldfu1e/YMMdF/XDwltI/4UF0xLj3LAbIPaoCGCxKY2cavPphedeRTNDCJ+XZ
+s56Mc7PXnDzcxz4r0tu3ATTf4fYZxb/cdKmYDuBwLAi9dl9ppGWZT4lItE56cms9
+0p9dVJrGB3LRQCnndiQFK9WwOARRswK+7VXyagZ6igr+GUcaesaplRH89mxuICqi
+7vXh9VS1r2tCtHVoi8mkW2deT6bH2qDN1xRdNvhsPFff/teOnxfbPWN6wqvqBS0l
+G/bbYywdDO7Co7Gw2fWf2RXvIkdxoo9M43xLwPdmY2ZsvUjJ6VYTj3fwFLeeA1sY
++1EUJDrt7l3XawIDAQABo4GYMIGVMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQD
+AgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMCAGA1UdIAQZMBcwCAYGBACORgEEMAsG
+CSoDBAUGBwgJATAdBgNVHQ4EFgQUIQZjiUdo2xDWTuJ9XkmvvZkhxP0wHwYDVR0j
+BBgwFoAUKYomPAXxKkHuQHBr9xgGET/g880wDQYJKoZIhvcNAQELBQADggEBAInY
+jNV00/NJ9B5SXCGOtCWEB/Gf4etEh6C1geinpwYWUf277rggFICq5b60oL+Of96V
+ei6p7QxhIgGVMbYWBOQVauuccZh7rIxFQ5dQCpfexuZrgtqXXsJQilyED9X2rlKN
+OA/dyhlFfeHagwxy8gcBpWb1eS4/bfohkPRAUtiQy8bJKLy02PibFV9fxQoCvhMb
+DEbCZaafDMaZUn4Tj2B9W6PHxt/tyiFWv+aX35l8nh3Y7XzpIDhKfgyK1FaFL856
+e8B+UBlyBdmvs7aaZL37+oY3SII31CZYcZA17e0kKlN87mF50yd0hIZ7D8jH2Pxx
+AF1lQkJ0KwhTawRjoR0=
+-----END CERTIFICATE-----
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCiNIrcCWcAN4aV
+1+7V79gwx0X9cPCW0j/hQXTEuPcsBsg9qgIYLEpjZxq8+mF515FM0MIn5dmznoxz
+s9ecPNzHPivS27cBNN/h9hnFv9x0qZgO4HAsCL12X2mkZZlPiUi0Tnpyaz3Sn11U
+msYHctFAKed2JAUr1bA4BFGzAr7tVfJqBnqKCv4ZRxp6xqmVEfz2bG4gKqLu9eH1
+VLWva0K0dWiLyaRbZ15PpsfaoM3XFF02+Gw8V9/+146fF9s9Y3rCq+oFLSUb9ttj
+LB0M7sKjsbDZ9Z/ZFe8iR3Gij0zjfEvA92ZjZmy9SMnpVhOPd/AUt54DWxj7URQk
+Ou3uXddrAgMBAAECggEAQ3hglENS9VujX1vpDFNOVYfmXJQod0vwZ2W/SP75TXZq
+v3+ijGSL8soV7KqndjONTGr/f/ITeqwGFzClDGeinDwHpZdgCZ/xSoAAW2nBrUNI
+LVP9RMvD52OrwUbDnTppJBsKwuJJ3n0MqN8SZVHEqZBkp5c3EXM68CoXw8LuITE3
+DoKI5ncfZ5fyQ1MET52R09C5yD8580MeW2PQIPTeGAlS/3imdSy5D4OE6j8hEW3S
+4rIGaGI73AmhbL8eSFhfmb2SyB2hO3qE3BAbAjWuwemFQFI15Vb9k7KA493aPNms
+B6jQvtU4o/1B0CwMeNNEwZha5uoHEp8QKuZ5Qg85iQKBgQDh28V2zLcZFt5E9c2z
+FqniI/1To0EPPFitJjN1DJZbRJR+gxIUpPYyvYHtztRpl/OnuCX0JsQYvDqFYC2o
+gAhptKE7FQv58g69hdfkB/n2nLADgYCbOSSTWuvtx5sGD5IuvZ+Te57ADor8Ekv/
+JY7SnvL8HlIMlocaQFA6nH9GiQKBgQC32h87VWOnV5mpzDMeiji0cZl2/QNmZqL1
+AxjvystozoB3AdKfMfaZJ848VBkthoEPpJfU24y5ORYi8yJ/CUPyYOQfy7jSxC/j
+UP33g9lCL+uEj/xX39p+FPQbSgIo/IMZ6mgz0pIsynuoFaseKtWjO/6PX5KnLqA1
+HnB9pVvxUwKBgAzmP2XklUSCkNlBbKkgzz0SLyK6vTmAidQBzYiO2nuF9DExjTPO
+pB0Lw8LwQCNzwT+//bLvD94VygXaE2F/Rnu7DEZSkmeJEpxya30jk3wpQMhCejTj
+U5py4+ylrM3wz7mJrPaAZfW0Hu38oYiF/Z075MbPeIItirPOHobqbz55AoGAQBqy
+1xpf4+JcduL3VAe329rcOqvfup3A5hNNZ5bbM9EE4/njuZRPOnmxpEFigggrCgxG
+0HY47ABmoosKFSdi5Kk6AYgkCoFTfTwpQVtcroJM6WzW/MDVyy59KuK0PBxHjgq4
+iJE8XJfBZAsiHiOrV/48NTuKw/Yy8DKL4JN+qncCgYEA0t+8NcBlFskdwz2q3P+U
+eowiam3cmMSwJNUsNU8H7GX0OXEWs5aOQhHm8Rqc/vaotCnLd6Kfat+34CkGqUe7
+64g6r5nqKGHwl0TFJpGevPHrcDfSkqR0JSvQI8HeMRG1LJZRSmv36Fs49M4HFwS/
+Zjya5Lqz/1OaO8jWWl4pnlU=
+-----END PRIVATE KEY-----

diff --git a/reg-tests/ssl/ssl_client_policies.vtc b/reg-tests/ssl/ssl_client_policies.vtc
new file mode 100644 (file)
index 0000000..d913f28
--- /dev/null
+++ b/reg-tests/ssl/ssl_client_policies.vtc
@@ -0,0 +1,8 @@
+#REGTEST_TYPE=devel
+
+varnishtest "Test the ssl_c_policies sample fetch"
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(3.5-dev4)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && openssl_version_atleast(1.1.1) && !ssllib_name_startswith(wolfSSL)'"
+
+setenv VTC_SOCK_TYPE stream
+include ${testdir}/ssl_client_policies.vtci

diff --git a/reg-tests/ssl/ssl_client_policies.vtci b/reg-tests/ssl/ssl_client_policies.vtci
new file mode 100644 (file)
index 0000000..246be23
--- /dev/null
+++ b/reg-tests/ssl/ssl_client_policies.vtci
@@ -0,0 +1,67 @@
+#REGTEST_TYPE=devel
+
+varnishtest "Test the ssl_c_policies sample fetch"
+feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(3.5-dev4)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && openssl_version_atleast(1.1.1) && !ssllib_name_startswith(wolfSSL)'"
+feature ignore_unknown_macro
+
+server s1 -repeat 3 {
+    rxreq
+    txresp
+} -start
+
+haproxy h1 -conf {
+    global
+    .if streq("$VTC_SOCK_TYPE",quic)
+        # required for backend connections
+        expose-experimental-directives
+    .endif
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+
+    .if !ssllib_name_startswith(AWS-LC)
+        tune.ssl.default-dh-param 2048
+    .endif
+        tune.ssl.capture-buffer-size 1
+        crt-base ${testdir}
+
+    defaults
+        mode http
+        option httplog
+        log stderr local0 debug err
+        option logasap
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+
+    listen clear-lst
+        bind "fd@${clearlst}"
+        balance roundrobin
+        server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none crt ${testdir}/certs/client_policies.pem
+
+    listen ssl-lst
+        mode http
+
+        acl policy_present ssl_c_policies(0.4.0.1862.1.4) -m found
+        acl policy_absent  ssl_c_policies(1.2.3.4.5.6.7.8.9.99) -m found
+
+        http-response add-header x-ssl-policies %[ssl_c_policies]
+        http-response set-header x-ssl-policy-present yes if policy_present
+        http-response set-header x-ssl-policy-absent  yes if policy_absent
+
+        bind "${VTC_SOCK_TYPE}+fd@${ssl}" ssl crt ${testdir}/certs/common.pem ca-file ${testdir}/certs/ca_policies.crt verify optional crt-ignore-err all
+
+        server s1 ${s1_addr}:${s1_port}
+} -start
+
+
+client c1 -connect ${h1_clearlst_sock} {
+    txreq
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-ssl-policies == "0.4.0.1862.1.4, 1.2.3.4.5.6.7.8.9.1"
+    expect resp.http.x-ssl-policy-present == "yes"
+    expect resp.http.x-ssl-policy-absent == "<undef>"
+} -run