From: Juan Pablo Mora Date: Thu, 6 Aug 2026 15:07:56 +0000 (+0200) Subject: REGTESTS: ssl: add ssl_c_policies test X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9bfd816639ad90be6c204f7d21b9fc3af6da24ed;p=thirdparty%2Fhaproxy.git REGTESTS: ssl: add ssl_c_policies test Add a VTC covering both modes of ssl_c_policies(): the full list of Certificate Policies OIDs, and the "-m found" single-OID check (both a present and an absent OID). reg-tests/ssl/certs/client1.pem (used by the other ssl_c_* sample tests) is an X509v1 certificate and carries no extensions at all, so it cannot be reused here. A dedicated, disposable CA and client certificate (ca_policies.crt / client_policies.pem) were generated for this test only, with a Certificate Policies extension containing 0.4.0.1862.1.4 and a filler OID. No personal or production data is involved, only generic placeholder subject fields consistent with the other certs in this directory. Verified locally with vtest (VTest2, "last" tag), alongside ssl_client_samples.vtc and ssl_client_auth.vtc to confirm no regressions. checkpatch.pl clean (only the generic, inapplicable "does MAINTAINERS need updating?" notice, since there is no SSL maintainer entry). --- diff --git a/reg-tests/ssl/certs/ca_policies.crt b/reg-tests/ssl/certs/ca_policies.crt new file mode 100644 index 000000000..393f47f4c --- /dev/null +++ b/reg-tests/ssl/certs/ca_policies.crt @@ -0,0 +1,22 @@ +-----BEGIN CERTIFICATE----- +MIIDlTCCAn2gAwIBAgIUW4gbCnEmFLzc61v5RFetOH6ARpQwDQYJKoZIhvcNAQEL +BQAwUjELMAkGA1UEBhMCRVMxIjAgBgNVBAoMGUhBUHJveHkgVGVjaG5vbG9naWVz +IFRlc3QxHzAdBgNVBAMMFnNzbF9jX3BvbGljaWVzIHRlc3QgQ0EwHhcNMjYwODA2 +MTQwOTI2WhcNNDYwODAxMTQwOTI2WjBSMQswCQYDVQQGEwJFUzEiMCAGA1UECgwZ +SEFQcm94eSBUZWNobm9sb2dpZXMgVGVzdDEfMB0GA1UEAwwWc3NsX2NfcG9saWNp +ZXMgdGVzdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANxt23In +UaMt1UjvU/nyDK4Fs5mcR3tBdjHdTG3IjPmfcYnQfvoq+3JhLOrddriAo1i1TKY2 +dAJF5d50KKZfJXhZB+vGRZj+BJ/HOI2MDsznj8zEYr7l83257FjBSDguuod0Zl3t +b5GXVodU/N8EjvYb46cF2nRNK2D11Juh//aIYlkjejyFc+VDKdEDWkfMKzqouTWU +k7eaYQRLoehG1+AtRb6Q9xHXB0gLKcjZt89i9CQmPt4SOKHnBEIytiSA+w/iFeZ+ +e4ojaJTyXv+u2xk2S/E6rm4rxiiPhreuxC8Amy/s5Cn9kWgoBjPvvgW4KWyTjhKI +ug7aU+0AmPZcULECAwEAAaNjMGEwHQYDVR0OBBYEFCmKJjwF8SpB7kBwa/cYBhE/ +4PPNMB8GA1UdIwQYMBaAFCmKJjwF8SpB7kBwa/cYBhE/4PPNMA8GA1UdEwEB/wQF +MAMBAf8wDgYDVR0PAQH/BAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQBbo7/6wpGd +YiHai/pzTviEWk7FsiM5C4rKxq643aHQkc+alGZj1lUTp8v3ajeqegvv6xMb4OHP +k3hxy7TqIccwPb5SbkOdgJQlP/Pk0vuDzUz5xPRADs6EKaYOIgnXWTSl09hrd+DM +LoMXpdnKA47FUsYG+ChzbI+JoEo0PgYtJEMHzHHU515A2XtX/gfVgwsKB+5SZKuA +Pim45S13iDALonry6i6vqqcMoe40p/ipPnK+dO42nDccsado+bydfKcDY1HYNwGd +t7RItASsTFw4RFgjLnPSu2Z27uMzkGEFw91esau6EVB5uONHhr5RFA9HopWNYdNn +2gqn6ajSXGUv +-----END CERTIFICATE----- diff --git a/reg-tests/ssl/certs/client_policies.pem b/reg-tests/ssl/certs/client_policies.pem new file mode 100644 index 000000000..8f07a4d10 --- /dev/null +++ b/reg-tests/ssl/certs/client_policies.pem @@ -0,0 +1,51 @@ +-----BEGIN CERTIFICATE----- +MIIDyjCCArKgAwIBAgIUZ2FYHdVGLXz7+B+9BMXaNRWfJs4wDQYJKoZIhvcNAQEL +BQAwUjELMAkGA1UEBhMCRVMxIjAgBgNVBAoMGUhBUHJveHkgVGVjaG5vbG9naWVz +IFRlc3QxHzAdBgNVBAMMFnNzbF9jX3BvbGljaWVzIHRlc3QgQ0EwHhcNMjYwODA2 +MTQwOTI2WhcNNDYwODAxMTQwOTI2WjBRMQswCQYDVQQGEwJFUzEiMCAGA1UECgwZ +SEFQcm94eSBUZWNobm9sb2dpZXMgVGVzdDEeMBwGA1UEAwwVc3NsX2NfcG9saWNp +ZXMgY2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAojSK3Aln +ADeGldfu1e/YMMdF/XDwltI/4UF0xLj3LAbIPaoCGCxKY2cavPphedeRTNDCJ+XZ +s56Mc7PXnDzcxz4r0tu3ATTf4fYZxb/cdKmYDuBwLAi9dl9ppGWZT4lItE56cms9 +0p9dVJrGB3LRQCnndiQFK9WwOARRswK+7VXyagZ6igr+GUcaesaplRH89mxuICqi +7vXh9VS1r2tCtHVoi8mkW2deT6bH2qDN1xRdNvhsPFff/teOnxfbPWN6wqvqBS0l +G/bbYywdDO7Co7Gw2fWf2RXvIkdxoo9M43xLwPdmY2ZsvUjJ6VYTj3fwFLeeA1sY ++1EUJDrt7l3XawIDAQABo4GYMIGVMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQD +AgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMCAGA1UdIAQZMBcwCAYGBACORgEEMAsG +CSoDBAUGBwgJATAdBgNVHQ4EFgQUIQZjiUdo2xDWTuJ9XkmvvZkhxP0wHwYDVR0j +BBgwFoAUKYomPAXxKkHuQHBr9xgGET/g880wDQYJKoZIhvcNAQELBQADggEBAInY +jNV00/NJ9B5SXCGOtCWEB/Gf4etEh6C1geinpwYWUf277rggFICq5b60oL+Of96V +ei6p7QxhIgGVMbYWBOQVauuccZh7rIxFQ5dQCpfexuZrgtqXXsJQilyED9X2rlKN +OA/dyhlFfeHagwxy8gcBpWb1eS4/bfohkPRAUtiQy8bJKLy02PibFV9fxQoCvhMb +DEbCZaafDMaZUn4Tj2B9W6PHxt/tyiFWv+aX35l8nh3Y7XzpIDhKfgyK1FaFL856 +e8B+UBlyBdmvs7aaZL37+oY3SII31CZYcZA17e0kKlN87mF50yd0hIZ7D8jH2Pxx +AF1lQkJ0KwhTawRjoR0= +-----END CERTIFICATE----- +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCiNIrcCWcAN4aV +1+7V79gwx0X9cPCW0j/hQXTEuPcsBsg9qgIYLEpjZxq8+mF515FM0MIn5dmznoxz +s9ecPNzHPivS27cBNN/h9hnFv9x0qZgO4HAsCL12X2mkZZlPiUi0Tnpyaz3Sn11U +msYHctFAKed2JAUr1bA4BFGzAr7tVfJqBnqKCv4ZRxp6xqmVEfz2bG4gKqLu9eH1 +VLWva0K0dWiLyaRbZ15PpsfaoM3XFF02+Gw8V9/+146fF9s9Y3rCq+oFLSUb9ttj +LB0M7sKjsbDZ9Z/ZFe8iR3Gij0zjfEvA92ZjZmy9SMnpVhOPd/AUt54DWxj7URQk +Ou3uXddrAgMBAAECggEAQ3hglENS9VujX1vpDFNOVYfmXJQod0vwZ2W/SP75TXZq +v3+ijGSL8soV7KqndjONTGr/f/ITeqwGFzClDGeinDwHpZdgCZ/xSoAAW2nBrUNI +LVP9RMvD52OrwUbDnTppJBsKwuJJ3n0MqN8SZVHEqZBkp5c3EXM68CoXw8LuITE3 +DoKI5ncfZ5fyQ1MET52R09C5yD8580MeW2PQIPTeGAlS/3imdSy5D4OE6j8hEW3S +4rIGaGI73AmhbL8eSFhfmb2SyB2hO3qE3BAbAjWuwemFQFI15Vb9k7KA493aPNms +B6jQvtU4o/1B0CwMeNNEwZha5uoHEp8QKuZ5Qg85iQKBgQDh28V2zLcZFt5E9c2z +FqniI/1To0EPPFitJjN1DJZbRJR+gxIUpPYyvYHtztRpl/OnuCX0JsQYvDqFYC2o +gAhptKE7FQv58g69hdfkB/n2nLADgYCbOSSTWuvtx5sGD5IuvZ+Te57ADor8Ekv/ +JY7SnvL8HlIMlocaQFA6nH9GiQKBgQC32h87VWOnV5mpzDMeiji0cZl2/QNmZqL1 +AxjvystozoB3AdKfMfaZJ848VBkthoEPpJfU24y5ORYi8yJ/CUPyYOQfy7jSxC/j +UP33g9lCL+uEj/xX39p+FPQbSgIo/IMZ6mgz0pIsynuoFaseKtWjO/6PX5KnLqA1 +HnB9pVvxUwKBgAzmP2XklUSCkNlBbKkgzz0SLyK6vTmAidQBzYiO2nuF9DExjTPO +pB0Lw8LwQCNzwT+//bLvD94VygXaE2F/Rnu7DEZSkmeJEpxya30jk3wpQMhCejTj +U5py4+ylrM3wz7mJrPaAZfW0Hu38oYiF/Z075MbPeIItirPOHobqbz55AoGAQBqy +1xpf4+JcduL3VAe329rcOqvfup3A5hNNZ5bbM9EE4/njuZRPOnmxpEFigggrCgxG +0HY47ABmoosKFSdi5Kk6AYgkCoFTfTwpQVtcroJM6WzW/MDVyy59KuK0PBxHjgq4 +iJE8XJfBZAsiHiOrV/48NTuKw/Yy8DKL4JN+qncCgYEA0t+8NcBlFskdwz2q3P+U +eowiam3cmMSwJNUsNU8H7GX0OXEWs5aOQhHm8Rqc/vaotCnLd6Kfat+34CkGqUe7 +64g6r5nqKGHwl0TFJpGevPHrcDfSkqR0JSvQI8HeMRG1LJZRSmv36Fs49M4HFwS/ +Zjya5Lqz/1OaO8jWWl4pnlU= +-----END PRIVATE KEY----- diff --git a/reg-tests/ssl/ssl_client_policies.vtc b/reg-tests/ssl/ssl_client_policies.vtc new file mode 100644 index 000000000..d913f28cf --- /dev/null +++ b/reg-tests/ssl/ssl_client_policies.vtc @@ -0,0 +1,8 @@ +#REGTEST_TYPE=devel + +varnishtest "Test the ssl_c_policies sample fetch" +feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(3.5-dev4)'" +feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && openssl_version_atleast(1.1.1) && !ssllib_name_startswith(wolfSSL)'" + +setenv VTC_SOCK_TYPE stream +include ${testdir}/ssl_client_policies.vtci diff --git a/reg-tests/ssl/ssl_client_policies.vtci b/reg-tests/ssl/ssl_client_policies.vtci new file mode 100644 index 000000000..246be2342 --- /dev/null +++ b/reg-tests/ssl/ssl_client_policies.vtci @@ -0,0 +1,67 @@ +#REGTEST_TYPE=devel + +varnishtest "Test the ssl_c_policies sample fetch" +feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(3.5-dev4)'" +feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && openssl_version_atleast(1.1.1) && !ssllib_name_startswith(wolfSSL)'" +feature ignore_unknown_macro + +server s1 -repeat 3 { + rxreq + txresp +} -start + +haproxy h1 -conf { + global + .if streq("$VTC_SOCK_TYPE",quic) + # required for backend connections + expose-experimental-directives + .endif + .if feature(THREAD) + thread-groups 1 + .endif + + .if !ssllib_name_startswith(AWS-LC) + tune.ssl.default-dh-param 2048 + .endif + tune.ssl.capture-buffer-size 1 + crt-base ${testdir} + + defaults + mode http + option httplog + log stderr local0 debug err + option logasap + timeout connect "${HAPROXY_TEST_TIMEOUT-5s}" + timeout client "${HAPROXY_TEST_TIMEOUT-5s}" + timeout server "${HAPROXY_TEST_TIMEOUT-5s}" + + + listen clear-lst + bind "fd@${clearlst}" + balance roundrobin + server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none crt ${testdir}/certs/client_policies.pem + + listen ssl-lst + mode http + + acl policy_present ssl_c_policies(0.4.0.1862.1.4) -m found + acl policy_absent ssl_c_policies(1.2.3.4.5.6.7.8.9.99) -m found + + http-response add-header x-ssl-policies %[ssl_c_policies] + http-response set-header x-ssl-policy-present yes if policy_present + http-response set-header x-ssl-policy-absent yes if policy_absent + + bind "${VTC_SOCK_TYPE}+fd@${ssl}" ssl crt ${testdir}/certs/common.pem ca-file ${testdir}/certs/ca_policies.crt verify optional crt-ignore-err all + + server s1 ${s1_addr}:${s1_port} +} -start + + +client c1 -connect ${h1_clearlst_sock} { + txreq + rxresp + expect resp.status == 200 + expect resp.http.x-ssl-policies == "0.4.0.1862.1.4, 1.2.3.4.5.6.7.8.9.1" + expect resp.http.x-ssl-policy-present == "yes" + expect resp.http.x-ssl-policy-absent == "" +} -run