diff --git a/CHANGELOG.md b/CHANGELOG.md index 433a0e2df..92b76e7bf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -23,6 +23,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/). - Use new cpu.requests formula from Kubernetes. [PR #1595](https://github.com/3scale/APIcast/pull/1595) [THREESCALE-15465](https://redhat.atlassian.net/browse/THREESCALE-15465) - Fix batcher policy fails silently when configured with string values instead of integers. [PR #1597](https://github.com/3scale/APIcast/pull/1597) [THREESCALE-15547](https://redhat.atlassian.net/browse/THREESCALE-15547) - Unify timeout options between http clients library [PR #1600](https://github.com/3scale/APIcast/pull/1600) +- Certificate is never verified in API request for https backend via proxy [PR #1573](https://github.com/3scale/APIcast/pull/1568) [THREESCALE-11944](https://redhat.atlassian.net/browse/THREESCALE-11944) ### Added - Update APIcast schema manifest [PR #1550](https://github.com/3scale/APIcast/pull/1550) diff --git a/gateway/src/apicast/http_proxy.lua b/gateway/src/apicast/http_proxy.lua index 51bd617f8..c1fe63ee5 100644 --- a/gateway/src/apicast/http_proxy.lua +++ b/gateway/src/apicast/http_proxy.lua @@ -150,7 +150,8 @@ local function forward_https_request(proxy_uri, uri, proxy_opts) body = body, proxy_uri = proxy_uri, timeout = opts.upstream_connection_opts, -- Extract timeouts to top level - proxy_options = opts + options = opts.options, + proxy_options = opts, } local httpc, err = http_proxy.new(request) @@ -238,7 +239,7 @@ function _M.request(upstream, proxy_uri) skip_https_connect = upstream.skip_https_connect, request_unbuffered = upstream.request_unbuffered, upstream_connection_opts = upstream.upstream_connection_opts, - upstream_ssl = upstream.upstream_ssl + options = upstream.options } forward_https_request(proxy_uri, uri, proxy_opts) diff --git a/gateway/src/apicast/upstream.lua b/gateway/src/apicast/upstream.lua index ef2097dc9..b76c196b4 100644 --- a/gateway/src/apicast/upstream.lua +++ b/gateway/src/apicast/upstream.lua @@ -233,10 +233,12 @@ function _M:call(context) self.request_unbuffered = context.request_unbuffered self.upstream_connection_opts = context.upstream_connection_opts - self.upstream_ssl = { - ssl_verify = context.upstream_verify, - ssl_client_cert = context.upstream_certificate, - ssl_client_priv_key = context.upstream_key + self.options = { + ssl = { + verify = context.upstream_verify, + client_cert = context.upstream_certificate, + client_priv_key = context.upstream_key + } } http_proxy.request(self, proxy_uri) else diff --git a/gateway/src/resty/http/proxy.lua b/gateway/src/resty/http/proxy.lua index d28ad6ec4..f33a27607 100644 --- a/gateway/src/resty/http/proxy.lua +++ b/gateway/src/resty/http/proxy.lua @@ -71,9 +71,9 @@ local function connect(request) if scheme == 'https' then options.ssl_server_name = host options.ssl_verify = ssl_verify - if proxy_options.upstream_ssl then - options.ssl_client_cert = proxy_options.upstream_ssl.ssl_client_cert - options.ssl_client_priv_key = proxy_options.upstream_ssl.ssl_client_priv_key + if request.options and request.options.ssl then + options.ssl_client_cert = request.options.ssl.client_cert + options.ssl_client_priv_key = request.options.ssl.client_priv_key end end @@ -116,7 +116,7 @@ local function connect(request) ngx.log(ngx.DEBUG, 'targeting server ', host, ':', port) - local ok, err = httpc:ssl_handshake(nil, host, request.ssl_verify) + local ok, err = httpc:ssl_handshake(nil, host, ssl_verify) if not ok then return nil, err end return httpc diff --git a/spec/resty/http/proxy_spec.lua b/spec/resty/http/proxy_spec.lua index 99ba647f6..b2352bd85 100644 --- a/spec/resty/http/proxy_spec.lua +++ b/spec/resty/http/proxy_spec.lua @@ -196,4 +196,121 @@ describe('resty.http.proxy', function() end) end) end) + + describe('options.ssl', function() + local http, httpc_mock, connect_spy + + local function create_httpc_mock() + return { + set_timeouts = function() end, + connect = function() return true end, + request = function() return { status = 200, read_body = function() return 'ok' end } end, + close = function() end, + set_keepalive = function() end, + pool = 'test', + get_reused_times = function() return 0 end, + host = 'example.com', + port = 443 + } + end + + before_each(function() + http = require('resty.resolver.http') + httpc_mock = create_httpc_mock() + connect_spy = spy.new(function() return true end) + httpc_mock.connect = connect_spy + stub(http, 'new', function() return httpc_mock end) + end) + + it('propagates options.ssl.verify to the connect ssl_verify option (used by http_ng)', function() + local request = { + url = 'https://upstream:8091/request', + method = 'GET', + options = { ssl = { verify = true } } + } + + assert(_M.new(request)) + + local connect_options = connect_spy.calls[1].vals[2] + assert.is_true(connect_options.ssl_verify) + end) + + it('propagates options.ssl.client_cert/client_priv_key set by the forward-proxy path', function() + local cert, key = 'cert-data', 'key-data' + local request = { + url = 'https://upstream:8091/request', + method = 'GET', + options = { ssl = { verify = true, client_cert = cert, client_priv_key = key } } + } + + assert(_M.new(request)) + + local connect_options = connect_spy.calls[1].vals[2] + assert.same(cert, connect_options.ssl_client_cert) + assert.same(key, connect_options.ssl_client_priv_key) + end) + + it('defaults ssl_verify to false when options.ssl is not set', function() + local request = { url = 'https://upstream:8091/request', method = 'GET' } + + assert(_M.new(request)) + + local connect_options = connect_spy.calls[1].vals[2] + assert.is_false(connect_options.ssl_verify) + end) + end) + + describe('skip_https_connect', function() + local http, httpc_mock, ssl_handshake_spy + + local function create_httpc_mock() + return { + set_timeouts = function() end, + connect = function() return true end, + ssl_handshake = function() return true end, + request = function() return { status = 200, read_body = function() return 'ok' end } end, + close = function() end, + set_keepalive = function() end, + pool = 'test', + get_reused_times = function() return 0 end, + host = 'example.com', + port = 443 + } + end + + before_each(function() + http = require('resty.resolver.http') + httpc_mock = create_httpc_mock() + ssl_handshake_spy = spy.new(function() return true end) + httpc_mock.ssl_handshake = ssl_handshake_spy + stub(http, 'new', function() return httpc_mock end) + end) + + it('passes options.ssl.verify to ssl_handshake, not the unset request.ssl_verify', function() + local request = { + url = 'https://upstream:8091/request', + method = 'GET', + proxy_uri = { scheme = 'http', host = 'proxy', port = 8080 }, + proxy_options = { skip_https_connect = true }, + options = { ssl = { verify = true } } + } + + assert(_M.new(request)) + + assert.spy(ssl_handshake_spy).was_called_with(match.is_table(), nil, 'upstream', true) + end) + + it('defaults ssl_verify to false in ssl_handshake when options.ssl is not set', function() + local request = { + url = 'https://upstream:8091/request', + method = 'GET', + proxy_uri = { scheme = 'http', host = 'proxy', port = 8080 }, + proxy_options = { skip_https_connect = true } + } + + assert(_M.new(request)) + + assert.spy(ssl_handshake_spy).was_called_with(match.is_table(), nil, 'upstream', false) + end) + end) end) diff --git a/t/apicast-policy-http-proxy.t b/t/apicast-policy-http-proxy.t index 9406ce7e1..4da26d855 100644 --- a/t/apicast-policy-http-proxy.t +++ b/t/apicast-policy-http-proxy.t @@ -1,8 +1,34 @@ use lib 't'; use Test::APIcast::Blackbox 'no_plan'; +use File::Slurp qw(read_file); + require("http_proxy.pl"); +sub string_to_json { + # Copied from here + # https://github.com/makamaka/JSON/blob/master/lib/JSON/backportPP.pm#L528 + my $escape_slash = 16; + my %esc = ( + "\n" => '\n', + "\r" => '\r', + "\t" => '\t', + "\f" => '\f', + "\b" => '\b', + "\"" => '\"', + "\\" => '\\\\', + "\'" => '\\\'', + ); + my $arg = $_[0]; + $arg =~ s/([\x22\x5c\n\r\t\f\b])/$esc{$1}/g; + $arg =~ s/\//\\\//g if ($escape_slash); + $arg =~ s/([\x00-\x08\x0b\x0e-\x1f])/'\\u00' . unpack('H2', $1)/eg; + return $arg; +} + +my $cert = read_file('t/fixtures/server-lvh.crt'); +$Test::Nginx::Util::UPSTREAM_CA_CERT = string_to_json($cert); + sub large_body { my $res = ""; for (my $i=0; $i <= 1024; $i++) { @@ -15,6 +41,38 @@ sub large_body { $ENV{'LARGE_BODY'} = large_body(); require("policies.pl"); +sub backend_authrep_ok { + my ($server_name) = @_; + my $prefix = $server_name ? "server_name $server_name;\n" : ''; + return $prefix . <<'END'; +location /transactions/authrep.xml { + content_by_lua_block { + ngx.exit(ngx.OK) + } +} +END +} + +sub ssl_listen_and_certs { + return <<"END"; +listen $ENV{TEST_NGINX_RANDOM_PORT} ssl; +ssl_certificate $ENV{TEST_NGINX_SERVER_ROOT}/html/server.crt; +ssl_certificate_key $ENV{TEST_NGINX_SERVER_ROOT}/html/server.key; +END +} + +sub ssl_backend_authrep_ok { + my ($server_name) = @_; + $server_name ||= 'test-backend.lvh.me'; + return backend_authrep_ok($server_name) . ssl_listen_and_certs(); +} + +sub ssl_upstream_header { + my ($server_name) = @_; + $server_name ||= 'test-upstream.lvh.me'; + return "server_name $server_name;\n" . ssl_listen_and_certs(); +} + repeat_each(3); run_tests(); @@ -161,22 +219,13 @@ using proxy: $TEST_NGINX_HTTP_PROXY } ] } ---- backend - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } ---- upstream env -server_name test-upstream.lvh.me; -listen $TEST_NGINX_RANDOM_PORT ssl; - -ssl_certificate $TEST_NGINX_SERVER_ROOT/html/server.crt; -ssl_certificate_key $TEST_NGINX_SERVER_ROOT/html/server.key; - +--- backend eval +::main::backend_authrep_ok() +--- upstream env eval +::main::ssl_upstream_header() . <<"END" location /test { - echo_foreach_split '\r\n' $echo_client_request_headers; - echo $echo_it; + echo_foreach_split '\r\n' \$echo_client_request_headers; + echo \$echo_it; echo_end; access_by_lua_block { @@ -191,6 +240,7 @@ location /test { assert.equals(result, "test-upstream.lvh.me:") } } +END --- request GET /test?user_key=test3 --- more_headers @@ -242,12 +292,8 @@ using proxy: $TEST_NGINX_HTTPS_PROXY } ] } ---- backend - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } +--- backend eval +::main::backend_authrep_ok() --- upstream server_name test-upstream.lvh.me; location / { @@ -290,12 +336,8 @@ proxy http request - got header line: Proxy-Authorization: Basic Zm9vOmJhcg== } ] } ---- backend - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } +--- backend eval +::main::backend_authrep_ok() --- upstream server_name test-upstream.lvh.me; location / { @@ -338,19 +380,10 @@ using proxy: http://foo:bar@127.0.0.1:$TEST_NGINX_HTTP_PROXY_PORT } ] } ---- backend - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } ---- upstream env -server_name test-upstream.lvh.me; -listen $TEST_NGINX_RANDOM_PORT ssl; - -ssl_certificate $TEST_NGINX_SERVER_ROOT/html/server.crt; -ssl_certificate_key $TEST_NGINX_SERVER_ROOT/html/server.key; - +--- backend eval +::main::backend_authrep_ok() +--- upstream eval +::main::ssl_upstream_header() . <<'END' location /test { echo_foreach_split '\r\n' $echo_client_request_headers; echo $echo_it; @@ -362,6 +395,7 @@ location /test { assert.falsy(proxy_auth) } } +END --- request GET /test?user_key=test3 --- error_code: 200 @@ -402,12 +436,8 @@ got header line: Proxy-Authorization: Basic Zm9vOmJhcg== } ] } ---- backend - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } +--- backend eval +::main::backend_authrep_ok() --- upstream server_name test-upstream.lvh.me; location / { @@ -538,19 +568,10 @@ using proxy: $TEST_NGINX_HTTP_PROXY } ] } ---- backend - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } ---- upstream env -server_name test-upstream.lvh.me; -listen $TEST_NGINX_RANDOM_PORT ssl; - -ssl_certificate $TEST_NGINX_SERVER_ROOT/html/server.crt; -ssl_certificate_key $TEST_NGINX_SERVER_ROOT/html/server.key; - +--- backend eval +::main::backend_authrep_ok() +--- upstream eval +::main::ssl_upstream_header() . <<'END' location / { access_by_lua_block { assert = require('luassert') @@ -562,6 +583,7 @@ location / { echo_read_request_body; echo $request_body; } +END --- more_headers Transfer-Encoding: chunked --- request eval @@ -677,12 +699,8 @@ a client request body is buffered to a temporary file } ] } ---- backend - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } +--- backend eval +::main::backend_authrep_ok() --- upstream server_name test-upstream.lvh.me; location / { @@ -756,13 +774,8 @@ a client request body is buffered to a temporary file } ] } ---- backend -server_name test_backend.lvh.me; - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } +--- backend eval +::main::backend_authrep_ok("test_backend.lvh.me") --- upstream server_name test-upstream.lvh.me; location /test { @@ -817,12 +830,8 @@ a client request body is buffered to a temporary file } ] } ---- backend - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } +--- backend eval +::main::backend_authrep_ok() --- upstream server_name test-upstream.lvh.me; location / { @@ -894,25 +903,15 @@ a client request body is buffered to a temporary file } ] } ---- backend env - server_name test-backend.lvh.me; - listen $TEST_NGINX_RANDOM_PORT ssl; - ssl_certificate $TEST_NGINX_SERVER_ROOT/html/server.crt; - ssl_certificate_key $TEST_NGINX_SERVER_ROOT/html/server.key; - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } ---- upstream env -server_name test-upstream.lvh.me; -listen $TEST_NGINX_RANDOM_PORT ssl; -ssl_certificate $TEST_NGINX_SERVER_ROOT/html/server.crt; -ssl_certificate_key $TEST_NGINX_SERVER_ROOT/html/server.key; +--- backend eval +::main::ssl_backend_authrep_ok() +--- upstream eval +::main::ssl_upstream_header() . <<'END' location /test { echo_read_request_body; echo_request_body; } +END --- request eval "POST /test?user_key= \n" . $ENV{LARGE_BODY} --- response_body eval chomp @@ -960,21 +959,10 @@ a client request body is buffered to a temporary file } ] } ---- backend env - server_name test-backend.lvh.me; - listen $TEST_NGINX_RANDOM_PORT ssl; - ssl_certificate $TEST_NGINX_SERVER_ROOT/html/server.crt; - ssl_certificate_key $TEST_NGINX_SERVER_ROOT/html/server.key; - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } ---- upstream env -server_name test-upstream.lvh.me; -listen $TEST_NGINX_RANDOM_PORT ssl; -ssl_certificate $TEST_NGINX_SERVER_ROOT/html/server.crt; -ssl_certificate_key $TEST_NGINX_SERVER_ROOT/html/server.key; +--- backend eval +::main::ssl_backend_authrep_ok() +--- upstream eval +::main::ssl_upstream_header() . <<'END' location /test { access_by_lua_block { assert = require('luassert') @@ -986,6 +974,7 @@ location /test { echo_read_request_body; echo_request_body; } +END --- more_headers Transfer-Encoding: chunked --- request eval @@ -1061,13 +1050,8 @@ with http_proxy is enough } ] } ---- backend -server_name test_backend.lvh.me; - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } +--- backend eval +::main::backend_authrep_ok("test_backend.lvh.me") --- upstream server_name test-upstream.lvh.me; location /test { @@ -1132,13 +1116,8 @@ can use that to verify that it was not executed. } ] } ---- backend -server_name test_backend.lvh.me; - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } +--- backend eval +::main::backend_authrep_ok("test_backend.lvh.me") --- upstream server_name test-upstream.lvh.me; location /test { @@ -1179,27 +1158,17 @@ POST /test?user_key= } ] } ---- backend env - server_name test-backend.lvh.me; - listen $TEST_NGINX_RANDOM_PORT ssl; - ssl_certificate $TEST_NGINX_SERVER_ROOT/html/server.crt; - ssl_certificate_key $TEST_NGINX_SERVER_ROOT/html/server.key; - location /transactions/authrep.xml { - content_by_lua_block { - ngx.exit(ngx.OK) - } - } ---- upstream env -server_name test-upstream.lvh.me; -listen $TEST_NGINX_RANDOM_PORT ssl; -ssl_certificate $TEST_NGINX_SERVER_ROOT/html/server.crt; -ssl_certificate_key $TEST_NGINX_SERVER_ROOT/html/server.key; -ssl_client_certificate $TEST_NGINX_SERVER_ROOT/html/client.crt; +--- backend eval +::main::ssl_backend_authrep_ok() +--- upstream eval +::main::ssl_upstream_header() . <<"END" +ssl_client_certificate $ENV{TEST_NGINX_SERVER_ROOT}/html/client.crt; ssl_verify_client on; location /test { echo 'ssl_client_s_dn: \$ssl_client_s_dn'; echo 'ssl_client_i_dn: \$ssl_client_i_dn'; } +END --- request GET /test?user_key=value --- error_code: 400 @@ -1214,6 +1183,7 @@ client sent no required SSL certificate while reading client request headers === TEST 19: MTLS connection to upstream via proxy when certificates are provided +and verify is set to false --- configuration random_port env eval < 't/fixtures/server-lvh.crt', +) +--- configuration random_port env eval +< CORE::join('', read_file('t/fixtures/server-lvh.crt')) ], + [ "server.key" => CORE::join('', read_file('t/fixtures/server-lvh.key')) ], + [ "client.crt" => CORE::join('', read_file('t/fixtures/client.crt')) ], + [ "client.key" => CORE::join('', read_file('t/fixtures/client.key')) ], + [ "passwords.file" => CORE::join('', read_file('t/fixtures/passwords.file')) ], +] diff --git a/t/fixtures/server-lvh.crt b/t/fixtures/server-lvh.crt new file mode 100644 index 000000000..798bf91da --- /dev/null +++ b/t/fixtures/server-lvh.crt @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDhjCCAm6gAwIBAgIUZdya9KjVpVASP/DF8Kw9rSxIcCkwDQYJKoZIhvcNAQEL +BQAwQjEPMA0GA1UECgwGM3NjYWxlMRAwDgYDVQQLDAdBUEljYXN0MR0wGwYDVQQD +DBR0ZXN0LXVwc3RyZWFtLmx2aC5tZTAeFw0yNjA5MDEwMzI3MTJaFw0zNjA4Mjkw +MzI3MTJaMEIxDzANBgNVBAoMBjNzY2FsZTEQMA4GA1UECwwHQVBJY2FzdDEdMBsG +A1UEAwwUdGVzdC11cHN0cmVhbS5sdmgubWUwggEiMA0GCSqGSIb3DQEBAQUAA4IB +DwAwggEKAoIBAQDlsouTHcvvxORKCsfeAjF+gNxXmSXJuCO5lCTtBexpdAbNNETM +4mUIPdAS+xVy7Q5JlUMwUBkrehbZPFKN+Clwyfl2elkO6CaelVKwgxTzRI5I3hYk +fuQc3HRrYgjQW+6tBF25/uJ7Gh0/XkWXCDR9/2jIxrkMAuQykQcs6pus4XP+gf8d +64iR5TRVRPFOxqs0UKtaVlzDs+DpBnq70Z0xX9GL4UbFFbacOes63yVuop8CyJOr +l9B1eEeILgdeEnjJ9j51njRLNVGgMpoJX48+HkKLWEepP8PG7MazjW6gO0RkbXfY +1zllQMxUkMVmhVahr+M6DpvlCIPd/KAw9GYtAgMBAAGjdDByMB0GA1UdDgQWBBRK +epL9ZFK3Lhsd8sFnHy1e1GSAPTAfBgNVHSMEGDAWgBRKepL9ZFK3Lhsd8sFnHy1e +1GSAPTAPBgNVHRMBAf8EBTADAQH/MB8GA1UdEQQYMBaCFHRlc3QtdXBzdHJlYW0u +bHZoLm1lMA0GCSqGSIb3DQEBCwUAA4IBAQByr39Yl3rzzgdXbyNyh/cf5p8DdOkQ +f3kVlHtdFNanfyjc353A4oNA0JnTqGwuBwmvn/LmTMeYqbN2LwTAFSdclODu2tY6 +yvLJoOb4fOWT1/Opt4TiIPUY2bPjIzJwJIDhAW0lYi3ncdxN24mbIA8SooeuQI/W +wEhoDkBQJ0sIf+17gy6y+/rBCRzDnROCoZeX5MzQeAlZ+7HzgaiAC0AEclMed+Sv +KyN/wljXYm7eQGFPPMy2ms0BJWH7QE52iQpKpDgj1cU2t4aF2EKMYqpp2TbyVXug +8ANKNzFTp8WQRKEqS6Ug3gMzqLpquSTqO3keifMsFjR8vM3n1/NaFY51 +-----END CERTIFICATE----- diff --git a/t/fixtures/server-lvh.key b/t/fixtures/server-lvh.key new file mode 100644 index 000000000..6d8c578c6 --- /dev/null +++ b/t/fixtures/server-lvh.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDlsouTHcvvxORK +CsfeAjF+gNxXmSXJuCO5lCTtBexpdAbNNETM4mUIPdAS+xVy7Q5JlUMwUBkrehbZ +PFKN+Clwyfl2elkO6CaelVKwgxTzRI5I3hYkfuQc3HRrYgjQW+6tBF25/uJ7Gh0/ +XkWXCDR9/2jIxrkMAuQykQcs6pus4XP+gf8d64iR5TRVRPFOxqs0UKtaVlzDs+Dp +Bnq70Z0xX9GL4UbFFbacOes63yVuop8CyJOrl9B1eEeILgdeEnjJ9j51njRLNVGg +MpoJX48+HkKLWEepP8PG7MazjW6gO0RkbXfY1zllQMxUkMVmhVahr+M6DpvlCIPd +/KAw9GYtAgMBAAECggEAKQeQE/rWE2G1r54mXntA0Qp+kW0rSVGJnBwgzm/o71tI +3b3Q7lIgXuz/rmxIRAuhKjat1kLwhAoea7ZxPqfN6zZAx8+J+fYw89HTf/EiPGQK +EG0PQnyiDZ+5cfcEgQdy5lfp0A/976RWBhw2TQirq7gERRzuL/2SOpAaWoUbwrD6 +TwCZKw1ljfI7lrjN8iQ5jqMJlCqXaiTRPD5mn5qJfNYzu4G1xdebPgQs70LRK10K +4XKGxpz+zc4D31GjLneZfgoy7tRB03zpXfD/Ntxeb5AwcenbGJJzOCH5Pzv5LHVR +1ecL34svEWMSwAXrCu/ezn3/3EvYSkBoaUObW+sB8QKBgQD088w7VH/V4SAEGz7F +cWRz0npmuYoCmgygGpOXfSL5dsOCS4FUXmU42WPmNWIraCEC0nHCrlXF79Jc3sO5 +i+WtGyINPVgSmvu/8orr83u1UWonJn0V/Bd35qdRDsFPj85YTYrTLd7P2M90ggGg +W4iTRCopAGi2MWxzK+z5OIYFlQKBgQDwDp2TKNohStYaSG04tqmLyRXpJiWSmXA/ +EQueN8Hke8HbEna6OHlAFxArEAMg7MusHrnwo/QKAGi/WDJSR6JC8vGxa+aNoqaF +Akmys+sxR1KV61Ex0fMbSHrgD42UkD7GHxENbOsJluSFE50ExMU+00EIH8jO1hdo +wUfwMg6IOQKBgGb4rdwrE2o3rxvK0EJz/oRp8KaKTKf3VmNfiLfgFPnFoT5+uyla +XTbevA4kVtZkeawUB1qNquUAgfAkfSbc1npEs7XZGdMIb9gq/5dczZ5VUUiP93ls +dfkjbya2CzGFBHs+baOE3uuE+wDBPinJEMrHlumRkHM2p55q0r2Zs01ZAoGBALqu +UwH+0erz/J4B1tY0zpLDNMPUA4IGytBwm/1VVPYu+6k2qZfVlQ0vIkaqtBQlsZnP +Zz/o8D3a5ZpvpupvhJLVxPj5dRiN9TsYdWGAIxV2ZpXpooHAyHJeIhgeYDa5GegO +fr9XBUy2yE1o3EG6F73soPUFaq7WtOuk6yGye7SZAoGBAOz0Ah4m9prudWFIJ3+A +h+L24eFXLyz5SLkgdKv1DfoePfyjSlQ6+vxPMYb3+I82F6kR40i0cDRkFkFP7H+F +Aasf31R0LgMacq2YN+LemcHbzL4Z0nNKH//aKg/0oXde+6c8E9rLdDTNF8NHDmiY +K2+tQmnd33G0gE6mxEiiDTII +-----END PRIVATE KEY----- diff --git a/t/http-proxy.t b/t/http-proxy.t index 0fb976546..82136b828 100644 --- a/t/http-proxy.t +++ b/t/http-proxy.t @@ -2164,7 +2164,7 @@ yay, api backend: test-upstream.lvh.me:$TEST_NGINX_SERVER_PORT "ca_certificates": [ "$Test::Nginx::Util::UPSTREAM_CA_CERT" ], - "verify": true + "verify": false } }, { @@ -2211,3 +2211,151 @@ proxy request: CONNECT test-upstream.lvh.me:$TEST_NGINX_RANDOM_PORT HTTP/1.1 --- no_error_log [error] --- user_files fixture=mutual_ssl.pl eval + + + +=== TEST 38: HTTPS_PROXY with mtls policy and verify is true +--- env random_port eval +( + 'https_proxy' => $ENV{TEST_NGINX_HTTPS_PROXY}, + 'BACKEND_ENDPOINT_OVERRIDE' => "https://test-backend.lvh.me:$ENV{TEST_NGINX_RANDOM_PORT}" +) +--- configuration random_port env eval +< $ENV{TEST_NGINX_HTTPS_PROXY}, + 'BACKEND_ENDPOINT_OVERRIDE' => "https://test-backend.lvh.me:$ENV{TEST_NGINX_RANDOM_PORT}", + 'SSL_CERT_FILE' => 't/fixtures/server-lvh.crt' +) +--- configuration random_port env eval +<