Changeset f363569 in mod_gnutls

Timestamp:

Sep 25, 2020, 5:53:51 PM (2 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, master

Children:

b4dc111

Parents:

be2ad50

Message:

Tests: Replace authority/imposter with a friendly cat identity

The SNI tests don't need an actual imposter certificate, just one with
a different identity. 09_verify_no_sni_fails_with_wrong_order now
checks for that specific certificate.

Location:

test

Files:

• Makefile.am (modified) (3 diffs)
• authority/imposter/template.in (deleted)
• authority/imposter/uid.in (deleted)
• authority/meow.test/template.in (added)
• tests/06_verify_sni_a/apache.conf (modified) (1 diff)
• tests/07_verify_sni_b/apache.conf (modified) (1 diff)
• tests/08_verify_no_sni_fallback_to_first_vhost/apache.conf (modified) (1 diff)
• tests/09_verify_no_sni_fails_with_wrong_order/apache.conf (modified) (1 diff)
• tests/09_verify_no_sni_fails_with_wrong_order/test.yaml (modified) (1 diff)

test/Makefile.am

@@ -81 +81 @@
 shared_identities = authority authority/client
 pgp_identities = $(shared_identities)
-x509_only_identities = authority/server authority/imposter \
+x509_only_identities = authority/server authority/meow.test \
         authority/subca authority/subca/server \
         rogueca rogueca/imposter rogueca/rogueclient
@@ -123 +123 @@
 
 cert_templates = authority/template.in authority/client/template.in \
-        authority/imposter/template.in authority/ocsp-responder/template \
+        authority/meow.test/template.in authority/ocsp-responder/template \
         authority/server/template.in \
         authority/subca/template.in authority/subca/server/template.in \
@@ -130 +130 @@
         rogueca/rogueclient/template.in
 generated_templates = authority/template authority/client/template \
-        authority/imposter/template authority/server/template \
+        authority/meow.test/template authority/server/template \
         rogueca/imposter/template rogueca/rogueclient/template
 

test/tests/06_verify_sni_a/apache.conf

@@ -11 +11 @@
 
 <VirtualHost _default_:${TEST_PORT}>
- ServerName imposter.example
+ ServerName meow.test
  GnuTLSEnable On
- GnuTLSCertificateFile  authority/imposter/x509.pem
- GnuTLSKeyFile          authority/imposter/secret.key
+ GnuTLSCertificateFile  authority/meow.test/x509.pem
+ GnuTLSKeyFile          authority/meow.test/secret.key
 </VirtualHost>

test/tests/07_verify_sni_b/apache.conf

@@ -6 +6 @@
 
 <VirtualHost _default_:${TEST_PORT}>
- ServerName imposter.example
+ ServerName meow.test
  GnuTLSEnable On
- GnuTLSCertificateFile  authority/imposter/x509.pem
- GnuTLSKeyFile          authority/imposter/secret.key
+ GnuTLSCertificateFile  authority/meow.test/x509.pem
+ GnuTLSKeyFile          authority/meow.test/secret.key
 </VirtualHost>
 

test/tests/08_verify_no_sni_fallback_to_first_vhost/apache.conf

@@ -11 +11 @@
 
 <VirtualHost _default_:${TEST_PORT}>
- ServerName imposter.example
+ ServerName meow.test
  GnuTLSEnable On
- GnuTLSCertificateFile  authority/imposter/x509.pem
- GnuTLSKeyFile          authority/imposter/secret.key
+ GnuTLSCertificateFile  authority/meow.test/x509.pem
+ GnuTLSKeyFile          authority/meow.test/secret.key
 </VirtualHost>

test/tests/09_verify_no_sni_fails_with_wrong_order/apache.conf

@@ -3 +3 @@
 GnuTLSCache ${DEFAULT_CACHE}
 
-# In this order, clients with no SNI should get the imposter's key
+# In this order, clients with no SNI should get the cat key
 
 <VirtualHost _default_:${TEST_PORT}>
- ServerName imposter.example
+ ServerName meow.test
  GnuTLSEnable On
- GnuTLSCertificateFile  authority/imposter/x509.pem
- GnuTLSKeyFile          authority/imposter/secret.key
+ GnuTLSCertificateFile  authority/meow.test/x509.pem
+ GnuTLSKeyFile          authority/meow.test/secret.key
 </VirtualHost>
 

test/tests/09_verify_no_sni_fails_with_wrong_order/test.yaml

@@ -2 +2 @@
 gnutls_params:
   - x509cafile=authority/x509.pem
+  - verify-hostname=meow.test
   - disable-sni
 actions:
   - !request
     path: /test.txt
+    headers:
+      Host: meow.test
     expect:
-      reset: yes
-
+      status: 200
+      body:
+        exactly: |
+          test