Skip to content

Commit ba3d977

Browse files
lgv5lgv5
committed
Fix SNI tests for LibreSSL
Since beginning of 2022, LibreSSL dropped support for IP addresses in SNI. This is aligned to RFC 6066, section 3: > Literal IPv4 and IPv6 addresses are not permitted in "HostName". In order to deal with it, clients connect to "localhost" instead of "127.0.0.1" and adjust "server.crt" to use "localhost" as Common Name instead of "127.0.0.1". rollback localhost => 127.0.0.1 change for servers
1 parent addf3ca commit ba3d977

File tree

5 files changed

+60
-52
lines changed

5 files changed

+60
-52
lines changed

‎t/mojo/certs/server.crt

+7-7
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIBsjCCARsCCQCptEBZlSnk3jANBgkqhkiG9w0BAQUFADAaMQswCQYDVQQGEwJV
3-
UzELMAkGA1UEAxMCY2EwHhcNMTQxMjEyMDUwMzI1WhcNMzQxMjA3MDUwMzI1WjAh
4-
MQswCQYDVQQGEwJVUzESMBAGA1UEAxMJMTI3LjAuMC4xMIGfMA0GCSqGSIb3DQEB
2+
MIIBsjCCARsCCQCM8WLoRPCPATANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQGEwJV
3+
UzELMAkGA1UEAxMCY2EwHhcNMjMwMjI1MTc1NjAwWhcNNDMwMjIwMTc1NjAwWjAh
4+
MQswCQYDVQQGEwJVUzESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEB
55
AQUAA4GNADCBiQKBgQDDhbj7nsfzahPilwn6pGdo6nKYCR21WZ73CuwPN86DmsZi
66
5LIRYRfKA0unape2BQBnMnSmInaXvHHBdVsTyt3XSFZj5+iCF9RcorXAqcDygScj
77
8MTWYAZxCu3lGAjtw0bGGYutlLg5jtEXvZwfe61XfJj9xDUPNQrP7mf/HTBmgQID
8-
AQABMA0GCSqGSIb3DQEBBQUAA4GBACRIx9fB4x8UO44C9TGj3bKb1NX3bkuHMz0m
9-
WdhCkzUUiANtRMxp2oLA3KHY4yOusZLZIUNyP10Ri5q/U1mR0poYCMm7AYee2OV7
10-
NdQIyppeDLoWQ9uPISPjp1d+zjpGOrLrSkpD1rYLVw4R56A9ZQks/LNs6TSceZjZ
11-
c5QST/9i
8+
AQABMA0GCSqGSIb3DQEBCwUAA4GBABjuNiXMWmGIr4LU7hypd4QKFZDfHyFFw21h
9+
dRhFp4cBq+A/9cDW7CBmKuVvBwYtkLSzQf0Y2/55mx1hz85NjRiSdDENWLncW8sA
10+
qt0mS9eX6s9HMeYNcT9ngPoAAUmkGT3/tAXwmejvu2XKBt8UBcnpJdt40YYq1wIH
11+
9lcg5Hni
1212
-----END CERTIFICATE-----

‎t/mojo/daemon_ipv6_tls.t

+3-3
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,8 @@ subtest 'IPv6, TLS, SNI and a proxy' => sub {
4141
$daemon = Mojo::Server::Daemon->new(app => app, silent => 1);
4242
my $listen
4343
= 'https://[::1]'
44-
. '?127.0.0.1_cert=t/mojo/certs/server.crt'
45-
. '&127.0.0.1_key=t/mojo/certs/server.key'
44+
. '?localhost_cert=t/mojo/certs/server.crt'
45+
. '&localhost_key=t/mojo/certs/server.key'
4646
. '&example.com_cert=t/mojo/certs/domain.crt'
4747
. '&example.com_key=t/mojo/certs/domain.key';
4848
my $forward = $daemon->listen([$listen])->start->ports->[0];
@@ -54,7 +54,7 @@ subtest 'IPv6, TLS, SNI and a proxy' => sub {
5454
is $tx->res->code, 200, 'right status';
5555
is $tx->res->body, 'works!', 'right content';
5656
ok !$tx->error, 'no error';
57-
$tx = $ua->get("https://127.0.0.1/");
57+
$tx = $ua->get("https://localhost/");
5858
is $tx->res->code, 200, 'right status';
5959
is $tx->res->body, 'works!', 'right content';
6060
ok !$tx->error, 'no error';

‎t/mojo/ioloop_tls.t

+19-11
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ plan skip_all => 'IO::Socket::SSL 2.009+ required for this test!' unless Moj
1414
# openssl req -x509 -days 7300 -key ca.key -in ca.csr -out ca.crt
1515
#
1616
# openssl genrsa -out server.key 1024
17-
# openssl req -new -key server.key -out server.csr -subj "/C=US/CN=127.0.0.1"
17+
# openssl req -new -key server.key -out server.csr -subj "/C=US/CN=localhost"
1818
# openssl x509 -req -days 7300 -in server.csr -out server.crt -CA ca.crt \
1919
# -CAkey ca.key -CAcreateserial
2020
#
@@ -46,7 +46,7 @@ my $id = $loop->server(
4646
my $port = $loop->acceptor($id)->port;
4747
my $promise2 = Mojo::Promise->new->ioloop($loop);
4848
$loop->client(
49-
{port => $port, tls => 1, tls_options => {SSL_verify_mode => 0x00}} => sub {
49+
{address => 'localhost', port => $port, tls => 1, tls_options => {SSL_verify_mode => 0x00}} => sub {
5050
my ($loop, $err, $stream) = @_;
5151
$stream->write('tset' => sub { shift->write('123') });
5252
$stream->on(close => sub { $promise2->resolve });
@@ -88,6 +88,7 @@ $id = Mojo::IOLoop->server(
8888
$port = Mojo::IOLoop->acceptor($id)->port;
8989
$promise2 = Mojo::Promise->new;
9090
Mojo::IOLoop->client(
91+
address => 'localhost',
9192
port => $port,
9293
tls => 1,
9394
tls_cert => 't/mojo/certs/client.crt',
@@ -118,6 +119,7 @@ ok !$server_err, 'no error';
118119
# Invalid client certificate
119120
my $client_err;
120121
Mojo::IOLoop->client(
122+
address => 'localhost',
121123
port => $port,
122124
tls => 1,
123125
tls_cert => 't/mojo/certs/bad.crt',
@@ -133,7 +135,7 @@ ok $client_err, 'has error';
133135
# Missing client certificate
134136
($server_err, $client_err) = ();
135137
Mojo::IOLoop->client(
136-
{port => $port, tls => 1} => sub {
138+
{address => 'localhost', port => $port, tls => 1} => sub {
137139
shift->stop;
138140
$client_err = shift;
139141
}
@@ -155,6 +157,7 @@ $id = $loop->server(
155157
);
156158
$port = $loop->acceptor($id)->port;
157159
$loop->client(
160+
address => 'localhost',
158161
port => $port,
159162
tls => 1,
160163
tls_cert => 't/mojo/certs/client.crt',
@@ -195,6 +198,7 @@ $id = Mojo::IOLoop->server(
195198
$port = Mojo::IOLoop->acceptor($id)->port;
196199
$promise2 = Mojo::Promise->new;
197200
Mojo::IOLoop->client(
201+
address => 'localhost',
198202
port => $port,
199203
tls => 1,
200204
tls_ca => 't/mojo/certs/ca.crt',
@@ -235,9 +239,10 @@ $id = $loop->server(
235239
);
236240
$port = $loop->acceptor($id)->port;
237241
$loop->client(
238-
port => $port,
239-
tls => 1,
240-
tls_ca => 't/mojo/certs/ca.crt',
242+
address => 'localhost',
243+
port => $port,
244+
tls => 1,
245+
tls_ca => 't/mojo/certs/ca.crt',
241246
sub {
242247
shift->stop;
243248
$client_err = shift;
@@ -259,7 +264,7 @@ $id = $loop->server(
259264
);
260265
$port = $loop->acceptor($id)->port;
261266
$loop->client(
262-
address => '127.0.0.1',
267+
address => 'localhost',
263268
port => $port,
264269
tls => 1,
265270
tls_ca => 't/mojo/certs/ca.crt',
@@ -284,9 +289,10 @@ $id = $loop->server(
284289
);
285290
$port = $loop->acceptor($id)->port;
286291
$loop->client(
287-
port => $port,
288-
tls => 1,
289-
tls_ca => 'no cert',
292+
address => 'localhost',
293+
port => $port,
294+
tls => 1,
295+
tls_ca => 'no cert',
290296
sub {
291297
shift->stop;
292298
$client_err = shift;
@@ -315,6 +321,7 @@ $id = $loop->server(
315321
);
316322
$port = $loop->acceptor($id)->port;
317323
$loop->client(
324+
address => 'localhost',
318325
port => $port,
319326
tls => 1,
320327
tls_cert => 't/mojo/certs/bad.crt',
@@ -350,7 +357,7 @@ $id = Mojo::IOLoop->server(
350357
);
351358
$port = Mojo::IOLoop->acceptor($id)->port;
352359
Mojo::IOLoop->client(
353-
{port => $port, tls => 1, tls_options => {SSL_verify_mode => 0x00}} => sub {
360+
{address => 'localhost', port => $port, tls => 1, tls_options => {SSL_verify_mode => 0x00}} => sub {
354361
shift->stop;
355362
$client = 'connected';
356363
$client_err = shift;
@@ -376,6 +383,7 @@ subtest 'ALPN' => sub {
376383
);
377384
$port = Mojo::IOLoop->acceptor($id)->port;
378385
Mojo::IOLoop->client(
386+
address => 'localhost',
379387
port => $port,
380388
tls => 1,
381389
tls_options => {SSL_alpn_protocols => ['baz', 'bar'], SSL_verify_mode => 0x00},

‎t/mojo/user_agent_tls.t

+12-12
Original file line numberDiff line numberDiff line change
@@ -29,20 +29,20 @@ subtest 'Web server with valid certificates' => sub {
2929

3030
subtest 'No certificate' => sub {
3131
my $ua = Mojo::UserAgent->new(ioloop => Mojo::IOLoop->singleton);
32-
my $tx = $ua->get("https://127.0.0.1:$port");
32+
my $tx = $ua->get("https://localhost:$port");
3333
ok $tx->error, 'has error';
34-
$tx = $ua->get("https://127.0.0.1:$port");
34+
$tx = $ua->get("https://localhost:$port");
3535
ok $tx->error, 'has error';
36-
$tx = $ua->ca('t/mojo/certs/ca.crt')->get("https://127.0.0.1:$port");
36+
$tx = $ua->ca('t/mojo/certs/ca.crt')->get("https://localhost:$port");
3737
ok $tx->error, 'has error';
38-
$tx = $ua->get("https://127.0.0.1:$port");
38+
$tx = $ua->get("https://localhost:$port");
3939
ok $tx->error, 'has error';
4040
};
4141

4242
subtest 'Valid certificates' => sub {
4343
my $ua = Mojo::UserAgent->new(ioloop => Mojo::IOLoop->singleton);
4444
$ua->ca('t/mojo/certs/ca.crt')->cert('t/mojo/certs/client.crt')->key('t/mojo/certs/client.key');
45-
my $tx = $ua->get("https://127.0.0.1:$port");
45+
my $tx = $ua->get("https://localhost:$port");
4646
ok !$tx->error, 'no error';
4747
is $tx->res->code, 200, 'right status';
4848
is $tx->res->body, 'works!', 'right content';
@@ -54,7 +54,7 @@ subtest 'Web server with valid certificates' => sub {
5454
local $ENV{MOJO_CERT_FILE} = 't/mojo/certs/client.crt';
5555
local $ENV{MOJO_KEY_FILE} = 't/mojo/certs/client.key';
5656
local $ENV{MOJO_INSECURE} = 0;
57-
my $tx = $ua->get("https://127.0.0.1:$port");
57+
my $tx = $ua->get("https://localhost:$port");
5858
is $ua->ca, 't/mojo/certs/ca.crt', 'right path';
5959
is $ua->cert, 't/mojo/certs/client.crt', 'right path';
6060
is $ua->key, 't/mojo/certs/client.key', 'right path';
@@ -67,7 +67,7 @@ subtest 'Web server with valid certificates' => sub {
6767
subtest 'Invalid certificate' => sub {
6868
my $ua = Mojo::UserAgent->new(ioloop => Mojo::IOLoop->singleton);
6969
$ua->cert('t/mojo/certs/bad.crt')->key('t/mojo/certs/bad.key');
70-
my $tx = $ua->get("https://127.0.0.1:$port");
70+
my $tx = $ua->get("https://localhost:$port");
7171
ok $tx->error, 'has error';
7272
};
7373
};
@@ -88,11 +88,11 @@ subtest 'Web server with valid certificates and no verification' => sub {
8888
# Invalid certificate
8989
my $ua = Mojo::UserAgent->new(ioloop => Mojo::IOLoop->singleton);
9090
$ua->cert('t/mojo/certs/bad.crt')->key('t/mojo/certs/bad.key');
91-
my $tx = $ua->get("https://127.0.0.1:$port");
91+
my $tx = $ua->get("https://localhost:$port");
9292
ok $tx->error, 'has error';
9393
$ua = Mojo::UserAgent->new(ioloop => $ua->ioloop, insecure => 1);
9494
$ua->cert('t/mojo/certs/bad.crt')->key('t/mojo/certs/bad.key');
95-
$tx = $ua->get("https://127.0.0.1:$port");
95+
$tx = $ua->get("https://localhost:$port");
9696
ok !$tx->error, 'no error';
9797
is $ua->ioloop->stream($tx->connection)->handle->get_cipher, 'AES256-SHA', 'AES256-SHA has been negotiatied';
9898
is $ua->ioloop->stream($tx->connection)->handle->get_sslversion, 'TLSv1', 'TLSv1 has been negotiatied';
@@ -105,19 +105,19 @@ subtest 'Client side TLS options' => sub {
105105

106106
subtest '(Not) setting verification mode' => sub {
107107
my $ua = Mojo::UserAgent->new(ioloop => Mojo::IOLoop->singleton);
108-
my $tx = $ua->get("https://127.0.0.1:$port");
108+
my $tx = $ua->get("https://localhost:$port");
109109
like $tx->error->{message}, qr/certificate verify failed/, 'has error';
110110

111111
$ua = Mojo::UserAgent->new(ioloop => Mojo::IOLoop->singleton);
112112
$ua->tls_options({SSL_verify_mode => 0x00});
113-
$tx = $ua->get("https://127.0.0.1:$port");
113+
$tx = $ua->get("https://localhost:$port");
114114
ok !$tx->error, 'no error';
115115
};
116116

117117
subtest 'Setting acceptable protocol version' => sub {
118118
my $ua = Mojo::UserAgent->new(ioloop => Mojo::IOLoop->singleton);
119119
$ua->tls_options({SSL_version => 'TLSv1_2'});
120-
my $tx = $ua->get("https://127.0.0.1:$port");
120+
my $tx = $ua->get("https://localhost:$port");
121121
like $tx->error->{message}, qr/wrong ssl version/, 'has error';
122122
};
123123
};

‎t/mojo/websocket_proxy_tls.t

+19-19
Original file line numberDiff line numberDiff line change
@@ -66,38 +66,38 @@ my $ua = Mojo::UserAgent->new(
6666
# Normal non-blocking request
6767
my $result;
6868
$ua->get(
69-
"https://127.0.0.1:$port/" => sub {
69+
"https://localhost:$port/" => sub {
7070
my ($ua, $tx) = @_;
7171
$result = $tx->res->body;
7272
Mojo::IOLoop->stop;
7373
}
7474
);
7575
Mojo::IOLoop->start;
76-
is $result, "Hello World! / https://127.0.0.1:$port/", 'right content';
76+
is $result, "Hello World! / https://localhost:$port/", 'right content';
7777

7878
# Broken redirect
7979
my $start;
8080
$ua->on(start => sub { $start++; pop->req->headers->header('X-Works', 'it does!') });
8181
$result = undef;
8282
my $works;
8383
$ua->max_redirects(3)->get(
84-
"https://127.0.0.1:$port/broken_redirect" => sub {
84+
"https://localhost:$port/broken_redirect" => sub {
8585
my ($ua, $tx) = @_;
8686
$result = $tx->res->body;
8787
$works = $tx->res->headers->header('X-Works');
8888
Mojo::IOLoop->stop;
8989
}
9090
);
9191
Mojo::IOLoop->start;
92-
is $result, "Hello World! / https://127.0.0.1:$port/", 'right content';
92+
is $result, "Hello World! / https://localhost:$port/", 'right content';
9393
is $works, 'it does!', 'right header';
9494
is $start, 2, 'redirected once';
9595
$ua->unsubscribe('start');
9696

9797
# Normal WebSocket
9898
$result = undef;
9999
$ua->websocket(
100-
"wss://127.0.0.1:$port/test" => sub {
100+
"wss://localhost:$port/test" => sub {
101101
my ($ua, $tx) = @_;
102102
$tx->on(finish => sub { Mojo::IOLoop->stop });
103103
$tx->on(message => sub { shift->finish; $result = shift });
@@ -112,7 +112,7 @@ $ua->proxy->https("http://sri:secr3t\@127.0.0.1:$proxy");
112112
$result = undef;
113113
my ($auth, $kept_alive);
114114
$ua->get(
115-
"https://127.0.0.1:$port/proxy" => sub {
115+
"https://localhost:$port/proxy" => sub {
116116
my ($ua, $tx) = @_;
117117
$result = $tx->res->body;
118118
$auth = $tx->req->headers->proxy_authorization;
@@ -123,27 +123,27 @@ $ua->get(
123123
Mojo::IOLoop->start;
124124
ok !$auth, 'no "Proxy-Authorization" header';
125125
ok !$kept_alive, 'connection was not kept alive';
126-
is $result, "https://127.0.0.1:$port/proxy", 'right content';
126+
is $result, "https://localhost:$port/proxy", 'right content';
127127

128128
# Non-blocking kept alive proxy request
129129
($kept_alive, $result) = ();
130130
$ua->get(
131-
"https://127.0.0.1:$port/proxy" => sub {
131+
"https://localhost:$port/proxy" => sub {
132132
my ($ua, $tx) = @_;
133133
$kept_alive = $tx->kept_alive;
134134
$result = $tx->res->body;
135135
Mojo::IOLoop->stop;
136136
}
137137
);
138138
Mojo::IOLoop->start;
139-
is $result, "https://127.0.0.1:$port/proxy", 'right content';
139+
is $result, "https://localhost:$port/proxy", 'right content';
140140
ok $kept_alive, 'connection was kept alive';
141141

142142
# Kept alive proxy WebSocket
143143
$ua->proxy->https("http://127.0.0.1:$proxy");
144144
($kept_alive, $result) = ();
145145
$ua->websocket(
146-
"wss://127.0.0.1:$port/test" => sub {
146+
"wss://localhost:$port/test" => sub {
147147
my ($ua, $tx) = @_;
148148
$kept_alive = $tx->kept_alive;
149149
$tx->on(finish => sub { Mojo::IOLoop->stop });
@@ -157,23 +157,23 @@ is $result, 'test1test2', 'right result';
157157

158158
# Blocking proxy requests
159159
$ua->proxy->https("http://sri:secr3t\@127.0.0.1:$proxy");
160-
my $tx = $ua->max_connections(0)->get("https://127.0.0.1:$port/proxy");
160+
my $tx = $ua->max_connections(0)->get("https://localhost:$port/proxy");
161161
is $tx->res->code, 200, 'right status';
162-
is $tx->res->body, "https://127.0.0.1:$port/proxy", 'right content';
162+
is $tx->res->body, "https://localhost:$port/proxy", 'right content';
163163
is $tx->req->method, 'GET', 'right method';
164164
is $tx->previous->req->method, 'CONNECT', 'right method';
165-
$tx = $ua->max_connections(5)->get("https://127.0.0.1:$port/proxy");
165+
$tx = $ua->max_connections(5)->get("https://localhost:$port/proxy");
166166
ok !$tx->kept_alive, 'connection was not kept alive';
167167
is $tx->res->code, 200, 'right status';
168-
is $tx->res->body, "https://127.0.0.1:$port/proxy", 'right content';
168+
is $tx->res->body, "https://localhost:$port/proxy", 'right content';
169169
is $tx->req->method, 'GET', 'right method';
170170
is $tx->previous->req->method, 'CONNECT', 'right method';
171171

172172
# Proxy WebSocket with bad target
173173
$ua->proxy->https("http://127.0.0.1:$proxy");
174174
my ($leak, $err);
175175
$ua->websocket(
176-
"wss://127.0.0.1:0/test" => sub {
176+
"wss://localhost:0/test" => sub {
177177
my ($ua, $tx) = @_;
178178
$leak = !!Mojo::IOLoop->stream($tx->previous->connection);
179179
$err = $tx->error;
@@ -185,9 +185,9 @@ ok !$leak, 'connection has been removed';
185185
is $err->{message}, 'Proxy connection failed', 'right error';
186186

187187
# Blocking proxy request again
188-
$tx = $ua->get("https://127.0.0.1:$port/proxy");
188+
$tx = $ua->get("https://localhost:$port/proxy");
189189
is $tx->res->code, 200, 'right status';
190-
is $tx->res->body, "https://127.0.0.1:$port/proxy", 'right content';
190+
is $tx->res->body, "https://localhost:$port/proxy", 'right content';
191191

192192
# Failed TLS handshake through proxy
193193
my $close = Mojo::IOLoop->acceptor(Mojo::IOLoop->server(sub {
@@ -214,13 +214,13 @@ $ua->connect_timeout(10);
214214
$ua = Mojo::UserAgent->new;
215215
$proxy = Mojo::IOLoop::Server->generate_port;
216216
$ua->proxy->https("http://127.0.0.1:$proxy");
217-
$tx = $ua->get("https://127.0.0.1:$port/proxy");
217+
$tx = $ua->get("https://localhost:$port/proxy");
218218
is $tx->error->{message}, 'Proxy connection failed', 'right error';
219219

220220
# Non-blocking request to bad proxy
221221
$err = undef;
222222
$ua->get(
223-
"https://127.0.0.1:$port/proxy" => sub {
223+
"https://localhost:$port/proxy" => sub {
224224
my ($ua, $tx) = @_;
225225
$err = $tx->error;
226226
Mojo::IOLoop->stop;

0 commit comments

Comments
 (0)