15 files changed, 924 insertions, 0 deletions
diff --git a/debian/perl-framework/t/ssl/all.t b/debian/perl-framework/t/ssl/all.t
new file mode 100644
index 0000000..d3965d8
--- /dev/null
+++ b/debian/perl-framework/t/ssl/all.t
@@ -0,0 +1,12 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+my $vars = Apache::Test::vars();
+
+#skip all tests in this directory unless ssl is enabled
+#and LWP has https support
+plan tests => 1, [$vars->{ssl_module_name}, qw(LWP::Protocol::https)];
+
+ok 1;
+
diff --git a/debian/perl-framework/t/ssl/basicauth.t b/debian/perl-framework/t/ssl/basicauth.t
new file mode 100644
index 0000000..dde2131
--- /dev/null
+++ b/debian/perl-framework/t/ssl/basicauth.t
@@ -0,0 +1,45 @@
+use strict;
+use warnings FATAL => 'all';
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestConfig ();
+use Apache::TestUtil;
+
+#if keepalives are on, renegotiation not happen again once
+#a client cert is presented.  so on test #3, the cert from #2
+#will be used.  this test scenerio would never
+#happen in real-life, so just disable keepalives here.
+Apache::TestRequest::user_agent_keepalive(0);
+
+my $url = '/ssl-fakebasicauth/index.html';
+
+plan tests => 4, need need_auth, need_lwp;
+
+Apache::TestRequest::scheme('https');
+
+# With TLSv1.3 mod_ssl may return a better 403 error here, otherwise
+# expect a TLS alert which is represented as a 500 by LWP.
+ok t_cmp (GET_RC($url, cert => undef),
+          qr/^(500|403)$/,
+          "Getting $url with no cert"
+         );
+
+ok t_cmp (GET_RC($url, cert => 'client_snakeoil'),
+          200,
+          "Getting $url with client_snakeoil cert"
+         );
+
+ok t_cmp (GET_RC($url, cert => 'client_ok'),
+          401,
+          "Getting $url with client_ok cert"
+         );
+
+if (!have_min_apache_version("2.5.1")) {
+    skip "Colon in username test skipped.";
+}
+else {
+    ok t_cmp (GET_RC($url, cert => 'client_colon'),
+              403,
+              "Getting $url with client_colon cert"
+        );
+}
diff --git a/debian/perl-framework/t/ssl/env.t b/debian/perl-framework/t/ssl/env.t
new file mode 100644
index 0000000..912a4dc
--- /dev/null
+++ b/debian/perl-framework/t/ssl/env.t
@@ -0,0 +1,89 @@
+use strict;
+use warnings FATAL => 'all';
+use Apache::Test;
+use Apache::TestUtil;
+use Apache::TestRequest;
+use Apache::TestConfig ();
+use Apache::TestSSLCA ();
+
+#if keepalives are on, renegotiation not happen again once
+#a client cert is presented.
+Apache::TestRequest::user_agent_keepalive(0);
+
+my $cert = 'client_snakeoil';
+
+my $server_expect =
+  Apache::TestSSLCA::dn_vars('ca', 'SERVER_I');
+
+my $client_expect =
+  Apache::TestSSLCA::dn_vars($cert, 'CLIENT_S');
+
+my $url = '/ssl-cgi/env.pl';
+
+my $tests = (keys(%$server_expect) + keys(%$client_expect) + 1) * 2;
+plan tests => $tests, need need_cgi, need_lwp;
+
+Apache::TestRequest::scheme('https');
+
+my $r = GET($url);
+
+ok t_cmp($r->code, 200, "response status OK");
+
+my $env = getenv($r->as_string);
+
+verify($env, $server_expect);
+verify($env, $client_expect, 1);
+
+$url = '/require-ssl-cgi/env.pl';
+
+$r = GET($url, cert => $cert);
+
+ok t_cmp($r->code, 200, "second response status OK");
+
+$env = getenv($r->as_string);
+
+verify($env, $server_expect);
+verify($env, $client_expect);
+
+sub verify {
+    my($env, $expect, $ne) = @_;
+
+    while (my($key, $val) = each %$expect) {
+        # the emailAddress attribute is still exported using the name
+        # _DN_Email by mod_ssl, even when using OpenSSL 0.9.7.
+        if ($key =~ /(.*)_emailAddress/) {
+            $key = $1 . "_Email";
+        }
+        if (Apache::TestConfig::WIN32) {
+            #perl uppercases all %ENV keys
+            #which causes SSL_*_DN_Email lookups to fail
+            $key = uc $key;
+        }
+        unless ($ne || $env->{$key}) {
+            print "#$key does not exist\n";
+            $env->{$key} = ""; #prevent use of unitialized value
+        }
+        if ($ne) {
+            print "#$key should not exist\n";
+            ok not exists $env->{$key};
+        }
+        else {
+            print "#$key: expect '$val', got '$env->{$key}'\n";
+            ok $env->{$key} eq $val;
+        }
+    }
+}
+
+sub getenv {
+    my $str = shift;
+
+    my %env;
+
+    for my $line (split /[\r\n]+/, $str) {
+        my($key, $val) = split /\s*=\s*/, $line, 2;
+        next unless $key and $val;
+        $env{$key} = $val;
+    }
+
+    \%env;
+}
diff --git a/debian/perl-framework/t/ssl/extlookup.t b/debian/perl-framework/t/ssl/extlookup.t
new file mode 100644
index 0000000..d40e76e
--- /dev/null
+++ b/debian/perl-framework/t/ssl/extlookup.t
@@ -0,0 +1,32 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+Apache::TestRequest::scheme("https");
+
+my %exts = (
+   "2.16.840.1.113730.1.13" => "This Is A Comment"
+);
+
+if (have_min_apache_version("2.4.0")) { 
+   $exts{"1.3.6.1.4.1.18060.12.0"} = "Lemons",
+}
+
+plan tests => 2 * (keys %exts), need 'test_ssl', need_min_apache_version(2.1);
+
+my ($actual, $expected, $r, $c);
+
+foreach (sort keys %exts) {
+    $r = GET("/test_ssl_ext_lookup?$_", cert => 'client_ok');
+    
+    ok t_cmp($r->code, 200, "ssl_ext_lookup works for $_");
+
+    $c = $r->content;
+    chomp $c;
+
+    ok t_cmp($c, $exts{$_}, "Extension value match for $_");
+}
+
diff --git a/debian/perl-framework/t/ssl/fakeauth.t b/debian/perl-framework/t/ssl/fakeauth.t
new file mode 100644
index 0000000..9009cf4
--- /dev/null
+++ b/debian/perl-framework/t/ssl/fakeauth.t
@@ -0,0 +1,35 @@
+use strict;
+use warnings FATAL => 'all';
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestConfig ();
+use Apache::TestUtil;
+
+# check fake authentication using mod_auth_anon
+# no cert should fail but the presence of any cert
+# should pass.  see also t/ssl/basicauth.t
+
+my $url = '/ssl-fakebasicauth2/index.html';
+
+plan tests => 3, need need_auth,
+                      need_module('mod_authn_anon'),
+                      need_min_apache_version(2.1);
+
+Apache::TestRequest::scheme('https');
+
+# With TLSv1.3 mod_ssl may return a better 403 error here, otherwise
+# expect a TLS alert which is represented as a 500 by LWP.
+ok t_cmp (GET_RC($url, cert => undef),
+          qr/^(500|403)$/,
+          "Getting $url with no cert"
+         );
+
+ok t_cmp (GET_RC($url, cert => 'client_snakeoil'),
+          200,
+          "Getting $url with client_snakeoil cert"
+         );
+
+ok t_cmp (GET_RC($url, cert => 'client_ok'),
+          200,
+          "Getting $url with client_ok cert"
+         );
diff --git a/debian/perl-framework/t/ssl/headers.t b/debian/perl-framework/t/ssl/headers.t
new file mode 100644
index 0000000..825d6a9
--- /dev/null
+++ b/debian/perl-framework/t/ssl/headers.t
@@ -0,0 +1,28 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+my $tests = 3;
+
+plan tests => $tests, need need_lwp, need_module('headers', 'ssl');
+
+Apache::TestRequest::scheme('https');
+
+my $h = HEAD_STR "/modules/headers/ssl/";
+
+# look for 500 when mod_headers doesn't grok the %s tag
+if ($h =~ /^HTTP\/1.1 500 Internal Server Error\n/) {   
+    foreach (1..$tests) {
+        skip "Skipping because mod_headers doesn't grok %s\n";
+    }
+    exit 0;
+}
+
+$h =~ s/Client-Bad-Header-Line:.*$//g;
+
+ok t_cmp($h, qr/X-SSL-Flag: on/, "SSLFlag header set");
+ok t_cmp($h, qr/X-SSL-Cert:.*END CERTIFICATE-----/, "SSL certificate is unwrapped");
+ok t_cmp($h, qr/X-SSL-None: \(null\)\n/, "unknown SSL variable not given");
diff --git a/debian/perl-framework/t/ssl/http.t b/debian/perl-framework/t/ssl/http.t
new file mode 100644
index 0000000..e556224
--- /dev/null
+++ b/debian/perl-framework/t/ssl/http.t
@@ -0,0 +1,48 @@
+use strict;
+use warnings FATAL => 'all';
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+BEGIN {
+   # prevent TestRequest from croaking on an HTTP/0.9 response
+   $ENV{APACHE_TEST_HTTP_09_OK} = 1;
+}
+
+#verify we can send an non-ssl http request to the ssl port
+#without dumping core.
+
+my $url = '/index.html';
+
+my @todo;
+
+if (Apache::TestConfig::WIN32) {
+    print "\n#ap_core_translate() chokes on ':' here\n",
+          "#where r->uri = /mod_ssl:error:HTTP-request\n";
+    @todo = (todo => [2]);
+}
+
+plan tests => 2, @todo, need_lwp;
+
+my $config = Apache::Test::config();
+my $ssl_module = $config->{vars}->{ssl_module_name};
+my $hostport = $config->{vhosts}->{$ssl_module}->{hostport};
+my $rurl = "http://$hostport$url";
+
+my $res = GET($rurl);
+my $proto = $res->protocol;
+
+if ($proto and $proto eq "HTTP/0.9") {
+    skip "server gave HTTP/0.9 response";
+} else {    
+    ok t_cmp($res->code,
+             400,
+             "Expected bad request from 'GET $rurl'"
+            );
+}
+
+ok t_cmp($res->content,
+         qr{speaking plain HTTP to an SSL-enabled server port},
+         "that error document contains the proper hint"
+        );
+
diff --git a/debian/perl-framework/t/ssl/ocsp.t b/debian/perl-framework/t/ssl/ocsp.t
new file mode 100644
index 0000000..9e0d776
--- /dev/null
+++ b/debian/perl-framework/t/ssl/ocsp.t
@@ -0,0 +1,53 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestSSLCA;
+use Apache::TestRequest;
+use Apache::TestConfig ();
+
+#if keepalives are on, renegotiation not happen again once
+#a client cert is presented.  so on test #3, the cert from #2
+#will be used.  this test scenerio would never
+#happen in real-life, so just disable keepalives here.
+Apache::TestRequest::user_agent_keepalive(0);
+
+my $url = '/index.html';
+
+Apache::TestRequest::scheme('https');
+Apache::TestRequest::module('ssl_ocsp');
+
+my $openssl = Apache::TestSSLCA::openssl();
+if (!have_min_apache_version('2.4.26')
+    or `$openssl list -commands 2>&1` !~ /ocsp/) {
+    print "1..0 # skip: No OpenSSL or mod_ssl OCSP support";
+    exit 0;
+}
+
+plan tests => 3, need_lwp;
+
+my $r;
+
+sok {
+    $r = GET $url, cert => undef;
+    my $message = $r->message() || '';
+    my $warning = $r->header('Client-Warning') || '';
+    print $r->as_string;
+    $r->code == 500 && $warning =~ 'Internal response' &&
+        $message =~ /alert handshake failure|read failed/;
+};
+
+sok {
+    $r = GET $url, cert => 'client_ok';
+    print $r->as_string;
+    $r->code == 200;
+};
+
+sok {
+    $r = GET $url, cert => 'client_revoked';
+    my $message = $r->message() || '';
+    my $warning = $r->header('Client-Warning') || '';
+    print $r->as_string;
+    $r->code == 500 && $warning =~ 'Internal response' &&
+        $message =~ /alert certificate revoked|read failed/;
+};
diff --git a/debian/perl-framework/t/ssl/pr12355.t b/debian/perl-framework/t/ssl/pr12355.t
new file mode 100644
index 0000000..51be00f
--- /dev/null
+++ b/debian/perl-framework/t/ssl/pr12355.t
@@ -0,0 +1,55 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+plan tests => 10, need 'ssl', need_min_apache_version('2.0');
+
+Apache::TestRequest::user_agent( ssl_opts => { SSL_cipher_list => 'ALL'});
+Apache::TestRequest::user_agent_keepalive(1);
+Apache::TestRequest::scheme('https');
+
+my $r;
+
+# Send a series of POST requests with varying size request bodies.
+# Alternate between the location which requires a AES128-SHA ciphersuite
+# and one which requires AES256-SHA; mod_ssl will attempt to perform the
+# renegotiation between each request, and hence needs to perform the
+# buffering of request body data.
+
+$r = POST "/require-aes256-cgi/perl_echo.pl", content => "hello world";
+
+ok t_cmp($r->code, 200, "renegotiation on POST works");
+ok t_cmp($r->content, "hello world", "request body matches response");
+
+$r = POST "/require-aes128-cgi/perl_echo.pl", content => "hello world";
+
+ok t_cmp($r->code, 200, "renegotiation on POST works");
+ok t_cmp($r->content, "hello world", "request body matches response");
+
+$r = POST "/require-aes256-cgi/perl_echo.pl", content => 'x'x10000;
+
+ok t_cmp($r->code, 200, "renegotiation on POST works");
+ok t_cmp($r->content, $r->request->content, "request body matches response");
+
+$r = POST "/require-aes128-cgi/perl_echo.pl", content => 'x'x60000;
+
+ok t_cmp($r->code, 200, "renegotiation on POST works");
+ok t_cmp($r->content, $r->request->content, "request body matches response");
+
+# Test that content-level input filters are still run as expected by
+# using a request which triggers the mod_case_filter_in:
+
+my @filter = ('X-AddInputFilter' => 'CaseFilterIn'); #mod_client_add_filter
+
+if (have_module('case_filter_in')) {
+    $r = POST "/require-aes256-cgi/perl_echo.pl", @filter, content => "hello";
+    
+    ok t_cmp($r->code, 200, "renegotiation on POST works");
+    ok t_cmp($r->content, "HELLO", "request body matches response");
+} else {
+    skip "mod_case_filter_in not available" foreach (1..2);
+}
+
diff --git a/debian/perl-framework/t/ssl/pr43738.t b/debian/perl-framework/t/ssl/pr43738.t
new file mode 100644
index 0000000..0814a39
--- /dev/null
+++ b/debian/perl-framework/t/ssl/pr43738.t
@@ -0,0 +1,28 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+plan tests => 4, 
+    need 'ssl', need_module('actions'),
+    need_min_apache_version('2.2.7');
+
+Apache::TestRequest::user_agent( ssl_opts => { SSL_cipher_list => 'ALL'});
+Apache::TestRequest::user_agent_keepalive(1);
+Apache::TestRequest::scheme('https');
+
+my $r;
+
+# Variation of the PR 12355 test which breaks per PR 43738.
+
+$r = POST "/modules/ssl/aes128/empty.pfa", content => "hello world";
+
+ok t_cmp($r->code, 200, "renegotiation on POST works");
+ok t_cmp($r->content, "/modules/ssl/aes128/empty.pfa\nhello world", "request body matches response");
+
+$r = POST "/modules/ssl/aes256/empty.pfa", content => "hello world";
+
+ok t_cmp($r->code, 200, "renegotiation on POST works");
+ok t_cmp($r->content, "/modules/ssl/aes256/empty.pfa\nhello world", "request body matches response");
diff --git a/debian/perl-framework/t/ssl/proxy.t b/debian/perl-framework/t/ssl/proxy.t
new file mode 100644
index 0000000..bbeddb6
--- /dev/null
+++ b/debian/perl-framework/t/ssl/proxy.t
@@ -0,0 +1,116 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+use Apache::TestCommon ();
+
+my %frontend = (
+    proxy_http_https  => 'http',
+    proxy_https_https => 'https',
+    proxy_https_http  => 'https',
+);
+my %backend = (
+    proxy_http_https  => 'https',
+    proxy_https_https => 'https',
+    proxy_https_http  => 'http',
+);
+
+my $num_modules = scalar keys %frontend;
+my $post_module = 'eat_post';
+
+my $post_tests = have_module($post_module) ?
+  Apache::TestCommon::run_post_test_sizes() : 0;
+
+my $num_http_backends = 0;
+for my $module (sort keys %backend) {
+    if ($backend{$module} eq "http") {
+        $num_http_backends++;
+    }
+}
+
+plan tests => (8 + $post_tests) * $num_modules - 5 * $num_http_backends,
+              need need_lwp, [qw(mod_proxy proxy_http.c)];
+
+for my $module (sort keys %frontend) {
+
+    my $scheme = $frontend{$module};
+    Apache::TestRequest::module($module);
+    Apache::TestRequest::scheme($scheme);
+
+    my $hostport = Apache::TestRequest::hostport();
+    my $res;
+    my %vars;
+
+    sok {
+        t_cmp(GET('/')->code,
+              200,
+              "/ with $module ($scheme)");
+    };
+
+    sok {
+        t_cmp(GET('/modules/cgi/nph-foldhdr.pl')->code,
+              200,
+              "CGI script with folded headers");
+    };
+
+    if ($backend{$module} eq "https") {
+        sok {
+            t_cmp(GET('/verify')->code,
+                  200,
+                  "using valid proxyssl client cert");
+        };
+
+        sok {
+            t_cmp(GET('/require/snakeoil')->code,
+                  403,
+                  "using invalid proxyssl client cert");
+        };
+
+        $res = GET('/require-ssl-cgi/env.pl');
+
+        sok {
+            t_cmp($res->code, 200, "protected cgi script");
+        };
+
+        my $body = $res->content || "";
+
+        for my $line (split /\s*\r?\n/, $body) {
+            my($key, $val) = split /\s*=\s*/, $line, 2;
+            next unless $key;
+            $vars{$key} = $val || "";
+        }
+
+        sok {
+            t_cmp($vars{HTTP_X_FORWARDED_HOST},
+                  $hostport,
+                  "X-Forwarded-Host header");
+        };
+
+        sok {
+            t_cmp($vars{SSL_CLIENT_S_DN_CN},
+                  'client_ok',
+                  "client subject common name");
+        };
+    }
+
+    sok {
+        #test that ProxyPassReverse rewrote the Location header
+        #to use the frontend server rather than downstream server
+        my $uri = '/modules';
+        my $ruri = Apache::TestRequest::resolve_url($uri) . '/';
+
+        #tell lwp not to follow redirect so we can see the Location header
+        local $Apache::TestRequest::RedirectOK = 0;
+
+        $res = GET($uri);
+
+        my $location = $res->header('Location') || 'NONE';
+
+        t_cmp($location, $ruri, 'ProxyPassReverse Location rewrite');
+    };
+
+    Apache::TestCommon::run_post_test($post_module) if $post_tests;
+    Apache::TestRequest::user_agent(reset => 1);
+}
diff --git a/debian/perl-framework/t/ssl/require.t b/debian/perl-framework/t/ssl/require.t
new file mode 100644
index 0000000..2a218d4
--- /dev/null
+++ b/debian/perl-framework/t/ssl/require.t
@@ -0,0 +1,55 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+
+#if keepalives are on, renegotiation not happen again once
+#a client cert is presented.  so on test #3, the cert from #2
+#will be used.  this test scenerio would never
+#happen in real-life, so just disable keepalives here.
+Apache::TestRequest::user_agent_keepalive(0);
+
+my $sslrequire_oid_needed_version = '2.1.7';
+my $have_sslrequire_oid = have_min_apache_version($sslrequire_oid_needed_version);
+
+plan tests => 10, need_lwp;
+
+Apache::TestRequest::scheme('https');
+
+my $url = '/require/asf/index.html';
+
+ok GET_RC($url, cert => undef) != 200;
+
+ok GET_RC($url, cert => 'client_ok') == 200;
+
+ok GET_RC($url, cert => 'client_revoked') != 200;
+
+$url = '/require/snakeoil/index.html';
+
+ok GET_RC($url, cert => 'client_ok') != 200;
+
+ok GET_RC($url, cert => 'client_snakeoil') == 200;
+
+ok GET_RC('/require/strcmp/index.html', cert => undef) == 200;
+
+ok GET_RC('/require/intcmp/index.html', cert => undef) == 200;
+
+if ($have_sslrequire_oid) {
+
+    $url = '/require/certext/index.html';
+
+    ok GET_RC($url, cert => undef) != 200;
+
+    if (!have_min_apache_version("2.4.0")) { 
+       skip "not backported, see 2.2.19 vote thread for analysis";
+    }
+    else { 
+        ok GET_RC($url, cert => 'client_ok') == 200;
+    }
+
+    ok GET_RC($url, cert => 'client_snakeoil') != 200;
+
+} else {
+    skip "skipping certificate extension test (httpd < $sslrequire_oid_needed_version)" foreach (1..3);
+}
diff --git a/debian/perl-framework/t/ssl/v2.t b/debian/perl-framework/t/ssl/v2.t
new file mode 100644
index 0000000..643c9d7
--- /dev/null
+++ b/debian/perl-framework/t/ssl/v2.t
@@ -0,0 +1,28 @@
+BEGIN {
+    $ENV{HTTPS_VERSION} = 2; #use SSLv2 instead of SSLv3
+}
+
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+
+plan tests => 1, need need_lwp,
+                      { "SSLv2 test(s) not applicable" =>
+                        sub { !need_min_apache_version('2.4.0') } };
+
+Apache::TestRequest::scheme('https');
+
+#just make sure the basics work for SSLv2
+ok GET_OK('/');
+
+#per-dir renegotiation does not work with SSLv2,
+#same breakage with apache-1.3.22+mod_ssl-2.8.5
+my $url = '/require/asf/index.html';
+
+#ok GET_RC($url, cert => undef) != 200;
+
+#ok GET_RC($url, cert => 'client_ok') == 200;
+
+#ok GET_RC($url, cert => 'client_revoked') != 200;
diff --git a/debian/perl-framework/t/ssl/varlookup.t b/debian/perl-framework/t/ssl/varlookup.t
new file mode 100644
index 0000000..126d442
--- /dev/null
+++ b/debian/perl-framework/t/ssl/varlookup.t
@@ -0,0 +1,261 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+use Apache::TestSSLCA qw(dn dn_oneline);
+
+unless (have_lwp) {
+    # bail out early, since the parser below relies on $LWP::VERSION
+    plan tests => 0, need_lwp;
+}
+
+use Time::localtime;
+
+my $config = Apache::Test::config();
+my $vars   = Apache::Test::vars();
+my $server = $config->server;
+my $time = localtime();
+
+(my $mmn = $config->{httpd_info}->{MODULE_MAGIC_NUMBER}) =~ s/:\d+$//;
+
+#Apache::TestRequest::scheme('https');
+local $vars->{scheme} = 'https';
+my $port = $config->port;
+my $rfc2253 = have_min_apache_version('2.3.11');
+
+my $url = '/test_ssl_var_lookup';
+my(%lookup, @vars);
+
+my %client_dn = dn('client_ok');
+
+my $client_dn = dn_oneline(\%client_dn, $rfc2253);
+
+my %client_i_dn = dn('ca');
+
+my $client_i_dn = dn_oneline(\%client_i_dn, $rfc2253);
+
+my %server_dn = dn('server');
+
+my $dgst = Apache::TestSSLCA::dgst();
+
+my $email_field = Apache::TestSSLCA::email_field();
+
+my $san_email = "$client_dn{$email_field}";
+
+my $san_dns = "$server_dn{CN}";
+
+my $san_msupn  = $san_email;
+
+my $san_dnssrv = "_https.$server_dn{CN}";
+
+if (not have_min_apache_version('2.4.13')) {
+    $san_email = $san_dns = "NULL";
+}
+
+if (not have_min_apache_version('2.4.17') or
+    Apache::Test::normalize_vstring(Apache::TestSSLCA::version()) <
+    Apache::Test::normalize_vstring("0.9.8")) {
+    $san_msupn = $san_dnssrv = "NULL";
+}
+
+# YYY will be turned into a pattern match: httpd-test/([-\w]+)
+# so we can test with different server keys/certs
+$server_dn{OU} = 'httpd-test/YYY';
+$server_dn{CN} = $vars->{servername};
+
+my $server_dn = dn_oneline(\%server_dn, $rfc2253);
+
+$server_dn     =~ s{(httpd-test.*?)YYY}{$1([-\\w]+)};
+$server_dn{OU} =~ s{(httpd-test.*?)YYY}{$1([-\\w]+)};
+
+my %server_i_dn = %client_i_dn;
+my $server_i_dn = $client_i_dn;
+
+my $cert_datefmt = '^\w{3} {1,2}\d{1,2} \d{2}:\d{2}:\d{2} \d{4} GMT$';
+
+while (<DATA>) {
+    chomp;
+    s/^\s+//; s/\s+$//;
+    s/\#.*//;
+    next unless $_;
+    my($key, $val) = split /\s+/, $_, 2;
+    next unless $key and $val;
+
+    if ($val =~ /^\"/) {
+        $val = eval qq($val);
+    }
+    elsif ($val =~ /^\'([^\']+)\'$/) {
+        $val = $1;
+    }
+    else {
+        $val = eval $val;
+    }
+
+    die $@ if $@;
+
+    $lookup{$key} = $val;
+    push @vars, $key;
+}
+
+if (not have_min_apache_version('2.4.32')) {
+    @vars = grep(!/_RAW/, @vars);
+}
+
+plan tests => scalar (@vars), need need_lwp, need_module('test_ssl');
+
+for my $key (@vars) {
+    sok { verify($key); };
+}
+
+sub verify {
+    my $key = shift;
+    my @headers;
+    if ($key eq 'HTTP_REFERER') {
+        push @headers, Referer => $0;
+    }
+    my $str = GET_BODY("$url?$key", cert => 'client_ok',
+                       @headers);
+    t_cmp($str, $lookup{$key}, "$key");
+}
+
+__END__
+#http://www.modssl.org/docs/2.8/ssl_reference.html#ToC23
+HTTP_USER_AGENT             "libwww-perl/$LWP::VERSION",
+HTTP:User-Agent             "libwww-perl/$LWP::VERSION",
+HTTP_REFERER                "$0"
+HTTP_COOKIE
+HTTP_FORWARDED
+HTTP_HOST                    Apache::TestRequest::hostport()
+HTTP_PROXY_CONNECTION
+HTTP_ACCEPT
+
+#standard CGI variables
+PATH_INFO
+AUTH_TYPE
+QUERY_STRING                'QUERY_STRING'
+SERVER_SOFTWARE             qr(^$server->{version})
+SERVER_ADMIN                $vars->{serveradmin}
+SERVER_PORT                 "$port"
+SERVER_NAME                 $vars->{servername}
+SERVER_PROTOCOL             qr(^HTTP/1\.\d$)
+REMOTE_IDENT
+REMOTE_ADDR                 $vars->{remote_addr}
+REMOTE_HOST
+REMOTE_USER
+DOCUMENT_ROOT               $vars->{documentroot}
+REQUEST_METHOD              'GET'
+REQUEST_URI                 $url
+
+#mod_ssl specific variables
+TIME_YEAR                    $time->year()+1900
+TIME_MON                     sprintf "%02d", $time->mon()+1
+TIME_DAY                     sprintf "%02d", $time->mday()
+TIME_WDAY                    $time->wday()
+TIME
+TIME_HOUR
+TIME_MIN
+TIME_SEC
+
+IS_SUBREQ                    'false'
+API_VERSION                  "$mmn"
+THE_REQUEST                  qr(^GET $url\?THE_REQUEST HTTP/1\.\d$)
+REQUEST_SCHEME               $vars->{scheme}
+REQUEST_FILENAME
+HTTPS                        'on'
+ENV:THE_ARGS                 'ENV:THE_ARGS'
+
+#XXX: should use Net::SSLeay to parse the certs
+#rather than just pattern match and hardcode
+
+SSL_CLIENT_M_VERSION         qr(^\d+$)
+SSL_SERVER_M_VERSION         qr(^\d+$)
+SSL_CLIENT_M_SERIAL          qr(^[0-9A-F]+$)
+SSL_SERVER_M_SERIAL          qr(^[0-9A-F]+$)
+SSL_PROTOCOL                 qr((TLS|SSL)v([1-3]|1\.[0-3])$)
+SSL_CLIENT_V_START           qr($cert_datefmt);
+SSL_SERVER_V_START           qr($cert_datefmt);
+SSL_SESSION_ID
+SSL_CLIENT_V_END             qr($cert_datefmt);
+SSL_SERVER_V_END             qr($cert_datefmt);
+SSL_CIPHER                   qr(^[A-Z0-9_-]+$)
+SSL_CIPHER_EXPORT            'false'
+SSL_CIPHER_ALGKEYSIZE        qr(^\d+$)
+SSL_CIPHER_USEKEYSIZE        qr(^\d+$)
+SSL_SECURE_RENEG             qr(^(false|true)$)
+
+SSL_CLIENT_S_DN              "$client_dn"
+SSL_SERVER_S_DN              qr(^$server_dn$)
+SSL_CLIENT_S_DN_C            "$client_dn{C}"
+SSL_SERVER_S_DN_C            "$server_dn{C}"
+SSL_CLIENT_S_DN_ST           "$client_dn{ST}"
+SSL_SERVER_S_DN_ST           "$server_dn{ST}"
+SSL_CLIENT_S_DN_L            "$client_dn{L}"
+SSL_SERVER_S_DN_L            "$server_dn{L}"
+SSL_CLIENT_S_DN_O            "$client_dn{O}"
+SSL_SERVER_S_DN_O            "$server_dn{O}"
+SSL_CLIENT_S_DN_OU           "$client_dn{OU}"
+SSL_SERVER_S_DN_OU           qr(^$server_dn{OU})
+SSL_CLIENT_S_DN_CN           "$client_dn{CN}"
+SSL_SERVER_S_DN_CN           "$server_dn{CN}"
+SSL_CLIENT_S_DN_T
+SSL_SERVER_S_DN_T
+SSL_CLIENT_S_DN_I
+SSL_SERVER_S_DN_I
+SSL_CLIENT_S_DN_G
+SSL_SERVER_S_DN_G
+SSL_CLIENT_S_DN_S
+SSL_SERVER_S_DN_S
+SSL_CLIENT_S_DN_D
+SSL_SERVER_S_DN_D
+SSL_CLIENT_S_DN_UID
+SSL_SERVER_S_DN_UID
+SSL_CLIENT_S_DN_Email        "$client_dn{$email_field}"
+SSL_SERVER_S_DN_Email        "$server_dn{$email_field}"
+SSL_CLIENT_SAN_Email_0       "$san_email"
+SSL_SERVER_SAN_DNS_0         "$san_dns"
+SSL_CLIENT_SAN_OTHER_msUPN_0 "$san_msupn"
+SSL_SERVER_SAN_OTHER_dnsSRV_0 "$san_dnssrv"
+
+SSL_CLIENT_I_DN              "$client_i_dn"
+SSL_SERVER_I_DN              "$server_i_dn"
+SSL_CLIENT_I_DN_C            "$client_i_dn{C}"
+SSL_SERVER_I_DN_C            "$server_i_dn{C}"
+SSL_CLIENT_I_DN_ST           "$client_i_dn{ST}"
+SSL_SERVER_I_DN_ST           "$server_i_dn{ST}"
+SSL_CLIENT_I_DN_L            "$client_i_dn{L}"
+SSL_SERVER_I_DN_L            "$server_i_dn{L}"
+SSL_CLIENT_I_DN_O            "$client_i_dn{O}"
+SSL_SERVER_I_DN_O            "$server_i_dn{O}"
+SSL_CLIENT_I_DN_OU           "$client_i_dn{OU}"
+SSL_SERVER_I_DN_OU           "$server_i_dn{OU}"
+SSL_CLIENT_I_DN_CN           "$client_i_dn{CN}"
+SSL_SERVER_I_DN_CN           "$server_i_dn{CN}"
+SSL_SERVER_I_DN_CN_RAW       "$server_i_dn{CN}"
+SSL_SERVER_I_DN_CN_0_RAW     "$server_i_dn{CN}"
+SSL_CLIENT_I_DN_T
+SSL_SERVER_I_DN_T
+SSL_CLIENT_I_DN_I
+SSL_SERVER_I_DN_I
+SSL_CLIENT_I_DN_G
+SSL_SERVER_I_DN_G
+SSL_CLIENT_I_DN_S
+SSL_SERVER_I_DN_S
+SSL_CLIENT_I_DN_D
+SSL_SERVER_I_DN_D
+SSL_CLIENT_I_DN_UID
+SSL_SERVER_I_DN_UID
+SSL_CLIENT_I_DN_Email        "$client_i_dn{$email_field}"
+SSL_SERVER_I_DN_Email        "$server_i_dn{$email_field}"
+SSL_CLIENT_A_SIG             "${dgst}WithRSAEncryption"
+SSL_SERVER_A_SIG             "${dgst}WithRSAEncryption"
+SSL_CLIENT_A_KEY             'rsaEncryption'
+SSL_SERVER_A_KEY             qr(^[rd]saEncryption$)
+SSL_CLIENT_CERT              qr(^-----BEGIN CERTIFICATE-----)
+SSL_SERVER_CERT              qr(^-----BEGIN CERTIFICATE-----)
+#SSL_CLIENT_CERT_CHAINn
+SSL_CLIENT_VERIFY            'SUCCESS'
+SSL_VERSION_LIBRARY
+SSL_VERSION_INTERFACE
+
diff --git a/debian/perl-framework/t/ssl/verify.t b/debian/perl-framework/t/ssl/verify.t
new file mode 100644
index 0000000..7bca845
--- /dev/null
+++ b/debian/perl-framework/t/ssl/verify.t
@@ -0,0 +1,39 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestConfig ();
+
+#if keepalives are on, renegotiation not happen again once
+#a client cert is presented.  so on test #3, the cert from #2
+#will be used.  this test scenerio would never
+#happen in real-life, so just disable keepalives here.
+Apache::TestRequest::user_agent_keepalive(0);
+
+my $url = '/verify/index.html';
+
+plan tests => 3, need_lwp;
+
+Apache::TestRequest::scheme('https');
+
+my $r;
+
+sok {
+    $r = GET $url, cert => undef;
+    print $r->as_string;
+    $r->code != 200;
+};
+
+sok {
+    $r = GET $url, cert => 'client_ok';
+    print $r->as_string;
+    $r->code == 200;
+};
+
+sok {
+    $r = GET $url, cert => 'client_revoked';
+    print $r->as_string;
+    $r->code != 200;
+};
+