summaryrefslogtreecommitdiffstats
path: root/tests/conf/test-srv-verify.cfg
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-13 12:18:05 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-13 12:18:05 +0000
commitb46aad6df449445a9fc4aa7b32bd40005438e3f7 (patch)
tree751aa858ca01f35de800164516b298887382919d /tests/conf/test-srv-verify.cfg
parentInitial commit. (diff)
downloadhaproxy-b46aad6df449445a9fc4aa7b32bd40005438e3f7.tar.xz
haproxy-b46aad6df449445a9fc4aa7b32bd40005438e3f7.zip
Adding upstream version 2.9.5.upstream/2.9.5
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'tests/conf/test-srv-verify.cfg')
-rw-r--r--tests/conf/test-srv-verify.cfg57
1 files changed, 57 insertions, 0 deletions
diff --git a/tests/conf/test-srv-verify.cfg b/tests/conf/test-srv-verify.cfg
new file mode 100644
index 0000000..e3ccc83
--- /dev/null
+++ b/tests/conf/test-srv-verify.cfg
@@ -0,0 +1,57 @@
+global
+ maxconn 490
+ stats socket /tmp/sock1 mode 666 level admin
+ stats timeout 10m
+ ssl-server-verify none
+ tune.ssl.default-dh-param 1024
+ log /dev/log local0 debug info
+
+defaults
+ mode http
+ log global
+ option httplog
+ option dontlognull
+ timeout connect 5s
+ timeout http-keep-alive 15s
+ timeout http-request 15s
+ timeout queue 30s
+ timeout tarpit 1m
+ timeout tunnel 300s
+ timeout client 30s
+ timeout server 60s
+
+listen 1
+ bind :8001
+
+ # passes checks and traffic (no hostname check)
+ # server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem
+
+ # passes checks and traffic (localhost is what the server presents)
+ # server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem verifyhost localhost
+
+ # fails checks and traffic (foo not matched on the server)
+ # server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem verifyhost foo
+
+ # passes checks and traffic (verify none ignores the host)
+ # server ssl 127.0.0.1:8443 ssl verify none check inter 500 ca-file rsa2048.pem verifyhost foo
+
+ # passes checks and traffic (localhost is fine)
+ # server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem sni str(localhost) verifyhost localhost
+
+ # passes checks and traffic (verifyhost overrides sni)
+ # server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem sni str(foo) verifyhost localhost
+
+ # passes checks and traffic (localhost always valid)
+ # server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem sni str(localhost)
+
+ # passes checks, and traffic without host or with "host: localhost" and fails other hosts.
+ server ssl 127.0.0.1:8443 ssl verify required check inter 500 ca-file rsa2048.pem sni req.hdr(host)
+
+ # just for tests
+ #server clear 127.0.0.1:8480
+
+listen 2
+ bind :8480
+ bind :8443 ssl crt rsa2048.pem
+ stats uri /
+