mod_ssl/request-body-buffer-with-TLSv1-3-PHA test added

mod_ssl/request-body-buffer-with-TLSv1-3-PHA/Makefile

@@ -0,0 +1,65 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/httpd/Regression/bz1775158-mod_ssl-request-body-buffer-with-TLSv1-3-PHA
+#   Description: Test for BZ#1775158 (POST request with TLS 1.3 PHA client auth fails)
+#   Author: Joe Orton <jorton@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2019 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/httpd/Regression/bz1775158-mod_ssl-request-body-buffer-with-TLSv1-3-PHA
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE httpd.conf perl_echo.pl
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Joe Orton <jorton@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     Test for BZ#1775158 (POST request with TLS 1.3 PHA client auth fails)" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        5m" >> $(METADATA)
+	@echo "RunFor:          httpd mod_ssl" >> $(METADATA)
+	@echo "Requires:        httpd mod_ssl curl perl" >> $(METADATA)
+	@echo "RhtsRequires:    library(httpd/http)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2+" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Bug:             1775158" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
+
+	rhts-lint $(METADATA)

mod_ssl/request-body-buffer-with-TLSv1-3-PHA/PURPOSE

@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/httpd/Regression/bz1775158-mod_ssl-request-body-buffer-with-TLSv1-3-PHA
+Description: Test for BZ#1775158 (POST request with TLS 1.3 PHA client auth fails)
+Author: Joe Orton <jorton@redhat.com>
+Bug summary: POST request with TLS 1.3 PHA client auth fails: Re-negotiation handshake failed: Client certificate missing
+Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1775158

mod_ssl/request-body-buffer-with-TLSv1-3-PHA/httpd.conf

@@ -0,0 +1,18 @@
+
+SSLCACertificateFile conf/rhts-ca.crt
+
+<Location /rhts-pha-any>
+   SSLVerifyClient on
+   SSLVerifyDepth 10
+</Location>
+
+<Location /rhts-pha-small>
+   SSLVerifyClient on
+   SSLVerifyDepth 10
+   SSLRenegBufferSize 512
+</Location>
+
+ScriptAlias /rhts-pha-any @CGIDIR@
+ScriptAlias /rhts-pha-small @CGIDIR@
+
+LogLevel ssl_module:trace7

mod_ssl/request-body-buffer-with-TLSv1-3-PHA/main.fmf

@@ -0,0 +1,34 @@
+summary: Test for BZ#1775158 (POST request with TLS 1.3 PHA client auth fails)
+description: |
+    Bug summary: POST request with TLS 1.3 PHA client auth fails: Re-negotiation handshake failed: Client certificate missing
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1775158
+contact: Maryna Nalbandian <mnalband@redhat.com>
+component:
+- mod_ssl
+- httpd
+test: ./runtest.sh
+framework: beakerlib
+require:
+- library(httpd/http)
+recommend:
+- httpd
+- mod_ssl
+- curl
+- perl
+duration: 5m
+enabled: true
+tier: '1'
+adjust:
+-   enabled: false
+    when: distro < rhel-8
+    continue: false
+-   enabled: false
+    when: distro == rhel-alt-7
+    continue: false
+-   because: fixed in 8.2
+    enabled: false
+    when: distro ~< rhel-8.2
+    continue: false
+extra-nitrate: TC#0605161
+extra-summary: /CoreOS/httpd/Regression/bz1775158-mod_ssl-request-body-buffer-with-TLSv1-3-PHA
+extra-task: /CoreOS/httpd/Regression/bz1775158-mod_ssl-request-body-buffer-with-TLSv1-3-PHA

mod_ssl/request-body-buffer-with-TLSv1-3-PHA/perl_echo.pl

@@ -0,0 +1,14 @@
+#!/usr/bin/perl
+
+print "Content-type: text/plain\n\n";
+
+if (my $ct = $ENV{CONTENT_LENGTH}) {
+    read STDIN, my $buffer, $ct;
+    print $buffer;
+}
+elsif (my $qs = $ENV{QUERY_STRING}) {
+    print $qs;
+}
+else {
+    print "nada";
+}

mod_ssl/request-body-buffer-with-TLSv1-3-PHA/runtest.sh

@@ -0,0 +1,98 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/httpd/Regression/bz1775158-mod_ssl-request-body-buffer-with-TLSv1-3-PHA
+#   Description: Test for BZ#1775158 (POST request with TLS 1.3 PHA client auth fails)
+#   Author: Joe Orton <jorton@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2019 Red Hat, Inc.
+#
+#   This program is free software: you can redistribute it and/or
+#   modify it under the terms of the GNU General Public License as
+#   published by the Free Software Foundation, either version 2 of
+#   the License, or (at your option) any later version.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE.  See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public License
+#   along with this program. If not, see http://www.gnu.org/licenses/.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGES=${PACKAGES:-"httpd"}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm --all
+        rlImport httpd/http || rlDie
+
+        rlRun "CGI=`realpath ${httpROOTDIR}/../cgi-bin`"
+        rlRun "CAFILE=${httpCONFDIR}/conf/rhts-ca.crt"
+        rlRun "CONF=${httpCONFDIR}/conf.d/rhts-ssl-pha2.conf"
+
+        rlRun "rlFileBackup ${httpCONFDIR}/conf.d/ssl.conf"
+        rlRun "sed s,@CGIDIR@,${CGI}, < httpd.conf > $CONF"
+        rlRun "cp perl_echo.pl ${CGI}/rhts-echo.pl"
+        rlRun "chmod +x ${CGI}/rhts-echo.pl"
+        rlRun "sed -i 's,LogLevel warn,LogLevel ssl_module:trace7,' ${httpCONFDIR}/conf.d/ssl.conf"
+        
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlRun "x509KeyGen ca" 0 "Creating CA key & certificate"
+        rlRun "x509KeyGen client" 0 "Creating client key & certificate"
+        rlRun "x509SelfSign ca --DN 'CN=test' --DN 'O=test' --subjectAltName 'DNS.1=$httpSSL_CN'" \
+              0 "Self-signing CA certificate"
+        rlRun "x509CertSign --CA ca -t webclient client --DN 'CN=rhts-pha-client' --DN 'O=$httpSSL_O'" \
+              0 "Signing client certificate"
+        rlRun "cp $(x509Cert ca) ${CAFILE}"
+
+        rlRun "dd if=/dev/urandom of=test-data bs=1024 count=10"
+
+        rlRun "> ${httpLOGDIR}/ssl_error_log"
+        rlRun "httpsStart"
+        rlRun "URL=https://$httpSSL_CN"
+
+        # Need to suppress Expect: 100-continue support in curl here,
+        # which otherwise prevents triggering the issue.
+        rlRun "CURL=\"curl -H Expect: --cacert $httpROOTDIR/ca.crt --data-binary @test-data --tlsv1.3\""
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        # Plain TLS with no client cert required - no PHA required.
+        rlRun "${CURL} ${URL}/cgi-bin/rhts-echo.pl > output"
+        rlAssertNotDiffer output test-data
+
+        # Client cert is required for this location, so should get a
+        # TLS certificate required error.
+        rlRun "${CURL} ${URL}/rhts-pha-any/rhts-echo.pl > output.2 2>stderr.2" 56 "Client cert required failure"
+        rlAssertGrep 'alert certificate required' stderr.2
+
+        rlRun "${CURL} --cert $(x509Cert client) --key $(x509Key client) ${URL}/rhts-pha-any/rhts-echo.pl > output.3" 
+        rlAssertNotDiffer output.3 test-data
+
+        # For this location the buffer size is limited to 512 bytes;
+        # it can't buffer the 10K request body and should give a 413
+        # error.        
+        rlRun "${CURL} --cert $(x509Cert client) --key $(x509Key client) ${URL}/rhts-pha-small/rhts-echo.pl > output.4"
+        rlAssertGrep '413 Request Entity Too Large' output.4
+
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "httpsStop"
+        rlRun "popd"
+        rlRun "rlFileRestore"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+        rlRun "rm -f $CAFILE $CONF $CGI/rhts-echo.pl" 
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd