tests: added a test case for TLS-PSK upstream and downstream.

Author: Tuure Vartiainen

t/140-ssl-c-api.t

@@ -62,6 +62,15 @@ ffi.cdef[[
     void ngx_http_lua_ffi_free_priv_key(void *cdata);
 
     int ngx_http_lua_ffi_ssl_clear_certs(void *r, char **err);
+
+    int ngx_http_lua_ffi_ssl_set_psk_key(void *r,
+        const char *key, size_t len, char **err);
+
+    int ngx_http_lua_ffi_ssl_get_psk_identity(void *r,
+        char *buf, char **err);
+
+    int ngx_http_lua_ffi_ssl_get_psk_identity_size(void *r,
+        char **err);
 ]]
 _EOC_
     }
@@ -811,3 +820,150 @@ lua ssl server name: "test.com"
 --- no_error_log
 [error]
 [alert]
+
+
+
+=== TEST 6: TLS-PSK
+--- http_config
+    server {
+        listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+        server_name   test.com;
+
+        ssl_psk_by_lua_block {
+            collectgarbage()
+
+            local ffi = require "ffi"
+            require "defines"
+
+            local errmsg = ffi.new("char *[1]")
+
+            local r = getfenv(0).__ngx_req
+            if not r then
+                ngx.log(ngx.ERR, "no request found")
+                return
+            end
+
+            local len = ffi.C.ngx_http_lua_ffi_ssl_get_psk_identity_size(r, errmsg)
+
+            if len < 0 then
+                ngx.log(ngx.ERR, "failed to get psk identity size: ", ffi.string(errmsg[0]))
+                return
+            end
+
+            if len > 4096 then
+                 ngx.log(ngx.ERR, "psk identity size too long")
+                 return
+            end
+
+            local buf = ffi.new("char[?]", 4096)
+
+            local rc = ffi.C.ngx_http_lua_ffi_ssl_get_psk_identity(r, buf, errmsg)
+            if rc ~= 0 then
+                ngx.log(ngx.ERR, "failed to get psk identity: ", ffi.string(errmsg[0]))
+                return
+            end
+
+            local psk_identity = ffi.string(buf, len)
+            if not psk_identity then
+                ngx.log(ngx.ERR, "psk_identity is undefined")
+                return
+            end
+
+            local psk_key = "psk_test_key"
+
+            local rc = ffi.C.ngx_http_lua_ffi_ssl_set_psk_key(r, psk_key, #psk_key, errmsg)
+            if rc ~= 0 then
+                ngx.log(ngx.ERR, "failed to set psk key: ", ffi.string(errmsg[0]))
+                return
+            end
+        }
+
+        ssl_certificate ../../cert/test.crt;
+        ssl_certificate_key ../../cert/test.key;
+
+        lua_ssl_psk_identity psk_test_identity_hint;
+
+        server_tokens off;
+        location /foo {
+            default_type 'text/plain';
+            content_by_lua_block { ngx.status = 201 ngx.say("foo") ngx.exit(201) }
+            more_clear_headers Date;
+        }
+    }
+--- config
+    server_tokens off;
+
+    location /t {
+        lua_ssl_ciphers PSK-AES256-CBC-SHA;
+        lua_ssl_psk_identity psk_test_identity;
+        lua_ssl_psk_key psk_test_key;
+
+        content_by_lua_block {
+            do
+                local sock = ngx.socket.tcp()
+
+                sock:settimeout(2000)
+
+                local ok, err = sock:connect("unix:$TEST_NGINX_HTML_DIR/nginx.sock")
+                if not ok then
+                    ngx.say("failed to connect: ", err)
+                    return
+                end
+
+                ngx.say("connected: ", ok)
+
+                local sess, err = sock:sslhandshake(nil, "test.com", false)
+                if not sess then
+                    ngx.say("failed to do SSL handshake: ", err)
+                    return
+                end
+
+                ngx.say("ssl handshake: ", type(sess))
+
+                local req = "GET /foo HTTP/1.0\r\nHost: test.com\r\nConnection: close\r\n\r\n"
+                local bytes, err = sock:send(req)
+                if not bytes then
+                    ngx.say("failed to send http request: ", err)
+                    return
+                end
+
+                ngx.say("sent http request: ", bytes, " bytes.")
+
+                while true do
+                    local line, err = sock:receive()
+                    if not line then
+                        -- ngx.say("failed to recieve response status line: ", err)
+                        break
+                    end
+
+                    ngx.say("received: ", line)
+                end
+
+                local ok, err = sock:close()
+                ngx.say("close: ", ok, " ", err)
+            end  -- do
+            -- collectgarbage()
+        }
+    }
+
+--- request
+GET /t
+--- response_body
+connected: 1
+ssl handshake: userdata
+sent http request: 56 bytes.
+received: HTTP/1.1 201 Created
+received: Server: nginx
+received: Content-Type: text/plain
+received: Content-Length: 4
+received: Connection: close
+received: 
+received: foo
+close: 1 nil
+
+--- error_log
+lua ssl server name: "test.com"
+
+--- no_error_log
+[error]
+[alert]