-From 2f281b9def161d195da4d795fa916b686ac9fd87 Mon Sep 17 00:00:00 2001
-From: Alessandro Ghedini <alessandro@ghedini.me>
-Date: Tue, 13 Sep 2016 22:31:32 +0100
-Subject: [PATCH 1/6] bugfix: ssl: don't use SSLv3 in tests
-
-OpenSSL 1.1.0 disables SSLv3 by default. In order to disable SSL session
-tickets set ssl_session_tickets to off instead.
----
- t/142-ssl-session-store.t | 24 +++++++++++-------------
- t/143-ssl-session-fetch.t | 26 +++++++++++++-------------
- 2 files changed, 24 insertions(+), 26 deletions(-)
-
-diff --git a/t/142-ssl-session-store.t b/t/142-ssl-session-store.t
-index 5c9fad35..b5955199 100644
---- a/t/142-ssl-session-store.t
-+++ b/t/142-ssl-session-store.t
-@@ -32,7 +32,7 @@ __DATA__
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -102,7 +102,7 @@ ssl_session_store_by_lua_block:1: ssl session store by lua is running!
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -177,7 +177,7 @@ API disabled in the context of ssl_session_store_by_lua*
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -267,9 +267,9 @@ my timer run!
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name   test.com;
- 
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -335,9 +335,9 @@ API disabled in the context of ssl_session_store_by_lua*
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -407,9 +407,9 @@ ngx.exit does not yield and the error code is eaten.
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -480,9 +480,9 @@ ssl_session_store_by_lua*: handler return value: 0, sess new cb exit code: 0
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -548,9 +548,9 @@ should never reached here
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -621,7 +621,7 @@ get_phase: ssl_session_store
-         }
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -690,7 +690,7 @@ qr/elapsed in ssl cert by lua: 0.(?:09|1[01])\d+,/,
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -760,7 +760,6 @@ a.lua:1: ssl store session by lua is running!
-         ssl_session_store_by_lua_block {
-             print("handler in test.com")
-         }
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
- 
-@@ -770,7 +769,6 @@ a.lua:1: ssl store session by lua is running!
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
- 
-@@ -836,7 +834,7 @@ qr/\[emerg\] .*? "ssl_session_store_by_lua_block" directive is not allowed here
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-diff --git a/t/143-ssl-session-fetch.t b/t/143-ssl-session-fetch.t
-index bd800ff8..54f7a4a3 100644
---- a/t/143-ssl-session-fetch.t
-+++ b/t/143-ssl-session-fetch.t
-@@ -33,7 +33,7 @@ __DATA__
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -114,7 +114,7 @@ qr/ssl_session_fetch_by_lua_block:1: ssl fetch sess by lua is running!/s
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -198,7 +198,7 @@ qr/elapsed in ssl fetch session by lua: 0.(?:09|1[01])\d+,/,
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -297,9 +297,9 @@ qr/my timer run!/s
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name   test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -377,9 +377,9 @@ qr/received memc reply: OK/s
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -458,9 +458,9 @@ should never reached here
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -540,9 +540,9 @@ should never reached here
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -621,9 +621,9 @@ should never reached here
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -704,9 +704,9 @@ should never reached here
-     server {
-         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
-         server_name test.com;
--        ssl_protocols SSLv3;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -787,7 +787,7 @@ should never reached here
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -872,7 +872,7 @@ qr/get_phase: ssl_session_fetch/s
-         }
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -956,7 +956,7 @@ ssl store session by lua is running!
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
-@@ -1036,7 +1036,7 @@ qr/\S+:\d+: ssl fetch sess by lua is running!/s
-         server_name   test.com;
-         ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
-         ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
--        ssl_protocols SSLv3;
-+        ssl_session_tickets off;
- 
-         server_tokens off;
-     }
--- 
-2.11.0
-
-
 From ad8df79bccef37a0bbfd8e40283f3b81cd867760 Mon Sep 17 00:00:00 2001
 From: Alessandro Ghedini <alessandro@cloudflare.com>
 Date: Thu, 12 May 2016 13:12:23 +0100

-- 
2.11.0


From 97ca52b469fcf4881c06ab26fbc46cbd37d8cf9f Mon Sep 17 00:00:00 2001
From: Alessandro Ghedini <alessandro@ghedini.me>
Date: Mon, 28 Nov 2016 21:01:00 +0000
Subject: [PATCH 6/6] bugfix: ssl: don't use RC4 in tests

RC4 ciphers are deprecated and disabled by default in OpenSSL 1.1.0.
---
 t/129-ssl-socket.t | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/t/129-ssl-socket.t b/t/129-ssl-socket.t
index 98fb5a2b..1d9c5710 100644
--- a/t/129-ssl-socket.t
+++ b/t/129-ssl-socket.t
@@ -1129,7 +1129,7 @@ SSL reused session
             sock:settimeout(2000)
 
             do
-                local ok, err = sock:connect("iscribblet.org", 443)
+                local ok, err = sock:connect("openresty.org", 443)
                 if not ok then
                     ngx.say("failed to connect: ", err)
                     return
@@ -1137,7 +1137,7 @@ SSL reused session
 
                 ngx.say("connected: ", ok)
 
-                local session, err = sock:sslhandshake(nil, "iscribblet.org")
+                local session, err = sock:sslhandshake(nil, "openresty.org")
                 if not session then
                     ngx.say("failed to do SSL handshake: ", err)
                     return
@@ -1145,7 +1145,7 @@ SSL reused session
 
                 ngx.say("ssl handshake: ", type(session))
 
-                local req = "GET / HTTP/1.1\\r\\nHost: iscribblet.org\\r\\nConnection: close\\r\\n\\r\\n"
+                local req = "GET /en/ HTTP/1.1\\r\\nHost: openresty.org\\r\\nConnection: close\\r\\n\\r\\n"
                 local bytes, err = sock:send(req)
                 if not bytes then
                     ngx.say("failed to send http request: ", err)
@@ -1174,7 +1174,7 @@ GET /t
 --- response_body
 connected: 1
 ssl handshake: userdata
-sent http request: 59 bytes.
+sent http request: 61 bytes.
 received: HTTP/1.1 200 OK
 close: 1 nil
 
@@ -1185,8 +1185,8 @@ qr/^lua ssl save session: ([0-9A-F]+)
 lua ssl free session: ([0-9A-F]+)
 $/
 --- error_log
-lua ssl server name: "iscribblet.org"
-SSL: TLSv1.2, cipher: "ECDHE-RSA-RC4-SHA SSLv3
+lua ssl server name: "openresty.org"
+SSL: TLSv1.2, cipher: "ECDHE-RSA-AES128-GCM-SHA256
 --- no_error_log
 SSL reused session
 [error]
@@ -1199,7 +1199,7 @@ SSL reused session
 --- config
     server_tokens off;
     resolver $TEST_NGINX_RESOLVER;
-    lua_ssl_ciphers RC4-SHA;
+    lua_ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256;
     location /t {
         #set $port 5000;
         set $port $TEST_NGINX_MEMCACHED_PORT;
@@ -1266,7 +1266,7 @@ lua ssl free session: ([0-9A-F]+)
 $/
 --- error_log
 lua ssl server name: "iscribblet.org"
-SSL: TLSv1.2, cipher: "RC4-SHA SSLv3
+SSL: TLSv1.2, cipher: "ECDHE-RSA-AES128-GCM-SHA256
 --- no_error_log
 SSL reused session
 [error]
@@ -1346,7 +1346,7 @@ lua ssl free session: ([0-9A-F]+)
 $/
 --- error_log
 lua ssl server name: "iscribblet.org"
-SSL: TLSv1, cipher: "ECDHE-RSA-RC4-SHA SSLv3
+SSL: TLSv1
 --- no_error_log
 SSL reused session
 [error]
-- 
2.11.0


 
         ngx_ssl_free_session(*psession);
     }
-- 
2.11.0

