From fb8f0baeb470bc48bb4062c64191ec7514e0b775 Mon Sep 17 00:00:00 2001
From: Maxim Dounin <mdounin@mdounin.ru>
Date: Thu, 21 Aug 2025 04:46:24 +0300
Subject: [PATCH] Tests: iPAddress subjectAltName tests.

Origin: <https://freenginx.org/hg/nginx-tests/rev/1bf186036193>
Signed-off-by: Eugene Grebenshchikov <e.grebenshchikov@f5.com>
---
 proxy_ssl_verify.t | 44 ++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 42 insertions(+), 2 deletions(-)

diff --git a/proxy_ssl_verify.t b/proxy_ssl_verify.t
index 5d8a3f5a..49fc5f58 100644
--- a/proxy_ssl_verify.t
+++ b/proxy_ssl_verify.t
@@ -23,7 +23,7 @@ select STDERR; $| = 1;
 select STDOUT; $| = 1;
 
 my $t = Test::Nginx->new()->has(qw/http http_ssl proxy/)
-	->has_daemon('openssl')->plan(6)
+	->has_daemon('openssl')->plan(10)
 	->write_file_expand('nginx.conf', <<'EOF');
 
 %%TEST_GLOBALS%%
@@ -81,6 +81,33 @@ http {
             proxy_ssl_trusted_certificate 1.example.com.crt;
             proxy_ssl_session_reuse off;
         }
+
+        location /ip {
+            proxy_pass https://127.0.0.1:8081/;
+            proxy_ssl_verify on;
+            proxy_ssl_trusted_certificate 1.example.com.crt;
+        }
+
+        location /ip/fail {
+            proxy_pass https://127.0.0.1:8081/;
+            proxy_ssl_name 127.0.0.2;
+            proxy_ssl_verify on;
+            proxy_ssl_trusted_certificate 1.example.com.crt;
+        }
+
+        location /ip6 {
+            proxy_pass https://127.0.0.1:8081/;
+            proxy_ssl_name [::1];
+            proxy_ssl_verify on;
+            proxy_ssl_trusted_certificate 1.example.com.crt;
+        }
+
+        location /ip6/fail {
+            proxy_pass https://127.0.0.1:8081/;
+            proxy_ssl_name [::2];
+            proxy_ssl_verify on;
+            proxy_ssl_trusted_certificate 1.example.com.crt;
+        }
     }
 
     server {
@@ -118,7 +145,7 @@ x509_extensions = v3_req
 commonName=no.match.example.com
 
 [ v3_req ]
-subjectAltName = DNS:example.com,DNS:*.example.com
+subjectAltName = DNS:example.com,DNS:*.example.com,IP:127.0.0.1,IP:::1
 EOF
 
 $t->write_file('openssl.2.example.com.conf', <<EOF);
@@ -165,4 +192,17 @@ like(http_get('/cn/fail'), qr/502 Bad/ms, 'verify cn fail');
 
 like(http_get('/untrusted'), qr/502 Bad/ms, 'untrusted');
 
+# subjectAltName iPAddress
+
+TODO: {
+local $TODO = 'not yet' unless $t->has_version('1.31.0');
+
+like(http_get('/ip'), qr/200 OK/ms, 'verify ipv4');
+like(http_get('/ip6'), qr/200 OK/ms, 'verify ipv6');
+
+}
+
+like(http_get('/ip/fail'), qr/502 Bad/ms, 'verify ipv4 fail');
+like(http_get('/ip6/fail'), qr/502 Bad/ms, 'verify ipv6 fail');
+
 ###############################################################################