nginx-tests: ssl_stapling.t annotate

annotate ssl_stapling.t @ 1400:94bcad5611af

Tests: skip OCSP stapling and multiple cert tests with BoringSSL.

author	Sergey Kandaurov <pluknet@nginx.com>
date	Mon, 19 Nov 2018 19:28:15 +0300
parents	d3d2aabe16dd
children	8c764fd93b5e

rev	line source
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	1 #!/usr/bin/perl
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	2
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	3 # (C) Sergey Kandaurov
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	4 # (C) Nginx, Inc.
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	5
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	6 # Tests for OCSP stapling.
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	7
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	8 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	9
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	10 use warnings;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	11 use strict;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	12
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	13 use Test::More;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	14
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	15 use MIME::Base64 qw/ decode_base64 /;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	16
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	17 BEGIN { use FindBin; chdir($FindBin::Bin); }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	18
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	19 use lib 'lib';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	20 use Test::Nginx;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	21
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	22 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	23
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	24 select STDERR; $\| = 1;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	25 select STDOUT; $\| = 1;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	26
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	27 eval {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	28 require Net::SSLeay;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	29 Net::SSLeay::load_error_strings();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	30 Net::SSLeay::SSLeay_add_ssl_algorithms();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	31 Net::SSLeay::randomize();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	32 Net::SSLeay::SSLeay();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	33 defined &Net::SSLeay::set_tlsext_status_type or die;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	34 };
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	35 plan(skip_all => 'Net::SSLeay not installed or too old') if $@;
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	36
1400 94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 1397 diff changeset	37 my $t = Test::Nginx->new()->has(qw/http http_ssl/)->has_daemon('openssl');
94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 1397 diff changeset	38
94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 1397 diff changeset	39 plan(skip_all => 'no OCSP stapling') if $t->has_module('BoringSSL');
94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 1397 diff changeset	40
94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 1397 diff changeset	41 $t->plan(9)->write_file_expand('nginx.conf', <<'EOF');
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	42
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	43 %%TEST_GLOBALS%%
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	44
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	45 daemon off;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	46
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	47 events {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	48 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	49
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	50 http {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	51 %%TEST_GLOBALS_HTTP%%
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	52
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	53 ssl_stapling on;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	54 ssl_trusted_certificate trusted.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	55
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	56 ssl_certificate ec-end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	57 ssl_certificate_key ec-end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	58
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	59 ssl_certificate end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	60 ssl_certificate_key end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	61
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	62 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	63 listen 127.0.0.1:8443 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	64 listen 127.0.0.1:8080;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	65 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	66 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	67
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	68 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	69 listen 127.0.0.1:8444 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	70 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	71
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	72 ssl_stapling_responder http://127.0.0.1:8081/;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	73 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	74
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	75 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	76 listen 127.0.0.1:8445 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	77 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	78
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	79 ssl_stapling_verify on;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	80 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	81
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	82 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	83 listen 127.0.0.1:8446 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	84 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	85
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	86 ssl_certificate ec-end.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	87 ssl_certificate_key ec-end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	88 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	89
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	90 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	91 listen 127.0.0.1:8447 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	92 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	93
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	94 ssl_certificate end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	95 ssl_certificate_key end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	96
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	97 ssl_stapling_file %%TESTDIR%%/resp.der;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	98 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	99
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	100 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	101 listen 127.0.0.1:8448 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	102 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	103
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	104 ssl_certificate ec-end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	105 ssl_certificate_key ec-end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	106
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	107 ssl_stapling_file %%TESTDIR%%/ec-resp.der;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	108 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	109
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	110 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	111 listen 127.0.0.1:8449 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	112 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	113
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	114 ssl_stapling_responder http://127.0.0.1:8080/;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	115 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	116 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	117
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	118 EOF
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	119
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	120 my $d = $t->testdir();
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	121 my $p = port(8081);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	122
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	123 $t->write_file('openssl.conf', <<EOF);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	124 [ req ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	125 default_bits = 1024
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	126 encrypt_key = no
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	127 distinguished_name = req_distinguished_name
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	128 [ req_distinguished_name ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	129 EOF
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	130
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	131 $t->write_file('ca.conf', <<EOF);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	132 [ ca ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	133 default_ca = myca
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	134
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	135 [ myca ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	136 new_certs_dir = $d
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	137 database = $d/certindex
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	138 default_md = sha1
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	139 policy = myca_policy
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	140 serial = $d/certserial
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	141 default_days = 1
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	142 x509_extensions = myca_extensions
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	143
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	144 [ myca_policy ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	145 commonName = supplied
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	146
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	147 [ myca_extensions ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	148 basicConstraints = critical,CA:TRUE
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	149 authorityInfoAccess = OCSP;URI:http://127.0.0.1:$p
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	150 EOF
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	151
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	152 foreach my $name ('root') {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	153 system('openssl req -x509 -new '
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	154 . "-config $d/openssl.conf -subj /CN=$name/ "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	155 . "-out $d/$name.crt -keyout $d/$name.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	156 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	157 or die "Can't create certificate for $name: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	158 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	159
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	160 foreach my $name ('int', 'end') {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	161 system("openssl req -new "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	162 . "-config $d/openssl.conf -subj /CN=$name/ "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	163 . "-out $d/$name.csr -keyout $d/$name.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	164 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	165 or die "Can't create certificate for $name: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	166 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	167
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	168 foreach my $name ('ec-end') {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	169 system("openssl ecparam -genkey -out $d/$name.key -name prime256v1 "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	170 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	171 or die "Can't create EC param: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	172 system("openssl req -new -key $d/$name.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	173 . "-config $d/openssl.conf -subj /CN=$name/ "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	174 . "-out $d/$name.csr "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	175 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	176 or die "Can't create certificate for $name: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	177 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	178
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	179 $t->write_file('certserial', '1000');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	180 $t->write_file('certindex', '');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	181
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	182 system("openssl ca -batch -config $d/ca.conf "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	183 . "-keyfile $d/root.key -cert $d/root.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	184 . "-subj /CN=int/ -in $d/int.csr -out $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	185 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	186 or die "Can't sign certificate for int: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	187
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	188 system("openssl ca -batch -config $d/ca.conf "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	189 . "-keyfile $d/int.key -cert $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	190 . "-subj /CN=ec-end/ -in $d/ec-end.csr -out $d/ec-end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	191 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	192 or die "Can't sign certificate for ec-end: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	193
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	194 system("openssl ca -batch -config $d/ca.conf "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	195 . "-keyfile $d/int.key -cert $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	196 . "-subj /CN=end/ -in $d/end.csr -out $d/end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	197 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	198 or die "Can't sign certificate for end: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	199
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	200 # RFC 6960, serialNumber
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	201
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	202 system("openssl x509 -in $d/end.crt -serial -noout "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	203 . ">>$d/serial 2>>$d/openssl.out") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	204 or die "Can't obtain serial for end: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	205
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	206 my $serial = pack("n2", 0x0202, hex $1) if $t->read_file('serial') =~ /(\d+)/;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	207
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	208 system("openssl ca -config $d/ca.conf -revoke $d/end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	209 . "-keyfile $d/root.key -cert $d/root.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	210 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	211 or die "Can't revoke end.crt: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	212
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	213 system("openssl ocsp -issuer $d/int.crt -cert $d/end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	214 . "-reqout $d/req.der >>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	215 or die "Can't create OCSP request: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	216
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	217 system("openssl ocsp -index $d/certindex -CA $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	218 . "-rsigner $d/root.crt -rkey $d/root.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	219 . "-reqin $d/req.der -respout $d/resp.der -ndays 1 "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	220 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	221 or die "Can't create OCSP response: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	222
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	223 system("openssl ocsp -issuer $d/int.crt -cert $d/ec-end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	224 . "-reqout $d/ec-req.der >>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	225 or die "Can't create EC OCSP request: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	226
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	227 system("openssl ocsp -index $d/certindex -CA $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	228 . "-rsigner $d/root.crt -rkey $d/root.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	229 . "-reqin $d/ec-req.der -respout $d/ec-resp.der -ndays 1 "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	230 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	231 or die "Can't create EC OCSP response: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	232
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	233 $t->write_file('trusted.crt',
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	234 $t->read_file('int.crt') . $t->read_file('root.crt'));
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	235 $t->write_file('end-int.crt',
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	236 $t->read_file('end.crt') . $t->read_file('int.crt'));
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	237 $t->write_file('ec-end-int.crt',
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	238 $t->read_file('ec-end.crt') . $t->read_file('int.crt'));
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	239
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	240 $t->run_daemon(\&http_daemon, $t);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	241 $t->run();
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	242
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	243 $t->waitforsocket("127.0.0.1:" . port(8081));
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	244
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	245 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	246
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	247 my $version = get_version();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	248
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	249 staple(8443, 'RSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	250 staple(8443, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	251 staple(8444, 'RSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	252 staple(8444, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	253 staple(8445, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	254 staple(8446, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	255 staple(8449, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	256
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	257 sleep 1;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	258
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	259 ok(!staple(8443, 'RSA'), 'staple revoked');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	260 ok(staple(8443, 'ECDSA'), 'staple success');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	261
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	262 ok(!staple(8444, 'RSA'), 'responder revoked');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	263 ok(staple(8444, 'ECDSA'), 'responder success');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	264
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	265 ok(!staple(8445, 'ECDSA'), 'verify - root not trusted');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	266
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	267 ok(staple(8446, 'ECDSA', "$d/int.crt"), 'cert store');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	268
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	269 is(staple(8447, 'RSA'), '1 1', 'file revoked');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	270 is(staple(8448, 'ECDSA'), '1 0', 'file success');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	271
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	272 ok(!staple(8449, 'ECDSA'), 'ocsp error');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	273
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	274 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	275
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	276 sub staple {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	277 my ($port, $ciphers, $ca) = @_;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	278 my (@resp);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	279
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	280 my $staple_cb = sub {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	281 my ($ssl, $resp) = @_;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	282 push @resp, !!$resp;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	283 return 1 unless $resp;
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	284 my $cert = Net::SSLeay::get_peer_certificate($ssl);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	285 my $certid = eval { Net::SSLeay::OCSP_cert2ids($ssl, $cert) }
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	286 or do { die "no OCSP_CERTID for certificate: $@"; };
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	287
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	288 my @res = Net::SSLeay::OCSP_response_results($resp, $certid);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	289 push @resp, $res[0][2]->{'statusType'};
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	290 };
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	291
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	292 my $s;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	293
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	294 eval {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	295 local $SIG{ALRM} = sub { die "timeout\n" };
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	296 local $SIG{PIPE} = sub { die "sigpipe\n" };
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	297 alarm(2);
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	298 $s = IO::Socket::INET->new('127.0.0.1:' . port($port));
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	299 alarm(0);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	300 };
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	301 alarm(0);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	302
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	303 if ($@) {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	304 log_in("died: $@");
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	305 return undef;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	306 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	307
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	308 my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	309
1397 d3d2aabe16dd Tests: LibreSSL client detection in multiple certificate tests. Sergey Kandaurov <pluknet@nginx.com> parents: 1389 diff changeset	310 my $ssleay = Net::SSLeay::SSLeay();
d3d2aabe16dd Tests: LibreSSL client detection in multiple certificate tests. Sergey Kandaurov <pluknet@nginx.com> parents: 1389 diff changeset	311 if ($ssleay < 0x1000200f \|\| $ssleay == 0x20000000) {
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	312 Net::SSLeay::CTX_set_cipher_list($ctx, $ciphers)
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	313 or die("Failed to set cipher list");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	314 } else {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	315 # SSL_CTRL_SET_SIGALGS_LIST
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	316 $ciphers = 'PSS' if $ciphers eq 'RSA' && $version > 0x0303;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	317 Net::SSLeay::CTX_ctrl($ctx, 98, 0, $ciphers . '+SHA256')
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	318 or die("Failed to set sigalgs");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	319 }
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	320
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	321 Net::SSLeay::CTX_load_verify_locations($ctx, $ca \|\| '', '');
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	322 Net::SSLeay::CTX_set_tlsext_status_cb($ctx, $staple_cb);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	323 my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	324 Net::SSLeay::set_tlsext_status_type($ssl,
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	325 Net::SSLeay::TLSEXT_STATUSTYPE_ocsp());
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	326 Net::SSLeay::set_fd($ssl, fileno($s));
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	327 Net::SSLeay::connect($ssl) or die("ssl connect");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	328
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	329 return join ' ', @resp;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	330 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	331
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	332 sub get_version {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	333 my $s;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	334
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	335 eval {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	336 local $SIG{ALRM} = sub { die "timeout\n" };
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	337 local $SIG{PIPE} = sub { die "sigpipe\n" };
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	338 alarm(2);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	339 $s = IO::Socket::INET->new('127.0.0.1:' . port(8443));
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	340 alarm(0);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	341 };
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	342 alarm(0);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	343
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	344 if ($@) {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	345 log_in("died: $@");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	346 return undef;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	347 }
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	348
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	349 my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	350 my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	351 Net::SSLeay::set_fd($ssl, fileno($s));
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	352 Net::SSLeay::connect($ssl) or die("ssl connect");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	353
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	354 Net::SSLeay::version($ssl);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	355 }
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	356
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	357 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	358
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	359 sub http_daemon {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	360 my ($t) = shift;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	361 my $server = IO::Socket::INET->new(
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	362 Proto => 'tcp',
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	363 LocalHost => "127.0.0.1:" . port(8081),
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	364 Listen => 5,
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	365 Reuse => 1
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	366 )
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	367 or die "Can't create listening socket: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	368
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	369 local $SIG{PIPE} = 'IGNORE';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	370
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	371 while (my $client = $server->accept()) {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	372 $client->autoflush(1);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	373
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	374 my $headers = '';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	375 my $uri = '';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	376
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	377 while (<$client>) {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	378 $headers .= $_;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	379 last if (/^\x0d?\x0a?$/);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	380 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	381
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	382 $uri = $1 if $headers =~ /^\S+\s+\/([^ ]+)\s+HTTP/i;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	383 next unless $uri;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	384
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	385 $uri =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	386 my $req = decode_base64($uri);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	387 my $resp = index($req, $serial) > 0 ? 'resp' : 'ec-resp';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	388
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	389 # ocsp dummy handler
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	390
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	391 select undef, undef, undef, 0.02;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	392
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	393 $headers = <<"EOF";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	394 HTTP/1.1 200 OK
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	395 Connection: close
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	396 Content-Type: application/ocsp-response
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	397
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	398 EOF
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	399
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	400 print $client $headers . $t->read_file("$resp.der");
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	401 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	402 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	403
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	404 ###############################################################################

Mercurial > hg > nginx-tests

annotate ssl_stapling.t @ 1400:94bcad5611af