Mercurial > hg > nginx-tests

annotate ssl_stapling.t @ 1427:eb1d883305ea

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Tests: avoid edge cases in upstream random two test. Unavailable servers contribute to the number of attempts, if selected, before the balancer would fall back to the default round-robin method. This means that it's quite possible to get server with more connections. To facilitate with selecting two alive servers, down server was removed from the upstream configuration at the cost of slightly worse coverage.
author Sergey Kandaurov <pluknet@nginx.com>
date Thu, 10 Jan 2019 17:42:34 +0300
parents 4e48bf51714f
children e8ba4ae5e3ac
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1330
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
1 #!/usr/bin/perl
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
2
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
3 # (C) Sergey Kandaurov
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
4 # (C) Nginx, Inc.
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
5
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
6 # Tests for OCSP stapling.
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
7
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
8 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
9
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
10 use warnings;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
11 use strict;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
12
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
13 use Test::More;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
14
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
15 use MIME::Base64 qw/ decode_base64 /;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
16
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
17 BEGIN { use FindBin; chdir($FindBin::Bin); }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
18
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
19 use lib 'lib';
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
20 use Test::Nginx;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
21
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
22 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
23
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
24 select STDERR; $| = 1;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
25 select STDOUT; $| = 1;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
26
1389
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
27 eval {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
28 require Net::SSLeay;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
29 Net::SSLeay::load_error_strings();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
30 Net::SSLeay::SSLeay_add_ssl_algorithms();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
31 Net::SSLeay::randomize();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
32 Net::SSLeay::SSLeay();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
33 defined &Net::SSLeay::set_tlsext_status_type or die;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
34 };
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
35 plan(skip_all => 'Net::SSLeay not installed or too old') if $@;
1330
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
36
1400
94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1397
diff changeset
37 my $t = Test::Nginx->new()->has(qw/http http_ssl/)->has_daemon('openssl');
94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1397
diff changeset
38
94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1397
diff changeset
39 plan(skip_all => 'no OCSP stapling') if $t->has_module('BoringSSL');
94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1397
diff changeset
40
94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1397
diff changeset
41 $t->plan(9)->write_file_expand('nginx.conf', <<'EOF');
1330
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
42
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
43 %%TEST_GLOBALS%%
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
44
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
45 daemon off;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
46
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
47 events {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
48 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
49
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
50 http {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
51 %%TEST_GLOBALS_HTTP%%
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
52
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
53 ssl_stapling on;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
54 ssl_trusted_certificate trusted.crt;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
55
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
56 ssl_certificate ec-end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
57 ssl_certificate_key ec-end.key;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
58
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
59 ssl_certificate end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
60 ssl_certificate_key end.key;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
61
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
62 server {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
63 listen 127.0.0.1:8443 ssl;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
64 listen 127.0.0.1:8080;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
65 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
66 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
67
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
68 server {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
69 listen 127.0.0.1:8444 ssl;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
70 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
71
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
72 ssl_stapling_responder http://127.0.0.1:8081/;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
73 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
74
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
75 server {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
76 listen 127.0.0.1:8445 ssl;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
77 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
78
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
79 ssl_stapling_verify on;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
80 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
81
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
82 server {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
83 listen 127.0.0.1:8446 ssl;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
84 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
85
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
86 ssl_certificate ec-end.crt;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
87 ssl_certificate_key ec-end.key;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
88 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
89
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
90 server {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
91 listen 127.0.0.1:8447 ssl;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
92 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
93
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
94 ssl_certificate end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
95 ssl_certificate_key end.key;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
96
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
97 ssl_stapling_file %%TESTDIR%%/resp.der;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
98 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
99
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
100 server {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
101 listen 127.0.0.1:8448 ssl;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
102 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
103
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
104 ssl_certificate ec-end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
105 ssl_certificate_key ec-end.key;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
106
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
107 ssl_stapling_file %%TESTDIR%%/ec-resp.der;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
108 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
109
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
110 server {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
111 listen 127.0.0.1:8449 ssl;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
112 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
113
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
114 ssl_stapling_responder http://127.0.0.1:8080/;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
115 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
116 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
117
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
118 EOF
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
119
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
120 my $d = $t->testdir();
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
121 my $p = port(8081);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
122
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
123 $t->write_file('openssl.conf', <<EOF);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
124 [ req ]
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
125 default_bits = 1024
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
126 encrypt_key = no
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
127 distinguished_name = req_distinguished_name
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
128 [ req_distinguished_name ]
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
129 EOF
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
130
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
131 $t->write_file('ca.conf', <<EOF);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
132 [ ca ]
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
133 default_ca = myca
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
134
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
135 [ myca ]
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
136 new_certs_dir = $d
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
137 database = $d/certindex
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
138 default_md = sha1
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
139 policy = myca_policy
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
140 serial = $d/certserial
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
141 default_days = 1
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
142 x509_extensions = myca_extensions
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
143
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
144 [ myca_policy ]
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
145 commonName = supplied
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
146
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
147 [ myca_extensions ]
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
148 basicConstraints = critical,CA:TRUE
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
149 authorityInfoAccess = OCSP;URI:http://127.0.0.1:$p
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
150 EOF
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
151
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
152 foreach my $name ('root') {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
153 system('openssl req -x509 -new '
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
154 . "-config $d/openssl.conf -subj /CN=$name/ "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
155 . "-out $d/$name.crt -keyout $d/$name.key "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
156 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
157 or die "Can't create certificate for $name: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
158 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
159
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
160 foreach my $name ('int', 'end') {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
161 system("openssl req -new "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
162 . "-config $d/openssl.conf -subj /CN=$name/ "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
163 . "-out $d/$name.csr -keyout $d/$name.key "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
164 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
165 or die "Can't create certificate for $name: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
166 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
167
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
168 foreach my $name ('ec-end') {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
169 system("openssl ecparam -genkey -out $d/$name.key -name prime256v1 "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
170 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
171 or die "Can't create EC param: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
172 system("openssl req -new -key $d/$name.key "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
173 . "-config $d/openssl.conf -subj /CN=$name/ "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
174 . "-out $d/$name.csr "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
175 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
176 or die "Can't create certificate for $name: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
177 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
178
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
179 $t->write_file('certserial', '1000');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
180 $t->write_file('certindex', '');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
181
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
182 system("openssl ca -batch -config $d/ca.conf "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
183 . "-keyfile $d/root.key -cert $d/root.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
184 . "-subj /CN=int/ -in $d/int.csr -out $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
185 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
186 or die "Can't sign certificate for int: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
187
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
188 system("openssl ca -batch -config $d/ca.conf "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
189 . "-keyfile $d/int.key -cert $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
190 . "-subj /CN=ec-end/ -in $d/ec-end.csr -out $d/ec-end.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
191 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
192 or die "Can't sign certificate for ec-end: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
193
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
194 system("openssl ca -batch -config $d/ca.conf "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
195 . "-keyfile $d/int.key -cert $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
196 . "-subj /CN=end/ -in $d/end.csr -out $d/end.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
197 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
198 or die "Can't sign certificate for end: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
199
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
200 # RFC 6960, serialNumber
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
201
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
202 system("openssl x509 -in $d/end.crt -serial -noout "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
203 . ">>$d/serial 2>>$d/openssl.out") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
204 or die "Can't obtain serial for end: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
205
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
206 my $serial = pack("n2", 0x0202, hex $1) if $t->read_file('serial') =~ /(\d+)/;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
207
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
208 system("openssl ca -config $d/ca.conf -revoke $d/end.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
209 . "-keyfile $d/root.key -cert $d/root.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
210 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
211 or die "Can't revoke end.crt: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
212
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
213 system("openssl ocsp -issuer $d/int.crt -cert $d/end.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
214 . "-reqout $d/req.der >>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
215 or die "Can't create OCSP request: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
216
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
217 system("openssl ocsp -index $d/certindex -CA $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
218 . "-rsigner $d/root.crt -rkey $d/root.key "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
219 . "-reqin $d/req.der -respout $d/resp.der -ndays 1 "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
220 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
221 or die "Can't create OCSP response: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
222
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
223 system("openssl ocsp -issuer $d/int.crt -cert $d/ec-end.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
224 . "-reqout $d/ec-req.der >>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
225 or die "Can't create EC OCSP request: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
226
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
227 system("openssl ocsp -index $d/certindex -CA $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
228 . "-rsigner $d/root.crt -rkey $d/root.key "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
229 . "-reqin $d/ec-req.der -respout $d/ec-resp.der -ndays 1 "
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
230 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
231 or die "Can't create EC OCSP response: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
232
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
233 $t->write_file('trusted.crt',
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
234 $t->read_file('int.crt') . $t->read_file('root.crt'));
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
235 $t->write_file('end-int.crt',
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
236 $t->read_file('end.crt') . $t->read_file('int.crt'));
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
237 $t->write_file('ec-end-int.crt',
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
238 $t->read_file('ec-end.crt') . $t->read_file('int.crt'));
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
239
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
240 $t->run_daemon(\&http_daemon, $t);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
241 $t->run();
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
242
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
243 $t->waitforsocket("127.0.0.1:" . port(8081));
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
244
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
245 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
246
1389
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
247 my $version = get_version();
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
248
1330
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
249 staple(8443, 'RSA');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
250 staple(8443, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
251 staple(8444, 'RSA');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
252 staple(8444, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
253 staple(8445, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
254 staple(8446, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
255 staple(8449, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
256
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
257 sleep 1;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
258
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
259 ok(!staple(8443, 'RSA'), 'staple revoked');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
260 ok(staple(8443, 'ECDSA'), 'staple success');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
261
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
262 ok(!staple(8444, 'RSA'), 'responder revoked');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
263 ok(staple(8444, 'ECDSA'), 'responder success');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
264
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
265 ok(!staple(8445, 'ECDSA'), 'verify - root not trusted');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
266
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
267 ok(staple(8446, 'ECDSA', "$d/int.crt"), 'cert store');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
268
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
269 is(staple(8447, 'RSA'), '1 1', 'file revoked');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
270 is(staple(8448, 'ECDSA'), '1 0', 'file success');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
271
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
272 ok(!staple(8449, 'ECDSA'), 'ocsp error');
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
273
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
274 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
275
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
276 sub staple {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
277 my ($port, $ciphers, $ca) = @_;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
278 my (@resp);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
279
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
280 my $staple_cb = sub {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
281 my ($ssl, $resp) = @_;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
282 push @resp, !!$resp;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
283 return 1 unless $resp;
1389
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
284 my $cert = Net::SSLeay::get_peer_certificate($ssl);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
285 my $certid = eval { Net::SSLeay::OCSP_cert2ids($ssl, $cert) }
1330
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
286 or do { die "no OCSP_CERTID for certificate: $@"; };
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
287
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
288 my @res = Net::SSLeay::OCSP_response_results($resp, $certid);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
289 push @resp, $res[0][2]->{'statusType'};
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
290 };
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
291
1389
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
292 my $s;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
293
1330
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
294 eval {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
295 local $SIG{ALRM} = sub { die "timeout\n" };
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
296 local $SIG{PIPE} = sub { die "sigpipe\n" };
1421
4e48bf51714f Tests: aligned various generic read timeouts to http_end().
Sergey Kandaurov <pluknet@nginx.com>
parents: 1407
diff changeset
297 alarm(8);
1389
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
298 $s = IO::Socket::INET->new('127.0.0.1:' . port($port));
1330
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
299 alarm(0);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
300 };
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
301 alarm(0);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
302
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
303 if ($@) {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
304 log_in("died: $@");
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
305 return undef;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
306 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
307
1389
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
308 my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
309
1397
d3d2aabe16dd Tests: LibreSSL client detection in multiple certificate tests.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1389
diff changeset
310 my $ssleay = Net::SSLeay::SSLeay();
d3d2aabe16dd Tests: LibreSSL client detection in multiple certificate tests.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1389
diff changeset
311 if ($ssleay < 0x1000200f || $ssleay == 0x20000000) {
1389
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
312 Net::SSLeay::CTX_set_cipher_list($ctx, $ciphers)
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
313 or die("Failed to set cipher list");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
314 } else {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
315 # SSL_CTRL_SET_SIGALGS_LIST
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
316 $ciphers = 'PSS' if $ciphers eq 'RSA' && $version > 0x0303;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
317 Net::SSLeay::CTX_ctrl($ctx, 98, 0, $ciphers . '+SHA256')
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
318 or die("Failed to set sigalgs");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
319 }
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
320
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
321 Net::SSLeay::CTX_load_verify_locations($ctx, $ca || '', '');
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
322 Net::SSLeay::CTX_set_tlsext_status_cb($ctx, $staple_cb);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
323 my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
324 Net::SSLeay::set_tlsext_status_type($ssl,
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
325 Net::SSLeay::TLSEXT_STATUSTYPE_ocsp());
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
326 Net::SSLeay::set_fd($ssl, fileno($s));
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
327 Net::SSLeay::connect($ssl) or die("ssl connect");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
328
1330
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
329 return join ' ', @resp;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
330 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
331
1389
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
332 sub get_version {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
333 my $s;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
334
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
335 eval {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
336 local $SIG{ALRM} = sub { die "timeout\n" };
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
337 local $SIG{PIPE} = sub { die "sigpipe\n" };
1421
4e48bf51714f Tests: aligned various generic read timeouts to http_end().
Sergey Kandaurov <pluknet@nginx.com>
parents: 1407
diff changeset
338 alarm(8);
1389
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
339 $s = IO::Socket::INET->new('127.0.0.1:' . port(8443));
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
340 alarm(0);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
341 };
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
342 alarm(0);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
343
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
344 if ($@) {
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
345 log_in("died: $@");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
346 return undef;
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
347 }
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
348
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
349 my $ctx = Net::SSLeay::CTX_new() or die("Failed to create SSL_CTX $!");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
350 my $ssl = Net::SSLeay::new($ctx) or die("Failed to create SSL $!");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
351 Net::SSLeay::set_fd($ssl, fileno($s));
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
352 Net::SSLeay::connect($ssl) or die("ssl connect");
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
353
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
354 Net::SSLeay::version($ssl);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
355 }
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs.
Sergey Kandaurov <pluknet@nginx.com>
parents: 1330
diff changeset
356
1330
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
357 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
358
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
359 sub http_daemon {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
360 my ($t) = shift;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
361 my $server = IO::Socket::INET->new(
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
362 Proto => 'tcp',
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
363 LocalHost => "127.0.0.1:" . port(8081),
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
364 Listen => 5,
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
365 Reuse => 1
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
366 )
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
367 or die "Can't create listening socket: $!\n";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
368
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
369 local $SIG{PIPE} = 'IGNORE';
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
370
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
371 while (my $client = $server->accept()) {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
372 $client->autoflush(1);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
373
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
374 my $headers = '';
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
375 my $uri = '';
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
376
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
377 while (<$client>) {
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
378 $headers .= $_;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
379 last if (/^\x0d?\x0a?$/);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
380 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
381
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
382 $uri = $1 if $headers =~ /^\S+\s+\/([^ ]+)\s+HTTP/i;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
383 next unless $uri;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
384
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
385 $uri =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
386 my $req = decode_base64($uri);
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
387 my $resp = index($req, $serial) > 0 ? 'resp' : 'ec-resp';
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
388
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
389 # ocsp dummy handler
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
390
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
391 select undef, undef, undef, 0.02;
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
392
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
393 $headers = <<"EOF";
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
394 HTTP/1.1 200 OK
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
395 Connection: close
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
396 Content-Type: application/ocsp-response
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
397
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
398 EOF
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
399
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
400 print $client $headers . $t->read_file("$resp.der");
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
401 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
402 }
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
403
b82ed2061f65 Tests: OCSP stapling tests.
Sergey Kandaurov <pluknet@nginx.com>
parents:
diff changeset
404 ###############################################################################