nginx-tests: ssl_stapling.t annotate

annotate ssl_stapling.t @ 1976:4e79bd25642f default tip

Tests: added test for headers without a colon.

author	Maxim Dounin <mdounin@mdounin.ru>
date	Sat, 11 May 2024 18:56:23 +0300
parents	f3573393f36f
children

rev	line source
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	1 #!/usr/bin/perl
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	2
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	3 # (C) Sergey Kandaurov
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	4 # (C) Nginx, Inc.
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	5
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	6 # Tests for OCSP stapling.
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	7
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	8 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	9
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	10 use warnings;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	11 use strict;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	12
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	13 use Test::More;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	14
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	15 use MIME::Base64 qw/ decode_base64 /;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	16
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	17 BEGIN { use FindBin; chdir($FindBin::Bin); }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	18
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	19 use lib 'lib';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	20 use Test::Nginx;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	21
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	22 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	23
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	24 select STDERR; $\| = 1;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	25 select STDOUT; $\| = 1;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	26
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	27 my $t = Test::Nginx->new()->has(qw/http http_ssl socket_ssl/)
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	28 ->has_daemon('openssl');
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	29
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	30 eval { defined &Net::SSLeay::set_tlsext_status_type or die; };
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	31 plan(skip_all => 'Net::SSLeay too old') if $@;
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	32 eval { defined &IO::Socket::SSL::SSL_OCSP_TRY_STAPLE or die; };
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	33 plan(skip_all => 'IO::Socket::SSL too old') if $@;
1400 94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 1397 diff changeset	34
1972 f3573393f36f Tests: guarded ssl_stapling.t for old OpenSSL versions. Maxim Dounin <mdounin@mdounin.ru> parents: 1967 diff changeset	35 plan(skip_all => 'no OCSP stapling')
f3573393f36f Tests: guarded ssl_stapling.t for old OpenSSL versions. Maxim Dounin <mdounin@mdounin.ru> parents: 1967 diff changeset	36 if $t->has_module('BoringSSL');
f3573393f36f Tests: guarded ssl_stapling.t for old OpenSSL versions. Maxim Dounin <mdounin@mdounin.ru> parents: 1967 diff changeset	37 plan(skip_all => 'no OCSP stapling')
f3573393f36f Tests: guarded ssl_stapling.t for old OpenSSL versions. Maxim Dounin <mdounin@mdounin.ru> parents: 1967 diff changeset	38 if $t->has_module('OpenSSL') and not $t->has_feature('openssl:0.9.8h');
f3573393f36f Tests: guarded ssl_stapling.t for old OpenSSL versions. Maxim Dounin <mdounin@mdounin.ru> parents: 1967 diff changeset	39 plan(skip_all => 'no OCSP stapling')
f3573393f36f Tests: guarded ssl_stapling.t for old OpenSSL versions. Maxim Dounin <mdounin@mdounin.ru> parents: 1967 diff changeset	40 if not $t->has_module('sni');
1400 94bcad5611af Tests: skip OCSP stapling and multiple cert tests with BoringSSL. Sergey Kandaurov <pluknet@nginx.com> parents: 1397 diff changeset	41
1842 af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	42 $t->plan(10)->write_file_expand('nginx.conf', <<'EOF');
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	43
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	44 %%TEST_GLOBALS%%
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	45
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	46 daemon off;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	47
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	48 events {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	49 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	50
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	51 http {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	52 %%TEST_GLOBALS_HTTP%%
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	53
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	54 ssl_stapling on;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	55 ssl_trusted_certificate trusted.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	56
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	57 ssl_certificate ec-end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	58 ssl_certificate_key ec-end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	59
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	60 ssl_certificate end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	61 ssl_certificate_key end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	62
1476 e8ba4ae5e3ac Tests: fixed ssl_stapling.t for nginx built with OpenSSL 0.9.8y+. Sergey Kandaurov <pluknet@nginx.com> parents: 1421 diff changeset	63 ssl_ciphers DEFAULT:ECCdraft;
e8ba4ae5e3ac Tests: fixed ssl_stapling.t for nginx built with OpenSSL 0.9.8y+. Sergey Kandaurov <pluknet@nginx.com> parents: 1421 diff changeset	64
1867 231b14e2041a Tests: unbreak ssl_stapling.t after IO::Socket::SSL refactoring. Sergey Kandaurov <pluknet@nginx.com> parents: 1865 diff changeset	65 add_header X-SSL-Protocol $ssl_protocol always;
231b14e2041a Tests: unbreak ssl_stapling.t after IO::Socket::SSL refactoring. Sergey Kandaurov <pluknet@nginx.com> parents: 1865 diff changeset	66
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	67 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	68 listen 127.0.0.1:8443 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	69 listen 127.0.0.1:8080;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	70 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	71 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	72
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	73 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	74 listen 127.0.0.1:8444 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	75 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	76
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	77 ssl_stapling_responder http://127.0.0.1:8081/;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	78 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	79
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	80 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	81 listen 127.0.0.1:8445 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	82 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	83
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	84 ssl_stapling_verify on;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	85 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	86
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	87 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	88 listen 127.0.0.1:8446 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	89 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	90
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	91 ssl_certificate ec-end.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	92 ssl_certificate_key ec-end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	93 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	94
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	95 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	96 listen 127.0.0.1:8447 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	97 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	98
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	99 ssl_certificate end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	100 ssl_certificate_key end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	101
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	102 ssl_stapling_file %%TESTDIR%%/resp.der;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	103 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	104
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	105 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	106 listen 127.0.0.1:8448 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	107 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	108
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	109 ssl_certificate ec-end-int.crt;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	110 ssl_certificate_key ec-end.key;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	111
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	112 ssl_stapling_file %%TESTDIR%%/ec-resp.der;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	113 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	114
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	115 server {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	116 listen 127.0.0.1:8449 ssl;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	117 server_name localhost;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	118
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	119 ssl_stapling_responder http://127.0.0.1:8080/;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	120 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	121 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	122
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	123 EOF
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	124
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	125 my $d = $t->testdir();
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	126 my $p = port(8081);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	127
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	128 $t->write_file('openssl.conf', <<EOF);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	129 [ req ]
1488 dbce8fb5f5f8 Tests: align with OpenSSL security level 2. Sergey Kandaurov <pluknet@nginx.com> parents: 1476 diff changeset	130 default_bits = 2048
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	131 encrypt_key = no
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	132 distinguished_name = req_distinguished_name
1945 0b5ec15c62ed Tests: compatibility with "openssl" app from OpenSSL 3.2.0. Maxim Dounin <mdounin@mdounin.ru> parents: 1871 diff changeset	133 x509_extensions = myca_extensions
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	134 [ req_distinguished_name ]
1945 0b5ec15c62ed Tests: compatibility with "openssl" app from OpenSSL 3.2.0. Maxim Dounin <mdounin@mdounin.ru> parents: 1871 diff changeset	135 [ myca_extensions ]
0b5ec15c62ed Tests: compatibility with "openssl" app from OpenSSL 3.2.0. Maxim Dounin <mdounin@mdounin.ru> parents: 1871 diff changeset	136 basicConstraints = critical,CA:TRUE
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	137 EOF
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	138
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	139 $t->write_file('ca.conf', <<EOF);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	140 [ ca ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	141 default_ca = myca
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	142
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	143 [ myca ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	144 new_certs_dir = $d
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	145 database = $d/certindex
1488 dbce8fb5f5f8 Tests: align with OpenSSL security level 2. Sergey Kandaurov <pluknet@nginx.com> parents: 1476 diff changeset	146 default_md = sha256
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	147 policy = myca_policy
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	148 serial = $d/certserial
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	149 default_days = 1
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	150 x509_extensions = myca_extensions
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	151
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	152 [ myca_policy ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	153 commonName = supplied
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	154
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	155 [ myca_extensions ]
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	156 basicConstraints = critical,CA:TRUE
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	157 authorityInfoAccess = OCSP;URI:http://127.0.0.1:$p
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	158 EOF
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	159
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	160 foreach my $name ('root') {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	161 system('openssl req -x509 -new '
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	162 . "-config $d/openssl.conf -subj /CN=$name/ "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	163 . "-out $d/$name.crt -keyout $d/$name.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	164 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	165 or die "Can't create certificate for $name: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	166 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	167
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	168 foreach my $name ('int', 'end') {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	169 system("openssl req -new "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	170 . "-config $d/openssl.conf -subj /CN=$name/ "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	171 . "-out $d/$name.csr -keyout $d/$name.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	172 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	173 or die "Can't create certificate for $name: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	174 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	175
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	176 foreach my $name ('ec-end') {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	177 system("openssl ecparam -genkey -out $d/$name.key -name prime256v1 "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	178 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	179 or die "Can't create EC param: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	180 system("openssl req -new -key $d/$name.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	181 . "-config $d/openssl.conf -subj /CN=$name/ "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	182 . "-out $d/$name.csr "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	183 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	184 or die "Can't create certificate for $name: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	185 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	186
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	187 $t->write_file('certserial', '1000');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	188 $t->write_file('certindex', '');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	189
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	190 system("openssl ca -batch -config $d/ca.conf "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	191 . "-keyfile $d/root.key -cert $d/root.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	192 . "-subj /CN=int/ -in $d/int.csr -out $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	193 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	194 or die "Can't sign certificate for int: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	195
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	196 system("openssl ca -batch -config $d/ca.conf "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	197 . "-keyfile $d/int.key -cert $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	198 . "-subj /CN=ec-end/ -in $d/ec-end.csr -out $d/ec-end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	199 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	200 or die "Can't sign certificate for ec-end: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	201
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	202 system("openssl ca -batch -config $d/ca.conf "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	203 . "-keyfile $d/int.key -cert $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	204 . "-subj /CN=end/ -in $d/end.csr -out $d/end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	205 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	206 or die "Can't sign certificate for end: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	207
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	208 # RFC 6960, serialNumber
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	209
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	210 system("openssl x509 -in $d/end.crt -serial -noout "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	211 . ">>$d/serial 2>>$d/openssl.out") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	212 or die "Can't obtain serial for end: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	213
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	214 my $serial = pack("n2", 0x0202, hex $1) if $t->read_file('serial') =~ /(\d+)/;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	215
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	216 system("openssl ca -config $d/ca.conf -revoke $d/end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	217 . "-keyfile $d/root.key -cert $d/root.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	218 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	219 or die "Can't revoke end.crt: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	220
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	221 system("openssl ocsp -issuer $d/int.crt -cert $d/end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	222 . "-reqout $d/req.der >>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	223 or die "Can't create OCSP request: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	224
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	225 system("openssl ocsp -index $d/certindex -CA $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	226 . "-rsigner $d/root.crt -rkey $d/root.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	227 . "-reqin $d/req.der -respout $d/resp.der -ndays 1 "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	228 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	229 or die "Can't create OCSP response: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	230
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	231 system("openssl ocsp -issuer $d/int.crt -cert $d/ec-end.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	232 . "-reqout $d/ec-req.der >>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	233 or die "Can't create EC OCSP request: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	234
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	235 system("openssl ocsp -index $d/certindex -CA $d/int.crt "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	236 . "-rsigner $d/root.crt -rkey $d/root.key "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	237 . "-reqin $d/ec-req.der -respout $d/ec-resp.der -ndays 1 "
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	238 . ">>$d/openssl.out 2>&1") == 0
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	239 or die "Can't create EC OCSP response: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	240
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	241 $t->write_file('trusted.crt',
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	242 $t->read_file('int.crt') . $t->read_file('root.crt'));
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	243 $t->write_file('end-int.crt',
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	244 $t->read_file('end.crt') . $t->read_file('int.crt'));
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	245 $t->write_file('ec-end-int.crt',
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	246 $t->read_file('ec-end.crt') . $t->read_file('int.crt'));
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	247
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	248 $t->run_daemon(\&http_daemon, $t);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	249 $t->run();
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	250
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	251 $t->waitforsocket("127.0.0.1:" . port(8081));
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	252
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	253 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	254
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	255 staple(8443, 'RSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	256 staple(8443, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	257 staple(8444, 'RSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	258 staple(8444, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	259 staple(8445, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	260 staple(8446, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	261 staple(8449, 'ECDSA');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	262
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	263 sleep 1;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	264
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	265 ok(!staple(8443, 'RSA'), 'staple revoked');
1842 af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	266
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	267 TODO: {
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	268 local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL'
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	269 if $t->has_module('LibreSSL') && test_tls13();
1967 0a93f101925a Tests: sigalgs handling with Net::SSLeay with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1945 diff changeset	270 local $TODO = 'no TLSv1.3 sigalgs in Net::SSLeay (LibreSSL)'
0a93f101925a Tests: sigalgs handling with Net::SSLeay with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1945 diff changeset	271 if Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER") && test_tls13();
1842 af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	272
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	273 ok(staple(8443, 'ECDSA'), 'staple success');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	274
1842 af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	275 }
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	276
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	277 ok(!staple(8444, 'RSA'), 'responder revoked');
1842 af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	278
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	279 TODO: {
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	280 local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL'
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	281 if $t->has_module('LibreSSL') && test_tls13();
1967 0a93f101925a Tests: sigalgs handling with Net::SSLeay with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1945 diff changeset	282 local $TODO = 'no TLSv1.3 sigalgs in Net::SSLeay (LibreSSL)'
0a93f101925a Tests: sigalgs handling with Net::SSLeay with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1945 diff changeset	283 if Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER") && test_tls13();
1842 af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	284
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	285 ok(staple(8444, 'ECDSA'), 'responder success');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	286
1842 af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	287 }
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	288
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	289 ok(!staple(8445, 'ECDSA'), 'verify - root not trusted');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	290
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	291 ok(staple(8446, 'ECDSA', "$d/int.crt"), 'cert store');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	292
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	293 is(staple(8447, 'RSA'), '1 1', 'file revoked');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	294 is(staple(8448, 'ECDSA'), '1 0', 'file success');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	295
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	296 ok(!staple(8449, 'ECDSA'), 'ocsp error');
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	297
1842 af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	298 TODO: {
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	299 local $TODO = 'broken TLSv1.3 sigalgs in LibreSSL'
1967 0a93f101925a Tests: sigalgs handling with Net::SSLeay with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1945 diff changeset	300 if $t->has_module('LibreSSL')
0a93f101925a Tests: sigalgs handling with Net::SSLeay with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1945 diff changeset	301 && !Net::SSLeay::constant("LIBRESSL_VERSION_NUMBER")
0a93f101925a Tests: sigalgs handling with Net::SSLeay with LibreSSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1945 diff changeset	302 && test_tls13();
1842 af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	303
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	304 like(`grep -F '[crit]' ${\($t->testdir())}/error.log`, qr/^$/s, 'no crit');
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	305
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	306 }
af47a0b348a5 Tests: LibreSSL certificate negotiation with TLSv1.3. Maxim Dounin <mdounin@mdounin.ru> parents: 1636 diff changeset	307
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	308 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	309
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	310 sub staple {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	311 my ($port, $ciphers, $ca) = @_;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	312 my (@resp);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	313
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	314 my $staple_cb = sub {
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	315 my ($s, $resp) = @_;
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	316 push @resp, !!$resp;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	317 return 1 unless $resp;
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	318
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	319 # Contrary to the documentation, IO::Socket::SSL calls the
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	320 # SSL_ocsp_staple_callback with the socket, and not the
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	321 # Net::SSLeay object.
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	322
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	323 my $ssl = $s->_get_ssl_object();
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	324
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	325 my $cert = Net::SSLeay::get_peer_certificate($ssl);
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	326 my $certid = eval { Net::SSLeay::OCSP_cert2ids($ssl, $cert) }
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	327 or do { die "no OCSP_CERTID for certificate: $@"; };
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	328
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	329 my @res = Net::SSLeay::OCSP_response_results($resp, $certid);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	330 push @resp, $res[0][2]->{'statusType'};
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	331 };
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	332
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	333 my $ctx_cb = sub {
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	334 my $ctx = shift;
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	335 return unless defined $ciphers;
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	336 my $ssleay = Net::SSLeay::SSLeay();
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	337 return if ($ssleay < 0x1000200f \|\| $ssleay == 0x20000000);
1871 1ba5108b6c24 Tests: handled unsupported PSS in sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1867 diff changeset	338 my @sigalgs = ('RSA+SHA256:PSS+SHA256', 'RSA+SHA256');
1ba5108b6c24 Tests: handled unsupported PSS in sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1867 diff changeset	339 @sigalgs = ($ciphers . '+SHA256') unless $ciphers eq 'RSA';
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	340 # SSL_CTRL_SET_SIGALGS_LIST
1871 1ba5108b6c24 Tests: handled unsupported PSS in sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1867 diff changeset	341 Net::SSLeay::CTX_ctrl($ctx, 98, 0, $sigalgs[0])
1ba5108b6c24 Tests: handled unsupported PSS in sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1867 diff changeset	342 or Net::SSLeay::CTX_ctrl($ctx, 98, 0, $sigalgs[1])
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	343 or die("Failed to set sigalgs");
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	344 };
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	345
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	346 my $s = http_get(
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	347 '/', start => 1, PeerAddr => '127.0.0.1:' . port($port),
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	348 SSL => 1,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	349 SSL_cipher_list => $ciphers,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	350 SSL_create_ctx_callback => $ctx_cb,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	351 SSL_ocsp_staple_callback => $staple_cb,
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	352 SSL_ocsp_mode => IO::Socket::SSL::SSL_OCSP_TRY_STAPLE(),
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	353 SSL_ca_file => $ca
0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	354 );
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	355
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	356 return $s unless $s;
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	357 return join ' ', @resp;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	358 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	359
1865 0e1865aa9b33 Tests: reworked http SSL tests to use IO::Socket::SSL. Maxim Dounin <mdounin@mdounin.ru> parents: 1842 diff changeset	360 sub test_tls13 {
1867 231b14e2041a Tests: unbreak ssl_stapling.t after IO::Socket::SSL refactoring. Sergey Kandaurov <pluknet@nginx.com> parents: 1865 diff changeset	361 return http_get('/', SSL => 1) =~ /TLSv1.3/;
1389 73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	362 }
73a9504ae6fd Tests: support TLS 1.3 in ssl_stapling.t by preferring sigalgs. Sergey Kandaurov <pluknet@nginx.com> parents: 1330 diff changeset	363
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	364 ###############################################################################
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	365
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	366 sub http_daemon {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	367 my ($t) = shift;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	368 my $server = IO::Socket::INET->new(
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	369 Proto => 'tcp',
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	370 LocalHost => "127.0.0.1:" . port(8081),
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	371 Listen => 5,
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	372 Reuse => 1
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	373 )
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	374 or die "Can't create listening socket: $!\n";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	375
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	376 local $SIG{PIPE} = 'IGNORE';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	377
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	378 while (my $client = $server->accept()) {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	379 $client->autoflush(1);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	380
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	381 my $headers = '';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	382 my $uri = '';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	383
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	384 while (<$client>) {
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	385 $headers .= $_;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	386 last if (/^\x0d?\x0a?$/);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	387 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	388
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	389 $uri = $1 if $headers =~ /^\S+\s+\/([^ ]+)\s+HTTP/i;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	390 next unless $uri;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	391
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	392 $uri =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	393 my $req = decode_base64($uri);
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	394 my $resp = index($req, $serial) > 0 ? 'resp' : 'ec-resp';
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	395
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	396 # ocsp dummy handler
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	397
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	398 select undef, undef, undef, 0.02;
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	399
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	400 $headers = <<"EOF";
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	401 HTTP/1.1 200 OK
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	402 Connection: close
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	403 Content-Type: application/ocsp-response
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	404
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	405 EOF
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	406
1636 2d371452658c Tests: fixed serving binary OCSP responses on win32. Sergey Kandaurov <pluknet@nginx.com> parents: 1488 diff changeset	407 local $/;
2d371452658c Tests: fixed serving binary OCSP responses on win32. Sergey Kandaurov <pluknet@nginx.com> parents: 1488 diff changeset	408 open my $fh, '<', "$d/$resp.der"
2d371452658c Tests: fixed serving binary OCSP responses on win32. Sergey Kandaurov <pluknet@nginx.com> parents: 1488 diff changeset	409 or die "Can't open $resp.der: $!";
2d371452658c Tests: fixed serving binary OCSP responses on win32. Sergey Kandaurov <pluknet@nginx.com> parents: 1488 diff changeset	410 binmode $fh;
2d371452658c Tests: fixed serving binary OCSP responses on win32. Sergey Kandaurov <pluknet@nginx.com> parents: 1488 diff changeset	411 my $content = <$fh>;
2d371452658c Tests: fixed serving binary OCSP responses on win32. Sergey Kandaurov <pluknet@nginx.com> parents: 1488 diff changeset	412 close $fh;
2d371452658c Tests: fixed serving binary OCSP responses on win32. Sergey Kandaurov <pluknet@nginx.com> parents: 1488 diff changeset	413
2d371452658c Tests: fixed serving binary OCSP responses on win32. Sergey Kandaurov <pluknet@nginx.com> parents: 1488 diff changeset	414 print $client $headers . $content;
1330 b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	415 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	416 }
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	417
b82ed2061f65 Tests: OCSP stapling tests. Sergey Kandaurov <pluknet@nginx.com> parents: diff changeset	418 ###############################################################################

Mercurial > hg > nginx-tests

annotate ssl_stapling.t @ 1976:4e79bd25642f default tip