wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
openssl/test/recipes/80-test_ocsp.t
Richard Levitte 42e0ccdfe8 unified build scheme: adjust test framework for out of source build tree 
To be able to run tests when we've built in a directory other than
the source tree, the testing framework needs a few adjustments.

test/testlib/OpenSSL/Test.pm needs to know where it can find
shlib_wrap.sh, and a number of other tests need to be told a different
place to find engines than what they may be able to figure out on
their own.  Relying to $TOP is not enough, $SRCTOP and $BLDTOP can be
used as an alternative.

As part of this change, top_file and top_dir are removed and
srctop_file, bldtop_file, srctop_dir and bldtop_dir take their place.

Reviewed-by: Ben Laurie <ben@openssl.org>
2016-02-09 11:43:20 +01:00

195 lines
7.3 KiB
Perl
Raw Blame History

#! /usr/bin/perl
use strict;
use warnings;
use POSIX;
use File::Spec::Functions qw/devnull catfile/;
use File::Copy;
use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir/;
setup("test_ocsp");
my $ocspdir=srctop_dir("test", "ocsp-tests");
# 17 December 2012 so we don't get certificate expiry errors.
my @check_time=("-attime", "1355875200");
sub test_ocsp {
my $title = shift;
my $inputfile = shift;
my $CAfile = shift;
my $expected_exit = shift;
run(app(["openssl", "base64", "-d",
"-in", catfile($ocspdir,$inputfile),
"-out", "ocsp-resp-fff.dat"]));
with({ exit_checker => sub { return shift == $expected_exit; } },
sub { ok(run(app(["openssl", "ocsp", "-respin", "ocsp-resp-fff.dat",
"-partial_chain", @check_time,
"-CAfile", catfile($ocspdir, $CAfile),
"-verify_other", catfile($ocspdir, $CAfile),
"-no-CApath"])),
$title); });
unlink "ocsp-resp-fff.dat";
}
plan tests => 10;
subtest "=== VALID OCSP RESPONSES ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
"ND1.ors", "ND1_Issuer_ICA.pem", 0);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
"ND2.ors", "ND2_Issuer_Root.pem", 0);
test_ocsp("NON-DELEGATED; Root CA -> EE",
"ND3.ors", "ND3_Issuer_Root.pem", 0);
test_ocsp("DELEGATED; Intermediate CA -> EE",
"D1.ors", "D1_Issuer_ICA.pem", 0);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"D2.ors", "D2_Issuer_Root.pem", 0);
test_ocsp("DELEGATED; Root CA -> EE",
"D3.ors", "D3_Issuer_Root.pem", 0);
};
subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
"ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
"ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
"ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
"ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Root CA -> EE",
"ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
};
subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
"WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
"WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
"WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
"WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"WRID_D2.ors", "D2_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Root CA -> EE",
"WRID_D3.ors", "D3_Issuer_Root.pem", 1);
};
subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
"WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
"WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
"WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
"WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"WINH_D2.ors", "D2_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Root CA -> EE",
"WINH_D3.ors", "D3_Issuer_Root.pem", 1);
};
subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
"WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
"WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
"WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
"WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Root CA -> EE",
"WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
};
subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
plan tests => 3;
test_ocsp("DELEGATED; Intermediate CA -> EE",
"WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Root CA -> EE",
"WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
};
subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
plan tests => 3;
test_ocsp("DELEGATED; Intermediate CA -> EE",
"ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Root CA -> EE",
"ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
};
subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
"ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
"ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
"ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
"D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Root CA -> EE",
"D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
};
subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
plan tests => 6;
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
"ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
"ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
test_ocsp("NON-DELEGATED; Root CA -> EE",
"ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Intermediate CA -> EE",
"D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
test_ocsp("DELEGATED; Root CA -> EE",
"D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
};
subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
plan tests => 6;
# Expect success, because we're explicitly trusting the issuer certificate.
test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
"ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
"ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
test_ocsp("NON-DELEGATED; Root CA -> EE",
"ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
test_ocsp("DELEGATED; Intermediate CA -> EE",
"D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
test_ocsp("DELEGATED; Root CA -> Intermediate CA",
"D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
test_ocsp("DELEGATED; Root CA -> EE",
"D3.ors", "ISIC_D3_Issuer_Root.pem", 0);
};
Reference in a new issue View git blame Copy permalink