test/recipes/80-test_ocsp.t

   1 #! /usr/bin/perl
   2
   3 use strict;
   4 use warnings;
   5
   6 use POSIX;
   7 use File::Spec::Functions qw/devnull catfile/;
   8 use File::Copy;
   9 use OpenSSL::Test qw/:DEFAULT with pipe top_dir/;
  10
  11 setup("test_ocsp");
  12
  13 my $ocspdir=top_dir("test", "ocsp-tests");
  14 # 17 December 2012 so we don't get certificate expiry errors.
  15 my @check_time=("-attime", "1355875200");
  16
  17 sub test_ocsp {
  18     my $title = shift;
  19     my $inputfile = shift;
  20     my $CAfile = shift;
  21     my $expected_exit = shift;
  22
  23     with({ exit_checker => sub { return shift == $expected_exit; } },
  24          sub { ok(run(pipe(app(["openssl", "base64", "-d",
  25                                 "-in", catfile($ocspdir,$inputfile)]),
  26                            app(["openssl", "ocsp", "-respin", "-",
  27                                 "-partial_chain", @check_time,
  28                                 "-CAfile", catfile($ocspdir, $CAfile),
  29                                 "-verify_other", catfile($ocspdir, $CAfile),
  30                                 "-CApath", devnull()]))),
  31                   $title); });
  32 }
  33
  34 plan tests => 10;
  35
  36 subtest "=== VALID OCSP RESPONSES ===" => sub {
  37     plan tests => 6;
  38
  39     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  40               "ND1.ors", "ND1_Issuer_ICA.pem", 0);
  41     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  42               "ND2.ors", "ND2_Issuer_Root.pem", 0);
  43     test_ocsp("NON-DELEGATED; Root CA -> EE",
  44               "ND3.ors", "ND3_Issuer_Root.pem", 0);
  45     test_ocsp("DELEGATED; Intermediate CA -> EE",
  46               "D1.ors", "D1_Issuer_ICA.pem", 0);
  47     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  48               "D2.ors", "D2_Issuer_Root.pem", 0);
  49     test_ocsp("DELEGATED; Root CA -> EE",
  50               "D3.ors", "D3_Issuer_Root.pem", 0);
  51 };
  52
  53 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
  54     plan tests => 6;
  55
  56     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  57               "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
  58     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  59               "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
  60     test_ocsp("NON-DELEGATED; Root CA -> EE",
  61               "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
  62     test_ocsp("DELEGATED; Intermediate CA -> EE",
  63               "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
  64     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  65               "ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
  66     test_ocsp("DELEGATED; Root CA -> EE",
  67               "ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
  68 };
  69
  70 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
  71     plan tests => 6;
  72
  73     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  74               "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
  75     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  76               "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
  77     test_ocsp("NON-DELEGATED; Root CA -> EE",
  78               "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
  79     test_ocsp("DELEGATED; Intermediate CA -> EE",
  80               "WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
  81     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  82               "WRID_D2.ors", "D2_Issuer_Root.pem", 1);
  83     test_ocsp("DELEGATED; Root CA -> EE",
  84               "WRID_D3.ors", "D3_Issuer_Root.pem", 1);
  85 };
  86
  87 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
  88     plan tests => 6;
  89
  90     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  91               "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
  92     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  93               "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
  94     test_ocsp("NON-DELEGATED; Root CA -> EE",
  95               "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
  96     test_ocsp("DELEGATED; Intermediate CA -> EE",
  97               "WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
  98     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  99               "WINH_D2.ors", "D2_Issuer_Root.pem", 1);
 100     test_ocsp("DELEGATED; Root CA -> EE",
 101               "WINH_D3.ors", "D3_Issuer_Root.pem", 1);
 102 };
 103
 104 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
 105     plan tests => 6;
 106
 107     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 108               "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
 109     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 110               "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
 111     test_ocsp("NON-DELEGATED; Root CA -> EE",
 112               "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
 113     test_ocsp("DELEGATED; Intermediate CA -> EE",
 114               "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
 115     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 116               "WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
 117     test_ocsp("DELEGATED; Root CA -> EE",
 118               "WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
 119 };
 120
 121 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
 122     plan tests => 3;
 123
 124     test_ocsp("DELEGATED; Intermediate CA -> EE",
 125               "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
 126     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 127               "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
 128     test_ocsp("DELEGATED; Root CA -> EE",
 129               "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
 130 };
 131
 132 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
 133     plan tests => 3;
 134
 135     test_ocsp("DELEGATED; Intermediate CA -> EE",
 136               "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
 137     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 138               "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
 139     test_ocsp("DELEGATED; Root CA -> EE",
 140               "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
 141 };
 142
 143 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
 144     plan tests => 6;
 145
 146     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 147               "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
 148     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 149               "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
 150     test_ocsp("NON-DELEGATED; Root CA -> EE",
 151               "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
 152     test_ocsp("DELEGATED; Intermediate CA -> EE",
 153               "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
 154     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 155               "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
 156     test_ocsp("DELEGATED; Root CA -> EE",
 157               "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
 158 };
 159
 160 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
 161     plan tests => 6;
 162
 163     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 164               "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
 165     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 166               "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
 167     test_ocsp("NON-DELEGATED; Root CA -> EE",
 168               "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
 169     test_ocsp("DELEGATED; Intermediate CA -> EE",
 170               "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
 171     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 172               "D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
 173     test_ocsp("DELEGATED; Root CA -> EE",
 174               "D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
 175 };
 176
 177 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
 178     plan tests => 6;
 179
 180     # Expect success, because we're explicitly trusting the issuer certificate.
 181     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 182               "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
 183     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 184               "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
 185     test_ocsp("NON-DELEGATED; Root CA -> EE",
 186               "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
 187     test_ocsp("DELEGATED; Intermediate CA -> EE",
 188               "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
 189     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 190               "D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
 191     test_ocsp("DELEGATED; Root CA -> EE",
 192               "D3.ors", "ISIC_D3_Issuer_Root.pem", 0);
 193 };