test/recipes/80-test_ocsp.t

   1 #! /usr/bin/perl
   2
   3 use strict;
   4 use warnings;
   5
   6 use POSIX;
   7 use File::Spec::Functions qw/devnull catfile/;
   8 use File::Copy;
   9 use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir/;
  10 use OpenSSL::Test::Utils;
  11
  12 setup("test_ocsp");
  13
  14 plan skip_all => "OCSP is not supported by this OpenSSL build"
  15     if disabled("ocsp");
  16
  17 my $ocspdir=srctop_dir("test", "ocsp-tests");
  18 # 17 December 2012 so we don't get certificate expiry errors.
  19 my @check_time=("-attime", "1355875200");
  20
  21 sub test_ocsp {
  22     my $title = shift;
  23     my $inputfile = shift;
  24     my $CAfile = shift;
  25     my $expected_exit = shift;
  26
  27     run(app(["openssl", "base64", "-d",
  28              "-in", catfile($ocspdir,$inputfile),
  29              "-out", "ocsp-resp-fff.dat"]));
  30     with({ exit_checker => sub { return shift == $expected_exit; } },
  31          sub { ok(run(app(["openssl", "ocsp", "-respin", "ocsp-resp-fff.dat",
  32                            "-partial_chain", @check_time,
  33                            "-CAfile", catfile($ocspdir, $CAfile),
  34                            "-verify_other", catfile($ocspdir, $CAfile),
  35                            "-no-CApath"])),
  36                   $title); });
  37     unlink "ocsp-resp-fff.dat";
  38 }
  39
  40 plan tests => 10;
  41
  42 subtest "=== VALID OCSP RESPONSES ===" => sub {
  43     plan tests => 6;
  44
  45     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  46               "ND1.ors", "ND1_Issuer_ICA.pem", 0);
  47     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  48               "ND2.ors", "ND2_Issuer_Root.pem", 0);
  49     test_ocsp("NON-DELEGATED; Root CA -> EE",
  50               "ND3.ors", "ND3_Issuer_Root.pem", 0);
  51     test_ocsp("DELEGATED; Intermediate CA -> EE",
  52               "D1.ors", "D1_Issuer_ICA.pem", 0);
  53     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  54               "D2.ors", "D2_Issuer_Root.pem", 0);
  55     test_ocsp("DELEGATED; Root CA -> EE",
  56               "D3.ors", "D3_Issuer_Root.pem", 0);
  57 };
  58
  59 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
  60     plan tests => 6;
  61
  62     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  63               "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
  64     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  65               "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
  66     test_ocsp("NON-DELEGATED; Root CA -> EE",
  67               "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
  68     test_ocsp("DELEGATED; Intermediate CA -> EE",
  69               "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
  70     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  71               "ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
  72     test_ocsp("DELEGATED; Root CA -> EE",
  73               "ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
  74 };
  75
  76 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
  77     plan tests => 6;
  78
  79     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  80               "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
  81     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  82               "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
  83     test_ocsp("NON-DELEGATED; Root CA -> EE",
  84               "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
  85     test_ocsp("DELEGATED; Intermediate CA -> EE",
  86               "WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
  87     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  88               "WRID_D2.ors", "D2_Issuer_Root.pem", 1);
  89     test_ocsp("DELEGATED; Root CA -> EE",
  90               "WRID_D3.ors", "D3_Issuer_Root.pem", 1);
  91 };
  92
  93 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
  94     plan tests => 6;
  95
  96     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  97               "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
  98     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  99               "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
 100     test_ocsp("NON-DELEGATED; Root CA -> EE",
 101               "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
 102     test_ocsp("DELEGATED; Intermediate CA -> EE",
 103               "WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
 104     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 105               "WINH_D2.ors", "D2_Issuer_Root.pem", 1);
 106     test_ocsp("DELEGATED; Root CA -> EE",
 107               "WINH_D3.ors", "D3_Issuer_Root.pem", 1);
 108 };
 109
 110 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
 111     plan tests => 6;
 112
 113     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 114               "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
 115     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 116               "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
 117     test_ocsp("NON-DELEGATED; Root CA -> EE",
 118               "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
 119     test_ocsp("DELEGATED; Intermediate CA -> EE",
 120               "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
 121     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 122               "WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
 123     test_ocsp("DELEGATED; Root CA -> EE",
 124               "WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
 125 };
 126
 127 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
 128     plan tests => 3;
 129
 130     test_ocsp("DELEGATED; Intermediate CA -> EE",
 131               "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
 132     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 133               "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
 134     test_ocsp("DELEGATED; Root CA -> EE",
 135               "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
 136 };
 137
 138 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
 139     plan tests => 3;
 140
 141     test_ocsp("DELEGATED; Intermediate CA -> EE",
 142               "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
 143     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 144               "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
 145     test_ocsp("DELEGATED; Root CA -> EE",
 146               "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
 147 };
 148
 149 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
 150     plan tests => 6;
 151
 152     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 153               "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
 154     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 155               "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
 156     test_ocsp("NON-DELEGATED; Root CA -> EE",
 157               "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
 158     test_ocsp("DELEGATED; Intermediate CA -> EE",
 159               "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
 160     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 161               "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
 162     test_ocsp("DELEGATED; Root CA -> EE",
 163               "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
 164 };
 165
 166 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
 167     plan tests => 6;
 168
 169     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 170               "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
 171     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 172               "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
 173     test_ocsp("NON-DELEGATED; Root CA -> EE",
 174               "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
 175     test_ocsp("DELEGATED; Intermediate CA -> EE",
 176               "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
 177     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 178               "D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
 179     test_ocsp("DELEGATED; Root CA -> EE",
 180               "D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
 181 };
 182
 183 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
 184     plan tests => 6;
 185
 186     # Expect success, because we're explicitly trusting the issuer certificate.
 187     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 188               "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
 189     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 190               "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
 191     test_ocsp("NON-DELEGATED; Root CA -> EE",
 192               "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
 193     test_ocsp("DELEGATED; Intermediate CA -> EE",
 194               "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
 195     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 196               "D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
 197     test_ocsp("DELEGATED; Root CA -> EE",
 198               "D3.ors", "ISIC_D3_Issuer_Root.pem", 0);
 199 };