REGTESTS: quic: show_ssl_ocspresponse.vtc supported by QUIC

ssl/show_ssl_ocspresponse.vtc was renamed to ssl/show_ssl_ocspresponse.vtci
to produce a common part runnable both for QUIC and TCP listeners.
Then show_ssl_ocspresponse.vtc files were created both under ssl and quic directories
to call this .vtci file with correct VTC_SOCK_TYPE environment values
("quic" for QUIC listeners and "stream" for TCP listeners);

diff --git a/reg-tests/quic/show_ssl_ocspresponse.vtc b/reg-tests/quic/show_ssl_ocspresponse.vtc
new file mode 100644 (file)
index 0000000..ee6dd88
--- /dev/null
+++ b/reg-tests/quic/show_ssl_ocspresponse.vtc
@@ -0,0 +1,28 @@
+#REGTEST_TYPE=devel
+
+# broken with BoringSSL.
+
+# This reg-test uses the "show ssl ocsp-response" command to display the details
+# of the OCSP responses used by HAProxy.
+# It also uses the new special cases of the "show ssl cert" command, where an OCSP
+# extension is provided to the certificate name (with or without preceding * for an
+# ongoing transaction).
+#
+# It uses the show_ocsp_server.pem server certificate, signed off by set_cafile_rootCA.crt,
+# which has two OCSP responses, show_ocsp_server.pem.ocsp which is loaded by default and in
+# which it is valid, and show_ocsp_server.pem.ocsp.revoked in which it is revoked.
+# The OSCP response is updated through the two means available in the CLI, the
+# "set ssl ocsp-response" command and the update through a "set ssl cert foo.ocsp".
+#
+# It requires socat to upload the new OCSP responses.
+#
+# If this test does not work anymore:
+# - Check that you have socat
+
+varnishtest "Test the 'show ssl ocsp-response' and 'show ssl cert foo.pem.ocsp' features of the CLI"
+# QUIC backend are not supported with USE_QUIC_OPENSSL_COMPAT
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'"
+feature cmd "command -v socat && command -v openssl"
+
+setenv VTC_SOCK_TYPE quic
+include ${testdir}/../ssl/show_ssl_ocspresponse.vtci

diff --git a/reg-tests/ssl/show_ssl_ocspresponse.vtc b/reg-tests/ssl/show_ssl_ocspresponse.vtc
index b9e4c05be88bca1dc81273c8e5d425f729fdcbbc..97b33583bd449dd557833e6e3965e2056d8cee66 100644 (file)
--- a/reg-tests/ssl/show_ssl_ocspresponse.vtc
+++ b/reg-tests/ssl/show_ssl_ocspresponse.vtc
@@ -23,128 +23,6 @@ varnishtest "Test the 'show ssl ocsp-response' and 'show ssl cert foo.pem.ocsp'
 feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(2.5-dev0)'"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && !ssllib_name_startswith(BoringSSL) && !ssllib_name_startswith(wolfSSL)'"
 feature cmd "command -v socat && command -v openssl"
-feature ignore_unknown_macro
 
-haproxy h1 -conf {
-    global
-    .if feature(THREAD)
-        thread-groups 1
-    .endif
-
-    .if !ssllib_name_startswith(AWS-LC)
-        tune.ssl.default-dh-param 2048
-    .endif
-        tune.ssl.capture-buffer-size 1
-        stats socket "${tmpdir}/h1/stats" level admin
-
-    defaults
-        mode http
-        option httplog
-        log stderr local0 debug err
-        option logasap
-        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
-        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
-        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
-
-    listen clear-lst
-        bind "fd@${clearlst}"
-        server s1 "${tmpdir}/ssl.sock" ssl ca-file ${testdir}/certs/set_cafile_rootCA.crt verify none
-
-    listen ssl-lst
-        # crt: certificate of the server
-        # ca-file: CA used for client authentication request
-        bind "${tmpdir}/ssl.sock" ssl crt ${testdir}/certs/show_ocsp_server.pem ca-file ${testdir}/certs/set_cafile_rootCA.crt verify none crt-ignore-err all
-        http-response add-header X-SSL-Client-Verify %[ssl_c_verify]
-        server s1 ${s1_addr}:${s1_port}
-} -start
-
-
-# Test the "show ssl ocsp-response" command
-haproxy h1 -cli {
-    send "show ssl ocsp-response"
-    expect ~ "Certificate ID key : 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-
-    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-    expect ~ "Responder Id: C = FR, O = HAProxy Technologies, CN = ocsp.haproxy.com"
-    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-    expect ~ "Cert Status: good"
-}
-
-# Test the "show ssl ocsp-response" command with a certificate path as parameter
-shell {
-    ocsp_response=$(echo "show ssl ocsp-response ${testdir}/certs/show_ocsp_server.pem" | socat "${tmpdir}/h1/stats" -)
-
-    echo "$ocsp_response" | grep "Responder Id: C = FR, O = HAProxy Technologies, CN = ocsp.haproxy.com" &&
-    echo "$ocsp_response" | grep "Cert Status: good"
-}
-
-# Test the "show ssl cert foo.pem.ocsp" command
-haproxy h1 -cli {
-    send "show ssl cert"
-    expect ~ ".*show_ocsp_server.pem"
-
-    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem"
-    expect ~ "Serial: 100F"
-    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem"
-    expect ~ "OCSP Response Key: 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-
-    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem.ocsp"
-    expect ~ "Responder Id: C = FR, O = HAProxy Technologies, CN = ocsp.haproxy.com"
-    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem.ocsp"
-    expect ~ "Cert Status: good"
-}
-
-
-# Change the server certificate's OCSP response through "set ssl ocsp-response"
-shell {
-    printf "set ssl ocsp-response <<\n$(cat ${testdir}/certs/show_ocsp_server.pem.ocsp.revoked|openssl base64)\n\n" | socat "${tmpdir}/h1/stats" -
-}
-
-# Check that the change was taken into account
-haproxy h1 -cli {
-    send "show ssl ocsp-response"
-    expect ~ "Certificate ID key : 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-
-    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-    expect ~ "Responder Id: C = FR, O = HAProxy Technologies, CN = ocsp.haproxy.com"
-    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-    expect ~ "Cert Status: revoked"
-
-    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem.ocsp"
-    expect ~ "Cert Status: revoked"
-}
-
-
-# Change the server certificate's OCSP response through a transaction
-shell {
-    printf "set ssl cert ${testdir}/certs/show_ocsp_server.pem <<\n$(cat ${testdir}/certs/show_ocsp_server.pem | sed  '/^$/d')\n\n" | socat  "${tmpdir}/h1/stats" -
-    printf "set ssl cert ${testdir}/certs/show_ocsp_server.pem.issuer <<\n$(cat ${testdir}/certs/show_ocsp_server.pem.issuer | sed  '/^$/d')\n\n" | socat  "${tmpdir}/h1/stats" -
-    printf "set ssl cert ${testdir}/certs/show_ocsp_server.pem.ocsp <<\n$(cat ${testdir}/certs/show_ocsp_server.pem.ocsp|openssl base64)\n\n" | socat  "${tmpdir}/h1/stats" -
-}
-
-
-# Check that the actual tree entry was not changed and that the uncommitted
-# transaction's OCSP response is the new one
-haproxy h1 -cli {
-    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-    expect ~ "Cert Status: revoked"
-    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-    expect ~ "This Update: Jun 10 08:57:45 2021 GMT"
-
-    send "show ssl cert *${testdir}/certs/show_ocsp_server.pem.ocsp"
-    expect ~ "Cert Status: good"
-    send "show ssl cert *${testdir}/certs/show_ocsp_server.pem.ocsp"
-    expect ~ "This Update: Jun 10 08:55:04 2021 GMT"
-}
-
-
-# Commit the transaction and check that it was taken into account
-haproxy h1 -cli {
-    send "commit ssl cert ${testdir}/certs/show_ocsp_server.pem"
-    expect ~ "Success!"
-
-    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-    expect ~ "Cert Status: good"
-    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
-    expect ~ "This Update: Jun 10 08:55:04 2021 GMT"
-}
+setenv VTC_SOCK_TYPE stream
+include ${testdir}/show_ssl_ocspresponse.vtci

diff --git a/reg-tests/ssl/show_ssl_ocspresponse.vtci b/reg-tests/ssl/show_ssl_ocspresponse.vtci
new file mode 100644 (file)
index 0000000..1172555
--- /dev/null
+++ b/reg-tests/ssl/show_ssl_ocspresponse.vtci
@@ -0,0 +1,129 @@
+feature ignore_unknown_macro
+
+haproxy h1 -conf {
+    global
+    .if streq("$VTC_SOCK_TYPE",quic)
+        # required for backend connections
+        expose-experimental-directives
+    .endif
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+
+    .if !ssllib_name_startswith(AWS-LC)
+        tune.ssl.default-dh-param 2048
+    .endif
+        tune.ssl.capture-buffer-size 1
+        stats socket "${tmpdir}/h1/stats" level admin
+
+    defaults
+        mode http
+        option httplog
+        log stderr local0 debug err
+        option logasap
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+
+    listen clear-lst
+        bind "fd@${clearlst}"
+        server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl ca-file ${testdir}/certs/set_cafile_rootCA.crt verify none
+
+    listen ssl-lst
+        # crt: certificate of the server
+        # ca-file: CA used for client authentication request
+        bind "${VTC_SOCK_TYPE}+fd@${ssl}" ssl crt ${testdir}/certs/show_ocsp_server.pem ca-file ${testdir}/certs/set_cafile_rootCA.crt verify none crt-ignore-err all
+        http-response add-header X-SSL-Client-Verify %[ssl_c_verify]
+        server s1 ${s1_addr}:${s1_port}
+} -start
+
+
+# Test the "show ssl ocsp-response" command
+haproxy h1 -cli {
+    send "show ssl ocsp-response"
+    expect ~ "Certificate ID key : 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+
+    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+    expect ~ "Responder Id: C = FR, O = HAProxy Technologies, CN = ocsp.haproxy.com"
+    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+    expect ~ "Cert Status: good"
+}
+
+# Test the "show ssl ocsp-response" command with a certificate path as parameter
+shell {
+    ocsp_response=$(echo "show ssl ocsp-response ${testdir}/certs/show_ocsp_server.pem" | socat "${tmpdir}/h1/stats" -)
+
+    echo "$ocsp_response" | grep "Responder Id: C = FR, O = HAProxy Technologies, CN = ocsp.haproxy.com" &&
+    echo "$ocsp_response" | grep "Cert Status: good"
+}
+
+# Test the "show ssl cert foo.pem.ocsp" command
+haproxy h1 -cli {
+    send "show ssl cert"
+    expect ~ ".*show_ocsp_server.pem"
+
+    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem"
+    expect ~ "Serial: 100F"
+    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem"
+    expect ~ "OCSP Response Key: 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+
+    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem.ocsp"
+    expect ~ "Responder Id: C = FR, O = HAProxy Technologies, CN = ocsp.haproxy.com"
+    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem.ocsp"
+    expect ~ "Cert Status: good"
+}
+
+
+# Change the server certificate's OCSP response through "set ssl ocsp-response"
+shell {
+    printf "set ssl ocsp-response <<\n$(cat ${testdir}/certs/show_ocsp_server.pem.ocsp.revoked|openssl base64)\n\n" | socat "${tmpdir}/h1/stats" -
+}
+
+# Check that the change was taken into account
+haproxy h1 -cli {
+    send "show ssl ocsp-response"
+    expect ~ "Certificate ID key : 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+
+    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+    expect ~ "Responder Id: C = FR, O = HAProxy Technologies, CN = ocsp.haproxy.com"
+    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+    expect ~ "Cert Status: revoked"
+
+    send "show ssl cert ${testdir}/certs/show_ocsp_server.pem.ocsp"
+    expect ~ "Cert Status: revoked"
+}
+
+
+# Change the server certificate's OCSP response through a transaction
+shell {
+    printf "set ssl cert ${testdir}/certs/show_ocsp_server.pem <<\n$(cat ${testdir}/certs/show_ocsp_server.pem | sed  '/^$/d')\n\n" | socat  "${tmpdir}/h1/stats" -
+    printf "set ssl cert ${testdir}/certs/show_ocsp_server.pem.issuer <<\n$(cat ${testdir}/certs/show_ocsp_server.pem.issuer | sed  '/^$/d')\n\n" | socat  "${tmpdir}/h1/stats" -
+    printf "set ssl cert ${testdir}/certs/show_ocsp_server.pem.ocsp <<\n$(cat ${testdir}/certs/show_ocsp_server.pem.ocsp|openssl base64)\n\n" | socat  "${tmpdir}/h1/stats" -
+}
+
+
+# Check that the actual tree entry was not changed and that the uncommitted
+# transaction's OCSP response is the new one
+haproxy h1 -cli {
+    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+    expect ~ "Cert Status: revoked"
+    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+    expect ~ "This Update: Jun 10 08:57:45 2021 GMT"
+
+    send "show ssl cert *${testdir}/certs/show_ocsp_server.pem.ocsp"
+    expect ~ "Cert Status: good"
+    send "show ssl cert *${testdir}/certs/show_ocsp_server.pem.ocsp"
+    expect ~ "This Update: Jun 10 08:55:04 2021 GMT"
+}
+
+
+# Commit the transaction and check that it was taken into account
+haproxy h1 -cli {
+    send "commit ssl cert ${testdir}/certs/show_ocsp_server.pem"
+    expect ~ "Success!"
+
+    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+    expect ~ "Cert Status: good"
+    send "show ssl ocsp-response 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a0202100f"
+    expect ~ "This Update: Jun 10 08:55:04 2021 GMT"
+}