From f5d786885721c374cc22a1f1311ca01408a496fd Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Sun, 24 Mar 2013 21:49:12 +0000 Subject: OCSP-stapling enhancement and testing. Server: Honor environment variable as well as running_in_test_harness in permitting bogus staplings Update server tests Add "-ocsp" option to client-ssl. Server side: add verification of stapled status. First cut server-mode ocsp testing. Fix some uninitialized ocsp-related data. Client (new): Verify stapling using only the chain that verified the server cert, not any acceptable chain. Add check for multiple responses in a stapling, which is not handled Refuse verification on expired and revoking staplings. Handle OCSP client refusal on lack of stapling from server. More fixing in client OCSP: use the server cert signing chain to verify the OCSP info. Add transport hosts_require_ocsp option. Log stapling responses. Start on tests for client-side. Testing support: Add CRL generation code and documentation update Initial CA & certificate set for testing. BUGFIX: Once a single OCSP response has been extracted the validation routine return code is no longer about the structure, but the actual returned OCSP status. --- test/scripts/5600-OCSP-OpenSSL/5600 | 80 +++++++++++++++++++++++++++++++++ test/scripts/5600-OCSP-OpenSSL/5601 | 65 +++++++++++++++++++++++++++ test/scripts/5600-OCSP-OpenSSL/REQUIRES | 3 ++ 3 files changed, 148 insertions(+) create mode 100644 test/scripts/5600-OCSP-OpenSSL/5600 create mode 100644 test/scripts/5600-OCSP-OpenSSL/5601 create mode 100644 test/scripts/5600-OCSP-OpenSSL/REQUIRES (limited to 'test/scripts') diff --git a/test/scripts/5600-OCSP-OpenSSL/5600 b/test/scripts/5600-OCSP-OpenSSL/5600 new file mode 100644 index 000000000..464da693c --- /dev/null +++ b/test/scripts/5600-OCSP-OpenSSL/5600 @@ -0,0 +1,80 @@ +# TLS server: OCSP stapling +# +# +# +# 1: Server sends good staple on request +exim -bd -oX PORT_D -DSERVER=server \ + -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp +**** +client-ssl \ + -ocsp aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem \ + HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2 +??? 220 +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 +starttls +??? 220 +mail from: +??? 250 +rcpt to: +??? 250 +quit +??? 221 +**** +killdaemon +# +# +# +# 2: Server does not staple an outdated response +exim -bd -oX PORT_D -DSERVER=server \ + -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp +**** +# XXX test sequence might not be quite right; this is for a server refusal +# and we're expecting a client refusal. +client-ssl -ocsp aux-fixed/exim-ca/expired1.example.com/CA.pem HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2 +??? 220 +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 +starttls +??? 220 +**** +killdaemon +# +# +# +# +# +# 3: Server does not staple a response for a revoked cert +exim -bd -oX PORT_D -DSERVER=server \ + -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp +**** +client-ssl \ + -ocsp aux-fixed/exim-ca/example.com/server1.example.com/ca_chain.pem \ + HOSTIPV4 PORT_D aux-fixed/cert2 aux-fixed/cert2 +??? 220 +ehlo rhu.barb +??? 250- +??? 250- +??? 250- +??? 250- +??? 250- +??? 250 +starttls +??? 220 +**** +killdaemon +# +# +# +# +# diff --git a/test/scripts/5600-OCSP-OpenSSL/5601 b/test/scripts/5600-OCSP-OpenSSL/5601 new file mode 100644 index 000000000..b2983eb0d --- /dev/null +++ b/test/scripts/5600-OCSP-OpenSSL/5601 @@ -0,0 +1,65 @@ +# OCSP stapling, client +# +# +# Client works when we don't demand OCSP stapling +exim -bd -oX PORT_D -DSERVER=server -DOCSP=/dev/null +**** +exim nostaple@test.ex +test message. +**** +sleep 1 +killdaemon +# +# +# +# +# Client accepts good stapled info +exim -bd -oX PORT_D -DSERVER=server \ + -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.good.resp +**** +exim CALLER@test.ex +test message. +**** +sleep 1 +killdaemon +# +# +# +# Client fails on lack of requested stapled info +exim -bd -oX PORT_D -DSERVER=server -DOCSP=/dev/null +**** +exim CALLER@test.ex +test message. +**** +sleep 1 +killdaemon +no_msglog_check +# +# +# +# Client fails on revoked stapled info +EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \ + -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.revoked.resp +**** +exim CALLER@test.ex +test message. +**** +sleep 1 +killdaemon +# +# +# +# +# Client fails on expired stapled info +EXIM_TESTHARNESS_DISABLE_OCSPVALIDITYCHECK=y exim -bd -oX PORT_D -DSERVER=server \ + -DOCSP=DIR/aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.ocsp.dated.resp +**** +exim CALLER@test.ex +test message. +**** +sleep 1 +killdaemon +# +# +# +# diff --git a/test/scripts/5600-OCSP-OpenSSL/REQUIRES b/test/scripts/5600-OCSP-OpenSSL/REQUIRES new file mode 100644 index 000000000..3d15ede9e --- /dev/null +++ b/test/scripts/5600-OCSP-OpenSSL/REQUIRES @@ -0,0 +1,3 @@ +support OpenSSL +support Experimental_OCSP +running IPv4 -- cgit v1.2.3