X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;f=test%2Frecipes%2F80-test_ocsp.t;h=e9ed7b4d519bb95bdd889612c1a8e3e3a6383dcb;hb=0f987bdab8c2e83d0bd4868c596903445d0ff12c;hp=103a7aea0eafd19ec742c32d7b80de975a8e5dca;hpb=596d6b7e1ca5aa24700098e262cb1625f256343f;p=openssl.git

diff --git a/test/recipes/80-test_ocsp.t b/test/recipes/80-test_ocsp.t
index 103a7aea0e..e9ed7b4d51 100644
--- a/test/recipes/80-test_ocsp.t
+++ b/test/recipes/80-test_ocsp.t
@@ -13,7 +13,7 @@ use warnings;
 use POSIX;
 use File::Spec::Functions qw/devnull catfile/;
 use File::Copy;
-use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir/;
+use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir data_file/;
 use OpenSSL::Test::Utils;
 
 setup("test_ocsp");
@@ -29,6 +29,10 @@ sub test_ocsp {
     my $title = shift;
     my $inputfile = shift;
     my $CAfile = shift;
+    my $untrusted = shift;
+    if ($untrusted eq "") {
+        $untrusted = $CAfile;
+    }
     my $expected_exit = shift;
 
     run(app(["openssl", "base64", "-d",
@@ -38,153 +42,155 @@ sub test_ocsp {
          sub { ok(run(app(["openssl", "ocsp", "-respin", "ocsp-resp-fff.dat",
                            "-partial_chain", @check_time,
                            "-CAfile", catfile($ocspdir, $CAfile),
-                           "-verify_other", catfile($ocspdir, $CAfile),
+                           "-verify_other", catfile($ocspdir, $untrusted),
                            "-no-CApath"])),
                   $title); });
     unlink "ocsp-resp-fff.dat";
 }
 
-plan tests => 10;
+plan tests => 11;
 
 subtest "=== VALID OCSP RESPONSES ===" => sub {
-    plan tests => 6;
+    plan tests => 7;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-	      "ND1.ors", "ND1_Issuer_ICA.pem", 0);
+	      "ND1.ors", "ND1_Issuer_ICA.pem", "", 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-	      "ND2.ors", "ND2_Issuer_Root.pem", 0);
+	      "ND2.ors", "ND2_Issuer_Root.pem", "", 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-	      "ND3.ors", "ND3_Issuer_Root.pem", 0);
+	      "ND3.ors", "ND3_Issuer_Root.pem", "", 0);
+    test_ocsp("NON-DELEGATED; 3-level CA hierarchy",
+	      "ND1.ors", "ND1_Cross_Root.pem", "ND1_Issuer_ICA-Cross.pem", 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "D1.ors", "D1_Issuer_ICA.pem", 0);
+	      "D1.ors", "D1_Issuer_ICA.pem", "", 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "D2.ors", "D2_Issuer_Root.pem", 0);
+	      "D2.ors", "D2_Issuer_Root.pem", "", 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "D3.ors", "D3_Issuer_Root.pem", 0);
+	      "D3.ors", "D3_Issuer_Root.pem", "", 0);
 };
 
 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-	      "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
+	      "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-	      "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
+	      "ISOP_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-	      "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
+	      "ISOP_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
+	      "ISOP_D1.ors", "D1_Issuer_ICA.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
+	      "ISOP_D2.ors", "D2_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
+	      "ISOP_D3.ors", "D3_Issuer_Root.pem", "", 1);
 };
 
 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-	      "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
+	      "WRID_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-	      "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
+	      "WRID_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-	      "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
+	      "WRID_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
+	      "WRID_D1.ors", "D1_Issuer_ICA.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "WRID_D2.ors", "D2_Issuer_Root.pem", 1);
+	      "WRID_D2.ors", "D2_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "WRID_D3.ors", "D3_Issuer_Root.pem", 1);
+	      "WRID_D3.ors", "D3_Issuer_Root.pem", "", 1);
 };
 
 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-	      "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
+	      "WINH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-	      "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
+	      "WINH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-	      "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
+	      "WINH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
+	      "WINH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "WINH_D2.ors", "D2_Issuer_Root.pem", 1);
+	      "WINH_D2.ors", "D2_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "WINH_D3.ors", "D3_Issuer_Root.pem", 1);
+	      "WINH_D3.ors", "D3_Issuer_Root.pem", "", 1);
 };
 
 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-	      "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
+	      "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-	      "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
+	      "WIKH_ND2.ors", "ND2_Issuer_Root.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-	      "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
+	      "WIKH_ND3.ors", "ND3_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
+	      "WIKH_D1.ors", "D1_Issuer_ICA.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
+	      "WIKH_D2.ors", "D2_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
+	      "WIKH_D3.ors", "D3_Issuer_Root.pem", "", 1);
 };
 
 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
     plan tests => 3;
 
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
+	      "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
+	      "WKDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
+	      "WKDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
 };
 
 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
     plan tests => 3;
 
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
+	      "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
+	      "ISDOSC_D2.ors", "D2_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
+	      "ISDOSC_D3.ors", "D3_Issuer_Root.pem", "", 1);
 };
 
 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-	      "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
+	      "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-	      "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
+	      "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-	      "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
+	      "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
+	      "D1.ors", "WSNIC_D1_Issuer_ICA.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
+	      "D2.ors", "WSNIC_D2_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
+	      "D3.ors", "WSNIC_D3_Issuer_Root.pem", "", 1);
 };
 
 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
     plan tests => 6;
 
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-	      "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
+	      "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-	      "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
+	      "ND2.ors", "WKIC_ND2_Issuer_Root.pem", "", 1);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-	      "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
+	      "ND3.ors", "WKIC_ND3_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
+	      "D1.ors", "WKIC_D1_Issuer_ICA.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
+	      "D2.ors", "WKIC_D2_Issuer_Root.pem", "", 1);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
+	      "D3.ors", "WKIC_D3_Issuer_Root.pem", "", 1);
 };
 
 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
@@ -192,15 +198,22 @@ subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
 
     # Expect success, because we're explicitly trusting the issuer certificate.
     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
-	      "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
+	      "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", "", 0);
     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
-	      "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
+	      "ND2.ors", "ISIC_ND2_Issuer_Root.pem", "", 0);
     test_ocsp("NON-DELEGATED; Root CA -> EE",
-	      "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
+	      "ND3.ors", "ISIC_ND3_Issuer_Root.pem", "", 0);
     test_ocsp("DELEGATED; Intermediate CA -> EE",
-	      "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
+	      "D1.ors", "ISIC_D1_Issuer_ICA.pem", "", 0);
     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
-	      "D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
+	      "D2.ors", "ISIC_D2_Issuer_Root.pem", "", 0);
     test_ocsp("DELEGATED; Root CA -> EE",
-	      "D3.ors", "ISIC_D3_Issuer_Root.pem", 0);
+	      "D3.ors", "ISIC_D3_Issuer_Root.pem", "", 0);
 };
+
+subtest "=== OCSP API TESTS===" => sub {
+    plan tests => 1;
+
+    ok(run(test(["ocspapitest", data_file("cert.pem"), data_file("key.pem")])),
+                 "running ocspapitest");
+}