test/recipes/80-test_ocsp.t

   1 #! /usr/bin/perl
   2
   3 use strict;
   4 use warnings;
   5
   6 use POSIX;
   7 use File::Spec::Functions qw/devnull catfile/;
   8 use File::Copy;
   9 use Test::More 0.96;
  10 use OpenSSL::Test qw/:DEFAULT with pipe top_dir/;
  11
  12 setup("test_ocsp");
  13
  14 my $ocspdir=top_dir("test", "ocsp-tests");
  15 # 17 December 2012 so we don't get certificate expiry errors.
  16 my @check_time=("-attime", "1355875200");
  17
  18 sub test_ocsp {
  19     my $title = shift;
  20     my $inputfile = shift;
  21     my $CAfile = shift;
  22     my $expected_exit = shift;
  23
  24     with({ exit_checker => sub { return shift == $expected_exit; } },
  25          sub { ok(run(pipe(app(["openssl", "base64", "-d",
  26                                 "-in", catfile($ocspdir,$inputfile)]),
  27                            app(["openssl", "ocsp", "-respin", "-",
  28                                 "-partial_chain", @check_time,
  29                                 "-CAfile", catfile($ocspdir, $CAfile),
  30                                 "-verify_other", catfile($ocspdir, $CAfile),
  31                                 "-CApath", devnull()]))),
  32                   $title); });
  33 }
  34
  35 plan tests => 10;
  36
  37 subtest "=== VALID OCSP RESPONSES ===" => sub {
  38     plan tests => 6;
  39
  40     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  41               "ND1.ors", "ND1_Issuer_ICA.pem", 0);
  42     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  43               "ND2.ors", "ND2_Issuer_Root.pem", 0);
  44     test_ocsp("NON-DELEGATED; Root CA -> EE",
  45               "ND3.ors", "ND3_Issuer_Root.pem", 0);
  46     test_ocsp("DELEGATED; Intermediate CA -> EE",
  47               "D1.ors", "D1_Issuer_ICA.pem", 0);
  48     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  49               "D2.ors", "D2_Issuer_Root.pem", 0);
  50     test_ocsp("DELEGATED; Root CA -> EE",
  51               "D3.ors", "D3_Issuer_Root.pem", 0);
  52 };
  53
  54 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
  55     plan tests => 6;
  56
  57     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  58               "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
  59     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  60               "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
  61     test_ocsp("NON-DELEGATED; Root CA -> EE",
  62               "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
  63     test_ocsp("DELEGATED; Intermediate CA -> EE",
  64               "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
  65     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  66               "ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
  67     test_ocsp("DELEGATED; Root CA -> EE",
  68               "ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
  69 };
  70
  71 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
  72     plan tests => 6;
  73
  74     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  75               "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
  76     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  77               "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
  78     test_ocsp("NON-DELEGATED; Root CA -> EE",
  79               "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
  80     test_ocsp("DELEGATED; Intermediate CA -> EE",
  81               "WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
  82     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
  83               "WRID_D2.ors", "D2_Issuer_Root.pem", 1);
  84     test_ocsp("DELEGATED; Root CA -> EE",
  85               "WRID_D3.ors", "D3_Issuer_Root.pem", 1);
  86 };
  87
  88 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
  89     plan tests => 6;
  90
  91     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
  92               "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
  93     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
  94               "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
  95     test_ocsp("NON-DELEGATED; Root CA -> EE",
  96               "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
  97     test_ocsp("DELEGATED; Intermediate CA -> EE",
  98               "WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
  99     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 100               "WINH_D2.ors", "D2_Issuer_Root.pem", 1);
 101     test_ocsp("DELEGATED; Root CA -> EE",
 102               "WINH_D3.ors", "D3_Issuer_Root.pem", 1);
 103 };
 104
 105 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
 106     plan tests => 6;
 107
 108     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 109               "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
 110     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 111               "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
 112     test_ocsp("NON-DELEGATED; Root CA -> EE",
 113               "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
 114     test_ocsp("DELEGATED; Intermediate CA -> EE",
 115               "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
 116     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 117               "WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
 118     test_ocsp("DELEGATED; Root CA -> EE",
 119               "WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
 120 };
 121
 122 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
 123     plan tests => 3;
 124
 125     test_ocsp("DELEGATED; Intermediate CA -> EE",
 126               "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
 127     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 128               "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
 129     test_ocsp("DELEGATED; Root CA -> EE",
 130               "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
 131 };
 132
 133 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
 134     plan tests => 3;
 135
 136     test_ocsp("DELEGATED; Intermediate CA -> EE",
 137               "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
 138     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 139               "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
 140     test_ocsp("DELEGATED; Root CA -> EE",
 141               "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
 142 };
 143
 144 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
 145     plan tests => 6;
 146
 147     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 148               "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
 149     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 150               "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
 151     test_ocsp("NON-DELEGATED; Root CA -> EE",
 152               "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
 153     test_ocsp("DELEGATED; Intermediate CA -> EE",
 154               "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
 155     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 156               "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
 157     test_ocsp("DELEGATED; Root CA -> EE",
 158               "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
 159 };
 160
 161 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
 162     plan tests => 6;
 163
 164     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 165               "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
 166     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 167               "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
 168     test_ocsp("NON-DELEGATED; Root CA -> EE",
 169               "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
 170     test_ocsp("DELEGATED; Intermediate CA -> EE",
 171               "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
 172     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 173               "D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
 174     test_ocsp("DELEGATED; Root CA -> EE",
 175               "D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
 176 };
 177
 178 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
 179     plan tests => 6;
 180
 181     # Expect success, because we're explicitly trusting the issuer certificate.
 182     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
 183               "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
 184     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
 185               "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
 186     test_ocsp("NON-DELEGATED; Root CA -> EE",
 187               "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
 188     test_ocsp("DELEGATED; Intermediate CA -> EE",
 189               "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
 190     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
 191               "D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
 192     test_ocsp("DELEGATED; Root CA -> EE",
 193               "D3.ors", "ISIC_D3_Issuer_Root.pem", 0);
 194 };