ocsp-stapling2.test 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530
  1. #!/usr/bin/env bash
  2. # ocsp-stapling2.test
  3. # Test requires HAVE_OCSP and HAVE_CERTIFICATE_STATUS_REQUEST_V2
  4. SCRIPT_DIR="$(dirname "$0")"
  5. # if we can, isolate the network namespace to eliminate port collisions.
  6. if [[ -n "$NETWORK_UNSHARE_HELPER" ]]; then
  7. if [[ -z "$NETWORK_UNSHARE_HELPER_CALLED" ]]; then
  8. export NETWORK_UNSHARE_HELPER_CALLED=yes
  9. exec "$NETWORK_UNSHARE_HELPER" "$0" "$@" || exit $?
  10. fi
  11. elif [ "${AM_BWRAPPED-}" != "yes" ]; then
  12. bwrap_path="$(command -v bwrap)"
  13. if [ -n "$bwrap_path" ]; then
  14. export AM_BWRAPPED=yes
  15. exec "$bwrap_path" --unshare-net --dev-bind / / "$0" "$@"
  16. fi
  17. unset AM_BWRAPPED
  18. fi
  19. if [[ -z "${RETRIES_REMAINING-}" ]]; then
  20. export RETRIES_REMAINING=2
  21. fi
  22. if ! ./examples/client/client -V | grep -q 3; then
  23. echo 'skipping ocsp-stapling2.test because TLS1.2 is not available.' 1>&2
  24. exit 77
  25. fi
  26. if ./examples/client/client '-#' | fgrep -q -e ' -DWOLFSSL_SNIFFER '; then
  27. echo 'skipping oscp-stapling2.test because WOLFSSL_SNIFFER defined.'
  28. exit 77
  29. fi
  30. if openssl s_server -help 2>&1 | fgrep -q -i ipv6 && nc -h 2>&1 | fgrep -q -i ipv6; then
  31. IPV6_SUPPORTED=yes
  32. else
  33. IPV6_SUPPORTED=no
  34. fi
  35. if ./examples/client/client '-#' | fgrep -q -e ' -DTEST_IPV6 '; then
  36. if [[ "$IPV6_SUPPORTED" == "no" ]]; then
  37. echo 'Skipping IPV6 test in environment lacking IPV6 support.'
  38. exit 77
  39. fi
  40. LOCALHOST='[::1]'
  41. LOCALHOST_FOR_NC='-6 ::1'
  42. else
  43. LOCALHOST='127.0.0.1'
  44. LOCALHOST_FOR_NC='127.0.0.1'
  45. fi
  46. PARENTDIR="$PWD"
  47. # create a unique workspace directory ending in PID for the script instance ($$)
  48. # to make this instance orthogonal to any others running, even on same repo.
  49. # TCP ports are also carefully formed below from the PID, to minimize conflicts.
  50. WORKSPACE="${PARENTDIR}/workspace.pid$$"
  51. mkdir "${WORKSPACE}" || exit $?
  52. cp -pR ${SCRIPT_DIR}/../certs "${WORKSPACE}"/ || exit $?
  53. cd "$WORKSPACE" || exit $?
  54. ln -s ../examples
  55. CERT_DIR="certs/ocsp"
  56. ready_file1="$WORKSPACE"/wolf_ocsp_s2_readyF1$$
  57. ready_file2="$WORKSPACE"/wolf_ocsp_s2_readyF2$$
  58. ready_file3="$WORKSPACE"/wolf_ocsp_s2_readyF3$$
  59. ready_file4="$WORKSPACE"/wolf_ocsp_s2_readyF4$$
  60. ready_file5="$WORKSPACE"/wolf_ocsp_s2_readyF5$$
  61. printf '%s\n' "ready file 1: $ready_file1"
  62. printf '%s\n' "ready file 2: $ready_file2"
  63. printf '%s\n' "ready file 3: $ready_file3"
  64. printf '%s\n' "ready file 4: $ready_file4"
  65. printf '%s\n' "ready file 5: $ready_file5"
  66. test_cnf="ocsp_s2.cnf"
  67. wait_for_readyFile(){
  68. counter=0
  69. while [ ! -s $1 -a "$counter" -lt 20 ]; do
  70. if [[ -n "${2-}" ]]; then
  71. if ! kill -0 $2 2>&-; then
  72. echo "pid $2 for port ${3-} exited before creating ready file. bailing..."
  73. exit 1
  74. fi
  75. fi
  76. echo -e "waiting for ready file..."
  77. sleep 0.1
  78. counter=$((counter+ 1))
  79. done
  80. if test -e $1; then
  81. echo -e "found ready file, starting client..."
  82. else
  83. echo -e "NO ready file at $1 -- ending test..."
  84. exit 1
  85. fi
  86. }
  87. remove_single_rF(){
  88. if test -e $1; then
  89. printf '%s\n' "removing ready file: $1"
  90. rm $1
  91. fi
  92. }
  93. #create a configure file for cert generation with the port 0 solution
  94. create_new_cnf() {
  95. printf '%s\n' "Random Ports Selected: $1 $2 $3 $4"
  96. printf '%s\n' "#" > $test_cnf
  97. printf '%s\n' "# openssl configuration file for OCSP certificates" >> $test_cnf
  98. printf '%s\n' "#" >> $test_cnf
  99. printf '%s\n' "" >> $test_cnf
  100. printf '%s\n' "# Extensions to add to a certificate request (intermediate1-ca)" >> $test_cnf
  101. printf '%s\n' "[ v3_req1 ]" >> $test_cnf
  102. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  103. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  104. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  105. printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
  106. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$1" >> $test_cnf
  107. printf '%s\n' "" >> $test_cnf
  108. printf '%s\n' "# Extensions to add to a certificate request (intermediate2-ca)" >> $test_cnf
  109. printf '%s\n' "[ v3_req2 ]" >> $test_cnf
  110. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  111. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  112. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  113. printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
  114. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$2" >> $test_cnf
  115. printf '%s\n' "" >> $test_cnf
  116. printf '%s\n' "# Extensions to add to a certificate request (intermediate3-ca)" >> $test_cnf
  117. printf '%s\n' "[ v3_req3 ]" >> $test_cnf
  118. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  119. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  120. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  121. printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
  122. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$3" >> $test_cnf
  123. printf '%s\n' "" >> $test_cnf
  124. printf '%s\n' "# Extensions for a typical CA" >> $test_cnf
  125. printf '%s\n' "[ v3_ca ]" >> $test_cnf
  126. printf '%s\n' "basicConstraints = CA:true" >> $test_cnf
  127. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  128. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  129. printf '%s\n' "keyUsage = keyCertSign, cRLSign" >> $test_cnf
  130. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$4" >> $test_cnf
  131. printf '%s\n' "" >> $test_cnf
  132. printf '%s\n' "# OCSP extensions." >> $test_cnf
  133. printf '%s\n' "[ v3_ocsp ]" >> $test_cnf
  134. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  135. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  136. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  137. printf '%s\n' "extendedKeyUsage = OCSPSigning" >> $test_cnf
  138. mv $test_cnf $CERT_DIR/$test_cnf
  139. cd $CERT_DIR
  140. CURR_LOC="$PWD"
  141. printf '%s\n' "echo now in $CURR_LOC"
  142. ./renewcerts-for-test.sh $test_cnf
  143. cd $WORKSPACE
  144. }
  145. remove_ready_file(){
  146. if test -e $ready_file1; then
  147. printf '%s\n' "removing ready file: $ready_file1"
  148. rm $ready_file1
  149. fi
  150. if test -e $ready_file2; then
  151. printf '%s\n' "removing ready file: $ready_file2"
  152. rm $ready_file2
  153. fi
  154. if test -e $ready_file3; then
  155. printf '%s\n' "removing ready file: $ready_file3"
  156. rm $ready_file3
  157. fi
  158. if test -e $ready_file4; then
  159. printf '%s\n' "removing ready file: $ready_file4"
  160. rm $ready_file4
  161. fi
  162. if test -e $ready_file5; then
  163. printf '%s\n' "removing ready file: $ready_file5"
  164. rm $ready_file5
  165. fi
  166. }
  167. cleanup()
  168. {
  169. exit_status=$?
  170. for i in $(jobs -pr)
  171. do
  172. kill -s KILL "$i"
  173. done
  174. remove_ready_file
  175. rm $CERT_DIR/$test_cnf
  176. cd "$PARENTDIR" || return 1
  177. rm -r "$WORKSPACE" || return 1
  178. if [[ ("$exit_status" == 1) && ($RETRIES_REMAINING -gt 0) ]]; then
  179. echo "retrying..."
  180. RETRIES_REMAINING=$((RETRIES_REMAINING - 1))
  181. exec $0 "$@"
  182. fi
  183. }
  184. trap cleanup EXIT INT TERM HUP
  185. [ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1
  186. # check if supported key size is large enough to handle 4096 bit RSA
  187. size="$(./examples/client/client '-?' | grep "Max RSA key")"
  188. size="${size//[^0-9]/}"
  189. if [ ! -z "$size" ]; then
  190. printf 'check on max key size of %d ...' $size
  191. if [ $size -lt 4096 ]; then
  192. printf '%s\n' "4096 bit RSA keys not supported"
  193. exit 0
  194. fi
  195. printf 'OK\n'
  196. fi
  197. #get four unique ports
  198. # choose consecutive ports based on the PID, skipping any that are
  199. # already bound, to avoid the birthday problem in case other
  200. # instances are sharing this host.
  201. get_first_free_port() {
  202. local ret="$1"
  203. while :; do
  204. if [[ "$ret" -ge 65536 ]]; then
  205. ret=1024
  206. fi
  207. if ! nc -z ${LOCALHOST_FOR_NC} "$ret"; then
  208. break
  209. fi
  210. ret=$((ret+1))
  211. done
  212. echo "$ret"
  213. return 0
  214. }
  215. base_port=$((((($$ + $RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
  216. port1=$(get_first_free_port $base_port)
  217. port2=$(get_first_free_port $((port1 + 1)))
  218. port3=$(get_first_free_port $((port2 + 1)))
  219. port4=$(get_first_free_port $((port3 + 1)))
  220. port5=$(get_first_free_port $((port4 + 1)))
  221. # 1:
  222. ./examples/server/server -R $ready_file1 -p $port1 &
  223. server_pid1=$!
  224. wait_for_readyFile $ready_file1 $server_pid1 $port1
  225. if [ ! -f $ready_file1 ]; then
  226. printf '%s\n' "Failed to create ready file1: \"$ready_file1\""
  227. exit 1
  228. fi
  229. # 2:
  230. ./examples/server/server -R $ready_file2 -p $port2 &
  231. server_pid2=$!
  232. wait_for_readyFile $ready_file2 $server_pid2 $port2
  233. if [ ! -f $ready_file2 ]; then
  234. printf '%s\n' "Failed to create ready file2: \"$ready_file2\""
  235. exit 1
  236. fi
  237. # 3:
  238. ./examples/server/server -R $ready_file3 -p $port3 &
  239. server_pid3=$!
  240. wait_for_readyFile $ready_file3 $server_pid3 $port3
  241. if [ ! -f $ready_file3 ]; then
  242. printf '%s\n' "Failed to create ready file3: \"$ready_file3\""
  243. exit 1
  244. fi
  245. # 4:
  246. ./examples/server/server -R $ready_file4 -p $port4 &
  247. server_pid4=$!
  248. wait_for_readyFile $ready_file4 $server_pid4 $port4
  249. if [ ! -f $ready_file4 ]; then
  250. printf '%s\n' "Failed to create ready file4: \"$ready_file4\""
  251. exit 1
  252. fi
  253. printf '%s\n' "------------- PORTS ---------------"
  254. printf '%s' "Random ports selected: $port1 $port2"
  255. printf '%s\n' " $port3 $port4"
  256. printf '%s\n' "-----------------------------------"
  257. # Use client connections to cleanly shutdown the servers
  258. ./examples/client/client -p $port1
  259. ./examples/client/client -p $port2
  260. ./examples/client/client -p $port3
  261. ./examples/client/client -p $port4
  262. create_new_cnf $port1 $port2 $port3 \
  263. $port4
  264. sleep 0.1
  265. # setup ocsp responders
  266. # OLD: ./certs/ocsp/ocspd-root-ca-and-intermediate-cas.sh &
  267. # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
  268. # purposes!
  269. openssl ocsp -port $port1 -nmin 1 \
  270. -index certs/ocsp/index-ca-and-intermediate-cas.txt \
  271. -rsigner certs/ocsp/ocsp-responder-cert.pem \
  272. -rkey certs/ocsp/ocsp-responder-key.pem \
  273. -CA certs/ocsp/root-ca-cert.pem \
  274. "$@" \
  275. &
  276. # OLD: ./certs/ocsp/ocspd-intermediate2-ca-issued-certs.sh &
  277. # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
  278. # purposes!
  279. openssl ocsp -port $port2 -nmin 1 \
  280. -index certs/ocsp/index-intermediate2-ca-issued-certs.txt \
  281. -rsigner certs/ocsp/ocsp-responder-cert.pem \
  282. -rkey certs/ocsp/ocsp-responder-key.pem \
  283. -CA certs/ocsp/intermediate2-ca-cert.pem \
  284. "$@" \
  285. &
  286. # OLD: ./certs/ocsp/ocspd-intermediate3-ca-issued-certs.sh &
  287. # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
  288. # purposes!
  289. openssl ocsp -port $port3 -nmin 1 \
  290. -index certs/ocsp/index-intermediate3-ca-issued-certs.txt \
  291. -rsigner certs/ocsp/ocsp-responder-cert.pem \
  292. -rkey certs/ocsp/ocsp-responder-key.pem \
  293. -CA certs/ocsp/intermediate3-ca-cert.pem \
  294. "$@" \
  295. &
  296. # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
  297. # purposes!
  298. openssl ocsp -port $port4 -nmin 1 \
  299. -index certs/ocsp/index-ca-and-intermediate-cas.txt \
  300. -rsigner certs/ocsp/ocsp-responder-cert.pem \
  301. -rkey certs/ocsp/ocsp-responder-key.pem \
  302. -CA certs/ocsp/root-ca-cert.pem \
  303. "$@" \
  304. &
  305. sleep 0.1
  306. # "jobs" is not portable for posix. Must use bash interpreter!
  307. [ $(jobs -r | wc -l) -ne 4 ] && printf '\n\n%s\n' "Setup ocsp responder failed, skipping" && exit 0
  308. printf '\n\n%s\n\n' "All OCSP responders started successfully!"
  309. printf '%s\n\n' "------------- TEST CASE 1 SHOULD PASS ------------------------"
  310. # client test against our own server - GOOD CERTS
  311. ./examples/server/server -c certs/ocsp/server3-cert.pem \
  312. -k certs/ocsp/server3-key.pem -R $ready_file5 \
  313. -p $port5 &
  314. server_pid5=$!
  315. wait_for_readyFile $ready_file5 $server_pid5 $port5
  316. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
  317. -p $port5
  318. RESULT=$?
  319. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
  320. printf '%s\n\n' "Test PASSED!"
  321. printf '%s\n\n' "------------- TEST CASE 2 SHOULD PASS ------------------------"
  322. remove_single_rF $ready_file5
  323. ./examples/server/server -c certs/ocsp/server3-cert.pem \
  324. -k certs/ocsp/server3-key.pem -R $ready_file5 \
  325. -p $port5 &
  326. server_pid5=$!
  327. wait_for_readyFile $ready_file5 $server_pid5 $port5
  328. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
  329. -p $port5
  330. RESULT=$?
  331. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 2 failed" && exit 1
  332. printf '%s\n\n' "Test PASSED!"
  333. printf '%s\n\n' "------------- TEST CASE 3 SHOULD REVOKE ----------------------"
  334. # client test against our own server - REVOKED SERVER CERT
  335. remove_single_rF $ready_file5
  336. ./examples/server/server -c certs/ocsp/server4-cert.pem \
  337. -k certs/ocsp/server4-key.pem -R $ready_file5 \
  338. -p $port5 &
  339. server_pid5=$!
  340. wait_for_readyFile $ready_file5 $server_pid5 $port5
  341. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
  342. -p $port5
  343. RESULT=$?
  344. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
  345. printf '%s\n\n' "Test successfully REVOKED!"
  346. printf '%s\n\n' "------------- TEST CASE 4 SHOULD REVOKE ----------------------"
  347. remove_single_rF $ready_file5
  348. ./examples/server/server -c certs/ocsp/server4-cert.pem \
  349. -k certs/ocsp/server4-key.pem -R $ready_file5 \
  350. -p $port5 &
  351. sleep 0.1
  352. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
  353. -p $port5
  354. RESULT=$?
  355. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
  356. printf '%s\n\n' "Test successfully REVOKED!"
  357. printf '%s\n\n' "------------- TEST CASE 5 SHOULD PASS ------------------------"
  358. # client test against our own server - REVOKED INTERMEDIATE CERT
  359. remove_single_rF $ready_file5
  360. ./examples/server/server -c certs/ocsp/server5-cert.pem \
  361. -k certs/ocsp/server5-key.pem -R $ready_file5 \
  362. -p $port5 &
  363. server_pid5=$!
  364. wait_for_readyFile $ready_file5 $server_pid5 $port5
  365. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -v 3 \
  366. -p $port5
  367. RESULT=$?
  368. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 3 failed $RESULT" && exit 1
  369. printf '%s\n\n' "Test PASSED!"
  370. printf '%s\n\n' "------------- TEST CASE 6 SHOULD REVOKE ----------------------"
  371. remove_single_rF $ready_file5
  372. ./examples/server/server -c certs/ocsp/server5-cert.pem \
  373. -k certs/ocsp/server5-key.pem -R $ready_file5 \
  374. -p $port5 &
  375. server_pid5=$!
  376. wait_for_readyFile $ready_file5 $server_pid5 $port5
  377. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
  378. -p $port5
  379. RESULT=$?
  380. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
  381. printf '%s\n\n' "Test successfully REVOKED!"
  382. printf '%s\n\n' "------------- TEST CASE 7 LOAD CERT IN SSL -------------------"
  383. remove_single_rF $ready_file5
  384. ./examples/server/server -c certs/ocsp/server1-cert.pem \
  385. -k certs/ocsp/server1-key.pem -R $ready_file5 \
  386. -p $port5 -H loadSSL &
  387. server_pid5=$!
  388. wait_for_readyFile $ready_file5 $server_pid5 $port5
  389. echo "test connection" | openssl s_client -status -legacy_renegotiation -connect ${LOCALHOST}:$port5 -cert ./certs/client-cert.pem -key ./certs/client-key.pem -CAfile ./certs/ocsp/root-ca-cert.pem
  390. RESULT=$?
  391. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection failed $RESULT" && exit 1
  392. wait $server_pid5
  393. if [ $? -ne 0 ]; then
  394. printf '%s\n' "Unexpected server result"
  395. exit 1
  396. fi
  397. printf '%s\n\n' "Test successful"
  398. printf '%s\n\n' "------------- TEST CASE 8 SHOULD REVOKE ----------------------"
  399. remove_single_rF $ready_file5
  400. ./examples/server/server -c certs/ocsp/server4-cert.pem \
  401. -k certs/ocsp/server4-key.pem -R $ready_file5 \
  402. -p $port5 -H loadSSL &
  403. server_pid5=$!
  404. sleep 0.1
  405. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 3 -v 3 \
  406. -p $port5
  407. RESULT=$?
  408. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection succeeded $RESULT" && exit 1
  409. wait $server_pid5
  410. if [ $? -ne 1 ]; then
  411. printf '%s\n' "Unexpected server result"
  412. exit 1
  413. fi
  414. printf '%s\n\n' "Test successfully REVOKED!"
  415. # need a unique port since may run the same time as testsuite
  416. generate_port() {
  417. #-------------------------------------------------------------------------#
  418. # Generate a random port number
  419. #-------------------------------------------------------------------------#
  420. if [[ "$OSTYPE" == "linux"* ]]; then
  421. port=$(($(od -An -N2 /dev/urandom) % (65535-49512) + 49512))
  422. elif [[ "$OSTYPE" == "darwin"* ]]; then
  423. port=$(($(od -An -N2 /dev/random) % (65535-49512) + 49512))
  424. else
  425. echo "Unknown OS TYPE"
  426. exit 1
  427. fi
  428. }
  429. # Start OpenSSL server that has no OCSP responses to return
  430. generate_port
  431. openssl s_server -cert ./certs/server-cert.pem -key certs/server-key.pem -www -port $port &
  432. openssl_pid=$!
  433. MAX_TIMEOUT=10
  434. until nc -z localhost $port # Wait for openssl to be ready
  435. do
  436. sleep 0.05
  437. if [ "$MAX_TIMEOUT" == "0" ]; then
  438. break
  439. fi
  440. ((MAX_TIMEOUT--))
  441. done
  442. printf '%s\n\n' "------------- TEST CASE 9 SHOULD PASS ----------------------"
  443. # client asks for OCSP staple but doesn't fail when none returned
  444. ./examples/client/client -p $port -g -v 3 -W 2
  445. RESULT=$?
  446. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 9 failed" && exit 1
  447. printf '%s\n\n' "Test PASSED!"
  448. printf '%s\n\n' "------------- TEST CASE 10 SHOULD UNKNOWN -------------------"
  449. # client asks for OCSP staple but doesn't fail when none returned
  450. ./examples/client/client -p $port -g -v 3 -W 2m
  451. RESULT=$?
  452. [ $RESULT -ne 1 ] \
  453. && printf '\n\n%s\n' "Client connection 10 succeeded $RESULT" \
  454. && exit 1
  455. printf '%s\n\n' "Test PASSED!"
  456. if ./examples/client/client -? 2>&1 | grep -q 'DTLS'; then
  457. printf '%s\n\n' "------------- TEST CASE DTLS-1 SHOULD PASS -------------------"
  458. # client test against our own server - GOOD CERTS
  459. ./examples/server/server -c certs/ocsp/server3-cert.pem \
  460. -k certs/ocsp/server3-key.pem -R $ready_file5 \
  461. -p $port5 -u -v 3 &
  462. server_pid5=$!
  463. sleep 0.2
  464. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 2 -u -v 3 \
  465. -p $port5
  466. RESULT=$?
  467. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
  468. printf '%s\n\n' "Test PASSED!"
  469. fi
  470. printf '%s\n\n' "------------------- TESTS COMPLETE ---------------------------"
  471. exit 0