123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530 |
- SCRIPT_DIR="$(dirname "$0")"
- if [[ -z "${RETRIES_REMAINING-}" ]]; then
- export RETRIES_REMAINING=2
- fi
- if test "$WOLFSSL_EXTERNAL_TEST" == "0"; then
- echo 'skipping oscp-stapling.test because WOLFSSL_EXTERNAL_TEST is \
- defined to the value 0.'
- exit 77
- fi
- if ! ./examples/client/client -V | grep -q 3; then
- echo 'skipping ocsp-stapling.test because TLS1.2 is not available.' 1>&2
- exit 77
- fi
- if ./examples/client/client '-#' | fgrep -q -e ' -DWOLFSSL_SNIFFER '; then
- echo 'skipping oscp-stapling.test because WOLFSSL_SNIFFER defined.'
- exit 77
- fi
- if ./examples/client/client -V | grep -q 4; then
- tls13=yes
- fi
- if ./examples/client/client -? 2>&1 | grep -q 'DTLSv1.3'; then
- dtls13=yes
- fi
- ./examples/client/client '-?' 2>&1 | grep -- 'Perform multi OCSP stapling for TLS13'
- if [ $? -eq 0 ]; then
- tls13multi=yes
- else
- tls13multi=no
- fi
- if openssl s_server -help 2>&1 | fgrep -q -i ipv6 && nc -h 2>&1 | fgrep -q -i ipv6; then
- IPV6_SUPPORTED=yes
- else
- IPV6_SUPPORTED=no
- fi
- if ./examples/client/client '-#' | fgrep -q -e ' -DTEST_IPV6 '; then
- if [[ "$IPV6_SUPPORTED" == "no" ]]; then
- echo 'Skipping IPV6 test in environment lacking IPV6 support.'
- exit 77
- fi
- LOCALHOST='[::1]'
- LOCALHOST_FOR_NC='::1'
- V4V6=6
- V4V6_FLAG=-6
- else
- LOCALHOST='127.0.0.1'
- LOCALHOST_FOR_NC='127.0.0.1'
- if [[ "$IPV6_SUPPORTED" == "yes" ]]; then
- V4V6_FLAG=-4
- else
- V4V6_FLAG=
- fi
- V4V6=4
- fi
- PARENTDIR="$PWD"
- WORKSPACE="${PARENTDIR}/workspace.pid$$"
- mkdir "${WORKSPACE}" || exit $?
- cp -pR ${SCRIPT_DIR}/../certs "${WORKSPACE}"/ || exit $?
- cd "$WORKSPACE" || exit $?
- ln -s ../examples
- CERT_DIR="./certs/ocsp"
- ready_file="$WORKSPACE"/wolf_ocsp_s1_readyF$$
- ready_file2="$WORKSPACE"/wolf_ocsp_s1_readyF2$$
- printf '%s\n' "ready file: \"$ready_file\""
- test_cnf="ocsp_s1.cnf"
- wait_for_readyFile(){
- counter=0
- while [ ! -s "$1" -a "$counter" -lt 20 ]; do
- if [[ -n "${2-}" ]]; then
- if ! kill -0 $2 2>&-; then
- echo "pid $2 for port ${3-} exited before creating ready file. bailing..."
- exit 1
- fi
- fi
- echo -e "waiting for ready file..."
- sleep 0.1
- counter=$((counter+ 1))
- done
- if test -e "$1"; then
- echo -e "found ready file, starting client..."
- else
- echo -e "NO ready file at \"$1\" -- ending test..."
- exit 1
- fi
- }
- remove_single_rF(){
- if test -e "$1"; then
- printf '%s\n' "removing ready file: \"$1\""
- rm "$1"
- fi
- }
- create_new_cnf() {
- printf '%s\n' "Random Port Selected: $1"
- printf '%s\n' "#" > $test_cnf
- printf '%s\n' "# openssl configuration file for OCSP certificates" >> $test_cnf
- printf '%s\n' "#" >> $test_cnf
- printf '%s\n' "" >> $test_cnf
- printf '%s\n' "# Extensions to add to a certificate request (intermediate1-ca)" >> $test_cnf
- printf '%s\n' "[ v3_req1 ]" >> $test_cnf
- printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
- printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
- printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
- printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
- printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$1" >> $test_cnf
- printf '%s\n' "" >> $test_cnf
- printf '%s\n' "# Extensions to add to a certificate request (intermediate2-ca)" >> $test_cnf
- printf '%s\n' "[ v3_req2 ]" >> $test_cnf
- printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
- printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
- printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
- printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
- printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:22222" >> $test_cnf
- printf '%s\n' "" >> $test_cnf
- printf '%s\n' "# Extensions to add to a certificate request (intermediate3-ca)" >> $test_cnf
- printf '%s\n' "[ v3_req3 ]" >> $test_cnf
- printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
- printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
- printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
- printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
- printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:22223" >> $test_cnf
- printf '%s\n' "" >> $test_cnf
- printf '%s\n' "# Extensions for a typical CA" >> $test_cnf
- printf '%s\n' "[ v3_ca ]" >> $test_cnf
- printf '%s\n' "basicConstraints = CA:true" >> $test_cnf
- printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
- printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
- printf '%s\n' "keyUsage = keyCertSign, cRLSign" >> $test_cnf
- printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:22220" >> $test_cnf
- printf '%s\n' "" >> $test_cnf
- printf '%s\n' "# OCSP extensions." >> $test_cnf
- printf '%s\n' "[ v3_ocsp ]" >> $test_cnf
- printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
- printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
- printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
- printf '%s\n' "extendedKeyUsage = OCSPSigning" >> $test_cnf
- mv $test_cnf $CERT_DIR/$test_cnf
- cd $CERT_DIR
- CURR_LOC="$PWD"
- printf '%s\n' "echo now in $CURR_LOC"
- ./renewcerts-for-test.sh $test_cnf
- cd "$WORKSPACE"
- }
- remove_ready_file() {
- if test -e "$ready_file"; then
- printf '%s\n' "removing ready file"
- rm "$ready_file"
- fi
- if test -e "$ready_file2"; then
- printf '%s\n' "removing ready file: \"$ready_file2\""
- rm "$ready_file2"
- fi
- }
- cleanup()
- {
- exit_status=$?
- for i in $(jobs -pr)
- do
- kill -s KILL "$i"
- done
- remove_ready_file
- rm $CERT_DIR/$test_cnf
- cd "$PARENTDIR" || return 1
- rm -r "$WORKSPACE" || return 1
- if [[ ("$exit_status" == 1) && ($RETRIES_REMAINING -gt 0) ]]; then
- echo "retrying..."
- RETRIES_REMAINING=$((RETRIES_REMAINING - 1))
- exec $0 "$@"
- fi
- }
- trap cleanup EXIT INT TERM HUP
- [ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1
- ./examples/client/client '-?' 2>&1 | grep -- 'Client not compiled in!'
- if [ $? -eq 0 ]; then
- exit 0
- fi
- size="$(./examples/client/client '-?' | grep "Max RSA key")"
- size="${size//[^0-9]/}"
- if [ ! -z "$size" ]; then
- printf 'check on max key size of %d ...' $size
- if [ $size -lt 4096 ]; then
- printf '%s\n' "4096 bit RSA keys not supported"
- exit 0
- fi
- printf 'OK\n'
- fi
- get_first_free_port() {
- local ret="$1"
- while :; do
- if [[ "$ret" -ge 65536 ]]; then
- ret=1024
- fi
- if ! nc -z $V4V6_FLAG $LOCALHOST_FOR_NC "$ret"; then
- break
- fi
- ret=$((ret+1))
- done
- echo "$ret"
- return 0
- }
- base_port=$((((($$ + $RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
- port1=$(get_first_free_port $base_port)
- port2=$(get_first_free_port $((port1 + 1)))
- port3=$(get_first_free_port $((port2 + 1)))
- ready_file=$PWD/wolf_ocsp_readyF$$
- printf '%s\n' "ready file: \"$ready_file\""
- ./examples/server/server -b -p $port1 -o -R "$ready_file" &
- wolf_pid=$!
- wait_for_readyFile "$ready_file" $wolf_pid $port1
- if [ ! -f "$ready_file" ]; then
- printf '%s\n' "Failed to create ready file: \"$ready_file\""
- exit 1
- else
- # should fail if ocspstapling is also enabled
- OPENSSL_OUTPUT=$(echo "hi" | openssl s_client -status $V4V6_FLAG -legacy_renegotiation -connect "${LOCALHOST}:$port1" -cert ./certs/client-cert.pem -key ./certs/client-key.pem -CAfile ./certs/ocsp/root-ca-cert.pem 2>&1)
- OPENSSL_RESULT=$?
- echo "$OPENSSL_OUTPUT"
- fgrep -q 'self signed certificate in certificate chain' <<< "$OPENSSL_OUTPUT"
- FGREP1_RESULT=$?
- fgrep -q 'self-signed certificate in certificate chain' <<< "$OPENSSL_OUTPUT"
- FGREP2_RESULT=$?
- if [ $OPENSSL_RESULT -eq 0 -a $FGREP1_RESULT -ne 0 -a $FGREP2_RESULT -ne 0 ]; then
- printf '%s\n' "Expected verification error from s_client is missing."
- remove_single_rF "$ready_file"
- exit 1
- fi
- remove_single_rF "$ready_file"
- wait $wolf_pid
- if [ $? -ne 0 ]; then
- printf '%s\n' "wolfSSL server unexpected fail"
- exit 1
- fi
- fi
- ./examples/server/server -b -p $port2 -R "$ready_file" &
- wolf_pid2=$!
- wait_for_readyFile "$ready_file" $wolf_pid2 $port2
- if [ ! -f "$ready_file" ]; then
- printf '%s\n' "Failed to create ready file: \"$ready_file\""
- exit 1
- else
- printf '%s\n' "Random port selected: $port2"
- # Use client connection to shutdown the server cleanly
- ./examples/client/client -p $port2
- create_new_cnf $port2
- fi
- sleep 0.1
- server=login.live.com
- ca=./certs/external/ca_collection.pem
- if [[ "$V4V6" == "4" ]]; then
- ./examples/client/client -C -h $server -p 443 -A $ca -g -W 1
- RESULT=$?
- [ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
- else
- echo "Skipping OCSP test on $server (IPv6 test client)"
- fi
- ./examples/server/server '-?' 2>&1 | grep -- 'Server not compiled in!'
- if [ $? -eq 0 ]; then
- exit 0
- fi
- openssl ocsp -port $port2 -nmin 1 \
- -index certs/ocsp/index-intermediate1-ca-issued-certs.txt \
- -rsigner certs/ocsp/ocsp-responder-cert.pem \
- -rkey certs/ocsp/ocsp-responder-key.pem \
- -CA certs/ocsp/intermediate1-ca-cert.pem \
- "$@" &
- sleep 0.1
- [ $(jobs -r | wc -l) -ne 1 ] && \
- printf '\n\n%s\n' "Setup ocsp responder failed, skipping" && exit 0
- printf '%s\n\n' "------------- TEST CASE 1 SHOULD PASS ------------------------"
- ./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
- -k certs/ocsp/server1-key.pem -p $port3 &
- wolf_pid3=$!
- wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
- ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p $port3
- RESULT=$?
- [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
- printf '%s\n\n' "Test PASSED!"
- printf '%s\n\n' "------------- TEST CASE 2 SHOULD REVOKE ----------------------"
- remove_single_rF "$ready_file2"
- ./examples/server/server -c certs/ocsp/server2-cert.pem -R "$ready_file2" \
- -k certs/ocsp/server2-key.pem -p $port3 &
- wolf_pid3=$!
- wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
- sleep 0.1
- ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p $port3
- RESULT=$?
- [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection 2 succeeded $RESULT" \
- && exit 1
- printf '%s\n\n' "Test successfully REVOKED!"
- if [[ ("$tls13" == "yes") && ("$tls13multi" == "no") ]]; then
- printf '%s\n\n' "------------- TEST CASE 3 SHOULD PASS --------------------"
- # client test against our own server - GOOD CERT
- remove_single_rF "$ready_file2"
- ./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
- -k certs/ocsp/server1-key.pem -v 4 \
- -p $port3 &
- wolf_pid3=$!
- wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
- ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
- -p $port3
- RESULT=$?
- [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 3 failed" && exit 1
- printf '%s\n\n' "Test PASSED!"
- printf '%s\n\n' "------------- TEST CASE 4 SHOULD PASS --------------------"
- # client test against our own server, must staple - GOOD CERT
- remove_single_rF "$ready_file2"
- ./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
- -k certs/ocsp/server1-key.pem -v 4 \
- -p $port3 &
- wolf_pid3=$!
- wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
- ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1m -v 4 -F 1 \
- -p $port3
- RESULT=$?
- [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 4 failed" && exit 1
- printf '%s\n\n' "Test PASSED!"
- printf '%s\n\n' "------------- TEST CASE 5 SHOULD REVOKE ------------------"
- # client test against our own server - REVOKED CERT
- remove_single_rF "$ready_file2"
- ./examples/server/server -c certs/ocsp/server2-cert.pem -R "$ready_file2" \
- -k certs/ocsp/server2-key.pem -v 4 \
- -p $port3 &
- wolf_pid3=$!
- wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
- ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
- -p $port3
- RESULT=$?
- [ $RESULT -ne 1 ] && \
- printf '\n\n%s\n' "Client connection 5 succeeded $RESULT" \
- && exit 1
- printf '%s\n\n' "Test successfully REVOKED!"
- else
- echo 'skipping TLS1.3 stapling tests.' 1>&2
- fi
- if ./examples/client/client -? 2>&1 | grep -q 'DTLSv1.2'; then
- printf '%s\n\n' "------------- TEST CASE DTLS-1 SHOULD PASS -------------------"
- # client test against our own server, must staple - GOOD CERT
- echo $ready_file2
- ./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
- -k certs/ocsp/server1-key.pem -u -v 3 \
- -p $port3 &
- wolf_pid3=$!
- sleep 0.2
- ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 3 \
- -W 1 -p $port3
- RESULT=$?
- [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 5 failed" && exit 1
- printf '%s\n\n' "Test PASSED!"
- fi
- if [[ ("$dtls13" == "yes") && ("$tls13multi" == "no") ]]; then
- printf '%s\n\n' "------------- TEST CASE DTLS-2 SHOULD PASS -------------------"
- # client test against our own server, must staple - GOOD CERT
- ./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
- -k certs/ocsp/server1-key.pem -u -v 4 \
- -p $port3 &
- wolf_pid3=$!
- sleep 0.2
- ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -u -v 4 \
- -W 1 -p $port3
- RESULT=$?
- [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 5 failed" && exit 1
- printf '%s\n\n' "Test PASSED!"
- fi
- generate_port() {
- #-------------------------------------------------------------------------#
- # Generate a random port number
- #-------------------------------------------------------------------------#
- if [[ "$OSTYPE" == "linux"* ]]; then
- port=$(($(od -An -N2 /dev/urandom) % (65535-49512) + 49512))
- elif [[ "$OSTYPE" == "darwin"* ]]; then
- port=$(($(od -An -N2 /dev/random) % (65535-49512) + 49512))
- else
- echo "Unknown OS TYPE"
- exit 1
- fi
- }
- generate_port
- openssl s_server $V4V6_FLAG -cert ./certs/server-cert.pem -key certs/server-key.pem -www -port $port &
- openssl_pid=$!
- MAX_TIMEOUT=10
- until nc -z localhost $port # Wait for openssl to be ready
- do
- sleep 0.05
- if [ "$MAX_TIMEOUT" == "0" ]; then
- break
- fi
- ((MAX_TIMEOUT--))
- done
- printf '%s\n\n' "------------- TEST CASE 6 SHOULD PASS ----------------------"
- ./examples/client/client -p $port -g -v 3 -W 1
- RESULT=$?
- [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 6 failed" && exit 1
- printf '%s\n\n' "Test PASSED!"
- printf '%s\n\n' "------------- TEST CASE 7 SHOULD UNKNOWN -------------------"
- ./examples/client/client -p $port -g -v 3 -W 1m
- RESULT=$?
- [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection 7 succeeded $RESULT" \
- && exit 1
- printf '%s\n\n' "Test PASSED!"
- openssl ciphers -tls1_3
- openssl_tls13=$?
- ./examples/client/client -V | grep -q 4
- wolfssl_tls13=$?
- if [ "$openssl_tls13" = "0" -a "$wolfssl_tls13" = "0" ]; then
- printf '%s\n\n' "------------- TEST CASE 8 SHOULD PASS --------------------"
- # client asks for OCSP staple but doesn't fail when none returned
- ./examples/client/client -p $port -g -v 4 -W 1
- RESULT=$?
- [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 8 failed" && exit 1
- printf '%s\n\n' "Test PASSED!"
- printf '%s\n\n' "------------- TEST CASE 9 SHOULD UNKNOWN -----------------"
- # client asks for OCSP staple but doesn't fail when none returned
- ./examples/client/client -p $port -g -v 4 -W 1m
- RESULT=$?
- [ $RESULT -ne 1 ] \
- && printf '\n\n%s\n' "Client connection 9 succeeded $RESULT" \
- && exit 1
- printf '%s\n\n' "Test PASSED!"
- else
- echo -n 'skipping TLS1.3 stapling interoperability test:' 1>&2
- if [ "$openssl_tls13" != "0" ]; then
- echo -n ' OpenSSL' 1>&2
- fi
- if [ "$wolfssl_tls13" != "0" ]; then
- if [ "$openssl_tls13" != "0" ]; then
- echo -n ' and' 1>&2
- fi
- echo -n ' wolfSSL' 1>&2
- fi
- echo -n ' missing TLS1.3 support.' 1>&2
- fi
- printf '%s\n\n' "------------------- TESTS COMPLETE ---------------------------"
- exit 0
|