1
0

ocsp-stapling.test 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476
  1. #!/bin/bash
  2. # ocsp-stapling.test
  3. # Test requires HAVE_OCSP and HAVE_CERTIFICATE_STATUS_REQUEST
  4. # Note, this script makes connection(s) to the public Internet.
  5. SCRIPT_DIR="$(dirname "$0")"
  6. if [[ -z "${RETRIES_REMAINING-}" ]]; then
  7. export RETRIES_REMAINING=2
  8. fi
  9. if ! ./examples/client/client -V | grep -q 3; then
  10. echo 'skipping ocsp-stapling.test because TLS1.2 is not available.' 1>&2
  11. exit 77
  12. fi
  13. if ./examples/client/client '-#' | fgrep -q -e ' -DWOLFSSL_SNIFFER '; then
  14. echo 'skipping oscp-stapling.test because WOLFSSL_SNIFFER defined.'
  15. exit 77
  16. fi
  17. if openssl s_server -help 2>&1 | fgrep -q -i ipv6 && nc -h 2>&1 | fgrep -q -i ipv6; then
  18. IPV6_SUPPORTED=yes
  19. else
  20. IPV6_SUPPORTED=no
  21. fi
  22. if ./examples/client/client '-#' | fgrep -q -e ' -DTEST_IPV6 '; then
  23. if [[ "$IPV6_SUPPORTED" == "no" ]]; then
  24. echo 'Skipping IPV6 test in environment lacking IPV6 support.'
  25. exit 77
  26. fi
  27. LOCALHOST='[::1]'
  28. LOCALHOST_FOR_NC='::1'
  29. V4V6=6
  30. V4V6_FLAG=-6
  31. else
  32. LOCALHOST='127.0.0.1'
  33. LOCALHOST_FOR_NC='127.0.0.1'
  34. if [[ "$IPV6_SUPPORTED" == "yes" ]]; then
  35. V4V6_FLAG=-4
  36. else
  37. V4V6_FLAG=
  38. fi
  39. V4V6=4
  40. fi
  41. PARENTDIR="$PWD"
  42. # create a unique workspace directory ending in PID for the script instance ($$)
  43. # to make this instance orthogonal to any others running, even on same repo.
  44. # TCP ports are also carefully formed below from the PID, to minimize conflicts.
  45. WORKSPACE="${PARENTDIR}/workspace.pid$$"
  46. mkdir "${WORKSPACE}" || exit $?
  47. cp -pR ${SCRIPT_DIR}/../certs "${WORKSPACE}"/ || exit $?
  48. cd "$WORKSPACE" || exit $?
  49. ln -s ../examples
  50. CERT_DIR="./certs/ocsp"
  51. ready_file="$WORKSPACE"/wolf_ocsp_s1_readyF$$
  52. ready_file2="$WORKSPACE"/wolf_ocsp_s1_readyF2$$
  53. printf '%s\n' "ready file: \"$ready_file\""
  54. test_cnf="ocsp_s1.cnf"
  55. wait_for_readyFile(){
  56. counter=0
  57. while [ ! -s "$1" -a "$counter" -lt 20 ]; do
  58. if [[ -n "${2-}" ]]; then
  59. if ! kill -0 $2 2>&-; then
  60. echo "pid $2 for port ${3-} exited before creating ready file. bailing..."
  61. exit 1
  62. fi
  63. fi
  64. echo -e "waiting for ready file..."
  65. sleep 0.1
  66. counter=$((counter+ 1))
  67. done
  68. if test -e "$1"; then
  69. echo -e "found ready file, starting client..."
  70. else
  71. echo -e "NO ready file at \"$1\" -- ending test..."
  72. exit 1
  73. fi
  74. }
  75. remove_single_rF(){
  76. if test -e "$1"; then
  77. printf '%s\n' "removing ready file: \"$1\""
  78. rm "$1"
  79. fi
  80. }
  81. #create a configure file for cert generation with the port 0 solution
  82. create_new_cnf() {
  83. printf '%s\n' "Random Port Selected: $1"
  84. printf '%s\n' "#" > $test_cnf
  85. printf '%s\n' "# openssl configuration file for OCSP certificates" >> $test_cnf
  86. printf '%s\n' "#" >> $test_cnf
  87. printf '%s\n' "" >> $test_cnf
  88. printf '%s\n' "# Extensions to add to a certificate request (intermediate1-ca)" >> $test_cnf
  89. printf '%s\n' "[ v3_req1 ]" >> $test_cnf
  90. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  91. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  92. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  93. printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
  94. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:$1" >> $test_cnf
  95. printf '%s\n' "" >> $test_cnf
  96. printf '%s\n' "# Extensions to add to a certificate request (intermediate2-ca)" >> $test_cnf
  97. printf '%s\n' "[ v3_req2 ]" >> $test_cnf
  98. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  99. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  100. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  101. printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
  102. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:22222" >> $test_cnf
  103. printf '%s\n' "" >> $test_cnf
  104. printf '%s\n' "# Extensions to add to a certificate request (intermediate3-ca)" >> $test_cnf
  105. printf '%s\n' "[ v3_req3 ]" >> $test_cnf
  106. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  107. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  108. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  109. printf '%s\n' "keyUsage = nonRepudiation, digitalSignature, keyEncipherment" >> $test_cnf
  110. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:22223" >> $test_cnf
  111. printf '%s\n' "" >> $test_cnf
  112. printf '%s\n' "# Extensions for a typical CA" >> $test_cnf
  113. printf '%s\n' "[ v3_ca ]" >> $test_cnf
  114. printf '%s\n' "basicConstraints = CA:true" >> $test_cnf
  115. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  116. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  117. printf '%s\n' "keyUsage = keyCertSign, cRLSign" >> $test_cnf
  118. printf '%s\n' "authorityInfoAccess = OCSP;URI:http://127.0.0.1:22220" >> $test_cnf
  119. printf '%s\n' "" >> $test_cnf
  120. printf '%s\n' "# OCSP extensions." >> $test_cnf
  121. printf '%s\n' "[ v3_ocsp ]" >> $test_cnf
  122. printf '%s\n' "basicConstraints = CA:false" >> $test_cnf
  123. printf '%s\n' "subjectKeyIdentifier = hash" >> $test_cnf
  124. printf '%s\n' "authorityKeyIdentifier = keyid:always,issuer:always" >> $test_cnf
  125. printf '%s\n' "extendedKeyUsage = OCSPSigning" >> $test_cnf
  126. mv $test_cnf $CERT_DIR/$test_cnf
  127. cd $CERT_DIR
  128. CURR_LOC="$PWD"
  129. printf '%s\n' "echo now in $CURR_LOC"
  130. ./renewcerts-for-test.sh $test_cnf
  131. cd "$WORKSPACE"
  132. }
  133. remove_ready_file() {
  134. if test -e "$ready_file"; then
  135. printf '%s\n' "removing ready file"
  136. rm "$ready_file"
  137. fi
  138. if test -e "$ready_file2"; then
  139. printf '%s\n' "removing ready file: \"$ready_file2\""
  140. rm "$ready_file2"
  141. fi
  142. }
  143. cleanup()
  144. {
  145. exit_status=$?
  146. for i in $(jobs -pr)
  147. do
  148. kill -s KILL "$i"
  149. done
  150. remove_ready_file
  151. rm $CERT_DIR/$test_cnf
  152. cd "$PARENTDIR" || return 1
  153. rm -r "$WORKSPACE" || return 1
  154. if [[ ("$exit_status" == 1) && ($RETRIES_REMAINING -gt 0) ]]; then
  155. echo "retrying..."
  156. RETRIES_REMAINING=$((RETRIES_REMAINING - 1))
  157. exec $0 "$@"
  158. fi
  159. }
  160. trap cleanup EXIT INT TERM HUP
  161. [ ! -x ./examples/client/client ] && echo -e "\n\nClient doesn't exist" && exit 1
  162. ./examples/client/client '-?' 2>&1 | grep -- 'Client not compiled in!'
  163. if [ $? -eq 0 ]; then
  164. exit 0
  165. fi
  166. # check if supported key size is large enough to handle 4096 bit RSA
  167. size="$(./examples/client/client '-?' | grep "Max RSA key")"
  168. size="${size//[^0-9]/}"
  169. if [ ! -z "$size" ]; then
  170. printf 'check on max key size of %d ...' $size
  171. if [ $size -lt 4096 ]; then
  172. printf '%s\n' "4096 bit RSA keys not supported"
  173. exit 0
  174. fi
  175. printf 'OK\n'
  176. fi
  177. # choose consecutive ports based on the PID, skipping any that are
  178. # already bound, to avoid the birthday problem in case other
  179. # instances are sharing this host.
  180. get_first_free_port() {
  181. local ret="$1"
  182. while :; do
  183. if [[ "$ret" -ge 65536 ]]; then
  184. ret=1024
  185. fi
  186. if ! nc -z $V4V6_FLAG $LOCALHOST_FOR_NC "$ret"; then
  187. break
  188. fi
  189. ret=$((ret+1))
  190. done
  191. echo "$ret"
  192. return 0
  193. }
  194. base_port=$((((($$ + $RETRIES_REMAINING) * 5) % (65536 - 2048)) + 1024))
  195. port1=$(get_first_free_port $base_port)
  196. port2=$(get_first_free_port $((port1 + 1)))
  197. port3=$(get_first_free_port $((port2 + 1)))
  198. # test interop fail case
  199. ready_file=$PWD/wolf_ocsp_readyF$$
  200. printf '%s\n' "ready file: \"$ready_file\""
  201. ./examples/server/server -b -p $port1 -o -R "$ready_file" &
  202. wolf_pid=$!
  203. wait_for_readyFile "$ready_file" $wolf_pid $port1
  204. if [ ! -f "$ready_file" ]; then
  205. printf '%s\n' "Failed to create ready file: \"$ready_file\""
  206. exit 1
  207. else
  208. # should fail if ocspstapling is also enabled
  209. OPENSSL_OUTPUT=$(echo "hi" | openssl s_client -status $V4V6_FLAG -legacy_renegotiation -connect "${LOCALHOST}:$port1" -cert ./certs/client-cert.pem -key ./certs/client-key.pem -CAfile ./certs/ocsp/root-ca-cert.pem 2>&1)
  210. OPENSSL_RESULT=$?
  211. echo "$OPENSSL_OUTPUT"
  212. fgrep -q 'self signed certificate in certificate chain' <<< "$OPENSSL_OUTPUT"
  213. FGREP1_RESULT=$?
  214. fgrep -q 'self-signed certificate in certificate chain' <<< "$OPENSSL_OUTPUT"
  215. FGREP2_RESULT=$?
  216. if [ $OPENSSL_RESULT -eq 0 -a $FGREP1_RESULT -ne 0 -a $FGREP2_RESULT -ne 0 ]; then
  217. printf '%s\n' "Expected verification error from s_client is missing."
  218. remove_single_rF "$ready_file"
  219. exit 1
  220. fi
  221. remove_single_rF "$ready_file"
  222. wait $wolf_pid
  223. if [ $? -ne 0 ]; then
  224. printf '%s\n' "wolfSSL server unexpected fail"
  225. exit 1
  226. fi
  227. fi
  228. # create a port to use with openssl ocsp responder
  229. ./examples/server/server -b -p $port2 -R "$ready_file" &
  230. wolf_pid2=$!
  231. wait_for_readyFile "$ready_file" $wolf_pid2 $port2
  232. if [ ! -f "$ready_file" ]; then
  233. printf '%s\n' "Failed to create ready file: \"$ready_file\""
  234. exit 1
  235. else
  236. printf '%s\n' "Random port selected: $port2"
  237. # Use client connection to shutdown the server cleanly
  238. ./examples/client/client -p $port2
  239. create_new_cnf $port2
  240. fi
  241. sleep 0.1
  242. # is our desired server there? - login.live.com doesn't answers PING
  243. #./scripts/ping.test $server 2
  244. # client test against the server
  245. server=login.live.com
  246. #ca=certs/external/baltimore-cybertrust-root.pem
  247. ca=./certs/external/ca_collection.pem
  248. if [[ "$V4V6" == "4" ]]; then
  249. ./examples/client/client -C -h $server -p 443 -A $ca -g -W 1
  250. RESULT=$?
  251. [ $RESULT -ne 0 ] && echo -e "\n\nClient connection failed" && exit 1
  252. else
  253. echo "Skipping OCSP test on $server (IPv6 test client)"
  254. fi
  255. # Test with example server
  256. ./examples/server/server '-?' 2>&1 | grep -- 'Server not compiled in!'
  257. if [ $? -eq 0 ]; then
  258. exit 0
  259. fi
  260. # setup ocsp responder
  261. # OLD: ./certs/ocsp/ocspd-intermediate1-ca-issued-certs.sh &
  262. # NEW: openssl isn't being cleaned up, invoke directly in script for cleanup
  263. # purposes!
  264. openssl ocsp -port $port2 -nmin 1 \
  265. -index certs/ocsp/index-intermediate1-ca-issued-certs.txt \
  266. -rsigner certs/ocsp/ocsp-responder-cert.pem \
  267. -rkey certs/ocsp/ocsp-responder-key.pem \
  268. -CA certs/ocsp/intermediate1-ca-cert.pem \
  269. "$@" &
  270. sleep 0.1
  271. # "jobs" is not portable for posix. Must use bash interpreter!
  272. [ $(jobs -r | wc -l) -ne 1 ] && \
  273. printf '\n\n%s\n' "Setup ocsp responder failed, skipping" && exit 0
  274. printf '%s\n\n' "------------- TEST CASE 1 SHOULD PASS ------------------------"
  275. # client test against our own server - GOOD CERT
  276. ./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
  277. -k certs/ocsp/server1-key.pem -p $port3 &
  278. wolf_pid3=$!
  279. wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
  280. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p $port3
  281. RESULT=$?
  282. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 1 failed" && exit 1
  283. printf '%s\n\n' "Test PASSED!"
  284. printf '%s\n\n' "------------- TEST CASE 2 SHOULD REVOKE ----------------------"
  285. # client test against our own server - REVOKED CERT
  286. remove_single_rF "$ready_file2"
  287. ./examples/server/server -c certs/ocsp/server2-cert.pem -R "$ready_file2" \
  288. -k certs/ocsp/server2-key.pem -p $port3 &
  289. wolf_pid3=$!
  290. wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
  291. sleep 0.1
  292. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -p $port3
  293. RESULT=$?
  294. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection 2 succeeded $RESULT" \
  295. && exit 1
  296. printf '%s\n\n' "Test successfully REVOKED!"
  297. if ./examples/client/client -V | grep -q 4; then
  298. printf '%s\n\n' "------------- TEST CASE 3 SHOULD PASS --------------------"
  299. # client test against our own server - GOOD CERT
  300. remove_single_rF "$ready_file2"
  301. ./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
  302. -k certs/ocsp/server1-key.pem -v 4 \
  303. -p $port3 &
  304. wolf_pid3=$!
  305. wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
  306. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
  307. -p $port3
  308. RESULT=$?
  309. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 3 failed" && exit 1
  310. printf '%s\n\n' "Test PASSED!"
  311. printf '%s\n\n' "------------- TEST CASE 4 SHOULD PASS --------------------"
  312. # client test against our own server, must staple - GOOD CERT
  313. remove_single_rF "$ready_file2"
  314. ./examples/server/server -c certs/ocsp/server1-cert.pem -R "$ready_file2" \
  315. -k certs/ocsp/server1-key.pem -v 4 \
  316. -p $port3 &
  317. wolf_pid3=$!
  318. wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
  319. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1m -v 4 -F 1 \
  320. -p $port3
  321. RESULT=$?
  322. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 4 failed" && exit 1
  323. printf '%s\n\n' "Test PASSED!"
  324. printf '%s\n\n' "------------- TEST CASE 5 SHOULD REVOKE ------------------"
  325. # client test against our own server - REVOKED CERT
  326. remove_single_rF "$ready_file2"
  327. ./examples/server/server -c certs/ocsp/server2-cert.pem -R "$ready_file2" \
  328. -k certs/ocsp/server2-key.pem -v 4 \
  329. -p $port3 &
  330. wolf_pid3=$!
  331. wait_for_readyFile "$ready_file2" $wolf_pid3 $port3
  332. ./examples/client/client -C -A certs/ocsp/root-ca-cert.pem -W 1 -v 4 -F 1 \
  333. -p $port3
  334. RESULT=$?
  335. [ $RESULT -ne 1 ] && \
  336. printf '\n\n%s\n' "Client connection 5 succeeded $RESULT" \
  337. && exit 1
  338. printf '%s\n\n' "Test successfully REVOKED!"
  339. else
  340. echo 'skipping TLS1.3 stapling tests.' 1>&2
  341. fi
  342. # need a unique port since may run the same time as testsuite
  343. generate_port() {
  344. #-------------------------------------------------------------------------#
  345. # Generate a random port number
  346. #-------------------------------------------------------------------------#
  347. if [[ "$OSTYPE" == "linux"* ]]; then
  348. port=$(($(od -An -N2 /dev/urandom) % (65535-49512) + 49512))
  349. elif [[ "$OSTYPE" == "darwin"* ]]; then
  350. port=$(($(od -An -N2 /dev/random) % (65535-49512) + 49512))
  351. else
  352. echo "Unknown OS TYPE"
  353. exit 1
  354. fi
  355. }
  356. # Start OpenSSL server that has no OCSP responses to return
  357. generate_port
  358. openssl s_server $V4V6_FLAG -cert ./certs/server-cert.pem -key certs/server-key.pem -www -port $port &
  359. openssl_pid=$!
  360. MAX_TIMEOUT=10
  361. until nc -z localhost $port # Wait for openssl to be ready
  362. do
  363. sleep 0.05
  364. if [ "$MAX_TIMEOUT" == "0" ]; then
  365. break
  366. fi
  367. ((MAX_TIMEOUT--))
  368. done
  369. printf '%s\n\n' "------------- TEST CASE 6 SHOULD PASS ----------------------"
  370. # client asks for OCSP staple but doesn't fail when none returned
  371. ./examples/client/client -p $port -g -v 3 -W 1
  372. RESULT=$?
  373. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 6 failed" && exit 1
  374. printf '%s\n\n' "Test PASSED!"
  375. printf '%s\n\n' "------------- TEST CASE 7 SHOULD UNKNOWN -------------------"
  376. # client asks for OCSP staple but doesn't fail when none returned
  377. ./examples/client/client -p $port -g -v 3 -W 1m
  378. RESULT=$?
  379. [ $RESULT -ne 1 ] && printf '\n\n%s\n' "Client connection 7 succeeded $RESULT" \
  380. && exit 1
  381. printf '%s\n\n' "Test PASSED!"
  382. openssl ciphers -tls1_3
  383. openssl_tls13=$?
  384. ./examples/client/client -V | grep -q 4
  385. wolfssl_tls13=$?
  386. if [ "$openssl_tls13" = "0" -a "$wolfssl_tls13" = "0" ]; then
  387. printf '%s\n\n' "------------- TEST CASE 8 SHOULD PASS --------------------"
  388. # client asks for OCSP staple but doesn't fail when none returned
  389. ./examples/client/client -p $port -g -v 4 -W 1
  390. RESULT=$?
  391. [ $RESULT -ne 0 ] && printf '\n\n%s\n' "Client connection 8 failed" && exit 1
  392. printf '%s\n\n' "Test PASSED!"
  393. printf '%s\n\n' "------------- TEST CASE 9 SHOULD UNKNOWN -----------------"
  394. # client asks for OCSP staple but doesn't fail when none returned
  395. ./examples/client/client -p $port -g -v 4 -W 1m
  396. RESULT=$?
  397. [ $RESULT -ne 1 ] \
  398. && printf '\n\n%s\n' "Client connection 9 succeeded $RESULT" \
  399. && exit 1
  400. printf '%s\n\n' "Test PASSED!"
  401. else
  402. echo -n 'skipping TLS1.3 stapling interoperability test:' 1>&2
  403. if [ "$openssl_tls13" != "0" ]; then
  404. echo -n ' OpenSSL' 1>&2
  405. fi
  406. if [ "$wolfssl_tls13" != "0" ]; then
  407. if [ "$openssl_tls13" != "0" ]; then
  408. echo -n ' and' 1>&2
  409. fi
  410. echo -n ' wolfSSL' 1>&2
  411. fi
  412. echo -n ' missing TLS1.3 support.' 1>&2
  413. fi
  414. printf '%s\n\n' "------------------- TESTS COMPLETE ---------------------------"
  415. exit 0