GH355: Implement HKDF
[oweals/openssl.git] / test / recipes / 80-test_ocsp.t
1 #! /usr/bin/perl
2
3 use strict;
4 use warnings;
5
6 use POSIX;
7 use File::Spec::Functions qw/devnull catfile/;
8 use File::Copy;
9 use OpenSSL::Test qw/:DEFAULT with pipe srctop_dir/;
10
11 setup("test_ocsp");
12
13 my $ocspdir=srctop_dir("test", "ocsp-tests");
14 # 17 December 2012 so we don't get certificate expiry errors.
15 my @check_time=("-attime", "1355875200");
16
17 sub test_ocsp {
18     my $title = shift;
19     my $inputfile = shift;
20     my $CAfile = shift;
21     my $expected_exit = shift;
22
23     run(app(["openssl", "base64", "-d",
24              "-in", catfile($ocspdir,$inputfile),
25              "-out", "ocsp-resp-fff.dat"]));
26     with({ exit_checker => sub { return shift == $expected_exit; } },
27          sub { ok(run(app(["openssl", "ocsp", "-respin", "ocsp-resp-fff.dat",
28                            "-partial_chain", @check_time,
29                            "-CAfile", catfile($ocspdir, $CAfile),
30                            "-verify_other", catfile($ocspdir, $CAfile),
31                            "-no-CApath"])),
32                   $title); });
33     unlink "ocsp-resp-fff.dat";
34 }
35
36 plan tests => 10;
37
38 subtest "=== VALID OCSP RESPONSES ===" => sub {
39     plan tests => 6;
40
41     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
42               "ND1.ors", "ND1_Issuer_ICA.pem", 0);
43     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
44               "ND2.ors", "ND2_Issuer_Root.pem", 0);
45     test_ocsp("NON-DELEGATED; Root CA -> EE",
46               "ND3.ors", "ND3_Issuer_Root.pem", 0);
47     test_ocsp("DELEGATED; Intermediate CA -> EE",
48               "D1.ors", "D1_Issuer_ICA.pem", 0);
49     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
50               "D2.ors", "D2_Issuer_Root.pem", 0);
51     test_ocsp("DELEGATED; Root CA -> EE",
52               "D3.ors", "D3_Issuer_Root.pem", 0);
53 };
54
55 subtest "=== INVALID SIGNATURE on the OCSP RESPONSE ===" => sub {
56     plan tests => 6;
57
58     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
59               "ISOP_ND1.ors", "ND1_Issuer_ICA.pem", 1);
60     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
61               "ISOP_ND2.ors", "ND2_Issuer_Root.pem", 1);
62     test_ocsp("NON-DELEGATED; Root CA -> EE",
63               "ISOP_ND3.ors", "ND3_Issuer_Root.pem", 1);
64     test_ocsp("DELEGATED; Intermediate CA -> EE",
65               "ISOP_D1.ors", "D1_Issuer_ICA.pem", 1);
66     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
67               "ISOP_D2.ors", "D2_Issuer_Root.pem", 1);
68     test_ocsp("DELEGATED; Root CA -> EE",
69               "ISOP_D3.ors", "D3_Issuer_Root.pem", 1);
70 };
71
72 subtest "=== WRONG RESPONDERID in the OCSP RESPONSE ===" => sub {
73     plan tests => 6;
74
75     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
76               "WRID_ND1.ors", "ND1_Issuer_ICA.pem", 1);
77     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
78               "WRID_ND2.ors", "ND2_Issuer_Root.pem", 1);
79     test_ocsp("NON-DELEGATED; Root CA -> EE",
80               "WRID_ND3.ors", "ND3_Issuer_Root.pem", 1);
81     test_ocsp("DELEGATED; Intermediate CA -> EE",
82               "WRID_D1.ors", "D1_Issuer_ICA.pem", 1);
83     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
84               "WRID_D2.ors", "D2_Issuer_Root.pem", 1);
85     test_ocsp("DELEGATED; Root CA -> EE",
86               "WRID_D3.ors", "D3_Issuer_Root.pem", 1);
87 };
88
89 subtest "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ===" => sub {
90     plan tests => 6;
91
92     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
93               "WINH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
94     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
95               "WINH_ND2.ors", "ND2_Issuer_Root.pem", 1);
96     test_ocsp("NON-DELEGATED; Root CA -> EE",
97               "WINH_ND3.ors", "ND3_Issuer_Root.pem", 1);
98     test_ocsp("DELEGATED; Intermediate CA -> EE",
99               "WINH_D1.ors", "D1_Issuer_ICA.pem", 1);
100     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
101               "WINH_D2.ors", "D2_Issuer_Root.pem", 1);
102     test_ocsp("DELEGATED; Root CA -> EE",
103               "WINH_D3.ors", "D3_Issuer_Root.pem", 1);
104 };
105
106 subtest "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ===" => sub {
107     plan tests => 6;
108
109     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
110               "WIKH_ND1.ors", "ND1_Issuer_ICA.pem", 1);
111     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
112               "WIKH_ND2.ors", "ND2_Issuer_Root.pem", 1);
113     test_ocsp("NON-DELEGATED; Root CA -> EE",
114               "WIKH_ND3.ors", "ND3_Issuer_Root.pem", 1);
115     test_ocsp("DELEGATED; Intermediate CA -> EE",
116               "WIKH_D1.ors", "D1_Issuer_ICA.pem", 1);
117     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
118               "WIKH_D2.ors", "D2_Issuer_Root.pem", 1);
119     test_ocsp("DELEGATED; Root CA -> EE",
120               "WIKH_D3.ors", "D3_Issuer_Root.pem", 1);
121 };
122
123 subtest "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
124     plan tests => 3;
125
126     test_ocsp("DELEGATED; Intermediate CA -> EE",
127               "WKDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
128     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
129               "WKDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
130     test_ocsp("DELEGATED; Root CA -> EE",
131               "WKDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
132 };
133
134 subtest "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ===" => sub {
135     plan tests => 3;
136
137     test_ocsp("DELEGATED; Intermediate CA -> EE",
138               "ISDOSC_D1.ors", "D1_Issuer_ICA.pem", 1);
139     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
140               "ISDOSC_D2.ors", "D2_Issuer_Root.pem", 1);
141     test_ocsp("DELEGATED; Root CA -> EE",
142               "ISDOSC_D3.ors", "D3_Issuer_Root.pem", 1);
143 };
144
145 subtest "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ===" => sub {
146     plan tests => 6;
147
148     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
149               "ND1.ors", "WSNIC_ND1_Issuer_ICA.pem", 1);
150     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
151               "ND2.ors", "WSNIC_ND2_Issuer_Root.pem", 1);
152     test_ocsp("NON-DELEGATED; Root CA -> EE",
153               "ND3.ors", "WSNIC_ND3_Issuer_Root.pem", 1);
154     test_ocsp("DELEGATED; Intermediate CA -> EE",
155               "D1.ors", "WSNIC_D1_Issuer_ICA.pem", 1);
156     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
157               "D2.ors", "WSNIC_D2_Issuer_Root.pem", 1);
158     test_ocsp("DELEGATED; Root CA -> EE",
159               "D3.ors", "WSNIC_D3_Issuer_Root.pem", 1);
160 };
161
162 subtest "=== WRONG KEY in the ISSUER CERTIFICATE ===" => sub {
163     plan tests => 6;
164
165     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
166               "ND1.ors", "WKIC_ND1_Issuer_ICA.pem", 1);
167     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
168               "ND2.ors", "WKIC_ND2_Issuer_Root.pem", 1);
169     test_ocsp("NON-DELEGATED; Root CA -> EE",
170               "ND3.ors", "WKIC_ND3_Issuer_Root.pem", 1);
171     test_ocsp("DELEGATED; Intermediate CA -> EE",
172               "D1.ors", "WKIC_D1_Issuer_ICA.pem", 1);
173     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
174               "D2.ors", "WKIC_D2_Issuer_Root.pem", 1);
175     test_ocsp("DELEGATED; Root CA -> EE",
176               "D3.ors", "WKIC_D3_Issuer_Root.pem", 1);
177 };
178
179 subtest "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ===" => sub {
180     plan tests => 6;
181
182     # Expect success, because we're explicitly trusting the issuer certificate.
183     test_ocsp("NON-DELEGATED; Intermediate CA -> EE",
184               "ND1.ors", "ISIC_ND1_Issuer_ICA.pem", 0);
185     test_ocsp("NON-DELEGATED; Root CA -> Intermediate CA",
186               "ND2.ors", "ISIC_ND2_Issuer_Root.pem", 0);
187     test_ocsp("NON-DELEGATED; Root CA -> EE",
188               "ND3.ors", "ISIC_ND3_Issuer_Root.pem", 0);
189     test_ocsp("DELEGATED; Intermediate CA -> EE",
190               "D1.ors", "ISIC_D1_Issuer_ICA.pem", 0);
191     test_ocsp("DELEGATED; Root CA -> Intermediate CA",
192               "D2.ors", "ISIC_D2_Issuer_Root.pem", 0);
193     test_ocsp("DELEGATED; Root CA -> EE",
194               "D3.ors", "ISIC_D3_Issuer_Root.pem", 0);
195 };