REGTESTS: Fix script about OCSP update compatibility tests
There were two occurrences of the seventh test. I don't know really why, but this triggered a VTC error: ---- h7 Assert error in _assert_VSB_state(), lib/vsb.c line 104: Condition((s->s_flags & 0x00020000) == state) not true. Errno=0 Success Renumbering tests fixes the script.
This commit is contained in:
Christopher Faulet
parent
6333e6ec8e
commit
e91da1dd8e
@ -642,13 +642,10 @@ haproxy h7 -cli {
|
|||||||
haproxy h7 -wait
|
haproxy h7 -wait
|
||||||
process p7 -wait
|
process p7 -wait
|
||||||
|
|
||||||
haproxy h6 -wait
|
|
||||||
process p6 -wait
|
|
||||||
|
|
||||||
|
|
||||||
######################
|
######################
|
||||||
# #
|
# #
|
||||||
# SEVENTH TEST CASE #
|
# EIGTH TEST CASE #
|
||||||
# #
|
# #
|
||||||
######################
|
######################
|
||||||
|
|
||||||
@ -658,100 +655,6 @@ process p6 -wait
|
|||||||
# instance is removed (via del ssl crt-list).
|
# instance is removed (via del ssl crt-list).
|
||||||
#
|
#
|
||||||
|
|
||||||
haproxy h7 -conf {
|
|
||||||
global
|
|
||||||
tune.ssl.default-dh-param 2048
|
|
||||||
tune.ssl.capture-buffer-size 1
|
|
||||||
stats socket "${tmpdir}/h7/stats" level admin
|
|
||||||
crt-base ${testdir}/ocsp_update
|
|
||||||
|
|
||||||
defaults
|
|
||||||
mode http
|
|
||||||
option httplog
|
|
||||||
log stderr local0 debug err
|
|
||||||
option logasap
|
|
||||||
timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
|
|
||||||
timeout client "${HAPROXY_TEST_TIMEOUT-5s}"
|
|
||||||
timeout server "${HAPROXY_TEST_TIMEOUT-5s}"
|
|
||||||
|
|
||||||
frontend ssl-fe
|
|
||||||
bind "${tmpdir}/ssl-h7.sock" ssl crt-list ${testdir}/ocsp_update/multicert_both_certs.crt-list ca-file ${testdir}/set_cafile_rootCA.crt verify none crt-ignore-err all
|
|
||||||
http-request return status 200
|
|
||||||
|
|
||||||
listen http_rebound_lst
|
|
||||||
mode http
|
|
||||||
bind "127.0.0.1:12345"
|
|
||||||
server s1 "127.0.0.1:12346"
|
|
||||||
} -start
|
|
||||||
|
|
||||||
# Check that the two certificates are taken into account in the auto update process
|
|
||||||
haproxy h7 -cli {
|
|
||||||
send "show ssl ocsp-updates"
|
|
||||||
expect ~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021015 .*"
|
|
||||||
|
|
||||||
send "show ssl ocsp-updates"
|
|
||||||
expect ~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021016 .*"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Remove the second line from the crt-list and check that the corresponding
|
|
||||||
# ocsp response was removed from the auto update list but is still present in the
|
|
||||||
# system
|
|
||||||
haproxy h7 -cli {
|
|
||||||
send "del ssl crt-list ${testdir}/ocsp_update/multicert_both_certs.crt-list ${testdir}/ocsp_update/multicert/server_ocsp.pem.ecdsa"
|
|
||||||
expect ~ "Entry.*deleted in crtlist"
|
|
||||||
|
|
||||||
send "show ssl ocsp-updates"
|
|
||||||
expect !~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021016 .*"
|
|
||||||
|
|
||||||
send "show ssl ocsp-response"
|
|
||||||
expect ~ "Certificate ID key : 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021016"
|
|
||||||
|
|
||||||
send "show ssl ocsp-response ${testdir}/ocsp_update/multicert/server_ocsp.pem.ecdsa"
|
|
||||||
expect ~ ".* Cert Status: good.*"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Add the previously removed crt-list line with auto-update enabled and check that
|
|
||||||
# the ocsp response appears in the auto update list
|
|
||||||
shell {
|
|
||||||
printf "add ssl crt-list ${testdir}/ocsp_update/multicert_both_certs.crt-list <<\nmulticert/server_ocsp.pem.ecdsa [ocsp-update on] foo.bar\n\n" | socat "${tmpdir}/h7/stats" - | grep "Inserting certificate.*in crt-list"
|
|
||||||
}
|
|
||||||
|
|
||||||
haproxy h7 -cli {
|
|
||||||
send "show ssl ocsp-updates"
|
|
||||||
expect ~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021016 .*"
|
|
||||||
}
|
|
||||||
|
|
||||||
# Check that the auto update option consistency check work even when crt-list
|
|
||||||
# lines are added through the cli
|
|
||||||
shell {
|
|
||||||
printf "add ssl crt-list ${testdir}/ocsp_update/multicert_both_certs.crt-list <<\nmulticert/server_ocsp.pem.ecdsa foo.foo\n\n" | socat "${tmpdir}/h7/stats" - | grep "Incompatibilities found in OCSP update mode for certificate"
|
|
||||||
}
|
|
||||||
|
|
||||||
haproxy h7 -wait
|
|
||||||
|
|
||||||
####################
|
|
||||||
# #
|
|
||||||
# EIGTH TEST CASE #
|
|
||||||
# #
|
|
||||||
####################
|
|
||||||
|
|
||||||
#
|
|
||||||
# Check that a certificate created through the CLI and which does not have ocsp
|
|
||||||
# update enabled can be updated via "update ssl ocsp-response" command.
|
|
||||||
#
|
|
||||||
|
|
||||||
process p8 "openssl ocsp -index ${testdir}/ocsp_update/index.txt -rsigner ${testdir}/ocsp_update/ocsp.haproxy.com.pem -CA ${testdir}/ocsp_update/ocsp_update_rootca.crt -nrequest 1 -ndays 1 -port 12346 -timeout 5" -start
|
|
||||||
|
|
||||||
barrier b8 cond 2 -cyclic
|
|
||||||
|
|
||||||
syslog Syslog_h8 -level info {
|
|
||||||
recv
|
|
||||||
expect ~ "GET /MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBSKg%2BAGD6%2F3Ccp%2Bm5VSKi6BY1%2FaCgQU9lKw5DXV6pI4UVCPCtvpLYXeAHoCAhAV HTTP/1.1"
|
|
||||||
|
|
||||||
barrier b8 sync
|
|
||||||
} -start
|
|
||||||
|
|
||||||
|
|
||||||
haproxy h8 -conf {
|
haproxy h8 -conf {
|
||||||
global
|
global
|
||||||
tune.ssl.default-dh-param 2048
|
tune.ssl.default-dh-param 2048
|
||||||
@ -769,58 +672,152 @@ haproxy h8 -conf {
|
|||||||
timeout server "${HAPROXY_TEST_TIMEOUT-5s}"
|
timeout server "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||||
|
|
||||||
frontend ssl-fe
|
frontend ssl-fe
|
||||||
bind "${tmpdir}/ssl-h8.sock" ssl crt-list ${testdir}/ocsp_update/multicert_ecdsa_no_update.crt-list ca-file ${testdir}/set_cafile_rootCA.crt verify none crt-ignore-err all
|
bind "${tmpdir}/ssl-h8.sock" ssl crt-list ${testdir}/ocsp_update/multicert_both_certs.crt-list ca-file ${testdir}/set_cafile_rootCA.crt verify none crt-ignore-err all
|
||||||
|
http-request return status 200
|
||||||
|
|
||||||
|
listen http_rebound_lst
|
||||||
|
mode http
|
||||||
|
bind "127.0.0.1:12345"
|
||||||
|
server s1 "127.0.0.1:12346"
|
||||||
|
} -start
|
||||||
|
|
||||||
|
# Check that the two certificates are taken into account in the auto update process
|
||||||
|
haproxy h8 -cli {
|
||||||
|
send "show ssl ocsp-updates"
|
||||||
|
expect ~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021015 .*"
|
||||||
|
|
||||||
|
send "show ssl ocsp-updates"
|
||||||
|
expect ~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021016 .*"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Remove the second line from the crt-list and check that the corresponding
|
||||||
|
# ocsp response was removed from the auto update list but is still present in the
|
||||||
|
# system
|
||||||
|
haproxy h8 -cli {
|
||||||
|
send "del ssl crt-list ${testdir}/ocsp_update/multicert_both_certs.crt-list ${testdir}/ocsp_update/multicert/server_ocsp.pem.ecdsa"
|
||||||
|
expect ~ "Entry.*deleted in crtlist"
|
||||||
|
|
||||||
|
send "show ssl ocsp-updates"
|
||||||
|
expect !~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021016 .*"
|
||||||
|
|
||||||
|
send "show ssl ocsp-response"
|
||||||
|
expect ~ "Certificate ID key : 303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021016"
|
||||||
|
|
||||||
|
send "show ssl ocsp-response ${testdir}/ocsp_update/multicert/server_ocsp.pem.ecdsa"
|
||||||
|
expect ~ ".* Cert Status: good.*"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Add the previously removed crt-list line with auto-update enabled and check that
|
||||||
|
# the ocsp response appears in the auto update list
|
||||||
|
shell {
|
||||||
|
printf "add ssl crt-list ${testdir}/ocsp_update/multicert_both_certs.crt-list <<\nmulticert/server_ocsp.pem.ecdsa [ocsp-update on] foo.bar\n\n" | socat "${tmpdir}/h8/stats" - | grep "Inserting certificate.*in crt-list"
|
||||||
|
}
|
||||||
|
|
||||||
|
haproxy h8 -cli {
|
||||||
|
send "show ssl ocsp-updates"
|
||||||
|
expect ~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021016 .*"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Check that the auto update option consistency check work even when crt-list
|
||||||
|
# lines are added through the cli
|
||||||
|
shell {
|
||||||
|
printf "add ssl crt-list ${testdir}/ocsp_update/multicert_both_certs.crt-list <<\nmulticert/server_ocsp.pem.ecdsa foo.foo\n\n" | socat "${tmpdir}/h8/stats" - | grep "Incompatibilities found in OCSP update mode for certificate"
|
||||||
|
}
|
||||||
|
|
||||||
|
haproxy h8 -wait
|
||||||
|
|
||||||
|
####################
|
||||||
|
# #
|
||||||
|
# NINTH TEST CASE #
|
||||||
|
# #
|
||||||
|
####################
|
||||||
|
|
||||||
|
#
|
||||||
|
# Check that a certificate created through the CLI and which does not have ocsp
|
||||||
|
# update enabled can be updated via "update ssl ocsp-response" command.
|
||||||
|
#
|
||||||
|
|
||||||
|
process p9 "openssl ocsp -index ${testdir}/ocsp_update/index.txt -rsigner ${testdir}/ocsp_update/ocsp.haproxy.com.pem -CA ${testdir}/ocsp_update/ocsp_update_rootca.crt -nrequest 1 -ndays 1 -port 12346 -timeout 5" -start
|
||||||
|
|
||||||
|
barrier b9 cond 2 -cyclic
|
||||||
|
|
||||||
|
syslog Syslog_h9 -level info {
|
||||||
|
recv
|
||||||
|
expect ~ "GET /MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBSKg%2BAGD6%2F3Ccp%2Bm5VSKi6BY1%2FaCgQU9lKw5DXV6pI4UVCPCtvpLYXeAHoCAhAV HTTP/1.1"
|
||||||
|
|
||||||
|
barrier b9 sync
|
||||||
|
} -start
|
||||||
|
|
||||||
|
|
||||||
|
haproxy h9 -conf {
|
||||||
|
global
|
||||||
|
tune.ssl.default-dh-param 2048
|
||||||
|
tune.ssl.capture-buffer-size 1
|
||||||
|
stats socket "${tmpdir}/h9/stats" level admin
|
||||||
|
crt-base ${testdir}/ocsp_update
|
||||||
|
|
||||||
|
defaults
|
||||||
|
mode http
|
||||||
|
option httplog
|
||||||
|
log stderr local0 debug err
|
||||||
|
option logasap
|
||||||
|
timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||||
|
timeout client "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||||
|
timeout server "${HAPROXY_TEST_TIMEOUT-5s}"
|
||||||
|
|
||||||
|
frontend ssl-fe
|
||||||
|
bind "${tmpdir}/ssl-h9.sock" ssl crt-list ${testdir}/ocsp_update/multicert_ecdsa_no_update.crt-list ca-file ${testdir}/set_cafile_rootCA.crt verify none crt-ignore-err all
|
||||||
http-request return status 200
|
http-request return status 200
|
||||||
|
|
||||||
listen http_rebound_lst
|
listen http_rebound_lst
|
||||||
mode http
|
mode http
|
||||||
option httplog
|
option httplog
|
||||||
log ${Syslog_h8_addr}:${Syslog_h8_port} local0
|
log ${Syslog_h9_addr}:${Syslog_h9_port} local0
|
||||||
bind "127.0.0.1:12345"
|
bind "127.0.0.1:12345"
|
||||||
server s1 "127.0.0.1:12346"
|
server s1 "127.0.0.1:12346"
|
||||||
} -start
|
} -start
|
||||||
|
|
||||||
# We need to "enable" the cli with a first cli call before using it only through socats
|
# We need to "enable" the cli with a first cli call before using it only through socats
|
||||||
haproxy h8 -cli {
|
haproxy h9 -cli {
|
||||||
send "show ssl cert"
|
send "show ssl cert"
|
||||||
expect ~ ""
|
expect ~ ""
|
||||||
}
|
}
|
||||||
|
|
||||||
# Create a new certificate and add it in the crt-list with ocsp auto-update enabled
|
# Create a new certificate and add it in the crt-list with ocsp auto-update enabled
|
||||||
shell {
|
shell {
|
||||||
echo "new ssl cert ${testdir}/ocsp_update/rsa.pem" | socat "${tmpdir}/h8/stats" -
|
echo "new ssl cert ${testdir}/ocsp_update/rsa.pem" | socat "${tmpdir}/h9/stats" -
|
||||||
printf "set ssl cert ${testdir}/ocsp_update/rsa.pem <<\n$(cat ${testdir}/ocsp_update/multicert/server_ocsp.pem.rsa)\n\n" | socat "${tmpdir}/h8/stats" -
|
printf "set ssl cert ${testdir}/ocsp_update/rsa.pem <<\n$(cat ${testdir}/ocsp_update/multicert/server_ocsp.pem.rsa)\n\n" | socat "${tmpdir}/h9/stats" -
|
||||||
printf "set ssl cert ${testdir}/ocsp_update/rsa.pem.issuer <<\n$(cat ${testdir}/ocsp_update/ocsp_update_rootca.crt)\n\n" | socat "${tmpdir}/h8/stats" -
|
printf "set ssl cert ${testdir}/ocsp_update/rsa.pem.issuer <<\n$(cat ${testdir}/ocsp_update/ocsp_update_rootca.crt)\n\n" | socat "${tmpdir}/h9/stats" -
|
||||||
printf "set ssl cert ${testdir}/ocsp_update/rsa.pem.ocsp <<\n$(base64 -w 1000 ${testdir}/ocsp_update/multicert/server_ocsp.pem.rsa.ocsp)\n\n" | socat "${tmpdir}/h8/stats" -
|
printf "set ssl cert ${testdir}/ocsp_update/rsa.pem.ocsp <<\n$(base64 -w 1000 ${testdir}/ocsp_update/multicert/server_ocsp.pem.rsa.ocsp)\n\n" | socat "${tmpdir}/h9/stats" -
|
||||||
echo "commit ssl cert ${testdir}/ocsp_update/rsa.pem" | socat "${tmpdir}/h8/stats" -
|
echo "commit ssl cert ${testdir}/ocsp_update/rsa.pem" | socat "${tmpdir}/h9/stats" -
|
||||||
|
|
||||||
printf "add ssl crt-list ${testdir}/ocsp_update/multicert_ecdsa_no_update.crt-list <<\nrsa.pem [ocsp-update off] foo.bar\n\n" | socat "${tmpdir}/h8/stats" -
|
printf "add ssl crt-list ${testdir}/ocsp_update/multicert_ecdsa_no_update.crt-list <<\nrsa.pem [ocsp-update off] foo.bar\n\n" | socat "${tmpdir}/h9/stats" -
|
||||||
}
|
}
|
||||||
|
|
||||||
# Check that the line is in the crt-list
|
# Check that the line is in the crt-list
|
||||||
haproxy h8 -cli {
|
haproxy h9 -cli {
|
||||||
send "show ssl crt-list ${testdir}/ocsp_update/multicert_ecdsa_no_update.crt-list"
|
send "show ssl crt-list ${testdir}/ocsp_update/multicert_ecdsa_no_update.crt-list"
|
||||||
expect ~ "${testdir}/ocsp_update/rsa.pem .* foo.bar"
|
expect ~ "${testdir}/ocsp_update/rsa.pem .* foo.bar"
|
||||||
}
|
}
|
||||||
|
|
||||||
# Check that the new certificate is NOT in the auto update list
|
# Check that the new certificate is NOT in the auto update list
|
||||||
haproxy h8 -cli {
|
haproxy h9 -cli {
|
||||||
send "show ssl ocsp-updates"
|
send "show ssl ocsp-updates"
|
||||||
expect !~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021015.*"
|
expect !~ "303b300906052b0e03021a050004148a83e0060faff709ca7e9b95522a2e81635fda0a0414f652b0e435d5ea923851508f0adbe92d85de007a02021015.*"
|
||||||
}
|
}
|
||||||
|
|
||||||
shell {
|
shell {
|
||||||
echo "update ssl ocsp-response ${testdir}/ocsp_update/rsa.pem" | socat "${tmpdir}/h8/stats" -
|
echo "update ssl ocsp-response ${testdir}/ocsp_update/rsa.pem" | socat "${tmpdir}/h9/stats" -
|
||||||
}
|
}
|
||||||
|
|
||||||
shell "sleep 1"
|
shell "sleep 1"
|
||||||
|
|
||||||
barrier b8 sync
|
barrier b9 sync
|
||||||
|
|
||||||
haproxy h8 -cli {
|
haproxy h9 -cli {
|
||||||
send "show ssl ocsp-response ${testdir}/ocsp_update/rsa.pem"
|
send "show ssl ocsp-response ${testdir}/ocsp_update/rsa.pem"
|
||||||
expect ~ ".* Cert Status: revoked.*"
|
expect ~ ".* Cert Status: revoked.*"
|
||||||
}
|
}
|
||||||
|
|
||||||
haproxy h8 -wait
|
haproxy h9 -wait
|
||||||
process p8 -wait
|
process p9 -wait
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user