From: Remi Tricot-Le Breton Date: Thu, 1 Oct 2026 14:59:30 +0000 (+0200) Subject: REGTESTS: ocsp: Add 'do-ocsp-request' tests X-Git-Tag: v3.5-dev9~217 X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=11d667d73df2c7e4da978683a59b196d52bca619;p=haproxy.git REGTESTS: ocsp: Add 'do-ocsp-request' tests Add a regtest that uses the 'do-ocsp-request' action with a client that uses a good certificate, a revoked certificate or no certificate. --- diff --git a/reg-tests/ssl/certs/ocsp_client_check/ca.key b/reg-tests/ssl/certs/ocsp_client_check/ca.key new file mode 100644 index 000000000..3941f6fc9 --- /dev/null +++ b/reg-tests/ssl/certs/ocsp_client_check/ca.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDJ9UVqDR4sQEHO +ZwkvTZ7chrT6GTRk706NAhKlHxbSIobp5g547MhBEgnr3bt8bQf2GHE9m77uoaVa +jxrThhUz5wFDvZGE2FmvxJ0jNRaDPneVHzW6Zs9g87hjmbJSSECI5AEEsj/+3xZ9 +bm9XDt5+TP+/wUWT0blPffikVIrevu90roDBAJKIJf7SLxeP95eCQtkuLN8NP1+n +SnjKF012qcbHPMvoCSZDJpoybB8puOjC8QuAEKVhLJ7T003lDkrB6QrTTbYtlQ6r +ZRNDhyXj0WJFaIb+ayQxpM3ISuZzcTxAZQrUwyIp5ztmWov7jD13Y0JbJLng/wKK +Y/tI14n7AgMBAAECggEAUFik8gkf/OjfhVcWn1wZHJD3BRzr7FAMhyrQ8iJJOPaF +iB5/mXpSPRkJG25OfbT+2thkjOcecd+bYkjWmlqYqtp3dVTAxQIxxCzLe0tOlo5O +kuQkwvDOBjtQG0f1WqjmC8/x28Vyklp8nxBFeXQv7j2B7e7dWG6yc76hIfeEfBLy +r6JUDj/iJLlLBgmmrDhYs0aBprs6K65WGftFhkUnWRM0ocvrEXpj+LxUM0+Qk0ul +FEiK3LAICZmLDTCILRP2Ptzk2o3fd53H5mR/sEK8qnYnT1CfwYVfdYo90EfDuXLN +PhYTIPcfd408MmOMFmCmmG/+Vuo2ghyrpOXH0OoTIQKBgQD3S6rJS7lu3bNumpuw +fF4pelQVQq+TpynNrJwibiiEaU49PwFIhrRZu/GW9MQaqmNrZVZzZqFu1BkanTuw +cPh/DBhTcxlc5t+Z2OzTJDefY5LCD6AxIHWee3yQuTimomGMxC43SVZNeO6BFL/W +TuAIsmHqqu5gIy+CUEG4Ba2g0QKBgQDREROgM7hD5O67TsA3rvpwL1oubfhF9c3C +XLI//zMJwSFk+kAUhkOmubD5EoQIl9bG9Ob2MEiH0rk87FGYWgPzww8nzdTpcA1t +AT3WwuxjSiBY+L22BN5t33UEMb6u6W+HGjs7l3/f6EXV7ClFVz5lNCpd5QLgmzpM +z7dAtmfRCwKBgQC9dBrDXGATr4VnlsrvylfZLv57yzr3w3kjOLnlJr+jsYlfIoW5 +KnnAxVuwapRSWXcRL/GrN1U1swgIe6ze362Ap6N7SxKDOdzT4HyOxZBXa9FjGtV+ +zX9OiwxDU6MzBfP2A9XkRSr470zJVzwg0wyPnRmmzo0Q2ePr0dCHStJaAQKBgCXP +zdnioMf+xsKvuooXponVtpzBHO8iRsWJWF/Euylfebe2nxJXOjMUUJKrq5+WPq0b +LA6IqwWNshz3rMY+OYrD06DiVEioEHWPjOyjsnc+t9z/l+gst0Ht8U8B5DfkVlx7 +/QyJGQKZEtBe9xPodIt/RM5Ylg2jZYbw5nbYxqwDAoGAKLL/Bozn0vWfX1q0c9cA +BhS7J9uHmVHlKL0Rpnr6pCuQxBzVol7KD9JvPn7Es8bKXM7K7aujM8ZVaHaHdFkj +NxryHUT6tBZf0LEyUR0SrqbxMfYEfHyInM363auXIOtgVR/xfOt8BP1Ww/Ku0doQ +4KPnp785bedowGiIb61deBM= +-----END PRIVATE KEY----- diff --git a/reg-tests/ssl/certs/ocsp_client_check/ca/ocsp_client_check_ca.crt b/reg-tests/ssl/certs/ocsp_client_check/ca/ocsp_client_check_ca.crt new file mode 100644 index 000000000..877284b94 --- /dev/null +++ b/reg-tests/ssl/certs/ocsp_client_check/ca/ocsp_client_check_ca.crt @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDcjCCAlqgAwIBAgIUQ9x4he0xTzJFhwO2Vp02H36SxkYwDQYJKoZIhvcNAQEL +BQAwUDELMAkGA1UEBhMCRlIxHTAbBgNVBAoMFEhBUHJveHkgVGVjaG5vbG9naWVz +MSIwIAYDVQQDDBlPQ1NQIENsaWVudCBDaGVjayBSb290IENBMCAXDTI2MDkwODE0 +MDcwOFoYDzIxMjYwODE1MTQwNzA4WjBQMQswCQYDVQQGEwJGUjEdMBsGA1UECgwU +SEFQcm94eSBUZWNobm9sb2dpZXMxIjAgBgNVBAMMGU9DU1AgQ2xpZW50IENoZWNr +IFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDJ9UVqDR4s +QEHOZwkvTZ7chrT6GTRk706NAhKlHxbSIobp5g547MhBEgnr3bt8bQf2GHE9m77u +oaVajxrThhUz5wFDvZGE2FmvxJ0jNRaDPneVHzW6Zs9g87hjmbJSSECI5AEEsj/+ +3xZ9bm9XDt5+TP+/wUWT0blPffikVIrevu90roDBAJKIJf7SLxeP95eCQtkuLN8N +P1+nSnjKF012qcbHPMvoCSZDJpoybB8puOjC8QuAEKVhLJ7T003lDkrB6QrTTbYt +lQ6rZRNDhyXj0WJFaIb+ayQxpM3ISuZzcTxAZQrUwyIp5ztmWov7jD13Y0JbJLng +/wKKY/tI14n7AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQD +AgGGMB0GA1UdDgQWBBQuqMVksIQvcZlvGoOxpDfUD4+U+zANBgkqhkiG9w0BAQsF +AAOCAQEAIcesAvOq128raUQcixFxygFEe9XqpV25H///ThlNoriDufI7pEZOTM+U +hGFajAGLqKdMCksbPBp5VYrQNoquYmQ9MagF79qpqx9F6UPLUShE6knr9X2hIOEA +Beg0uUIwJQCjTJ7oidrgBDYeJUASTZhpdNZlqlgRRPCCp56wsRLW7PDxScSNOCqq +2YQj+du+Ww/M8eagndIJwo7ng8JW80v++p5758NlBeOv+YwaCoQU8WXnRzgXrtaD +Z2keRPsu0Qn5AWqRFhP2e0BoxMkQN6CahbLE/9OOyRak6Y7gqdm8+W2BvTDYLMNJ +4OsNeqb31Hm6oVKG24ZJhn9/RS5KnQ== +-----END CERTIFICATE----- diff --git a/reg-tests/ssl/certs/ocsp_client_check/client_good.pem b/reg-tests/ssl/certs/ocsp_client_check/client_good.pem new file mode 100644 index 000000000..b0e6509fa --- /dev/null +++ b/reg-tests/ssl/certs/ocsp_client_check/client_good.pem @@ -0,0 +1,51 @@ +-----BEGIN CERTIFICATE----- +MIID2TCCAsGgAwIBAgIUek/VFpht1TjHBDEoAzsv3egBA7MwDQYJKoZIhvcNAQEL +BQAwUDELMAkGA1UEBhMCRlIxHTAbBgNVBAoMFEhBUHJveHkgVGVjaG5vbG9naWVz +MSIwIAYDVQQDDBlPQ1NQIENsaWVudCBDaGVjayBSb290IENBMCAXDTI2MDkwODE0 +MDcwOFoYDzIxMjYwODE1MTQwNzA4WjBRMQswCQYDVQQGEwJGUjEdMBsGA1UECgwU +SEFQcm94eSBUZWNobm9sb2dpZXMxIzAhBgNVBAMMGmdvb2Qub2NzcC1jbGllbnQt +Y2hlY2suY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnBPUujfI +bTW0HsURVTzxPohFEMZ4DqhQstsLVk4ixPVB0Sapa2cv4W68QkhvKAGGyZE4TQFu +U/1etVS58rwLTlmYTYfMk/28VQUtY7Eg/Fb1d6SHz07dt6jIOEvAGVlNIQwSn04F +UpqadzmCHizgMmzTxxnuUdMbhxLDgH7PmLzBaO0BPibNDNaQHxMYa+HbhbGtoSui +j6g4jdRAxcntI9QGhkuaWXB7Vc7qOMDkzCG1cjh2mVruycpLulRF/JfrrD5y8i+Y +Xvl42P81Zc5OIN5L/nb4dDU1R1Y8NR8vwhsdPY/eTu7xWZesjL4PAH5a/iPg+Igj +aHkRtawVuJZ3oQIDAQABo4GnMIGkMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQDAgWg +MBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBR2oq04PpgztsnjlGv49mT2 +U3+dFzAfBgNVHSMEGDAWgBQuqMVksIQvcZlvGoOxpDfUD4+U+zAyBggrBgEFBQcB +AQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MTIzNDYwDQYJKoZI +hvcNAQELBQADggEBAD2kLbsyMneG6GIQY1ENNDG6zgK7MlH26bFBsBrPBLORLvag +Xv/jWJuIEREFBl+UPA4XfcruR2POQGtRYJQ8B6WZ7g+zLIL7YfWb374JwMAOscR7 +zh5p6sh4S7391cmgF6GKrAVCAgRqilV9m959ptkHWS85jhhCCnwCOoc9vMaTB68M +Lw6gQt36OcREeG0f2AfIG0lPWE8H17ExBGaTfgrJtQcrx68RftEKWYA8jmOahVfP +08TjQVpdXgFHChikQzsl5GwHr3E9R6coj2eKMlbNAjkB9zZ+E34KmAwoHxxDCwrC +W7t31yDqNxbEqp2UWX0pc+odztuNxaLaSFGfhig= +-----END CERTIFICATE----- +-----BEGIN PRIVATE KEY----- +MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCcE9S6N8htNbQe +xRFVPPE+iEUQxngOqFCy2wtWTiLE9UHRJqlrZy/hbrxCSG8oAYbJkThNAW5T/V61 +VLnyvAtOWZhNh8yT/bxVBS1jsSD8VvV3pIfPTt23qMg4S8AZWU0hDBKfTgVSmpp3 +OYIeLOAybNPHGe5R0xuHEsOAfs+YvMFo7QE+Js0M1pAfExhr4duFsa2hK6KPqDiN +1EDFye0j1AaGS5pZcHtVzuo4wOTMIbVyOHaZWu7Jyku6VEX8l+usPnLyL5he+XjY +/zVlzk4g3kv+dvh0NTVHVjw1Hy/CGx09j95O7vFZl6yMvg8Aflr+I+D4iCNoeRG1 +rBW4lnehAgMBAAECggEAAuYoJlOXDabAx03JJzJ6J2uB72hlVl3cXl8c1jv+L7b/ +w4gWn2XntPXw6aEFbgp9t8CimWUSeN1I4SC/UbW6FsjpoB6Kr3DICtL9W2fAzWka +1v+jjWdpTUIVgnyvNzVSPj/2eFarWQQBxJ9JBkEWgr9EXYNS+rp7bVpNDvXkCqHm ++7XHPu+vB9v3CtTFk+ZJGiGHJwkGGHdd1JUNtFKR3yheAM9iVRqKxW6R2XMSy07A +DCl7VAQL8KyZs+JS2kcDIuOa8m3JIPE8Qfr0MrGXKvUsZHORfQKaC6rNk2LZuDhC +K5YXWOkLF1a+ouMM8jbQt6YMKNQYBkHPBYTGdF0lkQKBgQDU+tPBKg0c1FupYgME +yuRum+hjuoXxYE5f8kOQDyEVZ/LZSWpW4rxbullgOnFczZ1pBxbQxgPX5PdYLsrj +6XXKxqYkhrPn3HFeKxp8VUDl0X9GnJ7F4z+8YqVIj23wI+4kkmTH/8mBmRRJU7iK +RaNLQCmPi2vZ4HdsOeFAlRhDMQKBgQC7mpZwtFz9uFRv75z4WI6z11F9aTgcn6wC +wdZ5xchpmChG0U8q4zR8JPnMLlqgN3+i/P6A58dYkOE5mrLu42kfZ/S9tq6VPcd7 +BEgu62Zwb5SS388WpUlRP3ebc93w8CGcrqLGSjop8btER/P0Q6qJQ2V+J29cL/By +zF3WYmP/cQKBgCdHp3xNvCNgCxO/Tt04ak74FDEoeoGdCHdroAhWsfxXspNele02 +XhTw1oEH5lZ+WZTASPXyP003HmM2JhdIvH/MiWHdMhsGLiZ2/qiFtLVuIPIt+p52 +ng+pheBPC7Cpf8dg9JNqWoi7aeFoPnXKCCbdy4x840RIwN3GAwQ9Oz9RAoGAc0ul +S2y9fbzMP+Ld8I7UXNhmn5GLx6Ol3ifsvPf9nE/D6Qn4Ap6SAf3je0W9spuJGM0t +SGGp1NdtY66ca05dq8yC0Bk2oEfQkdzm09ceJNmeUMm1hvBb58/+nQ4Ph2S884Ms +THsP1flXIrapyiPP6f3+oRJxURGxT4wj236qgDECgYBDeGHxHAQGi7I1265tK6Ha +qJMgJ/XVnRYyLXGGfionoeGcyuaazg4TqQft1B+ZZPEDipvJfz2wKsl51Djd9mmM +hkEBtK1dfcw3bvg/wsgj1u7t0ID/W5i8JTvpJZUYjg5IfTWmf95MA1Uu7MC30uux +pQLXUdlsUGlStwgoYWl+ag== +-----END PRIVATE KEY----- diff --git a/reg-tests/ssl/certs/ocsp_client_check/client_no_ocsp.pem b/reg-tests/ssl/certs/ocsp_client_check/client_no_ocsp.pem new file mode 100644 index 000000000..1bdc784a5 --- /dev/null +++ b/reg-tests/ssl/certs/ocsp_client_check/client_no_ocsp.pem @@ -0,0 +1,50 @@ +-----BEGIN CERTIFICATE----- +MIIDpjCCAo6gAwIBAgIUArBXAXnqNVPFjU3CgnWqhecaVZYwDQYJKoZIhvcNAQEL +BQAwUDELMAkGA1UEBhMCRlIxHTAbBgNVBAoMFEhBUHJveHkgVGVjaG5vbG9naWVz +MSIwIAYDVQQDDBlPQ1NQIENsaWVudCBDaGVjayBSb290IENBMCAXDTI2MDkwODE0 +MDcwOVoYDzIxMjYwODE1MTQwNzA5WjBUMQswCQYDVQQGEwJGUjEdMBsGA1UECgwU +SEFQcm94eSBUZWNobm9sb2dpZXMxJjAkBgNVBAMMHW5vLW9jc3Aub2NzcC1jbGll +bnQtY2hlY2suY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAii9t +dRJotG0kGneKgfBL1BiXr6JJCLR/xiJo5wYOR4e5BlPmhZcFR8BOiAwX9KckN2XZ +c/igs0jE5pQKRWWiJue0YsAWzRBBXbJcVwivafpXn8p47Sj9llNxbdgOaTgDArW3 +ZdU7EuM9tqFTgaYVPzQ+artyVlQ/yx5ZQoFq/KUu7m+8NrWvQcdfRxS2vax1RrzO +0qfT9EpsN2OCVX404ufbrcZPCCSkI8p+BBJ4kH9eOSJqorXyO0Rdw3BYvzYDl+Gp +UqkkHoDNbNnAj7I6uQjl2qf1SmvOUynmdfDXhn1iMDvetranSe+vOWsxFFPeviEM +N+4uDepiaqKVhIEOGwIDAQABo3IwcDAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIF +oDATBgNVHSUEDDAKBggrBgEFBQcDAjAdBgNVHQ4EFgQUM5HSoTJiQZOZg/tX7+ka +KMq0u4YwHwYDVR0jBBgwFoAULqjFZLCEL3GZbxqDsaQ31A+PlPswDQYJKoZIhvcN +AQELBQADggEBAGGRbtxGXy05ezDqnK8tH4GRsWfrHm7OSGX1y0/Uk7gthtULw9x+ +xQ6O24Ue8Zx8ejRrNdybD+OQdrOsB0NpwNX7osoleTV9u3rYtHf/7NDJOcBXQSVd +2HUuavPEJ3Xv4+XprQ3g+vAE4vn5pOGDtpK9V6qyvSCy3ExEjfd4+/2X+/JDosYu +PKyhYggqmJBn9azYlR54b0XR9Y7YeFFk2F8ZV2vmv6SyYEvUkIMjieBHKC6eyAuZ +7xmGyyX75+Lkh4/EtZykWyw8Gy7B+l2d8lRInE7BK4JX0cBtt1ufNOzijcBooXlG +MuPR+F/DdAscW5daX+vfoA7loo7RclLcePc= +-----END CERTIFICATE----- +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCKL211Emi0bSQa +d4qB8EvUGJevokkItH/GImjnBg5Hh7kGU+aFlwVHwE6IDBf0pyQ3Zdlz+KCzSMTm +lApFZaIm57RiwBbNEEFdslxXCK9p+lefynjtKP2WU3Ft2A5pOAMCtbdl1TsS4z22 +oVOBphU/ND5qu3JWVD/LHllCgWr8pS7ub7w2ta9Bx19HFLa9rHVGvM7Sp9P0Smw3 +Y4JVfjTi59utxk8IJKQjyn4EEniQf145ImqitfI7RF3DcFi/NgOX4alSqSQegM1s +2cCPsjq5COXap/VKa85TKeZ18NeGfWIwO962tqdJ7685azEUU96+IQw37i4N6mJq +opWEgQ4bAgMBAAECggEAQimxO/PDhFgZiD6iZ9K5S+U2g5atZ2idIS4Kkkr4/VDD +y37SijYkBhXSxBseQTriAVBXzMpHj3ARLuHFBTNDb2NToFCe2jKlSYqD4fw7mP+P +gue7/Lm6qYZscg6X39M8xchh9nUhIssBGnel9xahZ7DJDeuQNDuEi+mNDWXP5wUw +ALiFnYYowX7xCKmbqsFTub8oDurf4laIY7dGvmi6sxjaevnsPL3Y2e9DN30BUEVO +mIsKLMKKZMWoNYYLonyAkOyWMaRA4c+58euBR8F+ghY4EjpYBQwWivSxcyKK4qlQ +UtamnyKDnYD2Nzec12IuIMJs663AUCSPn63jK70KoQKBgQDB4pRAU6NuCERYXUDl +nbeXJom4vZhtjXI6tLUyFqD8x90ZT8x0I7cCwas9ikn9gHEjR5SLe97ds9UYZU/V +iskWp1lF9sjUFz8/9Npev1XXNuDnhNqAnnv4AwBlZC2UtxejYBKeBMEatabNEivE +UPCWttJFAqhCMjt7t9+aERt2iwKBgQC2dKWQFi1H8RfF/AoqOiDi1SCsrRdOmigu +CHKO40I1zFm6IwEdPQ9ABg3yYuOZwIgG5QrTrLIx9jMk79c5mq5IDFn1SPH8x8E/ +qFT8WMMAfolBd2MRt1VKC/b8CortdtqB5MkcfYIaTjMzbNCu7WDnMqopgcKUnz9U +cSw3uCdIsQKBgQC1ndcdgrtegOP0mjYGYPzu26y6nu8///V2xHvPFZ9r6pRT94of +aK0wKdaMaRPyIPTaBV1CY6BasO/2UEC+WakQTWa0wP1SnwwijuxXQIfad4+pj6tW +PB8ILVebooGIAxJjecU2vGFe8bXz9weEeAVGSK8i8eBHUeKie5U7Lrc5DQKBgQC0 +XWd1opassabAr0EVMVVlJy8fxBRwPXBO4Ubt/bZsHFDu8r+dOckjj1imLh+01GEj +/7POQL//J9SzRO1MIp761krvcWbWblmZJjytIMnUaUIiF3U2BDgp9N35lip0SLQF +CDfPFDtS6c8vnPhGlJ7grnMMiRvjc/FU9nOxuTgMYQKBgFOxoy8gNGGZOWHbE+cM +feXjRM7yIakMZiIykalw3hGnGonFVwsZHs9Xmo8PInZqHmGuKYiqp10UqeLY4wpG +LK3gcGuqM/my3aVbUtu9a8UQlPho4oD/42fTNqU8jZotb1l3cW2HyfZ6jTDglCwK +Ni1L4LW5+yb4IhWVXK//cLkG +-----END PRIVATE KEY----- diff --git a/reg-tests/ssl/certs/ocsp_client_check/client_revoked.pem b/reg-tests/ssl/certs/ocsp_client_check/client_revoked.pem new file mode 100644 index 000000000..6961b9eee --- /dev/null +++ b/reg-tests/ssl/certs/ocsp_client_check/client_revoked.pem @@ -0,0 +1,51 @@ +-----BEGIN CERTIFICATE----- +MIID3DCCAsSgAwIBAgIUXeleYXdFZjzutOzLIu47+vU4Fv8wDQYJKoZIhvcNAQEL +BQAwUDELMAkGA1UEBhMCRlIxHTAbBgNVBAoMFEhBUHJveHkgVGVjaG5vbG9naWVz +MSIwIAYDVQQDDBlPQ1NQIENsaWVudCBDaGVjayBSb290IENBMCAXDTI2MDkwODE0 +MDcwOVoYDzIxMjYwODE1MTQwNzA5WjBUMQswCQYDVQQGEwJGUjEdMBsGA1UECgwU +SEFQcm94eSBUZWNobm9sb2dpZXMxJjAkBgNVBAMMHXJldm9rZWQub2NzcC1jbGll +bnQtY2hlY2suY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh8DG +uvGbWkJPmKS86VKPKVKkWojHF2LFrkL5Jh1RllMSiFjHJFVMgI//xFZDqJdH6kU0 +8y9ooB2Vq4Z/0ojxirIbiJSfnKBrp03UStAP2uFJFDir1snyVHeDkpZ0PwhwXyLi +vJ9GX63N/4oSyi749xRo5ygeTw1bvmqLDUv1XPUrXY4yr6+mNqIYwq3jqKxSkB+c +O54r0sMFd9NAc7HobPo36sGlXtpT1DxYvylTfsi1gehAe/Zjx5qVunXiAGR7ECy+ +bcM2de8ovWT9H1jzCQ1UbWNnpLr0vR4T+XwcJCXcNPDUBKqB6HphEUIBJ28TkEMl +u0LYGMTWyALClXRATwIDAQABo4GnMIGkMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQD +AgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMCMB0GA1UdDgQWBBS9gyizKpFDpxpYcdCj +MZxqXOaKxDAfBgNVHSMEGDAWgBQuqMVksIQvcZlvGoOxpDfUD4+U+zAyBggrBgEF +BQcBAQQmMCQwIgYIKwYBBQUHMAGGFmh0dHA6Ly8xMjcuMC4wLjE6MTIzNDYwDQYJ +KoZIhvcNAQELBQADggEBAE+ZLbQTuoMaQ8wQApaeL+QOqxvBKDywWh0oug0X+ShM +XXX5MTjqX0NgxEcaKHgMw9a5OzItNw1wB+2rsNEt9oAgRL2ovSSJlI7SIKCSdDkD +TW08XZN36PhvkRBNwxqyftBKJPjXVFaCvug/EOAk7OFgnJpAWVkjhsjyD+y0qSaa +58fN/DJcASlHUy1oGdi0d/5Skzo498ScVtj3JxkotHsdEr15bReY/CpMzJgHOdGW +Z5o6SGymUgalrnmc6XUKBnsXbORGzVobsLzeYIdfqtgqanGHH1flNJ2893fyu1ZF +T8X77yskEwyoH9I8FjK9Hpnh+FLa7tgaDGiv/fBp984= +-----END CERTIFICATE----- +-----BEGIN PRIVATE KEY----- +MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQCHwMa68ZtaQk+Y +pLzpUo8pUqRaiMcXYsWuQvkmHVGWUxKIWMckVUyAj//EVkOol0fqRTTzL2igHZWr +hn/SiPGKshuIlJ+coGunTdRK0A/a4UkUOKvWyfJUd4OSlnQ/CHBfIuK8n0Zfrc3/ +ihLKLvj3FGjnKB5PDVu+aosNS/Vc9StdjjKvr6Y2ohjCreOorFKQH5w7nivSwwV3 +00Bzsehs+jfqwaVe2lPUPFi/KVN+yLWB6EB79mPHmpW6deIAZHsQLL5twzZ17yi9 +ZP0fWPMJDVRtY2ekuvS9HhP5fBwkJdw08NQEqoHoemERQgEnbxOQQyW7QtgYxNbI +AsKVdEBPAgMBAAECggEAFd45hTLXaOZGsTBUbYI1pUf2ns5AGBB6sf7Vk3dkmwJz +I/tSdRQNOKaPDSnXnf26AXni34vTCaafuMZNVUpnHTBiHBHTq7pHLT0YhhwBzytn +B3a2Q77l+7JW7mhbKIOWVSpRpmXtQwtvTuCx9II1loO3VF6o5z4fzyBARG+TLRqQ +reOyQjmBRM3F9DufF9L7x0Lv6kNKhWYW0sZCuI3gdtz0VqnaTEA0PQ4g+KWP9HK8 +KmEBQznXlbUG85IOG7J6ERz9ujwF5BnOsFqZE0P8GX4e+Z1H0fOWQE+oQrdbutEM +snRs5UaJ4QkfnNepvpEkv2o5IrzOK5LToHOqUTjv2QKBgQC+aha3GQQiRuQdEC6+ +5+LmOh1uG+wplOZEdp6hJs9NjGUECot4gEoT7/maQIo57ak7lTLdSXC6ErSnkPO4 +aekYL91vdefelcFceOMkfvtukOQ9JQBkiGi8xCwB6tDytn5TfER6Hly3K254KVA6 +fh6SLsLoyZXICrR3yaFAbjNZaQKBgQC2guLRK0LTJ4Bjgbv44UdNCnOi+oVRtXi2 +r6FPZHkUzqUGMzosWX1FYLOMrCwa3SvLxzcvPhH1rm7gWJE/wNjKbuFGVIGCkzdQ +CVMk/E7F+XA2vnwn5QkuE8qXbvuDEHaK9dN59b1rC90SzADDiB/bw2cUHSTHIyYC +JVZ6CWWc9wKBgQCkrM80Tlg65KBHWkVzKMwcW8oz/cYCOBnkv8l0iUHjSTXbhtsT +va9TCskM1CA29QjU1LWGlwr8gUznVf7RUBccqdiRmqCK6WyucoXOfFsqRfh9wNBU +IXyjM+zzQ4atQZKC1QfLrRJ1/wOsu938mDIMLpC2DhCRTmDA8Ama1TNncQKBgQCC +mfyW818ZXI36Js8NFKACGDWRbbXTN4nPKLTE7D/czNa4LhY1wD/tUnqJcncJLjV1 +1/O8Ya1WYmFDNv2RYn1/toKL4lLezlvpcRLHR6lS7+EFu596qOG90DnLzYY7Tp+V +Zr3S6y+Fl3K2TbdKNHGfwB9V/FjiC1vacz+Dio/lFwKBgQC5lOSRgaLLXbEZKTYk +kZ78ICR3KoyJyGbDSxn+pipugGmjBMu936ECz7ZZx/1nMvS4FbEIyVosSTXvyxM2 +dB3YZdGA6ttd0ge9Xgtm2kQjnkGcPblwcM5bRHta8XCDm8EwCfRhjQ7fbSue4zmT +791tjJbIY2ToW0Do4UD9D9swew== +-----END PRIVATE KEY----- diff --git a/reg-tests/ssl/certs/ocsp_client_check/index.txt b/reg-tests/ssl/certs/ocsp_client_check/index.txt new file mode 100644 index 000000000..d5ba5f37c --- /dev/null +++ b/reg-tests/ssl/certs/ocsp_client_check/index.txt @@ -0,0 +1,4 @@ +V 21260815140708Z 2331111DB765171A19C2AB0232ACC4B829DEEB6C unknown /C=FR/O=HAProxy Technologies/CN=server.ocsp-client-check.com +V 21260815140708Z 7A4FD516986DD538C7043128033B2FDDE80103B3 unknown /C=FR/O=HAProxy Technologies/CN=good.ocsp-client-check.com +R 21260815140709Z 260908140709Z 5DE95E617745663CEEB4ECCB22EE3BFAF53816FF unknown /C=FR/O=HAProxy Technologies/CN=revoked.ocsp-client-check.com +V 21260815140709Z 02B0570179EA3553C58D4DC28275AA85E71A5596 unknown /C=FR/O=HAProxy Technologies/CN=no-ocsp.ocsp-client-check.com diff --git a/reg-tests/ssl/certs/ocsp_client_check/server.pem b/reg-tests/ssl/certs/ocsp_client_check/server.pem new file mode 100644 index 000000000..ae7108a50 --- /dev/null +++ b/reg-tests/ssl/certs/ocsp_client_check/server.pem @@ -0,0 +1,50 @@ +-----BEGIN CERTIFICATE----- +MIIDpTCCAo2gAwIBAgIUIzERHbdlFxoZwqsCMqzEuCne62wwDQYJKoZIhvcNAQEL +BQAwUDELMAkGA1UEBhMCRlIxHTAbBgNVBAoMFEhBUHJveHkgVGVjaG5vbG9naWVz +MSIwIAYDVQQDDBlPQ1NQIENsaWVudCBDaGVjayBSb290IENBMCAXDTI2MDkwODE0 +MDcwOFoYDzIxMjYwODE1MTQwNzA4WjBTMQswCQYDVQQGEwJGUjEdMBsGA1UECgwU +SEFQcm94eSBUZWNobm9sb2dpZXMxJTAjBgNVBAMMHHNlcnZlci5vY3NwLWNsaWVu +dC1jaGVjay5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCRcLwu +SEq7sBYxoyKfkSOWLHDYMdDw/BpWrV7ZhCwzh0odMrV+vI3Ryv8ZY9nHtalCLag4 +K9idHZLzfjfmpiTscQ6h9cWiXb9zKL42fDM3Ji8cDhyPdxFOQxj7IdzbXjXNYot3 +A628ROl/5fLwceh/bdIk2oOghmrR99Zw4qgV5OfXBX47BThb52ptbxuA9Oh6MRvY +BOR46feUGZRphm/JeMDTCK9V/ywWUwTfRDyQsPKKBIUnEBBf83Y4yT5ZuTD/fEEt +G/A5qkSvpqoKQRcwICdR2shCRwT9BV7f9QvJle50uCJhbrXi03NNVCa+cpUbgS/q +vU0tn4WagVniSUcFAgMBAAGjcjBwMAkGA1UdEwQCMAAwDgYDVR0PAQH/BAQDAgWg +MBMGA1UdJQQMMAoGCCsGAQUFBwMBMB0GA1UdDgQWBBQb6LHXb15NwAdAiN/QSRV0 +EDDMSzAfBgNVHSMEGDAWgBQuqMVksIQvcZlvGoOxpDfUD4+U+zANBgkqhkiG9w0B +AQsFAAOCAQEAEtKui0PWP6alLPEjogC6WZFzQqeKXNn98J/rdMOB50aDmELRi/yW +el4BAX74lMoQlTXDprQ/UEOnEQfAQQXoFUNauBLQ4vmKOyV5lyoczmL71Uyb49sv +hdHUle5ymeBU66mq1ElaOKZg43q9+ymp4dJlImW7IgQ8K9JG9g+8nxsnqdQJAPZ9 +Qd8O7yXQiA3N+dH7PjENvSLQxPWXZ0S6XNDMDUxKCPRBv7uoj8tU2imhuJI5pF6Q +5ueeFNfNEPuyjcV+0ifB6k8EQeqwlUSdEpE/Hwf4sGTBwJKdp2TI37xVgGX0MdWq +0+5YftpcD0MadVodNDoQruVBAQET5D2N+Q== +-----END CERTIFICATE----- +-----BEGIN PRIVATE KEY----- +MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCRcLwuSEq7sBYx +oyKfkSOWLHDYMdDw/BpWrV7ZhCwzh0odMrV+vI3Ryv8ZY9nHtalCLag4K9idHZLz +fjfmpiTscQ6h9cWiXb9zKL42fDM3Ji8cDhyPdxFOQxj7IdzbXjXNYot3A628ROl/ +5fLwceh/bdIk2oOghmrR99Zw4qgV5OfXBX47BThb52ptbxuA9Oh6MRvYBOR46feU +GZRphm/JeMDTCK9V/ywWUwTfRDyQsPKKBIUnEBBf83Y4yT5ZuTD/fEEtG/A5qkSv +pqoKQRcwICdR2shCRwT9BV7f9QvJle50uCJhbrXi03NNVCa+cpUbgS/qvU0tn4Wa +gVniSUcFAgMBAAECggEAB+8pwO+eLheI2mvfJWvWUGi7vjuXfbIPIMfj+wNQIv6A +L1AXISMZrIaBvKmbFZ9GLM9PVEMmFcopfGGYHJvXO1Pem7zL65PoMBjaqZ/Ebn+F +hecKLVRuTAHykK6z/P6qejokSBmaBoGO6HSLuIzKRXthAbQvBpiWpr45w15GE62c +Wdp8Q5K2ZvqP8koHYWoLkwVEte7c8x4j7SNjJ526+5wHs1g2AUInEo8q8LzZBq72 +sJm5tYq7zqrbM2Xyyl09LhTkWG26UQ+MhqMnI0NyoRQ7c272nzJ2myHo+ugaMbUv +eX5rzi5m8XqkxjDcg2ifSlMw0tpUVaO70r7dLg/2CQKBgQDKEmwlYTmc7qSZIYUF +2CkwBozflSN5PAbJKtIEwMiEZZSxRWQAtLgDaqTSCqT9JOAMmCa40kwBeTv1Ozhn +vjTeVIQOjD5g6s1/bLr2KjLfYcNfHDPBh4SqYhQ2IQhNiSMjNb3gss3nklQqCyb7 ++HK5nXo6ZHYo+UHQrqlCQNi77QKBgQC4QTyF1NanWlw5Zo14rEqxKU+DFJoAv0C6 +W6cF9zEM9ztXSnxTlqbHhoTdk1pUGCqE2JQdMCB9tu2AlBVTrRx+rlRpBiSpjEWc +Dufse9KUfqjuHJjvMkJXVyZ+4UCw4CHwzpqAXRMu86OpE1+47DCtOO5oCHpJ41eI +mapzUvPEeQKBgFMKRw8FaVuoZlPXhobkUei+iF3JOA62MEOzKSNy5fQimnxO+82e +dpBQ3vLCFRNCeCA01pTVNw7T92PLtl5LuAY1zR79WxUQ6OoYkKxgow9RaaxINqyt +OEOckpm78WGLnbj2eNVCJYOoipXMh3S8oMjOglBEwJoN9JIBdOUZKPfxAoGBAJwz +AaHa6xX4blJi8++m77L8eGGBJ4UWnULey9ss0TJSrMW1aWxbPIvNJ/nHHz5HNlRk +XjvYPtMULodgAixrhsqF8x0NjisFtUU1BbvexIgKUB97stKkYsU0JnhNcNABUgSY +wTWsscSN2uJMgEt+P026A7HB7hmRVvWAf5VAb1LRAoGBAJsjC917+VEiB/YlcBPI +7n5+owAckWooxHkiPne89t+TEGY/l35IYo/FZx/bgGcu6jNAcntbepCRO8xSFTrG +k0uogFAP6uGm/tlCFqzfXAPC3O/Q1lJuItx9wOKrGB286VNhnuUgFyRHq9JBHtlI +UDm7FVw2+PTkkQbuddi0hMxQ +-----END PRIVATE KEY----- diff --git a/reg-tests/ssl/ocsp_client_check.vtc b/reg-tests/ssl/ocsp_client_check.vtc new file mode 100644 index 000000000..94a22db8e --- /dev/null +++ b/reg-tests/ssl/ocsp_client_check.vtc @@ -0,0 +1,30 @@ +#REGTEST_TYPE=slow + +# This reg-test focuses on the 'do-ocsp-request' action which performs an OCSP +# check on the certificate presented by the client during the TLS handshake. +# +# The PKI used by this test is built by +# reg-tests/ssl/certs/ocsp_client_check/gen_certs.sh. It contains a root CA +# that has a SubjectKeyIdentifier extension, which is required for it to be +# usable through the 'issuers-chain-path' option (the issuer of the client +# certificate is looked up in the issuer tree via its AuthorityKeyIdentifier). +# Three client certificates are signed by this CA, two of them having an +# Authority Information Access extension that points to the OCSP responder +# started by this test (on the hardcoded 127.0.0.1:12346 address), the third +# one having no OCSP URI at all. +# +# The OCSP responder is an 'openssl ocsp' instance that relies on the +# certificate database in ocsp_client_check/index.txt, in which the +# "revoked.ocsp-client-check.com" certificate is revoked. +# +# If this test does not work anymore: +# - Check that you have openssl +# - Check that the 12346 port is free + +varnishtest "Test the 'do-ocsp-request' action" +feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(3.5-dev0)'" +feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && !ssllib_name_startswith(BoringSSL) && !ssllib_name_startswith(LibreSSL) && openssl_version_atleast(1.1.1)'" +feature cmd "command -v openssl" + +setenv VTC_SOCK_TYPE stream +include ${testdir}/ocsp_client_check.vtci diff --git a/reg-tests/ssl/ocsp_client_check.vtci b/reg-tests/ssl/ocsp_client_check.vtci new file mode 100644 index 000000000..737dccff4 --- /dev/null +++ b/reg-tests/ssl/ocsp_client_check.vtci @@ -0,0 +1,153 @@ +feature ignore_unknown_macro + +# The OCSP responder has to serve 3 requests: +# - one for the "good" client certificate through the http frontend +# - one for the "revoked" client certificate through the http frontend +# - one for the "good" client certificate through the tcp-request frontend +# The clients that have no OCSP URI in their certificate (or no certificate at +# all) do not generate any OCSP request. +process p1 "openssl ocsp -index ${testdir}/certs/ocsp_client_check/index.txt -rsigner ${testdir}/certs/ocsp_client_check/ca/ocsp_client_check_ca.crt -rkey ${testdir}/certs/ocsp_client_check/ca.key -CA ${testdir}/certs/ocsp_client_check/ca/ocsp_client_check_ca.crt -nrequest 3 -ndays 1 -port 12346 -timeout 5" -start + +haproxy h1 -conf { + global + .if feature(THREAD) + thread-groups 1 + .endif + + stats socket "${tmpdir}/h1/stats" level admin + # The issuer of the client certificates must be known in order to be + # able to build the OCSP request and to check the OCSP response's + # signature. + issuers-chain-path "${testdir}/certs/ocsp_client_check/ca/" + crt-base "${testdir}/certs/ocsp_client_check" + + defaults + mode http + option httplog + log stderr local0 debug err + timeout connect "${HAPROXY_TEST_TIMEOUT-5s}" + timeout client "${HAPROXY_TEST_TIMEOUT-5s}" + timeout server "${HAPROXY_TEST_TIMEOUT-5s}" + # The 'do-ocsp-request' action uses the http-request timeout as a limit + # for the whole OCSP request/response process. + timeout http-request "${HAPROXY_TEST_TIMEOUT-5s}" + + # Clear listeners used to build TLS connections that present the various + # client certificates to the SSL frontends. + listen clear-good-lst + bind "fd@${clear_good}" + server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none crt client_good.pem + + listen clear-revoked-lst + bind "fd@${clear_revoked}" + server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none crt client_revoked.pem + + listen clear-noocsp-lst + bind "fd@${clear_noocsp}" + server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none crt client_no_ocsp.pem + + listen clear-nocert-lst + bind "fd@${clear_nocert}" + server s1 "${VTC_SOCK_TYPE}+${h1_ssl_sock}" ssl verify none + + listen clear-good-tcp-lst + bind "fd@${clear_good_tcp}" + server s1 "${VTC_SOCK_TYPE}+${h1_ssl_tcp_sock}" ssl verify none crt client_good.pem + + # The action never denies the request by itself, the OCSP status and error + # reason are only exposed through variables. It is up to the configuration + # to decide what to do with them. + frontend ssl-fe + bind "${VTC_SOCK_TYPE}+fd@${ssl}" ssl crt server.pem ca-file "${testdir}/certs/ocsp_client_check/ca/ocsp_client_check_ca.crt" verify optional + + http-request do-ocsp-request status-var txn.ocsp_status reason-var txn.ocsp_reason + http-request return status 200 + + # "http-after-response" is used instead of "http-request return" + # header directives because the latter does not emit headers that + # have an empty value, while the converted OCSP reason is expected + # to be an empty string when the error code is 0. + http-after-response set-header x-ocsp-status "%[var(txn.ocsp_status)]" + http-after-response set-header x-ocsp-error "%[var(txn.ocsp_reason)]" + http-after-response set-header x-ocsp-reason "%[var(txn.ocsp_reason),ocsp_check_err_str]" + + # Same check, performed by a "tcp-request content" rule instead. + frontend ssl-tcp-fe + bind "${VTC_SOCK_TYPE}+fd@${ssl_tcp}" ssl crt server.pem ca-file "${testdir}/certs/ocsp_client_check/ca/ocsp_client_check_ca.crt" verify optional + + tcp-request inspect-delay 5s + tcp-request content do-ocsp-request status-var txn.ocsp_status reason-var txn.ocsp_reason + + http-request return status 200 + + # "http-after-response" is used instead of "http-request return" + # header directives because the latter does not emit headers that + # have an empty value, while the converted OCSP reason is expected + # to be an empty string when the error code is 0. + http-after-response set-header x-ocsp-status "%[var(txn.ocsp_status)]" + http-after-response set-header x-ocsp-error "%[var(txn.ocsp_reason)]" + http-after-response set-header x-ocsp-reason "%[var(txn.ocsp_reason),ocsp_check_err_str]" +} -start + + +# Valid client certificate, the OCSP responder answers "good". +client c1 -connect ${h1_clear_good_sock} { + txreq + rxresp + expect resp.status == 200 + expect resp.http.x-ocsp-status == "good" + expect resp.http.x-ocsp-error == "0" +} -run + +# Revoked client certificate. The action does not reject the request, the +# status is only reported in the variable. +client c1 -connect ${h1_clear_revoked_sock} { + txreq + rxresp + expect resp.status == 200 + expect resp.http.x-ocsp-status == "revoked" +} -run + +# The client certificate has no OCSP URI, no check can be performed. +client c1 -connect ${h1_clear_noocsp_sock} { + txreq + rxresp + expect resp.status == 200 + expect resp.http.x-ocsp-status == "inapplicable" + expect resp.http.x-ocsp-error == "0" +} -run + +# No client certificate at all, no check can be performed either. +client c1 -connect ${h1_clear_nocert_sock} { + txreq + rxresp + expect resp.status == 200 + expect resp.http.x-ocsp-status == "inapplicable" + expect resp.http.x-ocsp-error == "0" +} -run + +# Same check performed through a "tcp-request content" rule. +client c1 -connect ${h1_clear_good_tcp_sock} { + txreq + rxresp + expect resp.status == 200 + expect resp.http.x-ocsp-status == "good" + expect resp.http.x-ocsp-error == "0" +} -run + +# The responder should have answered all the expected requests by now. +process p1 -wait -expect-exit 0 + +# The OCSP responder is not running anymore, the check cannot be performed. The +# request is still not denied but the status is not "good", the error code is +# non-zero and the converted reason is filled. +client c1 -connect ${h1_clear_good_sock} { + txreq + rxresp + expect resp.status == 200 + expect resp.http.x-ocsp-status == "unknown" + expect resp.http.x-ocsp-error ~ "^[1-9][0-9]*$" + expect resp.http.x-ocsp-reason != "" +} -run + +haproxy h1 -wait