Skip to content

Commit 5e750a8

Browse files
alcaeusalcaeus
committed
PHPC-1533: Add first OCSP test
1 parent 569b352 commit 5e750a8

10 files changed

+680
-0
lines changed

‎.evergreen/config.yml

Lines changed: 405 additions & 0 deletions
Large diffs are not rendered by default.

‎.evergreen/run-ocsp-responder.sh

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
#! /bin/bash
2+
# Run an OCSP mock responder server if necessary.
3+
#
4+
# See the tests described in the specification for more info:
5+
# https://github.com/mongodb/specifications/tree/master/source/ocsp-support/tests#integration-tests-permutations-to-be-tested.
6+
# Precondition: mongod is NOT running. The responder should be started first.
7+
#
8+
# Environment variables:
9+
#
10+
# TEST_COLUMN
11+
# Required. Corresponds to a column of the test matrix. Set to one of the following:
12+
# TEST_1, TEST_2, TEST_3, TEST_4, SOFT_FAIL_TEST, MALICIOUS_SERVER_TEST_1, MALICIOUS_SERVER_TEST_2
13+
# CERT_TYPE
14+
# Required. Set to either rsa or ecdsa.
15+
# USE_DELEGATE
16+
# Optional. May be ON or OFF. If a test requires use of a responder, this decides whether
17+
# the responder uses a delegate certificate. Defaults to "OFF"
18+
# SKIP_PIP_INSTALL
19+
# Optional. Skip pip install for required packages for mock responder.
20+
#
21+
# Example:
22+
# TEST_COLUMN=TEST_1 CERT_TYPE=rsa ./run-ocsp-test.sh
23+
#
24+
25+
# Fail on any command returning a non-zero exit status.
26+
set -o errexit
27+
set -o xtrace
28+
29+
USE_DELEGATE=${USE_DELEGATE:-OFF}
30+
31+
if [ -z "$TEST_COLUMN" -o -z "$CERT_TYPE" ]; then
32+
echo "Required environment variable unset. See file comments for help."
33+
exit 1;
34+
fi
35+
echo "TEST_COLUMN=$TEST_COLUMN"
36+
echo "CERT_TYPE=$CERT_TYPE"
37+
echo "USE_DELEGATE=$USE_DELEGATE"
38+
echo "SKIP_PIP_INSTALL=$SKIP_PIP_INSTALL"
39+
40+
OS=$(uname -s | tr '[:upper:]' '[:lower:]')
41+
case "$OS" in
42+
cygwin*) OS="WINDOWS" ;;
43+
darwin) OS="MACOS" ;;
44+
*) OS="LINUX" ;;
45+
esac
46+
47+
if [ "TEST_1" = "$TEST_COLUMN" ]; then
48+
RESPONDER_REQUIRED="valid"
49+
elif [ "TEST_2" = "$TEST_COLUMN" ]; then
50+
RESPONDER_REQUIRED="invalid"
51+
elif [ "TEST_3" = "$TEST_COLUMN" ]; then
52+
RESPONDER_REQUIRED="valid"
53+
elif [ "TEST_4" = "$TEST_COLUMN" ]; then
54+
RESPONDER_REQUIRED="invalid"
55+
elif [ "MALICIOUS_SERVER_TEST_1" = "$TEST_COLUMN" ]; then
56+
RESPONDER_REQUIRED="invalid"
57+
else
58+
RESPONDER_REQUIRED=""
59+
fi
60+
61+
# Same responder is used for both server and client. So even stapling tests require a responder.
62+
63+
if [ -n "$RESPONDER_REQUIRED" ]; then
64+
echo "Starting mock responder"
65+
if [ -z "$SKIP_PIP_INSTALL" ]; then
66+
echo "Installing python dependencies"
67+
# Installing dependencies.
68+
if [ "$OS" = "WINDOWS" ]; then
69+
/cygdrive/c/python/Python36/python --version
70+
/cygdrive/c/python/Python36/python -m virtualenv venv_ocsp
71+
PYTHON="$(pwd)/venv_ocsp/Scripts/python"
72+
else
73+
/opt/mongodbtoolchain/v3/bin/python3 -m venv ./venv_ocsp
74+
PYTHON="$(pwd)/venv_ocsp/bin/python"
75+
fi
76+
77+
REQUIREMENTS="requirements.txt"
78+
if [ ! -f "$REQUIREMENTS" ]; then
79+
curl https://raw.githubusercontent.com/mongodb-labs/drivers-evergreen-tools/master/.evergreen/ocsp/mock-ocsp-responder-requirements.txt -o $REQUIREMENTS
80+
fi
81+
$PYTHON -m pip install -r $REQUIREMENTS
82+
fi
83+
cd "${DRIVERS_TOOLS}/.evergreen/ocsp/$CERT_TYPE"
84+
if [ "$RESPONDER_REQUIRED" = "invalid" ]; then
85+
FAULT="--fault revoked"
86+
fi
87+
if [ "ON" = "$USE_DELEGATE" ]; then
88+
RESPONDER_SIGNER="ocsp-responder"
89+
else
90+
RESPONDER_SIGNER="ca"
91+
fi
92+
$PYTHON ../ocsp_mock.py \
93+
--ca_file ca.pem \
94+
--ocsp_responder_cert $RESPONDER_SIGNER.crt \
95+
--ocsp_responder_key $RESPONDER_SIGNER.key \
96+
-p 8100 -v $FAULT \
97+
> ${PROJECT_DIRECTORY}/responder.log 2>&1 &
98+
cd -
99+
fi

‎scripts/presets/travis/standalone/ecdsa-basic-tls-ocsp-disableStapling.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"id" : "standalonenoauthssl",
3+
"name": "mongod",
4+
"procParams": {
5+
"ipv6": true,
6+
"bind_ip": "127.0.0.1,::1",
7+
"logappend": true,
8+
"journal": true,
9+
"port": 27017,
10+
"setParameter": {"failpoint.disableStapling":"{\"mode\":\"alwaysOn\"}}"}
11+
},
12+
"sslParams": {
13+
"sslOnNormalPorts": true,
14+
"sslPEMKeyFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/ecdsa/server.pem",
15+
"sslCAFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/ecdsa/ca.pem",
16+
"sslWeakCertificateValidation" : true,
17+
"sslAllowInvalidCertificates": true
18+
}
19+
}

‎scripts/presets/travis/standalone/ecdsa-basic-tls-ocsp-mustStaple-disableStapling.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"id" : "standalonenoauthssl",
3+
"name": "mongod",
4+
"procParams": {
5+
"ipv6": true,
6+
"bind_ip": "127.0.0.1,::1",
7+
"logappend": true,
8+
"journal": true,
9+
"port": 27017,
10+
"setParameter": {"failpoint.disableStapling":"{\"mode\":\"alwaysOn\"}}"}
11+
},
12+
"sslParams": {
13+
"sslOnNormalPorts": true,
14+
"sslPEMKeyFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/ecdsa/server-mustStaple.pem",
15+
"sslCAFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/ecdsa/ca.pem",
16+
"sslWeakCertificateValidation" : true,
17+
"sslAllowInvalidCertificates": true
18+
}
19+
}

‎scripts/presets/travis/standalone/ecdsa-basic-tls-ocsp-mustStaple.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"id" : "standalonenoauthssl",
3+
"name": "mongod",
4+
"procParams": {
5+
"ipv6": true,
6+
"bind_ip": "127.0.0.1,::1",
7+
"logappend": true,
8+
"journal": true,
9+
"port": 27017,
10+
"setParameter": {"ocspEnabled": true}
11+
},
12+
"sslParams": {
13+
"sslOnNormalPorts": true,
14+
"sslPEMKeyFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/ecdsa/server-mustStaple.pem",
15+
"sslCAFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/ecdsa/ca.pem",
16+
"sslWeakCertificateValidation" : true,
17+
"sslAllowInvalidCertificates": true
18+
}
19+
}

‎scripts/presets/travis/standalone/rsa-basic-tls-ocsp-disableStapling.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"id" : "standalonenoauthssl",
3+
"name": "mongod",
4+
"procParams": {
5+
"ipv6": true,
6+
"bind_ip": "127.0.0.1,::1",
7+
"logappend": true,
8+
"journal": true,
9+
"port": 27017,
10+
"setParameter": {"failpoint.disableStapling":"{\"mode\":\"alwaysOn\"}}"}
11+
},
12+
"sslParams": {
13+
"sslOnNormalPorts": true,
14+
"sslPEMKeyFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/rsa/server.pem",
15+
"sslCAFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/rsa/ca.pem",
16+
"sslWeakCertificateValidation" : true,
17+
"sslAllowInvalidCertificates": true
18+
}
19+
}

‎scripts/presets/travis/standalone/rsa-basic-tls-ocsp-mustStaple-disableStapling.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"id" : "standalonenoauthssl",
3+
"name": "mongod",
4+
"procParams": {
5+
"ipv6": true,
6+
"bind_ip": "127.0.0.1,::1",
7+
"logappend": true,
8+
"journal": true,
9+
"port": 27017,
10+
"setParameter": {"failpoint.disableStapling":"{\"mode\":\"alwaysOn\"}}"}
11+
},
12+
"sslParams": {
13+
"sslOnNormalPorts": true,
14+
"sslPEMKeyFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/rsa/server-mustStaple.pem",
15+
"sslCAFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/rsa/ca.pem",
16+
"sslWeakCertificateValidation" : true,
17+
"sslAllowInvalidCertificates": true
18+
}
19+
}

‎scripts/presets/travis/standalone/rsa-basic-tls-ocsp-mustStaple.json

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"id" : "standalonenoauthssl",
3+
"name": "mongod",
4+
"procParams": {
5+
"ipv6": true,
6+
"bind_ip": "127.0.0.1,::1",
7+
"logappend": true,
8+
"journal": true,
9+
"port": 27017,
10+
"setParameter": {"ocspEnabled": true}
11+
},
12+
"sslParams": {
13+
"sslOnNormalPorts": true,
14+
"sslPEMKeyFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/rsa/server-mustStaple.pem",
15+
"sslCAFile": "ABSOLUTE_PATH_REPLACEMENT_TOKEN/.evergreen/ocsp/rsa/ca.pem",
16+
"sslWeakCertificateValidation" : true,
17+
"sslAllowInvalidCertificates": true
18+
}
19+
}

‎tests/ocsp-failure.phpt

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
--TEST--
2+
Connection with OCSP checks fails
3+
--SKIPIF--
4+
<?php
5+
if ($_ENV['TESTS'] !== 'tests/ocsp-failure.phpt') { echo "skip OCSP tests not wanted\n"; }
6+
?>
7+
--FILE--
8+
<?php
9+
require_once __DIR__ . "/utils/basic.inc";
10+
11+
$ping = new \MongoDB\Driver\Command(['ping' => 1]);
12+
13+
// Expect command to fail with the provided options
14+
$m = new \MongoDB\Driver\Manager(URI);
15+
echo throws (function () use ($m, $ping) {
16+
$m->executeCommand('admin', $ping);
17+
}, "MongoDB\Driver\Exception\ConnectionTimeoutException"), "\n";
18+
19+
// Always expect command to pass when using insecure option
20+
$m = new \MongoDB\Driver\Manager(URI, ['tlsInsecure' => true]);
21+
$m->executeCommand('admin', $ping);
22+
23+
// Always expect command to pass when allowing invalid certificates
24+
$m = new \MongoDB\Driver\Manager(URI, ['tlsAllowInvalidCertificates' => true]);
25+
$m->executeCommand('admin', $ping);
26+
27+
?>
28+
===DONE===
29+
<?php exit(0); ?>
30+
--EXPECTF--
31+
OK: Got MongoDB\Driver\Exception\ConnectionTimeoutException
32+
No suitable servers found (`serverSelectionTryOnce` set): [%s calling ismaster on '%s:%d']
33+
===DONE===

‎tests/ocsp-success.phpt

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
--TEST--
2+
Connection with OCSP checks successful
3+
--SKIPIF--
4+
<?php
5+
if ($_ENV['TESTS'] !== 'tests/ocsp-success.phpt') { echo "skip OCSP tests not wanted\n"; }
6+
?>
7+
--FILE--
8+
<?php
9+
require_once __DIR__ . "/utils/basic.inc";
10+
11+
$ping = new \MongoDB\Driver\Command(['ping' => 1]);
12+
13+
// Expect command to pass with the provided options
14+
$m = new \MongoDB\Driver\Manager(URI);
15+
$m->executeCommand('admin', $ping);
16+
17+
// Always expect command to pass when using insecure option
18+
$m = new \MongoDB\Driver\Manager(URI, ['tlsInsecure' => true]);
19+
$m->executeCommand('admin', $ping);
20+
21+
// Always expect command to pass when allowing invalid certificates
22+
$m = new \MongoDB\Driver\Manager(URI, ['tlsAllowInvalidCertificates' => true]);
23+
$m->executeCommand('admin', $ping);
24+
25+
?>
26+
===DONE===
27+
<?php exit(0); ?>
28+
--EXPECT--
29+
===DONE===

0 commit comments

Comments
 (0)