Skip to content

Commit 96e5426

Browse files
mbroadstmbroadst
committed
test: add integration tests for OCSP support
NODE-2427
1 parent 69d10ba commit 96e5426

File tree

5 files changed

+431
-24
lines changed

5 files changed

+431
-24
lines changed

‎.evergreen/config.yml

Lines changed: 166 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,7 @@ functions:
6666
# If this was a patch build, doing a fresh clone would not actually test the patch
6767
cp -R ${PROJECT_DIRECTORY}/ $DRIVERS_TOOLS
6868
else
69-
# git clone git://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS
70-
git clone git://github.com/bazile-clyde/drivers-evergreen-tools.git $DRIVERS_TOOLS
69+
git clone git://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS
7170
fi
7271
7372
echo "{ \"releases\": { \"default\": \"$MONGODB_BINARIES\" }}" >
@@ -323,6 +322,54 @@ functions:
323322
324323
cat setup.js
325324
mongo --nodb setup.js aws_e2e_ecs.js
325+
run-ocsp-test:
326+
- command: shell.exec
327+
type: test
328+
params:
329+
working_dir: src
330+
script: |
331+
${PREPARE_SHELL}
332+
333+
UNIFIED=${UNIFIED} \
334+
CA_FILE="$DRIVERS_TOOLS/.evergreen/ocsp/rsa/ca.pem" \
335+
OCSP_TLS_SHOULD_SUCCEED="${OCSP_TLS_SHOULD_SUCCEED}" \
336+
sh ${PROJECT_DIRECTORY}/.evergreen/run-ocsp-tests.sh
337+
run-valid-ocsp-server:
338+
- command: shell.exec
339+
params:
340+
script: |
341+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
342+
/opt/mongodbtoolchain/v3/bin/python3 -m venv ./venv
343+
./venv/bin/pip3 install asn1crypto oscrypto bottle
344+
- command: shell.exec
345+
params:
346+
background: true
347+
script: |
348+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
349+
nohup ./venv/bin/python3 ocsp_mock.py \
350+
--ca_file rsa/ca.pem \
351+
--ocsp_responder_cert rsa/ca.crt \
352+
--ocsp_responder_key rsa/ca.key \
353+
-p 8100 -v
354+
run-revoked-ocsp-server:
355+
- command: shell.exec
356+
params:
357+
script: |
358+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
359+
/opt/mongodbtoolchain/v3/bin/python3 -m venv ./venv
360+
./venv/bin/pip3 install asn1crypto oscrypto bottle
361+
- command: shell.exec
362+
params:
363+
background: true
364+
script: |
365+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
366+
nohup ./venv/bin/python3 ocsp_mock.py \
367+
--ca_file rsa/ca.pem \
368+
--ocsp_responder_cert rsa/ca.crt \
369+
--ocsp_responder_key rsa/ca.key \
370+
-p 8100 \
371+
-v \
372+
--fault revoked
326373
pre:
327374
- func: fetch source
328375
- func: prepare resources
@@ -915,6 +962,102 @@ tasks:
915962
- func: run atlas tests
916963
vars:
917964
VERSION: latest
965+
- name: test-ocsp-valid-cert-server-staples
966+
tags:
967+
- ocsp
968+
commands:
969+
- func: run-valid-ocsp-server
970+
- func: install dependencies
971+
- func: bootstrap mongo-orchestration
972+
vars:
973+
ORCHESTRATION_FILE: rsa-basic-tls-ocsp-mustStaple.json
974+
VERSION: latest
975+
TOPOLOGY: server
976+
- func: run-ocsp-test
977+
vars:
978+
OCSP_TLS_SHOULD_SUCCEED: 1
979+
- name: test-ocsp-invalid-cert-server-staples
980+
tags:
981+
- ocsp
982+
commands:
983+
- func: run-revoked-ocsp-server
984+
- func: install dependencies
985+
- func: bootstrap mongo-orchestration
986+
vars:
987+
ORCHESTRATION_FILE: rsa-basic-tls-ocsp-mustStaple.json
988+
VERSION: latest
989+
TOPOLOGY: server
990+
- func: run-ocsp-test
991+
vars:
992+
OCSP_TLS_SHOULD_SUCCEED: 0
993+
- name: test-ocsp-valid-cert-server-does-not-staple
994+
tags:
995+
- ocsp
996+
commands:
997+
- func: run-valid-ocsp-server
998+
- func: install dependencies
999+
- func: bootstrap mongo-orchestration
1000+
vars:
1001+
ORCHESTRATION_FILE: rsa-basic-tls-ocsp-disableStapling.json
1002+
VERSION: latest
1003+
TOPOLOGY: server
1004+
- func: run-ocsp-test
1005+
vars:
1006+
OCSP_TLS_SHOULD_SUCCEED: 1
1007+
- name: test-ocsp-invalid-cert-server-does-not-staple
1008+
tags:
1009+
- ocsp
1010+
commands:
1011+
- func: run-revoked-ocsp-server
1012+
- func: install dependencies
1013+
- func: bootstrap mongo-orchestration
1014+
vars:
1015+
ORCHESTRATION_FILE: rsa-basic-tls-ocsp-disableStapling.json
1016+
VERSION: latest
1017+
TOPOLOGY: server
1018+
- func: run-ocsp-test
1019+
vars:
1020+
OCSP_TLS_SHOULD_SUCCEED: 0
1021+
- name: test-ocsp-soft-fail
1022+
tags:
1023+
- ocsp
1024+
commands:
1025+
- func: install dependencies
1026+
- func: bootstrap mongo-orchestration
1027+
vars:
1028+
ORCHESTRATION_FILE: rsa-basic-tls-ocsp-disableStapling.json
1029+
VERSION: latest
1030+
TOPOLOGY: server
1031+
- func: run-ocsp-test
1032+
vars:
1033+
OCSP_TLS_SHOULD_SUCCEED: 1
1034+
- name: test-ocsp-malicious-invalid-cert-mustStaple-server-does-not-staple
1035+
tags:
1036+
- ocsp
1037+
commands:
1038+
- func: run-revoked-ocsp-server
1039+
- func: install dependencies
1040+
- func: bootstrap mongo-orchestration
1041+
vars:
1042+
ORCHESTRATION_FILE: rsa-basic-tls-ocsp-mustStaple-disableStapling.json
1043+
VERSION: latest
1044+
TOPOLOGY: server
1045+
- func: run-ocsp-test
1046+
vars:
1047+
OCSP_TLS_SHOULD_SUCCEED: 0
1048+
- name: test-ocsp-malicious-no-responder-mustStaple-server-does-not-staple
1049+
tags:
1050+
- ocsp
1051+
commands:
1052+
- func: install dependencies
1053+
- func: bootstrap mongo-orchestration
1054+
vars:
1055+
ORCHESTRATION_FILE: rsa-basic-tls-ocsp-mustStaple-disableStapling.json
1056+
VERSION: latest
1057+
TOPOLOGY: server
1058+
- func: run-ocsp-test
1059+
vars:
1060+
OCSP_TLS_SHOULD_SUCCEED: 0
9181061
- name: aws-auth-test
9191062
commands:
9201063
- func: install dependencies
@@ -1082,6 +1225,13 @@ buildvariants:
10821225
- test-2.6-replica_set-unified
10831226
- test-2.6-sharded_cluster-unified
10841227
- test-atlas-connectivity
1228+
- test-ocsp-valid-cert-server-staples
1229+
- test-ocsp-invalid-cert-server-staples
1230+
- test-ocsp-valid-cert-server-does-not-staple
1231+
- test-ocsp-invalid-cert-server-does-not-staple
1232+
- test-ocsp-soft-fail
1233+
- test-ocsp-malicious-invalid-cert-mustStaple-server-does-not-staple
1234+
- test-ocsp-malicious-no-responder-mustStaple-server-does-not-staple
10851235
- name: macos-1014-carbon
10861236
display_name: macOS 10.14 Node Carbon
10871237
run_on: macos-1014
@@ -1167,6 +1317,13 @@ buildvariants:
11671317
- test-3.2-replica_set-unified
11681318
- test-3.2-sharded_cluster-unified
11691319
- test-atlas-connectivity
1320+
- test-ocsp-valid-cert-server-staples
1321+
- test-ocsp-invalid-cert-server-staples
1322+
- test-ocsp-valid-cert-server-does-not-staple
1323+
- test-ocsp-invalid-cert-server-does-not-staple
1324+
- test-ocsp-soft-fail
1325+
- test-ocsp-malicious-invalid-cert-mustStaple-server-does-not-staple
1326+
- test-ocsp-malicious-no-responder-mustStaple-server-does-not-staple
11701327
- name: rhel71-power8-test-carbon
11711328
display_name: RHEL 7.1 (POWER8) Node Carbon
11721329
run_on: rhel71-power8-test
@@ -1357,6 +1514,13 @@ buildvariants:
13571514
- test-4.2-replica_set-unified
13581515
- test-4.2-sharded_cluster-unified
13591516
- test-atlas-connectivity
1517+
- test-ocsp-valid-cert-server-staples
1518+
- test-ocsp-invalid-cert-server-staples
1519+
- test-ocsp-valid-cert-server-does-not-staple
1520+
- test-ocsp-invalid-cert-server-does-not-staple
1521+
- test-ocsp-soft-fail
1522+
- test-ocsp-malicious-invalid-cert-mustStaple-server-does-not-staple
1523+
- test-ocsp-malicious-no-responder-mustStaple-server-does-not-staple
13601524
- name: ubuntu1804-arm64-test-carbon
13611525
display_name: Ubuntu 18.04 (ARM64) Node Carbon
13621526
run_on: ubuntu1804-arm64-test

‎.evergreen/config.yml.in

Lines changed: 53 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,7 @@ functions:
8585
# If this was a patch build, doing a fresh clone would not actually test the patch
8686
cp -R ${PROJECT_DIRECTORY}/ $DRIVERS_TOOLS
8787
else
88-
# git clone git://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS
89-
git clone git://github.com/bazile-clyde/drivers-evergreen-tools.git $DRIVERS_TOOLS
88+
git clone git://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS
9089
fi
9190
echo "{ \"releases\": { \"default\": \"$MONGODB_BINARIES\" }}" > $MONGO_ORCHESTRATION_HOME/orchestration.config
9291

@@ -360,6 +359,58 @@ functions:
360359
cat setup.js
361360
mongo --nodb setup.js aws_e2e_ecs.js
362361

362+
run-ocsp-test:
363+
- command: shell.exec
364+
type: test
365+
params:
366+
working_dir: "src"
367+
script: |
368+
${PREPARE_SHELL}
369+
370+
UNIFIED=${UNIFIED} \
371+
CA_FILE="$DRIVERS_TOOLS/.evergreen/ocsp/rsa/ca.pem" \
372+
OCSP_TLS_SHOULD_SUCCEED="${OCSP_TLS_SHOULD_SUCCEED}" \
373+
sh ${PROJECT_DIRECTORY}/.evergreen/run-ocsp-tests.sh
374+
375+
run-valid-ocsp-server:
376+
- command: shell.exec
377+
params:
378+
script: |
379+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
380+
/opt/mongodbtoolchain/v3/bin/python3 -m venv ./venv
381+
./venv/bin/pip3 install asn1crypto oscrypto bottle
382+
- command: shell.exec
383+
params:
384+
background: true
385+
script: |
386+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
387+
nohup ./venv/bin/python3 ocsp_mock.py \
388+
--ca_file rsa/ca.pem \
389+
--ocsp_responder_cert rsa/ca.crt \
390+
--ocsp_responder_key rsa/ca.key \
391+
-p 8100 -v
392+
393+
run-revoked-ocsp-server:
394+
- command: shell.exec
395+
params:
396+
script: |
397+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
398+
/opt/mongodbtoolchain/v3/bin/python3 -m venv ./venv
399+
./venv/bin/pip3 install asn1crypto oscrypto bottle
400+
- command: shell.exec
401+
params:
402+
background: true
403+
script: |
404+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
405+
nohup ./venv/bin/python3 ocsp_mock.py \
406+
--ca_file rsa/ca.pem \
407+
--ocsp_responder_cert rsa/ca.crt \
408+
--ocsp_responder_key rsa/ca.key \
409+
-p 8100 \
410+
-v \
411+
--fault revoked
412+
413+
363414
pre:
364415
- func: "fetch source"
365416
- func: "prepare resources"

0 commit comments

Comments
 (0)