Skip to content

Commit 5ebbe78

Browse files
author
Divjot Arora
authored
GODRIVER-1467 Add tests for all combinations (#317)
The first commit for GODRIVER-1467 added tests for RSA certificates. This commit adds the following sets of tests: - RSA certificates + OCSP responses signed by delegates - ECDSA certificates - ECDSA certificates + OCSP responses signed by delegates This commit also uses a buildvariant instead of a matrix for OCSP tests in Evergreen and uses cron to set the variant to only run every 14 days on the waterfall.
1 parent 026d01f commit 5ebbe78

File tree

1 file changed

+282
-6
lines changed

1 file changed

+282
-6
lines changed

‎.evergreen/config.yml

Lines changed: 282 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -480,6 +480,46 @@ functions:
480480
-v \
481481
--fault revoked
482482
483+
run-valid-delegate-ocsp-server:
484+
- command: shell.exec
485+
params:
486+
script: |
487+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
488+
/opt/mongodbtoolchain/v3/bin/python3 -m venv ./venv
489+
./venv/bin/pip3 install -r ${PROJECT_DIRECTORY}/.evergreen/ocsp-requirements.txt
490+
- command: shell.exec
491+
params:
492+
background: true
493+
script: |
494+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
495+
496+
nohup ./venv/bin/python3 ocsp_mock.py \
497+
--ca_file ${OCSP_ALGORITHM}/ca.pem \
498+
--ocsp_responder_cert ${OCSP_ALGORITHM}/ocsp-responder.crt \
499+
--ocsp_responder_key ${OCSP_ALGORITHM}/ocsp-responder.key \
500+
-p 8100 -v
501+
502+
run-revoked-delegate-ocsp-server:
503+
- command: shell.exec
504+
params:
505+
script: |
506+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
507+
/opt/mongodbtoolchain/v3/bin/python3 -m venv ./venv
508+
./venv/bin/pip3 install -r ${PROJECT_DIRECTORY}/.evergreen/ocsp-requirements.txt
509+
- command: shell.exec
510+
params:
511+
background: true
512+
script: |
513+
cd ${DRIVERS_TOOLS}/.evergreen/ocsp
514+
515+
nohup ./venv/bin/python3 ocsp_mock.py \
516+
--ca_file ${OCSP_ALGORITHM}/ca.pem \
517+
--ocsp_responder_cert ${OCSP_ALGORITHM}/ocsp-responder.crt \
518+
--ocsp_responder_key ${OCSP_ALGORITHM}/ocsp-responder.key \
519+
-p 8100 \
520+
-v \
521+
--fault revoked
522+
483523
pre:
484524
- func: fetch-source
485525
- func: prepare-resources
@@ -755,6 +795,238 @@ tasks:
755795
OCSP_ALGORITHM: "rsa"
756796
OCSP_TLS_SHOULD_SUCCEED: "false"
757797

798+
- name: test-ocsp-rsa-delegate-valid-cert-server-staples
799+
tags: ["ocsp"]
800+
commands:
801+
- func: run-valid-delegate-ocsp-server
802+
vars:
803+
OCSP_ALGORITHM: "rsa"
804+
- func: ocsp-bootstrap-mongo-orchestration
805+
vars:
806+
ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple.json"
807+
- func: run-ocsp-test
808+
vars:
809+
OCSP_ALGORITHM: "rsa"
810+
OCSP_TLS_SHOULD_SUCCEED: "true"
811+
812+
- name: test-ocsp-rsa-delegate-invalid-cert-server-staples
813+
tags: ["ocsp"]
814+
commands:
815+
- func: run-revoked-delegate-ocsp-server
816+
vars:
817+
OCSP_ALGORITHM: "rsa"
818+
- func: ocsp-bootstrap-mongo-orchestration
819+
vars:
820+
ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple.json"
821+
- func: run-ocsp-test
822+
vars:
823+
OCSP_ALGORITHM: "rsa"
824+
OCSP_TLS_SHOULD_SUCCEED: "false"
825+
826+
- name: test-ocsp-rsa-delegate-valid-cert-server-does-not-staple
827+
tags: ["ocsp"]
828+
commands:
829+
- func: run-valid-delegate-ocsp-server
830+
vars:
831+
OCSP_ALGORITHM: "rsa"
832+
- func: ocsp-bootstrap-mongo-orchestration
833+
vars:
834+
ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-disableStapling.json"
835+
- func: run-ocsp-test
836+
vars:
837+
OCSP_ALGORITHM: "rsa"
838+
OCSP_TLS_SHOULD_SUCCEED: "true"
839+
840+
- name: test-ocsp-rsa-delegate-invalid-cert-server-does-not-staple
841+
tags: ["ocsp"]
842+
commands:
843+
- func: run-revoked-delegate-ocsp-server
844+
vars:
845+
OCSP_ALGORITHM: "rsa"
846+
- func: ocsp-bootstrap-mongo-orchestration
847+
vars:
848+
ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-disableStapling.json"
849+
- func: run-ocsp-test
850+
vars:
851+
OCSP_ALGORITHM: "rsa"
852+
OCSP_TLS_SHOULD_SUCCEED: "false"
853+
854+
- name: test-ocsp-rsa-delegate-malicious-invalid-cert-mustStaple-server-does-not-staple
855+
tags: ["ocsp"]
856+
commands:
857+
- func: run-revoked-delegate-ocsp-server
858+
vars:
859+
OCSP_ALGORITHM: "rsa"
860+
- func: ocsp-bootstrap-mongo-orchestration
861+
vars:
862+
ORCHESTRATION_FILE: "rsa-basic-tls-ocsp-mustStaple-disableStapling.json"
863+
- func: run-ocsp-test
864+
vars:
865+
OCSP_ALGORITHM: "rsa"
866+
OCSP_TLS_SHOULD_SUCCEED: "false"
867+
868+
- name: test-ocsp-ecdsa-valid-cert-server-staples
869+
tags: ["ocsp"]
870+
commands:
871+
- func: run-valid-ocsp-server
872+
vars:
873+
OCSP_ALGORITHM: "ecdsa"
874+
- func: ocsp-bootstrap-mongo-orchestration
875+
vars:
876+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple.json"
877+
- func: run-ocsp-test
878+
vars:
879+
OCSP_ALGORITHM: "ecdsa"
880+
OCSP_TLS_SHOULD_SUCCEED: "true"
881+
882+
- name: test-ocsp-ecdsa-invalid-cert-server-staples
883+
tags: ["ocsp"]
884+
commands:
885+
- func: run-revoked-ocsp-server
886+
vars:
887+
OCSP_ALGORITHM: "ecdsa"
888+
- func: ocsp-bootstrap-mongo-orchestration
889+
vars:
890+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple.json"
891+
- func: run-ocsp-test
892+
vars:
893+
OCSP_ALGORITHM: "ecdsa"
894+
OCSP_TLS_SHOULD_SUCCEED: "false"
895+
896+
- name: test-ocsp-ecdsa-valid-cert-server-does-not-staple
897+
tags: ["ocsp"]
898+
commands:
899+
- func: run-valid-ocsp-server
900+
vars:
901+
OCSP_ALGORITHM: "ecdsa"
902+
- func: ocsp-bootstrap-mongo-orchestration
903+
vars:
904+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
905+
- func: run-ocsp-test
906+
vars:
907+
OCSP_ALGORITHM: "ecdsa"
908+
OCSP_TLS_SHOULD_SUCCEED: "true"
909+
910+
- name: test-ocsp-ecdsa-invalid-cert-server-does-not-staple
911+
tags: ["ocsp"]
912+
commands:
913+
- func: run-revoked-ocsp-server
914+
vars:
915+
OCSP_ALGORITHM: "ecdsa"
916+
- func: ocsp-bootstrap-mongo-orchestration
917+
vars:
918+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
919+
- func: run-ocsp-test
920+
vars:
921+
OCSP_ALGORITHM: "ecdsa"
922+
OCSP_TLS_SHOULD_SUCCEED: "false"
923+
924+
- name: test-ocsp-ecdsa-soft-fail
925+
tags: ["ocsp"]
926+
commands:
927+
- func: ocsp-bootstrap-mongo-orchestration
928+
vars:
929+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
930+
- func: run-ocsp-test
931+
vars:
932+
OCSP_ALGORITHM: "ecdsa"
933+
OCSP_TLS_SHOULD_SUCCEED: "true"
934+
935+
- name: test-ocsp-ecdsa-malicious-invalid-cert-mustStaple-server-does-not-staple
936+
tags: ["ocsp"]
937+
commands:
938+
- func: run-revoked-ocsp-server
939+
vars:
940+
OCSP_ALGORITHM: "ecdsa"
941+
- func: ocsp-bootstrap-mongo-orchestration
942+
vars:
943+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple-disableStapling.json"
944+
- func: run-ocsp-test
945+
vars:
946+
OCSP_ALGORITHM: "ecdsa"
947+
OCSP_TLS_SHOULD_SUCCEED: "false"
948+
949+
- name: test-ocsp-ecdsa-malicious-no-responder-mustStaple-server-does-not-staple
950+
tags: ["ocsp"]
951+
commands:
952+
- func: ocsp-bootstrap-mongo-orchestration
953+
vars:
954+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple-disableStapling.json"
955+
- func: run-ocsp-test
956+
vars:
957+
OCSP_ALGORITHM: "ecdsa"
958+
OCSP_TLS_SHOULD_SUCCEED: "false"
959+
960+
- name: test-ocsp-ecdsa-delegate-valid-cert-server-staples
961+
tags: ["ocsp"]
962+
commands:
963+
- func: run-valid-delegate-ocsp-server
964+
vars:
965+
OCSP_ALGORITHM: "ecdsa"
966+
- func: ocsp-bootstrap-mongo-orchestration
967+
vars:
968+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple.json"
969+
- func: run-ocsp-test
970+
vars:
971+
OCSP_ALGORITHM: "ecdsa"
972+
OCSP_TLS_SHOULD_SUCCEED: "true"
973+
974+
- name: test-ocsp-ecdsa-delegate-invalid-cert-server-staples
975+
tags: ["ocsp"]
976+
commands:
977+
- func: run-revoked-delegate-ocsp-server
978+
vars:
979+
OCSP_ALGORITHM: "ecdsa"
980+
- func: ocsp-bootstrap-mongo-orchestration
981+
vars:
982+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple.json"
983+
- func: run-ocsp-test
984+
vars:
985+
OCSP_ALGORITHM: "ecdsa"
986+
OCSP_TLS_SHOULD_SUCCEED: "false"
987+
988+
- name: test-ocsp-ecdsa-delegate-valid-cert-server-does-not-staple
989+
tags: ["ocsp"]
990+
commands:
991+
- func: run-valid-delegate-ocsp-server
992+
vars:
993+
OCSP_ALGORITHM: "ecdsa"
994+
- func: ocsp-bootstrap-mongo-orchestration
995+
vars:
996+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
997+
- func: run-ocsp-test
998+
vars:
999+
OCSP_ALGORITHM: "ecdsa"
1000+
OCSP_TLS_SHOULD_SUCCEED: "true"
1001+
1002+
- name: test-ocsp-ecdsa-delegate-invalid-cert-server-does-not-staple
1003+
tags: ["ocsp"]
1004+
commands:
1005+
- func: run-revoked-delegate-ocsp-server
1006+
vars:
1007+
OCSP_ALGORITHM: "ecdsa"
1008+
- func: ocsp-bootstrap-mongo-orchestration
1009+
vars:
1010+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-disableStapling.json"
1011+
- func: run-ocsp-test
1012+
vars:
1013+
OCSP_ALGORITHM: "ecdsa"
1014+
OCSP_TLS_SHOULD_SUCCEED: "false"
1015+
1016+
- name: test-ocsp-ecdsa-delegate-malicious-invalid-cert-mustStaple-server-does-not-staple
1017+
tags: ["ocsp"]
1018+
commands:
1019+
- func: run-revoked-delegate-ocsp-server
1020+
vars:
1021+
OCSP_ALGORITHM: "ecdsa"
1022+
- func: ocsp-bootstrap-mongo-orchestration
1023+
vars:
1024+
ORCHESTRATION_FILE: "ecdsa-basic-tls-ocsp-mustStaple-disableStapling.json"
1025+
- func: run-ocsp-test
1026+
vars:
1027+
OCSP_ALGORITHM: "ecdsa"
1028+
OCSP_TLS_SHOULD_SUCCEED: "false"
1029+
7581030
- name: test-replicaset-noauth-nossl
7591031
tags: ["test", "replicaset"]
7601032
commands:
@@ -1078,6 +1350,16 @@ buildvariants:
10781350
tasks:
10791351
- name: "atlas-test"
10801352

1353+
- name: ocsp-test
1354+
display_name: "OCSP Tests"
1355+
run_on:
1356+
- ubuntu1604-build
1357+
expansions:
1358+
GO_DIST: "/opt/golang/go1.12"
1359+
tasks:
1360+
- name: ".ocsp"
1361+
cron: "@every 336h"
1362+
10811363
- matrix_name: "tests-legacy-auth-ssl"
10821364
matrix_spec: { version: ["2.6", "3.0"], os-ssl-legacy: "*" }
10831365
display_name: "${version} ${os-ssl-legacy}"
@@ -1119,9 +1401,3 @@ buildvariants:
11191401
display_name: "Enterprise Auth - ${os-ssl-32}"
11201402
tasks:
11211403
- name: ".test .enterprise-auth"
1122-
1123-
- matrix_name: "ocsp-tests"
1124-
matrix_spec: { version: ["latest"], os-ssl-32: ["ubuntu1604-64-go-1-12"] }
1125-
display_name: "OCSP ${version} ${os-ssl-32}"
1126-
tasks:
1127-
- name: ".ocsp"

0 commit comments

Comments
 (0)