mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2025-12-06 10:11:00 +01:00
ef18419601
ssl/ocsp_auto_update.vtc was renamed to ssl/ocsp_auto_update.vtci
to produce a common part runnable both for QUIC and TCP listeners.
Then ocsp_auto_update.vtc files were created both under ssl and quic directories
to call this .vtci file with correct VTC_SOCK_TYPE environment values
("quic" for QUIC listeners and "stream" for TCP listeners);
36 lines
1.6 KiB
Plaintext
36 lines
1.6 KiB
Plaintext
#REGTEST_TYPE=slow
|
|
# reg-test is around ~2.5s
|
|
|
|
# broken with BoringSSL.
|
|
|
|
# This reg-test focuses on the OCSP response auto-update functionality. It does
|
|
# not test the full scope of the feature because most of it is based on
|
|
# expiration times and long delays between updates of valid OCSP responses.
|
|
# Automatic update of valid OCSP responses loaded during init will not be
|
|
# tested because by design, such a response would no be automatically updated
|
|
# until init+1H.
|
|
#
|
|
# This test will then focus on certificates that have a specified OCSP URI but
|
|
# no known OCSP response. For those certificates, OCSP requests are sent as
|
|
# soon as possible by the update task.
|
|
#
|
|
# The ocsp responder used in all the tests will be an openssl using the
|
|
# certificate database in ocsp_update/index.txt. It will listen on port 12345
|
|
# which was specified explicitly in the certificates used in the tests.
|
|
# The synchronization will be based on the logs emitted by the OCSP update task
|
|
# directly. When this log is created, we will know that the update was
|
|
# effective and the updated OCSP response is loaded in the tree. So any
|
|
# following call to "show ssl ocsp-response" will display the latest response
|
|
# information.
|
|
#
|
|
# If this test does not work anymore:
|
|
# - Check that you have openssl and socat
|
|
|
|
varnishtest "Test the OCSP auto update feature"
|
|
feature cmd "$HAPROXY_PROGRAM -cc 'version_atleast(3.0-dev0)'"
|
|
feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && !ssllib_name_startswith(BoringSSL) && !ssllib_name_startswith(LibreSSL) && openssl_version_atleast(1.1.1)'"
|
|
feature cmd "command -v openssl && command -v socat"
|
|
|
|
setenv VTC_SOCK_TYPE stream
|
|
include ${testdir}/ocsp_auto_update.vtci
|