diff --git a/tests/hwsim/start.sh b/tests/hwsim/start.sh index 7c9da283b..dcdaa500c 100755 --- a/tests/hwsim/start.sh +++ b/tests/hwsim/start.sh @@ -136,6 +136,17 @@ if [ ! -r $LOGDIR/ocsp-server-cache.der ]; then cp $DIR/auth_serv/ocsp-server-cache.der $LOGDIR/ocsp-server-cache.der fi +openssl ocsp -index $DIR/auth_serv/index.txt \ + -rsigner $DIR/auth_serv/ocsp-responder.pem \ + -rkey $DIR/auth_serv/ocsp-responder.key \ + -resp_key_id \ + -CA $DIR/auth_serv/ca.pem \ + -issuer $DIR/auth_serv/ca.pem \ + -verify_other $DIR/auth_serv/ca.pem -trust_other \ + -ndays 7 \ + -reqin $DIR/auth_serv/ocsp-req.der \ + -respout $LOGDIR/ocsp-server-cache-key-id.der > $LOGDIR/ocsp.log 2>&1 + for i in unknown revoked; do openssl ocsp -index $DIR/auth_serv/index-$i.txt \ -rsigner $DIR/auth_serv/ocsp-responder.pem \ diff --git a/tests/hwsim/test_ap_eap.py b/tests/hwsim/test_ap_eap.py index e3ee3c78e..14b7ac12c 100644 --- a/tests/hwsim/test_ap_eap.py +++ b/tests/hwsim/test_ap_eap.py @@ -2597,6 +2597,21 @@ def int_eap_server_params(): "private_key": "auth_serv/server.key" } return params +def test_ap_wpa2_eap_tls_ocsp_key_id(dev, apdev, params): + """EAP-TLS and OCSP certificate signed OCSP response using key ID""" + check_ocsp_support(dev[0]) + ocsp = os.path.join(params['logdir'], "ocsp-server-cache-key-id.der") + if not os.path.exists(ocsp): + raise HwsimSkip("No OCSP response available") + params = int_eap_server_params() + params["ocsp_stapling_response"] = ocsp + hostapd.add_ap(apdev[0]['ifname'], params) + dev[0].connect("test-wpa2-eap", key_mgmt="WPA-EAP", eap="TLS", + identity="tls user", ca_cert="auth_serv/ca.pem", + private_key="auth_serv/user.pkcs12", + private_key_passwd="whatever", ocsp=2, + scan_freq="2412") + def test_ap_wpa2_eap_tls_ocsp_ca_signed_good(dev, apdev, params): """EAP-TLS and CA signed OCSP response (good)""" check_ocsp_support(dev[0])