1// Copyright Joyent, Inc. and other Node contributors.
2//
3// Permission is hereby granted, free of charge, to any person obtaining a
4// copy of this software and associated documentation files (the
5// "Software"), to deal in the Software without restriction, including
6// without limitation the rights to use, copy, modify, merge, publish,
7// distribute, sublicense, and/or sell copies of the Software, and to permit
8// persons to whom the Software is furnished to do so, subject to the
9// following conditions:
10//
11// The above copyright notice and this permission notice shall be included
12// in all copies or substantial portions of the Software.
13//
14// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
16// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
17// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
18// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
19// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
20// USE OR OTHER DEALINGS IN THE SOFTWARE.
21
22'use strict';
23const common = require('../common');
24
25if (!common.opensslCli)
26  common.skip('node compiled without OpenSSL CLI.');
27
28if (!common.hasCrypto)
29  common.skip('missing crypto');
30
31const tls = require('tls');
32const fixtures = require('../common/fixtures');
33
34const assert = require('assert');
35
36const SSL_OP_NO_TICKET = require('crypto').constants.SSL_OP_NO_TICKET;
37
38const pfx = fixtures.readKey('agent1.pfx');
39const key = fixtures.readKey('agent1-key.pem');
40const cert = fixtures.readKey('agent1-cert.pem');
41const ca = fixtures.readKey('ca1-cert.pem');
42
43function test(testOptions, cb) {
44  const options = {
45    key,
46    cert,
47    ca: [ca]
48  };
49  const requestCount = testOptions.response ? 0 : 1;
50
51  if (!testOptions.ocsp)
52    assert.strictEqual(testOptions.response, undefined);
53
54  if (testOptions.pfx) {
55    delete options.key;
56    delete options.cert;
57    options.pfx = testOptions.pfx;
58    options.passphrase = testOptions.passphrase;
59  }
60
61  const server = tls.createServer(options, common.mustCall((cleartext) => {
62    cleartext.on('error', function(er) {
63      // We're ok with getting ECONNRESET in this test, but it's
64      // timing-dependent, and thus unreliable. Any other errors
65      // are just failures, though.
66      if (er.code !== 'ECONNRESET')
67        throw er;
68    });
69    cleartext.end();
70  }, requestCount));
71
72  if (!testOptions.ocsp)
73    server.on('OCSPRequest', common.mustNotCall());
74  else
75    server.on('OCSPRequest', common.mustCall((cert, issuer, callback) => {
76      assert.ok(Buffer.isBuffer(cert));
77      assert.ok(Buffer.isBuffer(issuer));
78
79      // Callback a little later to ensure that async really works.
80      return setTimeout(callback, 100, null, testOptions.response ?
81        Buffer.from(testOptions.response) : null);
82    }));
83
84  server.listen(0, function() {
85    const client = tls.connect({
86      port: this.address().port,
87      requestOCSP: testOptions.ocsp,
88      secureOptions: testOptions.ocsp ? 0 : SSL_OP_NO_TICKET,
89      rejectUnauthorized: false
90    }, common.mustCall(requestCount));
91
92    client.on('OCSPResponse', common.mustCall((resp) => {
93      if (testOptions.response) {
94        assert.strictEqual(resp.toString(), testOptions.response);
95        client.destroy();
96      } else {
97        assert.strictEqual(resp, null);
98      }
99    }, testOptions.ocsp === false ? 0 : 1));
100
101    client.on('close', common.mustCall(() => {
102      server.close(cb);
103    }));
104  });
105}
106
107test({ ocsp: true, response: false });
108test({ ocsp: true, response: 'hello world' });
109test({ ocsp: false });
110
111if (!common.hasFipsCrypto) {
112  test({ ocsp: true, response: 'hello pfx', pfx: pfx, passphrase: 'sample' });
113}
114