|
Packit |
aea12f |
#!/bin/sh
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
# Copyright (C) 2014 Red Hat, Inc.
|
|
Packit |
aea12f |
#
|
|
Packit |
aea12f |
# Author: Nikos Mavrogiannopoulos
|
|
Packit |
aea12f |
#
|
|
Packit |
aea12f |
# This file is part of GnuTLS.
|
|
Packit |
aea12f |
#
|
|
Packit |
aea12f |
# GnuTLS is free software; you can redistribute it and/or modify it
|
|
Packit |
aea12f |
# under the terms of the GNU General Public License as published by the
|
|
Packit |
aea12f |
# Free Software Foundation; either version 3 of the License, or (at
|
|
Packit |
aea12f |
# your option) any later version.
|
|
Packit |
aea12f |
#
|
|
Packit |
aea12f |
# GnuTLS is distributed in the hope that it will be useful, but
|
|
Packit |
aea12f |
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit |
aea12f |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Packit |
aea12f |
# General Public License for more details.
|
|
Packit |
aea12f |
#
|
|
Packit |
aea12f |
# You should have received a copy of the GNU General Public License
|
|
Packit |
aea12f |
# along with GnuTLS; if not, write to the Free Software Foundation,
|
|
Packit |
aea12f |
# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
#set -e
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
srcdir="${srcdir:-.}"
|
|
Packit |
aea12f |
CERTTOOL="${CERTTOOL:-../../src/certtool${EXEEXT}}"
|
|
Packit |
aea12f |
DIFF="${DIFF:-diff}"
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
if ! test -x "${CERTTOOL}"; then
|
|
Packit |
aea12f |
exit 77
|
|
Packit |
aea12f |
fi
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
if ! test -z "${VALGRIND}"; then
|
|
Packit |
aea12f |
VALGRIND="${LIBTOOL:-libtool} --mode=execute ${VALGRIND} --error-exitcode=15"
|
|
Packit |
aea12f |
fi
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
TMPFILE=crq.$$.tmp
|
|
Packit |
aea12f |
OUTFILE=out.$$.tmp
|
|
Packit |
aea12f |
OUTFILE2=out2.$$.tmp
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
. ${srcdir}/../scripts/common.sh
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
check_for_datefudge
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
${VALGRIND} "${CERTTOOL}" --inder --crq-info --infile "${srcdir}/data/csr-invalid.der" >"${OUTFILE}" 2>&1
|
|
Packit |
aea12f |
rc=$?
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
# We're done.
|
|
Packit |
aea12f |
if test "${rc}" != "0"; then
|
|
Packit |
aea12f |
echo "Invalid crq decoding failed"
|
|
Packit |
aea12f |
exit ${rc}
|
|
Packit |
aea12f |
fi
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
grep "error: get_key_id" "${OUTFILE}" >/dev/null 2>&1
|
|
Packit |
aea12f |
if test "$?" != "0"; then
|
|
Packit |
aea12f |
echo "crq decoding didn't fail as expected"
|
|
Packit |
aea12f |
exit 1
|
|
Packit |
aea12f |
fi
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
rm -f "${OUTFILE}"
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
# check whether the honor_crq_extension option works
|
|
Packit |
aea12f |
datefudge -s "2007-04-22" \
|
|
Packit |
aea12f |
"${CERTTOOL}" --generate-request \
|
|
Packit |
aea12f |
--load-privkey "${srcdir}/data/template-test.key" \
|
|
Packit |
aea12f |
--template "${srcdir}/templates/template-tlsfeature.tmpl" \
|
|
Packit |
aea12f |
--outfile $OUTFILE 2>/dev/null
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
${CERTTOOL} --crq-info --no-text --infile ${OUTFILE} --outfile ${TMPFILE}
|
|
Packit |
aea12f |
rc=$?
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
if test "${rc}" != "0"; then
|
|
Packit |
aea12f |
echo "--no-text crq info failed 1"
|
|
Packit |
aea12f |
exit ${rc}
|
|
Packit |
aea12f |
fi
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
if grep -v '^-----BEGIN [A-Z0-9 ]\+-----$' ${TMPFILE} | grep -v '^[A-Za-z0-9/+=]\+$' | grep -v '^-----END [A-Z0-9 ]\+-----$' ; then
|
|
Packit |
aea12f |
echo "--no-text crq info failed 2"
|
|
Packit |
aea12f |
exit 1
|
|
Packit |
aea12f |
fi
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
datefudge -s "2007-04-22" \
|
|
Packit |
aea12f |
"${CERTTOOL}" --generate-certificate \
|
|
Packit |
aea12f |
--load-ca-privkey "${srcdir}/data/template-test.key" \
|
|
Packit |
aea12f |
--load-ca-certificate "${srcdir}/data/template-tlsfeature.pem" \
|
|
Packit |
aea12f |
--load-request="$OUTFILE" \
|
|
Packit |
aea12f |
--template "${srcdir}/templates/template-crq.tmpl" \
|
|
Packit |
aea12f |
--outfile "${OUTFILE2}" 2>/dev/null
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
${DIFF} "${srcdir}/data/template-crq.pem" "${OUTFILE2}" >/dev/null 2>&1
|
|
Packit |
aea12f |
rc=$?
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
# We're done.
|
|
Packit |
aea12f |
if test "${rc}" != "0"; then
|
|
Packit |
aea12f |
echo "Certificate request generation failed"
|
|
Packit |
aea12f |
echo $OUTFILE2
|
|
Packit |
aea12f |
exit ${rc}
|
|
Packit |
aea12f |
fi
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
rm -f "${OUTFILE}" "${OUTFILE2}"
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
# Test interactive CRQ creation with very long input
|
|
Packit |
aea12f |
cat >$TMPFILE <<__EOF__
|
|
Packit |
aea12f |
super-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-long.com
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
super-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-very-long.com
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
N
|
|
Packit |
aea12f |
Y
|
|
Packit |
aea12f |
N
|
|
Packit |
aea12f |
Y
|
|
Packit |
aea12f |
N
|
|
Packit |
aea12f |
N
|
|
Packit |
aea12f |
N
|
|
Packit |
aea12f |
N
|
|
Packit |
aea12f |
N
|
|
Packit |
aea12f |
N
|
|
Packit |
aea12f |
__EOF__
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
setsid \
|
|
Packit |
aea12f |
datefudge -s "2007-04-22" \
|
|
Packit |
aea12f |
"${CERTTOOL}" -q \
|
|
Packit |
aea12f |
--load-privkey "${srcdir}/data/template-test.key" \
|
|
Packit |
aea12f |
--outfile "${OUTFILE}" <$TMPFILE 2>/dev/null
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
${DIFF} --ignore-matching-lines "Algorithm Security Level" "${srcdir}/data/template-long-dns-crq.pem" "${OUTFILE}" >/dev/null 2>&1
|
|
Packit |
aea12f |
rc=$?
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
# We're done.
|
|
Packit |
aea12f |
if test "${rc}" != "0"; then
|
|
Packit |
aea12f |
echo "Certificate request generation with long DNS failed"
|
|
Packit |
aea12f |
echo $OUTFILE
|
|
Packit |
aea12f |
exit ${rc}
|
|
Packit |
aea12f |
fi
|
|
Packit |
aea12f |
|
|
Packit Service |
991b93 |
# check whether the generation with extension works
|
|
Packit Service |
991b93 |
datefudge -s "2007-04-22" \
|
|
Packit Service |
991b93 |
"${CERTTOOL}" --generate-request \
|
|
Packit Service |
991b93 |
--load-privkey "${srcdir}/data/template-test.key" \
|
|
Packit Service |
991b93 |
--template "${srcdir}/templates/arb-extensions.tmpl" \
|
|
Packit Service |
991b93 |
--outfile $OUTFILE 2>/dev/null
|
|
Packit Service |
991b93 |
rc=$?
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
if test "${rc}" != "0"; then
|
|
Packit Service |
991b93 |
echo "add_extension crq failed"
|
|
Packit Service |
991b93 |
exit ${rc}
|
|
Packit Service |
991b93 |
fi
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
${DIFF} --ignore-matching-lines "Algorithm Security Level" "${srcdir}/data/arb-extensions.csr" "${OUTFILE}" >/dev/null 2>&1
|
|
Packit Service |
991b93 |
rc=$?
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
if test "${rc}" != "0"; then
|
|
Packit Service |
991b93 |
echo "Certificate request generation with explicit extensions failed"
|
|
Packit Service |
991b93 |
exit ${rc}
|
|
Packit Service |
991b93 |
fi
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
# Generate certificate from CRQ with no explicit extensions
|
|
Packit Service |
991b93 |
datefudge -s "2007-04-22" \
|
|
Packit Service |
991b93 |
"${CERTTOOL}" --generate-certificate \
|
|
Packit Service |
991b93 |
--load-ca-privkey "${srcdir}/../../doc/credentials/x509/ca-key.pem" \
|
|
Packit Service |
991b93 |
--load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" \
|
|
Packit Service |
991b93 |
--load-request "${srcdir}/data/arb-extensions.csr" \
|
|
Packit Service |
991b93 |
--template "${srcdir}/templates/template-no-ca.tmpl" \
|
|
Packit Service |
991b93 |
--outfile "${OUTFILE}" 2>/dev/null
|
|
Packit Service |
991b93 |
rc=$?
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
if test "${rc}" != "0"; then
|
|
Packit Service |
991b93 |
echo "generate certificate with crq failed"
|
|
Packit Service |
991b93 |
exit ${rc}
|
|
Packit Service |
991b93 |
fi
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
${DIFF} --ignore-matching-lines "Algorithm Security Level" "${srcdir}/data/crq-cert-no-ca.pem" "${OUTFILE}" >/dev/null 2>&1
|
|
Packit Service |
991b93 |
rc=$?
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
if test "${rc}" != "0"; then
|
|
Packit Service |
991b93 |
echo "Certificate from request generation failed"
|
|
Packit Service |
991b93 |
exit ${rc}
|
|
Packit Service |
991b93 |
fi
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
# Generate certificate from CRQ with CRQ extensions
|
|
Packit Service |
991b93 |
datefudge -s "2007-04-22" \
|
|
Packit Service |
991b93 |
"${CERTTOOL}" --generate-certificate \
|
|
Packit Service |
991b93 |
--load-ca-privkey "${srcdir}/../../doc/credentials/x509/ca-key.pem" \
|
|
Packit Service |
991b93 |
--load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" \
|
|
Packit Service |
991b93 |
--load-request "${srcdir}/data/arb-extensions.csr" \
|
|
Packit Service |
991b93 |
--template "${srcdir}/templates/template-no-ca-honor.tmpl" \
|
|
Packit Service |
991b93 |
--outfile "${OUTFILE}" 2>/dev/null
|
|
Packit Service |
991b93 |
rc=$?
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
if test "${rc}" != "0"; then
|
|
Packit Service |
991b93 |
echo "generate certificate with crq failed"
|
|
Packit Service |
991b93 |
exit ${rc}
|
|
Packit Service |
991b93 |
fi
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
${DIFF} --ignore-matching-lines "Algorithm Security Level" "${srcdir}/data/crq-cert-no-ca-honor.pem" "${OUTFILE}" >/dev/null 2>&1
|
|
Packit Service |
991b93 |
rc=$?
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
if test "${rc}" != "0"; then
|
|
Packit Service |
991b93 |
echo "Certificate from request generation with honor flag failed"
|
|
Packit Service |
991b93 |
exit ${rc}
|
|
Packit Service |
991b93 |
fi
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
# Generate certificate from CRQ with explicit extensions
|
|
Packit Service |
991b93 |
datefudge -s "2007-04-22" \
|
|
Packit Service |
991b93 |
"${CERTTOOL}" --generate-certificate \
|
|
Packit Service |
991b93 |
--load-ca-privkey "${srcdir}/../../doc/credentials/x509/ca-key.pem" \
|
|
Packit Service |
991b93 |
--load-ca-certificate "${srcdir}/../../doc/credentials/x509/ca.pem" \
|
|
Packit Service |
991b93 |
--load-request "${srcdir}/data/arb-extensions.csr" \
|
|
Packit Service |
991b93 |
--template "${srcdir}/templates/template-no-ca-explicit.tmpl" \
|
|
Packit Service |
991b93 |
--outfile "${OUTFILE}" 2>/dev/null
|
|
Packit Service |
991b93 |
rc=$?
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
if test "${rc}" != "0"; then
|
|
Packit Service |
991b93 |
echo "generate certificate with crq failed"
|
|
Packit Service |
991b93 |
exit ${rc}
|
|
Packit Service |
991b93 |
fi
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
${DIFF} --ignore-matching-lines "Algorithm Security Level" "${srcdir}/data/crq-cert-no-ca-explicit.pem" "${OUTFILE}" >/dev/null 2>&1
|
|
Packit Service |
991b93 |
rc=$?
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
if test "${rc}" != "0"; then
|
|
Packit Service |
991b93 |
echo "Certificate from request generation with explicit extensions failed"
|
|
Packit Service |
991b93 |
exit ${rc}
|
|
Packit Service |
991b93 |
fi
|
|
Packit Service |
991b93 |
|
|
Packit Service |
991b93 |
|
|
Packit |
aea12f |
rm -f "${OUTFILE}" "${OUTFILE2}" "${TMPFILE}"
|
|
Packit |
aea12f |
|
|
Packit |
aea12f |
exit 0
|