#!/bin/sh

# Copyright (C) 2017 Red Hat, Inc.

#

# This file is part of p11-kit.

#

# p11-kit is free software; you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by the

# Free Software Foundation; either version 3 of the License, or (at

# your option) any later version.

#

# p11-kit is distributed in the hope that it will be useful, but

# WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

# General Public License for more details.

#

# You should have received a copy of the GNU General Public License

# along with GnuTLS; if not, write to the Free Software Foundation,

# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

#set -e

srcdir="${srcdir:-.}"

P11TOOL="${P11TOOL:-../src/p11tool${EXEEXT}}"

CERTTOOL="${CERTTOOL:-../src/certtool${EXEEXT}}"

DIFF="${DIFF:-diff}"

EXPORTED_FILE=out.$$.tmp

DER_FILE=out-der.$$.tmp

TMPFILE=out-tmp.$$.tmp

for lib in ${libdir} ${libdir}/pkcs11 /usr/lib64/pkcs11/ /usr/lib/pkcs11/ /usr/lib/x86_64-linux-gnu/pkcs11/;do

	if test -f "${lib}/p11-kit-trust.so"; then

		MODULE="${lib}/p11-kit-trust.so"

		echo "located ${MODULE}"

		break

	fi

done

if ! test -x "${P11TOOL}"; then

	echo "p11tool was not found"

	exit 77

fi

if ! test -f "${MODULE}"; then

	echo "p11-kit trust module was not found"

	exit 77

fi

TRUST_PATH="${srcdir}/p11-kit-trust-data/"

CACERT=${TRUST_PATH}/Example_Root_CA.pem

# Test whether a CA extracted from a trust store can retrieve stapled

# extensions.

OPTS="--provider ${MODULE} --provider-opts trusted,p11-kit:paths=\"${TRUST_PATH}\""

# Informational

${P11TOOL} --list-all-certs ${OPTS} 'pkcs11:'

####

# Test 1: Extract the CA certificate from store

${P11TOOL} --export 'pkcs11:object=Example%20CA' ${OPTS} --outder --outfile ${EXPORTED_FILE}

if test "$?" != "0"; then

	echo "Exporting failed (1)"

	exit 1

fi

${CERTTOOL} -i --infile ${CACERT} --outder --outfile ${DER_FILE}

if test "$?" != "0"; then

	echo "Exporting failed (2)"

	exit 1

fi

${DIFF} ${EXPORTED_FILE} ${DER_FILE}

if test "$?" != "0"; then

	echo "Files ${EXPORTED_FILE} and ${DER_FILE} are not identical"

	exit 1

fi

rm -f ${EXPORTED_FILE} ${DER_FILE} ${TMPFILE}

echo "Root CA retrieval test passed..."

####

# Test 2: Extract the certificate from store with the stapled data

${P11TOOL} --export-stapled 'pkcs11:object=Example%20CA' ${OPTS} --outder --outfile ${EXPORTED_FILE}

if test "$?" != "0"; then

	echo "Exporting failed (3)"

	exit 1

fi

${CERTTOOL} -i --infile ${CACERT} --outder --outfile ${DER_FILE}

if test "$?" != "0"; then

	echo "Exporting failed (4)"

	exit 1

fi

${DIFF} ${EXPORTED_FILE} ${DER_FILE}

if test "$?" = "0"; then

	echo "Files are identical; no extensions were stapled"

	exit 1

fi

${CERTTOOL} -i --inder --infile ${EXPORTED_FILE} --outfile ${TMPFILE}

if test "$?" != "0"; then

	echo "PEM converting failed"

	exit 1

fi

grep -i "Name Constraints" ${TMPFILE}

if test "$?" != "0"; then

	cat ${TMPFILE}

	echo "No name constraints found (1)"

	exit 1

fi

grep -i "Permitted" ${TMPFILE}

if test "$?" != "0"; then

	cat ${TMPFILE}

	echo "No name constraints found (2)"

	exit 1

fi

grep -i "DNSname: example.com" ${TMPFILE}

if test "$?" != "0"; then

	cat ${TMPFILE}

	echo "No name constraints found (3)"

	exit 1

fi

echo "Root CA with stapled extensions retrieval test passed..."

rm -f ${EXPORTED_FILE} ${DER_FILE} ${TMPFILE}

exit 0