#!/bin/bash

#

# This Source Code Form is subject to the terms of the Mozilla Public

# License, v. 2.0. If a copy of the MPL was not distributed with this

# file, You can obtain one at http://mozilla.org/MPL/2.0/.

########################################################################

#

# mozilla/security/nss/tests/pkits/pkits.sh

#

# Script to test the NIST PKITS tests 

#

# needs to work on all Unix and Windows platforms

#

# tests implemented:

#    vfychain 

#

# special NOTES

# ---------------

# NIST PKITS data needs to be downloaded from

# http://csrc.nist.gov/pki/testing/x509paths.html

# Environment variable PKITS_DATA needs to be set to the directory

# where this data is downloaded, or test data needs to be copied under 

# the mozilla source tree in mozilla/PKITS_DATA

########################################################################

############################## pkits_init ##############################

# local shell function to initialize this script 

########################################################################

pkits_init()

{

  SCRIPTNAME=pkits.sh

  if [ -z "${CLEANUP}" ] ; then

      CLEANUP="${SCRIPTNAME}"

  fi

  if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then

      cd ../common

      . ./init.sh

  fi

  if [ -z "${PKITS_DATA}" ]; then

      echo "${SCRIPTNAME}: PKITS data directory not defined, skipping."

      exit 0

  fi      

  if [ ! -d "${PKITS_DATA}" ]; then

      echo "${SCRIPTNAME}: PKITS data directory ${PKITS_DATA} doesn't exist, skipping."

      exit 0

  fi

  PKITSDIR=${HOSTDIR}/pkits

  COPYDIR=${PKITSDIR}/copydir

  mkdir -p ${PKITSDIR}

  mkdir -p ${COPYDIR}

  mkdir -p ${PKITSDIR}/html

  certs=${PKITS_DATA}/certs

  crls=${PKITS_DATA}/crls

  cd ${PKITSDIR}

  PKITSdb=${PKITSDIR}/PKITSdb

  PKITSbkp=${PKITSDIR}/PKITSbkp

  PKITS_LOG=${PKITSDIR}/pkits.log #getting its own logfile

  pkits_log "Start of logfile $PKITS_LOG"

  if [ ! -d "${PKITSdb}" ]; then

      mkdir -p ${PKITSdb}

  else

      pkits_log "$SCRIPTNAME: WARNING - ${PKITSdb} exists"

  fi

  if [ ! -d "${PKITSbkp}" ]; then

      mkdir -p ${PKITSbkp}

  else

      pkits_log "$SCRIPTNAME: WARNING - ${PKITSbkp} exists"

  fi

  echo "HOSTDIR" $HOSTDIR

  echo "PKITSDIR" $PKITSDIR

  echo "PKITSdb" $PKITSdb

  echo "PKITSbkp" $PKITSbkp

  echo "PKITS_DATA" $PKITS_DATA

  echo "certs" $certs

  echo "crls" $crls

  echo nss > ${PKITSdb}/pw

  ${BINDIR}/certutil -N -d ${PKITSdb} -f ${PKITSdb}/pw

  ${BINDIR}/certutil -A -n TrustAnchorRootCertificate -t "C,C,C" -i \

      $certs/TrustAnchorRootCertificate.crt -d $PKITSdb

  if [ -z "$NSS_NO_PKITS_CRLS" ]; then

    ${BINDIR}/crlutil -I -i $crls/TrustAnchorRootCRL.crl -d ${PKITSdb} -f ${PKITSdb}/pw

  else

    html  "
NO CRLs are being used.
"

    pkits_log "NO CRLs are being used."

  fi

  cp ${PKITSdb}/* ${PKITSbkp}

  KNOWN_BUG=

}

############################### pkits_log ##############################

# write to pkits.log file

########################################################################

pkits_log()

{

  echo "$SCRIPTNAME $*"

  echo $* >> ${PKITS_LOG}

}

restore_db()

{

  echo "Restore DB"

  rm ${PKITSdb}/*

  cp ${PKITSbkp}/* ${PKITSdb}

}

log_banner()

{

  echo ""

  echo "--------------------------------------------------------------------"

  echo "Test case ${VFY_ACTION}"

  echo ""

}

start_table()

{

  html ""
$*

  html "Test CaseResult" 

  echo ""

  echo "***************************************************************"

  echo "$*"

  echo "***************************************************************"

}

break_table()

{

  html "
"

  start_table "$@"

}

################################ pkits #################################

# local shell function for positive testcases, calls vfychain, writes 

# action and options to stdout, sets variable RET and writes results to 

# the html file results

########################################################################

pkits()

{

  echo "vfychain -d $PKITSdb -u 4 $*"

  ${BINDIR}/vfychain -d $PKITSdb -u 4 $* > ${PKITSDIR}/cmdout.txt 2>&1

  RET=$?

  CNT=`grep -c ERROR ${PKITSDIR}/cmdout.txt`

  RET=`expr ${RET} + ${CNT}`

  cat ${PKITSDIR}/cmdout.txt

  if [ "$RET" -ne 0 ]; then

      html_failed "${VFY_ACTION} ($RET) "

      pkits_log "ERROR: ${VFY_ACTION} failed $RET"

  else

      html_passed "${VFY_ACTION}"

      pkits_log "SUCCESS: ${VFY_ACTION} returned as expected $RET"

  fi

  return $RET

}

################################ pkitsn #################################

# local shell function for negative testcases, calls vfychain, writes 

# action and options to stdout, sets variable RET and writes results to 

# the html file results

########################################################################

pkitsn()

{

  echo "vfychain -d $PKITSdb -u 4 $*"

  ${BINDIR}/vfychain -d $PKITSdb -u 4 $* > ${PKITSDIR}/cmdout.txt 2>&1

  RET=$?

  CNT=`grep -c ERROR ${PKITSDIR}/cmdout.txt`

  RET=`expr ${RET} + ${CNT}`

  cat ${PKITSDIR}/cmdout.txt

  if [ "$RET" -eq 0 ]; then

      html_failed "${VFY_ACTION} ($RET) "

      pkits_log "ERROR: ${VFY_ACTION} failed $RET"

  else

      html_passed "${VFY_ACTION} ($RET) "

      pkits_log "SUCCESS: ${VFY_ACTION} returned as expected $RET"

  fi

  return $RET

}

################################ crlImport #############################

# local shell function to import a CRL, calls crlutil -I -i, writes 

# action and options to stdout

########################################################################

crlImport()

{

  if [ -z "$NSS_NO_PKITS_CRLS" ]; then

    echo "crlutil -d $PKITSdb -I -f ${PKITSdb}/pw -i $crls/$*"

    ${BINDIR}/crlutil -d ${PKITSdb} -I -f ${PKITSdb}/pw -i $crls/$* > ${PKITSDIR}/cmdout.txt 2>&1

    RET=$?

    cat ${PKITSDIR}/cmdout.txt

    if [ "$RET" -ne 0 ]; then

        html_failed "${VFY_ACTION} ($RET) "

        pkits_log "ERROR: ${VFY_ACTION} failed $RET"

    fi

  fi

}

################################ crlImportn #############################

# local shell function to import an incorrect CRL, calls crlutil -I -i, 

# writes action and options to stdout

########################################################################

crlImportn()

{

  RET=0

  if [ -z "$NSS_NO_PKITS_CRLS" ]; then

    echo "crlutil -d $PKITSdb -I -f ${PKITSdb}/pw -i $crls/$*"

    ${BINDIR}/crlutil -d ${PKITSdb} -I -f ${PKITSdb}/pw -i $crls/$* > ${PKITSDIR}/cmdout.txt 2>&1

    RET=$?

    cat ${PKITSDIR}/cmdout.txt

    if [ "$RET" -eq 0 ]; then

        html_failed "${VFY_ACTION} ($RET) "

        pkits_log "ERROR: ${VFY_ACTION} failed $RET"

    else

        html_passed "${VFY_ACTION} ($RET) "

        pkits_log "SUCCESS: ${VFY_ACTION} returned as expected $RET"

    fi

  fi

  return $RET

}

################################ certImport #############################

# local shell function to import a Cert, calls certutil -A, writes 

# action and options to stdout

########################################################################

certImport()

{

  echo "certutil -d $PKITSdb -A -t \",,\" -n $* -i $certs/$*.crt"

  ${BINDIR}/certutil -d $PKITSdb -A -t ",," -n $* -i $certs/$*.crt > ${PKITSDIR}/cmdout.txt 2>&1

  RET=$?

  cat ${PKITSDIR}/cmdout.txt

  if [ "$RET" -ne 0 ]; then

      html_failed "${VFY_ACTION} ($RET) "

      pkits_log "ERROR: ${VFY_ACTION} failed $RET"

  fi

}

################################ certImportn #############################

# local shell function to import an incorrect Cert, calls certutil -A, 

# writes action and options to stdout

########################################################################

certImportn()

{

  RET=0

  if [ -z "$NSS_NO_PKITS_CRLS" ]; then

    echo "certutil -d $PKITSdb -A -t \",,\" -n $* -i $certs/$*.crt"

    ${BINDIR}/certutil -d $PKITSdb -A -t ",," -n $* -i $certs/$*.crt > ${PKITSDIR}/cmdout.txt 2>&1

    RET=$?

    cat ${PKITSDIR}/cmdout.txt

    if [ "$RET" -eq 0 ]; then

        html_failed "${VFY_ACTION} ($RET) "

        pkits_log "ERROR: ${VFY_ACTION} failed $RET"

    else

        html_passed "${VFY_ACTION} ($RET) "

        pkits_log "SUCCESS: ${VFY_ACTION} returned as expected $RET"

    fi

  fi

}

############################## pkits_tests_bySection ###################

# running the various PKITS tests

########################################################################

pkits_SignatureVerification()

{

  start_table "NIST PKITS Section 4.1: Signature Verification"

  VFY_ACTION="Valid Signatures Test1"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkits $certs/ValidCertificatePathTest1EE.crt $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Invalid CA Signature Test2"; log_banner

  certImport BadSignedCACert

  crlImport BadSignedCACRL.crl

  pkitsn $certs/InvalidCASignatureTest2EE.crt \

    $certs/BadSignedCACert.crt

  restore_db

  VFY_ACTION="Invalid EE Signature Test3"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkitsn $certs/InvalidEESignatureTest3EE.crt $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Valid DSA Signatures Test4"; log_banner

  certImport DSACACert

  crlImport DSACACRL.crl

  pkits $certs/ValidDSASignaturesTest4EE.crt $certs/DSACACert.crt

  restore_db

  VFY_ACTION="Valid DSA Parameter Inheritance Test5"; log_banner

  certImport DSACACert

  crlImport DSACACRL.crl

  certImport DSAParametersInheritedCACert

  crlImport DSAParametersInheritedCACRL.crl

  pkits $certs/ValidDSAParameterInheritanceTest5EE.crt \

      $certs/DSAParametersInheritedCACert.crt \

      $certs/DSACACert.crt

  restore_db

  VFY_ACTION="Invalid DSA Signature Test6"; log_banner

  certImport DSACACert

  crlImport DSACACRL.crl

  pkitsn $certs/InvalidDSASignatureTest6EE.crt $certs/DSACACert.crt

  restore_db

}

pkits_ValidityPeriods()

{

  break_table "NIST PKITS Section 4.2: Validity Periods"

  VFY_ACTION="Invalid CA notBefore Date Test1"; log_banner

  certImport BadnotBeforeDateCACert

  crlImportn BadnotBeforeDateCACRL.crl

  if [ $RET -eq 0 ] ; then 

      pkitsn $certs/InvalidCAnotBeforeDateTest1EE.crt \

          $certs/BadnotBeforeDateCACert.crt

  fi

  restore_db

  VFY_ACTION="Invalid EE notBefore Date Test2"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkitsn $certs/InvalidEEnotBeforeDateTest2EE.crt \

      $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Valid pre2000 UTC notBefore Date Test3"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkits $certs/Validpre2000UTCnotBeforeDateTest3EE.crt \

      $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Valid GeneralizedTime notBefore Date Test4"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkits $certs/ValidGeneralizedTimenotBeforeDateTest4EE.crt \

      $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Invalid CA notAfter Date Test5"; log_banner

  certImport BadnotAfterDateCACert

  crlImportn BadnotAfterDateCACRL.crl

  if [ $RET -eq 0 ] ; then 

      pkitsn $certs/InvalidCAnotAfterDateTest5EE.crt \

          $certs/BadnotAfterDateCACert.crt

  fi

  restore_db

  VFY_ACTION="Invalid EE notAfter Date Test6"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkitsn $certs/InvalidEEnotAfterDateTest6EE.crt \

      $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Invalid pre2000 UTC EE notAfter Date Test7"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkitsn $certs/Invalidpre2000UTCEEnotAfterDateTest7EE.crt \

      $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="ValidGeneralizedTime notAfter Date Test8"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkits $certs/ValidGeneralizedTimenotAfterDateTest8EE.crt \

      $certs/GoodCACert.crt

  restore_db

}

pkits_NameChaining()

{

  break_table "NIST PKITS Section 4.3: Verifying NameChaining"

  VFY_ACTION="Invalid Name Chaining EE Test1"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkitsn $certs/InvalidNameChainingTest1EE.crt \

      $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Invalid Name Chaining Order Test2"; log_banner

  certImport NameOrderingCACert

  crlImport NameOrderCACRL.crl

  pkitsn $certs/InvalidNameChainingOrderTest2EE.crt \

      $certs/NameOrderingCACert.crt

  restore_db

### bug 216123 ###

if [ -n "${KNOWN_BUG}" ]; then

  VFY_ACTION="Valid Name Chaining Whitespace Test3"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkits $certs/ValidNameChainingWhitespaceTest3EE.crt \

      $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Valid Name Chaining Whitespace Test4"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkits $certs/ValidNameChainingWhitespaceTest4EE.crt \

      $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Valid Name Chaining Capitalization Test5"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkits $certs/ValidNameChainingCapitalizationTest5EE.crt \

      $certs/GoodCACert.crt

  restore_db

fi

  VFY_ACTION="Valid Name Chaining UIDs Test6"; log_banner

  certImport UIDCACert

  crlImport UIDCACRL.crl

  pkits $certs/ValidNameUIDsTest6EE.crt $certs/UIDCACert.crt

  restore_db

  VFY_ACTION="Valid RFC3280 Mandatory Attribute Types Test7"; log_banner

  certImport RFC3280MandatoryAttributeTypesCACert

  crlImport RFC3280MandatoryAttributeTypesCACRL.crl

  pkits $certs/ValidRFC3280MandatoryAttributeTypesTest7EE.crt \

      $certs/RFC3280MandatoryAttributeTypesCACert.crt

  restore_db

  VFY_ACTION="Valid RFC3280 Optional Attribute Types Test8"; log_banner

  certImport RFC3280OptionalAttributeTypesCACert

  crlImport RFC3280OptionalAttributeTypesCACRL.crl

  pkits $certs/ValidRFC3280OptionalAttributeTypesTest8EE.crt \

      $certs/RFC3280OptionalAttributeTypesCACert.crt

  restore_db

  VFY_ACTION="Valid UTF8String Encoded Names Test9"; log_banner

  certImport UTF8StringEncodedNamesCACert

  crlImport UTF8StringEncodedNamesCACRL.crl

  pkits $certs/ValidUTF8StringEncodedNamesTest9EE.crt \

      $certs/UTF8StringEncodedNamesCACert.crt

  restore_db

### bug 216123 ###

if [ -n "${KNOWN_BUG}" ]; then

  VFY_ACTION="Valid Rollover from PrintableString to UTF8String Test10"; log_banner

  certImport RolloverfromPrintableStringtoUTF8StringCACert

  crlImport RolloverfromPrintableStringtoUTF8StringCACRL.crl

  pkits $certs/ValidRolloverfromPrintableStringtoUTF8StringTest10EE.crt \

      $certs/RolloverfromPrintableStringtoUTF8StringCACert.crt

  restore_db

  VFY_ACTION="Valid UTF8String case Insensitive Match Test11"; log_banner

  certImport UTF8StringCaseInsensitiveMatchCACert

  crlImport UTF8StringCaseInsensitiveMatchCACRL.crl

  pkits $certs/ValidUTF8StringCaseInsensitiveMatchTest11EE.crt \

      $certs/UTF8StringCaseInsensitiveMatchCACert.crt

  restore_db

fi

}

pkits_BasicCertRevocation()

{

  break_table "NIST PKITS Section 4.4: Basic Certificate Revocation Tests"

### bug 414556 ###

if [ -n "${KNOWN_BUG}" ]; then

  VFY_ACTION="Missing CRL Test1"; log_banner

  pkitsn $certs/InvalidMissingCRLTest1EE.crt \

      $certs/NoCRLCACert.crt

fi

  VFY_ACTION="Invalid Revoked CA Test2"; log_banner

  certImport RevokedsubCACert

  crlImport RevokedsubCACRL.crl

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkitsn $certs/InvalidRevokedCATest2EE.crt \

     $certs/RevokedsubCACert.crt $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Invalid Revoked EE Test3"; log_banner

  certImport GoodCACert

  crlImport GoodCACRL.crl

  pkitsn $certs/InvalidRevokedEETest3EE.crt \

     $certs/GoodCACert.crt

  restore_db

  VFY_ACTION="Invalid Bad CRL Signature Test4"; log_banner

  certImport BadCRLSignatureCACert

  crlImportn BadCRLSignatureCACRL.crl

  if [ $RET -eq 0 ] ; then 

      pkitsn $certs/InvalidBadCRLSignatureTest4EE.crt \

          $certs/BadCRLSignatureCACert.crt

  fi

  restore_db

  VFY_ACTION="Invalid Bad CRL Issuer Name Test5"; log_banner

  certImport BadCRLIssuerNameCACert

  crlImportn BadCRLIssuerNameCACRL.crl

  if [ $RET -eq 0 ] ; then 

      pkitsn $certs/InvalidBadCRLIssuerNameTest5EE.crt \

          $certs/BadCRLIssuerNameCACert.crt

  fi

  restore_db

### bug 414556 ###

if [ -n "${KNOWN_BUG}" ]; then

  VFY_ACTION="Invalid Wrong CRL Test6"; log_banner

  certImport WrongCRLCACert

  crlImport WrongCRLCACRL.crl

  pkitsn $certs/InvalidWrongCRLTest6EE.crt \

      $certs/WrongCRLCACert.crt

  restore_db

fi

  VFY_ACTION="Valid Two CRLs Test7"; log_banner

  certImport TwoCRLsCACert

  crlImport TwoCRLsCAGoodCRL.crl

  crlImportn TwoCRLsCABadCRL.crl

  pkits $certs/ValidTwoCRLsTest7EE.crt \

     $certs/TwoCRLsCACert.crt

  restore_db

  VFY_ACTION="Invalid Unknown CRL Entry Extension Test8"; log_banner

  certImport UnknownCRLEntryExtensionCACert

  crlImportn UnknownCRLEntryExtensionCACRL.crl

  if [ $RET -eq 0 ] ; then 

      pkitsn $certs/InvalidUnknownCRLEntryExtensionTest8EE.crt \

          $certs/UnknownCRLEntryExtensionCACert.crt

  fi

  restore_db

  VFY_ACTION="Invalid Unknown CRL Extension Test9"; log_banner

  certImport UnknownCRLExtensionCACert

  crlImportn UnknownCRLExtensionCACRL.crl

  if [ $RET -eq 0 ] ; then 

      pkitsn $certs/InvalidUnknownCRLExtensionTest9EE.crt \

          $certs/UnknownCRLExtensionCACert.crt

  fi

  restore_db

  VFY_ACTION="Invalid Unknown CRL Extension Test10"; log_banner

  certImport UnknownCRLExtensionCACert

  crlImportn UnknownCRLExtensionCACRL.crl

  if [ $RET -eq 0 ] ; then 

      pkitsn $certs/InvalidUnknownCRLExtensionTest10EE.crt \

          $certs/UnknownCRLExtensionCACert.crt

  fi

  restore_db

### bug 414563 ###

if [ -n "${KNOWN_BUG}" ]; then

  VFY_ACTION="Invalid Old CRL nextUpdate Test11"; log_banner

  certImport OldCRLnextUpdateCACert

  crlImport OldCRLnextUpdateCACRL.crl

  pkitsn $certs/InvalidOldCRLnextUpdateTest11EE.crt \

     $certs/OldCRLnextUpdateCACert.crt

  restore_db

  VFY_ACTION="Invalid pre2000 CRL nextUpdate Test12"; log_banner

  certImport pre2000CRLnextUpdateCACert

  crlImport pre2000CRLnextUpdateCACRL.crl

  pkitsn $certs/Invalidpre2000CRLnextUpdateTest12EE.crt \

     $certs/pre2000CRLnextUpdateCACert.crt

  restore_db

fi

  VFY_ACTION="Valid GeneralizedTime CRL nextUpdate Test13"; log_banner

  certImport GeneralizedTimeCRLnextUpdateCACert

  crlImport GeneralizedTimeCRLnextUpdateCACRL.crl

  pkits $certs/ValidGeneralizedTimeCRLnextUpdateTest13EE.crt \

     $certs/GeneralizedTimeCRLnextUpdateCACert.crt

  restore_db

  VFY_ACTION="Valid Negative Serial Number Test14"; log_banner

  certImport NegativeSerialNumberCACert

  crlImport NegativeSerialNumberCACRL.crl

  pkits $certs/ValidNegativeSerialNumberTest14EE.crt \

     $certs/NegativeSerialNumberCACert.crt

  restore_db

  VFY_ACTION="Invalid Negative Serial Number Test15"; log_banner

  certImport NegativeSerialNumberCACert

  crlImport NegativeSerialNumberCACRL.crl

  pkitsn $certs/InvalidNegativeSerialNumberTest15EE.crt \

     $certs/NegativeSerialNumberCACert.crt

  restore_db

  VFY_ACTION="Valid Long Serial Number Test16"; log_banner

  certImport LongSerialNumberCACert

  crlImport LongSerialNumberCACRL.crl

  pkits $certs/ValidLongSerialNumberTest16EE.crt \

     $certs/LongSerialNumberCACert.crt

  restore_db

  VFY_ACTION="Valid Long Serial Number Test17"; log_banner

  certImport LongSerialNumberCACert

  crlImport LongSerialNumberCACRL.crl

  pkits $certs/ValidLongSerialNumberTest17EE.crt \

     $certs/LongSerialNumberCACert.crt

  restore_db

  VFY_ACTION="Invalid Long Serial Number Test18"; log_banner

  certImport LongSerialNumberCACert

  crlImport LongSerialNumberCACRL.crl

  pkitsn $certs/InvalidLongSerialNumberTest18EE.crt \

     $certs/LongSerialNumberCACert.crt

  restore_db

### bug 232737 ###

if [ -n "${KNOWN_BUG}" ]; then

  VFY_ACTION="Valid Separate Certificate and CRL Keys Test19"; log_banner

  certImport SeparateCertificateandCRLKeysCertificateSigningCACert

  certImport SeparateCertificateandCRLKeysCRLSigningCert

  crlImport SeparateCertificateandCRLKeysCRL.crl

  pkits $certs/ValidSeparateCertificateandCRLKeysTest19EE.crt \

     $certs/SeparateCertificateandCRLKeysCRLSigningCert.crt

  restore_db

  VFY_ACTION="Invalid Separate Certificate and CRL Keys Test20"; log_banner

  certImport SeparateCertificateandCRLKeysCertificateSigningCACert

  certImport SeparateCertificateandCRLKeysCRLSigningCert

  crlImport SeparateCertificateandCRLKeysCRL.crl

  pkits $certs/InvalidSeparateCertificateandCRLKeysTest20EE.crt \

     $certs/SeparateCertificateandCRLKeysCRLSigningCert.crt

  restore_db

  VFY_ACTION="Invalid Separate Certificate and CRL Keys Test21"; log_banner

  certImport SeparateCertificateandCRLKeysCA2CertificateSigningCACert

  certImport SeparateCertificateandCRLKeysCA2CRLSigningCert

  crlImport SeparateCertificateandCRLKeysCA2CRL.crl

  pkits $certs/InvalidSeparateCertificateandCRLKeysTest21EE.crt \

     $certs/SeparateCertificateandCRLKeysCA2CRLSigningCert.crt

  restore_db

fi

}

pkits_PathVerificWithSelfIssuedCerts()

{

  break_table "NIST PKITS Section 4.5: Self-Issued Certificates"

### bug 232737 ###

if [ -n "${KNOWN_BUG}" ]; then

  VFY_ACTION="Valid Basic Self-Issued Old With New Test1"; log_banner

  certImport BasicSelfIssuedNewKeyCACert

  crlImport BasicSelfIssuedNewKeyCACRL.crl

  pkits $certs/ValidBasicSelfIssuedOldWithNewTest1EE.crt \

      $certs/BasicSelfIssuedNewKeyOldWithNewCACert.crt \

      $certs/BasicSelfIssuedNewKeyCACert.crt

  restore_db

  VFY_ACTION="Invalid Basic Self-Issued Old With New Test2"; log_banner

  certImport BasicSelfIssuedNewKeyCACert

  crlImport BasicSelfIssuedNewKeyCACRL.crl

  pkitsn $certs/InvalidBasicSelfIssuedOldWithNewTest2EE.crt \

      $certs/BasicSelfIssuedNewKeyOldWithNewCACert.crt \

      $certs/BasicSelfIssuedNewKeyCACert.crt

  restore_db

fi

### bugs 321755 & 418769 ###

if [ -n "${KNOWN_BUG}" ]; then

  VFY_ACTION="Valid Basic Self-Issued New With Old Test3"; log_banner

  certImport BasicSelfIssuedOldKeyCACert

  crlImport BasicSelfIssuedOldKeyCACRL.crl

  pkits $certs/ValidBasicSelfIssuedNewWithOldTest3EE.crt \

      $certs/BasicSelfIssuedOldKeyNewWithOldCACert.crt \

      $certs/BasicSelfIssuedOldKeyCACert.crt

  restore_db

  VFY_ACTION="Valid Basic Self-Issued New With Old Test4"; log_banner

  certImport BasicSelfIssuedOldKeyCACert

  crlImport BasicSelfIssuedOldKeyCACRL.crl

  pkits $certs/ValidBasicSelfIssuedNewWithOldTest4EE.crt \

      $certs/BasicSelfIssuedOldKeyNewWithOldCACert.crt \

      $certs/BasicSelfIssuedOldKeyCACert.crt

  restore_db

  VFY_ACTION="Invalid Basic Self-Issued New With Old Test5"; log_banner

  certImport BasicSelfIssuedOldKeyCACert

  crlImport BasicSelfIssuedOldKeyCACRL.crl

  pkitsn $certs/InvalidBasicSelfIssuedNewWithOldTest5EE.crt \

      $certs/BasicSelfIssuedOldKeyNewWithOldCACert.crt \

      $certs/BasicSelfIssuedOldKeyCACert.crt

  restore_db

  VFY_ACTION="Valid Basic Self-Issued CRL Signing Key Test6"; log_banner

  certImport BasicSelfIssuedCRLSigningKeyCACert

  crlImport BasicSelfIssuedOldKeyCACRL.crl

  pkits $certs/ValidBasicSelfIssuedCRLSigningKeyTest6EE.crt \

      $certs/BasicSelfIssuedCRLSigningKeyCRLCert.crt \

      $certs/BasicSelfIssuedCRLSigningKeyCACert.crt

  restore_db

  VFY_ACTION="Invalid Basic Self-Issued CRL Signing Key Test7"; log_banner

  certImport BasicSelfIssuedCRLSigningKeyCACert

  crlImport BasicSelfIssuedOldKeyCACRL.crl

  pkitsn $certs/InvalidBasicSelfIssuedCRLSigningKeyTest7EE.crt \

      $certs/BasicSelfIssuedCRLSigningKeyCRLCert.crt \

      $certs/BasicSelfIssuedCRLSigningKeyCACert.crt

  restore_db

  VFY_ACTION="Invalid Basic Self-Issued CRL Signing Key Test8"; log_banner

  certImport BasicSelfIssuedCRLSigningKeyCACert

  crlImport BasicSelfIssuedOldKeyCACRL.crl

  pkitsn $certs/InvalidBasicSelfIssuedCRLSigningKeyTest8EE.crt \

      $certs/BasicSelfIssuedCRLSigningKeyCRLCert.crt \

      $certs/BasicSelfIssuedCRLSigningKeyCACert.crt

  restore_db

fi

}

pkits_BasicConstraints()

{

  break_table "NIST PKITS Section 4.6: Verifying Basic Constraints"

  VFY_ACTION="Invalid Missing basicConstraints Test1"; log_banner

  certImport MissingbasicConstraintsCACert

  crlImport MissingbasicConstraintsCACRL.crl

  pkitsn $certs/InvalidMissingbasicConstraintsTest1EE.crt \

      $certs/MissingbasicConstraintsCACert.crt

  restore_db

  VFY_ACTION="Invalid cA False Test2"; log_banner

  certImport basicConstraintsCriticalcAFalseCACert

  crlImport basicConstraintsCriticalcAFalseCACRL.crl

  pkitsn $certs/InvalidcAFalseTest2EE.crt \

      $certs/basicConstraintsCriticalcAFalseCACert.crt

  restore_db

  VFY_ACTION="Invalid cA False Test3"; log_banner

  certImport basicConstraintsNotCriticalcAFalseCACert

  crlImport basicConstraintsNotCriticalcAFalseCACRL.crl

  pkitsn $certs/InvalidcAFalseTest3EE.crt \

      $certs/basicConstraintsNotCriticalcAFalseCACert.crt

  restore_db

  VFY_ACTION="Valid basicConstraints Not Critical Test4"; log_banner

  certImport basicConstraintsNotCriticalCACert

  crlImport basicConstraintsNotCriticalCACRL.crl

  pkits $certs/ValidbasicConstraintsNotCriticalTest4EE.crt \

      $certs/basicConstraintsNotCriticalCACert.crt

  restore_db

  VFY_ACTION="Invalid pathLenConstraint Test5"; log_banner

  certImport pathLenConstraint0CACert

  crlImport pathLenConstraint0CACRL.crl

  certImport pathLenConstraint0subCACert

  crlImport pathLenConstraint0subCACRL.crl

  pkitsn $certs/InvalidpathLenConstraintTest5EE.crt \

      $certs/pathLenConstraint0subCACert.crt \

      $certs/pathLenConstraint0CACert.crt

  restore_db

  VFY_ACTION="Invalid pathLenConstraint Test6"; log_banner

  certImport pathLenConstraint0CACert

  crlImport pathLenConstraint0CACRL.crl

  certImport pathLenConstraint0subCACert

  crlImport pathLenConstraint0subCACRL.crl

  pkitsn $certs/InvalidpathLenConstraintTest6EE.crt \

      $certs/pathLenConstraint0subCACert.crt \

      $certs/pathLenConstraint0CACert.crt

  restore_db

  VFY_ACTION="Valid pathLenConstraint Test7"; log_banner

  certImport pathLenConstraint0CACert

  crlImport pathLenConstraint0CACRL.crl

  pkits $certs/ValidpathLenConstraintTest7EE.crt \

      $certs/pathLenConstraint0CACert.crt

  restore_db

  VFY_ACTION="Valid pathLenConstraint test8"; log_banner

  certImport pathLenConstraint0CACert

  crlImport pathLenConstraint0CACRL.crl

  pkits $certs/ValidpathLenConstraintTest8EE.crt \

      $certs/pathLenConstraint0CACert.crt

  restore_db

  VFY_ACTION="Invalid pathLenConstraint Test9"; log_banner

  certImport pathLenConstraint6CACert

  crlImport pathLenConstraint6CACRL.crl

  certImport pathLenConstraint6subCA0Cert

  crlImport pathLenConstraint6subCA0CRL.crl

  certImport pathLenConstraint6subsubCA00Cert

  crlImport pathLenConstraint6subsubCA00CRL.crl

  pkitsn $certs/InvalidpathLenConstraintTest9EE.crt \

      $certs/pathLenConstraint6subsubCA00Cert.crt \

      $certs/pathLenConstraint6subCA0Cert.crt \

      $certs/pathLenConstraint6CACert.crt

  restore_db

  VFY_ACTION="Invalid pathLenConstraint Test10"; log_banner

  certImport pathLenConstraint6CACert

  crlImport pathLenConstraint6CACRL.crl

  certImport pathLenConstraint6subCA0Cert

  crlImport pathLenConstraint6subCA0CRL.crl

  certImport pathLenConstraint6subsubCA00Cert

  crlImport pathLenConstraint6subsubCA00CRL.crl

  pkitsn $certs/InvalidpathLenConstraintTest10EE.crt \

      $certs/pathLenConstraint6subsubCA00Cert.crt \

      $certs/pathLenConstraint6subCA0Cert.crt \

      $certs/pathLenConstraint6CACert.crt

  restore_db

  VFY_ACTION="Invalid pathLenConstraint Test11"; log_banner

  certImport pathLenConstraint6CACert

  crlImport pathLenConstraint6CACRL.crl

  certImport pathLenConstraint6subCA1Cert

  crlImport pathLenConstraint6subCA1CRL.crl

  certImport pathLenConstraint6subsubCA11Cert

  crlImport pathLenConstraint6subsubCA11CRL.crl

  certImport pathLenConstraint6subsubsubCA11XCert

  crlImport pathLenConstraint6subsubsubCA11XCRL.crl

  pkitsn $certs/InvalidpathLenConstraintTest11EE.crt \

      $certs/pathLenConstraint6subsubsubCA11XCert.crt \

      $certs/pathLenConstraint6subsubCA11Cert.crt \

      $certs/pathLenConstraint6subCA1Cert.crt \

      $certs/pathLenConstraint6CACert.crt

  restore_db

  VFY_ACTION="Invalid pathLenConstraint test12"; log_banner

  certImport pathLenConstraint6CACert

  crlImport pathLenConstraint6CACRL.crl

  certImport pathLenConstraint6subCA1Cert

  crlImport pathLenConstraint6subCA1CRL.crl

  certImport pathLenConstraint6subsubCA11Cert

  crlImport pathLenConstraint6subsubCA11CRL.crl

  certImport pathLenConstraint6subsubsubCA11XCert

  crlImport pathLenConstraint6subsubsubCA11XCRL.crl

  pkitsn $certs/InvalidpathLenConstraintTest12EE.crt \

      $certs/pathLenConstraint6subsubsubCA11XCert.crt \

      $certs/pathLenConstraint6subsubCA11Cert.crt \

      $certs/pathLenConstraint6subCA1Cert.crt \

      $certs/pathLenConstraint6CACert.crt

  restore_db

  VFY_ACTION="Valid pathLenConstraint Test13"; log_banner

  certImport pathLenConstraint6CACert

  crlImport pathLenConstraint6CACRL.crl

  certImport pathLenConstraint6subCA4Cert

  crlImport pathLenConstraint6subCA4CRL.crl

  certImport pathLenConstraint6subsubCA41Cert

  crlImport pathLenConstraint6subsubCA41CRL.crl

  certImport pathLenConstraint6subsubsubCA41XCert

  crlImport pathLenConstraint6subsubsubCA41XCRL.crl

  pkits $certs/ValidpathLenConstraintTest13EE.crt \

      $certs/pathLenConstraint6subsubsubCA41XCert.crt \

      $certs/pathLenConstraint6subsubCA41Cert.crt \

      $certs/pathLenConstraint6subCA4Cert.crt \

      $certs/pathLenConstraint6CACert.crt

  restore_db

  VFY_ACTION="Valid pathLenConstraint Test14"; log_banner

  certImport pathLenConstraint6CACert

  crlImport pathLenConstraint6CACRL.crl

  certImport pathLenConstraint6subCA4Cert

  crlImport pathLenConstraint6subCA4CRL.crl

  certImport pathLenConstraint6subsubCA41Cert