chains.sh (37267B)
1 #!/bin/bash 2 # 3 # This Source Code Form is subject to the terms of the Mozilla Public 4 # License, v. 2.0. If a copy of the MPL was not distributed with this 5 # file, You can obtain one at http://mozilla.org/MPL/2.0/. 6 7 ######################################################################## 8 # 9 # mozilla/security/nss/tests/cert/chains.sh 10 # 11 # Script to test certificate chains validity. 12 # 13 # needs to work on all Unix and Windows platforms 14 # 15 # special strings 16 # --------------- 17 # FIXME ... known problems, search for this string 18 # NOTE .... unexpected behavior 19 ######################################################################## 20 21 ########################### is_httpserv_alive ########################## 22 # local shell function to exit with a fatal error if selfserver is not 23 # running 24 ######################################################################## 25 is_httpserv_alive() 26 { 27 if [ ! -f "${HTTPPID}" ]; then 28 echo "$SCRIPTNAME: Error - httpserv PID file ${HTTPPID} doesn't exist" 29 sleep 5 30 if [ ! -f "${HTTPPID}" ]; then 31 Exit 9 "Fatal - httpserv pid file ${HTTPPID} does not exist" 32 fi 33 fi 34 35 if [ "${OS_ARCH}" = "WINNT" ] && \ 36 [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then 37 PID=${SHELL_HTTPPID} 38 else 39 PID=`cat ${HTTPPID}` 40 fi 41 42 echo "kill -0 ${PID} >/dev/null 2>/dev/null" 43 kill -0 ${PID} >/dev/null 2>/dev/null || Exit 10 "Fatal - httpserv process not detectable" 44 45 echo "httpserv with PID ${PID} found at `date`" 46 } 47 48 ########################### wait_for_httpserv ########################## 49 # local shell function to wait until httpserver is running and initialized 50 ######################################################################## 51 wait_for_httpserv() 52 { 53 echo "trying to connect to httpserv at `date`" 54 echo "tstclnt -4 -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v" 55 ${BINDIR}/tstclnt -4 -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v 56 if [ $? -ne 0 ]; then 57 sleep 5 58 echo "retrying to connect to httpserv at `date`" 59 echo "tstclnt -4 -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v" 60 ${BINDIR}/tstclnt -4 -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v 61 if [ $? -ne 0 ]; then 62 html_failed "Waiting for Server" 63 fi 64 fi 65 is_httpserv_alive 66 } 67 68 ########################### kill_httpserv ############################## 69 # local shell function to kill the httpserver after the tests are done 70 ######################################################################## 71 kill_httpserv() 72 { 73 if [ "${OS_ARCH}" = "WINNT" ] && \ 74 [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then 75 PID=${SHELL_HTTPPID} 76 else 77 PID=`cat ${HTTPPID}` 78 fi 79 80 echo "trying to kill httpserv with PID ${PID} at `date`" 81 82 if [ "${OS_ARCH}" = "WINNT" ]; then 83 echo "${KILL} ${PID}" 84 ${KILL} ${PID} 85 else 86 echo "${KILL} -USR1 ${PID}" 87 ${KILL} -USR1 ${PID} 88 fi 89 wait ${PID} 90 91 # On Linux httpserv needs up to 30 seconds to fully die and free 92 # the port. Wait until the port is free. (Bug 129701) 93 if [ "${OS_ARCH}" = "Linux" ]; then 94 echo "httpserv -b -p ${NSS_AIA_PORT} 2>/dev/null;" 95 until ${BINDIR}/httpserv -b -p ${NSS_AIA_PORT} 2>/dev/null; do 96 echo "RETRY: httpserv -b -p ${NSS_AIA_PORT} 2>/dev/null;" 97 sleep 1 98 done 99 fi 100 101 echo "httpserv with PID ${PID} killed at `date`" 102 103 rm ${HTTPPID} 104 html_detect_core "kill_httpserv core detection step" 105 } 106 107 ########################### start_httpserv ############################# 108 # local shell function to start the httpserver with the parameters required 109 # for this test and log information (parameters, start time) 110 # also: wait until the server is up and running 111 ######################################################################## 112 start_httpserv() 113 { 114 HTTP_METHOD=$1 115 116 if [ -n "$testname" ] ; then 117 echo "$SCRIPTNAME: $testname ----" 118 fi 119 echo "httpserv starting at `date`" 120 ODDIR="${HOSTDIR}/chains/OCSPD" 121 echo "httpserv -D -p ${NSS_AIA_PORT} ${SERVER_OPTIONS} \\" 122 echo " -A OCSPRoot -C ${ODDIR}/OCSPRoot.crl -A OCSPCA1 -C ${ODDIR}/OCSPCA1.crl \\" 123 echo " -A OCSPCA2 -C ${ODDIR}/OCSPCA2.crl -A OCSPCA3 -C ${ODDIR}/OCSPCA3.crl \\" 124 echo " -O ${HTTP_METHOD} -d ${ODDIR}/ServerDB/ -f ${ODDIR}/ServerDB/dbpasswd \\" 125 echo " -i ${HTTPPID} $verbose &" 126 ${PROFTOOL} ${BINDIR}/httpserv -D -p ${NSS_AIA_PORT} ${SERVER_OPTIONS} \ 127 -A OCSPRoot -C ${ODDIR}/OCSPRoot.crl -A OCSPCA1 -C ${ODDIR}/OCSPCA1.crl \ 128 -A OCSPCA2 -C ${ODDIR}/OCSPCA2.crl -A OCSPCA3 -C ${ODDIR}/OCSPCA3.crl \ 129 -O ${HTTP_METHOD} -d ${ODDIR}/ServerDB/ -f ${ODDIR}/ServerDB/dbpasswd \ 130 -i ${HTTPPID} $verbose & 131 RET=$? 132 133 # The PID $! returned by the MKS or Cygwin shell is not the PID of 134 # the real background process, but rather the PID of a helper 135 # process (sh.exe). MKS's kill command has a bug: invoking kill 136 # on the helper process does not terminate the real background 137 # process. Our workaround has been to have httpserv save its PID 138 # in the ${HTTPPID} file and "kill" that PID instead. But this 139 # doesn't work under Cygwin; its kill command doesn't recognize 140 # the PID of the real background process, but it does work on the 141 # PID of the helper process. So we save the value of $! in the 142 # SHELL_HTTPPID variable, and use it instead of the ${HTTPPID} 143 # file under Cygwin. (In fact, this should work in any shell 144 # other than the MKS shell.) 145 SHELL_HTTPPID=$! 146 wait_for_httpserv 147 148 if [ "${OS_ARCH}" = "WINNT" ] && \ 149 [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then 150 PID=${SHELL_HTTPPID} 151 else 152 PID=`cat ${HTTPPID}` 153 fi 154 155 echo "httpserv with PID ${PID} started at `date`" 156 } 157 158 ############################# chains_init ############################## 159 # local shell function to initialize this script 160 ######################################################################## 161 chains_init() 162 { 163 if [ -z "${CLEANUP}" ] ; then # if nobody else is responsible for 164 CLEANUP="${SCRIPTNAME}" # cleaning this script will do it 165 fi 166 if [ -z "${INIT_SOURCED}" ] ; then 167 cd ../common 168 . ./init.sh 169 fi 170 171 SCRIPTNAME="chains.sh" 172 173 CHAINS_DIR="${HOSTDIR}/chains" 174 mkdir -p ${CHAINS_DIR} 175 cd ${CHAINS_DIR} 176 177 CHAINS_SCENARIOS="${QADIR}/chains/scenarios/scenarios" 178 179 CERT_SN_CNT=$(date '+%m%d%H%M%S' | sed "s/^0*//") 180 CERT_SN_FIX=$(expr ${CERT_SN_CNT} - 1000) 181 182 PK7_NONCE=${CERT_SN_CNT} 183 SCEN_CNT=${CERT_SN_CNT} 184 185 AIA_FILES="${HOSTDIR}/aiafiles" 186 187 CU_DATA=${HOSTDIR}/cu_data 188 CRL_DATA=${HOSTDIR}/crl_data 189 190 DEFAULT_AIA_BASE_PORT=$(expr ${PORT:-8631} + 10) 191 NSS_AIA_PORT=${NSS_AIA_PORT:-$DEFAULT_AIA_BASE_PORT} 192 DEFAULT_UNUSED_PORT=$(expr ${PORT:-8631} + 11) 193 NSS_UNUSED_PORT=${NSS_UNUSED_PORT:-$DEFAULT_UNUSED_PORT} 194 NSS_AIA_HTTP=${NSS_AIA_HTTP:-"http://${HOSTADDR}:${NSS_AIA_PORT}"} 195 NSS_AIA_PATH=${NSS_AIA_PATH:-$HOSTDIR/aiahttp} 196 NSS_AIA_OCSP=${NSS_AIA_OCSP:-$NSS_AIA_HTTP/ocsp} 197 NSS_OCSP_UNUSED=${NSS_AIA_OCSP_UNUSED:-"http://${HOSTADDR}:${NSS_UNUSED_PORT}"} 198 199 html_head "Certificate Chains Tests" 200 } 201 202 chains_run_httpserv() 203 { 204 HTTP_METHOD=$1 205 206 if [ -n "${NSS_AIA_PATH}" ]; then 207 HTTPPID=${NSS_AIA_PATH}/http_pid.$$ 208 mkdir -p "${NSS_AIA_PATH}" 209 SAVEPWD=`pwd` 210 cd "${NSS_AIA_PATH}" 211 # Start_httpserv sets environment variables, which are required for 212 # correct cleanup. (Running it in a subshell doesn't work, the 213 # value of $SHELL_HTTPPID wouldn't arrive in this scope.) 214 start_httpserv ${HTTP_METHOD} 215 cd "${SAVEPWD}" 216 fi 217 } 218 219 chains_stop_httpserv() 220 { 221 if [ -n "${NSS_AIA_PATH}" ]; then 222 kill_httpserv 223 fi 224 } 225 226 ############################ chains_cleanup ############################ 227 # local shell function to finish this script (no exit since it might be 228 # sourced) 229 ######################################################################## 230 chains_cleanup() 231 { 232 html "</TABLE><BR>" 233 cd ${QADIR} 234 . common/cleanup.sh 235 } 236 237 ############################ print_cu_data ############################# 238 # local shell function to print certutil input data 239 ######################################################################## 240 print_cu_data() 241 { 242 echo "=== Certutil input data ===" 243 cat ${CU_DATA} 244 echo "===" 245 } 246 247 set_cert_sn() 248 { 249 if [ -z "${SERIAL}" ]; then 250 CERT_SN_CNT=$(expr ${CERT_SN_CNT} + 1) 251 CERT_SN=${CERT_SN_CNT} 252 else 253 echo ${SERIAL} | cut -b 1 | grep '+' > /dev/null 254 if [ $? -eq 0 ]; then 255 CERT_SN=$(echo ${SERIAL} | cut -b 2-) 256 CERT_SN=$(expr ${CERT_SN_FIX} + ${CERT_SN}) 257 else 258 CERT_SN=${SERIAL} 259 fi 260 fi 261 } 262 263 ############################# create_db ################################ 264 # local shell function to create certificate database 265 ######################################################################## 266 create_db() 267 { 268 DB=$1 269 270 [ -d "${DB}" ] && rm -rf ${DB} 271 mkdir -p ${DB} 272 273 echo "${DB}passwd" > ${DB}/dbpasswd 274 275 TESTNAME="Creating DB ${DB}" 276 echo "${SCRIPTNAME}: ${TESTNAME}" 277 echo "certutil -N -d ${DB} -f ${DB}/dbpasswd" 278 ${BINDIR}/certutil -N -d ${DB} -f ${DB}/dbpasswd 279 html_msg $? 0 "${SCENARIO}${TESTNAME}" 280 } 281 282 ########################### create_root_ca ############################# 283 # local shell function to generate self-signed root certificate 284 ######################################################################## 285 create_root_ca() 286 { 287 ENTITY=$1 288 ENTITY_DB=${ENTITY}DB 289 290 set_cert_sn 291 date >> ${NOISE_FILE} 2>&1 292 293 CTYPE_OPT= 294 if [ -n "${CTYPE}" ]; then 295 CTYPE_OPT="-k ${CTYPE}" 296 fi 297 298 echo "5 299 6 300 9 301 n 302 y 303 -1 304 n 305 5 306 6 307 7 308 9 309 n 310 " > ${CU_DATA} 311 312 TESTNAME="Creating Root CA ${ENTITY}" 313 echo "${SCRIPTNAME}: ${TESTNAME}" 314 echo "certutil -s \"CN=${ENTITY} ROOT CA, O=${ENTITY}, C=US\" -S -n ${ENTITY} ${CTYPE_OPT} -t CTu,CTu,CTu -v 600 -x -d ${ENTITY_DB} -1 -2 -5 -f ${ENTITY_DB}/dbpasswd -z ${NOISE_FILE} -m ${CERT_SN} < ${CU_DATA}" 315 print_cu_data 316 ${BINDIR}/certutil -s "CN=${ENTITY} ROOT CA, O=${ENTITY}, C=US" -S -n ${ENTITY} ${CTYPE_OPT} -t CTu,CTu,CTu -v 600 -x -d ${ENTITY_DB} -1 -2 -5 -f ${ENTITY_DB}/dbpasswd -z ${NOISE_FILE} -m ${CERT_SN} < ${CU_DATA} 317 html_msg $? 0 "${SCENARIO}${TESTNAME}" 318 319 TESTNAME="Exporting Root CA ${ENTITY}.der" 320 echo "${SCRIPTNAME}: ${TESTNAME}" 321 echo "certutil -L -d ${ENTITY_DB} -r -n ${ENTITY} -o ${ENTITY}.der" 322 ${BINDIR}/certutil -L -d ${ENTITY_DB} -r -n ${ENTITY} -o ${ENTITY}.der 323 html_msg $? 0 "${SCENARIO}${TESTNAME}" 324 } 325 326 ########################### create_cert_req ############################ 327 # local shell function to generate certificate sign request 328 ######################################################################## 329 create_cert_req() 330 { 331 ENTITY=$1 332 TYPE=$2 333 334 ENTITY_DB=${ENTITY}DB 335 336 REQ=${ENTITY}Req.der 337 338 date >> ${NOISE_FILE} 2>&1 339 340 CTYPE_OPT= 341 if [ -n "${CTYPE}" ]; then 342 CTYPE_OPT="-k ${CTYPE}" 343 fi 344 345 CA_FLAG= 346 EXT_DATA= 347 OPTIONS= 348 349 if [ "${TYPE}" != "EE" ]; then 350 CA_FLAG="-2" 351 EXT_DATA="y 352 -1 353 y 354 " 355 else 356 CA_FLAG="-2" 357 EXT_DATA="n 358 -1 359 y 360 " 361 fi 362 363 process_crldp 364 365 echo "${EXT_DATA}" > ${CU_DATA} 366 367 TESTNAME="Creating ${TYPE} certifiate request ${REQ}" 368 echo "${SCRIPTNAME}: ${TESTNAME}" 369 echo "certutil -s \"CN=${ENTITY} ${TYPE}, O=${ENTITY}, C=US\" ${CTYPE_OPT} -R ${CA_FLAG} -d ${ENTITY_DB} -f ${ENTITY_DB}/dbpasswd -z ${NOISE_FILE} -o ${REQ} ${OPTIONS} < ${CU_DATA}" 370 print_cu_data 371 ${BINDIR}/certutil -s "CN=${ENTITY} ${TYPE}, O=${ENTITY}, C=US" ${CTYPE_OPT} -R ${CA_FLAG} -d ${ENTITY_DB} -f ${ENTITY_DB}/dbpasswd -z ${NOISE_FILE} -o ${REQ} ${OPTIONS} < ${CU_DATA} 372 html_msg $? 0 "${SCENARIO}${TESTNAME}" 373 } 374 375 ############################ create_entity ############################# 376 # local shell function to create certificate chain entity 377 ######################################################################## 378 create_entity() 379 { 380 ENTITY=$1 381 TYPE=$2 382 383 if [ -z "${ENTITY}" ]; then 384 echo "Configuration error: Unnamed entity" 385 exit 1 386 fi 387 388 DB=${ENTITY}DB 389 ENTITY_DB=${ENTITY}DB 390 391 case "${TYPE}" in 392 "Root") 393 create_db "${DB}" 394 create_root_ca "${ENTITY}" 395 ;; 396 "Intermediate" | "Bridge" | "EE") 397 create_db "${DB}" 398 create_cert_req "${ENTITY}" "${TYPE}" 399 ;; 400 "*") 401 echo "Configuration error: Unknown type ${TYPE}" 402 exit 1 403 ;; 404 esac 405 } 406 407 ######################################################################## 408 # List of global variables related to certificate extensions processing: 409 # 410 # Generated by process_extensions and functions called from it: 411 # OPTIONS - list of command line policy extensions 412 # DATA - list of inpud data related to policy extensions 413 # 414 # Generated by parse_config: 415 # POLICY - list of certificate policies 416 # MAPPING - list of policy mappings 417 # INHIBIT - inhibit flag 418 # AIA - AIA list 419 ######################################################################## 420 421 ############################ process_policy ############################ 422 # local shell function to process policy extension parameters and 423 # generate input for certutil 424 ######################################################################## 425 process_policy() 426 { 427 if [ -n "${POLICY}" ]; then 428 OPTIONS="${OPTIONS} --extCP" 429 430 NEXT= 431 for ITEM in ${POLICY}; do 432 if [ -n "${NEXT}" ]; then 433 DATA="${DATA}y 434 " 435 fi 436 437 NEXT=1 438 DATA="${DATA}${ITEM} 439 1 440 441 n 442 " 443 done 444 445 DATA="${DATA}n 446 n 447 " 448 fi 449 } 450 451 ########################### process_mapping ############################ 452 # local shell function to process policy mapping parameters and 453 # generate input for certutil 454 ######################################################################## 455 process_mapping() 456 { 457 if [ -n "${MAPPING}" ]; then 458 OPTIONS="${OPTIONS} --extPM" 459 460 NEXT= 461 for ITEM in ${MAPPING}; do 462 if [ -n "${NEXT}" ]; then 463 DATA="${DATA}y 464 " 465 fi 466 467 NEXT=1 468 IDP=`echo ${ITEM} | cut -d: -f1` 469 SDP=`echo ${ITEM} | cut -d: -f2` 470 DATA="${DATA}${IDP} 471 ${SDP} 472 " 473 done 474 475 DATA="${DATA}n 476 n 477 " 478 fi 479 } 480 481 ########################### process_inhibit############################# 482 # local shell function to process inhibit extension and generate input 483 # for certutil 484 ######################################################################## 485 process_inhibit() 486 { 487 if [ -n "${INHIBIT}" ]; then 488 OPTIONS="${OPTIONS} --extIA" 489 490 DATA="${DATA}${INHIBIT} 491 n 492 " 493 fi 494 } 495 496 ############################# process_aia ############################## 497 # local shell function to process AIA extension parameters and 498 # generate input for certutil 499 ######################################################################## 500 process_aia() 501 { 502 if [ -n "${AIA}" ]; then 503 OPTIONS="${OPTIONS} --extAIA" 504 505 DATA="${DATA}1 506 " 507 508 for ITEM in ${AIA}; do 509 PK7_NONCE=`expr $PK7_NONCE + 1` 510 511 echo ${ITEM} | grep ":" > /dev/null 512 if [ $? -eq 0 ]; then 513 CERT_NICK=`echo ${ITEM} | cut -d: -f1` 514 CERT_ISSUER=`echo ${ITEM} | cut -d: -f2` 515 CERT_LOCAL="${CERT_NICK}${CERT_ISSUER}.der" 516 CERT_PUBLIC="${HOST}-$$-${CERT_NICK}${CERT_ISSUER}-${PK7_NONCE}.der" 517 else 518 CERT_LOCAL="${ITEM}.p7" 519 CERT_PUBLIC="${HOST}-$$-${ITEM}-${PK7_NONCE}.p7" 520 fi 521 522 DATA="${DATA}7 523 ${NSS_AIA_HTTP}/${CERT_PUBLIC} 524 " 525 526 if [ -n "${NSS_AIA_PATH}" ]; then 527 cp ${CERT_LOCAL} ${NSS_AIA_PATH}/${CERT_PUBLIC} 2> /dev/null 528 chmod a+r ${NSS_AIA_PATH}/${CERT_PUBLIC} 529 echo ${NSS_AIA_PATH}/${CERT_PUBLIC} >> ${AIA_FILES} 530 fi 531 done 532 533 DATA="${DATA}0 534 n 535 n" 536 fi 537 } 538 539 process_ocsp() 540 { 541 if [ -n "${OCSP}" ]; then 542 OPTIONS="${OPTIONS} --extAIA" 543 544 if [ "${OCSP}" = "offline" ]; then 545 MY_OCSP_URL=${NSS_OCSP_UNUSED} 546 else 547 MY_OCSP_URL=${NSS_AIA_OCSP} 548 fi 549 550 DATA="${DATA}2 551 7 552 ${MY_OCSP_URL} 553 0 554 n 555 n 556 " 557 fi 558 } 559 560 process_crldp() 561 { 562 if [ -n "${CRLDP}" ]; then 563 OPTIONS="${OPTIONS} -4" 564 565 EXT_DATA="${EXT_DATA}1 566 " 567 568 for ITEM in ${CRLDP}; do 569 CRL_PUBLIC="${HOST}-$$-${ITEM}-${SCEN_CNT}.crl" 570 571 EXT_DATA="${EXT_DATA}7 572 ${NSS_AIA_HTTP}/${CRL_PUBLIC} 573 " 574 done 575 576 EXT_DATA="${EXT_DATA}-1 577 -1 578 -1 579 n 580 n 581 " 582 fi 583 } 584 585 process_ku_ns_eku() 586 { 587 if [ -n "${EXT_KU}" ]; then 588 OPTIONS="${OPTIONS} --keyUsage ${EXT_KU}" 589 fi 590 if [ -n "${EXT_NS}" ]; then 591 EXT_NS_KEY=$(echo ${EXT_NS} | cut -d: -f1) 592 EXT_NS_CODE=$(echo ${EXT_NS} | cut -d: -f2) 593 594 OPTIONS="${OPTIONS} --nsCertType ${EXT_NS_KEY}" 595 DATA="${DATA}${EXT_NS_CODE} 596 -1 597 n 598 " 599 fi 600 if [ -n "${EXT_EKU}" ]; then 601 OPTIONS="${OPTIONS} --extKeyUsage ${EXT_EKU}" 602 fi 603 } 604 605 copy_crl() 606 607 { 608 if [ -z "${NSS_AIA_PATH}" ]; then 609 return; 610 fi 611 612 CRL_LOCAL="${COPYCRL}.crl" 613 CRL_PUBLIC="${HOST}-$$-${COPYCRL}-${SCEN_CNT}.crl" 614 615 cp ${CRL_LOCAL} ${NSS_AIA_PATH}/${CRL_PUBLIC} 2> /dev/null 616 chmod a+r ${NSS_AIA_PATH}/${CRL_PUBLIC} 617 echo ${NSS_AIA_PATH}/${CRL_PUBLIC} >> ${AIA_FILES} 618 } 619 620 ########################## process_extension ########################### 621 # local shell function to process entity extension parameters and 622 # generate input for certutil 623 ######################################################################## 624 process_extensions() 625 { 626 OPTIONS= 627 DATA= 628 629 process_policy 630 process_mapping 631 process_inhibit 632 process_aia 633 process_ocsp 634 process_ku_ns_eku 635 } 636 637 ############################## sign_cert ############################### 638 # local shell function to sign certificate sign reuqest 639 ######################################################################## 640 sign_cert() 641 { 642 ENTITY=$1 643 ISSUER=$2 644 TYPE=$3 645 646 [ -z "${ISSUER}" ] && return 647 648 ENTITY_DB=${ENTITY}DB 649 ISSUER_DB=${ISSUER}DB 650 REQ=${ENTITY}Req.der 651 CERT=${ENTITY}${ISSUER}.der 652 653 set_cert_sn 654 655 EMAIL_OPT= 656 if [ "${TYPE}" = "Bridge" ]; then 657 EMAIL_OPT="-7 ${ENTITY}@${ISSUER}" 658 659 [ -n "${EMAILS}" ] && EMAILS="${EMAILS}," 660 EMAILS="${EMAILS}${ENTITY}@${ISSUER}" 661 fi 662 663 process_extensions 664 665 echo "${DATA}" > ${CU_DATA} 666 667 TESTNAME="Creating certficate ${CERT} signed by ${ISSUER}" 668 echo "${SCRIPTNAME}: ${TESTNAME}" 669 echo "certutil -C -c ${ISSUER} -v 60 -d ${ISSUER_DB} -i ${REQ} -o ${CERT} -f ${ISSUER_DB}/dbpasswd -m ${CERT_SN} ${EMAIL_OPT} ${OPTIONS} < ${CU_DATA}" 670 print_cu_data 671 ${BINDIR}/certutil -C -c ${ISSUER} -v 60 -d ${ISSUER_DB} -i ${REQ} -o ${CERT} -f ${ISSUER_DB}/dbpasswd -m ${CERT_SN} ${EMAIL_OPT} ${OPTIONS} < ${CU_DATA} 672 html_msg $? 0 "${SCENARIO}${TESTNAME}" 673 674 TESTNAME="Importing certificate ${CERT} to ${ENTITY_DB} database" 675 echo "${SCRIPTNAME}: ${TESTNAME}" 676 echo "certutil -A -n ${ENTITY} -t u,u,u -d ${ENTITY_DB} -f ${ENTITY_DB}/dbpasswd -i ${CERT}" 677 ${BINDIR}/certutil -A -n ${ENTITY} -t u,u,u -d ${ENTITY_DB} -f ${ENTITY_DB}/dbpasswd -i ${CERT} 678 html_msg $? 0 "${SCENARIO}${TESTNAME}" 679 } 680 681 ############################# create_pkcs7############################## 682 # local shell function to package bridge certificates into pkcs7 683 # package 684 ######################################################################## 685 create_pkcs7() 686 { 687 ENTITY=$1 688 ENTITY_DB=${ENTITY}DB 689 690 TESTNAME="Generating PKCS7 package from ${ENTITY_DB} database" 691 echo "${SCRIPTNAME}: ${TESTNAME}" 692 echo "cmsutil -O -r \"${EMAILS}\" -d ${ENTITY_DB} > ${ENTITY}.p7" 693 ${BINDIR}/cmsutil -O -r "${EMAILS}" -d ${ENTITY_DB} > ${ENTITY}.p7 694 html_msg $? 0 "${SCENARIO}${TESTNAME}" 695 } 696 697 ############################# import_key ############################### 698 # local shell function to import private key + cert into database 699 ######################################################################## 700 import_key() 701 { 702 KEY_NAME=$1.p12 703 DB=$2 704 705 KEY_FILE=../OCSPD/${KEY_NAME} 706 707 TESTNAME="Importing p12 key ${KEY_NAME} to ${DB} database" 708 echo "${SCRIPTNAME}: ${TESTNAME}" 709 echo "${BINDIR}/pk12util -d ${DB} -i ${KEY_FILE} -k ${DB}/dbpasswd -W nssnss" 710 ${BINDIR}/pk12util -d ${DB} -i ${KEY_FILE} -k ${DB}/dbpasswd -W nssnss 711 html_msg $? 0 "${SCENARIO}${TESTNAME}" 712 } 713 714 export_key() 715 { 716 KEY_NAME=$1.p12 717 DB=$2 718 719 TESTNAME="Exporting $1 as ${KEY_NAME} from ${DB} database" 720 echo "${SCRIPTNAME}: ${TESTNAME}" 721 echo "${BINDIR}/pk12util -d ${DB} -o ${KEY_NAME} -n $1 -k ${DB}/dbpasswd -W nssnss" 722 ${BINDIR}/pk12util -d ${DB} -o ${KEY_NAME} -n $1 -k ${DB}/dbpasswd -W nssnss 723 html_msg $? 0 "${SCENARIO}${TESTNAME}" 724 } 725 726 ############################# import_cert ############################## 727 # local shell function to import certificate into database 728 ######################################################################## 729 import_cert() 730 { 731 IMPORT=$1 732 DB=$2 733 734 CERT_NICK=`echo ${IMPORT} | cut -d: -f1` 735 CERT_ISSUER=`echo ${IMPORT} | cut -d: -f2` 736 CERT_TRUST=`echo ${IMPORT} | cut -d: -f3` 737 738 if [ "${CERT_ISSUER}" = "x" ]; then 739 CERT_ISSUER= 740 CERT=${CERT_NICK}.cert 741 CERT_FILE="${QADIR}/libpkix/certs/${CERT}" 742 elif [ "${CERT_ISSUER}" = "d" ]; then 743 CERT_ISSUER= 744 CERT=${CERT_NICK}.der 745 CERT_FILE="../OCSPD/${CERT}" 746 else 747 CERT=${CERT_NICK}${CERT_ISSUER}.der 748 CERT_FILE=${CERT} 749 fi 750 751 IS_ASCII=`grep -c -- "-----BEGIN CERTIFICATE-----" ${CERT_FILE}` 752 753 ASCII_OPT= 754 if [ "${IS_ASCII}" -gt 0 ]; then 755 ASCII_OPT="-a" 756 fi 757 758 TESTNAME="Importing certificate ${CERT} to ${DB} database" 759 echo "${SCRIPTNAME}: ${TESTNAME}" 760 echo "certutil -A -n ${CERT_NICK} ${ASCII_OPT} -t \"${CERT_TRUST}\" -d ${DB} -f ${DB}/dbpasswd -i ${CERT_FILE}" 761 ${BINDIR}/certutil -A -n ${CERT_NICK} ${ASCII_OPT} -t "${CERT_TRUST}" -d ${DB} -f ${DB}/dbpasswd -i ${CERT_FILE} 762 html_msg $? 0 "${SCENARIO}${TESTNAME}" 763 } 764 765 import_crl() 766 { 767 IMPORT=$1 768 DB=$2 769 770 CRL_NICK=`echo ${IMPORT} | cut -d: -f1` 771 CRL_FILE=${CRL_NICK}.crl 772 773 if [ ! -f "${CRL_FILE}" ]; then 774 return 775 fi 776 777 TESTNAME="Importing CRL ${CRL_FILE} to ${DB} database" 778 echo "${SCRIPTNAME}: ${TESTNAME}" 779 echo "crlutil -I -d ${DB} -f ${DB}/dbpasswd -i ${CRL_FILE}" 780 ${BINDIR}/crlutil -I -d ${DB} -f ${DB}/dbpasswd -i ${CRL_FILE} 781 html_msg $? 0 "${SCENARIO}${TESTNAME}" 782 } 783 784 create_crl() 785 { 786 ISSUER=$1 787 ISSUER_DB=${ISSUER}DB 788 789 CRL=${ISSUER}.crl 790 791 DATE=$(date -u '+%Y%m%d%H%M%SZ') 792 DATE_LAST="${DATE}" 793 794 UPDATE=$(expr $(date -u '+%Y') + 1)$(date -u '+%m%d%H%M%SZ') 795 796 echo "update=${DATE}" > ${CRL_DATA} 797 echo "nextupdate=${UPDATE}" >> ${CRL_DATA} 798 799 TESTNAME="Create CRL for ${ISSUER_DB}" 800 echo "${SCRIPTNAME}: ${TESTNAME}" 801 echo "crlutil -G -d ${ISSUER_DB} -n ${ISSUER} -f ${ISSUER_DB}/dbpasswd -o ${CRL}" 802 echo "=== Crlutil input data ===" 803 cat ${CRL_DATA} 804 echo "===" 805 ${BINDIR}/crlutil -G -d ${ISSUER_DB} -n ${ISSUER} -f ${ISSUER_DB}/dbpasswd -o ${CRL} < ${CRL_DATA} 806 html_msg $? 0 "${SCENARIO}${TESTNAME}" 807 } 808 809 revoke_cert() 810 { 811 ISSUER=$1 812 ISSUER_DB=${ISSUER}DB 813 814 CRL=${ISSUER}.crl 815 816 set_cert_sn 817 818 DATE=$(date -u '+%Y%m%d%H%M%SZ') 819 while [ "${DATE}" = "${DATE_LAST}" ]; do 820 sleep 1 821 DATE=$(date -u '+%Y%m%d%H%M%SZ') 822 done 823 DATE_LAST="${DATE}" 824 825 echo "update=${DATE}" > ${CRL_DATA} 826 echo "addcert ${CERT_SN} ${DATE}" >> ${CRL_DATA} 827 828 TESTNAME="Revoking certificate with SN ${CERT_SN} issued by ${ISSUER}" 829 echo "${SCRIPTNAME}: ${TESTNAME}" 830 echo "crlutil -M -d ${ISSUER_DB} -n ${ISSUER} -f ${ISSUER_DB}/dbpasswd -o ${CRL}" 831 echo "=== Crlutil input data ===" 832 cat ${CRL_DATA} 833 echo "===" 834 ${BINDIR}/crlutil -M -d ${ISSUER_DB} -n ${ISSUER} -f ${ISSUER_DB}/dbpasswd -o ${CRL} < ${CRL_DATA} 835 html_msg $? 0 "${SCENARIO}${TESTNAME}" 836 } 837 838 ######################################################################## 839 # List of global variables related to certificate verification: 840 # 841 # Generated by parse_config: 842 # DB - DB used for testing 843 # FETCH - fetch flag (used with AIA extension) 844 # POLICY - list of policies 845 # TRUST - trust anchor 846 # TRUST_AND_DB - Examine both trust anchors and the cert db for trust 847 # VERIFY - list of certificates to use as vfychain parameters 848 # EXP_RESULT - expected result 849 # REV_OPTS - revocation options 850 ######################################################################## 851 852 ############################# verify_cert ############################## 853 # local shell function to verify certificate validity 854 ######################################################################## 855 verify_cert() 856 { 857 ENGINE=$1 858 859 DB_OPT= 860 FETCH_OPT= 861 POLICY_OPT= 862 TRUST_OPT= 863 VFY_CERTS= 864 VFY_LIST= 865 TRUST_AND_DB_OPT= 866 867 if [ -n "${DB}" ]; then 868 DB_OPT="-d ${DB}" 869 fi 870 871 if [ -n "${FETCH}" ]; then 872 FETCH_OPT="-f" 873 if [ -z "${NSS_AIA_HTTP}" ]; then 874 echo "${SCRIPTNAME} Skipping test using AIA fetching, NSS_AIA_HTTP not defined" 875 return 876 fi 877 fi 878 879 if [ -n "${TRUST_AND_DB}" ]; then 880 TRUST_AND_DB_OPT="-T" 881 fi 882 883 for ITEM in ${POLICY}; do 884 POLICY_OPT="${POLICY_OPT} -o ${ITEM}" 885 done 886 887 for ITEM in ${TRUST}; do 888 echo ${ITEM} | grep ":" > /dev/null 889 if [ $? -eq 0 ]; then 890 CERT_NICK=`echo ${ITEM} | cut -d: -f1` 891 CERT_ISSUER=`echo ${ITEM} | cut -d: -f2` 892 CERT=${CERT_NICK}${CERT_ISSUER}.der 893 894 TRUST_OPT="${TRUST_OPT} -t ${CERT}" 895 else 896 TRUST_OPT="${TRUST_OPT} -t ${ITEM}" 897 fi 898 done 899 900 for ITEM in ${VERIFY}; do 901 CERT_NICK=`echo ${ITEM} | cut -d: -f1` 902 CERT_ISSUER=`echo ${ITEM} | cut -d: -f2` 903 904 if [ "${CERT_ISSUER}" = "x" ]; then 905 CERT="${QADIR}/libpkix/certs/${CERT_NICK}.cert" 906 VFY_CERTS="${VFY_CERTS} ${CERT}" 907 VFY_LIST="${VFY_LIST} ${CERT_NICK}.cert" 908 elif [ "${CERT_ISSUER}" = "d" ]; then 909 CERT="../OCSPD/${CERT_NICK}.der" 910 VFY_CERTS="${VFY_CERTS} ${CERT}" 911 VFY_LIST="${VFY_LIST} ${CERT_NICK}.cert" 912 else 913 CERT=${CERT_NICK}${CERT_ISSUER}.der 914 VFY_CERTS="${VFY_CERTS} ${CERT}" 915 VFY_LIST="${VFY_LIST} ${CERT}" 916 fi 917 done 918 919 VFY_OPTS_TNAME="${DB_OPT} ${ENGINE} ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${TRUST_OPT}" 920 VFY_OPTS_ALL="${DB_OPT} ${ENGINE} -vv ${VFY_TIME_OPT} ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}" 921 922 TESTNAME="Verifying certificate(s) ${VFY_LIST} with flags ${VFY_OPTS_TNAME}" 923 echo "${SCRIPTNAME}: ${TESTNAME}" 924 echo "vfychain ${VFY_OPTS_ALL}" 925 926 if [ -z "${MEMLEAK_DBG}" ]; then 927 VFY_OUT=$(${BINDIR}/vfychain ${VFY_OPTS_ALL} 2>&1) 928 RESULT=$? 929 echo "${VFY_OUT}" 930 else 931 VFY_OUT=$(${RUN_COMMAND_DBG} ${BINDIR}/vfychain ${VFY_OPTS_ALL} 2>> ${LOGFILE}) 932 RESULT=$? 933 echo "${VFY_OUT}" 934 fi 935 936 echo "${VFY_OUT}" | grep "ERROR -5990: I/O operation timed out" > /dev/null 937 E5990=$? 938 echo "${VFY_OUT}" | grep "ERROR -8030: Server returned bad HTTP response" > /dev/null 939 E8030=$? 940 941 if [ $E5990 -eq 0 -o $E8030 -eq 0 ]; then 942 echo "Result of this test is not valid due to network time out." 943 html_unknown "${SCENARIO}${TESTNAME}" 944 return 945 fi 946 947 echo "Returned value is ${RESULT}, expected result is ${EXP_RESULT}" 948 949 if [ "${EXP_RESULT}" = "pass" -a ${RESULT} -eq 0 ]; then 950 html_passed "${SCENARIO}${TESTNAME}" 951 elif [ "${EXP_RESULT}" = "fail" -a ${RESULT} -ne 0 ]; then 952 html_passed "${SCENARIO}${TESTNAME}" 953 else 954 html_failed "${SCENARIO}${TESTNAME}" 955 fi 956 } 957 958 check_ocsp() 959 { 960 OCSP_CERT=$1 961 962 CERT_NICK=`echo ${OCSP_CERT} | cut -d: -f1` 963 CERT_ISSUER=`echo ${OCSP_CERT} | cut -d: -f2` 964 965 if [ "${CERT_ISSUER}" = "x" ]; then 966 CERT_ISSUER= 967 CERT=${CERT_NICK}.cert 968 CERT_FILE="${QADIR}/libpkix/certs/${CERT}" 969 elif [ "${CERT_ISSUER}" = "d" ]; then 970 CERT_ISSUER= 971 CERT=${CERT_NICK}.der 972 CERT_FILE="../OCSPD/${CERT}" 973 else 974 CERT=${CERT_NICK}${CERT_ISSUER}.der 975 CERT_FILE=${CERT} 976 fi 977 978 # sample line: 979 # URI: "http://ocsp.server:2601" 980 OCSP_HOST=$(${BINDIR}/pp -w -t certificate -i ${CERT_FILE} | grep URI | sed "s/.*:\/\///" | sed "s/:.*//") 981 OCSP_PORT=$(${BINDIR}/pp -w -t certificate -i ${CERT_FILE} | grep URI | sed "s/^.*:.*:\/\/.*:\([0-9]*\).*$/\1/") 982 983 echo "tstclnt -4 -h ${OCSP_HOST} -p ${OCSP_PORT} -q -t 20" 984 tstclnt -4 -h ${OCSP_HOST} -p ${OCSP_PORT} -q -t 20 985 return $? 986 } 987 988 ############################ parse_result ############################## 989 # local shell function to process expected result value 990 # this function was created for case that expected result depends on 991 # some conditions - in our case type of cert DB 992 # 993 # default results are pass and fail 994 # this function added parsable values in format: 995 # type1:value1 type2:value2 .... typex:valuex 996 # 997 # allowed types are dbm, sql, all (all means all other cases) 998 # allowed values are pass and fail 999 # 1000 # if this format is not used, EXP_RESULT will stay unchanged (this also 1001 # covers pass and fail states) 1002 ######################################################################## 1003 parse_result() 1004 { 1005 for RES in ${EXP_RESULT} 1006 do 1007 RESTYPE=$(echo ${RES} | cut -d: -f1) 1008 RESSTAT=$(echo ${RES} | cut -d: -f2) 1009 1010 if [ "${RESTYPE}" = "${NSS_DEFAULT_DB_TYPE}" -o "${RESTYPE}" = "all" ]; then 1011 EXP_RESULT=${RESSTAT} 1012 break 1013 fi 1014 done 1015 } 1016 1017 ############################ parse_config ############################## 1018 # local shell function to parse and process file containing certificate 1019 # chain configuration and list of tests 1020 ######################################################################## 1021 parse_config() 1022 { 1023 SCENARIO= 1024 LOGNAME= 1025 1026 while read KEY VALUE 1027 do 1028 case "${KEY}" in 1029 "entity") 1030 ENTITY="${VALUE}" 1031 TYPE= 1032 ISSUER= 1033 CTYPE= 1034 POLICY= 1035 MAPPING= 1036 INHIBIT= 1037 AIA= 1038 CRLDP= 1039 OCSP= 1040 DB= 1041 EMAILS= 1042 EXT_KU= 1043 EXT_NS= 1044 EXT_EKU= 1045 SERIAL= 1046 EXPORT_KEY= 1047 ;; 1048 "type") 1049 TYPE="${VALUE}" 1050 ;; 1051 "issuer") 1052 if [ -n "${ISSUER}" ]; then 1053 if [ -z "${DB}" ]; then 1054 create_entity "${ENTITY}" "${TYPE}" 1055 fi 1056 sign_cert "${ENTITY}" "${ISSUER}" "${TYPE}" 1057 fi 1058 1059 ISSUER="${VALUE}" 1060 POLICY= 1061 MAPPING= 1062 INHIBIT= 1063 AIA= 1064 EXT_KU= 1065 EXT_NS= 1066 EXT_EKU= 1067 ;; 1068 "ctype") 1069 CTYPE="${VALUE}" 1070 ;; 1071 "policy") 1072 POLICY="${POLICY} ${VALUE}" 1073 ;; 1074 "mapping") 1075 MAPPING="${MAPPING} ${VALUE}" 1076 ;; 1077 "inhibit") 1078 INHIBIT="${VALUE}" 1079 ;; 1080 "aia") 1081 AIA="${AIA} ${VALUE}" 1082 ;; 1083 "crldp") 1084 CRLDP="${CRLDP} ${VALUE}" 1085 ;; 1086 "ocsp") 1087 OCSP="${VALUE}" 1088 ;; 1089 "db") 1090 DB="${VALUE}DB" 1091 create_db "${DB}" 1092 ;; 1093 "import") 1094 IMPORT="${VALUE}" 1095 import_cert "${IMPORT}" "${DB}" 1096 import_crl "${IMPORT}" "${DB}" 1097 ;; 1098 "import_key") 1099 IMPORT="${VALUE}" 1100 import_key "${IMPORT}" "${DB}" 1101 ;; 1102 "crl") 1103 ISSUER="${VALUE}" 1104 create_crl "${ISSUER}" 1105 ;; 1106 "revoke") 1107 REVOKE="${VALUE}" 1108 ;; 1109 "serial") 1110 SERIAL="${VALUE}" 1111 ;; 1112 "export_key") 1113 EXPORT_KEY=1 1114 ;; 1115 "copycrl") 1116 COPYCRL="${VALUE}" 1117 copy_crl "${COPYCRL}" 1118 ;; 1119 "verify") 1120 VERIFY="${VALUE}" 1121 VFY_TIME_OPT= 1122 TRUST= 1123 TRUST_AND_DB= 1124 POLICY= 1125 FETCH= 1126 EXP_RESULT= 1127 REV_OPTS= 1128 USAGE_OPT= 1129 ;; 1130 "at_time") 1131 VFY_TIME_OPT="-b ${VALUE}" 1132 ;; 1133 "cert") 1134 VERIFY="${VERIFY} ${VALUE}" 1135 ;; 1136 "testdb") 1137 if [ -n "${VALUE}" ]; then 1138 DB="${VALUE}DB" 1139 else 1140 DB= 1141 fi 1142 ;; 1143 "trust") 1144 TRUST="${TRUST} ${VALUE}" 1145 ;; 1146 "trust_and_db") 1147 TRUST_AND_DB=1 1148 ;; 1149 "fetch") 1150 FETCH=1 1151 ;; 1152 "result") 1153 EXP_RESULT="${VALUE}" 1154 parse_result 1155 ;; 1156 "rev_type") 1157 REV_OPTS="${REV_OPTS} -g ${VALUE}" 1158 ;; 1159 "rev_flags") 1160 REV_OPTS="${REV_OPTS} -h ${VALUE}" 1161 ;; 1162 "rev_mtype") 1163 REV_OPTS="${REV_OPTS} -m ${VALUE}" 1164 ;; 1165 "rev_mflags") 1166 REV_OPTS="${REV_OPTS} -s ${VALUE}" 1167 ;; 1168 "scenario") 1169 SCENARIO="${VALUE}: " 1170 1171 CHAINS_DIR="${HOSTDIR}/chains/${VALUE}" 1172 mkdir -p ${CHAINS_DIR} 1173 cd ${CHAINS_DIR} 1174 1175 if [ -n "${MEMLEAK_DBG}" ]; then 1176 LOGNAME="libpkix-${VALUE}" 1177 LOGFILE="${LOGDIR}/${LOGNAME}" 1178 fi 1179 1180 SCEN_CNT=$(expr ${SCEN_CNT} + 1) 1181 ;; 1182 "sleep") 1183 sleep ${VALUE} 1184 ;; 1185 "break") 1186 break 1187 ;; 1188 "check_ocsp") 1189 TESTNAME="Test that OCSP server is reachable" 1190 check_ocsp ${VALUE} 1191 if [ $? -ne 0 ]; then 1192 html_failed "$TESTNAME" 1193 break; 1194 else 1195 html_passed "$TESTNAME" 1196 fi 1197 ;; 1198 "ku") 1199 EXT_KU="${VALUE}" 1200 ;; 1201 "ns") 1202 EXT_NS="${VALUE}" 1203 ;; 1204 "eku") 1205 EXT_EKU="${VALUE}" 1206 ;; 1207 "usage") 1208 USAGE_OPT="-u ${VALUE}" 1209 ;; 1210 "") 1211 if [ -n "${ENTITY}" ]; then 1212 if [ -z "${DB}" ]; then 1213 create_entity "${ENTITY}" "${TYPE}" 1214 fi 1215 sign_cert "${ENTITY}" "${ISSUER}" "${TYPE}" 1216 if [ "${TYPE}" = "Bridge" ]; then 1217 create_pkcs7 "${ENTITY}" 1218 fi 1219 if [ -n "${EXPORT_KEY}" ]; then 1220 export_key "${ENTITY}" "${DB}" 1221 fi 1222 ENTITY= 1223 fi 1224 1225 if [ -n "${VERIFY}" ] && \ 1226 [ -z "$NSS_DISABLE_LIBPKIX" ]; then 1227 verify_cert "-pp" 1228 if [ -n "${VERIFY_CLASSIC_ENGINE_TOO}" ] && \ 1229 [ -z "$NSS_DISABLE_LIBPKIX" ]; then 1230 verify_cert "" 1231 verify_cert "-p" 1232 fi 1233 VERIFY= 1234 fi 1235 1236 if [ -n "${REVOKE}" ]; then 1237 revoke_cert "${REVOKE}" "${DB}" 1238 REVOKE= 1239 fi 1240 ;; 1241 *) 1242 if [ `echo ${KEY} | cut -b 1` != "#" ]; then 1243 echo "Configuration error: Unknown keyword ${KEY}" 1244 exit 1 1245 fi 1246 ;; 1247 esac 1248 done 1249 1250 if [ -n "${MEMLEAK_DBG}" ]; then 1251 log_parse 1252 html_msg $? 0 "${SCENARIO}Memory leak checking" 1253 fi 1254 } 1255 1256 process_scenario() 1257 { 1258 SCENARIO_FILE=$1 1259 1260 > ${AIA_FILES} 1261 1262 parse_config < "${QADIR}/chains/scenarios/${SCENARIO_FILE}" 1263 1264 while read AIA_FILE 1265 do 1266 rm ${AIA_FILE} 2> /dev/null 1267 done < ${AIA_FILES} 1268 rm ${AIA_FILES} 1269 } 1270 1271 # process ipsec.cfg separately 1272 chains_ipsec() 1273 { 1274 process_scenario "ipsec.cfg" 1275 } 1276 1277 # process ocspd.cfg separately 1278 chains_ocspd() 1279 { 1280 process_scenario "ocspd.cfg" 1281 } 1282 1283 # process ocsp.cfg separately 1284 chains_method() 1285 { 1286 process_scenario "method.cfg" 1287 } 1288 1289 ############################# chains_main ############################## 1290 # local shell function to process all testing scenarios 1291 ######################################################################## 1292 chains_main() 1293 { 1294 while read LINE 1295 do 1296 [ `echo ${LINE} | cut -b 1` != "#" ] || continue 1297 1298 [ ${LINE} != 'ipsec.cfg' ] || continue 1299 [ ${LINE} != 'ocspd.cfg' ] || continue 1300 [ ${LINE} != 'method.cfg' ] || continue 1301 [ -z "$NSS_DISABLE_DSA" -o ${LINE} != 'dsa.cfg' ] || continue 1302 1303 process_scenario ${LINE} 1304 done < "${CHAINS_SCENARIOS}" 1305 } 1306 1307 ################################ main ################################## 1308 1309 chains_init 1310 VERIFY_CLASSIC_ENGINE_TOO= 1311 chains_ocspd 1312 VERIFY_CLASSIC_ENGINE_TOO=1 1313 chains_ipsec 1314 chains_run_httpserv get 1315 chains_method 1316 chains_stop_httpserv 1317 chains_run_httpserv post 1318 chains_method 1319 chains_stop_httpserv 1320 VERIFY_CLASSIC_ENGINE_TOO= 1321 chains_run_httpserv random 1322 chains_main 1323 chains_stop_httpserv 1324 chains_run_httpserv get-unknown 1325 chains_main 1326 chains_stop_httpserv 1327 export NSS_COMBO_SIGNATURES=signonly 1328 chains_run_httpserv random 1329 chains_main 1330 chains_stop_httpserv 1331 export NSS_COMBO_SIGNATURES=vfynonly 1332 chains_run_httpserv random 1333 chains_main 1334 chains_stop_httpserv 1335 chains_cleanup