merge.sh (9959B)
1 #! /bin/bash 2 # 3 # This Source Code Form is subject to the terms of the Mozilla Public 4 # License, v. 2.0. If a copy of the MPL was not distributed with this 5 # file, You can obtain one at http://mozilla.org/MPL/2.0/. 6 7 ######################################################################## 8 # 9 # mozilla/security/nss/tests/merge/merge.sh 10 # 11 # Script to test NSS merge 12 # 13 # needs to work on all Unix and Windows platforms 14 # 15 # special strings 16 # --------------- 17 # FIXME ... known problems, search for this string 18 # NOTE .... unexpected behavior 19 # 20 ######################################################################## 21 22 ############################## merge_init ############################## 23 # local shell function to initialize this script 24 ######################################################################## 25 merge_init() 26 { 27 SCRIPTNAME=merge.sh # sourced - $0 would point to all.sh 28 HAS_EXPLICIT_DB=0 29 if [ ! -z "${NSS_DEFAULT_DB_TYPE}" ]; then 30 HAS_EXPLICIT_DB=1 31 fi 32 33 34 if [ -z "${CLEANUP}" ] ; then # if nobody else is responsible for 35 CLEANUP="${SCRIPTNAME}" # cleaning this script will do it 36 fi 37 38 if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then 39 cd ../common 40 . ./init.sh 41 fi 42 if [ ! -r $CERT_LOG_FILE ]; then # we need certificates here 43 cd ${QADIR}/cert 44 . ./cert.sh 45 fi 46 47 if [ ! -d ${HOSTDIR}/SDR ]; then 48 cd ${QADIR}/sdr 49 . ./sdr.sh 50 fi 51 SCRIPTNAME=merge.sh 52 53 html_head "Merge Tests" 54 55 # need the SSL & SMIME directories from cert.sh 56 grep "SUCCESS: SMIME passed" $CERT_LOG_FILE >/dev/null || { 57 Exit 11 "Fatal - S/MIME of cert.sh needs to pass first" 58 } 59 grep "SUCCESS: SSL passed" $CERT_LOG_FILE >/dev/null || { 60 Exit 8 "Fatal - SSL of cert.sh needs to pass first" 61 } 62 63 #temporary files for SDR tests 64 VALUE1=$HOSTDIR/tests.v1.$$ 65 VALUE3=$HOSTDIR/tests.v3.$$ 66 67 # local directories used in this test. 68 MERGEDIR=${HOSTDIR}/merge 69 R_MERGEDIR=../merge 70 D_MERGE="merge.$version" 71 # SDR not initialized in common/init 72 P_R_SDR=../SDR 73 D_SDR="SDR.$version" 74 mkdir -p ${MERGEDIR} 75 76 PROFILE=. 77 if [ -n "${MULTIACCESS_DBM}" ]; then 78 PROFILE="multiaccess:${D_MERGE}" 79 P_R_SDR="multiaccess:${D_SDR}" 80 fi 81 82 cd ${MERGEDIR} 83 84 # clear out any existing databases, potentially from a previous run. 85 rm -f *.db 86 87 # copy alicedir over as a seed database. 88 cp ${R_ALICEDIR}/* . 89 # copy the smime text samples 90 cp ${QADIR}/smime/*.txt . 91 92 # create a set of conflicting names. 93 CONFLICT1DIR=conflict1 94 CONFLICT2DIR=conflict2 95 mkdir ${CONFLICT1DIR} 96 mkdir ${CONFLICT2DIR} 97 # in the upgrade mode (dbm->sql), make sure our test databases 98 # are dbm databases. 99 if [ "${TEST_MODE}" = "UPGRADE_DB" ]; then 100 save=${NSS_DEFAULT_DB_TYPE} 101 NSS_DEFAULT_DB_TYPE=dbm ; export NSS_DEFAULT_DB_TYPE 102 fi 103 104 certutil -N -d ${CONFLICT1DIR} -f ${R_PWFILE} 105 certutil -N -d ${CONFLICT2DIR} -f ${R_PWFILE} 106 certutil -A -n Alice -t ,, -i ${R_CADIR}/TestUser41.cert -d ${CONFLICT1DIR} 107 # modify CONFLICTDIR potentially corrupting the database 108 certutil -A -n "Alice #1" -t C,, -i ${R_CADIR}/TestUser42.cert -d ${CONFLICT1DIR} -f ${R_PWFILE} 109 certutil -M -n "Alice #1" -t ,, -d ${CONFLICT1DIR} -f ${R_PWFILE} 110 certutil -A -n "Alice #99" -t ,, -i ${R_CADIR}/TestUser43.cert -d ${CONFLICT1DIR} 111 certutil -A -n Alice -t ,, -i ${R_CADIR}/TestUser44.cert -d ${CONFLICT2DIR} 112 certutil -A -n "Alice #1" -t ,, -i ${R_CADIR}/TestUser45.cert -d ${CONFLICT2DIR} 113 certutil -A -n "Alice #99" -t ,, -i ${R_CADIR}/TestUser46.cert -d ${CONFLICT2DIR} 114 if [ "${TEST_MODE}" = "UPGRADE_DB" ]; then 115 NSS_DEFAULT_DB_TYPE=${save}; export NSS_DEFAULT_DB_TYPE 116 fi 117 118 # 119 # allow all the tests to run in standalone mode. 120 # in standalone mode, TEST_MODE is not set. 121 # if NSS_DEFAULT_DB_TYPE is dbm, then test merge with dbm 122 # if NSS_DEFAULT_DB_TYPE is sql, then test merge with sql 123 # if NSS_DEFAULT_DB_TYPE is not set, then test database upgrade merge 124 # from dbm databases (created above) into a new sql db. 125 if [ -z "${TEST_MODE}" ] && [ ${HAS_EXPLICIT_DB} -eq 0 ]; then 126 echo "*** Using Standalone Upgrade DB mode" 127 NSS_DEFAULT_DB_TYPE=sql; export NSS_DEFAULT_DB_TYPE 128 echo certutil --upgrade-merge --source-dir ${P_R_ALICEDIR} --upgrade-id local -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE} 129 ${BINDIR}/certutil --upgrade-merge --source-dir ${P_R_ALICEDIR} --upgrade-id local -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE} 130 TEST_MODE=UPGRADE_DB 131 132 fi 133 134 } 135 136 # 137 # this allows us to run this test for both merge and upgrade-merge cases. 138 # merge_cmd takes the potential upgrade-id and the rest of the certutil 139 # arguments. 140 # 141 merge_cmd() 142 { 143 MERGE_CMD=--merge 144 if [ "${TEST_MODE}" = "UPGRADE_DB" ]; then 145 MERGE_CMD="--upgrade-merge --upgrade-token-name OldDB --upgrade-id ${1}" 146 fi 147 shift 148 echo certutil ${MERGE_CMD} $* 149 ${PROFTOOL} ${BINDIR}/certutil ${MERGE_CMD} $* 150 } 151 152 153 merge_main() 154 { 155 # first create a local sdr key and encrypt some data with it 156 # This will cause a colision with the SDR key in ../SDR. 157 echo "$SCRIPTNAME: Creating an SDR key & Encrypt" 158 echo "sdrtest -d ${PROFILE} -o ${VALUE3} -t Test2 -f ${R_PWFILE}" 159 ${PROFTOOL} ${BINDIR}/sdrtest -d ${PROFILE} -o ${VALUE3} -t Test2 -f ${R_PWFILE} 160 html_msg $? 0 "Creating SDR Key" 161 162 # Now merge in Dave 163 # Dave's cert is already in alicedir, but his key isn't. This will make 164 # sure we are updating the keys and CKA_ID's on the certificate properly. 165 MERGE_ID=dave 166 echo "$SCRIPTNAME: Merging in Key for Existing user" 167 merge_cmd dave --source-dir ${P_R_DAVEDIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE} 168 html_msg $? 0 "Merging Dave" 169 170 # Merge in server 171 # contains a CRL and new user certs 172 MERGE_ID=server 173 echo "$SCRIPTNAME: Merging in new user " 174 merge_cmd server --source-dir ${P_R_SERVERDIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE} 175 html_msg $? 0 "Merging server" 176 177 # Merge in ext_client 178 # contains a new certificate chain and additional trust flags 179 MERGE_ID=ext_client 180 echo "$SCRIPTNAME: Merging in new chain " 181 merge_cmd ext_client --source-dir ${P_R_EXT_CLIENTDIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE} 182 html_msg $? 0 "Merging ext_client" 183 184 # Merge conflicting nicknames in conflict1dir 185 # contains several certificates with nicknames that conflict with the target 186 # database 187 MERGE_ID=conflict1 188 echo "$SCRIPTNAME: Merging in conflicting nicknames 1" 189 merge_cmd conflict1 --source-dir ${CONFLICT1DIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE} 190 191 html_msg $? 0 "Merging conflicting nicknames 1" 192 193 # Merge conflicting nicknames in conflict2dir 194 # contains several certificates with nicknames that conflict with the target 195 # database 196 MERGE_ID=conflict2 197 echo "$SCRIPTNAME: Merging in conflicting nicknames 1" 198 merge_cmd conflict2 --source-dir ${CONFLICT2DIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE} 199 html_msg $? 0 "Merging conflicting nicknames 2" 200 201 # Make sure conflicted names were properly sorted out. 202 echo "$SCRIPTNAME: Verify nicknames were deconflicted (Alice #4)" 203 certutil -L -n "Alice #4" -d ${PROFILE} 204 html_msg $? 0 "Verify nicknames were deconflicted (Alice #4)" 205 206 # Make sure conflicted names were properly sorted out. 207 echo "$SCRIPTNAME: Verify nicknames were deconflicted (Alice #100)" 208 certutil -L -n "Alice #100" -d ${PROFILE} 209 html_msg $? 0 "Verify nicknames were deconflicted (Alice #100)" 210 211 # Merge in SDR 212 # contains a secret SDR key 213 MERGE_ID=SDR 214 echo "$SCRIPTNAME: Merging in SDR " 215 merge_cmd sdr --source-dir ${P_R_SDR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE} 216 html_msg $? 0 "Merging SDR" 217 218 # insert a listing of the database into the log for diagonic purposes 219 ${BINDIR}/certutil -L -d ${PROFILE} 220 ${BINDIR}/crlutil -L -d ${PROFILE} 221 222 # Make sure we can decrypt with our original SDR key generated above 223 echo "$SCRIPTNAME: Decrypt - With Original SDR Key" 224 echo "sdrtest -d ${PROFILE} -i ${VALUE3} -t Test2 -f ${R_PWFILE}" 225 ${PROFTOOL} ${BINDIR}/sdrtest -d ${PROFILE} -i ${VALUE3} -t Test2 -f ${R_PWFILE} 226 html_msg $? 0 "Decrypt - Value 3" 227 228 # Make sure we can decrypt with our the SDR key merged in from ../SDR 229 echo "$SCRIPTNAME: Decrypt - With Merged SDR Key" 230 echo "sdrtest -d ${PROFILE} -i ${VALUE1} -t Test1 -f ${R_PWFILE}" 231 ${PROFTOOL} ${BINDIR}/sdrtest -d ${PROFILE} -i ${VALUE1} -t Test1 -f ${R_PWFILE} 232 html_msg $? 0 "Decrypt - Value 1" 233 234 # Make sure we can sign with merge certificate 235 echo "$SCRIPTNAME: Signing with merged key ------------------" 236 echo "cmsutil -S -T -N Dave -H SHA1 -i alice.txt -d ${PROFILE} -p nss -o dave.dsig" 237 ${PROFTOOL} ${BINDIR}/cmsutil -S -T -N Dave -H SHA1 -i alice.txt -d ${PROFILE} -p nss -o dave.dsig 238 html_msg $? 0 "Create Detached Signature Dave" "." 239 240 echo "cmsutil -D -i dave.dsig -c alice.txt -d ${PROFILE} " 241 ${PROFTOOL} ${BINDIR}/cmsutil -D -i dave.dsig -c alice.txt -d ${PROFILE} 242 html_msg $? 0 "Verifying Dave's Detached Signature" 243 244 # Make sure that trust objects were properly merged 245 echo "$SCRIPTNAME: verifying merged cert ------------------" 246 echo "certutil -V -n ExtendedSSLUser -u C -d ${PROFILE}" 247 ${PROFTOOL} ${BINDIR}/certutil -V -n ExtendedSSLUser -u C -d ${PROFILE} 248 html_msg $? 0 "Verifying ExtendedSSL User Cert" 249 250 # Make sure that the crl got properly copied in 251 echo "$SCRIPTNAME: verifying merged crl ------------------" 252 echo "crlutil -L -n TestCA -d ${PROFILE}" 253 ${PROFTOOL} ${BINDIR}/crlutil -L -n TestCA -d ${PROFILE} 254 html_msg $? 0 "Verifying TestCA CRL" 255 256 } 257 258 ############################## smime_cleanup ########################### 259 # local shell function to finish this script (no exit since it might be 260 # sourced) 261 ######################################################################## 262 merge_cleanup() 263 { 264 html "</TABLE><BR>" 265 cd ${QADIR} 266 . common/cleanup.sh 267 } 268 269 ################## main ################################################# 270 271 merge_init 272 merge_main 273 echo "TEST_MODE=${TEST_MODE}" 274 echo "NSS_DEFAULT_DB_TYPE=${NSS_DEFAULT_DB_TYPE}" 275 merge_cleanup