The Tor Browser: security/nss/tests/chains/chains.sh@b8a032363ba2 (annotated)

security/nss/tests/chains/chains.sh@b8a032363ba2 (annotated)

security/nss/tests/chains/chains.sh

Thu, 22 Jan 2015 13:21:57 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Thu, 22 Jan 2015 13:21:57 +0100
branch: TOR_BUG_9701
changeset 15: b8a032363ba2
permissions: -rwxr-xr-x

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

 #!/bin/bash
 #
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ########################################################################
 #
 # mozilla/security/nss/tests/cert/chains.sh
 #
 # Script to test certificate chains validity.
 #
 # needs to work on all Unix and Windows platforms
 #
 # special strings
 # ---------------
 #   FIXME ... known problems, search for this string
 #   NOTE .... unexpected behavior
 ########################################################################
 ########################### is_httpserv_alive ##########################
 # local shell function to exit with a fatal error if selfserver is not
 # running
 ########################################################################
 is_httpserv_alive()
 {
   if [ ! -f "${HTTPPID}" ]; then
       echo "$SCRIPTNAME: Error - httpserv PID file ${HTTPPID} doesn't exist"
       sleep 5
       if [ ! -f "${HTTPPID}" ]; then
           Exit 9 "Fatal - httpserv pid file ${HTTPPID} does not exist"
       fi
   fi
   if [ "${OS_ARCH}" = "WINNT" ] && \
      [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then
       PID=${SHELL_HTTPPID}
   else
       PID=`cat ${HTTPPID}`
   fi
   echo "kill -0 ${PID} >/dev/null 2>/dev/null"
   kill -0 ${PID} >/dev/null 2>/dev/null || Exit 10 "Fatal - httpserv process not detectable"
   echo "httpserv with PID ${PID} found at `date`"
 }
 ########################### wait_for_httpserv ##########################
 # local shell function to wait until httpserver is running and initialized
 ########################################################################
 wait_for_httpserv()
 {
   echo "trying to connect to httpserv at `date`"
   echo "tstclnt -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v"
   ${BINDIR}/tstclnt -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v
   if [ $? -ne 0 ]; then
       sleep 5
       echo "retrying to connect to httpserv at `date`"
       echo "tstclnt -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v"
       ${BINDIR}/tstclnt -p ${NSS_AIA_PORT} -h ${HOSTADDR} -q -v
       if [ $? -ne 0 ]; then
           html_failed "Waiting for Server"
       fi
   fi
   is_httpserv_alive
 }
 ########################### kill_httpserv ##############################
 # local shell function to kill the httpserver after the tests are done
 ########################################################################
 kill_httpserv()
 {
   if [ "${OS_ARCH}" = "WINNT" ] && \
      [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then
       PID=${SHELL_HTTPPID}
   else
       PID=`cat ${HTTPPID}`
   fi
   echo "trying to kill httpserv with PID ${PID} at `date`"
   if [ "${OS_ARCH}" = "WINNT" -o "${OS_ARCH}" = "WIN95" -o "${OS_ARCH}" = "OS2" ]; then
       echo "${KILL} ${PID}"
       ${KILL} ${PID}
   else
       echo "${KILL} -USR1 ${PID}"
       ${KILL} -USR1 ${PID}
   fi
   wait ${PID}
   # On Linux httpserv needs up to 30 seconds to fully die and free
   # the port.  Wait until the port is free. (Bug 129701)
   if [ "${OS_ARCH}" = "Linux" ]; then
       echo "httpserv -b -p ${NSS_AIA_PORT} 2>/dev/null;"
       until ${BINDIR}/httpserv -b -p ${NSS_AIA_PORT} 2>/dev/null; do
           echo "RETRY: httpserv -b -p ${NSS_AIA_PORT} 2>/dev/null;"
           sleep 1
       done
   fi
   echo "httpserv with PID ${PID} killed at `date`"
   rm ${HTTPPID}
   html_detect_core "kill_httpserv core detection step"
 }
 ########################### start_httpserv #############################
 # local shell function to start the httpserver with the parameters required
 # for this test and log information (parameters, start time)
 # also: wait until the server is up and running
 ########################################################################
 start_httpserv()
 {
   HTTP_METHOD=$1
   if [ -n "$testname" ] ; then
       echo "$SCRIPTNAME: $testname ----"
   fi
   echo "httpserv starting at `date`"
   ODDIR="${HOSTDIR}/chains/OCSPD"
   echo "httpserv -D -p ${NSS_AIA_PORT} ${SERVER_OPTIONS} \\"
   echo "         -A OCSPRoot -C ${ODDIR}/OCSPRoot.crl -A OCSPCA1 -C ${ODDIR}/OCSPCA1.crl \\"
   echo "         -A OCSPCA2  -C ${ODDIR}/OCSPCA2.crl  -A OCSPCA3 -C ${ODDIR}/OCSPCA3.crl \\"
   echo "         -O ${HTTP_METHOD} -d ${ODDIR}/ServerDB/ -f ${ODDIR}/ServerDB/dbpasswd \\"
   echo "         -i ${HTTPPID} $verbose &"
   ${PROFTOOL} ${BINDIR}/httpserv -D -p ${NSS_AIA_PORT} ${SERVER_OPTIONS} \
                  -A OCSPRoot -C ${ODDIR}/OCSPRoot.crl -A OCSPCA1 -C ${ODDIR}/OCSPCA1.crl \
                  -A OCSPCA2  -C ${ODDIR}/OCSPCA2.crl  -A OCSPCA3 -C ${ODDIR}/OCSPCA3.crl \
                  -O ${HTTP_METHOD} -d ${ODDIR}/ServerDB/ -f ${ODDIR}/ServerDB/dbpasswd \
                  -i ${HTTPPID} $verbose &
   RET=$?
   # The PID $! returned by the MKS or Cygwin shell is not the PID of
   # the real background process, but rather the PID of a helper
   # process (sh.exe).  MKS's kill command has a bug: invoking kill
   # on the helper process does not terminate the real background
   # process.  Our workaround has been to have httpserv save its PID
   # in the ${HTTPPID} file and "kill" that PID instead.  But this
   # doesn't work under Cygwin; its kill command doesn't recognize
   # the PID of the real background process, but it does work on the
   # PID of the helper process.  So we save the value of $! in the
   # SHELL_HTTPPID variable, and use it instead of the ${HTTPPID}
   # file under Cygwin.  (In fact, this should work in any shell
   # other than the MKS shell.)
   SHELL_HTTPPID=$!
   wait_for_httpserv
   if [ "${OS_ARCH}" = "WINNT" ] && \
      [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then
       PID=${SHELL_HTTPPID}
   else
       PID=`cat ${HTTPPID}`
   fi
   echo "httpserv with PID ${PID} started at `date`"
 }
 ############################# chains_init ##############################
 # local shell function to initialize this script
 ########################################################################
 chains_init()
 {
     if [ -z "${CLEANUP}" ] ; then   # if nobody else is responsible for
         CLEANUP="${SCRIPTNAME}"     # cleaning this script will do it
     fi
     if [ -z "${INIT_SOURCED}" ] ; then
         cd ../common
         . ./init.sh
     fi
     SCRIPTNAME="chains.sh"
     CHAINS_DIR="${HOSTDIR}/chains"
     mkdir -p ${CHAINS_DIR}
     cd ${CHAINS_DIR}
     CHAINS_SCENARIOS="${QADIR}/chains/scenarios/scenarios"
     CERT_SN_CNT=$(date '+%m%d%H%M%S' | sed "s/^0*//")
     CERT_SN_FIX=$(expr ${CERT_SN_CNT} - 1000)
     PK7_NONCE=${CERT_SN_CNT}
     SCEN_CNT=${CERT_SN_CNT}
     AIA_FILES="${HOSTDIR}/aiafiles"
     CU_DATA=${HOSTDIR}/cu_data
     CRL_DATA=${HOSTDIR}/crl_data
     DEFAULT_AIA_BASE_PORT=$(expr ${PORT:-8631} + 10)
     NSS_AIA_PORT=${NSS_AIA_PORT:-$DEFAULT_AIA_BASE_PORT}
     DEFAULT_UNUSED_PORT=$(expr ${PORT:-8631} + 11)
     NSS_UNUSED_PORT=${NSS_UNUSED_PORT:-$DEFAULT_UNUSED_PORT}
     NSS_AIA_HTTP=${NSS_AIA_HTTP:-"http://${HOSTADDR}:${NSS_AIA_PORT}"}
     NSS_AIA_PATH=${NSS_AIA_PATH:-$HOSTDIR/aiahttp}
     NSS_AIA_OCSP=${NSS_AIA_OCSP:-$NSS_AIA_HTTP/ocsp}
     NSS_OCSP_UNUSED=${NSS_AIA_OCSP_UNUSED:-"http://${HOSTADDR}:${NSS_UNUSED_PORT}"}
     html_head "Certificate Chains Tests"
 }
 chains_run_httpserv()
 {
     HTTP_METHOD=$1
     if [ -n "${NSS_AIA_PATH}" ]; then
         HTTPPID=${NSS_AIA_PATH}/http_pid.$$
         mkdir -p "${NSS_AIA_PATH}"
         SAVEPWD=`pwd`
         cd "${NSS_AIA_PATH}"
         # Start_httpserv sets environment variables, which are required for
         # correct cleanup. (Running it in a subshell doesn't work, the
         # value of $SHELL_HTTPPID wouldn't arrive in this scope.)
         start_httpserv ${HTTP_METHOD}
         cd "${SAVEPWD}"
     fi
 }
 chains_stop_httpserv()
 {
     if [ -n "${NSS_AIA_PATH}" ]; then
         kill_httpserv
     fi
 }
 ############################ chains_cleanup ############################
 # local shell function to finish this script (no exit since it might be
 # sourced)
 ########################################################################
 chains_cleanup()
 {
     html "</TABLE><BR>"
     cd ${QADIR}
     . common/cleanup.sh
 }
 ############################ print_cu_data #############################
 # local shell function to print certutil input data
 ########################################################################
 print_cu_data()
 {
     echo "=== Certutil input data ==="
     cat ${CU_DATA}
     echo "==="
 }
 set_cert_sn()
 {
     if [ -z "${SERIAL}" ]; then
         CERT_SN_CNT=$(expr ${CERT_SN_CNT} + 1)
         CERT_SN=${CERT_SN_CNT}
     else
         echo ${SERIAL} | cut -b 1 | grep '+' > /dev/null
         if [ $? -eq 0 ]; then
             CERT_SN=$(echo ${SERIAL} | cut -b 2-)
             CERT_SN=$(expr ${CERT_SN_FIX} + ${CERT_SN})
         else
             CERT_SN=${SERIAL}
         fi
     fi
 }
 ############################# create_db ################################
 # local shell function to create certificate database
 ########################################################################
 create_db()
 {
     DB=$1
     [ -d "${DB}" ] && rm -rf ${DB}
     mkdir -p ${DB}
     echo "${DB}passwd" > ${DB}/dbpasswd
     TESTNAME="Creating DB ${DB}"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "certutil -N -d ${DB} -f ${DB}/dbpasswd"
     ${BINDIR}/certutil -N -d ${DB} -f ${DB}/dbpasswd
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 ########################### create_root_ca #############################
 # local shell function to generate self-signed root certificate
 ########################################################################
 create_root_ca()
 {
     ENTITY=$1
     ENTITY_DB=${ENTITY}DB
     set_cert_sn
     date >> ${NOISE_FILE} 2>&1
     CTYPE_OPT=
     if [ -n "${CTYPE}" ]; then
         CTYPE_OPT="-k ${CTYPE}"
     fi
     echo "5
 
 
 n
 y
 -1
 n
 
 
 
 
 n
 " > ${CU_DATA}
     TESTNAME="Creating Root CA ${ENTITY}"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "certutil -s \"CN=${ENTITY} ROOT CA, O=${ENTITY}, C=US\" -S -n ${ENTITY} ${CTYPE_OPT} -t CTu,CTu,CTu -v 600 -x -d ${ENTITY_DB} -1 -2 -5 -f ${ENTITY_DB}/dbpasswd -z ${NOISE_FILE} -m ${CERT_SN} < ${CU_DATA}"
     print_cu_data
     ${BINDIR}/certutil -s "CN=${ENTITY} ROOT CA, O=${ENTITY}, C=US" -S -n ${ENTITY} ${CTYPE_OPT} -t CTu,CTu,CTu -v 600 -x -d ${ENTITY_DB} -1 -2 -5 -f ${ENTITY_DB}/dbpasswd -z ${NOISE_FILE} -m ${CERT_SN} < ${CU_DATA}
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
     TESTNAME="Exporting Root CA ${ENTITY}.der"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "certutil -L -d ${ENTITY_DB} -r -n ${ENTITY} -o ${ENTITY}.der"
     ${BINDIR}/certutil -L -d ${ENTITY_DB} -r -n ${ENTITY} -o ${ENTITY}.der
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 ########################### create_cert_req ############################
 # local shell function to generate certificate sign request
 ########################################################################
 create_cert_req()
 {
     ENTITY=$1
     TYPE=$2
     ENTITY_DB=${ENTITY}DB
     REQ=${ENTITY}Req.der
     date >> ${NOISE_FILE} 2>&1
     CTYPE_OPT=
     if [ -n "${CTYPE}" ]; then
         CTYPE_OPT="-k ${CTYPE}"
     fi
     CA_FLAG=
     EXT_DATA=
     OPTIONS=
     if [ "${TYPE}" != "EE" ]; then
         CA_FLAG="-2"
         EXT_DATA="y
 -1
 y
 "
     fi
     process_crldp
     echo "${EXT_DATA}" > ${CU_DATA}
     TESTNAME="Creating ${TYPE} certifiate request ${REQ}"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "certutil -s \"CN=${ENTITY} ${TYPE}, O=${ENTITY}, C=US\" ${CTYPE_OPT} -R ${CA_FLAG} -d ${ENTITY_DB} -f ${ENTITY_DB}/dbpasswd -z ${NOISE_FILE} -o ${REQ} ${OPTIONS} < ${CU_DATA}"
     print_cu_data
     ${BINDIR}/certutil -s "CN=${ENTITY} ${TYPE}, O=${ENTITY}, C=US" ${CTYPE_OPT} -R ${CA_FLAG} -d ${ENTITY_DB} -f ${ENTITY_DB}/dbpasswd -z ${NOISE_FILE} -o ${REQ} ${OPTIONS} < ${CU_DATA}
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 ############################ create_entity #############################
 # local shell function to create certificate chain entity
 ########################################################################
 create_entity()
 {
     ENTITY=$1
     TYPE=$2
     if [ -z "${ENTITY}" ]; then
         echo "Configuration error: Unnamed entity"
         exit 1
     fi
     DB=${ENTITY}DB
     ENTITY_DB=${ENTITY}DB
     case "${TYPE}" in
     "Root")
         create_db "${DB}"
         create_root_ca "${ENTITY}"
         ;;
     "Intermediate" | "Bridge" | "EE")
         create_db "${DB}"
         create_cert_req "${ENTITY}" "${TYPE}"
         ;;
     "*")
         echo "Configuration error: Unknown type ${TYPE}"
         exit 1
         ;;
     esac
 }
 ########################################################################
 # List of global variables related to certificate extensions processing:
 #
 # Generated by process_extensions and functions called from it:
 # OPTIONS - list of command line policy extensions
 # DATA - list of inpud data related to policy extensions
 #
 # Generated by parse_config:
 # POLICY - list of certificate policies
 # MAPPING - list of policy mappings
 # INHIBIT - inhibit flag
 # AIA - AIA list
 ########################################################################
 ############################ process_policy ############################
 # local shell function to process policy extension parameters and
 # generate input for certutil
 ########################################################################
 process_policy()
 {
     if [ -n "${POLICY}" ]; then
         OPTIONS="${OPTIONS} --extCP"
         NEXT=
         for ITEM in ${POLICY}; do
             if [ -n "${NEXT}" ]; then
                 DATA="${DATA}y
 "
             fi
             NEXT=1
             DATA="${DATA}${ITEM}
 
 n
 "
         done
         DATA="${DATA}n
 n
 "
     fi
 }
 ########################### process_mapping ############################
 # local shell function to process policy mapping parameters and
 # generate input for certutil
 ########################################################################
 process_mapping()
 {
     if [ -n "${MAPPING}" ]; then
         OPTIONS="${OPTIONS} --extPM"
         NEXT=
         for ITEM in ${MAPPING}; do
             if [ -n "${NEXT}" ]; then
                 DATA="${DATA}y
 "
             fi
             NEXT=1
             IDP=`echo ${ITEM} | cut -d: -f1`
             SDP=`echo ${ITEM} | cut -d: -f2`
             DATA="${DATA}${IDP}
 ${SDP}
 "
         done
         DATA="${DATA}n
 n
 "
     fi
 }
 ########################### process_inhibit#############################
 # local shell function to process inhibit extension and generate input
 # for certutil
 ########################################################################
 process_inhibit()
 {
     if [ -n "${INHIBIT}" ]; then
         OPTIONS="${OPTIONS} --extIA"
         DATA="${DATA}${INHIBIT}
 n
 "
     fi
 }
 ############################# process_aia ##############################
 # local shell function to process AIA extension parameters and
 # generate input for certutil
 ########################################################################
 process_aia()
 {
     if [ -n "${AIA}" ]; then
         OPTIONS="${OPTIONS} --extAIA"
         DATA="${DATA}1
 "
         for ITEM in ${AIA}; do
             PK7_NONCE=`expr $PK7_NONCE + 1`
             echo ${ITEM} | grep ":" > /dev/null
             if [ $? -eq 0 ]; then
                 CERT_NICK=`echo ${ITEM} | cut -d: -f1`
                 CERT_ISSUER=`echo ${ITEM} | cut -d: -f2`
                 CERT_LOCAL="${CERT_NICK}${CERT_ISSUER}.der"
                 CERT_PUBLIC="${HOST}-$$-${CERT_NICK}${CERT_ISSUER}-${PK7_NONCE}.der"
             else
                 CERT_LOCAL="${ITEM}.p7"
                 CERT_PUBLIC="${HOST}-$$-${ITEM}-${PK7_NONCE}.p7"
             fi
             DATA="${DATA}7
 ${NSS_AIA_HTTP}/${CERT_PUBLIC}
 "
             if [ -n "${NSS_AIA_PATH}" ]; then
                 cp ${CERT_LOCAL} ${NSS_AIA_PATH}/${CERT_PUBLIC} 2> /dev/null
                 chmod a+r ${NSS_AIA_PATH}/${CERT_PUBLIC}
                 echo ${NSS_AIA_PATH}/${CERT_PUBLIC} >> ${AIA_FILES}
             fi
         done
         DATA="${DATA}0
 n
 n"
     fi
 }
 process_ocsp()
 {
     if [ -n "${OCSP}" ]; then
         OPTIONS="${OPTIONS} --extAIA"
 	if [ "${OCSP}" = "offline" ]; then
 	    MY_OCSP_URL=${NSS_OCSP_UNUSED}
 	else
 	    MY_OCSP_URL=${NSS_AIA_OCSP}
 	fi
         DATA="${DATA}2
 
 ${MY_OCSP_URL}
 
 n
 n
 "
     fi
 }
 process_crldp()
 {
     if [ -n "${CRLDP}" ]; then
         OPTIONS="${OPTIONS} -4"
         EXT_DATA="${EXT_DATA}1
 "
         for ITEM in ${CRLDP}; do
             CRL_PUBLIC="${HOST}-$$-${ITEM}-${SCEN_CNT}.crl"
             EXT_DATA="${EXT_DATA}7
 ${NSS_AIA_HTTP}/${CRL_PUBLIC}
 "
         done
         EXT_DATA="${EXT_DATA}-1
 -1
 -1
 n
 n
 "
     fi
 }
 process_ku_ns_eku()
 {
     if [ -n "${EXT_KU}" ]; then
         OPTIONS="${OPTIONS} --keyUsage ${EXT_KU}"
     fi
     if [ -n "${EXT_NS}" ]; then
         EXT_NS_KEY=$(echo ${EXT_NS} | cut -d: -f1)
         EXT_NS_CODE=$(echo ${EXT_NS} | cut -d: -f2)
         OPTIONS="${OPTIONS} --nsCertType ${EXT_NS_KEY}"
         DATA="${DATA}${EXT_NS_CODE}
 -1
 n
 "
     fi
     if [ -n "${EXT_EKU}" ]; then
         OPTIONS="${OPTIONS} --extKeyUsage ${EXT_EKU}"
     fi
 }
 copy_crl()
 {
     if [ -z "${NSS_AIA_PATH}" ]; then
         return;
     fi
     CRL_LOCAL="${COPYCRL}.crl"
     CRL_PUBLIC="${HOST}-$$-${COPYCRL}-${SCEN_CNT}.crl"
     cp ${CRL_LOCAL} ${NSS_AIA_PATH}/${CRL_PUBLIC} 2> /dev/null
     chmod a+r ${NSS_AIA_PATH}/${CRL_PUBLIC}
     echo ${NSS_AIA_PATH}/${CRL_PUBLIC} >> ${AIA_FILES}
 }
 ########################## process_extension ###########################
 # local shell function to process entity extension parameters and
 # generate input for certutil
 ########################################################################
 process_extensions()
 {
     OPTIONS=
     DATA=
     process_policy
     process_mapping
     process_inhibit
     process_aia
     process_ocsp
     process_ku_ns_eku
 }
 ############################## sign_cert ###############################
 # local shell function to sign certificate sign reuqest
 ########################################################################
 sign_cert()
 {
     ENTITY=$1
     ISSUER=$2
     TYPE=$3
     [ -z "${ISSUER}" ] && return
     ENTITY_DB=${ENTITY}DB
     ISSUER_DB=${ISSUER}DB
     REQ=${ENTITY}Req.der
     CERT=${ENTITY}${ISSUER}.der
     set_cert_sn
     EMAIL_OPT=
     if [ "${TYPE}" = "Bridge" ]; then
         EMAIL_OPT="-7 ${ENTITY}@${ISSUER}"
         [ -n "${EMAILS}" ] && EMAILS="${EMAILS},"
         EMAILS="${EMAILS}${ENTITY}@${ISSUER}"
     fi
     process_extensions
     echo "${DATA}" > ${CU_DATA}
     TESTNAME="Creating certficate ${CERT} signed by ${ISSUER}"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "certutil -C -c ${ISSUER} -v 60 -d ${ISSUER_DB} -i ${REQ} -o ${CERT} -f ${ISSUER_DB}/dbpasswd -m ${CERT_SN} ${EMAIL_OPT} ${OPTIONS} < ${CU_DATA}"
     print_cu_data
     ${BINDIR}/certutil -C -c ${ISSUER} -v 60 -d ${ISSUER_DB} -i ${REQ} -o ${CERT} -f ${ISSUER_DB}/dbpasswd -m ${CERT_SN} ${EMAIL_OPT} ${OPTIONS} < ${CU_DATA}
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
     TESTNAME="Importing certificate ${CERT} to ${ENTITY_DB} database"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "certutil -A -n ${ENTITY} -t u,u,u -d ${ENTITY_DB} -f ${ENTITY_DB}/dbpasswd -i ${CERT}"
     ${BINDIR}/certutil -A -n ${ENTITY} -t u,u,u -d ${ENTITY_DB} -f ${ENTITY_DB}/dbpasswd -i ${CERT}
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 ############################# create_pkcs7##############################
 # local shell function to package bridge certificates into pkcs7
 # package
 ########################################################################
 create_pkcs7()
 {
     ENTITY=$1
     ENTITY_DB=${ENTITY}DB
     TESTNAME="Generating PKCS7 package from ${ENTITY_DB} database"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "cmsutil -O -r \"${EMAILS}\" -d ${ENTITY_DB} > ${ENTITY}.p7"
     ${BINDIR}/cmsutil -O -r "${EMAILS}" -d ${ENTITY_DB} > ${ENTITY}.p7
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 ############################# import_key ###############################
 # local shell function to import private key + cert into database
 ########################################################################
 import_key()
 {
     KEY_NAME=$1.p12
     DB=$2
     KEY_FILE=../OCSPD/${KEY_NAME}
     TESTNAME="Importing p12 key ${KEY_NAME} to ${DB} database"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "${BINDIR}/pk12util -d ${DB} -i ${KEY_FILE} -k ${DB}/dbpasswd -W nssnss"
     ${BINDIR}/pk12util -d ${DB} -i ${KEY_FILE} -k ${DB}/dbpasswd -W nssnss
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 export_key()
 {
     KEY_NAME=$1.p12
     DB=$2
     TESTNAME="Exporting $1 as ${KEY_NAME} from ${DB} database"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "${BINDIR}/pk12util -d ${DB} -o ${KEY_NAME} -n $1 -k ${DB}/dbpasswd -W nssnss"
     ${BINDIR}/pk12util -d ${DB} -o ${KEY_NAME} -n $1 -k ${DB}/dbpasswd -W nssnss
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 ############################# import_cert ##############################
 # local shell function to import certificate into database
 ########################################################################
 import_cert()
 {
     IMPORT=$1
     DB=$2
     CERT_NICK=`echo ${IMPORT} | cut -d: -f1`
     CERT_ISSUER=`echo ${IMPORT} | cut -d: -f2`
     CERT_TRUST=`echo ${IMPORT} | cut -d: -f3`
     if [ "${CERT_ISSUER}" = "x" ]; then
         CERT_ISSUER=
         CERT=${CERT_NICK}.cert
         CERT_FILE="${QADIR}/libpkix/certs/${CERT}"
     elif [ "${CERT_ISSUER}" = "d" ]; then
         CERT_ISSUER=
         CERT=${CERT_NICK}.der
         CERT_FILE="../OCSPD/${CERT}"
     else
         CERT=${CERT_NICK}${CERT_ISSUER}.der
         CERT_FILE=${CERT}
     fi
     IS_ASCII=`grep -c -- "-----BEGIN CERTIFICATE-----" ${CERT_FILE}`
     ASCII_OPT=
     if [ "${IS_ASCII}" -gt 0 ]; then
         ASCII_OPT="-a"
     fi
     TESTNAME="Importing certificate ${CERT} to ${DB} database"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "certutil -A -n ${CERT_NICK} ${ASCII_OPT} -t \"${CERT_TRUST}\" -d ${DB} -f ${DB}/dbpasswd -i ${CERT_FILE}"
     ${BINDIR}/certutil -A -n ${CERT_NICK} ${ASCII_OPT} -t "${CERT_TRUST}" -d ${DB} -f ${DB}/dbpasswd -i ${CERT_FILE}
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 import_crl()
 {
     IMPORT=$1
     DB=$2
     CRL_NICK=`echo ${IMPORT} | cut -d: -f1`
     CRL_FILE=${CRL_NICK}.crl
     if [ ! -f "${CRL_FILE}" ]; then
         return
     fi
     TESTNAME="Importing CRL ${CRL_FILE} to ${DB} database"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "crlutil -I -d ${DB} -f ${DB}/dbpasswd -i ${CRL_FILE}"
     ${BINDIR}/crlutil -I -d ${DB} -f ${DB}/dbpasswd -i ${CRL_FILE}
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 create_crl()
 {
     ISSUER=$1
     ISSUER_DB=${ISSUER}DB
     CRL=${ISSUER}.crl
     DATE=$(date -u '+%Y%m%d%H%M%SZ')
     DATE_LAST="${DATE}"
     UPDATE=$(expr $(date -u '+%Y') + 1)$(date -u '+%m%d%H%M%SZ')
     echo "update=${DATE}" > ${CRL_DATA}
     echo "nextupdate=${UPDATE}" >> ${CRL_DATA}
     TESTNAME="Create CRL for ${ISSUER_DB}"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "crlutil -G -d ${ISSUER_DB} -n ${ISSUER} -f ${ISSUER_DB}/dbpasswd -o ${CRL}"
     echo "=== Crlutil input data ==="
     cat ${CRL_DATA}
     echo "==="
     ${BINDIR}/crlutil -G -d ${ISSUER_DB} -n ${ISSUER} -f ${ISSUER_DB}/dbpasswd -o ${CRL} < ${CRL_DATA}
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 revoke_cert()
 {
     ISSUER=$1
     ISSUER_DB=${ISSUER}DB
     CRL=${ISSUER}.crl
     set_cert_sn
     DATE=$(date -u '+%Y%m%d%H%M%SZ')
     while [ "${DATE}" = "${DATE_LAST}" ]; do
         sleep 1
         DATE=$(date -u '+%Y%m%d%H%M%SZ')
     done
     DATE_LAST="${DATE}"
     echo "update=${DATE}" > ${CRL_DATA}
     echo "addcert ${CERT_SN} ${DATE}" >> ${CRL_DATA}
     TESTNAME="Revoking certificate with SN ${CERT_SN} issued by ${ISSUER}"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "crlutil -M -d ${ISSUER_DB} -n ${ISSUER} -f ${ISSUER_DB}/dbpasswd -o ${CRL}"
     echo "=== Crlutil input data ==="
     cat ${CRL_DATA}
     echo "==="
     ${BINDIR}/crlutil -M -d ${ISSUER_DB} -n ${ISSUER} -f ${ISSUER_DB}/dbpasswd -o ${CRL} < ${CRL_DATA}
     html_msg $? 0 "${SCENARIO}${TESTNAME}"
 }
 ########################################################################
 # List of global variables related to certificate verification:
 #
 # Generated by parse_config:
 # DB - DB used for testing
 # FETCH - fetch flag (used with AIA extension)
 # POLICY - list of policies
 # TRUST - trust anchor
 # TRUST_AND_DB - Examine both trust anchors and the cert db for trust
 # VERIFY - list of certificates to use as vfychain parameters
 # EXP_RESULT - expected result
 # REV_OPTS - revocation options
 ########################################################################
 ############################# verify_cert ##############################
 # local shell function to verify certificate validity
 ########################################################################
 verify_cert()
 {
     ENGINE=$1
     DB_OPT=
     FETCH_OPT=
     POLICY_OPT=
     TRUST_OPT=
     VFY_CERTS=
     VFY_LIST=
     TRUST_AND_DB_OPT=
     if [ -n "${DB}" ]; then
         DB_OPT="-d ${DB}"
     fi
     if [ -n "${FETCH}" ]; then
         FETCH_OPT="-f"
         if [ -z "${NSS_AIA_HTTP}" ]; then
             echo "${SCRIPTNAME} Skipping test using AIA fetching, NSS_AIA_HTTP not defined"
             return
         fi
     fi
     if [ -n "${TRUST_AND_DB}" ]; then
         TRUST_AND_DB_OPT="-T"
     fi
     for ITEM in ${POLICY}; do
         POLICY_OPT="${POLICY_OPT} -o ${ITEM}"
     done
     for ITEM in ${TRUST}; do
         echo ${ITEM} | grep ":" > /dev/null
         if [ $? -eq 0 ]; then
             CERT_NICK=`echo ${ITEM} | cut -d: -f1`
             CERT_ISSUER=`echo ${ITEM} | cut -d: -f2`
             CERT=${CERT_NICK}${CERT_ISSUER}.der
             TRUST_OPT="${TRUST_OPT} -t ${CERT}"
         else
             TRUST_OPT="${TRUST_OPT} -t ${ITEM}"
         fi
     done
     for ITEM in ${VERIFY}; do
         CERT_NICK=`echo ${ITEM} | cut -d: -f1`
         CERT_ISSUER=`echo ${ITEM} | cut -d: -f2`
         if [ "${CERT_ISSUER}" = "x" ]; then
             CERT="${QADIR}/libpkix/certs/${CERT_NICK}.cert"
             VFY_CERTS="${VFY_CERTS} ${CERT}"
             VFY_LIST="${VFY_LIST} ${CERT_NICK}.cert"
         elif [ "${CERT_ISSUER}" = "d" ]; then
             CERT="../OCSPD/${CERT_NICK}.der"
             VFY_CERTS="${VFY_CERTS} ${CERT}"
             VFY_LIST="${VFY_LIST} ${CERT_NICK}.cert"
         else
             CERT=${CERT_NICK}${CERT_ISSUER}.der
             VFY_CERTS="${VFY_CERTS} ${CERT}"
             VFY_LIST="${VFY_LIST} ${CERT}"
         fi
     done
     VFY_OPTS_TNAME="${DB_OPT} ${ENGINE} ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${TRUST_OPT}"
     VFY_OPTS_ALL="${DB_OPT} ${ENGINE} -vv ${TRUST_AND_DB_OPT} ${REV_OPTS} ${FETCH_OPT} ${USAGE_OPT} ${POLICY_OPT} ${VFY_CERTS} ${TRUST_OPT}"
     TESTNAME="Verifying certificate(s) ${VFY_LIST} with flags ${VFY_OPTS_TNAME}"
     echo "${SCRIPTNAME}: ${TESTNAME}"
     echo "vfychain ${VFY_OPTS_ALL}"
     if [ -z "${MEMLEAK_DBG}" ]; then
         VFY_OUT=$(${BINDIR}/vfychain ${VFY_OPTS_ALL} 2>&1)
         RESULT=$?
         echo "${VFY_OUT}"
     else
         VFY_OUT=$(${RUN_COMMAND_DBG} ${BINDIR}/vfychain ${VFY_OPTS_ALL} 2>> ${LOGFILE})
         RESULT=$?
         echo "${VFY_OUT}"
     fi
     echo "${VFY_OUT}" | grep "ERROR -5990: I/O operation timed out" > /dev/null
     E5990=$?
     echo "${VFY_OUT}" | grep "ERROR -8030: Server returned bad HTTP response" > /dev/null
     E8030=$?
     if [ $E5990 -eq 0 -o $E8030 -eq 0 ]; then
         echo "Result of this test is not valid due to network time out."
         html_unknown "${SCENARIO}${TESTNAME}"
         return
     fi
     echo "Returned value is ${RESULT}, expected result is ${EXP_RESULT}"
     if [ "${EXP_RESULT}" = "pass" -a ${RESULT} -eq 0 ]; then
         html_passed "${SCENARIO}${TESTNAME}"
     elif [ "${EXP_RESULT}" = "fail" -a ${RESULT} -ne 0 ]; then
         html_passed "${SCENARIO}${TESTNAME}"
     else
         html_failed "${SCENARIO}${TESTNAME}"
     fi
 }
 check_ocsp()
 {
     OCSP_CERT=$1
     CERT_NICK=`echo ${OCSP_CERT} | cut -d: -f1`
     CERT_ISSUER=`echo ${OCSP_CERT} | cut -d: -f2`
     if [ "${CERT_ISSUER}" = "x" ]; then
         CERT_ISSUER=
         CERT=${CERT_NICK}.cert
         CERT_FILE="${QADIR}/libpkix/certs/${CERT}"
     elif [ "${CERT_ISSUER}" = "d" ]; then
         CERT_ISSUER=
         CERT=${CERT_NICK}.der
         CERT_FILE="../OCSPD/${CERT}"
     else
         CERT=${CERT_NICK}${CERT_ISSUER}.der
         CERT_FILE=${CERT}
     fi
     # sample line:
     #   URI: "http://ocsp.server:2601"
     OCSP_HOST=$(${BINDIR}/pp -w -t certificate -i ${CERT_FILE} | grep URI | sed "s/.*:\/\///" | sed "s/:.*//")
     OCSP_PORT=$(${BINDIR}/pp -w -t certificate -i ${CERT_FILE} | grep URI | sed "s/^.*:.*:\/\/.*:\([0-9]*\).*$/\1/")
     echo "tstclnt -h ${OCSP_HOST} -p ${OCSP_PORT} -q -t 20"
     tstclnt -h ${OCSP_HOST} -p ${OCSP_PORT} -q -t 20
     return $?
 }
 ############################ parse_result ##############################
 # local shell function to process expected result value
 # this function was created for case that expected result depends on
 # some conditions - in our case type of cert DB
 #
 # default results are pass and fail
 # this function added parsable values in format:
 # type1:value1 type2:value2 .... typex:valuex
 #
 # allowed types are dbm, sql, all (all means all other cases)
 # allowed values are pass and fail
 #
 # if this format is not used, EXP_RESULT will stay unchanged (this also
 # covers pass and fail states)
 ########################################################################
 parse_result()
 {
     for RES in ${EXP_RESULT}
     do
         RESTYPE=$(echo ${RES} | cut -d: -f1)
         RESSTAT=$(echo ${RES} | cut -d: -f2)
         if [ "${RESTYPE}" = "${NSS_DEFAULT_DB_TYPE}" -o "${RESTYPE}" = "all" ]; then
             EXP_RESULT=${RESSTAT}
             break
         fi
     done
 }
 ############################ parse_config ##############################
 # local shell function to parse and process file containing certificate
 # chain configuration and list of tests
 ########################################################################
 parse_config()
 {
     SCENARIO=
     LOGNAME=
     while read KEY VALUE
     do
         case "${KEY}" in
         "entity")
             ENTITY="${VALUE}"
             TYPE=
             ISSUER=
             CTYPE=
             POLICY=
             MAPPING=
             INHIBIT=
             AIA=
             CRLDP=
             OCSP=
             DB=
             EMAILS=
             EXT_KU=
             EXT_NS=
             EXT_EKU=
             SERIAL=
 	    EXPORT_KEY=
             ;;
         "type")
             TYPE="${VALUE}"
             ;;
         "issuer")
             if [ -n "${ISSUER}" ]; then
                 if [ -z "${DB}" ]; then
                     create_entity "${ENTITY}" "${TYPE}"
                 fi
                 sign_cert "${ENTITY}" "${ISSUER}" "${TYPE}"
             fi
             ISSUER="${VALUE}"
             POLICY=
             MAPPING=
             INHIBIT=
             AIA=
             EXT_KU=
             EXT_NS=
             EXT_EKU=
             ;;
         "ctype")
             CTYPE="${VALUE}"
             ;;
         "policy")
             POLICY="${POLICY} ${VALUE}"
             ;;
         "mapping")
             MAPPING="${MAPPING} ${VALUE}"
             ;;
         "inhibit")
             INHIBIT="${VALUE}"
             ;;
         "aia")
             AIA="${AIA} ${VALUE}"
             ;;
         "crldp")
             CRLDP="${CRLDP} ${VALUE}"
             ;;
         "ocsp")
             OCSP="${VALUE}"
             ;;
         "db")
             DB="${VALUE}DB"
             create_db "${DB}"
             ;;
         "import")
             IMPORT="${VALUE}"
             import_cert "${IMPORT}" "${DB}"
             import_crl "${IMPORT}" "${DB}"
             ;;
         "import_key")
             IMPORT="${VALUE}"
             import_key "${IMPORT}" "${DB}"
             ;;
         "crl")
             ISSUER="${VALUE}"
             create_crl "${ISSUER}"
             ;;
         "revoke")
             REVOKE="${VALUE}"
             ;;
         "serial")
             SERIAL="${VALUE}"
             ;;
 	"export_key")
 	    EXPORT_KEY=1
 	    ;;
         "copycrl")
             COPYCRL="${VALUE}"
             copy_crl "${COPYCRL}"
             ;;
         "verify")
             VERIFY="${VALUE}"
             TRUST=
             TRUST_AND_DB=
             POLICY=
             FETCH=
             EXP_RESULT=
             REV_OPTS=
             USAGE_OPT=
             ;;
         "cert")
             VERIFY="${VERIFY} ${VALUE}"
             ;;
         "testdb")
             if [ -n "${VALUE}" ]; then
                 DB="${VALUE}DB"
             else
                 DB=
             fi
             ;;
         "trust")
             TRUST="${TRUST} ${VALUE}"
             ;;
         "trust_and_db")
             TRUST_AND_DB=1
             ;;
         "fetch")
             FETCH=1
             ;;
         "result")
             EXP_RESULT="${VALUE}"
             parse_result
             ;;
         "rev_type")
             REV_OPTS="${REV_OPTS} -g ${VALUE}"
             ;;
         "rev_flags")
             REV_OPTS="${REV_OPTS} -h ${VALUE}"
             ;;
         "rev_mtype")
             REV_OPTS="${REV_OPTS} -m ${VALUE}"
             ;;
         "rev_mflags")
             REV_OPTS="${REV_OPTS} -s ${VALUE}"
             ;;
         "scenario")
             SCENARIO="${VALUE}: "
             CHAINS_DIR="${HOSTDIR}/chains/${VALUE}"
             mkdir -p ${CHAINS_DIR}
             cd ${CHAINS_DIR}
             if [ -n "${MEMLEAK_DBG}" ]; then
                 LOGNAME="libpkix-${VALUE}"
                 LOGFILE="${LOGDIR}/${LOGNAME}"
             fi
             SCEN_CNT=$(expr ${SCEN_CNT} + 1)
             ;;
         "sleep")
             sleep ${VALUE}
             ;;
         "break")
             break
             ;;
         "check_ocsp")
             TESTNAME="Test that OCSP server is reachable"
             check_ocsp ${VALUE}
             if [ $? -ne 0 ]; then
                 html_failed "$TESTNAME"
                 break;
             else
                 html_passed "$TESTNAME"
             fi
             ;;
         "ku")
             EXT_KU="${VALUE}"
             ;;
         "ns")
             EXT_NS="${VALUE}"
             ;;
         "eku")
             EXT_EKU="${VALUE}"
             ;;
         "usage")
             USAGE_OPT="-u ${VALUE}"
             ;;
         "")
             if [ -n "${ENTITY}" ]; then
                 if [ -z "${DB}" ]; then
                     create_entity "${ENTITY}" "${TYPE}"
                 fi
                 sign_cert "${ENTITY}" "${ISSUER}" "${TYPE}"
                 if [ "${TYPE}" = "Bridge" ]; then
                     create_pkcs7 "${ENTITY}"
                 fi
 		if [ -n "${EXPORT_KEY}" ]; then
 		    export_key "${ENTITY}" "${DB}"
 		fi
                 ENTITY=
             fi
             if [ -n "${VERIFY}" ]; then
                 verify_cert "-pp"
 		if [ -n "${VERIFY_CLASSIC_ENGINE_TOO}" ]; then
 		    verify_cert ""
 		    verify_cert "-p"
 		fi
                 VERIFY=
             fi
             if [ -n "${REVOKE}" ]; then
                 revoke_cert "${REVOKE}" "${DB}"
                 REVOKE=
             fi
             ;;
         *)
             if [ `echo ${KEY} | cut -b 1` != "#" ]; then
                 echo "Configuration error: Unknown keyword ${KEY}"
                 exit 1
             fi
             ;;
         esac
     done
     if [ -n "${MEMLEAK_DBG}" ]; then
         log_parse
         html_msg $? 0 "${SCENARIO}Memory leak checking"
     fi
 }
 process_scenario()
 {
     SCENARIO_FILE=$1
     > ${AIA_FILES}
     parse_config < "${QADIR}/chains/scenarios/${SCENARIO_FILE}"
     while read AIA_FILE
     do
 	rm ${AIA_FILE} 2> /dev/null
     done < ${AIA_FILES}
     rm ${AIA_FILES}
 }
 # process ocspd.cfg separately
 chains_ocspd()
 {
     process_scenario "ocspd.cfg"
 }
 # process ocsp.cfg separately
 chains_method()
 {
     process_scenario "method.cfg"
 }
 ############################# chains_main ##############################
 # local shell function to process all testing scenarios
 ########################################################################
 chains_main()
 {
     while read LINE
     do
         [ `echo ${LINE} | cut -b 1` != "#" ] || continue
 	[ ${LINE} != 'ocspd.cfg' ] || continue
 	[ ${LINE} != 'method.cfg' ] || continue
 	process_scenario ${LINE}
     done < "${CHAINS_SCENARIOS}"
 }
 ################################ main ##################################
 chains_init
 VERIFY_CLASSIC_ENGINE_TOO=
 chains_ocspd
 VERIFY_CLASSIC_ENGINE_TOO=1
 chains_run_httpserv get
 chains_method
 chains_stop_httpserv
 chains_run_httpserv post
 chains_method
 chains_stop_httpserv
 VERIFY_CLASSIC_ENGINE_TOO=
 chains_run_httpserv random
 chains_main
 chains_stop_httpserv
 chains_run_httpserv get-unknown
 chains_main
 chains_stop_httpserv
 chains_cleanup

The Tor Browser / annotate

security/nss/tests/chains/chains.sh@b8a032363ba2 (annotated)

security/nss/tests/chains/chains.sh