The Tor Browser / file comparison
comparison: security/nss/tests/iopr/cert_iopr.sh
security/nss/tests/iopr/cert_iopr.sh
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
equal
deleted
inserted
replaced
| -1:000000000000 | 0:cbcca056f6bd |
|---|---|
| 1 #! /bin/bash | |
| 2 # | |
| 3 # This Source Code Form is subject to the terms of the Mozilla Public | |
| 4 # License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 5 # file, You can obtain one at http://mozilla.org/MPL/2.0/. | |
| 6 | |
| 7 ######################################################################## | |
| 8 # | |
| 9 # mozilla/security/nss/tests/iopr/cert_iopr.sh | |
| 10 # | |
| 11 # Certificate generating and handeling for NSS interoperability QA. This file | |
| 12 # is included from cert.sh | |
| 13 # | |
| 14 # needs to work on all Unix and Windows platforms | |
| 15 # | |
| 16 # special strings | |
| 17 # --------------- | |
| 18 # FIXME ... known problems, search for this string | |
| 19 # NOTE .... unexpected behavior | |
| 20 ######################################################################## | |
| 21 | |
| 22 IOPR_CERT_SOURCED=1 | |
| 23 | |
| 24 ######################################################################## | |
| 25 # function wraps calls to pk12util, also: writes action and options | |
| 26 # to stdout. | |
| 27 # Params are the same as to pk12util. | |
| 28 # Returns pk12util status | |
| 29 # | |
| 30 pk12u() | |
| 31 { | |
| 32 echo "${CU_ACTION} --------------------------" | |
| 33 | |
| 34 echo "pk12util $@" | |
| 35 ${BINDIR}/pk12util $@ | |
| 36 RET=$? | |
| 37 | |
| 38 return $RET | |
| 39 } | |
| 40 | |
| 41 ######################################################################## | |
| 42 # Initializes nss db directory and files if they don't exists | |
| 43 # Params: | |
| 44 # $1 - directory location | |
| 45 # | |
| 46 createDBDir() { | |
| 47 trgDir=$1 | |
| 48 | |
| 49 if [ -z "`ls $trgDir | grep db`" ]; then | |
| 50 trgDir=`cd ${trgDir}; pwd` | |
| 51 if [ "${OS_ARCH}" = "WINNT" -a "$OS_NAME" = "CYGWIN_NT" ]; then | |
| 52 trgDir=`cygpath -m ${trgDir}` | |
| 53 fi | |
| 54 | |
| 55 CU_ACTION="Initializing DB at ${trgDir}" | |
| 56 certu -N -d "${trgDir}" -f "${R_PWFILE}" 2>&1 | |
| 57 if [ "$RET" -ne 0 ]; then | |
| 58 return $RET | |
| 59 fi | |
| 60 | |
| 61 CU_ACTION="Loading root cert module to Cert DB at ${trgDir}" | |
| 62 modu -add "RootCerts" -libfile "${ROOTCERTSFILE}" -dbdir "${trgDir}" 2>&1 | |
| 63 if [ "$RET" -ne 0 ]; then | |
| 64 return $RET | |
| 65 fi | |
| 66 fi | |
| 67 } | |
| 68 ######################################################################## | |
| 69 # takes care of downloading config, cert and crl files from remote | |
| 70 # location. | |
| 71 # Params: | |
| 72 # $1 - name of the host file will be downloaded from | |
| 73 # $2 - path to the file as it appeared in url | |
| 74 # $3 - target directory the file will be saved at. | |
| 75 # Returns tstclnt status. | |
| 76 # | |
| 77 download_file() { | |
| 78 host=$1 | |
| 79 filePath=$2 | |
| 80 trgDir=$3 | |
| 81 | |
| 82 file=$trgDir/`basename $filePath` | |
| 83 | |
| 84 createDBDir $trgDir || return $RET | |
| 85 | |
| 86 # echo wget -O $file http://${host}${filePath} | |
| 87 # wget -O $file http://${host}${filePath} | |
| 88 # ret=$? | |
| 89 | |
| 90 req=$file.$$ | |
| 91 echo "GET $filePath HTTP/1.0" > $req | |
| 92 echo >> $req | |
| 93 | |
| 94 echo ${BINDIR}/tstclnt -d $trgDir -S -h $host -p $IOPR_DOWNLOAD_PORT \ | |
| 95 -v -w ${R_PWFILE} -o | |
| 96 ${BINDIR}/tstclnt -d $trgDir -S -h $host -p $IOPR_DOWNLOAD_PORT \ | |
| 97 -v -w ${R_PWFILE} -o < $req > $file | |
| 98 ret=$? | |
| 99 rm -f $_tmp; | |
| 100 return $ret | |
| 101 } | |
| 102 | |
| 103 ######################################################################## | |
| 104 # Uses pk12util, certutil of cerlutil to import files to an nss db located | |
| 105 # at <dir>(the value of $1 parameter). Chooses a utility to use based on | |
| 106 # a file extension. Initializing a db if it does not exists. | |
| 107 # Params: | |
| 108 # $1 - db location directory | |
| 109 # $2 - file name to import | |
| 110 # $3 - nick name an object in the file will be associated with | |
| 111 # $4 - trust arguments | |
| 112 # Returns status of import | |
| 113 # | |
| 114 importFile() { | |
| 115 dir=$1\ | |
| 116 file=$2 | |
| 117 certName=$3 | |
| 118 certTrust=$4 | |
| 119 | |
| 120 [ ! -d $dir ] && mkdir -p $dir; | |
| 121 | |
| 122 createDBDir $dir || return $RET | |
| 123 | |
| 124 case `basename $file | sed 's/^.*\.//'` in | |
| 125 p12) | |
| 126 CU_ACTION="Importing p12 $file to DB at $dir" | |
| 127 pk12u -d $dir -i $file -k ${R_PWFILE} -W iopr | |
| 128 [ $? -ne 0 ] && return 1 | |
| 129 CU_ACTION="Modifying trust for cert $certName at $dir" | |
| 130 certu -M -n "$certName" -t "$certTrust" -f "${R_PWFILE}" -d "${dir}" | |
| 131 return $? | |
| 132 ;; | |
| 133 | |
| 134 crl) | |
| 135 CU_ACTION="Importing crl $file to DB at $dir" | |
| 136 crlu -d ${dir} -I -n TestCA -i $file | |
| 137 return $? | |
| 138 ;; | |
| 139 | |
| 140 crt | cert) | |
| 141 CU_ACTION="Importing cert $certName with trust $certTrust to $dir" | |
| 142 certu -A -n "$certName" -t "$certTrust" -f "${R_PWFILE}" -d "${dir}" \ | |
| 143 -i "$file" | |
| 144 return $? | |
| 145 ;; | |
| 146 | |
| 147 *) | |
| 148 echo "Unknown file extension: $file:" | |
| 149 return 1 | |
| 150 ;; | |
| 151 esac | |
| 152 } | |
| 153 | |
| 154 | |
| 155 ######################################################################### | |
| 156 # Downloads and installs test certs and crl from a remote webserver. | |
| 157 # Generates server cert for reverse testing if reverse test run is turned on. | |
| 158 # Params: | |
| 159 # $1 - host name to download files from. | |
| 160 # $2 - directory at which CA cert will be installed and used for | |
| 161 # signing a server cert. | |
| 162 # $3 - path to a config file in webserver context. | |
| 163 # $4 - ssl server db location | |
| 164 # $5 - ssl client db location | |
| 165 # $5 - ocsp client db location | |
| 166 # | |
| 167 # Returns 0 upon success, otherwise, failed command error code. | |
| 168 # | |
| 169 download_install_certs() { | |
| 170 host=$1 | |
| 171 caDir=$2 | |
| 172 confPath=$3 | |
| 173 sslServerDir=$4 | |
| 174 sslClientDir=$5 | |
| 175 ocspClientDir=$6 | |
| 176 | |
| 177 [ ! -d "$caDir" ] && mkdir -p $caDir; | |
| 178 | |
| 179 #======================================================= | |
| 180 # Getting config file | |
| 181 # | |
| 182 download_file $host "$confPath/iopr_server.cfg" $caDir | |
| 183 RET=$? | |
| 184 if [ $RET -ne 0 -o ! -f $caDir/iopr_server.cfg ]; then | |
| 185 html_failed "Fail to download website config file(ws: $host)" | |
| 186 return 1 | |
| 187 fi | |
| 188 | |
| 189 . $caDir/iopr_server.cfg | |
| 190 RET=$? | |
| 191 if [ $RET -ne 0 ]; then | |
| 192 html_failed "Fail to source config file(ws: $host)" | |
| 193 return $RET | |
| 194 fi | |
| 195 | |
| 196 #======================================================= | |
| 197 # Getting CA file | |
| 198 # | |
| 199 | |
| 200 #----------------- !!!WARNING!!! ----------------------- | |
| 201 # Do NOT copy this scenario. CA should never accompany its | |
| 202 # cert with the private key when deliver cert to a customer. | |
| 203 #----------------- !!!WARNING!!! ----------------------- | |
| 204 | |
| 205 download_file $host $certDir/$caCertName.p12 $caDir | |
| 206 RET=$? | |
| 207 if [ $RET -ne 0 -o ! -f $caDir/$caCertName.p12 ]; then | |
| 208 html_failed "Fail to download $caCertName cert(ws: $host)" | |
| 209 return 1 | |
| 210 fi | |
| 211 tmpFiles="$caDir/$caCertName.p12" | |
| 212 | |
| 213 importFile $caDir $caDir/$caCertName.p12 $caCertName "TC,C,C" | |
| 214 RET=$? | |
| 215 if [ $RET -ne 0 ]; then | |
| 216 html_failed "Fail to import $caCertName cert to CA DB(ws: $host)" | |
| 217 return $RET | |
| 218 fi | |
| 219 | |
| 220 CU_ACTION="Exporting Root CA cert(ws: $host)" | |
| 221 certu -L -n $caCertName -r -d ${caDir} -o $caDir/$caCertName.cert | |
| 222 if [ "$RET" -ne 0 ]; then | |
| 223 Exit 7 "Fatal - failed to export $caCertName cert" | |
| 224 fi | |
| 225 | |
| 226 #======================================================= | |
| 227 # Check what tests we want to run | |
| 228 # | |
| 229 doSslTests=0; doOcspTests=0 | |
| 230 # XXX remove "_new" from variables below | |
| 231 [ -n "`echo ${supportedTests_new} | grep -i ssl`" ] && doSslTests=1 | |
| 232 [ -n "`echo ${supportedTests_new} | grep -i ocsp`" ] && doOcspTests=1 | |
| 233 | |
| 234 if [ $doSslTests -eq 1 ]; then | |
| 235 if [ "$reverseRunCGIScript" ]; then | |
| 236 [ ! -d "$sslServerDir" ] && mkdir -p $sslServerDir; | |
| 237 #======================================================= | |
| 238 # Import CA cert to server DB | |
| 239 # | |
| 240 importFile $sslServerDir $caDir/$caCertName.cert server-client-CA \ | |
| 241 "TC,C,C" | |
| 242 RET=$? | |
| 243 if [ $RET -ne 0 ]; then | |
| 244 html_failed "Fail to import server-client-CA cert to \ | |
| 245 server DB(ws: $host)" | |
| 246 return $RET | |
| 247 fi | |
| 248 | |
| 249 #======================================================= | |
| 250 # Creating server cert | |
| 251 # | |
| 252 CERTNAME=$HOSTADDR | |
| 253 | |
| 254 CU_ACTION="Generate Cert Request for $CERTNAME (ws: $host)" | |
| 255 CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}@bogus.com, O=BOGUS NSS, \ | |
| 256 L=Mountain View, ST=California, C=US" | |
| 257 certu -R -d "${sslServerDir}" -f "${R_PWFILE}" -z "${R_NOISE_FILE}"\ | |
| 258 -o $sslServerDir/req 2>&1 | |
| 259 tmpFiles="$tmpFiles $sslServerDir/req" | |
| 260 | |
| 261 # NOTE: | |
| 262 # For possible time synchronization problems (bug 444308) we generate | |
| 263 # certificates valid also some time in past (-w -1) | |
| 264 | |
| 265 CU_ACTION="Sign ${CERTNAME}'s Request (ws: $host)" | |
| 266 certu -C -c "$caCertName" -m `date +"%s"` -v 60 -w -1 \ | |
| 267 -d "${caDir}" \ | |
| 268 -i ${sslServerDir}/req -o $caDir/${CERTNAME}.cert \ | |
| 269 -f "${R_PWFILE}" 2>&1 | |
| 270 | |
| 271 importFile $sslServerDir $caDir/$CERTNAME.cert $CERTNAME ",," | |
| 272 RET=$? | |
| 273 if [ $RET -ne 0 ]; then | |
| 274 html_failed "Fail to import $CERTNAME cert to server\ | |
| 275 DB(ws: $host)" | |
| 276 return $RET | |
| 277 fi | |
| 278 tmpFiles="$tmpFiles $caDir/$CERTNAME.cert" | |
| 279 | |
| 280 #======================================================= | |
| 281 # Download and import CA crl to server DB | |
| 282 # | |
| 283 download_file $host "$certDir/$caCrlName.crl" $sslServerDir | |
| 284 RET=$? | |
| 285 if [ $? -ne 0 ]; then | |
| 286 html_failed "Fail to download $caCertName crl\ | |
| 287 (ws: $host)" | |
| 288 return $RET | |
| 289 fi | |
| 290 tmpFiles="$tmpFiles $sslServerDir/$caCrlName.crl" | |
| 291 | |
| 292 importFile $sslServerDir $sslServerDir/TestCA.crl | |
| 293 RET=$? | |
| 294 if [ $RET -ne 0 ]; then | |
| 295 html_failed "Fail to import TestCA crt to server\ | |
| 296 DB(ws: $host)" | |
| 297 return $RET | |
| 298 fi | |
| 299 fi # if [ "$reverseRunCGIScript" ] | |
| 300 | |
| 301 [ ! -d "$sslClientDir" ] && mkdir -p $sslClientDir; | |
| 302 #======================================================= | |
| 303 # Import CA cert to ssl client DB | |
| 304 # | |
| 305 importFile $sslClientDir $caDir/$caCertName.cert server-client-CA \ | |
| 306 "TC,C,C" | |
| 307 RET=$? | |
| 308 if [ $RET -ne 0 ]; then | |
| 309 html_failed "Fail to import server-client-CA cert to \ | |
| 310 server DB(ws: $host)" | |
| 311 return $RET | |
| 312 fi | |
| 313 fi | |
| 314 | |
| 315 if [ $doOcspTests -eq 1 ]; then | |
| 316 [ ! -d "$ocspClientDir" ] && mkdir -p $ocspClientDir; | |
| 317 #======================================================= | |
| 318 # Import CA cert to ocsp client DB | |
| 319 # | |
| 320 importFile $ocspClientDir $caDir/$caCertName.cert server-client-CA \ | |
| 321 "TC,C,C" | |
| 322 RET=$? | |
| 323 if [ $RET -ne 0 ]; then | |
| 324 html_failed "Fail to import server-client-CA cert to \ | |
| 325 server DB(ws: $host)" | |
| 326 return $RET | |
| 327 fi | |
| 328 fi | |
| 329 | |
| 330 #======================================================= | |
| 331 # Import client certs to client DB | |
| 332 # | |
| 333 for fileName in $downloadFiles; do | |
| 334 certName=`echo $fileName | sed 's/\..*//'` | |
| 335 | |
| 336 if [ -n "`echo $certName | grep ocsp`" -a $doOcspTests -eq 1 ]; then | |
| 337 clientDir=$ocspClientDir | |
| 338 elif [ $doSslTests -eq 1 ]; then | |
| 339 clientDir=$sslClientDir | |
| 340 else | |
| 341 continue | |
| 342 fi | |
| 343 | |
| 344 download_file $host "$certDir/$fileName" $clientDir | |
| 345 RET=$? | |
| 346 if [ $RET -ne 0 -o ! -f $clientDir/$fileName ]; then | |
| 347 html_failed "Fail to download $certName cert(ws: $host)" | |
| 348 return $RET | |
| 349 fi | |
| 350 tmpFiles="$tmpFiles $clientDir/$fileName" | |
| 351 | |
| 352 importFile $clientDir $clientDir/$fileName $certName ",," | |
| 353 RET=$? | |
| 354 if [ $RET -ne 0 ]; then | |
| 355 html_failed "Fail to import $certName cert to client DB\ | |
| 356 (ws: $host)" | |
| 357 return $RET | |
| 358 fi | |
| 359 done | |
| 360 | |
| 361 rm -f $tmpFiles | |
| 362 | |
| 363 return 0 | |
| 364 } | |
| 365 | |
| 366 | |
| 367 ######################################################################### | |
| 368 # Initial point for downloading config, cert, crl files for multiple hosts | |
| 369 # involved in interoperability testing. Called from nss/tests/cert/cert.sh | |
| 370 # It will only proceed with downloading if environment variable | |
| 371 # IOPR_HOSTADDR_LIST is set and has a value of host names separated by space. | |
| 372 # | |
| 373 # Returns 1 if interoperability testing is off, 0 otherwise. | |
| 374 # | |
| 375 cert_iopr_setup() { | |
| 376 | |
| 377 if [ "$IOPR" -ne 1 ]; then | |
| 378 return 1 | |
| 379 fi | |
| 380 num=1 | |
| 381 IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f 1 -d' '` | |
| 382 while [ "$IOPR_HOST_PARAM" ]; do | |
| 383 IOPR_HOSTADDR=`echo $IOPR_HOST_PARAM | cut -f 1 -d':'` | |
| 384 IOPR_DOWNLOAD_PORT=`echo "$IOPR_HOST_PARAM:" | cut -f 2 -d':'` | |
| 385 [ -z "$IOPR_DOWNLOAD_PORT" ] && IOPR_DOWNLOAD_PORT=443 | |
| 386 IOPR_CONF_PATH=`echo "$IOPR_HOST_PARAM:" | cut -f 3 -d':'` | |
| 387 [ -z "$IOPR_CONF_PATH" ] && IOPR_CONF_PATH="/iopr" | |
| 388 | |
| 389 echo "Installing certs for $IOPR_HOSTADDR:$IOPR_DOWNLOAD_PORT:\ | |
| 390 $IOPR_CONF_PATH" | |
| 391 | |
| 392 download_install_certs ${IOPR_HOSTADDR} ${IOPR_CADIR}_${IOPR_HOSTADDR} \ | |
| 393 ${IOPR_CONF_PATH} ${IOPR_SSL_SERVERDIR}_${IOPR_HOSTADDR} \ | |
| 394 ${IOPR_SSL_CLIENTDIR}_${IOPR_HOSTADDR} \ | |
| 395 ${IOPR_OCSP_CLIENTDIR}_${IOPR_HOSTADDR} | |
| 396 if [ $? -ne 0 ]; then | |
| 397 echo "wsFlags=\"NOIOPR $wsParam\"" >> \ | |
| 398 ${IOPR_CADIR}_${IOPR_HOSTADDR}/iopr_server.cfg | |
| 399 fi | |
| 400 num=`expr $num + 1` | |
| 401 IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '` | |
| 402 done | |
| 403 | |
| 404 return 0 | |
| 405 } |
