The Tor Browser: security/nss/tests/merge/merge.sh@b8a032363ba2

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

     1 #! /bin/bash

2 #

     3 # This Source Code Form is subject to the terms of the Mozilla Public

     4 # License, v. 2.0. If a copy of the MPL was not distributed with this

     5 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

     7 ########################################################################

8 #

     9 # mozilla/security/nss/tests/merge/merge.sh

    10 #

    11 # Script to test NSS merge

    12 #

    13 # needs to work on all Unix and Windows platforms

    14 #

    15 # special strings

    16 # ---------------

    17 #   FIXME ... known problems, search for this string

    18 #   NOTE .... unexpected behavior

    19 #

    20 ########################################################################

    22 ############################## merge_init ##############################

    23 # local shell function to initialize this script

    24 ########################################################################

    25 merge_init()

    26 {

    27   SCRIPTNAME=merge.sh      # sourced - $0 would point to all.sh

    28   HAS_EXPLICIT_DB=0

    29   if [ ! -z "${NSS_DEFAULT_DB_TYPE}" ]; then

    30      HAS_EXPLICIT_DB=1

    31   fi

    34   if [ -z "${CLEANUP}" ] ; then     # if nobody else is responsible for

    35       CLEANUP="${SCRIPTNAME}"       # cleaning this script will do it

    36   fi

    38   if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then

    39       cd ../common

    40       . ./init.sh

    41   fi

    42   if [ ! -r $CERT_LOG_FILE ]; then  # we need certificates here

    43       cd ${QADIR}/cert

    44       . ./cert.sh

    45   fi

    47   if [ ! -d ${HOSTDIR}/SDR ]; then

    48       cd ${QADIR}/sdr

    49       . ./sdr.sh

    50   fi

    51   SCRIPTNAME=merge.sh

    53   html_head "Merge Tests"

    55   # need the SSL & SMIME directories from cert.sh

    56   grep "SUCCESS: SMIME passed" $CERT_LOG_FILE >/dev/null || {

    57       Exit 11 "Fatal - S/MIME of cert.sh needs to pass first"

    58   }

    59   grep "SUCCESS: SSL passed" $CERT_LOG_FILE >/dev/null || {

    60       Exit 8 "Fatal - SSL of cert.sh needs to pass first"

    61   }

    63   #temporary files for SDR tests

    64   VALUE1=$HOSTDIR/tests.v1.$$

    65   VALUE3=$HOSTDIR/tests.v3.$$

    67   # local directories used in this test.

    68   MERGEDIR=${HOSTDIR}/merge

    69   R_MERGEDIR=../merge

    70   D_MERGE="merge.$version"

    71   # SDR not initialized in common/init

    72   P_R_SDR=../SDR

    73   D_SDR="SDR.$version"

    74   mkdir -p ${MERGEDIR}

    76   PROFILE=.

    77   if [ -n "${MULTIACCESS_DBM}" ]; then

    78      PROFILE="multiaccess:${D_MERGE}"

    79      P_R_SDR="multiaccess:${D_SDR}"

    80   fi

    82   cd ${MERGEDIR}

    84   # clear out any existing databases, potentially from a previous run.

    85   rm -f *.db

    87   # copy alicedir over as a seed database.

    88   cp ${R_ALICEDIR}/* .

    89   # copy the smime text samples

    90   cp ${QADIR}/smime/*.txt .

    92   # create a set of conflicting names.

    93   CONFLICT1DIR=conflict1

    94   CONFLICT2DIR=conflict2

    95   mkdir ${CONFLICT1DIR}

    96   mkdir ${CONFLICT2DIR}

    97   # in the upgrade mode (dbm->sql), make sure our test databases

    98   # are dbm databases.

    99   if [ "${TEST_MODE}" = "UPGRADE_DB" ]; then

   100 	save=${NSS_DEFAULT_DB_TYPE}

   101 	NSS_DEFAULT_DB_TYPE= ; export NSS_DEFAULT_DB_TYPE

   102   fi

   104   certutil -N -d ${CONFLICT1DIR} -f ${R_PWFILE}

   105   certutil -N -d ${CONFLICT2DIR} -f ${R_PWFILE}

   106   certutil -A -n Alice -t ,, -i ${R_CADIR}/TestUser41.cert -d ${CONFLICT1DIR}

   107   certutil -A -n "Alice #1" -t ,, -i ${R_CADIR}/TestUser42.cert -d ${CONFLICT1DIR}

   108   certutil -A -n "Alice #99" -t ,, -i ${R_CADIR}/TestUser43.cert -d ${CONFLICT1DIR}

   109   certutil -A -n Alice -t ,, -i ${R_CADIR}/TestUser44.cert -d ${CONFLICT2DIR}

   110   certutil -A -n "Alice #1" -t ,, -i ${R_CADIR}/TestUser45.cert -d ${CONFLICT2DIR}

   111   certutil -A -n "Alice #99" -t ,, -i ${R_CADIR}/TestUser46.cert -d ${CONFLICT2DIR}

   112   if [ "${TEST_MODE}" = "UPGRADE_DB" ]; then

   113 	NSS_DEFAULT_DB_TYPE=${save}; export NSS_DEFAULT_DB_TYPE

   114   fi

   116   #

   117   # allow all the tests to run in standalone mode.

   118   #  in standalone mode, TEST_MODE is not set.

   119   #  if NSS_DEFAULT_DB_TYPE is dbm, then test merge with dbm

   120   #  if NSS_DEFAULT_DB_TYPE is sql, then test merge with sql

   121   #  if NSS_DEFAULT_DB_TYPE is not set, then test database upgrade merge

   122   #   from dbm databases (created above) into a new sql db.

   123   if [ -z "${TEST_MODE}" ] && [ ${HAS_EXPLICIT_DB} -eq 0 ]; then

   124 	echo "*** Using Standalone Upgrade DB mode"

   125 	NSS_DEFAULT_DB_TYPE=sql; export NSS_DEFAULT_DB_TYPE

   126 	echo certutil --upgrade-merge --source-dir ${P_R_ALICEDIR} --upgrade-id local -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE}

   127 	${BINDIR}/certutil --upgrade-merge --source-dir ${P_R_ALICEDIR} --upgrade-id local -d ${PROFILE}  -f ${R_PWFILE} -@ ${R_PWFILE}

   128 	TEST_MODE=UPGRADE_DB

   130   fi

   132 }

   134 #

   135 # this allows us to run this test for both merge and upgrade-merge cases.

   136 # merge_cmd takes the potential upgrade-id and the rest of the certutil

   137 # arguments.

   138 #

   139 merge_cmd()

   140 {

   141   MERGE_CMD=--merge

   142   if [ "${TEST_MODE}" = "UPGRADE_DB" ]; then

   143      MERGE_CMD="--upgrade-merge --upgrade-token-name OldDB --upgrade-id ${1}"

   144   fi

   145   shift

   146   echo certutil ${MERGE_CMD} $*

   147   ${PROFTOOL} ${BINDIR}/certutil ${MERGE_CMD} $*

   148 }

   151 merge_main()

   152 {

   153   # first create a local sdr key and encrypt some data with it

   154   # This will cause a colision with the SDR key in ../SDR.

   155   echo "$SCRIPTNAME: Creating an SDR key & Encrypt"

   156   echo "sdrtest -d ${PROFILE} -o ${VALUE3} -t Test2 -f ${R_PWFILE}"

   157   ${PROFTOOL} ${BINDIR}/sdrtest -d ${PROFILE} -o ${VALUE3} -t Test2 -f ${R_PWFILE}

   158   html_msg $? 0 "Creating SDR Key"

   160   # Now merge in Dave

   161   # Dave's cert is already in alicedir, but his key isn't. This will make

   162   # sure we are updating the keys and CKA_ID's on the certificate properly.

   163   MERGE_ID=dave

   164   echo "$SCRIPTNAME: Merging in Key for Existing user"

   165   merge_cmd dave --source-dir ${P_R_DAVEDIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE}

   166   html_msg $? 0 "Merging Dave"

   168   # Merge in server

   169   # contains a CRL and new user certs

   170   MERGE_ID=server

   171   echo "$SCRIPTNAME: Merging in new user "

   172   merge_cmd server --source-dir ${P_R_SERVERDIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE}

   173   html_msg $? 0 "Merging server"

   175   # Merge in ext_client

   176   # contains a new certificate chain and additional trust flags

   177   MERGE_ID=ext_client

   178   echo "$SCRIPTNAME: Merging in new chain "

   179   merge_cmd ext_client --source-dir ${P_R_EXT_CLIENTDIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE}

   180   html_msg $? 0 "Merging ext_client"

   182   # Merge conflicting nicknames in conflict1dir

   183   # contains several certificates with nicknames that conflict with the target

   184   # database

   185   MERGE_ID=conflict1

   186   echo "$SCRIPTNAME: Merging in conflicting nicknames 1"

   187   merge_cmd conflict1 --source-dir ${CONFLICT1DIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE}

   189   html_msg $? 0 "Merging conflicting nicknames 1"

   191   # Merge conflicting nicknames in conflict2dir

   192   # contains several certificates with nicknames that conflict with the target

   193   # database

   194   MERGE_ID=conflict2

   195   echo "$SCRIPTNAME: Merging in conflicting nicknames 1"

   196   merge_cmd conflict2 --source-dir ${CONFLICT2DIR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE}

   197   html_msg $? 0 "Merging conflicting nicknames 2"

   199   # Make sure conflicted names were properly sorted out.

   200   echo "$SCRIPTNAME: Verify nicknames were deconflicted (Alice #4)"

   201   certutil -L -n "Alice #4" -d ${PROFILE}

   202   html_msg $? 0 "Verify nicknames were deconflicted (Alice #4)"

   204   # Make sure conflicted names were properly sorted out.

   205   echo "$SCRIPTNAME: Verify nicknames were deconflicted (Alice #100)"

   206   certutil -L -n "Alice #100" -d ${PROFILE}

   207   html_msg $? 0 "Verify nicknames were deconflicted (Alice #100)"

   209   # Merge in SDR

   210   # contains a secret SDR key

   211   MERGE_ID=SDR

   212   echo "$SCRIPTNAME: Merging in SDR "

   213   merge_cmd sdr --source-dir ${P_R_SDR} -d ${PROFILE} -f ${R_PWFILE} -@ ${R_PWFILE}

   214   html_msg $? 0 "Merging SDR"

   216   # insert a listing of the database into the log for diagonic purposes

   217   ${BINDIR}/certutil -L -d ${PROFILE}

   218   ${BINDIR}/crlutil -L -d ${PROFILE}

   220   # Make sure we can decrypt with our original SDR key generated above

   221   echo "$SCRIPTNAME: Decrypt - With Original SDR Key"

   222   echo "sdrtest -d ${PROFILE} -i ${VALUE3} -t Test2 -f ${R_PWFILE}"

   223   ${PROFTOOL} ${BINDIR}/sdrtest -d ${PROFILE} -i ${VALUE3} -t Test2 -f ${R_PWFILE}

   224   html_msg $? 0 "Decrypt - Value 3"

   226   # Make sure we can decrypt with our the SDR key merged in from ../SDR

   227   echo "$SCRIPTNAME: Decrypt - With Merged SDR Key"

   228   echo "sdrtest -d ${PROFILE} -i ${VALUE1} -t Test1 -f ${R_PWFILE}"

   229   ${PROFTOOL} ${BINDIR}/sdrtest -d ${PROFILE} -i ${VALUE1} -t Test1 -f ${R_PWFILE}

   230   html_msg $? 0 "Decrypt - Value 1"

   232   # Make sure we can sign with merge certificate

   233   echo "$SCRIPTNAME: Signing with merged key  ------------------"

   234   echo "cmsutil -S -T -N Dave -H SHA1 -i alice.txt -d ${PROFILE} -p nss -o dave.dsig"

   235   ${PROFTOOL} ${BINDIR}/cmsutil -S -T -N Dave -H SHA1 -i alice.txt -d ${PROFILE} -p nss -o dave.dsig

   236   html_msg $? 0 "Create Detached Signature Dave" "."

   238   echo "cmsutil -D -i dave.dsig -c alice.txt -d ${PROFILE} "

   239   ${PROFTOOL} ${BINDIR}/cmsutil -D -i dave.dsig -c alice.txt -d ${PROFILE}

   240   html_msg $? 0 "Verifying Dave's Detached Signature"

   242   # Make sure that trust objects were properly merged

   243   echo "$SCRIPTNAME: verifying  merged cert  ------------------"

   244   echo "certutil -V -n ExtendedSSLUser -u C -d ${PROFILE}"

   245   ${PROFTOOL} ${BINDIR}/certutil -V -n ExtendedSSLUser -u C -d ${PROFILE}

   246   html_msg $? 0 "Verifying ExtendedSSL User Cert"

   248   # Make sure that the crl got properly copied in

   249   echo "$SCRIPTNAME: verifying  merged crl  ------------------"

   250   echo "crlutil -L -n TestCA -d ${PROFILE}"

   251   ${PROFTOOL} ${BINDIR}/crlutil -L -n TestCA -d ${PROFILE}

   252   html_msg $? 0 "Verifying TestCA CRL"

   254 }

   256 ############################## smime_cleanup ###########################

   257 # local shell function to finish this script (no exit since it might be

   258 # sourced)

   259 ########################################################################

   260 merge_cleanup()

   261 {

   262   html "</TABLE><BR>"

   263   cd ${QADIR}

   264   . common/cleanup.sh

   265 }

   267 ################## main #################################################

   269 merge_init

   270 merge_main

   271 merge_cleanup

The Tor Browser / file revision

security/nss/tests/merge/merge.sh@b8a032363ba2

security/nss/tests/merge/merge.sh