security/nss/tests/ssl/ssl.sh@b8a032363ba2
security/nss/tests/ssl/ssl.sh
Thu, 22 Jan 2015 13:21:57 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Thu, 22 Jan 2015 13:21:57 +0100
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
- permissions
- -rwxr-xr-x
Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6
1 #! /bin/bash
2 #
3 # This Source Code Form is subject to the terms of the Mozilla Public
4 # License, v. 2.0. If a copy of the MPL was not distributed with this
5 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
7 ########################################################################
8 #
9 # mozilla/security/nss/tests/ssl/ssl.sh
10 #
11 # Script to test NSS SSL
12 #
13 # needs to work on all Unix and Windows platforms
14 #
15 # special strings
16 # ---------------
17 # FIXME ... known problems, search for this string
18 # NOTE .... unexpected behavior
19 #
20 ########################################################################
22 ############################## ssl_init ################################
23 # local shell function to initialize this script
24 ########################################################################
25 ssl_init()
26 {
27 SCRIPTNAME=ssl.sh # sourced - $0 would point to all.sh
29 if [ -z "${CLEANUP}" ] ; then # if nobody else is responsible for
30 CLEANUP="${SCRIPTNAME}" # cleaning this script will do it
31 fi
33 if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
34 cd ../common
35 . ./init.sh
36 fi
37 if [ -z "${IOPR_SSL_SOURCED}" ]; then
38 . ../iopr/ssl_iopr.sh
39 fi
40 if [ ! -r $CERT_LOG_FILE ]; then # we need certificates here
41 cd ../cert
42 . ./cert.sh
43 fi
44 SCRIPTNAME=ssl.sh
45 echo "$SCRIPTNAME: SSL tests ==============================="
47 grep "SUCCESS: SSL passed" $CERT_LOG_FILE >/dev/null || {
48 html_head "SSL Test failure"
49 Exit 8 "Fatal - cert.sh needs to pass first"
50 }
52 if [ -z "$NSS_TEST_DISABLE_CRL" ] ; then
53 grep "SUCCESS: SSL CRL prep passed" $CERT_LOG_FILE >/dev/null || {
54 html_head "SSL Test failure"
55 Exit 8 "Fatal - SSL of cert.sh needs to pass first"
56 }
57 fi
59 PORT=${PORT-8443}
60 NSS_SSL_TESTS=${NSS_SSL_TESTS:-normal_normal}
61 nss_ssl_run="stapling cov auth stress"
62 NSS_SSL_RUN=${NSS_SSL_RUN:-$nss_ssl_run}
64 # Test case files
65 SSLCOV=${QADIR}/ssl/sslcov.txt
66 SSLAUTH=${QADIR}/ssl/sslauth.txt
67 SSLSTRESS=${QADIR}/ssl/sslstress.txt
68 REQUEST_FILE=${QADIR}/ssl/sslreq.dat
70 #temparary files
71 SERVEROUTFILE=${TMP}/tests_server.$$
72 SERVERPID=${TMP}/tests_pid.$$
74 R_SERVERPID=../tests_pid.$$
76 TEMPFILES="$TMPFILES ${SERVEROUTFILE} ${SERVERPID}"
78 fileout=0 #FIXME, looks like all.sh tried to turn this on but actually didn't
79 #fileout=1
80 #verbose="-v" #FIXME - see where this is usefull
82 USER_NICKNAME=TestUser
83 NORM_EXT=""
85 if [ -z "$NSS_DISABLE_ECC" ] ; then
86 ECC_STRING=" - with ECC"
87 else
88 ECC_STRING=""
89 fi
91 CSHORT="-c ABCDEF:003B:003C:003D:0041:0084:009Ccdefgijklmnvyz"
92 CLONG="-c ABCDEF:C001:C002:C003:C004:C005:C006:C007:C008:C009:C00A:C00B:C00C:C00D:C00E:C00F:C010:C011:C012:C013:C014:C023:C027:C02B:C02F:003B:003C:003D:0041:0084:009Ccdefgijklmnvyz"
94 if [ "${OS_ARCH}" != "WINNT" ]; then
95 ulimit -n 1000 # make sure we have enough file descriptors
96 fi
98 cd ${CLIENTDIR}
99 }
101 ########################### is_selfserv_alive ##########################
102 # local shell function to exit with a fatal error if selfserver is not
103 # running
104 ########################################################################
105 is_selfserv_alive()
106 {
107 if [ ! -f "${SERVERPID}" ]; then
108 echo "$SCRIPTNAME: Error - selfserv PID file ${SERVERPID} doesn't exist"
109 sleep 5
110 if [ ! -f "${SERVERPID}" ]; then
111 Exit 9 "Fatal - selfserv pid file ${SERVERPID} does not exist"
112 fi
113 fi
115 if [ "${OS_ARCH}" = "WINNT" ] && \
116 [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then
117 PID=${SHELL_SERVERPID}
118 else
119 PID=`cat ${SERVERPID}`
120 fi
122 echo "kill -0 ${PID} >/dev/null 2>/dev/null"
123 kill -0 ${PID} >/dev/null 2>/dev/null || Exit 10 "Fatal - selfserv process not detectable"
125 echo "selfserv with PID ${PID} found at `date`"
126 }
128 ########################### wait_for_selfserv ##########################
129 # local shell function to wait until selfserver is running and initialized
130 ########################################################################
131 wait_for_selfserv()
132 {
133 echo "trying to connect to selfserv at `date`"
134 echo "tstclnt -p ${PORT} -h ${HOSTADDR} ${CLIENT_OPTIONS} -q \\"
135 echo " -d ${P_R_CLIENTDIR} -v < ${REQUEST_FILE}"
136 ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} ${CLIENT_OPTIONS} -q \
137 -d ${P_R_CLIENTDIR} -v < ${REQUEST_FILE}
138 if [ $? -ne 0 ]; then
139 sleep 5
140 echo "retrying to connect to selfserv at `date`"
141 echo "tstclnt -p ${PORT} -h ${HOSTADDR} ${CLIENT_OPTIONS} -q \\"
142 echo " -d ${P_R_CLIENTDIR} -v < ${REQUEST_FILE}"
143 ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} ${CLIENT_OPTIONS} -q \
144 -d ${P_R_CLIENTDIR} -v < ${REQUEST_FILE}
145 if [ $? -ne 0 ]; then
146 html_failed "Waiting for Server"
147 fi
148 fi
149 is_selfserv_alive
150 }
152 ########################### kill_selfserv ##############################
153 # local shell function to kill the selfserver after the tests are done
154 ########################################################################
155 kill_selfserv()
156 {
157 if [ "${OS_ARCH}" = "WINNT" ] && \
158 [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then
159 PID=${SHELL_SERVERPID}
160 else
161 PID=`cat ${SERVERPID}`
162 fi
164 echo "trying to kill selfserv with PID ${PID} at `date`"
166 if [ "${OS_ARCH}" = "WINNT" -o "${OS_ARCH}" = "WIN95" -o "${OS_ARCH}" = "OS2" ]; then
167 echo "${KILL} ${PID}"
168 ${KILL} ${PID}
169 else
170 echo "${KILL} -USR1 ${PID}"
171 ${KILL} -USR1 ${PID}
172 fi
173 wait ${PID}
174 if [ ${fileout} -eq 1 ]; then
175 cat ${SERVEROUTFILE}
176 fi
178 # On Linux selfserv needs up to 30 seconds to fully die and free
179 # the port. Wait until the port is free. (Bug 129701)
180 if [ "${OS_ARCH}" = "Linux" ]; then
181 echo "selfserv -b -p ${PORT} 2>/dev/null;"
182 until ${BINDIR}/selfserv -b -p ${PORT} 2>/dev/null; do
183 echo "RETRY: selfserv -b -p ${PORT} 2>/dev/null;"
184 sleep 1
185 done
186 fi
188 echo "selfserv with PID ${PID} killed at `date`"
190 rm ${SERVERPID}
191 html_detect_core "kill_selfserv core detection step"
192 }
194 ########################### start_selfserv #############################
195 # local shell function to start the selfserver with the parameters required
196 # for this test and log information (parameters, start time)
197 # also: wait until the server is up and running
198 ########################################################################
199 start_selfserv()
200 {
201 if [ -n "$testname" ] ; then
202 echo "$SCRIPTNAME: $testname ----"
203 fi
204 sparam=`echo $sparam | sed -e 's;_; ;g'`
205 if [ -z "$NSS_DISABLE_ECC" ] && \
206 [ -z "$NO_ECC_CERTS" -o "$NO_ECC_CERTS" != "1" ] ; then
207 ECC_OPTIONS="-e ${HOSTADDR}-ec"
208 else
209 ECC_OPTIONS=""
210 fi
211 if [ "$1" = "mixed" ]; then
212 ECC_OPTIONS="-e ${HOSTADDR}-ecmixed"
213 fi
214 echo "selfserv starting at `date`"
215 echo "selfserv -D -p ${PORT} -d ${P_R_SERVERDIR} -n ${HOSTADDR} ${SERVER_OPTIONS} \\"
216 echo " ${ECC_OPTIONS} -w nss ${sparam} -i ${R_SERVERPID} $verbose &"
217 if [ ${fileout} -eq 1 ]; then
218 ${PROFTOOL} ${BINDIR}/selfserv -D -p ${PORT} -d ${P_R_SERVERDIR} -n ${HOSTADDR} ${SERVER_OPTIONS} \
219 ${ECC_OPTIONS} -w nss ${sparam} -i ${R_SERVERPID} $verbose \
220 > ${SERVEROUTFILE} 2>&1 &
221 RET=$?
222 else
223 ${PROFTOOL} ${BINDIR}/selfserv -D -p ${PORT} -d ${P_R_SERVERDIR} -n ${HOSTADDR} ${SERVER_OPTIONS} \
224 ${ECC_OPTIONS} -w nss ${sparam} -i ${R_SERVERPID} $verbose &
225 RET=$?
226 fi
228 # The PID $! returned by the MKS or Cygwin shell is not the PID of
229 # the real background process, but rather the PID of a helper
230 # process (sh.exe). MKS's kill command has a bug: invoking kill
231 # on the helper process does not terminate the real background
232 # process. Our workaround has been to have selfserv save its PID
233 # in the ${SERVERPID} file and "kill" that PID instead. But this
234 # doesn't work under Cygwin; its kill command doesn't recognize
235 # the PID of the real background process, but it does work on the
236 # PID of the helper process. So we save the value of $! in the
237 # SHELL_SERVERPID variable, and use it instead of the ${SERVERPID}
238 # file under Cygwin. (In fact, this should work in any shell
239 # other than the MKS shell.)
240 SHELL_SERVERPID=$!
241 wait_for_selfserv
243 if [ "${OS_ARCH}" = "WINNT" ] && \
244 [ "$OS_NAME" = "CYGWIN_NT" -o "$OS_NAME" = "MINGW32_NT" ]; then
245 PID=${SHELL_SERVERPID}
246 else
247 PID=`cat ${SERVERPID}`
248 fi
250 echo "selfserv with PID ${PID} started at `date`"
251 }
253 ############################## ssl_cov #################################
254 # local shell function to perform SSL Cipher Coverage tests
255 ########################################################################
256 ssl_cov()
257 {
258 html_head "SSL Cipher Coverage $NORM_EXT - server $SERVER_MODE/client $CLIENT_MODE $ECC_STRING"
260 testname=""
261 if [ -z "$NSS_DISABLE_ECC" ] ; then
262 sparam="$CLONG"
263 else
264 sparam="$CSHORT"
265 fi
267 mixed=0
268 start_selfserv # Launch the server
270 VMIN="ssl2"
271 VMAX="tls1.1"
273 exec < ${SSLCOV}
274 while read ectype testmax param testname
275 do
276 echo "${testname}" | grep "EXPORT" > /dev/null
277 EXP=$?
278 echo "${testname}" | grep "SSL2" > /dev/null
279 SSL2=$?
281 if [ "${SSL2}" -eq 0 ] ; then
282 # We cannot use asynchronous cert verification with SSL2
283 SSL2_FLAGS=-O
284 VMIN="ssl2"
285 else
286 # Do not enable SSL2 for non-SSL2-specific tests. SSL2 is disabled by
287 # default in libssl but it is enabled by default in tstclnt; we want
288 # to test the libssl default whenever possible.
289 SSL2_FLAGS=
290 VMIN="ssl3"
291 fi
293 if [ "$NORM_EXT" = "Extended Test" -a "${SSL2}" -eq 0 ] ; then
294 echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
295 elif [ "$ectype" = "ECC" -a -n "$NSS_DISABLE_ECC" ] ; then
296 echo "$SCRIPTNAME: skipping $testname (ECC only)"
297 elif [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] && [ "$SSL2" -eq 0 -o "$EXP" -eq 0 ] ; then
298 echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
299 elif [ "`echo $ectype | cut -b 1`" != "#" ] ; then
300 echo "$SCRIPTNAME: running $testname ----------------------------"
301 VMAX="ssl3"
302 if [ "$testmax" = "TLS10" ]; then
303 VMAX="tls1.0"
304 fi
305 if [ "$testmax" = "TLS11" ]; then
306 VMAX="tls1.1"
307 fi
308 if [ "$testmax" = "TLS12" ]; then
309 VMAX="tls1.2"
310 fi
312 # These five tests need an EC cert signed with RSA
313 # This requires a different certificate loaded in selfserv
314 # due to a (current) NSS limitation of only loaded one cert
315 # per type so the default selfserv setup will not work.
316 #:C00B TLS ECDH RSA WITH NULL SHA
317 #:C00C TLS ECDH RSA WITH RC4 128 SHA
318 #:C00D TLS ECDH RSA WITH 3DES EDE CBC SHA
319 #:C00E TLS ECDH RSA WITH AES 128 CBC SHA
320 #:C00F TLS ECDH RSA WITH AES 256 CBC SHA
322 if [ $mixed -eq 0 ]; then
323 if [ "${param}" = ":C00B" -o "${param}" = ":C00C" -o "${param}" = ":C00D" -o "${param}" = ":C00E" -o "${param}" = ":C00F" ]; then
324 kill_selfserv
325 start_selfserv mixed
326 mixed=1
327 else
328 is_selfserv_alive
329 fi
330 else
331 if [ "${param}" = ":C00B" -o "${param}" = ":C00C" -o "${param}" = ":C00D" -o "${param}" = ":C00E" -o "${param}" = ":C00F" ]; then
332 is_selfserv_alive
333 else
334 kill_selfserv
335 start_selfserv
336 mixed=0
337 fi
338 fi
340 echo "tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} -V ${VMIN}:${VMAX} ${SSL2_FLAGS} ${CLIENT_OPTIONS} \\"
341 echo " -f -d ${P_R_CLIENTDIR} -v -w nss < ${REQUEST_FILE}"
343 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
344 ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} -V ${VMIN}:${VMAX} ${SSL2_FLAGS} ${CLIENT_OPTIONS} -f \
345 -d ${P_R_CLIENTDIR} -v -w nss < ${REQUEST_FILE} \
346 >${TMP}/$HOST.tmp.$$ 2>&1
347 ret=$?
348 cat ${TMP}/$HOST.tmp.$$
349 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
350 html_msg $ret 0 "${testname}" \
351 "produced a returncode of $ret, expected is 0"
352 fi
353 done
355 kill_selfserv
356 html "</TABLE><BR>"
357 }
359 ############################## ssl_auth ################################
360 # local shell function to perform SSL Client Authentication tests
361 ########################################################################
362 ssl_auth()
363 {
364 html_head "SSL Client Authentication $NORM_EXT - server $SERVER_MODE/client $CLIENT_MODE $ECC_STRING"
366 exec < ${SSLAUTH}
367 while read ectype value sparam cparam testname
368 do
369 [ -z "$ectype" ] && continue
370 echo "${testname}" | grep "don't require client auth" > /dev/null
371 CAUTH=$?
373 if [ "${CLIENT_MODE}" = "fips" -a "${CAUTH}" -eq 0 ] ; then
374 echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
375 elif [ "$ectype" = "SNI" -a "$NORM_EXT" = "Extended Test" ] ; then
376 echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
377 elif [ "$ectype" = "ECC" -a -n "$NSS_DISABLE_ECC" ] ; then
378 echo "$SCRIPTNAME: skipping $testname (ECC only)"
379 elif [ "`echo $ectype | cut -b 1`" != "#" ]; then
380 cparam=`echo $cparam | sed -e 's;_; ;g' -e "s/TestUser/$USER_NICKNAME/g" `
381 if [ "$ectype" = "SNI" ]; then
382 cparam=`echo $cparam | sed -e "s/Host/$HOST/g" -e "s/Dom/$DOMSUF/g" `
383 sparam=`echo $sparam | sed -e "s/Host/$HOST/g" -e "s/Dom/$DOMSUF/g" `
384 fi
385 start_selfserv
387 echo "tstclnt -p ${PORT} -h ${HOSTADDR} -f -d ${P_R_CLIENTDIR} -v ${CLIENT_OPTIONS} \\"
388 echo " ${cparam} < ${REQUEST_FILE}"
389 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
390 ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -f ${cparam} ${CLIENT_OPTIONS} \
391 -d ${P_R_CLIENTDIR} -v < ${REQUEST_FILE} \
392 >${TMP}/$HOST.tmp.$$ 2>&1
393 ret=$?
394 cat ${TMP}/$HOST.tmp.$$
395 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
397 #workaround for bug #402058
398 [ $ret -ne 0 ] && ret=1
399 [ $value -ne 0 ] && value=1
401 html_msg $ret $value "${testname}" \
402 "produced a returncode of $ret, expected is $value"
403 kill_selfserv
404 fi
405 done
407 html "</TABLE><BR>"
408 }
410 ssl_stapling_sub()
411 {
412 testname=$1
413 SO=$2
414 value=$3
416 if [ "$NORM_EXT" = "Extended Test" ] ; then
417 # these tests use the ext_client directory for tstclnt,
418 # which doesn't contain the required "TestCA" for server cert
419 # verification, I don't know if it would be OK to add it...
420 echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
421 return 0
422 fi
423 if [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
424 echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
425 return 0
426 fi
428 SAVE_SERVER_OPTIONS=${SERVER_OPTIONS}
429 SERVER_OPTIONS="${SERVER_OPTIONS} ${SO}"
431 SAVE_P_R_SERVERDIR=${P_R_SERVERDIR}
432 P_R_SERVERDIR=${P_R_SERVERDIR}/../stapling/
434 echo "${testname}"
436 start_selfserv
438 echo "tstclnt -p ${PORT} -h ${HOSTADDR} -f -d ${P_R_CLIENTDIR} -v ${CLIENT_OPTIONS} \\"
439 echo " -T -O -F -M 1 -V ssl3: < ${REQUEST_FILE}"
440 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
441 ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -f ${CLIENT_OPTIONS} \
442 -d ${P_R_CLIENTDIR} -v -T -O -F -M 1 -V ssl3: < ${REQUEST_FILE} \
443 >${TMP}/$HOST.tmp.$$ 2>&1
444 ret=$?
445 cat ${TMP}/$HOST.tmp.$$
446 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
448 # hopefully no workaround for bug #402058 needed here?
449 # (see commands in ssl_auth
451 html_msg $ret $value "${testname}" \
452 "produced a returncode of $ret, expected is $value"
453 kill_selfserv
455 SERVER_OPTIONS=${SAVE_SERVER_OPTIONS}
456 P_R_SERVERDIR=${SAVE_P_R_SERVERDIR}
457 }
459 ssl_stapling_stress()
460 {
461 testname="Stress OCSP stapling, server uses random status"
462 SO="-A TestCA -T random"
463 value=0
465 if [ "$NORM_EXT" = "Extended Test" ] ; then
466 # these tests use the ext_client directory for tstclnt,
467 # which doesn't contain the required "TestCA" for server cert
468 # verification, I don't know if it would be OK to add it...
469 echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
470 return 0
471 fi
472 if [ "$SERVER_MODE" = "fips" -o "$CLIENT_MODE" = "fips" ] ; then
473 echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
474 return 0
475 fi
477 SAVE_SERVER_OPTIONS=${SERVER_OPTIONS}
478 SERVER_OPTIONS="${SERVER_OPTIONS} ${SO}"
480 SAVE_P_R_SERVERDIR=${P_R_SERVERDIR}
481 P_R_SERVERDIR=${P_R_SERVERDIR}/../stapling/
483 echo "${testname}"
484 start_selfserv
486 echo "strsclnt -q -p ${PORT} -d ${P_R_CLIENTDIR} ${CLIENT_OPTIONS} -w nss \\"
487 echo " -c 1000 -V ssl3: -N -T $verbose ${HOSTADDR}"
488 echo "strsclnt started at `date`"
489 ${PROFTOOL} ${BINDIR}/strsclnt -q -p ${PORT} -d ${P_R_CLIENTDIR} ${CLIENT_OPTIONS} -w nss \
490 -c 1000 -V ssl3: -N -T $verbose ${HOSTADDR}
491 ret=$?
493 echo "strsclnt completed at `date`"
494 html_msg $ret $value \
495 "${testname}" \
496 "produced a returncode of $ret, expected is $value."
497 kill_selfserv
499 SERVER_OPTIONS=${SAVE_SERVER_OPTIONS}
500 P_R_SERVERDIR=${SAVE_P_R_SERVERDIR}
501 }
503 ############################ ssl_stapling ##############################
504 # local shell function to perform SSL Cert Status (OCSP Stapling) tests
505 ########################################################################
506 ssl_stapling()
507 {
508 html_head "SSL Cert Status (OCSP Stapling) $NORM_EXT - server $SERVER_MODE/client $CLIENT_MODE $ECC_STRING"
510 # tstclnt Exit code:
511 # 0: have fresh and valid revocation data, status good
512 # 1: cert failed to verify, prior to revocation checking
513 # 2: missing, old or invalid revocation data
514 # 3: have fresh and valid revocation data, status revoked
516 # selfserv modes
517 # good, revoked, unkown: Include locally signed response. Requires: -A
518 # failure: Include OCSP failure status, such as "try later" (unsigned)
519 # badsig: use a good status but with an invalid signature
520 # corrupted: stapled cert status is an invalid block of data
522 ssl_stapling_sub "OCSP stapling, signed response, good status" "-A TestCA -T good" 0
523 ssl_stapling_sub "OCSP stapling, signed response, revoked status" "-A TestCA -T revoked" 3
524 ssl_stapling_sub "OCSP stapling, signed response, unknown status" "-A TestCA -T unknown" 2
525 ssl_stapling_sub "OCSP stapling, unsigned failure response" "-A TestCA -T failure" 2
526 ssl_stapling_sub "OCSP stapling, good status, bad signature" "-A TestCA -T badsig" 2
527 ssl_stapling_sub "OCSP stapling, invalid cert status data" "-A TestCA -T corrupted" 2
528 ssl_stapling_sub "Valid cert, Server doesn't staple" "" 2
530 ssl_stapling_stress
532 html "</TABLE><BR>"
533 }
536 ############################## ssl_stress ##############################
537 # local shell function to perform SSL stress test
538 ########################################################################
539 ssl_stress()
540 {
541 html_head "SSL Stress Test $NORM_EXT - server $SERVER_MODE/client $CLIENT_MODE $ECC_STRING"
543 exec < ${SSLSTRESS}
544 while read ectype value sparam cparam testname
545 do
546 if [ -z "$ectype" ]; then
547 # silently ignore blank lines
548 continue
549 fi
551 echo "${testname}" | grep "SSL2" > /dev/null
552 SSL2=$?
553 echo "${testname}" | grep "client auth" > /dev/null
554 CAUTH=$?
556 if [ "${SSL2}" -eq 0 -a "$NORM_EXT" = "Extended Test" ] ; then
557 echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
558 elif [ "$ectype" = "SNI" -a "$NORM_EXT" = "Extended Test" ] ; then
559 echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
560 elif [ "$ectype" = "ECC" -a -n "$NSS_DISABLE_ECC" ] ; then
561 echo "$SCRIPTNAME: skipping $testname (ECC only)"
562 elif [ "${SERVER_MODE}" = "fips" -o "${CLIENT_MODE}" = "fips" ] && [ "${SSL2}" -eq 0 ] ; then
563 echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
564 elif [ "${CLIENT_MODE}" = "fips" -a "${CAUTH}" -ne 0 ] ; then
565 echo "$SCRIPTNAME: skipping $testname (non-FIPS only)"
566 elif [ "`echo $ectype | cut -b 1`" != "#" ]; then
567 cparam=`echo $cparam | sed -e 's;_; ;g' -e "s/TestUser/$USER_NICKNAME/g" `
568 if [ "$ectype" = "SNI" ]; then
569 cparam=`echo $cparam | sed -e "s/Host/$HOST/g" -e "s/Dom/$DOMSUF/g" `
570 sparam=`echo $sparam | sed -e "s/Host/$HOST/g" -e "s/Dom/$DOMSUF/g" `
571 fi
573 # These tests need the mixed cert
574 # Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse)
575 # Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse, client auth)
576 p=`echo "$sparam" | sed -e "s/\(.*\)\(-c_:C0..\)\(.*\)/\2/"`;
577 if [ "$p" = "-c_:C00E" ]; then
578 start_selfserv mixed
579 else
580 start_selfserv
581 fi
583 if [ "`uname -n`" = "sjsu" ] ; then
584 echo "debugging disapering selfserv... ps -ef | grep selfserv"
585 ps -ef | grep selfserv
586 fi
588 echo "strsclnt -q -p ${PORT} -d ${P_R_CLIENTDIR} ${CLIENT_OPTIONS} -w nss $cparam \\"
589 echo " $verbose ${HOSTADDR}"
590 echo "strsclnt started at `date`"
591 ${PROFTOOL} ${BINDIR}/strsclnt -q -p ${PORT} -d ${P_R_CLIENTDIR} ${CLIENT_OPTIONS} -w nss $cparam \
592 $verbose ${HOSTADDR}
593 ret=$?
594 echo "strsclnt completed at `date`"
595 html_msg $ret $value \
596 "${testname}" \
597 "produced a returncode of $ret, expected is $value. "
598 if [ "`uname -n`" = "sjsu" ] ; then
599 echo "debugging disapering selfserv... ps -ef | grep selfserv"
600 ps -ef | grep selfserv
601 fi
602 kill_selfserv
603 fi
604 done
606 html "</TABLE><BR>"
607 }
609 ############################ ssl_crl_ssl ###############################
610 # local shell function to perform SSL test with/out revoked certs tests
611 ########################################################################
612 ssl_crl_ssl()
613 {
614 html_head "CRL SSL Client Tests $NORM_EXT $ECC_STRING"
616 # Using First CRL Group for this test. There are $CRL_GRP_1_RANGE certs in it.
617 # Cert number $UNREVOKED_CERT_GRP_1 was not revoked
618 CRL_GROUP_BEGIN=$CRL_GRP_1_BEGIN
619 CRL_GROUP_RANGE=$CRL_GRP_1_RANGE
620 UNREVOKED_CERT=$UNREVOKED_CERT_GRP_1
622 exec < ${SSLAUTH}
623 while read ectype value sparam cparam testname
624 do
625 [ "$ectype" = "" ] && continue
626 if [ "$ectype" = "ECC" -a -n "$NSS_DISABLE_ECC" ] ; then
627 echo "$SCRIPTNAME: skipping $testname (ECC only)"
628 elif [ "$ectype" = "SNI" ]; then
629 continue
630 elif [ "`echo $ectype | cut -b 1`" != "#" ]; then
631 servarg=`echo $sparam | awk '{r=split($0,a,"-r") - 1;print r;}'`
632 pwd=`echo $cparam | grep nss`
633 user=`echo $cparam | grep TestUser`
634 _cparam=$cparam
635 case $servarg in
636 1) if [ -z "$pwd" -o -z "$user" ]; then
637 rev_modvalue=0
638 else
639 rev_modvalue=254
640 fi
641 ;;
642 2) rev_modvalue=254 ;;
643 3) if [ -z "$pwd" -o -z "$user" ]; then
644 rev_modvalue=0
645 else
646 rev_modvalue=1
647 fi
648 ;;
649 4) rev_modvalue=1 ;;
650 esac
651 TEMP_NUM=0
652 while [ $TEMP_NUM -lt $CRL_GROUP_RANGE ]
653 do
654 CURR_SER_NUM=`expr ${CRL_GROUP_BEGIN} + ${TEMP_NUM}`
655 TEMP_NUM=`expr $TEMP_NUM + 1`
656 USER_NICKNAME="TestUser${CURR_SER_NUM}"
657 cparam=`echo $_cparam | sed -e 's;_; ;g' -e "s/TestUser/$USER_NICKNAME/g" `
658 start_selfserv
660 echo "tstclnt -p ${PORT} -h ${HOSTADDR} -f -d ${R_CLIENTDIR} -v \\"
661 echo " ${cparam} < ${REQUEST_FILE}"
662 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
663 ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -f ${cparam} \
664 -d ${R_CLIENTDIR} -v < ${REQUEST_FILE} \
665 >${TMP}/$HOST.tmp.$$ 2>&1
666 ret=$?
667 cat ${TMP}/$HOST.tmp.$$
668 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
669 if [ $CURR_SER_NUM -ne $UNREVOKED_CERT ]; then
670 modvalue=$rev_modvalue
671 testAddMsg="revoked"
672 else
673 testAddMsg="not revoked"
674 modvalue=$value
675 fi
677 html_msg $ret $modvalue "${testname} (cert ${USER_NICKNAME} - $testAddMsg)" \
678 "produced a returncode of $ret, expected is $modvalue"
679 kill_selfserv
680 done
681 fi
682 done
684 html "</TABLE><BR>"
685 }
687 ############################# is_revoked ###############################
688 # local shell function to check if certificate is revoked
689 ########################################################################
690 is_revoked() {
691 certNum=$1
692 currLoadedGrp=$2
694 found=0
695 ownerGrp=1
696 while [ $ownerGrp -le $TOTAL_GRP_NUM -a $found -eq 0 ]
697 do
698 currGrpBegin=`eval echo \$\{CRL_GRP_${ownerGrp}_BEGIN\}`
699 currGrpRange=`eval echo \$\{CRL_GRP_${ownerGrp}_RANGE\}`
700 currGrpEnd=`expr $currGrpBegin + $currGrpRange - 1`
701 if [ $certNum -ge $currGrpBegin -a $certNum -le $currGrpEnd ]; then
702 found=1
703 else
704 ownerGrp=`expr $ownerGrp + 1`
705 fi
706 done
707 if [ $found -eq 1 -a $currLoadedGrp -lt $ownerGrp ]; then
708 return 1
709 fi
710 if [ $found -eq 0 ]; then
711 return 1
712 fi
713 unrevokedGrpCert=`eval echo \$\{UNREVOKED_CERT_GRP_${ownerGrp}\}`
714 if [ $certNum -eq $unrevokedGrpCert ]; then
715 return 1
716 fi
717 return 0
718 }
720 ########################### load_group_crl #############################
721 # local shell function to load CRL
722 ########################################################################
723 load_group_crl() {
724 group=$1
725 ectype=$2
727 OUTFILE_TMP=${TMP}/$HOST.tmp.$$
728 grpBegin=`eval echo \$\{CRL_GRP_${group}_BEGIN\}`
729 grpRange=`eval echo \$\{CRL_GRP_${group}_RANGE\}`
730 grpEnd=`expr $grpBegin + $grpRange - 1`
732 if [ "$grpBegin" = "" -o "$grpRange" = "" ]; then
733 ret=1
734 return 1;
735 fi
737 # Add -ec suffix for ECC
738 if [ "$ectype" = "ECC" ] ; then
739 ecsuffix="-ec"
740 eccomment="ECC "
741 else
742 ecsuffix=""
743 eccomment=""
744 fi
746 if [ "$RELOAD_CRL" != "" ]; then
747 if [ $group -eq 1 ]; then
748 echo "==================== Resetting to group 1 crl ==================="
749 kill_selfserv
750 start_selfserv
751 is_selfserv_alive
752 fi
753 echo "================= Reloading ${eccomment}CRL for group $grpBegin - $grpEnd ============="
755 echo "tstclnt -p ${PORT} -h ${HOSTADDR} -f -d ${R_CLIENTDIR} -v \\"
756 echo " -V ssl3: -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix}"
757 echo "Request:"
758 echo "GET crl://${SERVERDIR}/root.crl_${grpBegin}-${grpEnd}${ecsuffix}"
759 echo ""
760 echo "RELOAD time $i"
762 REQF=${R_CLIENTDIR}.crlreq
763 cat > ${REQF} <<_EOF_REQUEST_
764 GET crl://${SERVERDIR}/root.crl_${grpBegin}-${grpEnd}${ecsuffix}
766 _EOF_REQUEST_
768 ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -f \
769 -d ${R_CLIENTDIR} -v -V ssl3: -w nss -n TestUser${UNREVOKED_CERT_GRP_1}${ecsuffix} \
770 >${OUTFILE_TMP} 2>&1 < ${REQF}
772 cat ${OUTFILE_TMP}
773 grep "CRL ReCache Error" ${OUTFILE_TMP}
774 if [ $? -eq 0 ]; then
775 ret=1
776 return 1
777 fi
778 else
779 echo "=== Updating DB for group $grpBegin - $grpEnd and restarting selfserv ====="
781 kill_selfserv
782 CU_ACTION="Importing ${eccomment}CRL for groups $grpBegin - $grpEnd"
783 crlu -d ${R_SERVERDIR} -I -i ${SERVERDIR}/root.crl_${grpBegin}-${grpEnd}${ecsuffix} \
784 -p ../tests.pw.928
785 ret=$?
786 if [ "$ret" -eq 0 ]; then
787 html_passed "${CU_ACTION}"
788 return 1
789 fi
790 start_selfserv
791 fi
792 is_selfserv_alive
793 ret=$?
794 echo "================= CRL Reloaded ============="
795 }
797 ########################### ssl_crl_cache ##############################
798 # local shell function to perform SSL test for crl cache functionality
799 # with/out revoked certs
800 ########################################################################
801 ssl_crl_cache()
802 {
803 html_head "Cache CRL SSL Client Tests $NORM_EXT $ECC_STRING"
804 SSLAUTH_TMP=${TMP}/authin.tl.tmp
805 SERV_ARG=-r_-r
806 rm -f ${SSLAUTH_TMP}
807 echo ${SSLAUTH_TMP}
809 grep -- " $SERV_ARG " ${SSLAUTH} | grep -v "^#" | grep -v none | grep -v bogus > ${SSLAUTH_TMP}
810 echo $?
811 while [ $? -eq 0 -a -f ${SSLAUTH_TMP} ]
812 do
813 sparam=$SERV_ARG
814 start_selfserv
815 exec < ${SSLAUTH_TMP}
816 while read ectype value sparam cparam testname
817 do
818 [ "$ectype" = "" ] && continue
819 if [ "$ectype" = "ECC" -a -n "$NSS_DISABLE_ECC" ] ; then
820 echo "$SCRIPTNAME: skipping $testname (ECC only)"
821 elif [ "$ectype" = "SNI" ]; then
822 continue
823 else
824 servarg=`echo $sparam | awk '{r=split($0,a,"-r") - 1;print r;}'`
825 pwd=`echo $cparam | grep nss`
826 user=`echo $cparam | grep TestUser`
827 _cparam=$cparam
828 case $servarg in
829 1) if [ -z "$pwd" -o -z "$user" ]; then
830 rev_modvalue=0
831 else
832 rev_modvalue=254
833 fi
834 ;;
835 2) rev_modvalue=254 ;;
837 3) if [ -z "$pwd" -o -z "$user" ]; then
838 rev_modvalue=0
839 else
840 rev_modvalue=1
841 fi
842 ;;
843 4) rev_modvalue=1 ;;
844 esac
845 TEMP_NUM=0
846 LOADED_GRP=1
847 while [ ${LOADED_GRP} -le ${TOTAL_GRP_NUM} ]
848 do
849 while [ $TEMP_NUM -lt $TOTAL_CRL_RANGE ]
850 do
851 CURR_SER_NUM=`expr ${CRL_GRP_1_BEGIN} + ${TEMP_NUM}`
852 TEMP_NUM=`expr $TEMP_NUM + 1`
853 USER_NICKNAME="TestUser${CURR_SER_NUM}"
854 cparam=`echo $_cparam | sed -e 's;_; ;g' -e "s/TestUser/$USER_NICKNAME/g" `
856 echo "Server Args: $SERV_ARG"
857 echo "tstclnt -p ${PORT} -h ${HOSTADDR} -f -d ${R_CLIENTDIR} -v \\"
858 echo " ${cparam} < ${REQUEST_FILE}"
859 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
860 ${PROFTOOL} ${BINDIR}/tstclnt -p ${PORT} -h ${HOSTADDR} -f ${cparam} \
861 -d ${R_CLIENTDIR} -v < ${REQUEST_FILE} \
862 >${TMP}/$HOST.tmp.$$ 2>&1
863 ret=$?
864 cat ${TMP}/$HOST.tmp.$$
865 rm ${TMP}/$HOST.tmp.$$ 2>/dev/null
866 is_revoked ${CURR_SER_NUM} ${LOADED_GRP}
867 isRevoked=$?
868 if [ $isRevoked -eq 0 ]; then
869 modvalue=$rev_modvalue
870 testAddMsg="revoked"
871 else
872 modvalue=$value
873 testAddMsg="not revoked"
874 fi
876 is_selfserv_alive
877 ss_status=$?
878 if [ "$ss_status" -ne 0 ]; then
879 html_msg $ret $modvalue \
880 "${testname}(cert ${USER_NICKNAME} - $testAddMsg)" \
881 "produced a returncode of $ret, expected is $modvalue. " \
882 "selfserv is not alive!"
883 else
884 html_msg $ret $modvalue \
885 "${testname}(cert ${USER_NICKNAME} - $testAddMsg)" \
886 "produced a returncode of $ret, expected is $modvalue"
887 fi
888 done
889 LOADED_GRP=`expr $LOADED_GRP + 1`
890 TEMP_NUM=0
891 if [ "$LOADED_GRP" -le "$TOTAL_GRP_NUM" ]; then
892 load_group_crl $LOADED_GRP $ectype
893 html_msg $ret 0 "Load group $LOADED_GRP ${eccomment}crl " \
894 "produced a returncode of $ret, expected is 0"
895 fi
896 done
897 # Restart selfserv to roll back to two initial group 1 crls
898 # TestCA CRL and TestCA-ec CRL
899 kill_selfserv
900 start_selfserv
901 fi
902 done
903 kill_selfserv
904 SERV_ARG="${SERV_ARG}_-r"
905 rm -f ${SSLAUTH_TMP}
906 grep -- " $SERV_ARG " ${SSLAUTH} | grep -v "^#" | grep -v none | grep -v bogus > ${SSLAUTH_TMP}
907 done
908 TEMPFILES=${SSLAUTH_TMP}
909 html "</TABLE><BR>"
910 }
913 ############################## ssl_cleanup #############################
914 # local shell function to finish this script (no exit since it might be
915 # sourced)
916 ########################################################################
917 ssl_cleanup()
918 {
919 rm $SERVERPID 2>/dev/null
920 cd ${QADIR}
921 . common/cleanup.sh
922 }
924 ############################## ssl_run #################################
925 # local shell function to run coverage, authentication and stress tests
926 ########################################################################
927 ssl_run()
928 {
929 for SSL_RUN in ${NSS_SSL_RUN}
930 do
931 case "${SSL_RUN}" in
932 "stapling")
933 ssl_stapling
934 ;;
935 "cov")
936 ssl_cov
937 ;;
938 "auth")
939 ssl_auth
940 ;;
941 "stress")
942 ssl_stress
943 ;;
944 esac
945 done
946 }
948 ############################ ssl_run_all ###############################
949 # local shell function to run both standard and extended ssl tests
950 ########################################################################
951 ssl_run_all()
952 {
953 ORIG_SERVERDIR=$SERVERDIR
954 ORIG_CLIENTDIR=$CLIENTDIR
955 ORIG_R_SERVERDIR=$R_SERVERDIR
956 ORIG_R_CLIENTDIR=$R_CLIENTDIR
957 ORIG_P_R_SERVERDIR=$P_R_SERVERDIR
958 ORIG_P_R_CLIENTDIR=$P_R_CLIENTDIR
960 USER_NICKNAME=TestUser
961 NORM_EXT=""
962 cd ${CLIENTDIR}
964 ssl_run
966 SERVERDIR=$EXT_SERVERDIR
967 CLIENTDIR=$EXT_CLIENTDIR
968 R_SERVERDIR=$R_EXT_SERVERDIR
969 R_CLIENTDIR=$R_EXT_CLIENTDIR
970 P_R_SERVERDIR=$P_R_EXT_SERVERDIR
971 P_R_CLIENTDIR=$P_R_EXT_CLIENTDIR
973 USER_NICKNAME=ExtendedSSLUser
974 NORM_EXT="Extended Test"
975 cd ${CLIENTDIR}
977 ssl_run
979 # the next round of ssl tests will only run if these vars are reset
980 SERVERDIR=$ORIG_SERVERDIR
981 CLIENTDIR=$ORIG_CLIENTDIR
982 R_SERVERDIR=$ORIG_R_SERVERDIR
983 R_CLIENTDIR=$ORIG_R_CLIENTDIR
984 P_R_SERVERDIR=$ORIG_P_R_SERVERDIR
985 P_R_CLIENTDIR=$ORIG_P_R_CLIENTDIR
987 USER_NICKNAME=TestUser
988 NORM_EXT=
989 cd ${QADIR}/ssl
990 }
992 ############################ ssl_set_fips ##############################
993 # local shell function to set FIPS mode on/off
994 ########################################################################
995 ssl_set_fips()
996 {
997 CLTSRV=$1
998 ONOFF=$2
1000 if [ ${CLTSRV} = "server" ]; then
1001 DBDIRS="${SERVERDIR} ${EXT_SERVERDIR}"
1002 else
1003 DBDIRS="${CLIENTDIR} ${EXT_CLIENTDIR}"
1004 fi
1006 if [ "${ONOFF}" = "on" ]; then
1007 FIPSMODE=true
1008 RET_EXP=0
1009 else
1010 FIPSMODE=false
1011 RET_EXP=1
1012 fi
1014 html_head "SSL - FIPS mode ${ONOFF} for ${CLTSRV}"
1016 for DBDIR in ${DBDIRS}
1017 do
1018 EXT_OPT=
1019 echo ${DBDIR} | grep ext > /dev/null
1020 if [ $? -eq 0 ]; then
1021 EXT_OPT="extended "
1022 fi
1024 echo "${SCRIPTNAME}: Turning FIPS ${ONOFF} for the ${EXT_OPT} ${CLTSRV}"
1026 echo "modutil -dbdir ${DBDIR} -fips ${FIPSMODE} -force"
1027 ${BINDIR}/modutil -dbdir ${DBDIR} -fips ${FIPSMODE} -force 2>&1
1028 RET=$?
1029 html_msg "${RET}" "0" "${TESTNAME} (modutil -fips ${FIPSMODE})" \
1030 "produced a returncode of ${RET}, expected is 0"
1032 echo "modutil -dbdir ${DBDIR} -list"
1033 DBLIST=`${BINDIR}/modutil -dbdir ${DBDIR} -list 2>&1`
1034 RET=$?
1035 html_msg "${RET}" "0" "${TESTNAME} (modutil -list)" \
1036 "produced a returncode of ${RET}, expected is 0"
1038 echo "${DBLIST}" | grep "FIPS PKCS #11"
1039 RET=$?
1040 html_msg "${RET}" "${RET_EXP}" "${TESTNAME} (grep \"FIPS PKCS #11\")" \
1041 "produced a returncode of ${RET}, expected is ${RET_EXP}"
1042 done
1044 html "</TABLE><BR>"
1045 }
1047 ############################ ssl_set_fips ##############################
1048 # local shell function to run all tests set in NSS_SSL_TESTS variable
1049 ########################################################################
1050 ssl_run_tests()
1051 {
1052 for SSL_TEST in ${NSS_SSL_TESTS}
1053 do
1054 case "${SSL_TEST}" in
1055 "crl")
1056 ssl_crl_ssl
1057 ssl_crl_cache
1058 ;;
1059 "iopr")
1060 ssl_iopr_run
1061 ;;
1062 *)
1063 SERVER_MODE=`echo "${SSL_TEST}" | cut -d_ -f1`
1064 CLIENT_MODE=`echo "${SSL_TEST}" | cut -d_ -f2`
1066 case "${SERVER_MODE}" in
1067 "normal")
1068 SERVER_OPTIONS=
1069 ;;
1070 "bypass")
1071 SERVER_OPTIONS="-B -s"
1072 ;;
1073 "fips")
1074 SERVER_OPTIONS=
1075 ssl_set_fips server on
1076 ;;
1077 *)
1078 echo "${SCRIPTNAME}: Error: Unknown server mode ${SERVER_MODE}"
1079 continue
1080 ;;
1081 esac
1083 case "${CLIENT_MODE}" in
1084 "normal")
1085 CLIENT_OPTIONS=
1086 ;;
1087 "bypass")
1088 CLIENT_OPTIONS="-B -s"
1089 ;;
1090 "fips")
1091 SERVER_OPTIONS=
1092 ssl_set_fips client on
1093 ;;
1094 *)
1095 echo "${SCRIPTNAME}: Error: Unknown client mode ${CLIENT_MODE}"
1096 continue
1097 ;;
1098 esac
1100 ssl_run_all
1102 if [ "${SERVER_MODE}" = "fips" ]; then
1103 ssl_set_fips server off
1104 fi
1106 if [ "${CLIENT_MODE}" = "fips" ]; then
1107 ssl_set_fips client off
1108 fi
1109 ;;
1110 esac
1111 done
1112 }
1114 ################################# main #################################
1116 ssl_init
1117 ssl_run_tests
1118 ssl_cleanup
