1#!/bin/sh 2# 3# $OpenBSD: appstest.sh,v 1.60 2024/01/12 13:16:48 tb Exp $ 4# 5# Copyright (c) 2016 Kinichiro Inoguchi <inoguchi@openbsd.org> 6# 7# Permission to use, copy, modify, and distribute this software for any 8# purpose with or without fee is hereby granted, provided that the above 9# copyright notice and this permission notice appear in all copies. 10# 11# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19# 20# appstest.sh - test script for openssl command according to man OPENSSL(1) 21# 22# input : none 23# output : all files generated by this script go under $ssldir 24# 25 26function section_message { 27 echo "" 28 echo "#---------#---------#---------#---------#---------#---------#---------#--------" 29 echo "===" 30 echo "=== (Section) $1 `date +'%Y/%m/%d %H:%M:%S'`" 31 echo "===" 32} 33 34function start_message { 35 echo "" 36 echo "[TEST] $1" 37} 38 39function stop_s_server { 40 if [ ! -z "$s_server_pid" ] ; then 41 echo ":-| stop s_server [ $s_server_pid ]" 42 sleep 1 43 kill -TERM $s_server_pid 44 wait $s_server_pid 45 s_server_pid= 46 fi 47} 48 49function stop_gnutls_serv { 50 if [ ! -z "$gnutls_serv_pid" ] ; then 51 echo ":-| stop gnutls-serv [ $gnutls_serv_pid ]" 52 sleep 1 53 kill -TERM $gnutls_serv_pid 54 wait $gnutls_serv_pid 55 gnutls_serv_pid= 56 fi 57} 58 59function check_exit_status { 60 status=$1 61 if [ $status -ne 0 ] ; then 62 stop_s_server 63 echo ":-< error occurs, exit status = [ $status ]" 64 exit $status 65 else 66 echo ":-) success. " 67 fi 68} 69 70function usage { 71 echo "usage: appstest.sh [-egiq]" 72} 73 74function test_usage_lists_others { 75 # === COMMAND USAGE === 76 section_message "COMMAND USAGE" 77 78 start_message "output usages of all commands." 79 80 cmds=`$openssl_bin list-standard-commands` 81 $openssl_bin -help 2>> $user1_dir/usages.out 82 for c in $cmds ; do 83 $openssl_bin $c -help 2>> $user1_dir/usages.out 84 done 85 86 start_message "check all list-* commands." 87 88 lists="" 89 lists="$lists list-standard-commands" 90 lists="$lists list-message-digest-commands list-message-digest-algorithms" 91 lists="$lists list-cipher-commands list-cipher-algorithms" 92 lists="$lists list-public-key-algorithms" 93 94 listsfile=$user1_dir/lists.out 95 96 for l in $lists ; do 97 echo "" >> $listsfile 98 echo "$l" >> $listsfile 99 $openssl_bin $l >> $listsfile 100 done 101 102 start_message "check interactive mode" 103 $openssl_bin <<__EOF__ 104help 105quit 106__EOF__ 107 check_exit_status $? 108 109 #---------#---------#---------#---------#---------#---------#--------- 110 111 # --- listing operations --- 112 section_message "listing operations" 113 114 start_message "ciphers" 115 $openssl_bin ciphers -V > $user1_dir/ciphers-V.out 116 check_exit_status $? 117 118 start_message "errstr" 119 $openssl_bin errstr 2606A074 120 check_exit_status $? 121 122 #---------#---------#---------#---------#---------#---------#--------- 123 124 # --- random number etc. operations --- 125 section_message "random number etc. operations" 126 127 start_message "passwd" 128 129 pass="test-pass-1234" 130 131 echo $pass | $openssl_bin passwd -stdin -1 132 check_exit_status $? 133 134 echo $pass | $openssl_bin passwd -stdin -apr1 135 check_exit_status $? 136 137 echo $pass | $openssl_bin passwd -stdin -crypt 138 check_exit_status $? 139 140 start_message "prime" 141 142 $openssl_bin prime 1 143 check_exit_status $? 144 145 $openssl_bin prime 2 146 check_exit_status $? 147 148 $openssl_bin prime -bits 64 -checks 3 -generate -hex -safe 5 149 check_exit_status $? 150 151 start_message "rand" 152 153 $openssl_bin rand -base64 100 154 check_exit_status $? 155 156 $openssl_bin rand -hex 100 157 check_exit_status $? 158} 159 160function test_md { 161 # === MESSAGE DIGEST COMMANDS === 162 section_message "MESSAGE DIGEST COMMANDS" 163 164 start_message "dgst - See [MESSAGE DIGEST COMMANDS] section." 165 166 text="1234567890abcdefghijklmnopqrstuvwxyz" 167 dgstdat=$user1_dir/dgst.dat 168 echo $text > $dgstdat 169 hmac_key="test-hmac-key" 170 cmac_key="1234567890abcde1234567890abcde12" 171 dgstkey=$user1_dir/dgstkey.pem 172 dgstpass=test-dgst-pass 173 dgstpub=$user1_dir/dgstpub.pem 174 dgstsig=$user1_dir/dgst.sig 175 176 $openssl_bin genrsa -aes256 -passout pass:$dgstpass -out $dgstkey 177 check_exit_status $? 178 179 $openssl_bin pkey -in $dgstkey -passin pass:$dgstpass -pubout \ 180 -out $dgstpub 181 check_exit_status $? 182 183 digests=`$openssl_bin list-message-digest-commands` 184 185 for d in $digests ; do 186 187 echo -n "$d ... " 188 $openssl_bin dgst -$d -hex -out $dgstdat.$d $dgstdat 189 check_exit_status $? 190 191 echo -n "$d HMAC ... " 192 $openssl_bin dgst -$d -c -hmac $hmac_key -out $dgstdat.$d.hmac \ 193 $dgstdat 194 check_exit_status $? 195 196 echo -n "$d CMAC ... " 197 $openssl_bin dgst -$d -r -mac cmac -macopt cipher:aes-128-cbc \ 198 -macopt hexkey:$cmac_key -out $dgstdat.$d.cmac $dgstdat 199 check_exit_status $? 200 201 echo -n "$d sign ... " 202 $openssl_bin dgst -sign $dgstkey -keyform pem \ 203 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 204 -passin pass:$dgstpass -binary -out $dgstsig.$d $dgstdat 205 check_exit_status $? 206 207 echo -n "$d verify ... " 208 $openssl_bin dgst -verify $dgstpub \ 209 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 210 -signature $dgstsig.$d $dgstdat 211 check_exit_status $? 212 213 echo -n "$d prverify ... " 214 $openssl_bin dgst -prverify $dgstkey -passin pass:$dgstpass \ 215 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 216 -signature $dgstsig.$d $dgstdat 217 check_exit_status $? 218 done 219} 220 221function test_encoding_cipher { 222 # === ENCODING AND CIPHER COMMANDS === 223 section_message "ENCODING AND CIPHER COMMANDS" 224 225 start_message "enc - See [ENCODING AND CIPHER COMMANDS] section." 226 227 text="1234567890abcdefghijklmnopqrstuvwxyz" 228 encfile=$user1_dir/encfile.dat 229 echo $text > $encfile 230 pass="test-pass-1234" 231 232 ciphers=`$openssl_bin list-cipher-commands` 233 234 for c in $ciphers ; do 235 echo -n "$c ... encoding ... " 236 $openssl_bin enc -$c -e -base64 -pass pass:$pass \ 237 -in $encfile -out $encfile-$c.enc 238 check_exit_status $? 239 240 echo -n "decoding ... " 241 $openssl_bin enc -$c -d -base64 -pass pass:$pass \ 242 -in $encfile-$c.enc -out $encfile-$c.dec 243 check_exit_status $? 244 245 echo -n "cmp ... " 246 cmp $encfile $encfile-$c.dec 247 check_exit_status $? 248 done 249} 250 251function test_key { 252 # === various KEY operations === 253 section_message "various KEY operations" 254 255 key_pass=test-key-pass 256 257 # DH 258 259 start_message "gendh - Obsoleted by dhparam." 260 gendh2=$key_dir/gendh2.pem 261 $openssl_bin gendh -2 -out $gendh2 > $gendh2.log 2>&1 262 check_exit_status $? 263 264 start_message "dh - Obsoleted by dhparam." 265 $openssl_bin dh -in $gendh2 -check -text -out $gendh2.out 266 check_exit_status $? 267 268 if [ $no_long_tests = 0 ] ; then 269 start_message "dhparam - Superseded by genpkey and pkeyparam." 270 dhparam2=$key_dir/dhparam2.pem 271 $openssl_bin dhparam -2 -out $dhparam2 > $dhparam2.log 2>&1 272 check_exit_status $? 273 $openssl_bin dhparam -in $dhparam2 -check -text \ 274 -out $dhparam2.out 275 check_exit_status $? 276 else 277 start_message "SKIPPING dhparam - Superseded by genpkey and pkeyparam. (quick mode)" 278 fi 279 280 # DSA 281 282 start_message "dsaparam - Superseded by genpkey and pkeyparam." 283 dsaparam512=$key_dir/dsaparam512.pem 284 $openssl_bin dsaparam -genkey -out $dsaparam512 512 \ 285 > $dsaparam512.log 2>&1 286 check_exit_status $? 287 288 start_message "dsa" 289 $openssl_bin dsa -in $dsaparam512 -text -modulus -out $dsaparam512.out 290 check_exit_status $? 291 292 start_message "gendsa - Superseded by genpkey and pkey." 293 gendsa_des3=$key_dir/gendsa_des3.pem 294 $openssl_bin gendsa -des3 -out $gendsa_des3 \ 295 -passout pass:$key_pass $dsaparam512 296 check_exit_status $? 297 298 # RSA 299 300 start_message "genrsa - Superseded by genpkey." 301 genrsa_aes256=$key_dir/genrsa_aes256.pem 302 $openssl_bin genrsa -f4 -aes256 -out $genrsa_aes256 \ 303 -passout pass:$key_pass 2048 > $genrsa_aes256.log 2>&1 304 check_exit_status $? 305 306 start_message "rsa" 307 $openssl_bin rsa -in $genrsa_aes256 -passin pass:$key_pass \ 308 -check -text -out $genrsa_aes256.out 309 check_exit_status $? 310 311 start_message "rsautl - Superseded by pkeyutl." 312 rsautldat=$key_dir/rsautl.dat 313 rsautlsig=$key_dir/rsautl.sig 314 echo "abcdefghijklmnopqrstuvwxyz1234567890" > $rsautldat 315 316 $openssl_bin rsautl -sign -in $rsautldat -inkey $genrsa_aes256 \ 317 -passin pass:$key_pass -out $rsautlsig 318 check_exit_status $? 319 320 $openssl_bin rsautl -verify -in $rsautlsig -inkey $genrsa_aes256 \ 321 -passin pass:$key_pass 322 check_exit_status $? 323 324 # EC 325 326 start_message "ecparam -list-curves" 327 $openssl_bin ecparam -list_curves -out $key_dir/ecparam-list_curves.out 328 check_exit_status $? 329 330 # get all EC curves 331 ec_curves=`$openssl_bin ecparam -list_curves | grep ':' | cut -d ':' -f 1` 332 333 start_message "ecparam and ec" 334 335 for curve in $ec_curves ; 336 do 337 ecparam=$key_dir/ecparam_$curve.pem 338 339 echo -n "ec - $curve ... ecparam ... " 340 $openssl_bin ecparam -out $ecparam -name $curve -genkey \ 341 -param_enc explicit -conv_form compressed -C 342 check_exit_status $? 343 344 echo -n "ec ... " 345 $openssl_bin ec -in $ecparam -text \ 346 -out $ecparam.out 2> /dev/null 347 check_exit_status $? 348 done 349 350 # PKEY 351 352 start_message "genpkey" 353 354 # DH by GENPKEY 355 356 genpkey_dh_param=$key_dir/genpkey_dh_param.pem 357 $openssl_bin genpkey -genparam -algorithm DH -out $genpkey_dh_param \ 358 -pkeyopt dh_paramgen_prime_len:1024 > $genpkey_dh_param.log 2>&1 359 check_exit_status $? 360 361 genpkey_dh=$key_dir/genpkey_dh.pem 362 $openssl_bin genpkey -paramfile $genpkey_dh_param -out $genpkey_dh 363 check_exit_status $? 364 365 # DSA by GENPKEY 366 367 genpkey_dsa_param=$key_dir/genpkey_dsa_param.pem 368 $openssl_bin genpkey -genparam -algorithm DSA -out $genpkey_dsa_param \ 369 -pkeyopt dsa_paramgen_bits:1024 > $genpkey_dsa_param.log 2>&1 370 check_exit_status $? 371 372 genpkey_dsa=$key_dir/genpkey_dsa.pem 373 $openssl_bin genpkey -paramfile $genpkey_dsa_param -out $genpkey_dsa 374 check_exit_status $? 375 376 # RSA by GENPKEY 377 378 genpkey_rsa=$key_dir/genpkey_rsa.pem 379 $openssl_bin genpkey -algorithm RSA -out $genpkey_rsa \ 380 -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 \ 381 > $genpkey_rsa.log 2>&1 382 check_exit_status $? 383 384 genpkey_rsa_pss=$key_dir/genpkey_rsa_pss.pem 385 $openssl_bin genpkey -algorithm RSA-PSS -out $genpkey_rsa_pss \ 386 -pkeyopt rsa_keygen_bits:2048 \ 387 -pkeyopt rsa_pss_keygen_mgf1_md:sha256 \ 388 -pkeyopt rsa_pss_keygen_md:sha256 \ 389 -pkeyopt rsa_pss_keygen_saltlen:32 \ 390 > $genpkey_rsa_pss.log 2>&1 391 check_exit_status $? 392 393 # EC by GENPKEY 394 395 genpkey_ec_param=$key_dir/genpkey_ec_param.pem 396 $openssl_bin genpkey -genparam -algorithm EC -out $genpkey_ec_param \ 397 -pkeyopt ec_paramgen_curve:secp384r1 398 check_exit_status $? 399 400 genpkey_ec=$key_dir/genpkey_ec.pem 401 $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec 402 check_exit_status $? 403 404 genpkey_ec_2=$key_dir/genpkey_ec_2.pem 405 $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec_2 406 check_exit_status $? 407 408 start_message "pkeyparam" 409 410 $openssl_bin pkeyparam -in $genpkey_dh_param -text \ 411 -out $genpkey_dh_param.out 412 check_exit_status $? 413 414 $openssl_bin pkeyparam -in $genpkey_dsa_param -text \ 415 -out $genpkey_dsa_param.out 416 check_exit_status $? 417 418 $openssl_bin pkeyparam -in $genpkey_ec_param -text \ 419 -out $genpkey_ec_param.out 420 check_exit_status $? 421 422 start_message "pkey" 423 424 $openssl_bin pkey -in $genpkey_dh -pubout -out $genpkey_dh.pub \ 425 -text_pub 426 check_exit_status $? 427 428 $openssl_bin pkey -in $genpkey_dsa -pubout -out $genpkey_dsa.pub \ 429 -text_pub 430 check_exit_status $? 431 432 $openssl_bin pkey -in $genpkey_rsa -pubout -out $genpkey_rsa.pub \ 433 -text_pub 434 check_exit_status $? 435 436 $openssl_bin pkey -in $genpkey_ec -pubout -out $genpkey_ec.pub \ 437 -text_pub 438 check_exit_status $? 439 440 $openssl_bin pkey -in $genpkey_ec_2 -pubout -out $genpkey_ec_2.pub \ 441 -text_pub 442 check_exit_status $? 443 444 start_message "pkeyutl" 445 446 pkeyutldat=$key_dir/pkeyutl.dat 447 pkeyutlsig=$key_dir/pkeyutl.sig 448 echo "abcdefghijklmnopqrstuvwxyz1234567890" > $pkeyutldat 449 450 $openssl_bin pkeyutl -sign -in $pkeyutldat -inkey $genpkey_rsa \ 451 -out $pkeyutlsig 452 check_exit_status $? 453 454 $openssl_bin pkeyutl -verify -in $pkeyutldat -sigfile $pkeyutlsig \ 455 -inkey $genpkey_rsa 456 check_exit_status $? 457 458 $openssl_bin pkeyutl -verifyrecover -in $pkeyutlsig -inkey $genpkey_rsa 459 check_exit_status $? 460 461 pkeyutlenc=$key_dir/pkeyutl.enc 462 pkeyutldec=$key_dir/pkeyutl.dec 463 464 $openssl_bin pkeyutl -encrypt -in $pkeyutldat \ 465 -pubin -inkey $genpkey_rsa.pub -out $pkeyutlenc 466 check_exit_status $? 467 468 $openssl_bin pkeyutl -decrypt -in $pkeyutlenc \ 469 -inkey $genpkey_rsa -out $pkeyutldec 470 check_exit_status $? 471 472 diff $pkeyutldat $pkeyutldec 473 check_exit_status $? 474 475 pkeyutl_rsa_oaep_enc=$key_dir/pkeyutl_rsa_oaep.enc 476 pkeyutl_rsa_oaep_dec=$key_dir/pkeyutl_rsa_oaep.dec 477 478 $openssl_bin pkeyutl -encrypt -in $pkeyutldat \ 479 -inkey $genpkey_rsa \ 480 -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 \ 481 -pkeyopt rsa_oaep_label:0011223344556677 \ 482 -out $pkeyutl_rsa_oaep_enc 483 check_exit_status $? 484 485 $openssl_bin pkeyutl -decrypt -in $pkeyutl_rsa_oaep_enc \ 486 -inkey $genpkey_rsa \ 487 -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 \ 488 -pkeyopt rsa_oaep_label:0011223344556677 \ 489 -out $pkeyutl_rsa_oaep_dec 490 check_exit_status $? 491 492 diff $pkeyutldat $pkeyutl_rsa_oaep_dec 493 check_exit_status $? 494 495 pkeyutlsc1=$key_dir/pkeyutl.sc1 496 pkeyutlsc2=$key_dir/pkeyutl.sc2 497 498 $openssl_bin pkeyutl -derive -inkey $genpkey_ec \ 499 -peerkey $genpkey_ec_2.pub -out $pkeyutlsc1 -hexdump 500 check_exit_status $? 501 502 $openssl_bin pkeyutl -derive -inkey $genpkey_ec_2 \ 503 -peerkey $genpkey_ec.pub -out $pkeyutlsc2 -hexdump 504 check_exit_status $? 505 506 diff $pkeyutlsc1 $pkeyutlsc2 507 check_exit_status $? 508} 509 510function test_pki { 511 section_message "setup local CA" 512 513 # 514 # prepare test openssl.cnf 515 # 516 517 cat << __EOF__ > $ssldir/openssl.cnf 518oid_section = new_oids 519[ new_oids ] 520tsa_policy1 = 1.2.3.4.1 521tsa_policy2 = 1.2.3.4.5.6 522tsa_policy3 = 1.2.3.4.5.7 523[ ca ] 524default_ca = CA_default 525[ CA_default ] 526dir = ./$ca_dir 527crl_dir = \$dir/crl 528database = \$dir/index.txt 529new_certs_dir = \$dir/newcerts 530serial = \$dir/serial 531crlnumber = \$dir/crlnumber 532default_days = 1 533default_md = default 534policy = policy_match 535[ policy_match ] 536countryName = match 537stateOrProvinceName = match 538organizationName = match 539organizationalUnitName = optional 540commonName = supplied 541emailAddress = optional 542[ req ] 543distinguished_name = req_distinguished_name 544[ req_distinguished_name ] 545countryName = Country Name 546countryName_default = JP 547countryName_min = 2 548countryName_max = 2 549stateOrProvinceName = State or Province Name 550stateOrProvinceName_default = Tokyo 551organizationName = Organization Name 552organizationName_default = TEST_DUMMY_COMPANY 553commonName = Common Name 554[ tsa ] 555default_tsa = tsa_config1 556[ tsa_config1 ] 557dir = ./$tsa_dir 558serial = \$dir/serial 559crypto_device = builtin 560digests = sha1, sha256, sha384, sha512 561default_policy = tsa_policy1 562other_policies = tsa_policy2, tsa_policy3 563[ tsa_ext ] 564keyUsage = critical,nonRepudiation 565extendedKeyUsage = critical,timeStamping 566[ ocsp_ext ] 567basicConstraints = CA:FALSE 568keyUsage = nonRepudiation,digitalSignature,keyEncipherment 569extendedKeyUsage = OCSPSigning 570__EOF__ 571 572 #---------#---------#---------#---------#---------#---------#--------- 573 574 # 575 # setup test CA 576 # 577 578 mkdir -p $ca_dir 579 mkdir -p $tsa_dir 580 mkdir -p $ocsp_dir 581 mkdir -p $server_dir 582 583 mkdir -p $ca_dir/certs 584 mkdir -p $ca_dir/private 585 mkdir -p $ca_dir/crl 586 mkdir -p $ca_dir/newcerts 587 chmod 700 $ca_dir/private 588 echo "01" > $ca_dir/serial 589 touch $ca_dir/index.txt 590 touch $ca_dir/crlnumber 591 echo "01" > $ca_dir/crlnumber 592 593 # 594 # setup test TSA 595 # 596 mkdir -p $tsa_dir/private 597 chmod 700 $tsa_dir/private 598 echo "01" > $tsa_dir/serial 599 touch $tsa_dir/index.txt 600 601 # 602 # setup test OCSP 603 # 604 mkdir -p $ocsp_dir/private 605 chmod 700 $ocsp_dir/private 606 607 #---------#---------#---------#---------#---------#---------#--------- 608 609 # --- CA initiate (generate CA key and cert) --- 610 611 start_message "req ... generate CA key and self signed cert" 612 613 ca_cert=$ca_dir/ca_cert.pem 614 ca_key=$ca_dir/private/ca_key.pem ca_pass=test-ca-pass 615 616 if [ $mingw = 0 ] ; then 617 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testCA.test-dummy.com/' 618 else 619 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testCA.test-dummy.com\' 620 fi 621 622 $openssl_bin req -new -x509 -batch -newkey rsa:2048 \ 623 -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 \ 624 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 625 -config $ssldir/openssl.cnf -verbose \ 626 -subj $subj -days 1 -set_serial 1 -multivalue-rdn \ 627 -keyout $ca_key -passout pass:$ca_pass \ 628 -out $ca_cert -outform pem 629 check_exit_status $? 630 631 #---------#---------#---------#---------#---------#---------#--------- 632 633 # --- TSA initiate (generate TSA key and cert) --- 634 635 start_message "req ... generate TSA key and cert" 636 637 # generate CSR for TSA 638 639 tsa_csr=$tsa_dir/tsa_csr.pem 640 tsa_key=$tsa_dir/private/tsa_key.pem 641 tsa_pass=test-tsa-pass 642 643 if [ $mingw = 0 ] ; then 644 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testTSA.test-dummy.com/' 645 else 646 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testTSA.test-dummy.com\' 647 fi 648 649 $openssl_bin req -new -keyout $tsa_key -out $tsa_csr \ 650 -passout pass:$tsa_pass -subj $subj 651 check_exit_status $? 652 653 start_message "ca ... sign by CA with TSA extensions" 654 655 tsa_cert=$tsa_dir/tsa_cert.pem 656 657 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ 658 -key $ca_pass -config $ssldir/openssl.cnf -create_serial \ 659 -policy policy_match -days 1 -md sha256 -extensions tsa_ext \ 660 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:32 \ 661 -multivalue-rdn -preserveDN -noemailDN \ 662 -in $tsa_csr -outdir $tsa_dir -out $tsa_cert -verbose -notext \ 663 > $tsa_cert.log 2>&1 664 check_exit_status $? 665 666 #---------#---------#---------#---------#---------#---------#--------- 667 668 # --- OCSP initiate (generate OCSP key and cert) --- 669 670 start_message "req ... generate OCSP key and cert" 671 672 # generate CSR for OCSP 673 674 ocsp_csr=$ocsp_dir/ocsp_csr.pem 675 ocsp_key=$ocsp_dir/private/ocsp_key.pem 676 677 if [ $mingw = 0 ] ; then 678 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testOCSP.test-dummy.com/' 679 else 680 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testOCSP.test-dummy.com\' 681 fi 682 683 $openssl_bin req -new -keyout $ocsp_key -nodes -out $ocsp_csr \ 684 -subj $subj 685 check_exit_status $? 686 687 start_message "ca ... sign by CA with OCSP extensions" 688 689 ocsp_cert=$ocsp_dir/ocsp_cert.pem 690 691 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ 692 -key $ca_pass -out $ocsp_cert -extensions ocsp_ext \ 693 -startdate `date -u '+%y%m%d%H%M%SZ'` -enddate 491223235959Z \ 694 -subj $subj -infiles $ocsp_csr > $ocsp_cert.log 2>&1 695 check_exit_status $? 696 697 #---------#---------#---------#---------#---------#---------#--------- 698 699 # --- server-admin operations (generate server key and csr) --- 700 section_message "server-admin operations (generate server key and csr)" 701 702 # RSA certificate 703 704 sv_rsa_key=$server_dir/sv_rsa_key.pem 705 sv_rsa_csr=$server_dir/sv_rsa_csr.pem 706 sv_rsa_pass=test-server-pass 707 708 if [ $mingw = 0 ] ; then 709 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=localhost.test-dummy.com/' 710 else 711 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=localhost.test-dummy.com\' 712 fi 713 714 start_message "genrsa ... generate server key#1" 715 716 $openssl_bin genrsa -aes256 -passout pass:$sv_rsa_pass -out $sv_rsa_key 717 check_exit_status $? 718 719 $openssl_bin rsa -in $sv_rsa_key -passin pass:$sv_rsa_pass \ 720 -out $sv_rsa_key.nopass 721 check_exit_status $? 722 723 start_message "req ... generate server csr#1" 724 725 $openssl_bin req -new -subj $subj -sha256 \ 726 -key $sv_rsa_key -keyform pem -passin pass:$sv_rsa_pass \ 727 -addext 'subjectAltName = DNS:localhost.test-dummy.com' \ 728 -out $sv_rsa_csr -outform pem 729 check_exit_status $? 730 731 start_message "req ... verify server csr#1" 732 733 $openssl_bin req -verify -in $sv_rsa_csr -inform pem \ 734 -newhdr -noout -pubkey -subject -modulus -text \ 735 -nameopt multiline -reqopt compatible \ 736 -out $sv_rsa_csr.verify.out 737 check_exit_status $? 738 739 start_message "req ... generate server csr#2 (interactive mode)" 740 741 # RSA certificate (for revoke test) 742 743 revoke_key=$server_dir/revoke_key.pem 744 revoke_csr=$server_dir/revoke_csr.pem 745 revoke_pass=test-revoke-pass 746 747 $openssl_bin req -new -keyout $revoke_key -out $revoke_csr \ 748 -passout pass:$revoke_pass <<__EOF__ 749JP 750Tokyo 751TEST_DUMMY_COMPANY 752revoke.test-dummy.com 753__EOF__ 754 check_exit_status $? 755 756 # ECDSA certificate 757 758 sv_ecdsa_key=$server_dir/sv_ecdsa_key.pem 759 sv_ecdsa_csr=$server_dir/sv_ecdsa_csr.pem 760 sv_ecdsa_pass=test-ecdsa-pass 761 762 if [ $mingw = 0 ] ; then 763 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=ecdsa.test-dummy.com/' 764 else 765 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=ecdsa.test-dummy.com\' 766 fi 767 768 start_message "ecparam ... generate server key#3" 769 770 $openssl_bin ecparam -name prime256v1 -genkey -out $sv_ecdsa_key 771 check_exit_status $? 772 773 start_message "req ... generate server csr#3" 774 775 $openssl_bin req -new -subj $subj -sha256 \ 776 -key $sv_ecdsa_key -keyform pem -passin pass:$sv_ecdsa_pass \ 777 -addext 'subjectAltName = DNS:ecdsa.test-dummy.com' \ 778 -out $sv_ecdsa_csr -outform pem 779 check_exit_status $? 780 781 start_message "req ... verify server csr#3" 782 783 $openssl_bin req -verify -in $sv_ecdsa_csr -inform pem \ 784 -newhdr -noout -pubkey -subject -modulus -text \ 785 -nameopt multiline -reqopt compatible \ 786 -out $sv_ecdsa_csr.verify.out 787 check_exit_status $? 788 789 # GOST certificate 790 791 sv_gost_key=$server_dir/sv_gost_key.pem 792 sv_gost_csr=$server_dir/sv_gost_csr.pem 793 sv_gost_pass=test-gost-pass 794 795 if [ $mingw = 0 ] ; then 796 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=gost.test-dummy.com/' 797 else 798 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=gost.test-dummy.com\' 799 fi 800 801 start_message "genpkey ... generate server key#4" 802 803 $openssl_bin genpkey -algorithm GOST2001 -pkeyopt paramset:A \ 804 -pkeyopt dgst:streebog512 -out $sv_gost_key 805 check_exit_status $? 806 807 start_message "req ... generate server csr#4" 808 809 $openssl_bin req -new -subj $subj -streebog512 \ 810 -key $sv_gost_key -keyform pem -passin pass:$sv_gost_pass \ 811 -addext 'subjectAltName = DNS:gost.test-dummy.com' \ 812 -out $sv_gost_csr -outform pem 813 check_exit_status $? 814 815 start_message "req ... verify server csr#4" 816 817 $openssl_bin req -verify -in $sv_gost_csr -inform pem \ 818 -newhdr -noout -pubkey -subject -modulus -text \ 819 -nameopt multiline -reqopt compatible \ 820 -out $sv_gost_csr.verify.out 821 check_exit_status $? 822 823 #---------#---------#---------#---------#---------#---------#--------- 824 825 # --- CA operations (issue cert for server) --- 826 section_message "CA operations (issue cert for server)" 827 828 start_message "ca ... issue cert for server csr#1" 829 830 sv_rsa_cert=$server_dir/sv_rsa_cert.pem 831 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 832 -in $sv_rsa_csr -out $sv_rsa_cert > $sv_rsa_cert.log 2>&1 833 check_exit_status $? 834 835 start_message "x509 ... issue cert for server csr#2" 836 837 $openssl_bin genrsa -out $server_dir/testkey.pem 2>&1 838 check_exit_status $? 839 $openssl_bin rsa -in $server_dir/testkey.pem -pubout \ 840 -out $server_dir/testpubkey.pem 2>&1 841 check_exit_status $? 842 843 revoke_cert=$server_dir/revoke_cert.pem 844 $openssl_bin x509 -req -in $revoke_csr -CA $ca_cert -CAform pem \ 845 -CAkey $ca_key -CAkeyform pem \ 846 -CAserial $ca_dir/serial -set_serial 10 \ 847 -passin pass:$ca_pass -CAcreateserial -out $revoke_cert \ 848 -set_issuer /CN=issuer -set_subject /CN=subject \ 849 -force_pubkey $server_dir/testpubkey.pem 850 > $revoke_cert.log 2>&1 851 check_exit_status $? 852 853 start_message "x509 ... check if csr#2 cert has proper issuer & subject" 854 if [ "$($openssl_bin x509 -in $revoke_cert -issuer -noout)" != \ 855 "issuer= /CN=issuer" ]; then 856 exit 1 857 fi 858 if [ "$($openssl_bin x509 -in $revoke_cert -subject -noout)" != \ 859 "subject= /CN=subject" ]; then 860 exit 1 861 fi 862 check_exit_status 0 863 864 start_message "x509 ... check if csr#2 cert pubkey was forced" 865 $openssl_bin x509 -in $revoke_cert -pubkey -noout > $revoke_cert.pub 866 check_exit_status $? 867 diff $server_dir/testpubkey.pem $revoke_cert.pub 868 check_exit_status $? 869 870 start_message "ca ... issue cert for server csr#3" 871 872 sv_ecdsa_cert=$server_dir/sv_ecdsa_cert.pem 873 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 874 -in $sv_ecdsa_csr -out $sv_ecdsa_cert > $sv_ecdsa_cert.log 2>&1 875 check_exit_status $? 876 877 start_message "ca ... issue cert for server csr#4" 878 879 sv_gost_cert=$server_dir/sv_gost_cert.pem 880 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 881 -in $sv_gost_csr -out $sv_gost_cert > $sv_gost_cert.log 2>&1 882 check_exit_status $? 883 884 #---------#---------#---------#---------#---------#---------#--------- 885 886 # --- CA operations (revoke cert and generate crl) --- 887 section_message "CA operations (revoke cert and generate crl)" 888 889 start_message "ca ... revoke server cert#2" 890 crl_file=$ca_dir/crl.pem 891 $openssl_bin ca -gencrl -out $crl_file -revoke $revoke_cert \ 892 -config $ssldir/openssl.cnf -name CA_default \ 893 -crldays 30 -crlhours 12 -crlsec 30 -updatedb \ 894 -crl_reason unspecified -crl_hold 1.2.840.10040.2.2 \ 895 -crl_compromise `date -u '+%Y%m%d%H%M%SZ'` \ 896 -crl_CA_compromise `date -u '+%Y%m%d%H%M%SZ'` \ 897 -keyfile $ca_key -passin pass:$ca_pass -cert $ca_cert \ 898 > $crl_file.log 2>&1 899 check_exit_status $? 900 901 start_message "ca ... show certificate status by serial number" 902 $openssl_bin ca -config $ssldir/openssl.cnf -status 1 903 904 start_message "crl ... CA generates CRL" 905 $openssl_bin crl -in $crl_file -fingerprint >> $crl_file.log 2>&1 906 check_exit_status $? 907 908 crl_p7=$ca_dir/crl.p7 909 start_message "crl2pkcs7 ... convert CRL to pkcs7" 910 $openssl_bin crl2pkcs7 -in $crl_file -certfile $ca_cert -out $crl_p7 911 check_exit_status $? 912 913 #---------#---------#---------#---------#---------#---------#--------- 914 915 # --- server-admin operations (check csr, verify cert, certhash) --- 916 section_message "server-admin operations (check csr, verify cert, certhash)" 917 918 start_message "asn1parse ... parse server csr#1" 919 $openssl_bin asn1parse -in $sv_rsa_csr -i -dlimit 100 -length 1000 \ 920 -strparse 01 > $sv_rsa_csr.asn1parse.out 921 check_exit_status $? 922 923 start_message "verify ... server cert#1" 924 $openssl_bin verify -verbose -CAfile $ca_cert -CRLfile $crl_file \ 925 -crl_check -issuer_checks -purpose sslserver $sv_rsa_cert 926 check_exit_status $? 927 928 start_message "x509 ... get detail info about server cert#1" 929 $openssl_bin x509 -in $sv_rsa_cert -text -C -dates -startdate -enddate \ 930 -fingerprint -issuer -issuer_hash -issuer_hash_old \ 931 -subject -hash -subject_hash -subject_hash_old -ocsp_uri \ 932 -ocspid -modulus -pubkey -serial -email -noout -trustout \ 933 -alias -clrtrust -clrreject -next_serial -checkend 3600 \ 934 -nameopt multiline -certopt compatible > $sv_rsa_cert.x509.out 935 check_exit_status $? 936 937 if [ $mingw = 0 ] ; then 938 start_message "certhash" 939 $openssl_bin certhash -v $server_dir \ 940 > $server_dir/certhash.log 2>&1 941 check_exit_status $? 942 fi 943 944 # self signed 945 start_message "x509 ... generate self signed server cert" 946 server_self_cert=$server_dir/server_self_cert.pem 947 $openssl_bin x509 -in $sv_rsa_cert -signkey $sv_rsa_key -keyform pem \ 948 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 949 -passin pass:$sv_rsa_pass -out $server_self_cert -days 1 950 check_exit_status $? 951 952 #---------#---------#---------#---------#---------#---------#--------- 953 954 # --- Netscape SPKAC operations --- 955 section_message "Netscape SPKAC operations" 956 957 # server-admin generates SPKAC 958 959 start_message "spkac" 960 spkacfile=$server_dir/spkac.file 961 962 $openssl_bin spkac -key $genpkey_rsa -challenge hello -out $spkacfile 963 check_exit_status $? 964 965 $openssl_bin spkac -in $spkacfile -verify -out $spkacfile.out 966 check_exit_status $? 967 968 spkacreq=$server_dir/spkac.req 969 cat << __EOF__ > $spkacreq 970countryName = JP 971stateOrProvinceName = Tokyo 972organizationName = TEST_DUMMY_COMPANY 973commonName = spkac.test-dummy.com 974__EOF__ 975 cat $spkacfile >> $spkacreq 976 977 # CA signs SPKAC 978 start_message "ca ... CA signs SPKAC csr" 979 spkaccert=$server_dir/spkac.cert 980 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 981 -spkac $spkacreq -out $spkaccert > $spkaccert.log 2>&1 982 check_exit_status $? 983 984 start_message "x509 ... convert DER format SPKAC cert to PEM" 985 spkacpem=$server_dir/spkac.pem 986 $openssl_bin x509 -in $spkaccert -inform DER -out $spkacpem -outform PEM 987 check_exit_status $? 988 989 #---------#---------#---------#---------#---------#---------#--------- 990 991 # --- user1 operations (generate user1 key and csr) --- 992 section_message "user1 operations (generate user1 key and csr)" 993 994 # trust 995 start_message "x509 ... trust testCA cert" 996 user1_trust=$user1_dir/user1_trust_ca.pem 997 $openssl_bin x509 -in $ca_cert -addtrust clientAuth \ 998 -setalias "trusted testCA" -purpose -out $user1_trust \ 999 > $user1_trust.log 2>&1 1000 check_exit_status $? 1001 1002 start_message "req ... generate private key and csr for user1" 1003 1004 cl_rsa_key=$user1_dir/cl_rsa_key.pem 1005 cl_rsa_csr=$user1_dir/cl_rsa_csr.pem 1006 cl_rsa_pass=test-user1-pass 1007 1008 if [ $mingw = 0 ] ; then 1009 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user1.test-dummy.com/' 1010 else 1011 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user1.test-dummy.com\' 1012 fi 1013 1014 $openssl_bin req -new -keyout $cl_rsa_key -out $cl_rsa_csr \ 1015 -passout pass:$cl_rsa_pass -subj $subj > $cl_rsa_csr.log 2>&1 1016 check_exit_status $? 1017 1018 start_message "req ... generate private key and csr for user2" 1019 1020 cl_ecdsa_key=$user1_dir/cl_ecdsa_key.pem 1021 cl_ecdsa_csr=$user1_dir/cl_ecdsa_csr.pem 1022 cl_ecdsa_pass=test-user1-pass 1023 1024 if [ $mingw = 0 ] ; then 1025 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user2.test-dummy.com/' 1026 else 1027 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user2.test-dummy.com\' 1028 fi 1029 1030 $openssl_bin ecparam -name prime256v1 -genkey -out $cl_ecdsa_key 1031 check_exit_status $? 1032 1033 $openssl_bin req -new -subj $subj -sha256 \ 1034 -key $cl_ecdsa_key -keyform pem -passin pass:$cl_ecdsa_pass \ 1035 -out $cl_ecdsa_csr -outform pem 1036 check_exit_status $? 1037 1038 start_message "req ... generate private key and csr for user3" 1039 1040 cl_gost_key=$user1_dir/cl_gost_key.pem 1041 cl_gost_csr=$user1_dir/cl_gost_csr.pem 1042 cl_gost_pass=test-user1-pass 1043 1044 if [ $mingw = 0 ] ; then 1045 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user3.test-dummy.com/' 1046 else 1047 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user3.test-dummy.com\' 1048 fi 1049 1050 $openssl_bin genpkey -algorithm GOST2001 -pkeyopt paramset:A \ 1051 -pkeyopt dgst:streebog512 -out $cl_gost_key 1052 check_exit_status $? 1053 1054 $openssl_bin req -new -subj $subj -streebog512 \ 1055 -key $cl_gost_key -keyform pem -passin pass:$cl_gost_pass \ 1056 -out $cl_gost_csr -outform pem 1057 check_exit_status $? 1058 1059 #---------#---------#---------#---------#---------#---------#--------- 1060 1061 # --- CA operations (issue cert for user1) --- 1062 section_message "CA operations (issue cert for user1)" 1063 1064 start_message "ca ... issue cert for user1" 1065 1066 cl_rsa_cert=$user1_dir/cl_rsa_cert.pem 1067 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 1068 -in $cl_rsa_csr -out $cl_rsa_cert > $cl_rsa_cert.log 2>&1 1069 check_exit_status $? 1070 1071 start_message "ca ... issue cert for user2" 1072 1073 cl_ecdsa_cert=$user1_dir/cl_ecdsa_cert.pem 1074 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 1075 -in $cl_ecdsa_csr -out $cl_ecdsa_cert > $cl_ecdsa_cert.log 2>&1 1076 check_exit_status $? 1077 1078 start_message "ca ... issue cert for user3" 1079 1080 cl_gost_cert=$user1_dir/cl_gost_cert.pem 1081 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 1082 -in $cl_gost_csr -out $cl_gost_cert > $cl_gost_cert.log 2>&1 1083 check_exit_status $? 1084} 1085 1086function test_tsa { 1087 # --- TSA operations --- 1088 section_message "TSA operations" 1089 1090 tsa_dat=$user1_dir/tsa.dat 1091 cat << __EOF__ > $tsa_dat 1092Hello Bob, 1093Sincerely yours 1094Alice 1095__EOF__ 1096 1097 # Query 1098 start_message "ts ... create time stamp request" 1099 1100 tsa_tsq=$user1_dir/tsa.tsq 1101 1102 $openssl_bin ts -query -sha1 -data $tsa_dat -no_nonce -out $tsa_tsq 1103 check_exit_status $? 1104 1105 start_message "ts ... print time stamp request" 1106 1107 $openssl_bin ts -query -in $tsa_tsq -text -out $tsa_tsq.log 1108 check_exit_status $? 1109 1110 # Reply 1111 start_message "ts ... create time stamp response for a request" 1112 1113 tsa_tsr=$user1_dir/tsa.tsr 1114 1115 $openssl_bin ts -reply -queryfile $tsa_tsq -inkey $tsa_key \ 1116 -passin pass:$tsa_pass -signer $tsa_cert -chain $ca_cert \ 1117 -config $ssldir/openssl.cnf -section tsa_config1 -cert \ 1118 -policy 1.3.6.1.4.1.4146.2.3 -out $tsa_tsr 1119 check_exit_status $? 1120 1121 # Verify 1122 start_message "ts ... verify time stamp response" 1123 1124 $openssl_bin ts -verify -queryfile $tsa_tsq -in $tsa_tsr \ 1125 -CAfile $ca_cert -untrusted $tsa_cert 1126 check_exit_status $? 1127} 1128 1129function test_cms { 1130 # --- CMS operations --- 1131 section_message "CMS operations" 1132 1133 if [ $ecdsa_tests = 1 ] ; then 1134 echo "Using ECDSA certificate" 1135 type=ecdsa 1136 cl_cert=$cl_ecdsa_cert 1137 cl_key=$cl_ecdsa_key 1138 sv_cert=$sv_ecdsa_cert 1139 sv_key=$sv_ecdsa_key 1140 sign_keyopt= 1141 enc_keyopt= 1142 else 1143 echo "Using RSA certificate" 1144 type=rsa 1145 cl_cert=$cl_rsa_cert 1146 cl_key="$cl_rsa_key -passin pass:$cl_rsa_pass" 1147 sv_cert=$sv_rsa_cert 1148 sv_key="$sv_rsa_key -passin pass:$sv_rsa_pass" 1149 sign_keyopt="-keyopt rsa_padding_mode:pss" 1150 enc_keyopt="-keyopt rsa_padding_mode:oaep" 1151 fi 1152 1153 cms_txt=$user1_dir/cms_$type.txt 1154 cms_sig=$user1_dir/cms_$type.sig 1155 cms_enc=$user1_dir/cms_$type.enc 1156 cms_dec=$user1_dir/cms_$type.dec 1157 cms_sgr=$user1_dir/cms_$type.sgr 1158 cms_ver=$user1_dir/cms_$type.ver 1159 cms_out=$user1_dir/cms_$type.out 1160 cms_dct=$user1_dir/cms_$type.dct 1161 cms_dot=$user1_dir/cms_$type.dot 1162 cms_dgc=$user1_dir/cms_$type.dgc 1163 cms_dgv=$user1_dir/cms_$type.dgv 1164 cms_ede=$user1_dir/cms_$type.ede 1165 cms_edd=$user1_dir/cms_$type.edd 1166 cms_srp=$user1_dir/cms_$type.srp 1167 cms_pwe=$user1_dir/cms_$type.pwe 1168 cms_pwd=$user1_dir/cms_$type.pwd 1169 1170 cat << __EOF__ > $cms_txt 1171Hello Bob, 1172Sincerely yours 1173Alice 1174__EOF__ 1175 1176 # sign 1177 start_message "cms ... sign to message" 1178 1179 $openssl_bin cms -sign -in $cms_txt -text \ 1180 -out $cms_sig -outform smime \ 1181 -signer $cl_cert -inkey $cl_key $sign_keyopt \ 1182 -keyform pem -md sha256 \ 1183 -from user1@test-dummy.com -to server@test-dummy.com \ 1184 -subject "test openssl cms" \ 1185 -receipt_request_from server@test-dummy.com \ 1186 -receipt_request_to user1@test-dummy.com 1187 check_exit_status $? 1188 1189 # encrypt 1190 start_message "cms ... encrypt message" 1191 1192 $openssl_bin cms -encrypt -aes256 -binary -in $cms_sig -inform smime \ 1193 -recip $sv_cert $enc_keyopt -out $cms_enc 1194 check_exit_status $? 1195 1196 # decrypt 1197 start_message "cms ... decrypt message" 1198 1199 $openssl_bin cms -decrypt -in $cms_enc -out $cms_dec \ 1200 -recip $sv_cert -inkey $sv_key 1201 check_exit_status $? 1202 1203 # verify 1204 start_message "cms ... verify message" 1205 1206 $openssl_bin cms -verify -in $cms_dec \ 1207 -CAfile $ca_cert -certfile $cl_cert -nointern \ 1208 -check_ss_sig -issuer_checks -policy_check -x509_strict \ 1209 -signer $cms_sgr -text -out $cms_ver -receipt_request_print \ 1210 > $cms_ver.log 2>&1 1211 check_exit_status $? 1212 1213 diff -b $cms_ver $cms_txt 1214 check_exit_status $? 1215 1216 # cmsout 1217 start_message "cms ... cmsout" 1218 1219 $openssl_bin cms -cmsout -in $cms_enc -print -out $cms_out 1220 check_exit_status $? 1221 1222 # data_create 1223 start_message "cms ... data_create" 1224 1225 $openssl_bin cms -data_create -in $cms_enc -out $cms_dct 1226 check_exit_status $? 1227 1228 # data_out 1229 start_message "cms ... data_out" 1230 1231 $openssl_bin cms -data_out -in $cms_dct -out $cms_dot 1232 check_exit_status $? 1233 1234 # digest_create 1235 start_message "cms ... digest_create" 1236 1237 $openssl_bin cms -digest_create -in $cms_txt -md sha256 -out $cms_dgc 1238 check_exit_status $? 1239 1240 # digest_verify 1241 start_message "cms ... digest_verify" 1242 1243 $openssl_bin cms -digest_verify -in $cms_dgc -md sha256 -out $cms_dgv 1244 check_exit_status $? 1245 1246 diff -b $cms_dgv $cms_txt 1247 check_exit_status $? 1248 1249 # compress 1250 1251 # uncompress 1252 1253 # EncryptedData_encrypt 1254 start_message "cms ... EncryptedData_encrypt" 1255 1256 $openssl_bin cms -EncryptedData_encrypt -in $cms_sig -out $cms_ede \ 1257 -aes128 -secretkey 00112233445566778899aabbccddeeff 1258 check_exit_status $? 1259 1260 # EncryptedData_decrypt 1261 start_message "cms ... EncryptedData_decrypt" 1262 1263 $openssl_bin cms -EncryptedData_decrypt -in $cms_ede -out $cms_edd \ 1264 -aes128 -secretkey 00112233445566778899aabbccddeeff 1265 check_exit_status $? 1266 1267 diff -b $cms_edd $cms_sig 1268 check_exit_status $? 1269 1270 # sign_receipt 1271 start_message "cms ... sign to receipt" 1272 1273 $openssl_bin cms -sign_receipt -in $cms_sig -out $cms_srp \ 1274 -signer $sv_cert -inkey $sv_key -md sha256 1275 check_exit_status $? 1276 1277 # verify_receipt 1278 start_message "cms ... verify receipt" 1279 1280 $openssl_bin cms -verify_receipt $cms_srp -rctform smime -in $cms_sig \ 1281 -CAfile $ca_cert -certfile $sv_cert 1282 check_exit_status $? 1283 1284 # encrypt with pwri 1285 start_message "cms ... encrypt with pwri" 1286 1287 $openssl_bin cms -encrypt -camellia256 -in $cms_txt -out $cms_pwe \ 1288 -pwri_password abcdefg 1289 check_exit_status $? 1290 1291 # decrypt with pwri 1292 start_message "cms ... decrypt with pwri" 1293 1294 $openssl_bin cms -decrypt -camellia256 -in $cms_pwe -out $cms_pwd \ 1295 -pwri_password abcdefg 1296 check_exit_status $? 1297 1298 diff -b $cms_pwd $cms_txt 1299 check_exit_status $? 1300} 1301 1302function test_smime { 1303 # --- S/MIME operations --- 1304 section_message "S/MIME operations" 1305 1306 cl_cert=$cl_rsa_cert 1307 cl_key="$cl_rsa_key -passin pass:$cl_rsa_pass" 1308 sv_cert=$sv_rsa_cert 1309 sv_key="$sv_rsa_key -passin pass:$sv_rsa_pass" 1310 1311 smime_txt=$user1_dir/smime.txt 1312 smime_enc=$user1_dir/smime.enc 1313 smime_sig=$user1_dir/smime.sig 1314 smime_p7o=$user1_dir/smime.p7o 1315 smime_sgr=$user1_dir/smime.sgr 1316 smime_ver=$user1_dir/smime.ver 1317 smime_dec=$user1_dir/smime.dec 1318 1319 cat << __EOF__ > $smime_txt 1320Hello Bob, 1321Sincerely yours 1322Alice 1323__EOF__ 1324 1325 # encrypt 1326 start_message "smime ... encrypt message" 1327 1328 $openssl_bin smime -encrypt -aes256 -binary -in $smime_txt \ 1329 -out $smime_enc $sv_cert 1330 check_exit_status $? 1331 1332 # sign 1333 start_message "smime ... sign to message" 1334 1335 $openssl_bin smime -sign -in $smime_enc -text -inform smime \ 1336 -out $smime_sig -outform smime \ 1337 -signer $cl_cert -inkey $cl_key -keyform pem -md sha256 \ 1338 -from user1@test-dummy.com -to server@test-dummy.com \ 1339 -subject "test openssl smime" 1340 check_exit_status $? 1341 1342 # pk7out 1343 start_message "smime ... pk7out from message" 1344 1345 $openssl_bin smime -pk7out -in $smime_sig -out $smime_p7o 1346 check_exit_status $? 1347 1348 # verify 1349 start_message "smime ... verify message" 1350 1351 $openssl_bin smime -verify -in $smime_sig \ 1352 -CAfile $ca_cert -certfile $cl_cert -nointern \ 1353 -check_ss_sig -issuer_checks -policy_check -x509_strict \ 1354 -signer $smime_sgr -text -out $smime_ver 1355 check_exit_status $? 1356 1357 # decrypt 1358 start_message "smime ... decrypt message" 1359 1360 $openssl_bin smime -decrypt -in $smime_ver -out $smime_dec \ 1361 -recip $sv_cert -inkey $sv_key 1362 check_exit_status $? 1363 1364 diff $smime_dec $smime_txt 1365 check_exit_status $? 1366} 1367 1368function test_ocsp { 1369 # --- OCSP operations --- 1370 section_message "OCSP operations" 1371 1372 # get key without pass 1373 cl_rsa_key_nopass=$user1_dir/cl_rsa_key_nopass.pem 1374 $openssl_bin pkey -in $cl_rsa_key -passin pass:$cl_rsa_pass \ 1375 -out $cl_rsa_key_nopass 1376 check_exit_status $? 1377 1378 # request 1379 start_message "ocsp ... create OCSP request" 1380 1381 ocsp_req=$user1_dir/ocsp_req.der 1382 $openssl_bin ocsp -issuer $ca_cert -cert $sv_rsa_cert \ 1383 -cert $revoke_cert -serial 1 -nonce -no_certs -CAfile $ca_cert \ 1384 -signer $cl_rsa_cert -signkey $cl_rsa_key_nopass \ 1385 -sign_other $cl_rsa_cert -sha256 \ 1386 -reqout $ocsp_req -req_text -out $ocsp_req.out 1387 check_exit_status $? 1388 1389 # response 1390 start_message "ocsp ... create OCPS response for a request" 1391 1392 ocsp_res=$user1_dir/ocsp_res.der 1393 $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ 1394 -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ 1395 -reqin $ocsp_req -rother $ocsp_cert -resp_no_certs -noverify \ 1396 -nmin 60 -validity_period 300 -status_age 300 \ 1397 -respout $ocsp_res -resp_text -out $ocsp_res.out 1398 check_exit_status $? 1399 1400 # ocsp server 1401 start_message "ocsp ... start OCSP server in background" 1402 1403 ocsp_port=8888 1404 1405 ocsp_svr_log=$user1_dir/ocsp_svr.log 1406 $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ 1407 -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ 1408 -host localhost -port $ocsp_port -path / -ndays 1 -nrequest 1 \ 1409 -resp_key_id -text -out $ocsp_svr_log & 1410 check_exit_status $? 1411 ocsp_svr_pid=$! 1412 echo "ocsp server pid = [ $ocsp_svr_pid ]" 1413 sleep 1 1414 1415 # send query to ocsp server 1416 start_message "ocsp ... send OCSP request to server" 1417 1418 ocsp_qry=$user1_dir/ocsp_qry.der 1419 $openssl_bin ocsp -issuer $ca_cert -cert $sv_rsa_cert \ 1420 -cert $revoke_cert -CAfile $ca_cert -no_nonce \ 1421 -url http://localhost:$ocsp_port -timeout 10 -text \ 1422 -header Host localhost \ 1423 -respout $ocsp_qry -out $ocsp_qry.out 1424 check_exit_status $? 1425 1426 # verify response from server 1427 start_message "ocsp ... verify OCSP response from server" 1428 1429 $openssl_bin ocsp -respin $ocsp_qry -CAfile $ca_cert \ 1430 -ignore_err -no_signature_verify -no_cert_verify -no_chain \ 1431 -no_cert_checks -no_explicit -trust_other -no_intern \ 1432 -verify_other $ocsp_cert -VAfile $ocsp_cert 1433 check_exit_status $? 1434} 1435 1436function test_pkcs { 1437 # --- PKCS operations --- 1438 section_message "PKCS operations" 1439 1440 pkcs_pass=test-pkcs-pass 1441 1442 start_message "pkcs7 ... output certs in crl(pkcs7)" 1443 $openssl_bin pkcs7 -in $crl_p7 -print_certs -text -out $crl_p7.out 1444 check_exit_status $? 1445 1446 start_message "pkcs8 ... convert key to pkcs8" 1447 $openssl_bin pkcs8 -in $cl_rsa_key -topk8 -out $cl_rsa_key.p8 \ 1448 -passin pass:$cl_rsa_pass -passout pass:$cl_rsa_pass \ 1449 -v1 pbeWithSHA1AndDES-CBC -v2 des3 1450 check_exit_status $? 1451 1452 start_message "pkcs8 ... convert pkcs8 to key in DER format" 1453 $openssl_bin pkcs8 -in $cl_rsa_key.p8 -passin pass:$cl_rsa_pass \ 1454 -outform DER -out $cl_rsa_key.p8.der 1455 check_exit_status $? 1456 1457 start_message "pkcs12 ... create" 1458 $openssl_bin pkcs12 -export -in $sv_rsa_cert -inkey $sv_rsa_key \ 1459 -passin pass:$sv_rsa_pass -certfile $ca_cert -CAfile $ca_cert \ 1460 -caname "caname_server_p12" \ 1461 -certpbe AES-256-CBC -keypbe AES-256-CBC -chain \ 1462 -name "name_server_p12" -des3 -maciter -macalg sha256 \ 1463 -CSP "csp_server_p12" -LMK -keyex \ 1464 -passout pass:$pkcs_pass -out $sv_rsa_cert.p12 1465 check_exit_status $? 1466 1467 start_message "pkcs12 ... verify" 1468 $openssl_bin pkcs12 -in $sv_rsa_cert.p12 -passin pass:$pkcs_pass -info \ 1469 -noout > $sv_rsa_cert.p12.log 2>&1 1470 check_exit_status $? 1471 1472 start_message "pkcs12 ... private key to PEM without encryption" 1473 $openssl_bin pkcs12 -in $sv_rsa_cert.p12 -password pass:$pkcs_pass \ 1474 -nocerts -nomacver -nodes -out $sv_rsa_cert.p12.pem 1475 check_exit_status $? 1476} 1477 1478function test_sc_by_protocol_version { 1479 sc=$1 1480 ver=$2 1481 msg=$3 1482 cid=$4 1483 1484 if [ $gost_tests = 1 ] && [ $ver = "tls1_3" -o $sc != 00 ] ; then 1485 return 1486 fi 1487 1488 groups_and_cipher="" 1489 if [ $ver = "tls1_3" ] ; then 1490 # Expect HelloRetryRequest 1491 groups_and_cipher="-groups P-521:P-384 -cipher ALL" 1492 fi 1493 1494 s_client_out=$user1_dir/s_client_${sc}_${ver}.out 1495 1496 start_message "s_client ... connect to TLS/SSL test server by $ver" 1497 sleep $test_pause_sec 1498 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1499 -$ver $groups_and_cipher \ 1500 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1501 check_exit_status $? 1502 1503 # check downgrade bits in SH 1504 if [ $ver = "tls1" -o $ver = "tls1_1" ] ; then 1505 perl -0ne \ 1506 'exit (!/ServerHello\n.*\n.*44 4f\n.*57 4e 47 52 44 00/m)' \ 1507 $s_client_out 1508 check_exit_status $? 1509 elif [ $ver = "tls1_2" ] ; then 1510 perl -0ne \ 1511 'exit (!/ServerHello\n.*\n.*44 4f\n.*57 4e 47 52 44 01/m)' \ 1512 $s_client_out 1513 check_exit_status $? 1514 elif [ $ver = "tls1_3" ] ; then 1515 perl -0ne \ 1516 'exit (/ServerHello\n.*\n.*44 4f\n.*57 4e 47 52 44/m)' \ 1517 $s_client_out 1518 check_exit_status $? 1519 fi 1520 1521 # check HRR hash 1522 if [ $ver = "tls1_3" ] ; then 1523 perl -0ne \ 1524 'exit (!/ServerHello\n.*cf 21 ad 74 e5 9a 61 11 be 1d\n.*8c 02 1e 65 b8 91 c2 a2 11 16 7a bb 8c 5e 07 9e\n.*09 e2 c8 a8 33 9c/m)' \ 1525 $s_client_out 1526 check_exit_status $? 1527 fi 1528 1529 if [ $ver = "tls1_3" ] ; then 1530 grep 'Server Temp Key: ECDH, .*384.*, 384 bits' $s_client_out \ 1531 > /dev/null 1532 check_exit_status $? 1533 fi 1534 1535 # OpenSSL1.1.1 with TLSv1.3 does not call SSL_SESSION_print() until 1536 # NewSessionTicket arrival 1537 if ! [ $cid = "1" -a $ver = "tls1_3" ] ; then 1538 grep "$msg" $s_client_out > /dev/null 1539 check_exit_status $? 1540 fi 1541 1542 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1543 check_exit_status $? 1544} 1545 1546function test_sc_all_cipher { 1547 sc=$1 1548 ver=$2 1549 1550 if [ $gost_tests = 1 ] && [ $ver = "tls1_3" -o $sc != 00 ] ; then 1551 return 1552 fi 1553 1554 copt=cipher 1555 ciphers=$user1_dir/ciphers_${sc}_${ver} 1556 1557 if [ $ver = "tls1_3" ] ; then 1558 echo "TLS_AES_256_GCM_SHA384" > $ciphers 1559 echo "TLS_CHACHA20_POLY1305_SHA256" >> $ciphers 1560 echo "TLS_AES_128_GCM_SHA256" >> $ciphers 1561 if [ $c_id != "0" ] ; then 1562 copt=ciphersuites 1563 fi 1564 else 1565 s_ciph=$server_dir/s_ciph_${sc}_${ver} 1566 cipher_string="" 1567 if [ $s_id = "0" ] ; then 1568 if [ $ecdsa_tests = 1 ] ; then 1569 cipher_string="ECDSA+TLSv1.2:!TLSv1.3" 1570 elif [ $gost_tests = 1 ] ; then 1571 cipher_string="kGOST:!NULL:!TLSv1.3" 1572 else 1573 cipher_string="ALL:!ECDSA:!kGOST:!TLSv1.3" 1574 fi 1575 fi 1576 $s_bin ciphers -v $cipher_string | awk '{print $1}' > $s_ciph 1577 1578 c_ciph=$user1_dir/c_ciph_${sc}_${ver} 1579 cipher_string="" 1580 if [ $c_id = "0" ] ; then 1581 if [ $ecdsa_tests = 1 ] ; then 1582 cipher_string="ECDSA+TLSv1.2:!TLSv1.3" 1583 elif [ $gost_tests = 1 ] ; then 1584 cipher_string="kGOST:!NULL:!TLSv1.3" 1585 else 1586 cipher_string="ALL:!ECDSA:!kGOST:!TLSv1.3" 1587 fi 1588 fi 1589 $c_bin ciphers -s -v $cipher_string | awk '{print $1}' > $c_ciph 1590 1591 grep -x -f $s_ciph $c_ciph | sort -R > $ciphers 1592 fi 1593 1594 cnum=0 1595 for c in `cat $ciphers` ; do 1596 cnum=`expr $cnum + 1` 1597 cnstr=`printf %03d $cnum` 1598 s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_${cnstr}_${c}.out 1599 1600 start_message "s_client ... connect to TLS/SSL test server with [ $cnstr ] $ver $c" 1601 sleep $test_pause_sec 1602 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1603 -$ver -$copt $c \ 1604 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1605 check_exit_status $? 1606 1607 grep "Cipher is $c" $s_client_out > /dev/null 1608 check_exit_status $? 1609 1610 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1611 check_exit_status $? 1612 done 1613} 1614 1615function test_sc_session_reuse { 1616 sc=$1 1617 ver=$2 1618 1619 if [ $gost_tests = 1 ] && [ $ver = "tls1_3" -o $sc != 00 ] ; then 1620 return 1621 fi 1622 1623 sess_dat=$user1_dir/s_client_${sc}_${ver}_sess.dat 1624 1625 # Get session ticket to reuse 1626 1627 s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_reuse_1.out 1628 1629 start_message "s_client ... connect to TLS/SSL test server to get session id $ver" 1630 sleep $test_pause_sec 1631 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1632 -$ver -alpn "spdy/3,http/1.1" -sess_out $sess_dat \ 1633 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1634 check_exit_status $? 1635 1636 grep '^New, TLS.*$' $s_client_out > /dev/null 1637 check_exit_status $? 1638 1639 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1640 check_exit_status $? 1641 1642 # Reuse session ticket 1643 1644 s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_reuse_2.out 1645 1646 start_message "s_client ... connect to TLS/SSL test server reusing session id $ver" 1647 sleep $test_pause_sec 1648 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1649 -$ver -sess_in $sess_dat \ 1650 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1651 check_exit_status $? 1652 1653 grep '^Reused, TLS.*$' $s_client_out > /dev/null 1654 check_exit_status $? 1655 1656 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1657 check_exit_status $? 1658 1659 # sess_id 1660 1661 start_message "sess_id" 1662 $c_bin sess_id -in $sess_dat -text -out $sess_dat.out 1663 check_exit_status $? 1664} 1665 1666function test_sc_verify { 1667 sc=$1 1668 ver=$2 1669 1670 if [ $gost_tests = 1 ] && [ $ver = "tls1_3" -o $sc != 00 ] ; then 1671 return 1672 fi 1673 1674 # invalid verification pattern 1675 1676 s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_invalid.out 1677 1678 start_message "s_client ... connect to tls/ssl test server but verify error $ver" 1679 sleep $test_pause_sec 1680 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1681 -$ver -showcerts -crl_check -issuer_checks -policy_check \ 1682 -status -servername xyz \ 1683 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1684 check_exit_status $? 1685 1686 grep 'verify return code: 0 (ok)' $s_client_out > /dev/null 1687 if [ $? -eq 0 ] ; then 1688 check_exit_status 1 1689 else 1690 check_exit_status 0 1691 fi 1692 1693 # client certificate pattern 1694 1695 s_client_out=$user1_dir/s_client_${sc}_${ver}_tls_client_cert.out 1696 1697 start_message "s_client ... connect to tls/ssl test server with client certificate $ver" 1698 1699 if [ $ecdsa_tests = 1 ] ; then 1700 echo "Using ECDSA client certificate" 1701 crt=$cl_ecdsa_cert 1702 key=$cl_ecdsa_key 1703 pwd=$cl_ecdsa_pass 1704 elif [ $gost_tests = 1 ] ; then 1705 echo "Using GOST client certificate" 1706 crt=$cl_gost_cert 1707 key=$cl_gost_key 1708 pwd=$cl_gost_pass 1709 else 1710 echo "Using RSA client certificate" 1711 crt=$cl_rsa_cert 1712 key=$cl_rsa_key 1713 pwd=$cl_rsa_pass 1714 fi 1715 1716 sleep $test_pause_sec 1717 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1718 -$ver -cert $crt -key $key -pass pass:$pwd \ 1719 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1720 check_exit_status $? 1721 1722 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1723 check_exit_status $? 1724} 1725 1726function test_server_client { 1727 # --- client/server operations (TLS) --- 1728 section_message "client/server operations (TLS)" 1729 1730 s_id="$1" 1731 c_id="$2" 1732 sc="$1$2" 1733 1734 test_pause_sec=0.2 1735 1736 if [ $s_id = "0" ] ; then 1737 s_bin=$openssl_bin 1738 else 1739 s_bin=$other_openssl_bin 1740 fi 1741 1742 if [ $c_id = "0" ] ; then 1743 c_bin=$openssl_bin 1744 else 1745 c_bin=$other_openssl_bin 1746 fi 1747 1748 echo "s_server is [`$s_bin version`]" 1749 echo "s_client is [`$c_bin version`]" 1750 1751 host="localhost" 1752 port=4433 1753 s_server_out=$server_dir/s_server_${sc}_tls.out 1754 1755 if [ $ecdsa_tests = 1 ] ; then 1756 echo "Using ECDSA certificate" 1757 crt=$sv_ecdsa_cert 1758 key=$sv_ecdsa_key 1759 pwd=$sv_ecdsa_pass 1760 elif [ $gost_tests = 1 ] ; then 1761 echo "Using GOST certificate" 1762 crt=$sv_gost_cert 1763 key=$sv_gost_key 1764 pwd=$sv_gost_pass 1765 else 1766 echo "Using RSA certificate" 1767 crt=$sv_rsa_cert 1768 key=$sv_rsa_key 1769 pwd=$sv_rsa_pass 1770 fi 1771 1772 start_message "s_server ... start TLS/SSL test server" 1773 $s_bin s_server -accept $port -CAfile $ca_cert \ 1774 -cert $crt -key $key -pass pass:$pwd \ 1775 -context "appstest.sh" -id_prefix "APPSTEST.SH" -crl_check \ 1776 -alpn "http/1.1,spdy/3" -www -cipher ALL -4 \ 1777 -msg -tlsextdebug -verify 3 -groups X25519:P-384:P-256 \ 1778 -status -servername xyz -cert2 $crt -key2 $key \ 1779 > $s_server_out 2>&1 & 1780 check_exit_status $? 1781 s_server_pid=$! 1782 echo "s_server pid = [ $s_server_pid ]" 1783 sleep 1 1784 1785 # test by protocol version 1786 test_sc_by_protocol_version $sc tls1_2 'Protocol : TLSv1\.2$' $c_id 1787 test_sc_by_protocol_version $sc tls1_3 'Protocol : TLSv1\.3$' $c_id 1788 1789 # all available ciphers with random order 1790 test_sc_all_cipher $sc tls1_2 1791 test_sc_all_cipher $sc tls1_3 1792 1793 # session resumption 1794 test_sc_session_reuse $sc tls1_2 1795 1796 # invalid verification pattern 1797 test_sc_verify $sc tls1_2 1798 test_sc_verify $sc tls1_3 1799 1800 # s_time 1801 if [ $gost_tests != 1 ] ; then 1802 start_message "s_time ... connect to TLS/SSL test server" 1803 $c_bin s_time -connect $host:$port -CApath $ca_dir -time 1 \ 1804 > $server_dir/s_time_${sc}.log 1805 check_exit_status $? 1806 fi 1807 1808 stop_s_server 1809} 1810 1811function test_server_client_dtls { 1812 # --- client/server operations (DTLS) --- 1813 section_message "client/server operations (DTLS)" 1814 1815 s_id="$1" 1816 c_id="$2" 1817 sc="$1$2" 1818 1819 test_pause_sec=0.2 1820 1821 if [ $s_id = "0" ] ; then 1822 s_bin=$openssl_bin 1823 else 1824 s_bin=$other_openssl_bin 1825 fi 1826 1827 if [ $c_id = "0" ] ; then 1828 c_bin=$openssl_bin 1829 else 1830 c_bin=$other_openssl_bin 1831 fi 1832 1833 echo "s_server is [`$s_bin version`]" 1834 echo "s_client is [`$c_bin version`]" 1835 1836 host="localhost" 1837 port=4433 1838 s_server_out=$server_dir/s_server_${sc}_dtls.out 1839 1840 if [ $ecdsa_tests = 1 ] ; then 1841 echo "Using ECDSA certificate" 1842 crt=$sv_ecdsa_cert 1843 key=$sv_ecdsa_key 1844 pwd=$sv_ecdsa_pass 1845 elif [ $gost_tests = 1 ] ; then 1846 echo "Using GOST certificate" 1847 crt=$sv_gost_cert 1848 key=$sv_gost_key 1849 pwd=$sv_gost_pass 1850 else 1851 echo "Using RSA certificate" 1852 crt=$sv_rsa_cert 1853 key=$sv_rsa_key 1854 pwd=$sv_rsa_pass 1855 fi 1856 1857 start_message "s_server ... start DTLS test server" 1858 $s_bin s_server -accept $port -CAfile $ca_cert \ 1859 -cert $crt -key $key -pass pass:$pwd \ 1860 -context "appstest.sh" -id_prefix "APPSTEST.SH" -crl_check \ 1861 -alpn "http/1.1,spdy/3" -cipher ALL -4 \ 1862 -msg -tlsextdebug -verify 3 -groups X25519:P-384:P-256 \ 1863 -status -servername xyz -cert2 $crt -key2 $key -dtls -quiet \ 1864 > $s_server_out 2>&1 & 1865 check_exit_status $? 1866 s_server_pid=$! 1867 echo "s_server pid = [ $s_server_pid ]" 1868 sleep 1 1869 1870 # test by protocol version 1871 test_sc_by_protocol_version $sc dtls1_2 'Protocol : DTLSv1.2$' $c_id 1872 1873 stop_s_server 1874} 1875 1876function test_gnutls { 1877 # --- GnuTLS interoperability --- 1878 section_message "GnuTLS $1 interoperability" 1879 1880 proto="$1" 1881 1882 if [ $proto = "tls" ] ; then 1883 sopt="-www" 1884 lopt= 1885 gopt= 1886 else 1887 sopt="-quiet" 1888 lopt="-dtls" 1889 gopt="-u" 1890 fi 1891 1892 gs_bin=/usr/local/bin/gnutls-serv 1893 gc_bin=/usr/local/bin/gnutls-cli 1894 1895 host="localhost" 1896 port=4433 1897 1898 if [ $ecdsa_tests = 1 ] ; then 1899 echo "Using ECDSA certificate" 1900 crt=$sv_ecdsa_cert 1901 key=$sv_ecdsa_key 1902 sni=ecdsa.test-dummy.com 1903 elif [ $gost_tests = 1 ] ; then 1904 echo "Using GOST certificate" 1905 crt=$sv_gost_cert 1906 key=$sv_gost_key 1907 sni=gost.test-dummy.com 1908 else 1909 echo "Using RSA certificate" 1910 crt=$sv_rsa_cert 1911 key=$sv_rsa_key.nopass 1912 sni=localhost.test-dummy.com 1913 fi 1914 1915 # LibreSSL - GnuTLS 1916 1917 start_message "s_server ... start $proto test server" 1918 s_server_out=$server_dir/s_server_LG_$proto.out 1919 $openssl_bin s_server -accept $port -CAfile $ca_cert \ 1920 -cert $crt -key $key -cert2 $crt -key2 $key \ 1921 -servername $sni -msg -tlsextdebug -status $sopt $lopt \ 1922 > $s_server_out 2>&1 & 1923 check_exit_status $? 1924 s_server_pid=$! 1925 echo "s_server pid = [ $s_server_pid ]" 1926 sleep 1 1927 1928 gnutls_cli_out=$user1_dir/gnutls-cli_LG_$proto.out 1929 $gc_bin --x509cafile=$ca_cert --sni-hostname=$sni \ 1930 --verify-hostname=$sni $gopt -p $port $host < /dev/null \ 1931 > $gnutls_cli_out 2>&1 1932 check_exit_status $? 1933 1934 grep 'Handshake was completed' $gnutls_cli_out > /dev/null 1935 check_exit_status $? 1936 1937 stop_s_server 1938 1939 # GnuTLS - LibreSSL 1940 1941 start_message "gnutls-serv ... start $proto test server" 1942 gnutls_serv_out=$server_dir/gnutls-serv_GL_$proto.out 1943 $gs_bin --x509cafile=$ca_cert --x509certfile=$crt --x509keyfile=$key \ 1944 $gopt -p $port > $gnutls_serv_out 2>&1 & 1945 check_exit_status $? 1946 gnutls_serv_pid=$! 1947 echo "gnutls-serv pid = [ $gnutls_serv_pid ]" 1948 sleep 1 1949 1950 s_client_out=$user1_dir/s_client_GL_$proto.out 1951 $openssl_bin s_client -connect $host:$port -CAfile $ca_cert \ 1952 -msg -tlsextdebug -status $lopt < /dev/null > $s_client_out 2>&1 1953 check_exit_status $? 1954 1955 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1956 check_exit_status $? 1957 1958 stop_gnutls_serv 1959} 1960 1961function test_speed { 1962 # === PERFORMANCE === 1963 section_message "PERFORMANCE" 1964 1965 if [ $no_long_tests = 0 ] ; then 1966 start_message "speed" 1967 $openssl_bin speed sha512 rsa2048 -multi 2 -elapsed 1968 check_exit_status $? 1969 else 1970 start_message "SKIPPING speed (quick mode)" 1971 fi 1972} 1973 1974function test_version { 1975 # --- VERSION INFORMATION --- 1976 section_message "VERSION INFORMATION" 1977 1978 start_message "version" 1979 $openssl_bin version -a 1980 check_exit_status $? 1981} 1982 1983#---------#---------#---------#---------#---------#---------#---------#--------- 1984 1985openssl_bin=${OPENSSL:-/usr/bin/openssl} 1986other_openssl_bin=${OTHER_OPENSSL:-/usr/local/bin/eopenssl11} 1987other_openssl_version=`$other_openssl_bin version | cut -b 1-10` 1988 1989ecdsa_tests=0 1990gost_tests=0 1991interop_tests=0 1992gnutls_tests=0 1993no_long_tests=0 1994 1995while [ "$1" != "" ]; do 1996 case $1 in 1997 -e | --ecdsa) shift 1998 ecdsa_tests=1 1999 gost_tests=0 2000 ;; 2001 -g | --gost) shift 2002 gost_tests=1 2003 ecdsa_tests=0 2004 ;; 2005 -i | --interop) shift 2006 interop_tests=1 2007 ;; 2008 -n | --gnutls) shift 2009 gnutls_tests=1 2010 ;; 2011 -q | --quick ) shift 2012 no_long_tests=1 2013 ;; 2014 * ) usage 2015 exit 1 2016 esac 2017done 2018 2019if [ ! -x $openssl_bin ] ; then 2020 echo ":-< \$OPENSSL [$openssl_bin] is not executable." 2021 exit 1 2022fi 2023 2024if [ $interop_tests = 1 -a ! -x $other_openssl_bin ] ; then 2025 echo ":-< \$OTHER_OPENSSL [$other_openssl_bin] is not executable." 2026 exit 1 2027fi 2028 2029# 2030# create ssldir, and all files generated by this script goes under this dir. 2031# 2032ssldir="appstest_dir" 2033 2034if [ -d $ssldir ] ; then 2035 echo "directory [ $ssldir ] exists, this script deletes this directory ..." 2036 /bin/rm -rf $ssldir 2037fi 2038 2039mkdir -p $ssldir 2040 2041ca_dir=$ssldir/testCA 2042tsa_dir=$ssldir/testTSA 2043ocsp_dir=$ssldir/testOCSP 2044server_dir=$ssldir/server 2045user1_dir=$ssldir/user1 2046mkdir -p $user1_dir 2047key_dir=$ssldir/key 2048mkdir -p $key_dir 2049 2050export OPENSSL_CONF=$ssldir/openssl.cnf 2051touch $OPENSSL_CONF 2052 2053uname_s=`uname -s | grep 'MINGW'` 2054if [ "$uname_s" = "" ] ; then 2055 mingw=0 2056else 2057 mingw=1 2058fi 2059 2060# 2061# process tests 2062# 2063test_usage_lists_others 2064test_md 2065test_encoding_cipher 2066test_key 2067test_pki 2068test_tsa 2069test_cms 2070test_smime 2071test_ocsp 2072test_pkcs 2073test_server_client 0 0 2074if [ $interop_tests = 1 ] ; then 2075 test_server_client 0 1 2076 test_server_client 1 0 2077fi 2078test_server_client_dtls 0 0 2079if [ $interop_tests = 1 ] ; then 2080 test_server_client_dtls 0 1 2081 test_server_client_dtls 1 0 2082fi 2083if [ $gnutls_tests = 1 ] ; then 2084 test_gnutls tls 2085 test_gnutls dtls 2086fi 2087test_speed 2088test_version 2089 2090section_message "END" 2091 2092exit 0 2093 2094