1#!/bin/sh
2
3OPENSSL_CONF="${builddir}/openssl.cnf"
4export OPENSSL_CONF
5
6password='AT3S4PASSWD'
7
8key="${builddir}/client.key"
9pwdfile="${builddir}/passwd"
10
11# create an engine key for us
12sed 's/PRIVATE KEY/TEST ENGINE KEY/' < ${top_srcdir}/sample/sample-keys/client.key > ${key}
13echo "$password" > $pwdfile
14
15# our version of grep to output log.txt on failure in case it's an openssl
16# error mismatch and the grep expression needs updating
17loggrep() {
18    egrep -q "$1" log.txt || { echo '---- begin log.txt ----'; cat log.txt; echo '--- end log.txt ---'; return 1; }
19}
20
21# note here we've induced a mismatch in the client key and the server
22# cert which openvpn should report and die.  Check that it does.  Note
23# also that this mismatch depends on openssl not openvpn, so it is
24# somewhat fragile
25${top_builddir}/src/openvpn/openvpn --cd ${top_srcdir}/sample --config sample-config-files/loopback-server --engine testengine --key ${key} --askpass $pwdfile > log.txt 2>&1
26
27# first off check we died because of a key mismatch.  If this doesn't
28# pass, suspect openssl of returning different messages and update the
29# test accordingly
30loggrep '(X509_check_private_key:key values mismatch|func\(128\):reason\(116\))' log.txt || { echo "Key mismatch not detected"; exit 1; }
31
32# now look for the engine prints (these are under our control)
33loggrep 'ENGINE: engine_init called' || { echo "Engine initialization not detected"; exit 1; }
34loggrep 'ENGINE: engine_load_key called' || { echo "Key was not loaded from engine"; exit 1; }
35loggrep "ENGINE: engine_load_key got password ${password}" || { echo "Key password was not retrieved by the engine"; exit 1; }
36exit 0
37