You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
255 lines
7.3 KiB
255 lines
7.3 KiB
$! |
|
$! A few very basic tests for the 'ts' time stamping authority command. |
|
$! |
|
$ |
|
$ __arch = "VAX" |
|
$ if f$getsyi("cpu") .ge. 128 then - |
|
__arch = f$edit( f$getsyi( "ARCH_NAME"), "UPCASE") |
|
$ if __arch .eqs. "" then __arch = "UNK" |
|
$! |
|
$ if (p4 .eqs. "64") then __arch = __arch+ "_64" |
|
$! |
|
$ exe_dir = "sys$disk:[-.''__arch'.exe.apps]" |
|
$ |
|
$ openssl = "mcr ''f$parse(exe_dir+"openssl.exe")'" |
|
$ OPENSSL_CONF = "[-]CAtsa.cnf" |
|
$ ! Because that's what ../apps/CA.sh really looks at |
|
$ SSLEAY_CONFIG = "-config " + OPENSSL_CONF |
|
$ |
|
$ error: |
|
$ subroutine |
|
$ write sys$error "TSA test failed!" |
|
$ exit 3 |
|
$ endsubroutine |
|
$ |
|
$ setup_dir: |
|
$ subroutine |
|
$ |
|
$ if f$search("tsa.dir") .nes "" |
|
$ then |
|
$ @[-.util]deltree [.tsa]*.* |
|
$ set file/prot=(S:RWED,O:RWED,G:RWED,W:RWED) tsa.dir;* |
|
$ delete tsa.dir;* |
|
$ endif |
|
$ |
|
$ create/dir [.tsa] |
|
$ set default [.tsa] |
|
$ endsubroutine |
|
$ |
|
$ clean_up_dir: |
|
$ subroutine |
|
$ |
|
$ set default [-] |
|
$ @[-.util]deltree [.tsa]*.* |
|
$ set file/prot=(S:RWED,O:RWED,G:RWED,W:RWED) tsa.dir;* |
|
$ delete tsa.dir;* |
|
$ endsubroutine |
|
$ |
|
$ create_ca: |
|
$ subroutine |
|
$ |
|
$ write sys$output "Creating a new CA for the TSA tests..." |
|
$ TSDNSECT = "ts_ca_dn" |
|
$ openssl req -new -x509 -nodes - |
|
-out tsaca.pem -keyout tsacakey.pem |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ create_tsa_cert: |
|
$ subroutine |
|
$ |
|
$ INDEX=p1 |
|
$ EXT=p2 |
|
$ TSDNSECT = "ts_cert_dn" |
|
$ |
|
$ openssl req -new - |
|
-out tsa_req'INDEX'.pem -keyout tsa_key'INDEX'.pem |
|
$ if $severity .ne. 1 then call error |
|
$ |
|
$ write sys$output "Using extension ''EXT'" |
|
$ openssl x509 -req - |
|
-in tsa_req'INDEX'.pem -out tsa_cert'INDEX'.pem - |
|
"-CA" tsaca.pem "-CAkey" tsacakey.pem "-CAcreateserial" - |
|
-extfile 'OPENSSL_CONF' -extensions "''EXT'" |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ print_request: |
|
$ subroutine |
|
$ |
|
$ openssl ts -query -in 'p1' -text |
|
$ endsubroutine |
|
$ |
|
$ create_time_stamp_request1: subroutine |
|
$ |
|
$ openssl ts -query -data [-]testtsa.com -policy tsa_policy1 - |
|
-cert -out req1.tsq |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ create_time_stamp_request2: subroutine |
|
$ |
|
$ openssl ts -query -data [-]testtsa.com -policy tsa_policy2 - |
|
-no_nonce -out req2.tsq |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ create_time_stamp_request3: subroutine |
|
$ |
|
$ openssl ts -query -data [-]CAtsa.cnf -no_nonce -out req3.tsq |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ print_response: |
|
$ subroutine |
|
$ |
|
$ openssl ts -reply -in 'p1' -text |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ create_time_stamp_response: |
|
$ subroutine |
|
$ |
|
$ openssl ts -reply -section 'p3' -queryfile 'p1' -out 'p2' |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ time_stamp_response_token_test: |
|
$ subroutine |
|
$ |
|
$ RESPONSE2 = p2+ "-copy_tsr" |
|
$ TOKEN_DER = p2+ "-token_der" |
|
$ openssl ts -reply -in 'p2' -out 'TOKEN_DER' -token_out |
|
$ if $severity .ne. 1 then call error |
|
$ openssl ts -reply -in 'TOKEN_DER' -token_in -out 'RESPONSE2' |
|
$ if $severity .ne. 1 then call error |
|
$ backup/compare 'RESPONSE2' 'p2' |
|
$ if $severity .ne. 1 then call error |
|
$ openssl ts -reply -in 'p2' -text -token_out |
|
$ if $severity .ne. 1 then call error |
|
$ openssl ts -reply -in 'TOKEN_DER' -token_in -text -token_out |
|
$ if $severity .ne. 1 then call error |
|
$ openssl ts -reply -queryfile 'p1' -text -token_out |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ verify_time_stamp_response: |
|
$ subroutine |
|
$ |
|
$ openssl ts -verify -queryfile 'p1' -in 'p2' - |
|
"-CAfile" tsaca.pem -untrusted tsa_cert1.pem |
|
$ if $severity .ne. 1 then call error |
|
$ openssl ts -verify -data 'p3' -in 'p2' - |
|
"-CAfile" tsaca.pem -untrusted tsa_cert1.pem |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ verify_time_stamp_token: |
|
$ subroutine |
|
$ |
|
$ ! create the token from the response first |
|
$ openssl ts -reply -in "''p2'" -out "''p2'-token" -token_out |
|
$ if $severity .ne. 1 then call error |
|
$ openssl ts -verify -queryfile "''p1'" -in "''p2'-token" - |
|
-token_in "-CAfile" tsaca.pem -untrusted tsa_cert1.pem |
|
$ if $severity .ne. 1 then call error |
|
$ openssl ts -verify -data "''p3'" -in "''p2'-token" - |
|
-token_in "-CAfile" tsaca.pem -untrusted tsa_cert1.pem |
|
$ if $severity .ne. 1 then call error |
|
$ endsubroutine |
|
$ |
|
$ verify_time_stamp_response_fail: |
|
$ subroutine |
|
$ |
|
$ openssl ts -verify -queryfile 'p1' -in 'p2' - |
|
"-CAfile" tsaca.pem -untrusted tsa_cert1.pem |
|
$ ! Checks if the verification failed, as it should have. |
|
$ if $severity .eq. 1 then call error |
|
$ write sys$output "Ok" |
|
$ endsubroutine |
|
$ |
|
$ ! Main body ---------------------------------------------------------- |
|
$ |
|
$ set noon |
|
$ |
|
$ write sys$output "Setting up TSA test directory..." |
|
$ call setup_dir |
|
$ |
|
$ write sys$output "Creating CA for TSA tests..." |
|
$ call create_ca |
|
$ |
|
$ write sys$output "Creating tsa_cert1.pem TSA server cert..." |
|
$ call create_tsa_cert 1 "tsa_cert" |
|
$ |
|
$ write sys$output "Creating tsa_cert2.pem non-TSA server cert..." |
|
$ call create_tsa_cert 2 "non_tsa_cert" |
|
$ |
|
$ write sys$output "Creating req1.req time stamp request for file testtsa..." |
|
$ call create_time_stamp_request1 |
|
$ |
|
$ write sys$output "Printing req1.req..." |
|
$ call print_request "req1.tsq" |
|
$ |
|
$ write sys$output "Generating valid response for req1.req..." |
|
$ call create_time_stamp_response "req1.tsq" "resp1.tsr" "tsa_config1" |
|
$ |
|
$ write sys$output "Printing response..." |
|
$ call print_response "resp1.tsr" |
|
$ |
|
$ write sys$output "Verifying valid response..." |
|
$ call verify_time_stamp_response "req1.tsq" "resp1.tsr" "[-]testtsa.com" |
|
$ |
|
$ write sys$output "Verifying valid token..." |
|
$ call verify_time_stamp_token "req1.tsq" "resp1.tsr" "[-]testtsa.com" |
|
$ |
|
$ ! The tests below are commented out, because invalid signer certificates |
|
$ ! can no longer be specified in the config file. |
|
$ |
|
$ ! write sys$output "Generating _invalid_ response for req1.req..." |
|
$ ! call create_time_stamp_response "req1.tsq" "resp1_bad.tsr" "tsa_config2" |
|
$ |
|
$ ! write sys$output "Printing response..." |
|
$ ! call print_response "resp1_bad.tsr" |
|
$ |
|
$ ! write sys$output "Verifying invalid response, it should fail..." |
|
$ ! call verify_time_stamp_response_fail "req1.tsq" "resp1_bad.tsr" |
|
$ |
|
$ write sys$output "Creating req2.req time stamp request for file testtsa..." |
|
$ call create_time_stamp_request2 |
|
$ |
|
$ write sys$output "Printing req2.req..." |
|
$ call print_request "req2.tsq" |
|
$ |
|
$ write sys$output "Generating valid response for req2.req..." |
|
$ call create_time_stamp_response "req2.tsq" "resp2.tsr" "tsa_config1" |
|
$ |
|
$ write sys$output "Checking '-token_in' and '-token_out' options with '-reply'..." |
|
$ call time_stamp_response_token_test "req2.tsq" "resp2.tsr" |
|
$ |
|
$ write sys$output "Printing response..." |
|
$ call print_response "resp2.tsr" |
|
$ |
|
$ write sys$output "Verifying valid response..." |
|
$ call verify_time_stamp_response "req2.tsq" "resp2.tsr" "[-]testtsa.com" |
|
$ |
|
$ write sys$output "Verifying response against wrong request, it should fail..." |
|
$ call verify_time_stamp_response_fail "req1.tsq" "resp2.tsr" |
|
$ |
|
$ write sys$output "Verifying response against wrong request, it should fail..." |
|
$ call verify_time_stamp_response_fail "req2.tsq" "resp1.tsr" |
|
$ |
|
$ write sys$output "Creating req3.req time stamp request for file CAtsa.cnf..." |
|
$ call create_time_stamp_request3 |
|
$ |
|
$ write sys$output "Printing req3.req..." |
|
$ call print_request "req3.tsq" |
|
$ |
|
$ write sys$output "Verifying response against wrong request, it should fail..." |
|
$ call verify_time_stamp_response_fail "req3.tsq" "resp1.tsr" |
|
$ |
|
$ write sys$output "Cleaning up..." |
|
$ call clean_up_dir |
|
$ |
|
$ set on |
|
$ |
|
$ exit
|
|
|