1#!/bin/sh
2
3#
4# A few very basic tests for the 'ts' time stamping authority command.
5#
6
7SH="/bin/sh"
8if test "$OSTYPE" = msdosdjgpp; then
9    PATH="../apps\;$PATH"
10else
11    PATH="../apps:$PATH"
12fi
13export SH PATH
14
15OPENSSL_CONF="../CAtsa.cnf"
16export OPENSSL_CONF
17# Because that's what ../apps/CA.sh really looks at
18SSLEAY_CONFIG="-config $OPENSSL_CONF"
19export SSLEAY_CONFIG
20
21OPENSSL="`pwd`/../util/opensslwrap.sh"
22export OPENSSL
23
24error () {
25
26    echo "TSA test failed!" >&2
27    exit 1
28}
29
30setup_dir () {
31
32    rm -rf tsa 2>/dev/null
33    mkdir tsa
34    cd ./tsa
35}
36
37clean_up_dir () {
38
39    cd ..
40    rm -rf tsa
41}
42
43create_ca () {
44
45    echo "Creating a new CA for the TSA tests..."
46    TSDNSECT=ts_ca_dn
47    export TSDNSECT   
48    ../../util/shlib_wrap.sh ../../apps/openssl req -new -x509 -nodes \
49	-out tsaca.pem -keyout tsacakey.pem
50    test $? != 0 && error
51}
52
53create_tsa_cert () {
54
55    INDEX=$1
56    export INDEX
57    EXT=$2
58    TSDNSECT=ts_cert_dn
59    export TSDNSECT   
60
61    ../../util/shlib_wrap.sh ../../apps/openssl req -new \
62	-out tsa_req${INDEX}.pem -keyout tsa_key${INDEX}.pem
63    test $? != 0 && error
64echo Using extension $EXT
65    ../../util/shlib_wrap.sh ../../apps/openssl x509 -req \
66	-in tsa_req${INDEX}.pem -out tsa_cert${INDEX}.pem \
67	-CA tsaca.pem -CAkey tsacakey.pem -CAcreateserial \
68	-extfile $OPENSSL_CONF -extensions $EXT
69    test $? != 0 && error
70}
71
72print_request () {
73
74    ../../util/shlib_wrap.sh ../../apps/openssl ts -query -in $1 -text
75}
76
77create_time_stamp_request1 () {
78
79    ../../util/shlib_wrap.sh ../../apps/openssl ts -query -data ../testtsa -policy tsa_policy1 -cert -out req1.tsq
80    test $? != 0 && error
81}
82
83create_time_stamp_request2 () {
84
85    ../../util/shlib_wrap.sh ../../apps/openssl ts -query -data ../testtsa -policy tsa_policy2 -no_nonce \
86	-out req2.tsq
87    test $? != 0 && error
88}
89
90create_time_stamp_request3 () {
91
92    ../../util/shlib_wrap.sh ../../apps/openssl ts -query -data ../CAtsa.cnf -no_nonce -out req3.tsq
93    test $? != 0 && error
94}
95
96print_response () {
97
98    ../../util/shlib_wrap.sh ../../apps/openssl ts -reply -in $1 -text
99    test $? != 0 && error
100}
101
102create_time_stamp_response () {
103
104    ../../util/shlib_wrap.sh ../../apps/openssl ts -reply -section $3 -queryfile $1 -out $2
105    test $? != 0 && error
106}
107
108time_stamp_response_token_test () {
109
110    RESPONSE2=$2.copy.tsr
111    TOKEN_DER=$2.token.der
112    ../../util/shlib_wrap.sh ../../apps/openssl ts -reply -in $2 -out $TOKEN_DER -token_out
113    test $? != 0 && error
114    ../../util/shlib_wrap.sh ../../apps/openssl ts -reply -in $TOKEN_DER -token_in -out $RESPONSE2
115    test $? != 0 && error
116    cmp $RESPONSE2 $2
117    test $? != 0 && error
118    ../../util/shlib_wrap.sh ../../apps/openssl ts -reply -in $2 -text -token_out
119    test $? != 0 && error
120    ../../util/shlib_wrap.sh ../../apps/openssl ts -reply -in $TOKEN_DER -token_in -text -token_out
121    test $? != 0 && error
122    ../../util/shlib_wrap.sh ../../apps/openssl ts -reply -queryfile $1 -text -token_out
123    test $? != 0 && error
124}
125
126verify_time_stamp_response () {
127
128    ../../util/shlib_wrap.sh ../../apps/openssl ts -verify -queryfile $1 -in $2 -CAfile tsaca.pem \
129	-untrusted tsa_cert1.pem
130    test $? != 0 && error
131    ../../util/shlib_wrap.sh ../../apps/openssl ts -verify -data $3 -in $2 -CAfile tsaca.pem \
132	-untrusted tsa_cert1.pem
133    test $? != 0 && error
134}
135
136verify_time_stamp_token () {
137
138    # create the token from the response first
139    ../../util/shlib_wrap.sh ../../apps/openssl ts -reply -in $2 -out $2.token -token_out
140    test $? != 0 && error
141    ../../util/shlib_wrap.sh ../../apps/openssl ts -verify -queryfile $1 -in $2.token -token_in \
142	-CAfile tsaca.pem -untrusted tsa_cert1.pem
143    test $? != 0 && error
144    ../../util/shlib_wrap.sh ../../apps/openssl ts -verify -data $3 -in $2.token -token_in \
145	-CAfile tsaca.pem -untrusted tsa_cert1.pem
146    test $? != 0 && error
147}
148
149verify_time_stamp_response_fail () {
150
151    ../../util/shlib_wrap.sh ../../apps/openssl ts -verify -queryfile $1 -in $2 -CAfile tsaca.pem \
152	-untrusted tsa_cert1.pem
153    # Checks if the verification failed, as it should have.
154    test $? = 0 && error
155    echo Ok
156}
157
158# main functions
159
160echo "Setting up TSA test directory..."
161setup_dir
162
163echo "Creating CA for TSA tests..."
164create_ca
165
166echo "Creating tsa_cert1.pem TSA server cert..."
167create_tsa_cert 1 tsa_cert
168
169echo "Creating tsa_cert2.pem non-TSA server cert..."
170create_tsa_cert 2 non_tsa_cert
171
172echo "Creating req1.req time stamp request for file testtsa..."
173create_time_stamp_request1
174
175echo "Printing req1.req..."
176print_request req1.tsq
177
178echo "Generating valid response for req1.req..."
179create_time_stamp_response req1.tsq resp1.tsr tsa_config1
180
181echo "Printing response..."
182print_response resp1.tsr
183
184echo "Verifying valid response..."
185verify_time_stamp_response req1.tsq resp1.tsr ../testtsa
186
187echo "Verifying valid token..."
188verify_time_stamp_token req1.tsq resp1.tsr ../testtsa
189
190# The tests below are commented out, because invalid signer certificates
191# can no longer be specified in the config file.
192
193# echo "Generating _invalid_ response for req1.req..."
194# create_time_stamp_response req1.tsq resp1_bad.tsr tsa_config2
195
196# echo "Printing response..."
197# print_response resp1_bad.tsr
198
199# echo "Verifying invalid response, it should fail..."
200# verify_time_stamp_response_fail req1.tsq resp1_bad.tsr
201
202echo "Creating req2.req time stamp request for file testtsa..."
203create_time_stamp_request2
204
205echo "Printing req2.req..."
206print_request req2.tsq
207
208echo "Generating valid response for req2.req..."
209create_time_stamp_response req2.tsq resp2.tsr tsa_config1
210
211echo "Checking '-token_in' and '-token_out' options with '-reply'..."
212time_stamp_response_token_test req2.tsq resp2.tsr
213
214echo "Printing response..."
215print_response resp2.tsr
216
217echo "Verifying valid response..."
218verify_time_stamp_response req2.tsq resp2.tsr ../testtsa
219
220echo "Verifying response against wrong request, it should fail..."
221verify_time_stamp_response_fail req1.tsq resp2.tsr
222
223echo "Verifying response against wrong request, it should fail..."
224verify_time_stamp_response_fail req2.tsq resp1.tsr
225
226echo "Creating req3.req time stamp request for file CAtsa.cnf..."
227create_time_stamp_request3
228
229echo "Printing req3.req..."
230print_request req3.tsq
231
232echo "Verifying response against wrong request, it should fail..."
233verify_time_stamp_response_fail req3.tsq resp1.tsr
234
235echo "Cleaning up..."
236clean_up_dir
237
238exit 0
239