appstest.sh revision 1.22
1#!/bin/sh 2# 3# $OpenBSD: appstest.sh,v 1.22 2019/06/27 09:34:06 inoguchi Exp $ 4# 5# Copyright (c) 2016 Kinichiro Inoguchi <inoguchi@openbsd.org> 6# 7# Permission to use, copy, modify, and distribute this software for any 8# purpose with or without fee is hereby granted, provided that the above 9# copyright notice and this permission notice appear in all copies. 10# 11# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 12# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 13# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 14# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 15# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19# 20# appstest.sh - test script for openssl command according to man OPENSSL(1) 21# 22# input : none 23# output : all files generated by this script go under $ssldir 24# 25 26function section_message { 27 echo "" 28 echo "#---------#---------#---------#---------#---------#---------#---------#--------" 29 echo "===" 30 echo "=== (Section) $1 `date +'%Y/%m/%d %H:%M:%S'`" 31 echo "===" 32} 33 34function start_message { 35 echo "" 36 echo "[TEST] $1" 37} 38 39function stop_s_server { 40 if [ ! -z "$s_server_pid" ] ; then 41 echo ":-| stop s_server [ $s_server_pid ]" 42 sleep 1 43 kill -TERM $s_server_pid 44 wait $s_server_pid 45 s_server_pid= 46 fi 47} 48 49function check_exit_status { 50 status=$1 51 if [ $status -ne 0 ] ; then 52 stop_s_server 53 echo ":-< error occurs, exit status = [ $status ]" 54 exit $status 55 else 56 echo ":-) success. " 57 fi 58} 59 60function usage { 61 echo "usage: appstest.sh [-iq]" 62} 63 64function test_usage_lists_others { 65 # === COMMAND USAGE === 66 section_message "COMMAND USAGE" 67 68 start_message "output usages of all commands." 69 70 cmds=`$openssl_bin list-standard-commands` 71 $openssl_bin -help 2>> $user1_dir/usages.out 72 for c in $cmds ; do 73 $openssl_bin $c -help 2>> $user1_dir/usages.out 74 done 75 76 start_message "check all list-* commands." 77 78 lists="" 79 lists="$lists list-standard-commands" 80 lists="$lists list-message-digest-commands list-message-digest-algorithms" 81 lists="$lists list-cipher-commands list-cipher-algorithms" 82 lists="$lists list-public-key-algorithms" 83 84 listsfile=$user1_dir/lists.out 85 86 for l in $lists ; do 87 echo "" >> $listsfile 88 echo "$l" >> $listsfile 89 $openssl_bin $l >> $listsfile 90 done 91 92 start_message "check interactive mode" 93 $openssl_bin <<__EOF__ 94help 95quit 96__EOF__ 97 check_exit_status $? 98 99 #---------#---------#---------#---------#---------#---------#--------- 100 101 # --- listing operations --- 102 section_message "listing operations" 103 104 start_message "ciphers" 105 $openssl_bin ciphers -V 106 check_exit_status $? 107 108 start_message "errstr" 109 $openssl_bin errstr 2606A074 110 check_exit_status $? 111 $openssl_bin errstr -stats 2606A074 > $user1_dir/errstr-stats.out 112 check_exit_status $? 113 114 #---------#---------#---------#---------#---------#---------#--------- 115 116 # --- random number etc. operations --- 117 section_message "random number etc. operations" 118 119 start_message "passwd" 120 121 pass="test-pass-1234" 122 123 echo $pass | $openssl_bin passwd -stdin -1 124 check_exit_status $? 125 126 echo $pass | $openssl_bin passwd -stdin -apr1 127 check_exit_status $? 128 129 echo $pass | $openssl_bin passwd -stdin -crypt 130 check_exit_status $? 131 132 start_message "prime" 133 134 $openssl_bin prime 1 135 check_exit_status $? 136 137 $openssl_bin prime 2 138 check_exit_status $? 139 140 $openssl_bin prime -bits 64 -checks 3 -generate -hex -safe 5 141 check_exit_status $? 142 143 start_message "rand" 144 145 $openssl_bin rand -base64 100 146 check_exit_status $? 147 148 $openssl_bin rand -hex 100 149 check_exit_status $? 150} 151 152function test_md { 153 # === MESSAGE DIGEST COMMANDS === 154 section_message "MESSAGE DIGEST COMMANDS" 155 156 start_message "dgst - See [MESSAGE DIGEST COMMANDS] section." 157 158 text="1234567890abcdefghijklmnopqrstuvwxyz" 159 dgstdat=$user1_dir/dgst.dat 160 echo $text > $dgstdat 161 hmac_key="test-hmac-key" 162 cmac_key="1234567890abcde1234567890abcde12" 163 dgstkey=$user1_dir/dgstkey.pem 164 dgstpass=test-dgst-pass 165 dgstpub=$user1_dir/dgstpub.pem 166 dgstsig=$user1_dir/dgst.sig 167 168 $openssl_bin genrsa -aes256 -passout pass:$dgstpass -out $dgstkey 169 check_exit_status $? 170 171 $openssl_bin pkey -in $dgstkey -passin pass:$dgstpass -pubout \ 172 -out $dgstpub 173 check_exit_status $? 174 175 digests=`$openssl_bin list-message-digest-commands` 176 177 for d in $digests ; do 178 179 echo -n "$d ... " 180 $openssl_bin dgst -$d -hex -out $dgstdat.$d $dgstdat 181 check_exit_status $? 182 183 echo -n "$d HMAC ... " 184 $openssl_bin dgst -$d -c -hmac $hmac_key -out $dgstdat.$d.hmac \ 185 $dgstdat 186 check_exit_status $? 187 188 echo -n "$d CMAC ... " 189 $openssl_bin dgst -$d -r -mac cmac -macopt cipher:aes-128-cbc \ 190 -macopt hexkey:$cmac_key -out $dgstdat.$d.cmac $dgstdat 191 check_exit_status $? 192 193 echo -n "$d sign ... " 194 $openssl_bin dgst -sign $dgstkey -keyform pem \ 195 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 196 -passin pass:$dgstpass -binary -out $dgstsig.$d $dgstdat 197 check_exit_status $? 198 199 echo -n "$d verify ... " 200 $openssl_bin dgst -verify $dgstpub \ 201 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 202 -signature $dgstsig.$d $dgstdat 203 check_exit_status $? 204 205 echo -n "$d prverify ... " 206 $openssl_bin dgst -prverify $dgstkey -passin pass:$dgstpass \ 207 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 208 -signature $dgstsig.$d $dgstdat 209 check_exit_status $? 210 done 211} 212 213function test_encoding_cipher { 214 # === ENCODING AND CIPHER COMMANDS === 215 section_message "ENCODING AND CIPHER COMMANDS" 216 217 start_message "enc - See [ENCODING AND CIPHER COMMANDS] section." 218 219 text="1234567890abcdefghijklmnopqrstuvwxyz" 220 encfile=$user1_dir/encfile.dat 221 echo $text > $encfile 222 pass="test-pass-1234" 223 224 ciphers=`$openssl_bin list-cipher-commands` 225 226 for c in $ciphers ; do 227 echo -n "$c ... encoding ... " 228 $openssl_bin enc -$c -e -base64 -pass pass:$pass \ 229 -in $encfile -out $encfile-$c.enc 230 check_exit_status $? 231 232 echo -n "decoding ... " 233 $openssl_bin enc -$c -d -base64 -pass pass:$pass \ 234 -in $encfile-$c.enc -out $encfile-$c.dec 235 check_exit_status $? 236 237 echo -n "cmp ... " 238 cmp $encfile $encfile-$c.dec 239 check_exit_status $? 240 done 241} 242 243function test_key { 244 # === various KEY operations === 245 section_message "various KEY operations" 246 247 key_pass=test-key-pass 248 249 # DH 250 251 start_message "gendh - Obsoleted by dhparam." 252 gendh2=$key_dir/gendh2.pem 253 $openssl_bin gendh -2 -out $gendh2 254 check_exit_status $? 255 256 start_message "dh - Obsoleted by dhparam." 257 $openssl_bin dh -in $gendh2 -check -text -out $gendh2.out 258 check_exit_status $? 259 260 if [ $no_long_tests = 0 ] ; then 261 start_message "dhparam - Superseded by genpkey and pkeyparam." 262 dhparam2=$key_dir/dhparam2.pem 263 $openssl_bin dhparam -2 -out $dhparam2 264 check_exit_status $? 265 $openssl_bin dhparam -in $dhparam2 -check -text \ 266 -out $dhparam2.out 267 check_exit_status $? 268 else 269 start_message "SKIPPING dhparam - Superseded by genpkey and pkeyparam. (quick mode)" 270 fi 271 272 # DSA 273 274 start_message "dsaparam - Superseded by genpkey and pkeyparam." 275 dsaparam512=$key_dir/dsaparam512.pem 276 $openssl_bin dsaparam -genkey -out $dsaparam512 512 277 check_exit_status $? 278 279 start_message "dsa" 280 $openssl_bin dsa -in $dsaparam512 -text -out $dsaparam512.out 281 check_exit_status $? 282 283 start_message "gendsa - Superseded by genpkey and pkey." 284 gendsa_des3=$key_dir/gendsa_des3.pem 285 $openssl_bin gendsa -des3 -out $gendsa_des3 \ 286 -passout pass:$key_pass $dsaparam512 287 check_exit_status $? 288 289 # RSA 290 291 start_message "genrsa - Superseded by genpkey." 292 genrsa_aes256=$key_dir/genrsa_aes256.pem 293 $openssl_bin genrsa -f4 -aes256 -out $genrsa_aes256 \ 294 -passout pass:$key_pass 2048 295 check_exit_status $? 296 297 start_message "rsa" 298 $openssl_bin rsa -in $genrsa_aes256 -passin pass:$key_pass \ 299 -check -text -out $genrsa_aes256.out 300 check_exit_status $? 301 302 start_message "rsautl - Superseded by pkeyutl." 303 rsautldat=$key_dir/rsautl.dat 304 rsautlsig=$key_dir/rsautl.sig 305 echo "abcdefghijklmnopqrstuvwxyz1234567890" > $rsautldat 306 307 $openssl_bin rsautl -sign -in $rsautldat -inkey $genrsa_aes256 \ 308 -passin pass:$key_pass -out $rsautlsig 309 check_exit_status $? 310 311 $openssl_bin rsautl -verify -in $rsautlsig -inkey $genrsa_aes256 \ 312 -passin pass:$key_pass 313 check_exit_status $? 314 315 # EC 316 317 start_message "ecparam -list-curves" 318 $openssl_bin ecparam -list_curves 319 check_exit_status $? 320 321 # get all EC curves 322 ec_curves=`$openssl_bin ecparam -list_curves | grep ':' | cut -d ':' -f 1` 323 324 start_message "ecparam and ec" 325 326 for curve in $ec_curves ; 327 do 328 ecparam=$key_dir/ecparam_$curve.pem 329 330 echo -n "ec - $curve ... ecparam ... " 331 $openssl_bin ecparam -out $ecparam -name $curve -genkey \ 332 -param_enc explicit -conv_form compressed -C 333 check_exit_status $? 334 335 echo -n "ec ... " 336 $openssl_bin ec -in $ecparam -text \ 337 -out $ecparam.out 2> /dev/null 338 check_exit_status $? 339 done 340 341 # PKEY 342 343 start_message "genpkey" 344 345 # DH by GENPKEY 346 347 genpkey_dh_param=$key_dir/genpkey_dh_param.pem 348 $openssl_bin genpkey -genparam -algorithm DH -out $genpkey_dh_param \ 349 -pkeyopt dh_paramgen_prime_len:1024 350 check_exit_status $? 351 352 genpkey_dh=$key_dir/genpkey_dh.pem 353 $openssl_bin genpkey -paramfile $genpkey_dh_param -out $genpkey_dh 354 check_exit_status $? 355 356 # DSA by GENPKEY 357 358 genpkey_dsa_param=$key_dir/genpkey_dsa_param.pem 359 $openssl_bin genpkey -genparam -algorithm DSA -out $genpkey_dsa_param \ 360 -pkeyopt dsa_paramgen_bits:1024 361 check_exit_status $? 362 363 genpkey_dsa=$key_dir/genpkey_dsa.pem 364 $openssl_bin genpkey -paramfile $genpkey_dsa_param -out $genpkey_dsa 365 check_exit_status $? 366 367 # RSA by GENPKEY 368 369 genpkey_rsa=$key_dir/genpkey_rsa.pem 370 $openssl_bin genpkey -algorithm RSA -out $genpkey_rsa \ 371 -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 372 check_exit_status $? 373 374 # EC by GENPKEY 375 376 genpkey_ec_param=$key_dir/genpkey_ec_param.pem 377 $openssl_bin genpkey -genparam -algorithm EC -out $genpkey_ec_param \ 378 -pkeyopt ec_paramgen_curve:secp384r1 379 check_exit_status $? 380 381 genpkey_ec=$key_dir/genpkey_ec.pem 382 $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec 383 check_exit_status $? 384 385 genpkey_ec_2=$key_dir/genpkey_ec_2.pem 386 $openssl_bin genpkey -paramfile $genpkey_ec_param -out $genpkey_ec_2 387 check_exit_status $? 388 389 start_message "pkeyparam" 390 391 $openssl_bin pkeyparam -in $genpkey_dh_param -text \ 392 -out $genpkey_dh_param.out 393 check_exit_status $? 394 395 $openssl_bin pkeyparam -in $genpkey_dsa_param -text \ 396 -out $genpkey_dsa_param.out 397 check_exit_status $? 398 399 $openssl_bin pkeyparam -in $genpkey_ec_param -text \ 400 -out $genpkey_ec_param.out 401 check_exit_status $? 402 403 start_message "pkey" 404 405 $openssl_bin pkey -in $genpkey_dh -pubout -out $genpkey_dh.pub \ 406 -text_pub 407 check_exit_status $? 408 409 $openssl_bin pkey -in $genpkey_dsa -pubout -out $genpkey_dsa.pub \ 410 -text_pub 411 check_exit_status $? 412 413 $openssl_bin pkey -in $genpkey_rsa -pubout -out $genpkey_rsa.pub \ 414 -text_pub 415 check_exit_status $? 416 417 $openssl_bin pkey -in $genpkey_ec -pubout -out $genpkey_ec.pub \ 418 -text_pub 419 check_exit_status $? 420 421 $openssl_bin pkey -in $genpkey_ec_2 -pubout -out $genpkey_ec_2.pub \ 422 -text_pub 423 check_exit_status $? 424 425 start_message "pkeyutl" 426 427 pkeyutldat=$key_dir/pkeyutl.dat 428 pkeyutlsig=$key_dir/pkeyutl.sig 429 echo "abcdefghijklmnopqrstuvwxyz1234567890" > $pkeyutldat 430 431 $openssl_bin pkeyutl -sign -in $pkeyutldat -inkey $genpkey_rsa \ 432 -out $pkeyutlsig 433 check_exit_status $? 434 435 $openssl_bin pkeyutl -verify -in $pkeyutldat -sigfile $pkeyutlsig \ 436 -inkey $genpkey_rsa 437 check_exit_status $? 438 439 $openssl_bin pkeyutl -verifyrecover -in $pkeyutlsig -inkey $genpkey_rsa 440 check_exit_status $? 441 442 pkeyutlenc=$key_dir/pkeyutl.enc 443 pkeyutldec=$key_dir/pkeyutl.dec 444 445 $openssl_bin pkeyutl -encrypt -in $pkeyutldat \ 446 -pubin -inkey $genpkey_rsa.pub -out $pkeyutlenc 447 check_exit_status $? 448 449 $openssl_bin pkeyutl -decrypt -in $pkeyutlenc \ 450 -inkey $genpkey_rsa -out $pkeyutldec 451 check_exit_status $? 452 453 diff $pkeyutldat $pkeyutldec 454 check_exit_status $? 455 456 pkeyutlsc1=$key_dir/pkeyutl.sc1 457 pkeyutlsc2=$key_dir/pkeyutl.sc2 458 459 $openssl_bin pkeyutl -derive -inkey $genpkey_ec \ 460 -peerkey $genpkey_ec_2.pub -out $pkeyutlsc1 -hexdump 461 check_exit_status $? 462 463 $openssl_bin pkeyutl -derive -inkey $genpkey_ec_2 \ 464 -peerkey $genpkey_ec.pub -out $pkeyutlsc2 -hexdump 465 check_exit_status $? 466 467 diff $pkeyutlsc1 $pkeyutlsc2 468 check_exit_status $? 469} 470 471function test_pki { 472 section_message "setup local CA" 473 474 # 475 # prepare test openssl.cnf 476 # 477 478 cat << __EOF__ > $ssldir/openssl.cnf 479oid_section = new_oids 480[ new_oids ] 481tsa_policy1 = 1.2.3.4.1 482tsa_policy2 = 1.2.3.4.5.6 483tsa_policy3 = 1.2.3.4.5.7 484[ ca ] 485default_ca = CA_default 486[ CA_default ] 487dir = ./$ca_dir 488crl_dir = \$dir/crl 489database = \$dir/index.txt 490new_certs_dir = \$dir/newcerts 491serial = \$dir/serial 492crlnumber = \$dir/crlnumber 493default_days = 1 494default_md = default 495policy = policy_match 496[ policy_match ] 497countryName = match 498stateOrProvinceName = match 499organizationName = match 500organizationalUnitName = optional 501commonName = supplied 502emailAddress = optional 503[ req ] 504distinguished_name = req_distinguished_name 505[ req_distinguished_name ] 506countryName = Country Name 507countryName_default = JP 508countryName_min = 2 509countryName_max = 2 510stateOrProvinceName = State or Province Name 511stateOrProvinceName_default = Tokyo 512organizationName = Organization Name 513organizationName_default = TEST_DUMMY_COMPANY 514commonName = Common Name 515[ tsa ] 516default_tsa = tsa_config1 517[ tsa_config1 ] 518dir = ./$tsa_dir 519serial = \$dir/serial 520crypto_device = builtin 521digests = sha1, sha256, sha384, sha512 522default_policy = tsa_policy1 523other_policies = tsa_policy2, tsa_policy3 524[ tsa_ext ] 525keyUsage = critical,nonRepudiation 526extendedKeyUsage = critical,timeStamping 527[ ocsp_ext ] 528basicConstraints = CA:FALSE 529keyUsage = nonRepudiation,digitalSignature,keyEncipherment 530extendedKeyUsage = OCSPSigning 531__EOF__ 532 533 #---------#---------#---------#---------#---------#---------#--------- 534 535 # 536 # setup test CA 537 # 538 539 mkdir -p $ca_dir 540 mkdir -p $tsa_dir 541 mkdir -p $ocsp_dir 542 mkdir -p $server_dir 543 544 mkdir -p $ca_dir/certs 545 mkdir -p $ca_dir/private 546 mkdir -p $ca_dir/crl 547 mkdir -p $ca_dir/newcerts 548 chmod 700 $ca_dir/private 549 echo "01" > $ca_dir/serial 550 touch $ca_dir/index.txt 551 touch $ca_dir/crlnumber 552 echo "01" > $ca_dir/crlnumber 553 554 # 555 # setup test TSA 556 # 557 mkdir -p $tsa_dir/private 558 chmod 700 $tsa_dir/private 559 echo "01" > $tsa_dir/serial 560 touch $tsa_dir/index.txt 561 562 # 563 # setup test OCSP 564 # 565 mkdir -p $ocsp_dir/private 566 chmod 700 $ocsp_dir/private 567 568 #---------#---------#---------#---------#---------#---------#--------- 569 570 # --- CA initiate (generate CA key and cert) --- 571 572 start_message "req ... generate CA key and self signed cert" 573 574 ca_cert=$ca_dir/ca_cert.pem 575 ca_key=$ca_dir/private/ca_key.pem ca_pass=test-ca-pass 576 577 if [ $mingw = 0 ] ; then 578 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testCA.test_dummy.com/' 579 else 580 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testCA.test_dummy.com\' 581 fi 582 583 $openssl_bin req -new -x509 -batch -newkey rsa:2048 \ 584 -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 \ 585 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 586 -config $ssldir/openssl.cnf -verbose \ 587 -subj $subj -days 1 -set_serial 1 -multivalue-rdn \ 588 -keyout $ca_key -passout pass:$ca_pass \ 589 -out $ca_cert -outform pem 590 check_exit_status $? 591 592 #---------#---------#---------#---------#---------#---------#--------- 593 594 # --- TSA initiate (generate TSA key and cert) --- 595 596 start_message "req ... generate TSA key and cert" 597 598 # generate CSR for TSA 599 600 tsa_csr=$tsa_dir/tsa_csr.pem 601 tsa_key=$tsa_dir/private/tsa_key.pem 602 tsa_pass=test-tsa-pass 603 604 if [ $mingw = 0 ] ; then 605 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testTSA.test_dummy.com/' 606 else 607 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testTSA.test_dummy.com\' 608 fi 609 610 $openssl_bin req -new -keyout $tsa_key -out $tsa_csr \ 611 -passout pass:$tsa_pass -subj $subj -asn1-kludge 612 check_exit_status $? 613 614 start_message "ca ... sign by CA with TSA extensions" 615 616 tsa_cert=$tsa_dir/tsa_cert.pem 617 618 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ 619 -key $ca_pass -config $ssldir/openssl.cnf -create_serial \ 620 -policy policy_match -days 1 -md sha256 -extensions tsa_ext \ 621 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:32 \ 622 -multivalue-rdn -preserveDN -noemailDN \ 623 -in $tsa_csr -outdir $tsa_dir -out $tsa_cert -verbose -notext 624 check_exit_status $? 625 626 #---------#---------#---------#---------#---------#---------#--------- 627 628 # --- OCSP initiate (generate OCSP key and cert) --- 629 630 start_message "req ... generate OCSP key and cert" 631 632 # generate CSR for OCSP 633 634 ocsp_csr=$ocsp_dir/ocsp_csr.pem 635 ocsp_key=$ocsp_dir/private/ocsp_key.pem 636 637 if [ $mingw = 0 ] ; then 638 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=testOCSP.test_dummy.com/' 639 else 640 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=testOCSP.test_dummy.com\' 641 fi 642 643 $openssl_bin req -new -keyout $ocsp_key -nodes -out $ocsp_csr \ 644 -subj $subj -no-asn1-kludge 645 check_exit_status $? 646 647 start_message "ca ... sign by CA with OCSP extensions" 648 649 ocsp_cert=$ocsp_dir/ocsp_cert.pem 650 651 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -keyform pem \ 652 -key $ca_pass -out $ocsp_cert -extensions ocsp_ext \ 653 -startdate `date -u '+%y%m%d%H%M%SZ'` -enddate 491223235959Z \ 654 -subj $subj -infiles $ocsp_csr 655 check_exit_status $? 656 657 #---------#---------#---------#---------#---------#---------#--------- 658 659 # --- server-admin operations (generate server key and csr) --- 660 section_message "server-admin operations (generate server key and csr)" 661 662 server_key=$server_dir/server_key.pem 663 server_csr=$server_dir/server_csr.pem 664 server_pass=test-server-pass 665 666 if [ $mingw = 0 ] ; then 667 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=localhost.test_dummy.com/' 668 else 669 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=localhost.test_dummy.com\' 670 fi 671 672 start_message "genrsa ... generate server key#1" 673 674 $openssl_bin genrsa -aes256 -passout pass:$server_pass -out $server_key 675 check_exit_status $? 676 677 start_message "req ... generate server csr#1" 678 679 $openssl_bin req -new -subj $subj -sha256 \ 680 -key $server_key -keyform pem -passin pass:$server_pass \ 681 -out $server_csr -outform pem 682 check_exit_status $? 683 684 start_message "req ... verify server csr#1" 685 686 $openssl_bin req -verify -in $server_csr -inform pem \ 687 -newhdr -noout -pubkey -subject -modulus -text \ 688 -nameopt multiline -reqopt compatible \ 689 -out $server_csr.verify.out 690 check_exit_status $? 691 692 start_message "req ... generate server csr#2 (interactive mode)" 693 694 revoke_key=$server_dir/revoke_key.pem 695 revoke_csr=$server_dir/revoke_csr.pem 696 revoke_pass=test-revoke-pass 697 698 $openssl_bin req -new -keyout $revoke_key -out $revoke_csr \ 699 -passout pass:$revoke_pass <<__EOF__ 700JP 701Tokyo 702TEST_DUMMY_COMPANY 703revoke.test_dummy.com 704__EOF__ 705 check_exit_status $? 706 707 #---------#---------#---------#---------#---------#---------#--------- 708 709 # --- CA operations (issue cert for server) --- 710 section_message "CA operations (issue cert for server)" 711 712 start_message "ca ... issue cert for server csr#1" 713 714 server_cert=$server_dir/server_cert.pem 715 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 716 -in $server_csr -out $server_cert 717 check_exit_status $? 718 719 start_message "x509 ... issue cert for server csr#2" 720 721 revoke_cert=$server_dir/revoke_cert.pem 722 $openssl_bin x509 -req -in $revoke_csr -CA $ca_cert -CAform pem \ 723 -CAkey $ca_key -CAkeyform pem \ 724 -CAserial $ca_dir/serial -set_serial 10 \ 725 -passin pass:$ca_pass -CAcreateserial -out $revoke_cert 726 check_exit_status $? 727 728 #---------#---------#---------#---------#---------#---------#--------- 729 730 # --- CA operations (revoke cert and generate crl) --- 731 section_message "CA operations (revoke cert and generate crl)" 732 733 start_message "ca ... revoke server cert#2" 734 crl_file=$ca_dir/crl.pem 735 $openssl_bin ca -gencrl -out $crl_file -revoke $revoke_cert \ 736 -config $ssldir/openssl.cnf -name CA_default \ 737 -crldays 30 -crlhours 12 -crlsec 30 -updatedb \ 738 -crl_reason unspecified -crl_hold 1.2.840.10040.2.2 \ 739 -crl_compromise `date -u '+%Y%m%d%H%M%SZ'` \ 740 -crl_CA_compromise `date -u '+%Y%m%d%H%M%SZ'` \ 741 -keyfile $ca_key -passin pass:$ca_pass -cert $ca_cert 742 check_exit_status $? 743 744 start_message "ca ... show certificate status by serial number" 745 $openssl_bin ca -config $ssldir/openssl.cnf -status 1 746 747 start_message "crl ... CA generates CRL" 748 $openssl_bin crl -in $crl_file -fingerprint 749 check_exit_status $? 750 751 crl_p7=$ca_dir/crl.p7 752 start_message "crl2pkcs7 ... convert CRL to pkcs7" 753 $openssl_bin crl2pkcs7 -in $crl_file -certfile $ca_cert -out $crl_p7 754 check_exit_status $? 755 756 #---------#---------#---------#---------#---------#---------#--------- 757 758 # --- server-admin operations (check csr, verify cert, certhash) --- 759 section_message "server-admin operations (check csr, verify cert, certhash)" 760 761 start_message "asn1parse ... parse server csr#1" 762 $openssl_bin asn1parse -in $server_csr -i -dlimit 100 -length 1000 \ 763 -strparse 01 > $server_csr.asn1parse.out 764 check_exit_status $? 765 766 start_message "verify ... server cert#1" 767 $openssl_bin verify -verbose -CAfile $ca_cert -CRLfile $crl_file \ 768 -crl_check -issuer_checks -purpose sslserver $server_cert 769 check_exit_status $? 770 771 start_message "x509 ... get detail info about server cert#1" 772 $openssl_bin x509 -in $server_cert -text -C -dates -startdate -enddate \ 773 -fingerprint -issuer -issuer_hash -issuer_hash_old \ 774 -subject -hash -subject_hash -subject_hash_old -ocsp_uri \ 775 -ocspid -modulus -pubkey -serial -email -noout -trustout \ 776 -alias -clrtrust -clrreject -next_serial -checkend 3600 \ 777 -nameopt multiline -certopt compatible > $server_cert.x509.out 778 check_exit_status $? 779 780 if [ $mingw = 0 ] ; then 781 start_message "certhash" 782 $openssl_bin certhash -v $server_dir 783 check_exit_status $? 784 fi 785 786 # self signed 787 start_message "x509 ... generate self signed server cert" 788 server_self_cert=$server_dir/server_self_cert.pem 789 $openssl_bin x509 -in $server_cert -signkey $server_key -keyform pem \ 790 -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:8 \ 791 -passin pass:$server_pass -out $server_self_cert -days 1 792 check_exit_status $? 793 794 #---------#---------#---------#---------#---------#---------#--------- 795 796 # --- Netscape SPKAC operations --- 797 section_message "Netscape SPKAC operations" 798 799 # server-admin generates SPKAC 800 801 start_message "spkac" 802 spkacfile=$server_dir/spkac.file 803 804 $openssl_bin spkac -key $genpkey_rsa -challenge hello -out $spkacfile 805 check_exit_status $? 806 807 $openssl_bin spkac -in $spkacfile -verify -out $spkacfile.out 808 check_exit_status $? 809 810 spkacreq=$server_dir/spkac.req 811 cat << __EOF__ > $spkacreq 812countryName = JP 813stateOrProvinceName = Tokyo 814organizationName = TEST_DUMMY_COMPANY 815commonName = spkac.test_dummy.com 816__EOF__ 817 cat $spkacfile >> $spkacreq 818 819 # CA signs SPKAC 820 start_message "ca ... CA signs SPKAC csr" 821 spkaccert=$server_dir/spkac.cert 822 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 823 -spkac $spkacreq -out $spkaccert 824 check_exit_status $? 825 826 start_message "x509 ... convert DER format SPKAC cert to PEM" 827 spkacpem=$server_dir/spkac.pem 828 $openssl_bin x509 -in $spkaccert -inform DER -out $spkacpem -outform PEM 829 check_exit_status $? 830 831 # server-admin cert verify 832 833 start_message "nseq" 834 $openssl_bin nseq -in $spkacpem -toseq -out $spkacpem.nseq 835 check_exit_status $? 836 837 #---------#---------#---------#---------#---------#---------#--------- 838 839 # --- user1 operations (generate user1 key and csr) --- 840 section_message "user1 operations (generate user1 key and csr)" 841 842 # trust 843 start_message "x509 ... trust testCA cert" 844 user1_trust=$user1_dir/user1_trust_ca.pem 845 $openssl_bin x509 -in $ca_cert -addtrust clientAuth \ 846 -setalias "trusted testCA" -purpose -out $user1_trust 847 check_exit_status $? 848 849 start_message "req ... generate private key and csr for user1" 850 851 user1_key=$user1_dir/user1_key.pem 852 user1_csr=$user1_dir/user1_csr.pem 853 user1_pass=test-user1-pass 854 855 if [ $mingw = 0 ] ; then 856 subj='/C=JP/ST=Tokyo/O=TEST_DUMMY_COMPANY/CN=user1.test_dummy.com/' 857 else 858 subj='//C=JP\ST=Tokyo\O=TEST_DUMMY_COMPANY\CN=user1.test_dummy.com\' 859 fi 860 861 $openssl_bin req -new -keyout $user1_key -out $user1_csr \ 862 -passout pass:$user1_pass -subj $subj 863 check_exit_status $? 864 865 #---------#---------#---------#---------#---------#---------#--------- 866 867 # --- CA operations (issue cert for user1) --- 868 section_message "CA operations (issue cert for user1)" 869 870 start_message "ca ... issue cert for user1" 871 872 user1_cert=$user1_dir/user1_cert.pem 873 $openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \ 874 -in $user1_csr -out $user1_cert 875 check_exit_status $? 876} 877 878function test_tsa { 879 # --- TSA operations --- 880 section_message "TSA operations" 881 882 tsa_dat=$user1_dir/tsa.dat 883 cat << __EOF__ > $tsa_dat 884Hello Bob, 885Sincerely yours 886Alice 887__EOF__ 888 889 # Query 890 start_message "ts ... create time stamp request" 891 892 tsa_tsq=$user1_dir/tsa.tsq 893 894 $openssl_bin ts -query -sha1 -data $tsa_dat -no_nonce -out $tsa_tsq 895 check_exit_status $? 896 897 start_message "ts ... print time stamp request" 898 899 $openssl_bin ts -query -in $tsa_tsq -text 900 check_exit_status $? 901 902 # Reply 903 start_message "ts ... create time stamp response for a request" 904 905 tsa_tsr=$user1_dir/tsa.tsr 906 907 $openssl_bin ts -reply -queryfile $tsa_tsq -inkey $tsa_key \ 908 -passin pass:$tsa_pass -signer $tsa_cert -chain $ca_cert \ 909 -config $ssldir/openssl.cnf -section tsa_config1 -cert \ 910 -policy 1.3.6.1.4.1.4146.2.3 -out $tsa_tsr 911 check_exit_status $? 912 913 # Verify 914 start_message "ts ... verify time stamp response" 915 916 $openssl_bin ts -verify -queryfile $tsa_tsq -in $tsa_tsr \ 917 -CAfile $ca_cert -untrusted $tsa_cert 918 check_exit_status $? 919} 920 921function test_smime { 922 # --- S/MIME operations --- 923 section_message "S/MIME operations" 924 925 smime_txt=$user1_dir/smime.txt 926 smime_enc=$user1_dir/smime.enc 927 smime_sig=$user1_dir/smime.sig 928 smime_p7o=$user1_dir/smime.p7o 929 smime_sgr=$user1_dir/smime.sgr 930 smime_ver=$user1_dir/smime.ver 931 smime_dec=$user1_dir/smime.dec 932 933 cat << __EOF__ > $smime_txt 934Hello Bob, 935Sincerely yours 936Alice 937__EOF__ 938 939 # encrypt 940 start_message "smime ... encrypt message" 941 942 $openssl_bin smime -encrypt -aes256 -binary -in $smime_txt \ 943 -out $smime_enc $server_cert 944 check_exit_status $? 945 946 # sign 947 start_message "smime ... sign to message" 948 949 $openssl_bin smime -sign -in $smime_enc -text -inform smime \ 950 -out $smime_sig -outform smime \ 951 -signer $user1_cert -inkey $user1_key -keyform pem \ 952 -passin pass:$user1_pass -md sha256 \ 953 -from user1@test_dummy.com -to server@test_dummy.com \ 954 -subject "test openssl smime" 955 check_exit_status $? 956 957 # pk7out 958 start_message "smime ... pk7out from message" 959 960 $openssl_bin smime -pk7out -in $smime_sig -out $smime_p7o 961 check_exit_status $? 962 963 # verify 964 start_message "smime ... verify message" 965 966 $openssl_bin smime -verify -in $smime_sig \ 967 -CAfile $ca_cert -certfile $user1_cert -nointern \ 968 -check_ss_sig -issuer_checks -policy_check -x509_strict \ 969 -signer $smime_sgr -text -out $smime_ver 970 check_exit_status $? 971 972 # decrypt 973 start_message "smime ... decrypt message" 974 975 $openssl_bin smime -decrypt -in $smime_ver -out $smime_dec \ 976 -recip $server_cert -inkey $server_key -passin pass:$server_pass 977 check_exit_status $? 978 979 diff $smime_dec $smime_txt 980 check_exit_status $? 981} 982 983function test_ocsp { 984 # --- OCSP operations --- 985 section_message "OCSP operations" 986 987 # get key without pass 988 user1_key_nopass=$user1_dir/user1_key_nopass.pem 989 $openssl_bin pkey -in $user1_key -passin pass:$user1_pass \ 990 -out $user1_key_nopass 991 check_exit_status $? 992 993 # request 994 start_message "ocsp ... create OCSP request" 995 996 ocsp_req=$user1_dir/ocsp_req.der 997 $openssl_bin ocsp -issuer $ca_cert -cert $server_cert \ 998 -cert $revoke_cert -serial 1 -nonce -no_certs -CAfile $ca_cert \ 999 -signer $user1_cert -signkey $user1_key_nopass \ 1000 -sign_other $user1_cert -sha256 \ 1001 -reqout $ocsp_req -req_text -out $ocsp_req.out 1002 check_exit_status $? 1003 1004 # response 1005 start_message "ocsp ... create OCPS response for a request" 1006 1007 ocsp_res=$user1_dir/ocsp_res.der 1008 $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ 1009 -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ 1010 -reqin $ocsp_req -rother $ocsp_cert -resp_no_certs -noverify \ 1011 -nmin 60 -validity_period 300 -status_age 300 \ 1012 -respout $ocsp_res -resp_text -out $ocsp_res.out 1013 check_exit_status $? 1014 1015 # ocsp server 1016 start_message "ocsp ... start OCSP server in background" 1017 1018 ocsp_port=8888 1019 1020 ocsp_svr_log=$user1_dir/ocsp_svr.log 1021 $openssl_bin ocsp -index $ca_dir/index.txt -CA $ca_cert \ 1022 -CAfile $ca_cert -rsigner $ocsp_cert -rkey $ocsp_key \ 1023 -host localhost -port $ocsp_port -path / -ndays 1 -nrequest 1 \ 1024 -resp_key_id -text -out $ocsp_svr_log & 1025 check_exit_status $? 1026 ocsp_svr_pid=$! 1027 echo "ocsp server pid = [ $ocsp_svr_pid ]" 1028 sleep 1 1029 1030 # send query to ocsp server 1031 start_message "ocsp ... send OCSP request to server" 1032 1033 ocsp_qry=$user1_dir/ocsp_qry.der 1034 $openssl_bin ocsp -issuer $ca_cert -cert $server_cert \ 1035 -cert $revoke_cert -CAfile $ca_cert -no_nonce \ 1036 -url http://localhost:$ocsp_port -timeout 10 -text \ 1037 -header Host localhost \ 1038 -respout $ocsp_qry -out $ocsp_qry.out 1039 check_exit_status $? 1040 1041 # verify response from server 1042 start_message "ocsp ... verify OCSP response from server" 1043 1044 $openssl_bin ocsp -respin $ocsp_qry -CAfile $ca_cert \ 1045 -ignore_err -no_signature_verify -no_cert_verify -no_chain \ 1046 -no_cert_checks -no_explicit -trust_other -no_intern \ 1047 -verify_other $ocsp_cert -VAfile $ocsp_cert 1048 check_exit_status $? 1049} 1050 1051function test_pkcs { 1052 # --- PKCS operations --- 1053 section_message "PKCS operations" 1054 1055 pkcs_pass=test-pkcs-pass 1056 1057 start_message "pkcs7 ... output certs in crl(pkcs7)" 1058 $openssl_bin pkcs7 -in $crl_p7 -print_certs -text -out $crl_p7.out 1059 check_exit_status $? 1060 1061 start_message "pkcs8 ... convert key to pkcs8" 1062 $openssl_bin pkcs8 -in $user1_key -topk8 -out $user1_key.p8 \ 1063 -passin pass:$user1_pass -passout pass:$user1_pass \ 1064 -v1 pbeWithSHA1AndDES-CBC -v2 des3 1065 check_exit_status $? 1066 1067 start_message "pkcs8 ... convert pkcs8 to key in DER format" 1068 $openssl_bin pkcs8 -in $user1_key.p8 -passin pass:$user1_pass \ 1069 -outform DER -out $user1_key.p8.der 1070 check_exit_status $? 1071 1072 start_message "pkcs12 ... create" 1073 $openssl_bin pkcs12 -export -in $server_cert -inkey $server_key \ 1074 -passin pass:$server_pass -certfile $ca_cert -CAfile $ca_cert \ 1075 -caname "caname_server_p12" \ 1076 -certpbe AES-256-CBC -keypbe AES-256-CBC -chain \ 1077 -name "name_server_p12" -des3 -maciter -macalg sha256 \ 1078 -CSP "csp_server_p12" -LMK -keyex \ 1079 -passout pass:$pkcs_pass -out $server_cert.p12 1080 check_exit_status $? 1081 1082 start_message "pkcs12 ... verify" 1083 $openssl_bin pkcs12 -in $server_cert.p12 -passin pass:$pkcs_pass -info \ 1084 -noout 1085 check_exit_status $? 1086 1087 start_message "pkcs12 ... private key to PEM without encryption" 1088 $openssl_bin pkcs12 -in $server_cert.p12 -password pass:$pkcs_pass \ 1089 -nocerts -nomacver -nodes -out $server_cert.p12.pem 1090 check_exit_status $? 1091} 1092 1093function test_server_client { 1094 # --- client/server operations (TLS) --- 1095 section_message "client/server operations (TLS)" 1096 1097 s_id="$1" 1098 c_id="$2" 1099 sc="$1$2" 1100 1101 test_pause_sec=0.2 1102 1103 if [ $s_id = "0" ] ; then 1104 s_bin=$openssl_bin 1105 else 1106 s_bin=$other_openssl_bin 1107 fi 1108 1109 if [ $c_id = "0" ] ; then 1110 c_bin=$openssl_bin 1111 else 1112 c_bin=$other_openssl_bin 1113 fi 1114 1115 echo "s_server is [`$s_bin version`]" 1116 echo "s_client is [`$c_bin version`]" 1117 1118 host="localhost" 1119 port=4433 1120 sess_dat=$user1_dir/s_client_${sc}_sess.dat 1121 s_server_out=$server_dir/s_server_${sc}_tls.out 1122 1123 $s_bin version | grep 'OpenSSL 1.1.1' > /dev/null 1124 if [ $? -eq 0 ] ; then 1125 extra_opts="-4" 1126 else 1127 extra_opts="" 1128 fi 1129 1130 start_message "s_server ... start TLS/SSL test server" 1131 $s_bin s_server -accept $port -CAfile $ca_cert \ 1132 -cert $server_cert -key $server_key -pass pass:$server_pass \ 1133 -context "appstest.sh" -id_prefix "APPSTEST.SH" -crl_check \ 1134 -nextprotoneg "http/1.1,spdy/3" -alpn "http/1.1,spdy/3" -www \ 1135 -cipher ALL $extra_opts \ 1136 -msg -tlsextdebug > $s_server_out 2>&1 & 1137 check_exit_status $? 1138 s_server_pid=$! 1139 echo "s_server pid = [ $s_server_pid ]" 1140 sleep 1 1141 1142 # protocol = TLSv1 1143 1144 s_client_out=$user1_dir/s_client_${sc}_tls_1_0.out 1145 1146 start_message "s_client ... connect to TLS/SSL test server by TLSv1" 1147 sleep $test_pause_sec 1148 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1149 -tls1 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1150 check_exit_status $? 1151 1152 grep 'Protocol : TLSv1$' $s_client_out > /dev/null 1153 check_exit_status $? 1154 1155 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1156 check_exit_status $? 1157 1158 # protocol = TLSv1.1 1159 1160 s_client_out=$user1_dir/s_client_${sc}_tls_1_1.out 1161 1162 start_message "s_client ... connect to TLS/SSL test server by TLSv1.1" 1163 sleep $test_pause_sec 1164 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1165 -tls1_1 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1166 check_exit_status $? 1167 1168 grep 'Protocol : TLSv1\.1$' $s_client_out > /dev/null 1169 check_exit_status $? 1170 1171 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1172 check_exit_status $? 1173 1174 # protocol = TLSv1.2 1175 1176 s_client_out=$user1_dir/s_client_${sc}_tls_1_2.out 1177 1178 start_message "s_client ... connect to TLS/SSL test server by TLSv1.2" 1179 sleep $test_pause_sec 1180 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1181 -tls1_2 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1182 check_exit_status $? 1183 1184 grep 'Protocol : TLSv1\.2$' $s_client_out > /dev/null 1185 check_exit_status $? 1186 1187 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1188 check_exit_status $? 1189 1190 # all available ciphers with random order 1191 1192 s_ciph=$server_dir/s_ciph_${sc} 1193 if [ $s_id = "0" ] ; then 1194 $s_bin ciphers -v ALL:!ECDSA:!kGOST | awk '{print $1}' > $s_ciph 1195 else 1196 $s_bin ciphers -v | awk '{print $1}' > $s_ciph 1197 fi 1198 1199 c_ciph=$user1_dir/c_ciph_${sc} 1200 if [ $c_id = "0" ] ; then 1201 $c_bin ciphers -v ALL:!ECDSA:!kGOST | awk '{print $1}' > $c_ciph 1202 else 1203 $c_bin ciphers -v | awk '{print $1}' > $c_ciph 1204 fi 1205 1206 ciphers=$user1_dir/ciphers_${sc} 1207 grep -x -f $s_ciph $c_ciph | sort -R > $ciphers 1208 1209 cnum=0 1210 for c in `cat $ciphers` ; do 1211 cnum=`expr $cnum + 1` 1212 cnstr=`printf %03d $cnum` 1213 s_client_out=$user1_dir/s_client_${sc}_tls_${cnstr}_${c}.out 1214 1215 start_message "s_client ... connect to TLS/SSL test server with [ $cnstr ] $c" 1216 sleep $test_pause_sec 1217 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1218 -cipher $c \ 1219 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1220 check_exit_status $? 1221 1222 grep "Cipher : $c" $s_client_out > /dev/null 1223 check_exit_status $? 1224 1225 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1226 check_exit_status $? 1227 done 1228 1229 # Get session ticket to reuse 1230 1231 s_client_out=$user1_dir/s_client_${sc}_tls_reuse_1.out 1232 1233 start_message "s_client ... connect to TLS/SSL test server to get session id" 1234 sleep $test_pause_sec 1235 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1236 -nextprotoneg "spdy/3,http/1.1" -alpn "spdy/3,http/1.1" \ 1237 -sess_out $sess_dat \ 1238 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1239 check_exit_status $? 1240 1241 grep '^New, TLS.*$' $s_client_out > /dev/null 1242 check_exit_status $? 1243 1244 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1245 check_exit_status $? 1246 1247 # Reuse session ticket 1248 1249 s_client_out=$user1_dir/s_client_${sc}_tls_reuse_2.out 1250 1251 start_message "s_client ... connect to TLS/SSL test server reusing session id" 1252 sleep $test_pause_sec 1253 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1254 -sess_in $sess_dat \ 1255 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1256 check_exit_status $? 1257 1258 grep '^Reused, TLS.*$' $s_client_out > /dev/null 1259 check_exit_status $? 1260 1261 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1262 check_exit_status $? 1263 1264 # invalid verification pattern 1265 1266 s_client_out=$user1_dir/s_client_${sc}_tls_invalid.out 1267 1268 start_message "s_client ... connect to TLS/SSL test server but verify error" 1269 sleep $test_pause_sec 1270 $c_bin s_client -connect $host:$port -CAfile $ca_cert \ 1271 -showcerts -crl_check -issuer_checks -policy_check \ 1272 -msg -tlsextdebug < /dev/null > $s_client_out 2>&1 1273 check_exit_status $? 1274 1275 grep 'Verify return code: 0 (ok)' $s_client_out > /dev/null 1276 if [ $? -eq 0 ] ; then 1277 check_exit_status 1 1278 else 1279 check_exit_status 0 1280 fi 1281 1282 # s_time 1283 start_message "s_time ... connect to TLS/SSL test server" 1284 $c_bin s_time -connect $host:$port -CApath $ca_dir -time 2 1285 check_exit_status $? 1286 1287 # sess_id 1288 start_message "sess_id" 1289 $c_bin sess_id -in $sess_dat -text -out $sess_dat.out 1290 check_exit_status $? 1291 1292 stop_s_server 1293} 1294 1295function test_speed { 1296 # === PERFORMANCE === 1297 section_message "PERFORMANCE" 1298 1299 if [ $no_long_tests = 0 ] ; then 1300 start_message "speed" 1301 $openssl_bin speed sha512 rsa2048 -multi 2 -elapsed 1302 check_exit_status $? 1303 else 1304 start_message "SKIPPING speed (quick mode)" 1305 fi 1306} 1307 1308function test_version { 1309 # --- VERSION INFORMATION --- 1310 section_message "VERSION INFORMATION" 1311 1312 start_message "version" 1313 $openssl_bin version -a 1314 check_exit_status $? 1315} 1316 1317#---------#---------#---------#---------#---------#---------#---------#--------- 1318 1319openssl_bin=${OPENSSL:-/usr/bin/openssl} 1320other_openssl_bin=${OTHER_OPENSSL:-/usr/local/bin/eopenssl} 1321 1322interop_tests=0 1323no_long_tests=0 1324 1325while [ "$1" != "" ]; do 1326 case $1 in 1327 -i | --interop) shift 1328 interop_tests=1 1329 ;; 1330 -q | --quick ) shift 1331 no_long_tests=1 1332 ;; 1333 * ) usage 1334 exit 1 1335 esac 1336done 1337 1338if [ ! -x $openssl_bin ] ; then 1339 echo ":-< \$OPENSSL [$openssl_bin] is not executable." 1340 exit 1 1341fi 1342 1343if [ $interop_tests = 1 -a ! -x $other_openssl_bin ] ; then 1344 echo ":-< \$OTHER_OPENSSL [$other_openssl_bin] is not executable." 1345 exit 1 1346fi 1347 1348# 1349# create ssldir, and all files generated by this script goes under this dir. 1350# 1351ssldir="appstest_dir" 1352 1353if [ -d $ssldir ] ; then 1354 echo "directory [ $ssldir ] exists, this script deletes this directory ..." 1355 /bin/rm -rf $ssldir 1356fi 1357 1358mkdir -p $ssldir 1359 1360ca_dir=$ssldir/testCA 1361tsa_dir=$ssldir/testTSA 1362ocsp_dir=$ssldir/testOCSP 1363server_dir=$ssldir/server 1364user1_dir=$ssldir/user1 1365mkdir -p $user1_dir 1366key_dir=$ssldir/key 1367mkdir -p $key_dir 1368 1369export OPENSSL_CONF=$ssldir/openssl.cnf 1370touch $OPENSSL_CONF 1371 1372uname_s=`uname -s | grep 'MINGW'` 1373if [ "$uname_s" = "" ] ; then 1374 mingw=0 1375else 1376 mingw=1 1377fi 1378 1379# 1380# process tests 1381# 1382test_usage_lists_others 1383test_md 1384test_encoding_cipher 1385test_key 1386test_pki 1387test_tsa 1388test_smime 1389test_ocsp 1390test_pkcs 1391test_server_client 0 0 1392if [ $interop_tests = 1 ] ; then 1393 test_server_client 0 1 1394 test_server_client 1 0 1395fi 1396test_speed 1397test_version 1398 1399section_message "END" 1400 1401exit 0 1402 1403