diff options
Diffstat (limited to 'security/nss/tests/tools/tools.sh')
| -rwxr-xr-x | security/nss/tests/tools/tools.sh | 733 |
1 files changed, 733 insertions, 0 deletions
diff --git a/security/nss/tests/tools/tools.sh b/security/nss/tests/tools/tools.sh new file mode 100755 index 0000000000..15a41e39cf --- /dev/null +++ b/security/nss/tests/tools/tools.sh @@ -0,0 +1,733 @@ +#! /bin/bash +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +######################################################################## +# +# mozilla/security/nss/tests/tools/tools.sh +# +# Script to test basic functionality of NSS tools +# +# needs to work on all Unix and Windows platforms +# +# tests implemented: +# pk12util +# signtool +# +# special strings +# --------------- +# FIXME ... known problems, search for this string +# NOTE .... unexpected behavior +######################################################################## + + export pkcs12v2pbeWithSha1And128BitRc4=\ +"PKCS #12 V2 PBE With SHA-1 And 128 Bit RC4" + + export pkcs12v2pbeWithSha1And40BitRc4=\ +"PKCS #12 V2 PBE With SHA-1 And 40 Bit RC4" + + export pkcs12v2pbeWithSha1AndTripleDESCBC=\ +"PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC" + + export pkcs12v2pbeWithSha1And128BitRc2Cbc=\ +"PKCS #12 V2 PBE With SHA-1 And 128 Bit RC2 CBC" + + export pkcs12v2pbeWithSha1And40BitRc2Cbc=\ +"PKCS #12 V2 PBE With SHA-1 And 40 Bit RC2 CBC" + + export pkcs5pbeWithMD2AndDEScbc=\ +"PKCS #5 Password Based Encryption with MD2 and DES-CBC" + + export pkcs5pbeWithMD5AndDEScbc=\ +"PKCS #5 Password Based Encryption with MD5 and DES-CBC" + + export pkcs5pbeWithSha1AndDEScbc=\ +"PKCS #5 Password Based Encryption with SHA-1 and DES-CBC" + + # if we change the defaults in pk12util, update these variables + export CERT_ENCRYPTION_DEFAULT="AES-128-CBC" + export KEY_ENCRYPTION_DEFAULT="AES-256-CBC" + export HASH_DEFAULT="SHA-256" + + export PKCS5v1_PBE_CIPHERS="${pkcs5pbeWithMD2AndDEScbc},\ +${pkcs5pbeWithMD5AndDEScbc},\ +${pkcs5pbeWithSha1AndDEScbc}" + export PKCS12_PBE_CIPHERS="${pkcs12v2pbeWithSha1And128BitRc4},\ +${pkcs12v2pbeWithSha1And40BitRc4},\ +${pkcs12v2pbeWithSha1AndTripleDESCBC},\ +${pkcs12v2pbeWithSha1And128BitRc2Cbc},\ +${pkcs12v2pbeWithSha1And40BitRc2Cbc}" + export PKCS5v2_PBE_CIPHERS="RC2-CBC,DES-EDE3-CBC,AES-128-CBC,AES-192-CBC,\ +AES-256-CBC,CAMELLIA-128-CBC,CAMELLIA-192-CBC,CAMELLIA-256-CBC" + export PBE_CIPHERS="${PKCS5v1_PBE_CIPHERS},${PKCS12_PBE_CIPHERS},${PKCS5v2_PBE_CIPHERS}" + export PBE_CIPHERS_CLASSES="${pkcs5pbeWithSha1AndDEScbc},\ +${pkcs12v2pbeWithSha1AndTripleDESCBC},AES-256-CBC,default" + export PBE_HASH="SHA-1,SHA-224,SHA-256,SHA-384,SHA-512,default" + +############################## tools_init ############################## +# local shell function to initialize this script +######################################################################## +tools_init() +{ + SCRIPTNAME=tools.sh # sourced - $0 would point to all.sh + + if [ -z "${CLEANUP}" ] ; then # if nobody else is responsible for + CLEANUP="${SCRIPTNAME}" # cleaning this script will do it + fi + + if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then + cd ../common + . ./init.sh + fi + if [ ! -r $CERT_LOG_FILE ]; then # we need certificates here + cd ../cert + . ./cert.sh + fi + SCRIPTNAME=tools.sh + + html_head "Tools Tests" + + grep "SUCCESS: SMIME passed" $CERT_LOG_FILE >/dev/null || { + Exit 15 "Fatal - S/MIME of cert.sh needs to pass first" + } + + TOOLSDIR=${HOSTDIR}/tools + COPYDIR=${TOOLSDIR}/copydir + SIGNDIR=${TOOLSDIR}/signdir + + R_TOOLSDIR=../tools + R_COPYDIR=../tools/copydir + R_SIGNDIR=../tools/signdir + P_R_COPYDIR=${R_COPYDIR} + P_R_SIGNDIR=${R_SIGNDIR} + if [ -n "${MULTIACCESS_DBM}" ]; then + P_R_COPYDIR="multiaccess:Tools.$version" + P_R_SIGNDIR="multiaccess:Tools.sign.$version" + fi + + mkdir -p ${TOOLSDIR} + mkdir -p ${COPYDIR} + mkdir -p ${SIGNDIR} + cp ${ALICEDIR}/* ${SIGNDIR}/ + mkdir -p ${TOOLSDIR}/html + cp ${QADIR}/tools/sign*.html ${TOOLSDIR}/html + mkdir -p ${TOOLSDIR}/data + cp ${QADIR}/tools/TestOldCA.p12 ${TOOLSDIR}/data + cp ${QADIR}/tools/TestOldAES128CA.p12 ${TOOLSDIR}/data + cp ${QADIR}/tools/TestRSAPSS.p12 ${TOOLSDIR}/data + + cd ${TOOLSDIR} +} + +########################## list_p12_file ############################### +# List the key and cert in the specified p12 file +######################################################################## +list_p12_file() +{ + echo "$SCRIPTNAME: Listing Alice's pk12 file" + echo "pk12util -l ${1} -w ${R_PWFILE}" + + ${BINDIR}/pk12util -l ${1} -w ${R_PWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Listing ${1} (pk12util -l)" + check_tmpfile +} + +######################################################################## +# Import the key and cert from the specified p12 file +######################################################################## +import_p12_file() +{ + echo "$SCRIPTNAME: Importing Alice's pk12 ${1} file" + echo "pk12util -i ${1} -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE}" + + ${BINDIR}/pk12util -i ${1} -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Importing ${1} (pk12util -i)" + check_tmpfile +} + + +######################################################################## +# Export the key and cert from the specified p12 file +######################################################################## +export_p12_file() +{ + # $1 p12 file + # $2 cert to export + # $3 certdb + # $4 key encryption cipher or "default" + # $5 certificate encryption cipher or "default" + # $6 hash algorithm or "default" + KEY_CIPHER_OPT="-c" + KEY_CIPHER="${4}" + CERT_CIPHER_OPT="-C" + CERT_CIPHER="${5}" + HASH_ALG_OPT="-M" + HASH_ALG="${6}" + + if [ "${KEY_CIPHER}" = "default" ]; then + KEY_CIPHER_OPT="" + KEY_CIPHER="" + fi + if [ "${CERT_CIPHER}" = "default" ]; then + CERT_CIPHER_OPT="" + CERT_CIPHER="" + fi + if [ "${HASH_ALG}" = "default" ]; then + HASH_ALG_OPT="" + HASH_ALG="" + fi + + echo "pk12util -o \"${1}\" -n \"${2}\" -d \"${3}\" \\" + echo " -k ${R_PWFILE} -w ${R_PWFILE} \\" + echo " ${KEY_CIPHER_OPT} \"${KEY_CIPHER}\" \\" + echo " ${CERT_CIPHER_OPT} \"${CERT_CIPHER}\" \\" + echo " ${HASH_ALG_OPT} \"${HASH_ALG}\"" + ${BINDIR}/pk12util -o "${1}" -n "${2}" -d "${3}" \ + -k ${R_PWFILE} -w ${R_PWFILE} \ + ${KEY_CIPHER_OPT} "${KEY_CIPHER}" \ + ${CERT_CIPHER_OPT} "${CERT_CIPHER}" \ + ${HASH_ALG_OPT} "${HASH_ALG}" 2>&1 + ret=$? + html_msg $ret 0 "Exporting with [${4}:${5}:${6}] (pk12util -o)" + check_tmpfile + verify_p12 "${1}" "${4}" "${5}" "${6}" + return $ret +} + +######################################################################## +# Exports key and cert to a p12 file, the key encryption cipher, +# the cert encryption cipher, and/or the hash algorithm are specified. +# The key and cert are imported and the p12 file is listed +######################################################################## +export_list_import() +{ + export_p12_file Alice.p12 Alice "${P_R_ALICEDIR}" "${@}" + list_p12_file Alice.p12 + import_p12_file Alice.p12 +} + +######################################################################## +# Export using the pkcs5pbe ciphers for key and certificate encryption. +# List the contents of and import from the p12 file. +######################################################################## +tools_p12_export_list_import_all_pkcs5pbe_ciphers() +{ + local saveIFS="${IFS}" + IFS=, + for key_cipher in ${PKCS5v1_PBE_CIPHERS} default; do + for cert_cipher in ${PKCS5v1_PBE_CIPHERS} default none; do + for hash in ${PBE_HASH}; do + export_list_import "${key_cipher}" "${cert_cipher}" "${hash}" + done + done + done + IFS="${saveIFS}" +} + +######################################################################## +# Export using the pkcs5v2 ciphers for key and certificate encryption. +# List the contents of and import from the p12 file. +######################################################################## +tools_p12_export_list_import_all_pkcs5v2_ciphers() +{ + local saveIFS="${IFS}" + IFS=, + for key_cipher in ${PKCS5v2_PBE_CIPHERS} default; do + for cert_cipher in ${PKCS5v2_PBE_CIPHERS} default none; do + for hash in ${PBE_HASH}; do + export_list_import "${key_cipher}" "${cert_cipher}" "${hash}" + done + done + done + IFS="${saveIFS}" +} + +######################################################################## +# Export using the pkcs12v2pbe ciphers for key and certificate encryption. +# List the contents of and import from the p12 file. +######################################################################## +tools_p12_export_list_import_all_pkcs12v2pbe_ciphers() +{ + local saveIFS="${IFS}" + IFS=, + for key_cipher in ${PKCS12_PBE_CIPHERS} ${PKCS5v1_PBE_CIPHERS} default; do + for cert_cipher in ${PKCS12_PBE_CIPHERS} ${PKCS5v1_PBE_CIPHERS} default none; do + for hash in ${PBE_HASH}; do + export_list_import "${key_cipher}" "${cert_cipher}" "${hash}" + done + done + done + IFS="${saveIFS}" +} + +######################################################################## +# Spot check all ciphers. +# using the traditional tests, we wind up running almost 1300 tests. +# This isn't too bad for debug builds in which the interator is set to 1000. +# for optimized builds, the iterator is set to 60000, which means a 30 +# minute test will now take more than 2 hours. This tests most combinations +# and results in only about 300 tests. We are stil testing all ciphers +# for both key and cert encryption, and we are testing them against +# one of each class of cipher (pkcs5v1, pkcs5v2, pkcs12). +######################################################################## +tools_p12_export_list_import_most_ciphers() +{ + local saveIFS="${IFS}" + IFS=, + for cipher in ${PBE_CIPHERS}; do + for class in ${PBE_CIPHERS_CLASSES}; do + # we'll test the case of cipher == class below the for loop + if [ "${cipher}" != "${class}" ]; then + export_list_import "${class}" "${cipher}" "SHA-1" + export_list_import "${cipher}" "${class}" "SHA-256" + fi + done + export_list_import "${cipher}" "none" "SHA-224" + export_list_import "${cipher}" "${cipher}" "SHA-384" + done + for class in ${PBE_CIPHERS_CLASSES}; do + for hash in ${PBE_HASH}; do + export_list_import "${class}" "${class}" "${hash}" + done + done + IFS="${saveIFS}" +} + +######################################################################### +# Export with no encryption on key should fail but on cert should pass +######################################################################### +tools_p12_export_with_none_ciphers() +{ + # use none as the key encryption algorithm default for the cert one + # should fail + + echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\" + echo " -k ${R_PWFILE} -w ${R_PWFILE} -c none" + ${BINDIR}/pk12util -o Alice.p12 -n Alice -d ${P_R_ALICEDIR} \ + -k ${R_PWFILE} -w ${R_PWFILE} \ + -c none 2>&1 + ret=$? + html_msg $ret 30 "Exporting with [none:default:default] (pk12util -o)" + check_tmpfile + + # use default as the key encryption algorithm none for the cert one + # should pass + + echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\" + echo " -k ${R_PWFILE} -w ${R_PWFILE} -C none" + ${BINDIR}/pk12util -o Alice.p12 -n Alice -d ${P_R_ALICEDIR} \ + -k ${R_PWFILE} -w ${R_PWFILE} \ + -C none 2>&1 + ret=$? + html_msg $ret 0 "Exporting with [default:none:default] (pk12util -o)" + check_tmpfile + verify_p12 Alice.p12 "default" "none" "default" +} + +######################################################################### +# Export with invalid cipher should fail +######################################################################### +tools_p12_export_with_invalid_ciphers() +{ + echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\" + echo " -k ${R_PWFILE} -w ${R_PWFILE} -c INVALID_CIPHER" + ${BINDIR}/pk12util -o Alice.p12 -n Alice -d ${P_R_ALICEDIR} \ + -k ${R_PWFILE} -w ${R_PWFILE} \ + -c INVALID_CIPHER 2>&1 + ret=$? + html_msg $ret 30 "Exporting with [INVALID_CIPHER:default] (pk12util -o)" + check_tmpfile + + echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\" + echo " -k ${R_PWFILE} -w ${R_PWFILE} -C INVALID_CIPHER" + ${BINDIR}/pk12util -o Alice.p12 -n Alice -d ${P_R_ALICEDIR} \ + -k ${R_PWFILE} -w ${R_PWFILE} \ + -C INVALID_CIPHER 2>&1 + ret=$? + html_msg $ret 30 "Exporting with [default:INVALID_CIPHER] (pk12util -o)" + check_tmpfile + +} + +######################################################################### +# Exports using the default key and certificate encryption ciphers. +# Imports from and lists the contents of the p12 file. +# Repeats the test with ECC if enabled. +######################################################################## +tools_p12_export_list_import_with_default_ciphers() +{ + echo "$SCRIPTNAME: Exporting Alice's email cert & key - default ciphers" + + export_list_import "default" "default" "default" + + echo "$SCRIPTNAME: Exporting Alice's email EC cert & key---------------" + echo "pk12util -o Alice-ec.p12 -n \"Alice-ec\" -d ${P_R_ALICEDIR} -k ${R_PWFILE} \\" + echo " -w ${R_PWFILE}" + ${BINDIR}/pk12util -o Alice-ec.p12 -n "Alice-ec" -d ${P_R_ALICEDIR} -k ${R_PWFILE} \ + -w ${R_PWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Exporting Alice's email EC cert & key (pk12util -o)" + check_tmpfile + verify_p12 Alice-ec.p12 "default" "default" "default" + + echo "$SCRIPTNAME: Importing Alice's email EC cert & key --------------" + echo "pk12util -i Alice-ec.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE}" + ${BINDIR}/pk12util -i Alice-ec.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Importing Alice's email EC cert & key (pk12util -i)" + check_tmpfile + + echo "$SCRIPTNAME: Listing Alice's pk12 EC file -----------------" + echo "pk12util -l Alice-ec.p12 -w ${R_PWFILE}" + ${BINDIR}/pk12util -l Alice-ec.p12 -w ${R_PWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Listing Alice's pk12 EC file (pk12util -l)" + check_tmpfile + + echo "$SCRIPTNAME: Exporting Alice's email EC cert & key with long pw------" + echo "pk12util -o Alice-ec-long.p12 -n \"Alice-ec\" -d ${P_R_ALICEDIR} -k ${R_PWFILE} \\" + echo " -w ${R_LONGPWFILE}" + ${BINDIR}/pk12util -o Alice-ec-long.p12 -n "Alice-ec" -d ${P_R_ALICEDIR} -k ${R_PWFILE} \ + -w ${R_LONGPWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Exporting Alice's email EC cert & key with long pw (pk12util -o)" + check_tmpfile + verify_p12 Alice-ec-long.p12 "default" "default" "default" + + echo "$SCRIPTNAME: Importing Alice's email EC cert & key with long pw-----" + echo "pk12util -i Alice-ec-long.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_LONGPWFILE}" + ${BINDIR}/pk12util -i Alice-ec-long.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_LONGPWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Importing Alice's email EC cert & key with long pw (pk12util -i)" + check_tmpfile + + echo "$SCRIPTNAME: Listing Alice's pk12 EC file with long pw ------------" + echo "pk12util -l Alice-ec-long.p12 -w ${R_LONGPWFILE}" + ${BINDIR}/pk12util -l Alice-ec-long.p12 -w ${R_LONGPWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Listing Alice's pk12 EC file with long pw (pk12util -l)" + check_tmpfile +} + +tools_p12_import_old_files() +{ + echo "$SCRIPTNAME: Importing PKCS#12 files created with older NSS --------------" + echo "pk12util -i TestOldCA.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE}" + ${BINDIR}/pk12util -i ${TOOLSDIR}/data/TestOldCA.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Importing PKCS#12 file created with NSS 3.21 (PBES2 with BMPString password)" + check_tmpfile + + echo "pk12util -i TestOldAES128CA.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE}" + ${BINDIR}/pk12util -i ${TOOLSDIR}/data/TestOldAES128CA.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE} 2>&1 + ret=$? + html_msg $ret 0 "Importing PKCS#12 file created with NSS 3.29.5 (PBES2 with incorrect AES-128-CBC algorithm ID)" + check_tmpfile +} + +tools_p12_import_rsa_pss_private_key() +{ + echo "$SCRIPTNAME: Importing RSA-PSS private key from PKCS#12 file --------------" + ${BINDIR}/pk12util -i ${TOOLSDIR}/data/TestRSAPSS.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -W '' 2>&1 + ret=$? + html_msg $ret 0 "Importing RSA-PSS private key from PKCS#12 file" + check_tmpfile + + # Check if RSA-PSS identifier is included in the key listing + ${BINDIR}/certutil -d ${P_R_COPYDIR} -K -f ${R_PWFILE} | grep '^<[0-9 ]*> *rsaPss' + ret=$? + html_msg $ret 0 "Listing RSA-PSS private key imported from PKCS#12 file" + check_tmpfile + + return $ret +} + +############################## tools_p12 ############################### +# local shell function to test basic functionality of pk12util +######################################################################## +tools_p12() +{ + tools_p12_export_list_import_with_default_ciphers + # optimized builds have a larger iterator, so they can't run as many + # pkcs12 tests and complete in a reasonable time. Use the iterateration + # count from the previous tests to determine how many tests + # we can run. + iteration_count=$(pp -t p12 -i Alice-ec.p12 | grep "Iterations: " | sed -e 's;.*Iterations: ;;' -e 's;(.*).*;;') + echo "Iteration count=${iteration_count}" + if [ -n "${iteration_count}" -a ${iteration_count} -le 10000 ]; then + tools_p12_export_list_import_all_pkcs5v2_ciphers + tools_p12_export_list_import_all_pkcs12v2pbe_ciphers + else + tools_p12_export_list_import_most_ciphers + fi + tools_p12_export_with_none_ciphers + tools_p12_export_with_invalid_ciphers + tools_p12_import_old_files + if [ "${TEST_MODE}" = "SHARED_DB" ] ; then + tools_p12_import_rsa_pss_private_key + fi +} + +############################## tools_sign ############################## +# local shell function pk12util uses a hardcoded tmp file, if this exists +# and is owned by another user we don't get reasonable errormessages +######################################################################## +check_tmpfile() +{ + if [ $ret != "0" -a -f /tmp/Pk12uTemp ] ; then + echo "Error: pk12util temp file exists. Please remove this file and" + echo " rerun the test (/tmp/Pk12uTemp) " + fi +} + +############################## tools_sign ############################## +# make sure the generated p12 file has the characteristics we expected +######################################################################## +verify_p12() +{ + KEY_ENCRYPTION=$(map_cipher "${2}" "${KEY_ENCRYPTION_DEFAULT}") + CERT_ENCRYPTION=$(map_cipher "${3}" "${CERT_ENCRYPTION_DEFAULT}") + HASH=$(map_cipher "${4}" "${HASH_DEFAULT}") + + STATE="NOBAGS" # state records if we are in the key or cert bag + CERT_ENCRYPTION_NOT_FOUND=1 + KEY_ENCRYPTION_NOT_FOUND=1 + CERT_ENCRYPTION_FAIL=0 + KEY_ENCRYPTION_FAIL=0 + HASH_FAIL=0 + TMP=$(mktemp /tmp/p12Verify.XXXXXX) + which pk12util + local saveIFS="${IFS}" + IFS=" \ +" + # use pp to dump the pkcs12 file, only the unencrypted portions are visible + # if there are multiple entries, we fail if any of those entries have the + # wrong encryption. We also fail if we can't find any encryption info. + # Use a file rather than a pipe so that while do can modify our variables. + # We're only interested in extracting the encryption algorithms are here, + # p12util -l will verify that decryption works properly. + pp -t pkcs12 -i ${1} -o ${TMP} + while read line ; do + # first up: if we see an unencrypted key bag, then we know that the key + # was unencrypted (NOTE: pk12util currently can't generate these kinds of + # files). + if [[ "${line}" =~ "Bag "[0-9]+" ID: PKCS #12 V1 Key Bag" ]]; then + KEY_ENCRYPTION_NOT_FOUND=0 + if [ "${KEY_ENCRYPTION}" != "none" ]; then + KEY_ENCRYPTION_FAIL=1 + echo "--Key encryption mismatch: expected \"${KEY_ENCRYPTION}\" found \"none\"" + fi + continue + fi + # if we find the the Cert Bag, then we know that the certificate was not + # encrypted + if [[ "${line}" =~ "Bag "[0-9]+" ID: PKCS #12 V1 Cert Bag" ]]; then + CERT_ENCRYPTION_NOT_FOUND=0 + if [ "${CERT_ENCRYPTION}" != "none" ]; then + CERT_ENCRYPTION_FAIL=1 + echo "--Cert encryption mismatch: expected \"${CERT_ENCRYPTION}\" found \"none\"" + fi + continue + fi + # we found the shrouded key bag, the next encryption informtion should be + # for the key. + if [[ "${line}" =~ "Bag "[0-9]+" ID: PKCS #12 V1 PKCS8 Shrouded Key Bag" ]]; then + STATE="KEY" + continue + fi + # If we found PKCS #7 Encrypted Data, it must be the encrypted certificate + # (well it could be any encrypted certificate, or a crl, but in p12util + # they will all have the same encryption value + if [[ "${line}" = "PKCS #7 Encrypted Data:" ]]; then + STATE="CERT" + continue + fi + # check the Mac + if [[ "${line}" =~ "Mac Digest Algorithm ID: ".* ]]; then + MAC="${line##Mac Digest Algorithm ID: }" + if [ "${MAC}" != "${HASH}" ]; then + HASH_FAIL=1 + echo "--Mac Hash mismatch: expected \"${HASH}\" found \"${MAC}\"" + fi + fi + # check the KDF + if [[ "${line}" =~ "KDF algorithm: ".* ]]; then + KDF="${line##KDF algorithm: }" + if [ "${KDF}" != "HMAC ${HASH}" ]; then + HASH_FAIL=1 + echo "--KDF Hash mismatch: expected \"HMAC ${HASH}\" found \"${KDF}\"" + fi + fi + # Content Encryption Algorithm is the PKCS #5 algorithm ID. + if [[ "${line}" =~ .*"Encryption Algorithm: ".* ]]; then + # Strip the [Content ]EncryptionAlgorithm + ENCRYPTION="${line##Content }" + ENCRYPTION="${ENCRYPTION##Encryption Algorithm: }" + # If that algorithm id is PKCS #5 V2, then skip forward looking + # for the Cipher: field. + if [[ "${ENCRYPTION}" =~ "PKCS #5 Password Based Encryption v2"\ * ]]; then + continue; + fi + case ${STATE} in + "KEY") + KEY_ENCRYPTION_NOT_FOUND=0 + if [ "${KEY_ENCRYPTION}" != "${ENCRYPTION}" ]; then + KEY_ENCRYPTION_FAIL=1 + echo "--Key encryption mismatch: expected \"${KEY_ENCRYPTION}\" found \"${ENCRYPTION}\"" + fi + ;; + "CERT") + CERT_ENCRYPTION_NOT_FOUND=0 + if [ "${CERT_ENCRYPTION}" != "${ENCRYPTION}" ]; then + CERT_ENCRYPTION_FAIL=1 + echo "--Cert encryption mismatch: expected \"${CERT_ENCRYPTION}\" found \"${ENCRYPTION}\"" + fi + ;; + esac + fi + # handle the PKCS 5 case + if [[ "${line}" =~ "Cipher: ".* ]]; then + ENCRYPTION="${line#Cipher: }" + case ${STATE} in + "KEY") + KEY_ENCRYPTION_NOT_FOUND=0 + if [ "${KEY_ENCRYPTION}" != "${ENCRYPTION}" ]; then + KEY_ENCRYPTION_FAIL=1 + echo "--Key encryption mismatch: expected \"${KEY_ENCRYPTION}\" found \"${ENCRYPTION}\"" + fi + ;; + "CERT") + CERT_ENCRYPTION_NOT_FOUND=0 + if [ "${CERT_ENCRYPTION}" != "${ENCRYPTION}" ]; then + CERT_ENCRYPTION_FAIL=1 + echo "--Cert encryption mismatch: expected \"${CERT_ENCRYPTION}\" found \"${ENCRYPTION}\"" + fi + ;; + esac + fi + done < ${TMP} + IFS="${saveIFS}" + # we've scanned the file, set the return value to a combination of + # KEY and CERT state variables. If everything is as expected, they should + # add up to 0. + ret=$((${HASH_FAIL} * 10000 + ${KEY_ENCRYPTION_FAIL} * 1000 + ${KEY_ENCRYPTION_NOT_FOUND} * 100 + ${CERT_ENCRYPTION_FAIL} * 10 + ${CERT_ENCRYPTION_NOT_FOUND})) + rm -r ${TMP} + html_msg $ret 0 "Verifying p12 file generated with [${2}:${3}:${4}]" +} + +# +# this handles any mapping we need from requested cipher to +# actual cipher. For instance ciphers which already have +# PKCS 5 v1 PBE will be mapped to those pbes by pk12util. +map_cipher() +{ + if [ "${1}" = "default" ]; then + echo "${2}" + return + fi + case "${1}" in + # these get mapped to the PKCS5 v1 or PKCS 12 attributes, not PKCS 5v2 + RC2-CBC) + echo "${pkcs12v2pbeWithSha1And128BitRc2Cbc}" + return ;; + DES-EDE3-CBC) + echo "${pkcs12v2pbeWithSha1AndTripleDESCBC}" + return;; + esac + echo "${1}" +} + +############################## tools_sign ############################## +# local shell function to test basic functionality of signtool +######################################################################## +tools_sign() +{ + echo "$SCRIPTNAME: Create objsign cert -------------------------------" + echo "signtool -G \"objectsigner\" -d ${P_R_SIGNDIR} -p \"nss\"" + ${BINDIR}/signtool -G "objsigner" -d ${P_R_SIGNDIR} -p "nss" 2>&1 <<SIGNSCRIPT +y +TEST +MOZ +NSS +NY +US +liz +liz@moz.org +SIGNSCRIPT + html_msg $? 0 "Create objsign cert (signtool -G)" + + echo "$SCRIPTNAME: Signing a jar of files ----------------------------" + echo "signtool -Z nojs.jar -d ${P_R_SIGNDIR} -p \"nss\" -k objsigner \\" + echo " ${R_TOOLSDIR}/html" + ${BINDIR}/signtool -Z nojs.jar -d ${P_R_SIGNDIR} -p "nss" -k objsigner \ + ${R_TOOLSDIR}/html + html_msg $? 0 "Signing a jar of files (signtool -Z)" + + echo "$SCRIPTNAME: Listing signed files in jar ----------------------" + echo "signtool -v nojs.jar -d ${P_R_SIGNDIR} -p nss -k objsigner" + ${BINDIR}/signtool -v nojs.jar -d ${P_R_SIGNDIR} -p nss -k objsigner + html_msg $? 0 "Listing signed files in jar (signtool -v)" + + echo "$SCRIPTNAME: Show who signed jar ------------------------------" + echo "signtool -w nojs.jar -d ${P_R_SIGNDIR}" + ${BINDIR}/signtool -w nojs.jar -d ${P_R_SIGNDIR} + html_msg $? 0 "Show who signed jar (signtool -w)" + + echo "$SCRIPTNAME: Signing a xpi of files ----------------------------" + echo "signtool -Z nojs.xpi -X -d ${P_R_SIGNDIR} -p \"nss\" -k objsigner \\" + echo " ${R_TOOLSDIR}/html" + ${BINDIR}/signtool -Z nojs.xpi -X -d ${P_R_SIGNDIR} -p "nss" -k objsigner \ + ${R_TOOLSDIR}/html + html_msg $? 0 "Signing a xpi of files (signtool -Z -X)" + + echo "$SCRIPTNAME: Listing signed files in xpi ----------------------" + echo "signtool -v nojs.xpi -d ${P_R_SIGNDIR} -p nss -k objsigner" + ${BINDIR}/signtool -v nojs.xpi -d ${P_R_SIGNDIR} -p nss -k objsigner + html_msg $? 0 "Listing signed files in xpi (signtool -v)" + + echo "$SCRIPTNAME: Show who signed xpi ------------------------------" + echo "signtool -w nojs.xpi -d ${P_R_SIGNDIR}" + ${BINDIR}/signtool -w nojs.xpi -d ${P_R_SIGNDIR} + html_msg $? 0 "Show who signed xpi (signtool -w)" + +} + +tools_modutil() +{ + echo "$SCRIPTNAME: Test if DB created by modutil -create is initialized" + mkdir -p ${R_TOOLSDIR}/moddir + # copied from modu function in cert.sh + # echo is used to press Enter expected by modutil + echo | ${BINDIR}/modutil -create -dbdir "${R_TOOLSDIR}/moddir" 2>&1 + ret=$? + ${BINDIR}/certutil -S -s 'CN=TestUser' -d "${TOOLSDIR}/moddir" -n TestUser \ + -x -t ',,' -z "${R_NOISE_FILE}" + ret=$? + html_msg $ret 0 "Test if DB created by modutil -create is initialized" + check_tmpfile +} + +############################## tools_cleanup ########################### +# local shell function to finish this script (no exit since it might be +# sourced) +######################################################################## +tools_cleanup() +{ + html "</TABLE><BR>" + cd ${QADIR} + . common/cleanup.sh +} + +################## main ################################################# + +tools_init +tools_p12 +tools_sign +tools_modutil +tools_cleanup + + |