+++ /dev/null
-$!
-$! A few very basic tests for the 'ts' time stamping authority command.
-$!
-$
-$ __arch = "VAX"
-$ if f$getsyi("cpu") .ge. 128 then -
- __arch = f$edit( f$getsyi( "ARCH_NAME"), "UPCASE")
-$ if __arch .eqs. "" then __arch = "UNK"
-$!
-$ if (p4 .eqs. "64") then __arch = __arch+ "_64"
-$!
-$ exe_dir = "sys$disk:[-.''__arch'.exe.apps]"
-$
-$ openssl = "mcr ''f$parse(exe_dir+"openssl.exe")'"
-$ OPENSSL_CONF = "[-]CAtsa.cnf"
-$ ! Because that's what ../apps/CA.sh really looks at
-$ SSLEAY_CONFIG = "-config " + OPENSSL_CONF
-$
-$ error:
-$ subroutine
-$ write sys$error "TSA test failed!"
-$ exit 3
-$ endsubroutine
-$
-$ setup_dir:
-$ subroutine
-$
-$ if f$search("tsa.dir") .nes ""
-$ then
-$ @[-.util]deltree [.tsa]*.*
-$ set file/prot=(S:RWED,O:RWED,G:RWED,W:RWED) tsa.dir;*
-$ delete tsa.dir;*
-$ endif
-$
-$ create/dir [.tsa]
-$ set default [.tsa]
-$ endsubroutine
-$
-$ clean_up_dir:
-$ subroutine
-$
-$ set default [-]
-$ @[-.util]deltree [.tsa]*.*
-$ set file/prot=(S:RWED,O:RWED,G:RWED,W:RWED) tsa.dir;*
-$ delete tsa.dir;*
-$ endsubroutine
-$
-$ create_ca:
-$ subroutine
-$
-$ write sys$output "Creating a new CA for the TSA tests..."
-$ TSDNSECT = "ts_ca_dn"
-$ openssl req -new -x509 -nodes -
- -out tsaca.pem -keyout tsacakey.pem
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ create_tsa_cert:
-$ subroutine
-$
-$ INDEX=p1
-$ EXT=p2
-$ TSDNSECT = "ts_cert_dn"
-$
-$ openssl req -new -
- -out tsa_req'INDEX'.pem -keyout tsa_key'INDEX'.pem
-$ if $severity .ne. 1 then call error
-$
-$ write sys$output "Using extension ''EXT'"
-$ openssl x509 -req -
- -in tsa_req'INDEX'.pem -out tsa_cert'INDEX'.pem -
- "-CA" tsaca.pem "-CAkey" tsacakey.pem "-CAcreateserial" -
- -extfile 'OPENSSL_CONF' -extensions "''EXT'"
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ print_request:
-$ subroutine
-$
-$ openssl ts -query -in 'p1' -text
-$ endsubroutine
-$
-$ create_time_stamp_request1: subroutine
-$
-$ openssl ts -query -data [-]testtsa.com -policy tsa_policy1 -
- -cert -out req1.tsq
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ create_time_stamp_request2: subroutine
-$
-$ openssl ts -query -data [-]testtsa.com -policy tsa_policy2 -
- -no_nonce -out req2.tsq
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ create_time_stamp_request3: subroutine
-$
-$ openssl ts -query -data [-]CAtsa.cnf -no_nonce -out req3.tsq
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ print_response:
-$ subroutine
-$
-$ openssl ts -reply -in 'p1' -text
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ create_time_stamp_response:
-$ subroutine
-$
-$ openssl ts -reply -section 'p3' -queryfile 'p1' -out 'p2'
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ time_stamp_response_token_test:
-$ subroutine
-$
-$ RESPONSE2 = p2+ "-copy_tsr"
-$ TOKEN_DER = p2+ "-token_der"
-$ openssl ts -reply -in 'p2' -out 'TOKEN_DER' -token_out
-$ if $severity .ne. 1 then call error
-$ openssl ts -reply -in 'TOKEN_DER' -token_in -out 'RESPONSE2'
-$ if $severity .ne. 1 then call error
-$ backup/compare 'RESPONSE2' 'p2'
-$ if $severity .ne. 1 then call error
-$ openssl ts -reply -in 'p2' -text -token_out
-$ if $severity .ne. 1 then call error
-$ openssl ts -reply -in 'TOKEN_DER' -token_in -text -token_out
-$ if $severity .ne. 1 then call error
-$ openssl ts -reply -queryfile 'p1' -text -token_out
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ verify_time_stamp_response:
-$ subroutine
-$
-$ openssl ts -verify -queryfile 'p1' -in 'p2' -
- "-CAfile" tsaca.pem -untrusted tsa_cert1.pem
-$ if $severity .ne. 1 then call error
-$ openssl ts -verify -data 'p3' -in 'p2' -
- "-CAfile" tsaca.pem -untrusted tsa_cert1.pem
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ verify_time_stamp_token:
-$ subroutine
-$
-$ ! create the token from the response first
-$ openssl ts -reply -in "''p2'" -out "''p2'-token" -token_out
-$ if $severity .ne. 1 then call error
-$ openssl ts -verify -queryfile "''p1'" -in "''p2'-token" -
- -token_in "-CAfile" tsaca.pem -untrusted tsa_cert1.pem
-$ if $severity .ne. 1 then call error
-$ openssl ts -verify -data "''p3'" -in "''p2'-token" -
- -token_in "-CAfile" tsaca.pem -untrusted tsa_cert1.pem
-$ if $severity .ne. 1 then call error
-$ endsubroutine
-$
-$ verify_time_stamp_response_fail:
-$ subroutine
-$
-$ openssl ts -verify -queryfile 'p1' -in 'p2' -
- "-CAfile" tsaca.pem -untrusted tsa_cert1.pem
-$ ! Checks if the verification failed, as it should have.
-$ if $severity .eq. 1 then call error
-$ write sys$output "Ok"
-$ endsubroutine
-$
-$ ! Main body ----------------------------------------------------------
-$
-$ set noon
-$
-$ write sys$output "Setting up TSA test directory..."
-$ call setup_dir
-$
-$ write sys$output "Creating CA for TSA tests..."
-$ call create_ca
-$
-$ write sys$output "Creating tsa_cert1.pem TSA server cert..."
-$ call create_tsa_cert 1 "tsa_cert"
-$
-$ write sys$output "Creating tsa_cert2.pem non-TSA server cert..."
-$ call create_tsa_cert 2 "non_tsa_cert"
-$
-$ write sys$output "Creating req1.req time stamp request for file testtsa..."
-$ call create_time_stamp_request1
-$
-$ write sys$output "Printing req1.req..."
-$ call print_request "req1.tsq"
-$
-$ write sys$output "Generating valid response for req1.req..."
-$ call create_time_stamp_response "req1.tsq" "resp1.tsr" "tsa_config1"
-$
-$ write sys$output "Printing response..."
-$ call print_response "resp1.tsr"
-$
-$ write sys$output "Verifying valid response..."
-$ call verify_time_stamp_response "req1.tsq" "resp1.tsr" "[-]testtsa.com"
-$
-$ write sys$output "Verifying valid token..."
-$ call verify_time_stamp_token "req1.tsq" "resp1.tsr" "[-]testtsa.com"
-$
-$ ! The tests below are commented out, because invalid signer certificates
-$ ! can no longer be specified in the config file.
-$
-$ ! write sys$output "Generating _invalid_ response for req1.req..."
-$ ! call create_time_stamp_response "req1.tsq" "resp1_bad.tsr" "tsa_config2"
-$
-$ ! write sys$output "Printing response..."
-$ ! call print_response "resp1_bad.tsr"
-$
-$ ! write sys$output "Verifying invalid response, it should fail..."
-$ ! call verify_time_stamp_response_fail "req1.tsq" "resp1_bad.tsr"
-$
-$ write sys$output "Creating req2.req time stamp request for file testtsa..."
-$ call create_time_stamp_request2
-$
-$ write sys$output "Printing req2.req..."
-$ call print_request "req2.tsq"
-$
-$ write sys$output "Generating valid response for req2.req..."
-$ call create_time_stamp_response "req2.tsq" "resp2.tsr" "tsa_config1"
-$
-$ write sys$output "Checking '-token_in' and '-token_out' options with '-reply'..."
-$ call time_stamp_response_token_test "req2.tsq" "resp2.tsr"
-$
-$ write sys$output "Printing response..."
-$ call print_response "resp2.tsr"
-$
-$ write sys$output "Verifying valid response..."
-$ call verify_time_stamp_response "req2.tsq" "resp2.tsr" "[-]testtsa.com"
-$
-$ write sys$output "Verifying response against wrong request, it should fail..."
-$ call verify_time_stamp_response_fail "req1.tsq" "resp2.tsr"
-$
-$ write sys$output "Verifying response against wrong request, it should fail..."
-$ call verify_time_stamp_response_fail "req2.tsq" "resp1.tsr"
-$
-$ write sys$output "Creating req3.req time stamp request for file CAtsa.cnf..."
-$ call create_time_stamp_request3
-$
-$ write sys$output "Printing req3.req..."
-$ call print_request "req3.tsq"
-$
-$ write sys$output "Verifying response against wrong request, it should fail..."
-$ call verify_time_stamp_response_fail "req3.tsq" "resp1.tsr"
-$
-$ write sys$output "Cleaning up..."
-$ call clean_up_dir
-$
-$ set on
-$
-$ exit
projects / cassiopeia.git / blobdiff