blob: 61745a9b44cb1004df6b34f2122e4f91bfb39c42 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
#!/bin/sh
. "${builddir=.}/test-init.sh"
teardown()
{
for x in $TD; do
if [ -d $x ]; then
rmdir $x
elif [ -f $x ]; then
rm $x
fi
done
TD=""
}
openssl_quiet()
(
command='/Generating a|-----|^[.+]+$|writing new private key/d'
exec 3>&1
openssl $@ 2>&1 >&3 3>&- | sed -r "$command" 3>&-
)
setup()
{
# Parse the trust paths
oldifs="$IFS"
IFS=:
set $with_trust_paths
IFS="$oldifs"
if [ ! -d $1 ]; then
skip "$1 is not a directory"
return
fi
SOURCE_1=$1
if [ $# -lt 2 ]; then
warning "certain tests neutered if only 1 trust path: $with_trust_paths"
SOURCE_2=$1
else
SOURCE_2=$2
fi
# Make a temporary directory
dir=$(mktemp -d)
cd $dir
CLEANUP="$dir $TD"
# Generate a unique identifier
CERT_1_CN=test_$(dd if=/dev/urandom count=40 bs=1 status=none | base64 | tr -d '+/=')
CERT_2_CN=test_$(dd if=/dev/urandom count=40 bs=1 status=none | base64 | tr -d '+/=')
CERT_3_CN=test_$(dd if=/dev/urandom count=40 bs=1 status=none | base64 | tr -d '+/=')
# Generate relevant certificates
openssl_quiet req -x509 -newkey rsa:512 -keyout /dev/null -days 3 -nodes \
-out cert_1.pem -subj /CN=$CERT_1_CN
openssl_quiet req -x509 -newkey rsa:512 -keyout /dev/null -days 3 -nodes \
-out cert_2.pem -subj /CN=$CERT_2_CN
openssl_quiet req -x509 -newkey rsa:512 -keyout /dev/null -days 3 -nodes \
-out cert_3.pem -subj /CN=$CERT_3_CN
TD="cert_1.pem cert_2.pem cert_3.pem $TD"
mkdir -p $SOURCE_1/anchors
cp cert_1.pem $SOURCE_1/anchors/
mkdir -p $SOURCE_2/anchors
cp cert_2.pem $SOURCE_2/anchors/
cp cert_3.pem $SOURCE_2/anchors/
TD="$SOURCE_1/anchors/cert_1.pem $SOURCE_2/anchors/cert_2.pem $SOURCE_2/anchors/cert_3.pem $TD"
}
test_extract()
{
trust extract --filter=ca-anchors --format=pem-bundle \
--purpose=server-auth --comment \
extract-test.pem
assert_contains extract-test.pem $CERT_1_CN
assert_contains extract-test.pem $CERT_2_CN
assert_contains extract-test.pem $CERT_3_CN
}
test_blacklist()
{
mkdir -p $SOURCE_1/blacklist
cp cert_3.pem $SOURCE_1/blacklist
TD="$SOURCE_1/blacklist/cert_3.pem $TD"
trust extract --filter=ca-anchors --format=pem-bundle \
--purpose=server-auth --comment \
blacklist-test.pem
assert_contains blacklist-test.pem $CERT_1_CN
assert_not_contains blacklist-test.pem $CERT_3_CN
}
run test_extract test_blacklist
|
