summaryrefslogtreecommitdiff
path: root/tests
diff options
context:
space:
mode:
Diffstat (limited to 'tests')
-rwxr-xr-x[-rw-r--r--]tests/tools/tools.sh506
1 files changed, 320 insertions, 186 deletions
diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
index 7cf1ef73f..19d8b1903 100644..100755
--- a/tests/tools/tools.sh
+++ b/tests/tools/tools.sh
@@ -1,4 +1,4 @@
-#! /bin/bash
+#! /bin/bash
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -8,7 +8,7 @@
#
# mozilla/security/nss/tests/tools/tools.sh
#
-# Script to test basic functionality of NSS tools
+# Script to test basic functionality of NSS tools
#
# needs to work on all Unix and Windows platforms
#
@@ -23,29 +23,20 @@
########################################################################
export pkcs12v2pbeWithSha1And128BitRc4=\
-"PKCS #12 V2 PBE With SHA-1 and 128 Bit RC4"
+"PKCS #12 V2 PBE With SHA-1 And 128 Bit RC4"
export pkcs12v2pbeWithSha1And40BitRc4=\
-"PKCS #12 V2 PBE With SHA-1 and 40 Bit RC4"
+"PKCS #12 V2 PBE With SHA-1 And 40 Bit RC4"
export pkcs12v2pbeWithSha1AndTripleDESCBC=\
-"PKCS #12 V2 PBE With SHA-1 and 3KEY Triple DES-CBC"
+"PKCS #12 V2 PBE With SHA-1 And 3KEY Triple DES-CBC"
export pkcs12v2pbeWithSha1And128BitRc2Cbc=\
-"PKCS #12 V2 PBE With SHA-1 and 128 Bit RC2 CBC"
+"PKCS #12 V2 PBE With SHA-1 And 128 Bit RC2 CBC"
export pkcs12v2pbeWithSha1And40BitRc2Cbc=\
-"PKCS #12 V2 PBE With SHA-1 and 40 Bit RC2 CBC"
+"PKCS #12 V2 PBE With SHA-1 And 40 Bit RC2 CBC"
- export pkcs12v2pbeWithMd2AndDESCBC=\
-"PKCS #5 Password Based Encryption with MD2 and DES-CBC"
-
- export pkcs12v2pbeWithMd5AndDESCBC=\
-"PKCS #5 Password Based Encryption with MD5 and DES-CBC"
-
- export pkcs12v2pbeWithSha1AndDESCBC=\
-"PKCS #5 Password Based Encryption with SHA-1 and DES-CBC"
-
export pkcs5pbeWithMD2AndDEScbc=\
"PKCS #5 Password Based Encryption with MD2 and DES-CBC"
@@ -55,8 +46,28 @@
export pkcs5pbeWithSha1AndDEScbc=\
"PKCS #5 Password Based Encryption with SHA-1 and DES-CBC"
+ # if we change the defaults in pk12util, update these variables
+ export CERT_ENCRYPTION_DEFAULT="AES-128-CBC"
+ export KEY_ENCRYPTION_DEFAULT="AES-256-CBC"
+ export HASH_DEFAULT="SHA-256"
+
+ export PKCS5v1_PBE_CIPHERS="${pkcs5pbeWithMD2AndDEScbc},\
+${pkcs5pbeWithMD5AndDEScbc},\
+${pkcs5pbeWithSha1AndDEScbc}"
+ export PKCS12_PBE_CIPHERS="${pkcs12v2pbeWithSha1And128BitRc4},\
+${pkcs12v2pbeWithSha1And40BitRc4},\
+${pkcs12v2pbeWithSha1AndTripleDESCBC},\
+${pkcs12v2pbeWithSha1And128BitRc2Cbc},\
+${pkcs12v2pbeWithSha1And40BitRc2Cbc}"
+ export PKCS5v2_PBE_CIPHERS="RC2-CBC,DES-EDE3-CBC,AES-128-CBC,AES-192-CBC,\
+AES-256-CBC,CAMELLIA-128-CBC,CAMELLIA-192-CBC,CAMELLIA-256-CBC"
+ export PBE_CIPHERS="${PKCS5v1_PBE_CIPHERS},${PKCS12_PBE_CIPHERS},${PKCS5v2_PBE_CIPHERS}"
+ export PBE_CIPHERS_CLASSES="${pkcs5pbeWithSha1AndDEScbc},\
+${pkcs12v2pbeWithSha1AndTripleDESCBC},AES-256-CBC,default"
+ export PBE_HASH="SHA-1,SHA-224,SHA-256,SHA-384,SHA-512,default"
+
############################## tools_init ##############################
-# local shell function to initialize this script
+# local shell function to initialize this script
########################################################################
tools_init()
{
@@ -117,7 +128,7 @@ list_p12_file()
{
echo "$SCRIPTNAME: Listing Alice's pk12 file"
echo "pk12util -l ${1} -w ${R_PWFILE}"
-
+
${BINDIR}/pk12util -l ${1} -w ${R_PWFILE} 2>&1
ret=$?
html_msg $ret 0 "Listing ${1} (pk12util -l)"
@@ -131,105 +142,70 @@ import_p12_file()
{
echo "$SCRIPTNAME: Importing Alice's pk12 ${1} file"
echo "pk12util -i ${1} -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE}"
-
+
${BINDIR}/pk12util -i ${1} -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE} 2>&1
ret=$?
html_msg $ret 0 "Importing ${1} (pk12util -i)"
check_tmpfile
}
-########################################################################
-# Export the key and cert to a p12 file using default ciphers
-########################################################################
-export_with_default_ciphers()
-{
- echo "$SCRIPTNAME: Exporting Alice's key & cert with [default:default] (pk12util -o)"
- echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\"
- echo " -k ${R_PWFILE} -w ${R_PWFILE}"
- ${BINDIR}/pk12util -o Alice.p12 -n "Alice" -d ${P_R_ALICEDIR} \
- -k ${R_PWFILE} -w ${R_PWFILE} 2>&1
- ret=$?
- html_msg $ret 0 "Exporting Alices's key & cert with [default:default] (pk12util -o)"
- check_tmpfile
- return $ret
-}
########################################################################
-# Exports key/cert to a p12 file, the key encryption cipher is specified
-# and the cert encryption cipher is blank for default.
+# Export the key and cert from the specified p12 file
########################################################################
-export_with_key_cipher()
+export_p12_file()
{
- # $1 key encryption cipher
- echo "$SCRIPTNAME: Exporting with [${1}:default]"
- echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\"
- echo " -k ${R_PWFILE} -w ${R_PWFILE} -c ${1}"
- ${BINDIR}/pk12util -o Alice.p12 -n "Alice" -d ${P_R_ALICEDIR} \
- -k ${R_PWFILE} -w ${R_PWFILE} -c "${1}" 2>&1
- ret=$?
- html_msg $ret 0 "Exporting with [${1}:default] (pk12util -o)"
- check_tmpfile
- return $ret
-}
-
-########################################################################
-# Exports key/cert to a p12 file, the key encryption cipher is left
-# empty for default and the cert encryption cipher is specified.
-########################################################################
-export_with_cert_cipher()
-{
- # $1 certificate encryption cipher
- echo "$SCRIPTNAME: Exporting with [default:${1}]"
- echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\"
- echo " -k ${R_PWFILE} -w ${R_PWFILE} -C ${1}"
- ${BINDIR}/pk12util -o Alice.p12 -n "Alice" -d ${P_R_ALICEDIR} \
- -k ${R_PWFILE} -w ${R_PWFILE} -C "${1}" 2>&1
- ret=$?
- html_msg $ret 0 "Exporting with [default:${1}] (pk12util -o)"
- check_tmpfile
- return $ret
-}
+ # $1 p12 file
+ # $2 cert to export
+ # $3 certdb
+ # $4 key encryption cipher or "default"
+ # $5 certificate encryption cipher or "default"
+ # $6 hash algorithm or "default"
+ KEY_CIPHER_OPT="-c"
+ KEY_CIPHER="${4}"
+ CERT_CIPHER_OPT="-C"
+ CERT_CIPHER="${5}"
+ HASH_ALG_OPT="-M"
+ HASH_ALG="${6}"
+
+ if [ "${KEY_CIPHER}" = "default" ]; then
+ KEY_CIPHER_OPT=""
+ KEY_CIPHER=""
+ fi
+ if [ "${CERT_CIPHER}" = "default" ]; then
+ CERT_CIPHER_OPT=""
+ CERT_CIPHER=""
+ fi
+ if [ "${HASH_ALG}" = "default" ]; then
+ HASH_ALG_OPT=""
+ HASH_ALG=""
+ fi
-########################################################################
-# Exports key/cert to a p12 file, both the key encryption cipher and
-# the cert encryption cipher are specified.
-########################################################################
-export_with_both_key_and_cert_cipher()
-{
- # $1 key encryption cipher or ""
- # $2 certificate encryption cipher or ""
-
- echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\"
- echo " -k ${R_PWFILE} -w ${R_PWFILE} -c ${1} -C ${2}"
- ${BINDIR}/pk12util -o Alice.p12 -n Alice -d ${P_R_ALICEDIR} \
+ echo "pk12util -o \"${1}\" -n \"${2}\" -d \"${3}\" \\"
+ echo " -k ${R_PWFILE} -w ${R_PWFILE} \\"
+ echo " ${KEY_CIPHER_OPT} \"${KEY_CIPHER}\" \\"
+ echo " ${CERT_CIPHER_OPT} \"${CERT_CIPHER}\" \\"
+ echo " ${HASH_ALG_OPT} \"${HASH_ALG}\""
+ ${BINDIR}/pk12util -o "${1}" -n "${2}" -d "${3}" \
-k ${R_PWFILE} -w ${R_PWFILE} \
- -c "${1}" -C "${2}" 2>&1
- ret=$?
- html_msg $ret 0 "Exporting with [${1}:${2}] (pk12util -o)"
+ ${KEY_CIPHER_OPT} "${KEY_CIPHER}" \
+ ${CERT_CIPHER_OPT} "${CERT_CIPHER}" \
+ ${HASH_ALG_OPT} "${HASH_ALG}" 2>&1
+ ret=$?
+ html_msg $ret 0 "Exporting with [${4}:${5}:${6}] (pk12util -o)"
check_tmpfile
+ verify_p12 "${1}" "${4}" "${5}" "${6}"
return $ret
}
########################################################################
-# Exports key and cert to a p12 file, both the key encryption cipher
-# and the cert encryption cipher are specified. The key and cert are
-# imported and the p12 file is listed
+# Exports key and cert to a p12 file, the key encryption cipher,
+# the cert encryption cipher, and/or the hash algorithm are specified.
+# The key and cert are imported and the p12 file is listed
########################################################################
export_list_import()
{
- # $1 key encryption cipher
- # $2 certificate encryption cipher
-
- if [ "${1}" != "DEFAULT" -a "${2}" != "DEFAULT" ]; then
- export_with_both_key_and_cert_cipher "${1}" "${2}"
- elif [ "${1}" != "DEFAULT" -a "${2}" = "DEFAULT" ]; then
- export_with_key_cipher "${1}"
- elif [ "${1}" = "DEFAULT" -a "${2}" != "DEFAULT" ]; then
- export_with_cert_cipher "${2}"
- else
- export_with_default_ciphers
- fi
-
+ export_p12_file Alice.p12 Alice "${P_R_ALICEDIR}" "${@}"
list_p12_file Alice.p12
import_p12_file Alice.p12
}
@@ -239,20 +215,17 @@ export_list_import()
# List the contents of and import from the p12 file.
########################################################################
tools_p12_export_list_import_all_pkcs5pbe_ciphers()
-{
- # specify each on key and cert cipher
- for key_cipher in "${pkcs5pbeWithMD2AndDEScbc}" \
- "${pkcs5pbeWithMD5AndDEScbc}" \
- "${pkcs5pbeWithSha1AndDEScbc}"\
- "DEFAULT"; do
- for cert_cipher in "${pkcs5pbeWithMD2AndDEScbc}" \
- "${pkcs5pbeWithMD5AndDEScbc}" \
- "${pkcs5pbeWithSha1AndDEScbc}" \
- "DEFAULT"\
- "none"; do
- export_list_import "${key_cipher}" "${cert_cipher}"
- done
+{
+ local saveIFS="${IFS}"
+ IFS=,
+ for key_cipher in ${PKCS5v1_PBE_CIPHERS} default; do
+ for cert_cipher in ${PKCS5v1_PBE_CIPHERS} default none; do
+ for hash in ${PBE_HASH}; do
+ export_list_import "${key_cipher}" "${cert_cipher}" "${hash}"
+ done
+ done
done
+ IFS="${saveIFS}"
}
########################################################################
@@ -261,36 +234,16 @@ tools_p12_export_list_import_all_pkcs5pbe_ciphers()
########################################################################
tools_p12_export_list_import_all_pkcs5v2_ciphers()
{
- # These should pass
- for key_cipher in\
- RC2-CBC \
- DES-EDE3-CBC \
- AES-128-CBC \
- AES-192-CBC \
- AES-256-CBC \
- CAMELLIA-128-CBC \
- CAMELLIA-192-CBC \
- CAMELLIA-256-CBC; do
-
-#---------------------------------------------------------------
-# Bug 452464 - pk12util -o fails when -C option specifies
-# Camellia ciphers
-# FIXME Restore these to the list
-# CAMELLIA-128-CBC, \
-# CAMELLIA-192-CBC, \
-# CAMELLIA-256-CBC, \
-# when 452464 is fixed
-#---------------------------------------------------------------
- for cert_cipher in \
- RC2-CBC \
- DES-EDE3-CBC \
- AES-128-CBC \
- AES-192-CBC \
- AES-256-CBC \
- none; do
- export_list_import ${key_cipher} ${cert_cipher}
- done
+ local saveIFS="${IFS}"
+ IFS=,
+ for key_cipher in ${PKCS5v2_PBE_CIPHERS} default; do
+ for cert_cipher in ${PKCS5v2_PBE_CIPHERS} default none; do
+ for hash in ${PBE_HASH}; do
+ export_list_import "${key_cipher}" "${cert_cipher}" "${hash}"
+ done
+ done
done
+ IFS="${saveIFS}"
}
########################################################################
@@ -298,36 +251,50 @@ tools_p12_export_list_import_all_pkcs5v2_ciphers()
# List the contents of and import from the p12 file.
########################################################################
tools_p12_export_list_import_all_pkcs12v2pbe_ciphers()
-{
-#---------------------------------------------------------------
-# Bug 452471 - pk12util -o fails when -c option specifies pkcs12v2 PBE ciphers
-# FIXME - Restore these to the list
-# "${pkcs12v2pbeWithSha1And128BitRc4}" \
-# "${pkcs12v2pbeWithSha1And40BitRc4}" \
-# "${pkcs12v2pbeWithSha1AndTripleDESCBC}" \
-# "${pkcs12v2pbeWithSha1And128BitRc2Cbc}" \
-# "${pkcs12v2pbeWithSha1And40BitRc2Cbc}" \
-# "${pkcs12v2pbeWithMd2AndDESCBC}" \
-# "${pkcs12v2pbeWithMd5AndDESCBC}" \
-# "${pkcs12v2pbeWithSha1AndDESCBC}" \
-# "DEFAULT"; do
-# when 452471 is fixed
-#---------------------------------------------------------------
-# for key_cipher in \
- key_cipher="DEFAULT"
- for cert_cipher in "${pkcs12v2pbeWithSha1And128BitRc4}" \
- "${pkcs12v2pbeWithSha1And40BitRc4}" \
- "${pkcs12v2pbeWithSha1AndTripleDESCBC}" \
- "${pkcs12v2pbeWithSha1And128BitRc2Cbc}" \
- "${pkcs12v2pbeWithSha1And40BitRc2Cbc}" \
- "${pkcs12v2pbeWithMd2AndDESCBC}" \
- "${pkcs12v2pbeWithMd5AndDESCBC}" \
- "${pkcs12v2pbeWithSha1AndDESCBC}" \
- "DEFAULT"\
- "none"; do
- export_list_import "${key_cipher}" "${cert_cipher}"
- done
- #done
+{
+ local saveIFS="${IFS}"
+ IFS=,
+ for key_cipher in ${PKCS12_PBE_CIPHERS} ${PKCS5v1_PBE_CIPHERS} default; do
+ for cert_cipher in ${PKCS12_PBE_CIPHERS} ${PKCS5v1_PBE_CIPHERS} default none; do
+ for hash in ${PBE_HASH}; do
+ export_list_import "${key_cipher}" "${cert_cipher}" "${hash}"
+ done
+ done
+ done
+ IFS="${saveIFS}"
+}
+
+########################################################################
+# Spot check all ciphers.
+# using the traditional tests, we wind up running almost 1300 tests.
+# This isn't too bad for debug builds in which the interator is set to 1000.
+# for optimized builds, the iterator is set to 60000, which means a 30
+# minute test will now take more than 2 hours. This tests most combinations
+# and results in only about 300 tests. We are stil testing all ciphers
+# for both key and cert encryption, and we are testing them against
+# one of each class of cipher (pkcs5v1, pkcs5v2, pkcs12).
+########################################################################
+tools_p12_export_list_import_most_ciphers()
+{
+ local saveIFS="${IFS}"
+ IFS=,
+ for cipher in ${PBE_CIPHERS}; do
+ for class in ${PBE_CIPHERS_CLASSES}; do
+ # we'll test the case of cipher == class below the for loop
+ if [ "${cipher}" != "${class}" ]; then
+ export_list_import "${class}" "${cipher}" "SHA-1"
+ export_list_import "${cipher}" "${class}" "SHA-256"
+ fi
+ done
+ export_list_import "${cipher}" "none" "SHA-224"
+ export_list_import "${cipher}" "${cipher}" "SHA-384"
+ done
+ for class in ${PBE_CIPHERS_CLASSES}; do
+ for hash in ${PBE_HASH}; do
+ export_list_import "${class}" "${class}" "${hash}"
+ done
+ done
+ IFS="${saveIFS}"
}
#########################################################################
@@ -337,28 +304,28 @@ tools_p12_export_with_none_ciphers()
{
# use none as the key encryption algorithm default for the cert one
# should fail
-
+
echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\"
- echo " -k ${R_PWFILE} -w ${R_PWFILE} -c none"
+ echo " -k ${R_PWFILE} -w ${R_PWFILE} -c none"
${BINDIR}/pk12util -o Alice.p12 -n Alice -d ${P_R_ALICEDIR} \
-k ${R_PWFILE} -w ${R_PWFILE} \
- -c none 2>&1
+ -c none 2>&1
ret=$?
- html_msg $ret 30 "Exporting with [none:default] (pk12util -o)"
+ html_msg $ret 30 "Exporting with [none:default:default] (pk12util -o)"
check_tmpfile
# use default as the key encryption algorithm none for the cert one
# should pass
-
+
echo "pk12util -o Alice.p12 -n \"Alice\" -d ${P_R_ALICEDIR} \\"
- echo " -k ${R_PWFILE} -w ${R_PWFILE} -C none"
+ echo " -k ${R_PWFILE} -w ${R_PWFILE} -C none"
${BINDIR}/pk12util -o Alice.p12 -n Alice -d ${P_R_ALICEDIR} \
-k ${R_PWFILE} -w ${R_PWFILE} \
- -C none 2>&1
+ -C none 2>&1
ret=$?
- html_msg $ret 0 "Exporting with [default:none] (pk12util -o)"
+ html_msg $ret 0 "Exporting with [default:none:default] (pk12util -o)"
check_tmpfile
-
+ verify_p12 Alice.p12 "default" "none" "default"
}
#########################################################################
@@ -394,17 +361,18 @@ tools_p12_export_with_invalid_ciphers()
tools_p12_export_list_import_with_default_ciphers()
{
echo "$SCRIPTNAME: Exporting Alice's email cert & key - default ciphers"
-
- export_list_import "DEFAULT" "DEFAULT"
+
+ export_list_import "default" "default" "default"
echo "$SCRIPTNAME: Exporting Alice's email EC cert & key---------------"
echo "pk12util -o Alice-ec.p12 -n \"Alice-ec\" -d ${P_R_ALICEDIR} -k ${R_PWFILE} \\"
echo " -w ${R_PWFILE}"
${BINDIR}/pk12util -o Alice-ec.p12 -n "Alice-ec" -d ${P_R_ALICEDIR} -k ${R_PWFILE} \
- -w ${R_PWFILE} 2>&1
+ -w ${R_PWFILE} 2>&1
ret=$?
html_msg $ret 0 "Exporting Alice's email EC cert & key (pk12util -o)"
check_tmpfile
+ verify_p12 Alice-ec.p12 "default" "default" "default"
echo "$SCRIPTNAME: Importing Alice's email EC cert & key --------------"
echo "pk12util -i Alice-ec.p12 -d ${P_R_COPYDIR} -k ${R_PWFILE} -w ${R_PWFILE}"
@@ -460,9 +428,18 @@ tools_p12_import_rsa_pss_private_key()
tools_p12()
{
tools_p12_export_list_import_with_default_ciphers
- tools_p12_export_list_import_all_pkcs5v2_ciphers
- tools_p12_export_list_import_all_pkcs5pbe_ciphers
- tools_p12_export_list_import_all_pkcs12v2pbe_ciphers
+ # optimized builds have a larger iterator, so they can't run as many
+ # pkcs12 tests and complete in a reasonable time. Use the iterateration
+ # count from the previous tests to determine how many tests
+ # we can run.
+ iteration_count=$(pp -t p12 -i Alice-ec.p12 | grep "Iterations: " | sed -e 's;.*Iterations: ;;' -e 's;(.*).*;;')
+ echo "Iteration count=${iteration_count}"
+ if [ -n "${iteration_count}" -a ${iteration_count} -le 10000 ]; then
+ tools_p12_export_list_import_all_pkcs5v2_ciphers
+ tools_p12_export_list_import_all_pkcs12v2pbe_ciphers
+ else
+ tools_p12_export_list_import_most_ciphers
+ fi
tools_p12_export_with_none_ciphers
tools_p12_export_with_invalid_ciphers
tools_p12_import_old_files
@@ -473,7 +450,7 @@ tools_p12()
############################## tools_sign ##############################
# local shell function pk12util uses a hardcoded tmp file, if this exists
-# and is owned by another user we don't get reasonable errormessages
+# and is owned by another user we don't get reasonable errormessages
########################################################################
check_tmpfile()
{
@@ -484,6 +461,163 @@ check_tmpfile()
}
############################## tools_sign ##############################
+# make sure the generated p12 file has the characteristics we expected
+########################################################################
+verify_p12()
+{
+ KEY_ENCRYPTION=$(map_cipher "${2}" "${KEY_ENCRYPTION_DEFAULT}")
+ CERT_ENCRYPTION=$(map_cipher "${3}" "${CERT_ENCRYPTION_DEFAULT}")
+ HASH=$(map_cipher "${4}" "${HASH_DEFAULT}")
+
+ STATE="NOBAGS" # state records if we are in the key or cert bag
+ CERT_ENCRYPTION_NOT_FOUND=1
+ KEY_ENCRYPTION_NOT_FOUND=1
+ CERT_ENCRYPTION_FAIL=0
+ KEY_ENCRYPTION_FAIL=0
+ HASH_FAIL=0
+ TMP=$(mktemp /tmp/p12Verify.XXXXXX)
+ which pk12util
+ local saveIFS="${IFS}"
+ IFS=" \
+"
+ # use pp to dump the pkcs12 file, only the unencrypted portions are visible
+ # if there are multiple entries, we fail if any of those entries have the
+ # wrong encryption. We also fail if we can't find any encryption info.
+ # Use a file rather than a pipe so that while do can modify our variables.
+ # We're only interested in extracting the encryption algorithms are here,
+ # p12util -l will verify that decryption works properly.
+ pp -t pkcs12 -i ${1} -o ${TMP}
+ while read line ; do
+ # first up: if we see an unencrypted key bag, then we know that the key
+ # was unencrypted (NOTE: pk12util currently can't generate these kinds of
+ # files).
+ if [[ "${line}" =~ "Bag "[0-9]+" ID: PKCS #12 V1 Key Bag" ]]; then
+ KEY_ENCRYPTION_NOT_FOUND=0
+ if [ "${KEY_ENCRYPTION}" != "none" ]; then
+ KEY_ENCRYPTION_FAIL=1
+ echo "--Key encryption mismatch: expected \"${KEY_ENCRYPTION}\" found \"none\""
+ fi
+ continue
+ fi
+ # if we find the the Cert Bag, then we know that the certificate was not
+ # encrypted
+ if [[ "${line}" =~ "Bag "[0-9]+" ID: PKCS #12 V1 Cert Bag" ]]; then
+ CERT_ENCRYPTION_NOT_FOUND=0
+ if [ "${CERT_ENCRYPTION}" != "none" ]; then
+ CERT_ENCRYPTION_FAIL=1
+ echo "--Cert encryption mismatch: expected \"${CERT_ENCRYPTION}\" found \"none\""
+ fi
+ continue
+ fi
+ # we found the shrouded key bag, the next encryption informtion should be
+ # for the key.
+ if [[ "${line}" =~ "Bag "[0-9]+" ID: PKCS #12 V1 PKCS8 Shrouded Key Bag" ]]; then
+ STATE="KEY"
+ continue
+ fi
+ # If we found PKCS #7 Encrypted Data, it must be the encrypted certificate
+ # (well it could be any encrypted certificate, or a crl, but in p12util
+ # they will all have the same encryption value
+ if [[ "${line}" = "PKCS #7 Encrypted Data:" ]]; then
+ STATE="CERT"
+ continue
+ fi
+ # check the Mac
+ if [[ "${line}" =~ "Mac Digest Algorithm ID: ".* ]]; then
+ MAC="${line##Mac Digest Algorithm ID: }"
+ if [ "${MAC}" != "${HASH}" ]; then
+ HASH_FAIL=1
+ echo "--Mac Hash mismatch: expected \"${HASH}\" found \"${MAC}\""
+ fi
+ fi
+ # check the KDF
+ if [[ "${line}" =~ "KDF algorithm: ".* ]]; then
+ KDF="${line##KDF algorithm: }"
+ if [ "${KDF}" != "HMAC ${HASH}" ]; then
+ HASH_FAIL=1
+ echo "--KDF Hash mismatch: expected \"HMAC ${HASH}\" found \"${KDF}\""
+ fi
+ fi
+ # Content Encryption Algorithm is the PKCS #5 algorithm ID.
+ if [[ "${line}" =~ .*"Encryption Algorithm: ".* ]]; then
+ # Strip the [Content ]EncryptionAlgorithm
+ ENCRYPTION="${line##Content }"
+ ENCRYPTION="${ENCRYPTION##Encryption Algorithm: }"
+ # If that algorithm id is PKCS #5 V2, then skip forward looking
+ # for the Cipher: field.
+ if [[ "${ENCRYPTION}" =~ "PKCS #5 Password Based Encryption v2"\ * ]]; then
+ continue;
+ fi
+ case ${STATE} in
+ "KEY")
+ KEY_ENCRYPTION_NOT_FOUND=0
+ if [ "${KEY_ENCRYPTION}" != "${ENCRYPTION}" ]; then
+ KEY_ENCRYPTION_FAIL=1
+ echo "--Key encryption mismatch: expected \"${KEY_ENCRYPTION}\" found \"${ENCRYPTION}\""
+ fi
+ ;;
+ "CERT")
+ CERT_ENCRYPTION_NOT_FOUND=0
+ if [ "${CERT_ENCRYPTION}" != "${ENCRYPTION}" ]; then
+ CERT_ENCRYPTION_FAIL=1
+ echo "--Cert encryption mismatch: expected \"${CERT_ENCRYPTION}\" found \"${ENCRYPTION}\""
+ fi
+ ;;
+ esac
+ fi
+ # handle the PKCS 5 case
+ if [[ "${line}" =~ "Cipher: ".* ]]; then
+ ENCRYPTION="${line#Cipher: }"
+ case ${STATE} in
+ "KEY")
+ KEY_ENCRYPTION_NOT_FOUND=0
+ if [ "${KEY_ENCRYPTION}" != "${ENCRYPTION}" ]; then
+ KEY_ENCRYPTION_FAIL=1
+ echo "--Key encryption mismatch: expected \"${KEY_ENCRYPTION}\" found \"${ENCRYPTION}\""
+ fi
+ ;;
+ "CERT")
+ CERT_ENCRYPTION_NOT_FOUND=0
+ if [ "${CERT_ENCRYPTION}" != "${ENCRYPTION}" ]; then
+ CERT_ENCRYPTION_FAIL=1
+ echo "--Cert encryption mismatch: expected \"${CERT_ENCRYPTION}\" found \"${ENCRYPTION}\""
+ fi
+ ;;
+ esac
+ fi
+ done < ${TMP}
+ IFS="${saveIFS}"
+ # we've scanned the file, set the return value to a combination of
+ # KEY and CERT state variables. If everything is as expected, they should
+ # add up to 0.
+ ret=$((${HASH_FAIL} * 10000 + ${KEY_ENCRYPTION_FAIL} * 1000 + ${KEY_ENCRYPTION_NOT_FOUND} * 100 + ${CERT_ENCRYPTION_FAIL} * 10 + ${CERT_ENCRYPTION_NOT_FOUND}))
+ rm -r ${TMP}
+ html_msg $ret 0 "Verifying p12 file generated with [${2}:${3}:${4}]"
+}
+
+#
+# this handles any mapping we need from requested cipher to
+# actual cipher. For instance ciphers which already have
+# PKCS 5 v1 PBE will be mapped to those pbes by pk12util.
+map_cipher()
+{
+ if [ "${1}" = "default" ]; then
+ echo "${2}"
+ return
+ fi
+ case "${1}" in
+ # these get mapped to the PKCS5 v1 or PKCS 12 attributes, not PKCS 5v2
+ RC2-CBC)
+ echo "${pkcs12v2pbeWithSha1And128BitRc2Cbc}"
+ return ;;
+ DES-EDE3-CBC)
+ echo "${pkcs12v2pbeWithSha1AndTripleDESCBC}"
+ return;;
+ esac
+ echo "${1}"
+}
+
+############################## tools_sign ##############################
# local shell function to test basic functionality of signtool
########################################################################
tools_sign()
@@ -554,7 +688,7 @@ tools_modutil()
}
############################## tools_cleanup ###########################
-# local shell function to finish this script (no exit since it might be
+# local shell function to finish this script (no exit since it might be
# sourced)
########################################################################
tools_cleanup()
View Lorry Controller Status