Bug 473790 - Script to configure OCSPD. r=alexei

git-svn-id: svn://10.0.0.236/trunk@256383 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/security/nss/tests/chains/ocspd-config/ocspd-certs.sh

@@ -0,0 +1,109 @@
+#!/bin/bash
+
+DATA_DIR=$1
+OCSP_DIR=$2
+CERT_DIR=$3
+
+TEST_PWD="nssnss"
+CONF_TEMPLATE="ocspd.conf.template"
+
+convert_cert()
+{
+    CERT_NAME=$1
+    CERT_SIGNER=$2
+
+    openssl x509 -in ${DATA_DIR}/${CERT_NAME}${CERT_SIGNER}.der -inform DER -out ${DATA_DIR}/${CERT_NAME}.pem -outform PEM
+}
+
+convert_crl()
+{
+    CRL_NAME=$1
+
+    openssl crl -in ${DATA_DIR}/${CRL_NAME}.crl -inform DER -out ${DATA_DIR}/${CRL_NAME}crl.pem -outform PEM
+}
+
+convert_key()
+{
+    KEY_NAME=$1
+
+    pk12util -o ${DATA_DIR}/${KEY_NAME}.p12 -n ${KEY_NAME} -d ${DATA_DIR}/${KEY_NAME}DB -k ${DATA_DIR}/${KEY_NAME}DB/dbpasswd -W ${TEST_PWD}
+    openssl pkcs12 -in ${DATA_DIR}/${KEY_NAME}.p12 -out ${DATA_DIR}/${KEY_NAME}.key.tmp -passin pass:${TEST_PWD} -passout pass:${TEST_PWD}
+
+    STATUS=0
+    cat ${DATA_DIR}/${KEY_NAME}.key.tmp | while read LINE; do
+        echo "${LINE}" | grep "BEGIN RSA PRIVATE KEY" > /dev/null && STATUS=1
+        [ ${STATUS} -eq 1 ] && echo "${LINE}"
+        echo "${LINE}" | grep "END RSA PRIVATE KEY" > /dev/null && break
+    done > ${DATA_DIR}/${KEY_NAME}.key
+    
+    rm ${DATA_DIR}/${KEY_NAME}.key.tmp
+}
+
+create_conf()
+{
+    CONF_FILE=$1
+    CA=$2
+    OCSP=$3
+    PORT=$4 
+
+    cat ${CONF_TEMPLATE} | \
+        sed "s:@DIR@:${OCSP_DIR}:" | \
+        sed "s:@CA_CERT@:${DATA_DIR}/${CA}.pem:" | \
+        sed "s:@CA_CRL@:${DATA_DIR}/${CA}crl.pem:" | \
+        sed "s:@CA_KEY@:${DATA_DIR}/${CA}.key:" | \
+        sed "s:@OCSP_PID@:${OCSP}.pid:" | \
+        sed "s:@PORT@:${PORT}:" \
+        > ${CONF_FILE}
+}
+
+copy_cert()
+{
+    CERT_NAME=$1
+    CERT_SIGNER=$2
+
+    cp ${DATA_DIR}/${CERT_NAME}${CERT_SIGNER}.der ${CERT_DIR}/${CERT_NAME}.cert
+}
+
+
+copy_key()
+{
+    KEY_NAME=$1
+
+    cp ${DATA_DIR}/${KEY_NAME}.p12 ${CERT_DIR}/${KEY_NAME}.p12
+}
+
+convert_cert OCSPRoot
+convert_crl OCSPRoot
+convert_key OCSPRoot
+
+convert_cert OCSPCA1 OCSPRoot
+convert_crl OCSPCA1
+convert_key OCSPCA1
+
+convert_cert OCSPCA2 OCSPRoot
+convert_crl OCSPCA2
+convert_key OCSPCA2
+
+convert_cert OCSPCA3 OCSPRoot
+convert_crl OCSPCA3
+convert_key OCSPCA3
+
+create_conf ocspd0.conf OCSPRoot ocspd0 2600
+create_conf ocspd1.conf OCSPCA1 ocspd1 2601
+create_conf ocspd2.conf OCSPCA2 ocspd2 2602
+create_conf ocspd3.conf OCSPCA3 ocspd3 2603
+
+copy_cert OCSPRoot
+copy_cert OCSPCA1 OCSPRoot
+copy_cert OCSPCA2 OCSPRoot
+copy_cert OCSPCA3 OCSPRoot
+copy_cert OCSPEE11 OCSPCA1
+copy_cert OCSPEE12 OCSPCA1
+copy_cert OCSPEE13 OCSPCA1
+copy_cert OCSPEE14 OCSPCA1
+copy_cert OCSPEE15 OCSPCA1
+copy_cert OCSPEE21 OCSPCA2
+copy_cert OCSPEE31 OCSPCA3
+
+copy_key OCSPCA1
+

mozilla/security/nss/tests/chains/ocspd-config/ocspd.conf.template

@@ -0,0 +1,45 @@
+[ ocspd ]
+
+default_ocspd = OCSPD_default
+
+[ OCSPD_default ]
+
+dir = @DIR@
+db = $dir/index.txt
+md = sha1
+
+ca_certificate = $dir/@CA_CERT@
+ocspd_certificate = $dir/@CA_CERT@
+ocspd_key = $dir/@CA_KEY@
+pidfile = $dir/@OCSP_PID@
+
+user = nobody 
+group = nobody
+
+bind = *
+port = @PORT@
+
+max_req_size = 8192
+threads_num = 150
+max_timeout_secs = 5
+crl_auto_reload = 3600
+crl_check_validity = 600
+crl_reload_expired = yes
+response = ocsp_response
+dbms = dbms_file
+
+[ ocsp_response ]
+
+dir = @DIR@
+next_update_days = 0
+next_update_mins = 5
+
+[ dbms_file ]
+
+0.ca = @first_ca
+
+[ first_ca ]
+
+crl_url = file:///@DIR@/@CA_CRL@
+ca_url  = file:///@DIR@/@CA_CERT@
+

mozilla/security/nss/tests/chains/ocspd-config/readme

@@ -0,0 +1,16 @@
+This script is used to generate certificates used by ocspd.
+
+Some steps to run (only once - before all OCSP testing):
+1. Edit security/nss/tests/chains/scenarios/scenarios to have there only ocspd.cfg
+2. Set environment variable to run only chains tests: export NSS_TESTS=all.sh
+3. Run tests: ./all.sh
+4. Go to results directory: cd tests_results/security/${HOST}.${ID}/chains
+5. Copy ocspd-certs.sh and ocspd.conf.template to this directory
+6. Run: ./ocspd-certs.sh OCSPD ${OCSPD_ETC_DIR} ${LIBPKIX_CERTS_DIR}:
+   Example: ./ocspd-certs.sh OCSPD /export/iopr/openca-ocsp-responder/etc/ocspdPKIX \
+       ~/nss/securitytip/mozilla/security/nss/tests/libpkix/certs
+7. Copy config files and keys/certs/crls to ocspd etc directory:
+   cp *.conf /Volumes/dochinups.red.iplanet.com/openca-ocsp-responder/etc/ocspdPKIX
+   cp *.pem *.key /Volumes/dochinups.red.iplanet.com/openca-ocsp-responder/etc/ocspdPKIX/OCSPD
+8. Start ocsp deamons on dochinups (for all configs).
+

mozilla/security/nss/tests/chains/scenarios/ocspd.cfg

@@ -0,0 +1,92 @@
+scenario OCSPD
+
+#root CA
+entity OCSPRoot
+  type Root
+
+#CA - OK
+entity OCSPCA1
+  type Intermediate
+  issuer OCSPRoot
+  serial 1
+  ocsp 2600
+
+#CA - revoked
+entity OCSPCA2
+  type Intermediate
+  issuer OCSPRoot
+  serial 2
+  ocsp 2600
+
+#CA - unknown status
+entity OCSPCA3
+  type Intermediate
+  issuer OCSPRoot
+  serial 3
+  ocsp 2599
+
+#EE - OK
+entity OCSPEE11
+  type EE
+  issuer OCSPCA1
+  serial 1
+  ocsp 2601
+
+#EE - revoked on OCSP
+entity OCSPEE12
+  type EE
+  issuer OCSPCA1
+  serial 2
+  ocsp 2601
+
+#EE - revoked on CRL
+entity OCSPEE13
+  type EE
+  issuer OCSPCA1
+  serial 3
+  ocsp 2601
+
+#EE - revoked on OCSP and CRL
+entity OCSPEE14
+  type EE
+  issuer OCSPCA1
+  serial 4
+  ocsp 2601
+
+#EE - unknown status
+entity OCSPEE15
+  type EE
+  issuer OCSPCA1
+  serial 5
+  ocsp 2599
+
+#EE - pointing to revoked OCSP
+entity OCSPEE21
+  type EE
+  issuer OCSPCA2
+  serial 1
+  ocsp 2602
+
+#EE - pointing to OCSP with unknown status
+entity OCSPEE31
+  type EE
+  issuer OCSPCA3
+  serial 1
+  ocsp 2603
+
+crl OCSPRoot
+
+revoke OCSPRoot
+  serial 2
+
+crl OCSPCA1
+
+revoke OCSPCA1
+  serial 2
+
+revoke OCSPCA1
+  serial 4
+
+crl OCSPCA2
+crl OCSPCA3
+