Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow cert.sh and ssl.sh to support mixed ECC/RSA certs. Patch created by Slavomir Katuscak. r=nelson, rrelyea

Browse Source 
git-svn-id: svn://10.0.0.236/branches/NSS_3_11_BRANCH@208307 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
julien.pierre.bugs%sun.com
2006-08-24 17:56:37 +00:00
parent 72b09e6728
commit 85324c2113
4 changed files with 125 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
mozilla/security/nss/tests/cert/cert.sh
View File

@@ -333,6 +333,34 @@ cert_add_cert()
return $RET
fi
cert_log "SUCCESS: $CERTNAME's EC Cert Created"
# Generate EC certificate signed with RSA
CU_ACTION="Generate mixed EC Cert Request for $CERTNAME"
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}-ecmixed@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -k ec -q "${CURVE}" -d "${PROFILEDIR}" -f "${R_PWFILE}" \
-z "${R_NOISE_FILE}" -o req 2>&1
if [ "$RET" -ne 0 ]; then
return $RET
fi
CU_ACTION="Sign ${CERTNAME}'s EC Request with RSA"
# Avoid conflicting serial numbers with TestCA issuer by keeping
# this set far away. A smaller number risks colliding with the
# extended ssl user certificates.
NEWSERIAL=`expr ${CERTSERIAL} + 10000`
certu -C -c "TestCA" -m "$NEWSERIAL" -v 60 -d "${P_R_CADIR}" \
-i req -o "${CERTNAME}-ecmixed.cert" -f "${R_PWFILE}" "$1" 2>&1
if [ "$RET" -ne 0 ]; then
return $RET
fi
CU_ACTION="Import $CERTNAME's mixed EC Cert"
certu -A -n "${CERTNAME}-ecmixed" -t "u,u,u" -d "${PROFILEDIR}" \
-f "${R_PWFILE}" -i "${CERTNAME}-ecmixed.cert" 2>&1
if [ "$RET" -ne 0 ]; then
return $RET
fi
cert_log "SUCCESS: $CERTNAME's mixed EC Cert Created"
fi
return 0
@@ -695,6 +723,27 @@ cert_extended_ssl()
#
# done with EC certs
#
# Repeat again for mixed EC certs
#
EC_CURVE="secp256r1"
CU_ACTION="Generate mixed EC Cert Request for $CERTNAME (ext)"
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}-ecmixed@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -d "${PROFILEDIR}" -k ec -q "${EC_CURVE}" -f "${R_PWFILE}" \
-z "${R_NOISE_FILE}" -o req 2>&1
CU_ACTION="Sign ${CERTNAME}'s mixed EC Request (ext)"
cp ${CERTDIR}/req ${SERVER_CADIR}
certu -C -c "chain-2-serverCA" -m 201 -v 60 -d "${P_SERVER_CADIR}" \
-i req -o "${CERTNAME}-ecmixed.cert" -f "${R_PWFILE}" 2>&1
CU_ACTION="Import $CERTNAME's mixed EC Cert -t u,u,u (ext)"
certu -A -n "${CERTNAME}-ecmixed" -t "u,u,u" -d "${PROFILEDIR}" \
-f "${R_PWFILE}" -i "${CERTNAME}-ecmixed.cert" 2>&1
# CU_ACTION="Import Client mixed EC Root CA -t T,, for $CERTNAME (ext.)"
# certu -A -n "clientCA-ecmixed" -t "T,," -f "${R_PWFILE}" \
# -d "${PROFILEDIR}" -i "${CLIENT_CADIR}/clientCA-ecmixed.ca.cert" \
# 2>&1
fi
echo "Importing all the server's own CA chain into the servers DB"
@@ -757,6 +806,29 @@ cert_extended_ssl()
-d "${PROFILEDIR}" -i "${SERVER_CADIR}/serverCA-ec.ca.cert" 2>&1
#
# done with EC certs
#
#
# Repeat the above for mixed EC certs
#
CU_ACTION="Generate mixed EC Cert Request for $CERTNAME (ext)"
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}-ecmixed@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -d "${PROFILEDIR}" -k ec -q "${EC_CURVE}" -f "${R_PWFILE}" \
-z "${R_NOISE_FILE}" -o req 2>&1
CU_ACTION="Sign ${CERTNAME}'s mixed EC Request (ext)"
cp ${CERTDIR}/req ${CLIENT_CADIR}
certu -C -c "chain-2-clientCA" -m 301 -v 60 -d "${P_CLIENT_CADIR}" \
-i req -o "${CERTNAME}-ecmixed.cert" -f "${R_PWFILE}" 2>&1
CU_ACTION="Import $CERTNAME's mixed EC Cert -t u,u,u (ext)"
certu -A -n "${CERTNAME}-ecmixed" -t "u,u,u" -d "${PROFILEDIR}" \
-f "${R_PWFILE}" -i "${CERTNAME}-ecmixed.cert" 2>&1
# CU_ACTION="Import Server EC Root CA -t C,C,C for $CERTNAME (ext.)"
# certu -A -n "serverCA-ec" -t "C,C,C" -f "${R_PWFILE}" \
# -d "${PROFILEDIR}" -i "${SERVER_CADIR}/serverCA-ec.ca.cert" 2>&1
#
# done with mixed EC certs
#
fi

44
mozilla/security/nss/tests/ssl/ssl.sh
View File

@@ -205,6 +205,9 @@ start_selfserv()
else
ECC_OPTIONS=""
fi
if [ "$1" = "mixed" ]; then
ECC_OPTIONS="-e ${HOSTADDR}-ecmixed"
fi
echo "selfserv -D -p ${PORT} -d ${P_R_SERVERDIR} -n ${HOSTADDR} ${SERVER_OPTIONS} \\"
echo " ${ECC_OPTIONS} -w nss ${sparam} -i ${R_SERVERPID} $verbose &"
echo "selfserv started at `date`"
@@ -245,6 +248,8 @@ ssl_cov()
else
sparam="$CSHORT"
fi
mixed=0
start_selfserv # Launch the server
p=""
@@ -264,7 +269,34 @@ ssl_cov()
TLS_FLAG=""
fi
is_selfserv_alive
# These five tests need an EC cert signed with RSA
# This requires a different certificate loaded in selfserv
# due to a (current) NSS limitation of only loaded one cert
# per type so the default selfserv setup will not work.
#:C00B TLS ECDH RSA WITH NULL SHA
#:C00C TLS ECDH RSA WITH RC4 128 SHA
#:C00D TLS ECDH RSA WITH 3DES EDE CBC SHA
#:C00E TLS ECDH RSA WITH AES 128 CBC SHA
#:C00F TLS ECDH RSA WITH AES 256 CBC SHA
if [ $mixed -eq 0 ]; then
if [ "${param}" = ":C00B" -o "${param}" = ":C00C" -o "${param}" = ":C00D" -o "${param}" = ":C00E" -o "${param}" = ":C00F" ]; then
kill_selfserv
start_selfserv mixed
mixed=1
else
is_selfserv_alive
fi
else
if [ "${param}" = ":C00B" -o "${param}" = ":C00C" -o "${param}" = ":C00D" -o "${param}" = ":C00E" -o "${param}" = ":C00F" ]; then
is_selfserv_alive
else
kill_selfserv
start_selfserv
mixed=0
fi
fi
echo "tstclnt -p ${PORT} -h ${HOSTADDR} -c ${param} ${TLS_FLAG} ${CLIENT_OPTIONS} \\"
echo " -f -d ${P_R_CLIENTDIR} < ${REQUEST_FILE}"
@@ -335,7 +367,15 @@ ssl_stress()
echo "$SCRIPTNAME: skipping $testname (ECC only)"
elif [ "$ectype" != "#" ]; then
cparam=`echo $cparam | sed -e 's;_; ;g'`
start_selfserv
# This test needs the mixed cert
# Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse)
if [ "${sparam}" = "-c_:C00E" ]; then
start_selfserv mixed
else
start_selfserv
fi
if [ "`uname -n`" = "sjsu" ] ; then
echo "debugging disapering selfserv... ps -ef | grep selfserv"
ps -ef | grep selfserv

20
mozilla/security/nss/tests/ssl/sslcov.txt
View File

@@ -59,11 +59,11 @@
ECC noTLS :C008 SSL3 ECDHE ECDSA WITH 3DES EDE CBC SHA
ECC noTLS :C009 SSL3 ECDHE ECDSA WITH AES 128 CBC SHA
ECC noTLS :C00A SSL3 ECDHE ECDSA WITH AES 256 CBC SHA
# ECC noTLS :C00B SSL3 ECDH RSA WITH NULL SHA
# ECC noTLS :C00C SSL3 ECDH RSA WITH RC4 128 SHA
# ECC noTLS :C00D SSL3 ECDH RSA WITH 3DES EDE CBC SHA
# ECC noTLS :C00E SSL3 ECDH RSA WITH AES 128 CBC SHA
# ECC noTLS :C00F SSL3 ECDH RSA WITH AES 256 CBC SHA
ECC noTLS :C00B SSL3 ECDH RSA WITH NULL SHA
ECC noTLS :C00C SSL3 ECDH RSA WITH RC4 128 SHA
ECC noTLS :C00D SSL3 ECDH RSA WITH 3DES EDE CBC SHA
ECC noTLS :C00E SSL3 ECDH RSA WITH AES 128 CBC SHA
ECC noTLS :C00F SSL3 ECDH RSA WITH AES 256 CBC SHA
ECC noTLS :C010 SSL3 ECDHE RSA WITH NULL SHA
ECC noTLS :C011 SSL3 ECDHE RSA WITH RC4 128 SHA
ECC noTLS :C012 SSL3 ECDHE RSA WITH 3DES EDE CBC SHA
@@ -82,11 +82,11 @@
ECC TLS :C008 TLS ECDHE ECDSA WITH 3DES EDE CBC SHA
ECC TLS :C009 TLS ECDHE ECDSA WITH AES 128 CBC SHA
ECC TLS :C00A TLS ECDHE ECDSA WITH AES 256 CBC SHA
# ECC TLS :C00B TLS ECDH RSA WITH NULL SHA
# ECC TLS :C00C TLS ECDH RSA WITH RC4 128 SHA
# ECC TLS :C00D TLS ECDH RSA WITH 3DES EDE CBC SHA
# ECC TLS :C00E TLS ECDH RSA WITH AES 128 CBC SHA
# ECC TLS :C00F TLS ECDH RSA WITH AES 256 CBC SHA
ECC TLS :C00B TLS ECDH RSA WITH NULL SHA
ECC TLS :C00C TLS ECDH RSA WITH RC4 128 SHA
ECC TLS :C00D TLS ECDH RSA WITH 3DES EDE CBC SHA
ECC TLS :C00E TLS ECDH RSA WITH AES 128 CBC SHA
ECC TLS :C00F TLS ECDH RSA WITH AES 256 CBC SHA
ECC TLS :C010 TLS ECDHE RSA WITH NULL SHA
ECC TLS :C011 TLS ECDHE RSA WITH RC4 128 SHA
ECC TLS :C012 TLS ECDHE RSA WITH 3DES EDE CBC SHA

2
mozilla/security/nss/tests/ssl/sslstress.txt
View File

@@ -18,7 +18,7 @@
ECC 0 -c_:C009 -c_100_-C_:C009_-N_-T Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse)
ECC 0 -c_:C013 -c_1000_-C_:C013_-T Stress SSL3 ECDHE-RSA AES 128 CBC with SHA
ECC 0 -c_:C004 -2_-c_100_-C_:C004_-N Stress TLS ECDH-ECDSA AES 128 CBC with SHA (no reuse)
# ECC 0 -c_:C00E -2_-c_100_-C_:C00E_-N Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse)
ECC 0 -c_:C00E -2_-c_100_-C_:C00E_-N Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse)
ECC 0 -c_:C013 -2_-c_1000_-C_:C013 Stress TLS ECDHE-RSA AES 128 CBC with SHA
#
# add client auth versions here...