Sync tests on NSS_3_11_BRANCH with trunk, primarily for ECC tests.
git-svn-id: svn://10.0.0.236/branches/NSS_3_11_BRANCH@195230 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
nelson%bolyard.com
@@ -78,7 +78,7 @@
|
||||
#
|
||||
########################################################################
|
||||
|
||||
TESTS="cert ssl sdr cipher smime crmf perf tools fips dbtests"
|
||||
TESTS="cipher perf cert dbtests tools fips sdr crmf smime ssl"
|
||||
SCRIPTNAME=all.sh
|
||||
CLEANUP="${SCRIPTNAME}"
|
||||
cd `dirname $0` # will cause problems if sourced
|
||||
|
||||
@@ -885,8 +885,79 @@ MODSCRIPT
|
||||
fi
|
||||
}
|
||||
|
||||
############################## cert_extensions ###############################
|
||||
# local shell function to test cert extensions generation.
|
||||
##############################################################################
|
||||
|
||||
############################## cert_stresscerts ################################
|
||||
checkRes()
|
||||
{
|
||||
res=$1
|
||||
filterList=$2
|
||||
|
||||
[ $res -ne 0 ] && return 1
|
||||
|
||||
for fl in `echo $filterList | tr \| ' '`; do
|
||||
fl="`echo $fl | tr _ ' '`"
|
||||
expStat=0
|
||||
if [ X`echo "$fl" | cut -c 1` = 'X!' ]; then
|
||||
expStat=1
|
||||
fl=`echo $fl | tr -d '!'`
|
||||
fi
|
||||
certutil -d ${CERT_EXTENSIONS_DIR} -L -n $CERTNAME | grep "$fl" >/dev/null 2>&1
|
||||
[ $? -ne $expStat ] && return 1
|
||||
done
|
||||
return 0
|
||||
}
|
||||
|
||||
|
||||
cert_extensions()
|
||||
{
|
||||
|
||||
CERTNAME=TestExt
|
||||
cert_create_cert ${CERT_EXTENSIONS_DIR} $CERTNAME 90 ${D_CERT_EXTENSTIONS}
|
||||
TARG_FILE=${CERT_EXTENSIONS_DIR}/test.args
|
||||
|
||||
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
|
||||
|
||||
count=0
|
||||
while read arg opt filterList; do
|
||||
if [ X"`echo $arg | cut -c 1`" = "X#" ]; then
|
||||
continue
|
||||
fi
|
||||
if [ X"`echo $arg | cut -c 1`" = "X!" ]; then
|
||||
testName="$filterList"
|
||||
continue
|
||||
fi
|
||||
if [ X"$arg" = "X=" ]; then
|
||||
count=`expr $count + 1`
|
||||
echo "#################################################"
|
||||
CU_ACTION="Testing $testName"
|
||||
certutil -d ${CERT_EXTENSIONS_DIR} -D -n $CERTNAME
|
||||
echo certutil -d ${CERT_EXTENSIONS_DIR} -S -n $CERTNAME -t "u,u,u" \
|
||||
-s "${CU_SUBJECT}" -x -f ${R_PWFILE} -z "${R_NOISE_FILE}" -$opt < $TARG_FILE
|
||||
certutil -d ${CERT_EXTENSIONS_DIR} -S -n $CERTNAME -t "u,u,u" -o /tmp/cert \
|
||||
-s "${CU_SUBJECT}" -x -f ${R_PWFILE} -z "${R_NOISE_FILE}" -$opt < $TARG_FILE
|
||||
ret=$?
|
||||
echo "certutil options:"
|
||||
cat $TARG_FILE
|
||||
checkRes $ret "$filterList"
|
||||
RET=$?
|
||||
if [ "$RET" -ne 0 ]; then
|
||||
CERTFAILED=$RET
|
||||
html_failed "<TR><TD>${CU_ACTION} ($RET) "
|
||||
cert_log "ERROR: ${CU_ACTION} failed $RET"
|
||||
else
|
||||
html_passed "<TR><TD>${CU_ACTION}"
|
||||
fi
|
||||
rm -f $TARG_FILE
|
||||
else
|
||||
echo $arg >> $TARG_FILE
|
||||
fi
|
||||
done < ${QADIR}/cert/certext.txt
|
||||
}
|
||||
|
||||
|
||||
############################## cert_crl_ssl ############################
|
||||
# local shell function to generate certs and crls for SSL tests
|
||||
########################################################################
|
||||
cert_crl_ssl()
|
||||
@@ -1096,6 +1167,7 @@ cert_extended_ssl
|
||||
cert_ssl
|
||||
cert_smime_client
|
||||
cert_fips
|
||||
cert_extensions
|
||||
cert_crl_ssl
|
||||
if [ -n "$DO_DIST_ST" -a "$DO_DIST_ST" = "TRUE" ] ; then
|
||||
cert_stresscerts
|
||||
|
||||
132
mozilla/security/nss/tests/cert/certext.txt
Normal file
132
mozilla/security/nss/tests/cert/certext.txt
Normal file
@@ -0,0 +1,132 @@
|
||||
# File syntax:
|
||||
# '#' comments.
|
||||
# If the line starts from '!'('! TEST_N Test Name String'),
|
||||
# then 'Test Name String' will be the name of a test(starting
|
||||
# from second space till the rest of the line).
|
||||
# All uncommented lines are hard codded answers to certutil
|
||||
# extension questions.
|
||||
# Line '= N string1|string2|string3': '=' is a stop sign
|
||||
# of certutil inputs and start of the test. 'N' is the number
|
||||
# of extension that will be tested. 'string1|string2|string3'
|
||||
# are grep patterns for test result verification. '_' in stringN
|
||||
# will be replaced to a space.
|
||||
# ################################################################
|
||||
! TEST_1 Certificate Key Usage Extension
|
||||
0
|
||||
1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
10
|
||||
n
|
||||
= 1 Certificate_Key_Usage|Digital_Signature|Non-Repudiation|Key_Encipherment|Data_Encipherment|Key_Agreement|Certificate_Signing|CRL_Signing
|
||||
# ################################################################
|
||||
! TEST_2 Certificate Key Usage Extension
|
||||
0
|
||||
1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
10
|
||||
y
|
||||
= 1 Certificate_Key_Usage|Digital_Signature|Critical:_True
|
||||
# ################################################################
|
||||
! TEST_3 Certificate Basic Constraints Extension
|
||||
y
|
||||
-1
|
||||
n
|
||||
= 2 Name:_Certificate_Basic_Constraints|Data:_Is_a_CA_with_no_maximum
|
||||
# ################################################################
|
||||
! TEST_4 Certificate Basic Constraints Extension
|
||||
n
|
||||
-1
|
||||
y
|
||||
= 2 Name:_Certificate_Basic_Constraints|Data:_Is_not_a_CA|Critical:_True
|
||||
# ################################################################
|
||||
! TEST_5 Certificate Authority Key Identifier Extension
|
||||
y
|
||||
12341235123
|
||||
|
||||
|
||||
y
|
||||
= 3 Name:_Certificate_Authority_Key_Identifier|Critical:_True|Key_ID:|12341235123
|
||||
# ################################################################
|
||||
! TEST_6 Certificate Authority Key Identifier Extension
|
||||
y
|
||||
|
||||
3
|
||||
test.com
|
||||
|
||||
214123
|
||||
y
|
||||
= 3 Name:_Certificate_Authority_Key_Identifier|Critical:_True|Issuer:|DNS_name:_"test.com"|Serial_Number:|214123
|
||||
# ################################################################
|
||||
! TEST_7 CRL Distribution Points Extension
|
||||
1
|
||||
1
|
||||
InstanceOfOtherName
|
||||
2
|
||||
rfc822Name
|
||||
3
|
||||
test.com
|
||||
4
|
||||
test@test.com
|
||||
6
|
||||
ediPArtyName
|
||||
8
|
||||
ipAddress
|
||||
9
|
||||
123451235
|
||||
10
|
||||
0
|
||||
10
|
||||
n
|
||||
n
|
||||
= 4 Name:_CRL_Distribution_Points|InstanceOfOtherName|rfc822Name|test.com|test@test.com|ediPArtyName
|
||||
# #################################################################
|
||||
! TEST_8 CRL Distribution Points Extension
|
||||
2
|
||||
SN=asdfsdf
|
||||
4
|
||||
3
|
||||
test.com
|
||||
10
|
||||
n
|
||||
n
|
||||
= 4 Name:_CRL_Distribution_Points|X520_Title|"asdfsdf"|Reasons:|DNS_name:_"test.com"
|
||||
# ################################################################
|
||||
! TEST_9 Certificate Type Extension
|
||||
0
|
||||
1
|
||||
2
|
||||
10
|
||||
n
|
||||
= 5 Name:_Certificate_Type|Data:_<SSL_Client,SSL_Server,S/MIME>
|
||||
# ################################################################
|
||||
! TEST_10 Extended Key Usage Extension
|
||||
0
|
||||
1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
10
|
||||
y
|
||||
= 6 Name:_Extended_Key_Usage|Critical:_True|TLS_Web_Server_Authentication_Certificate|TLS_Web_Client_Authentication_Certificate|Code_Signing_Certificate|E-Mail_Protection_Certificate|Time_Stamping_Certifcate|OCSP_Responder_Certificate|Strong_Crypto_Export_Approved
|
||||
# ################################################################
|
||||
! TEST_11 Certificate Key Usage Extension
|
||||
|
||||
1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
10
|
||||
n
|
||||
= 1 Certificate_Key_Usage|!Digital_Signature|Non-Repudiation|Key_Encipherment|Data_Encipherment|Key_Agreement|Certificate_Signing|CRL_Signing
|
||||
@@ -386,6 +386,8 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
|
||||
EXT_SERVERDIR=${HOSTDIR}/ext_server
|
||||
EXT_CLIENTDIR=${HOSTDIR}/ext_client
|
||||
|
||||
CERT_EXTENSIONS_DIR=${HOSTDIR}/cert_extensions
|
||||
|
||||
PWFILE=${TMP}/tests.pw.$$
|
||||
NOISE_FILE=${TMP}/tests_noise.$$
|
||||
CORELIST_FILE=${TMP}/clist.$$
|
||||
@@ -408,6 +410,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
|
||||
D_FIPS="FIPS.$version"
|
||||
D_EXT_SERVER="ExtendedServer.$version"
|
||||
D_EXT_CLIENT="ExtendedClient.$version"
|
||||
D_CERT_EXTENSTIONS="CertExtensions.$version"
|
||||
|
||||
# we need relative pathnames of these files abd directories, since our
|
||||
# tools can't handle the unix style absolut pathnames on cygnus
|
||||
@@ -421,6 +424,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
|
||||
R_EVEDIR=../eve
|
||||
R_EXT_SERVERDIR=../ext_server
|
||||
R_EXT_CLIENTDIR=../ext_client
|
||||
R_CERT_EXT=../cert_extensions
|
||||
|
||||
#
|
||||
# profiles are either paths or domains depending on the setting of
|
||||
|
||||
@@ -84,10 +84,6 @@ dbtest_init()
|
||||
# in the output.log, otherwise we can't tell what's a real error
|
||||
RONLY_DIR=${HOSTDIR}/ronlydir
|
||||
EMPTY_DIR=${HOSTDIR}/emptydir
|
||||
grep "SUCCESS: SSL passed" $CERT_LOG_FILE >/dev/null || {
|
||||
html_head "SSL Test failure"
|
||||
Exit : "Fatal - SSL of cert.sh needs to pass first"
|
||||
}
|
||||
|
||||
html_head "CERT and Key DB Tests"
|
||||
|
||||
|
||||
@@ -14,15 +14,12 @@
|
||||
# noECC 0 -r -w_bogus_-n_"Test_User" TLS Request don't require client auth (bad password)
|
||||
#
|
||||
# ############################ ECC ciphers ############################
|
||||
# Currently, session reuse does not work for ECDH-ECDSA and ECDHE-ECDSA
|
||||
# ciphers (see Bug 238051). Setting up 1000 connections without session
|
||||
# reuse would take too long, so use only 10 connections
|
||||
#
|
||||
ECC 0 -c_:C009 -c_10_-C_:C009_-N_-T Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse)
|
||||
ECC 0 -c_:C013 -c_100_-C_:C013_-T Stress SSL3 ECDHE-RSA AES 128 CBC with SHA
|
||||
ECC 0 -c_:C004 -c_10_-C_:C004_-N Stress TLS ECDH-ECDSA AES 128 CBC with SHA (no reuse)
|
||||
# ECC 0 -c_:C00E -c_10_-C_:C00E_-N Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse)
|
||||
ECC 0 -c_:C013 -c_100_-C_:C013 Stress TLS ECDHE-RSA AES 128 CBC with SHA
|
||||
ECC 0 -c_:C009 -c_100_-C_:C009_-N_-T Stress SSL3 ECDHE-ECDSA AES 128 CBC with SHA (no reuse)
|
||||
ECC 0 -c_:C013 -c_1000_-C_:C013_-T Stress SSL3 ECDHE-RSA AES 128 CBC with SHA
|
||||
ECC 0 -c_:C004 -2_-c_100_-C_:C004_-N Stress TLS ECDH-ECDSA AES 128 CBC with SHA (no reuse)
|
||||
# ECC 0 -c_:C00E -2_-c_100_-C_:C00E_-N Stress TLS ECDH-RSA AES 128 CBC with SHA (no reuse)
|
||||
ECC 0 -c_:C013 -2_-c_1000_-C_:C013 Stress TLS ECDHE-RSA AES 128 CBC with SHA
|
||||
#
|
||||
# add client auth versions here...
|
||||
#
|
||||
|
||||
Reference in New Issue
Block a user