Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

265784: SSL interoperability regression testing. r=nelson

Browse Source 
To turn on the feature, set and export env variable
IOPR_HOSTADDR_LIST to space separated interoperability server fqdn list


git-svn-id: svn://10.0.0.236/trunk@214031 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
alexei.volkov.bugs%sun.com
2006-10-23 23:46:47 +00:00
parent cc9a05725b
commit f13fa8117a
14 changed files with 2174 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

93
mozilla/security/nss/cmd/tstclnt/tstclnt.c
View File

@@ -65,6 +65,7 @@
#include "sslproto.h"
#include "pk11func.h"
#include "plgetopt.h"
#include "plstr.h"
#if defined(WIN32)
#include <fcntl.h>
@@ -210,6 +211,7 @@ static void Usage(const char *progName)
fprintf(stderr, "%-20s Disable SSL v2.\n", "-2");
fprintf(stderr, "%-20s Disable SSL v3.\n", "-3");
fprintf(stderr, "%-20s Disable TLS (SSL v3.1).\n", "-T");
fprintf(stderr, "%-20s Prints only payload data. Skips HTTP header.\n", "-S");
fprintf(stderr, "%-20s Client speaks first. \n", "-f");
fprintf(stderr, "%-20s Override bad server cert. Make it OK.\n", "-o");
fprintf(stderr, "%-20s Disable SSL socket locking.\n", "-s");
@@ -397,6 +399,83 @@ printHostNameAndAddr(const char * host, const PRNetAddr * addr)
}
}
/*
* Prints output according to skipProtoHeader flag. If skipProtoHeader
* is not set, prints without any changes, otherwise looking
* for \n\r\n(empty line sequence: HTTP header separator) and
* prints everything after it.
*/
static void
separateReqHeader(const PRFileDesc* outFd, const char* buf, const int nb,
PRBool *wrStarted, int *ptrnMatched) {
/* it is sufficient to look for only "\n\r\n". Hopping that
* HTTP response format satisfies the standard */
char *ptrnStr = "\n\r\n";
char *resPtr;
if (nb == 0) {
return;
}
if (*ptrnMatched > 0) {
/* Get here only if previous separateReqHeader call found
* only a fragment of "\n\r\n" in previous buffer. */
PORT_Assert(*ptrnMatched < 3);
/* the size of fragment of "\n\r\n" what we want to find in this
* buffer is equal to *ptrnMatched */
if (*ptrnMatched <= nb) {
/* move the pointer to the beginning of the fragment */
int strSize = *ptrnMatched;
char *tmpPtrn = ptrnStr + (3 - strSize);
if (PL_strncmp(buf, tmpPtrn, strSize) == 0) {
/* print the rest of the buffer(without the fragment) */
PR_Write((void*)outFd, buf + strSize, nb - strSize);
*wrStarted = PR_TRUE;
return;
}
} else {
/* we are here only when nb == 1 && *ptrnMatched == 2 */
if (*buf == '\r') {
*ptrnMatched = 1;
} else {
*ptrnMatched = 0;
}
return;
}
}
resPtr = PL_strnstr(buf, ptrnStr, nb);
if (resPtr != NULL) {
/* if "\n\r\n" was found in the buffer, calculate offset
* and print the rest of the buffer */
int newBn = nb - (resPtr - buf + 3); /* 3 is the length of "\n\r\n" */
PR_Write((void*)outFd, resPtr + 3, newBn);
*wrStarted = PR_TRUE;
return;
} else {
/* try to find a fragment of "\n\r\n" at the end of the buffer.
* if found, set *ptrnMatched to the number of chars left to find
* in the next buffer.*/
int i;
for(i = 1 ;i < 3;i++) {
char *bufPrt;
int strSize = 3 - i;
if (strSize > nb) {
continue;
}
bufPrt = (char*)(buf + nb - strSize);
if (PL_strncmp(bufPrt, ptrnStr, strSize) == 0) {
*ptrnMatched = i;
return;
}
}
}
}
#define SSOCK_FD 0
#define STDIN_FD 1
@@ -441,6 +520,9 @@ int main(int argc, char **argv)
PRBool useCommandLinePassword = PR_FALSE;
PRBool pingServerFirst = PR_FALSE;
PRBool clientSpeaksFirst = PR_FALSE;
PRBool wrStarted = PR_FALSE;
PRBool skipProtoHeader = PR_FALSE;
int headerSeparatorPtrnId = 0;
int error = 0;
PLOptState *optstate;
PLOptStatus optstatus;
@@ -459,7 +541,7 @@ int main(int argc, char **argv)
}
}
optstate = PL_CreateOptState(argc, argv, "23BTfc:h:p:d:m:n:oqsvw:x");
optstate = PL_CreateOptState(argc, argv, "23BTSfc:h:p:d:m:n:oqsvw:x");
while ((optstatus = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
switch (optstate->option) {
case '?':
@@ -473,6 +555,8 @@ int main(int argc, char **argv)
case 'T': disableTLS = 1; break;
case 'S': skipProtoHeader = PR_TRUE; break;
case 'c': cipherString = strdup(optstate->value); break;
case 'h': host = strdup(optstate->value); break;
@@ -940,7 +1024,12 @@ int main(int argc, char **argv)
/* EOF from socket... stop polling socket for read */
pollset[SSOCK_FD].in_flags = 0;
} else {
PR_Write(std_out, buf, nb);
if (skipProtoHeader != PR_TRUE || wrStarted == PR_TRUE) {
PR_Write(std_out, buf, nb);
} else {
separateReqHeader(std_out, buf, nb, &wrStarted,
&headerSeparatorPtrnId);
}
if (verbose)
fputs("\n\n", stderr);
}

4
mozilla/security/nss/tests/cert/cert.sh
View File

@@ -74,6 +74,9 @@ cert_init()
cd ../common
. ./init.sh
fi
if [ -z "${IOPR_CERT_SOURCED}" ]; then
. ../iopr/cert_iopr.sh
fi
SCRIPTNAME="cert.sh"
CRL_GRP_DATE=`date "+%Y%m%d%H%M%SZ"`
if [ -n "$NSS_ENABLE_ECC" ] ; then
@@ -1307,6 +1310,7 @@ cert_fips
cert_eccurves
cert_extensions
cert_crl_ssl
cert_iopr_setup
if [ -n "$DO_DIST_ST" -a "$DO_DIST_ST" = "TRUE" ] ; then
cert_stresscerts
#following lines to be used when databases are to be reused

21
mozilla/security/nss/tests/common/init.sh
View File

@@ -387,6 +387,10 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
EXT_SERVERDIR=${HOSTDIR}/ext_server
EXT_CLIENTDIR=${HOSTDIR}/ext_client
IOPR_CADIR=${HOSTDIR}/CA_iopr
IOPR_SERVERDIR=${HOSTDIR}/server_iopr
IOPR_CLIENTDIR=${HOSTDIR}/client_iopr
CERT_EXTENSIONS_DIR=${HOSTDIR}/cert_extensions
PWFILE=${TMP}/tests.pw.$$
@@ -420,6 +424,9 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
R_CADIR=../CA
R_SERVERDIR=../server
R_CLIENTDIR=../client
R_IOPR_CADIR=../CA_iopr
R_IOPR_SERVERDIR=../server_iopr
R_IOPR_CLIENTDIR=../client_iopr
R_ALICEDIR=../alicedir
R_BOBDIR=../bobdir
R_DAVEDIR=../dave
@@ -524,6 +531,20 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then
RELOAD_CRL=1
#################################################
# Interoperability testing constatnts
#
# if suite is setup for testing, IOPR_HOSTADDR_LIST should have
# at least one host name(FQDN)
# Example IOPR_HOSTADDR_LIST="goa1.SFBay.Sun.COM"
if [ -z "`echo ${IOPR_HOSTADDR_LIST} | grep '[A-Za-z]'`" ]; then
IOPR=0
else
IOPR=1
fi
#################################################
SCRIPTNAME=$0
INIT_SOURCED=TRUE #whatever one does - NEVER export this one please
fi

370
mozilla/security/nss/tests/iopr/cert_iopr.sh Normal file
View File

@@ -0,0 +1,370 @@
#! /bin/sh
#
# ***** BEGIN LICENSE BLOCK *****
# Version: MPL 1.1/GPL 2.0/LGPL 2.1
#
# The contents of this file are subject to the Mozilla Public License Version
# 1.1 (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
# http://www.mozilla.org/MPL/
#
# Software distributed under the License is distributed on an "AS IS" basis,
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
# for the specific language governing rights and limitations under the
# License.
#
# The Original Code is the Netscape security libraries.
#
# The Initial Developer of the Original Code is
# Netscape Communications Corporation.
# Portions created by the Initial Developer are Copyright (C) 1994-2000
# the Initial Developer. All Rights Reserved.
#
# Alternatively, the contents of this file may be used under the terms of
# either the GNU General Public License Version 2 or later (the "GPL"), or
# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
# in which case the provisions of the GPL or the LGPL are applicable instead
# of those above. If you wish to allow use of your version of this file only
# under the terms of either the GPL or the LGPL, and not to allow others to
# use your version of this file under the terms of the MPL, indicate your
# decision by deleting the provisions above and replace them with the notice
# and other provisions required by the GPL or the LGPL. If you do not delete
# the provisions above, a recipient may use your version of this file under
# the terms of any one of the MPL, the GPL or the LGPL.
#
# ***** END LICENSE BLOCK *****
########################################################################
#
# mozilla/security/nss/tests/iopr/cert_iopr.sh
#
# Certificate generating and handeling for NSS interoperability QA. This file
# is included from cert.sh
#
# needs to work on all Unix and Windows platforms
#
# special strings
# ---------------
# FIXME ... known problems, search for this string
# NOTE .... unexpected behavior
#
# FIXME - Netscape - NSS
########################################################################
IOPR_CERT_SOURCED=1
########################################################################
# function wraps calls to pk12util, also: writes action and options
# to stdout.
# Params are the same as to pk12util.
# Returns pk12util status
#
pk12u()
{
echo "${CU_ACTION} --------------------------"
echo "pk12util $@"
pk12util $@
RET=$?
return $RET
}
########################################################################
# Initializes nss db directory and files if they don't exists
# Params:
# $1 - directory location
#
createDBDir() {
trgDir=$1
if [ -z "`ls $trgDir | grep db`" ]; then
CU_ACTION="Initializing DB at $dir"
certu -N -d "${trgDir}" -f "${R_PWFILE}" 2>&1
if [ "$RET" -ne 0 ]; then
return $RET
fi
fi
}
########################################################################
# takes care of downloading config, cert and crl files from remote
# location.
# Params:
# $1 - name of the host file will be downloaded from
# $2 - path to the file as it appeared in url
# $3 - target directory the file will be saved at.
# Returns tstclnt status.
#
download_file() {
host=$1
filePath=$2
trgDir=$3
file=$trgDir/`basename $filePath`
createDBDir $trgDir || return $RET
# echo wget -O $file http://${host}${filePath}
# wget -O $file http://${host}${filePath}
# ret=$?
req=$file.$$
echo "GET $filePath HTTP/1.0" > $req
echo >> $req
tstclnt -d $trgDir -S -h $host -p $IOPR_DOWNLOAD_PORT \
-w ${R_PWFILE} -o < $req > $file
ret=$?
rm -f $_tmp;
return $ret
}
########################################################################
# Uses pk12util, certutil of cerlutil to import files to an nss db located
# at <dir>(the value of $1 parameter). Chooses a utility to use based on
# a file extension. Initializing a db if it does not exists.
# Params:
# $1 - db location directory
# $2 - file name to import
# $3 - nick name an object in the file will be associated with
# $4 - trust arguments
# Returns status of import
#
importFile() {
dir=$1\
file=$2
certName=$3
certTrust=$4
[ ! -d $dir ] && mkdir -p $dir;
createDBDir $dir || return $RET
case `basename $file | sed 's/^.*\.//'` in
p12)
CU_ACTION="Importing p12 $file to DB at $dir"
pk12u -d $dir -i $file -k ${R_PWFILE} -W iopr
[ $? -ne 0 ] && return 1
CU_ACTION="Modifying trust for cert $certName at $dir"
certu -M -n "$certName" -t "$certTrust" -f "${R_PWFILE}" -d "${dir}"
return $?
;;
crl)
CU_ACTION="Importing crl $file to DB at $dir"
crlu -d ${dir} -I -n TestCA -i $file
return $?
;;
crt | cert)
CU_ACTION="Importing cert $certName with trust $certTrust to $dir"
certu -A -n "$certName" -t "$certTrust" -f "${R_PWFILE}" -d "${dir}" \
-i "$file"
return $?
;;
*)
echo "Unknown file extension: $file:"
return 1
;;
esac
}
#########################################################################
# Downloads and installs test certs and crl from a remote webserver.
# Generates server cert for reverse testing if reverse test run is turned on.
# Params:
# $1 - host name to download files from.
# $2 - directory at which CA cert will be installed and used for
# signing a server cert.
# $3 - path to a config file in webserver context.
# $4 - server db location
# $5 - client db location
# Returns 0 upon success, otherwise, failed command error code.
#
download_install_certs() {
host=$1
caDir=$2
confPath=$3
serverDir=$4
clientDir=$5
[ ! -d "$caDir" ] && mkdir -p $caDir;
#=======================================================
# Getting config file
#
download_file $host "$confPath/iopr_server.cfg" $caDir
RET=$?
if [ $RET -ne 0 -o ! -f $caDir/iopr_server.cfg ]; then
html_failed "<TR><TD>Fail to download website config file(ws: $host)"
return 1
fi
. $caDir/iopr_server.cfg
RET=$?
if [ $RET -ne 0 ]; then
html_failed "<TR><TD>Fail to source config file(ws: $host)"
return $RET
fi
#=======================================================
# Getting CA file
#
#----------------- !!!WARNING!!! -----------------------
# Do NOT copy this scenario. CA should never accompany its
# cert with the private key when deliver cert to a customer.
#----------------- !!!WARNING!!! -----------------------
download_file $host $certDir/$caCertName.p12 $caDir
RET=$?
if [ $RET -ne 0 -o ! -f $caDir/$caCertName.p12 ]; then
html_failed "<TR><TD>Fail to download $caCertName cert(ws: $host)"
return 1
fi
tmpFiles="$caDir/$caCertName.p12"
importFile $caDir $caDir/$caCertName.p12 $caCertName "TC,C,C"
RET=$?
if [ $RET -ne 0 ]; then
html_failed "<TR><TD>Fail to import $caCertName cert to CA DB(ws: $host)"
return $RET
fi
CU_ACTION="Exporting Root CA cert(ws: $host)"
certu -L -n $caCertName -r -d ${caDir} -o $caDir/$caCertName.cert
if [ "$RET" -ne 0 ]; then
Exit 7 "Fatal - failed to export $caCertName cert"
fi
if [ "$reverseRunCGIScript" ]; then
[ ! -d "$serverDir" ] && mkdir -p $serverDir;
#=======================================================
# Import CA cert to server DB
#
importFile $serverDir $caDir/$caCertName.cert server-client-CA "TC,C,C"
RET=$?
if [ $RET -ne 0 ]; then
html_failed "<TR><TD>Fail to import server-client-CA cert to server DB(ws: $host)"
return $RET
fi
#=======================================================
# Creating server cert
#
CERTNAME=$HOSTADDR
CU_ACTION="Generate Cert Request for $CERTNAME (ws: $host)"
CU_SUBJECT="CN=$CERTNAME, E=${CERTNAME}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
certu -R -d "${serverDir}" -f "${R_PWFILE}" -z "${R_NOISE_FILE}" -o $serverDir/req 2>&1
tmpFiles="$tmpFiles $serverDir/req"
CU_ACTION="Sign ${CERTNAME}'s Request (ws: $host)"
certu -C -c "$caCertName" -m `date +"%s"` -v 60 -d "${caDir}" \
-i ${serverDir}/req -o $caDir/${CERTNAME}.cert -f "${R_PWFILE}" 2>&1
importFile $serverDir $caDir/$CERTNAME.cert $CERTNAME ",,"
RET=$?
if [ $RET -ne 0 ]; then
html_failed "<TR><TD>Fail to import $CERTNAME cert to server DB(ws: $host)"
return $RET
fi
tmpFiles="$tmpFiles $caDir/$CERTNAME.cert"
#=======================================================
# Download and import CA crl to server DB
#
download_file $host "$certDir/$caCrlName.crl" $serverDir
RET=$?
if [ $? -ne 0 ]; then
html_failed "<TR><TD>Fail to download $caCertName crl(ws: $host)"
return $RET
fi
tmpFiles="$tmpFiles $serverDir/$caCrlName.crl"
importFile $serverDir $serverDir/TestCA.crl
RET=$?
if [ $RET -ne 0 ]; then
html_failed "<TR><TD>Fail to import TestCA crt to server DB(ws: $host)"
return $RET
fi
fi # if [ "$reverseRunCGIScript" ]
[ ! -d "$clientDir" ] && mkdir -p $clientDir;
#=======================================================
# Import CA cert to client DB
#
importFile $clientDir $caDir/$caCertName.cert server-client-CA "TC,C,C"
RET=$?
if [ $RET -ne 0 ]; then
html_failed "<TR><TD>Fail to import server-client-CA cert to server DB(ws: $host)"
return $RET
fi
#=======================================================
# Import client certs to client DB
#
for certName in $userCertNames; do
download_file $host "$certDir/$certName.p12" $clientDir
RET=$?
if [ $RET -ne 0 -o ! -f $clientDir/$certName.p12 ]; then
html_failed "<TR><TD>Fail to download $certName cert(ws: $host)"
return $RET
fi
tmpFiles="$tmpFiles $clientDir/$certName.p12"
importFile $clientDir $clientDir/$certName.p12 $certName ",,"
RET=$?
if [ $RET -ne 0 ]; then
html_failed "<TR><TD>Fail to import $certName cert to client DB(ws: $host)"
return $RET
fi
done
rm -f $tmpFiles
return 0
}
#########################################################################
# Initial point for downloading config, cert, crl files for multiple hosts
# involved in interoperability testing. Called from nss/tests/cert/cert.sh
# It will only proceed with downloading if environment variable
# IOPR_HOSTADDR_LIST is set and has a value of host names separated by space.
#
# Returns 1 if interoperability testing is off, 0 otherwise.
#
cert_iopr_setup() {
if [ "$IOPR" -ne 1 ]; then
return 1
fi
num=1
IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f 1 -d' '`
while [ "$IOPR_HOST_PARAM" ]; do
IOPR_HOSTADDR=`echo $IOPR_HOST_PARAM | cut -f 1 -d':'`
IOPR_DOWNLOAD_PORT=`echo "$IOPR_HOST_PARAM:" | cut -f 2 -d':'`
[ -z "$IOPR_DOWNLOAD_PORT" ] && IOPR_DOWNLOAD_PORT=443
IOPR_CONF_PATH=`echo "$IOPR_HOST_PARAM:" | cut -f 3 -d':'`
[ -z "$IOPR_CONF_PATH" ] && IOPR_CONF_PATH="/iopr"
echo "Installing certs for $IOPR_HOSTADDR:$IOPR_DOWNLOAD_PORT:$IOPR_CONF_PATH"
download_install_certs ${IOPR_HOSTADDR} ${IOPR_CADIR}_${IOPR_HOSTADDR} \
${IOPR_CONF_PATH} ${IOPR_SERVERDIR}_${IOPR_HOSTADDR} \
${IOPR_CLIENTDIR}_${IOPR_HOSTADDR}
if [ $? -ne 0 ]; then
echo "wsFlags=\"NOIOPR $wsParam\"" >> \
${IOPR_CADIR}_${IOPR_HOSTADDR}/iopr_server.cfg
fi
num=`expr $num + 1`
IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
done
return 0
}

43
mozilla/security/nss/tests/iopr/server_scr/apache_unix.cfg Normal file
View File

@@ -0,0 +1,43 @@
#
# Apache OPENSSL configuration file
#
#
# Define what type of system this is.
#
$clientSys = "openssl";
#
# Cipher conversion table file
#
$cipherTableFile = "$certDir/cipher.list";
#--------------------------------------------
# Web server specific variables start here:
#
#
# Location of installed openssl binary
#
$opensslb = "/usr/local/bin/openssl";
#
# General location of apache server
#
$apacheHttpd="/var/httpd-ssl";
#
# HTTP Request file
#
$reqFile = "$apacheHttpd/cgi-bin/sslreq.dat";
#
# OpenSSL certificate directory
#
$certDir = "$apacheHttpd/cert";
#
# CA certificate file
#
$caCertFile = "$certDir/serverCA.crt";

194
mozilla/security/nss/tests/iopr/server_scr/cert_gen.sh Normal file
View File

@@ -0,0 +1,194 @@
#!/bin/sh
######################################################################################
# Server and client certs and crl generator functions. Generated files placed in a <dir>
# directory to be accessible through http://<webserver>/iopr/TestCA.crt directory.
# This functions is used for manual webserver configuration and it is not a part of
# nss test run.
# To create certs use the following command:
# sh cert_iopr.sh cert_gen <dir> <cert name> [cert req]
# Where:
# dir - directory where to place created files
# cert name - name of created server cert(FQDN)
# cert req - cert request to be used for cert generation.
#
repAndExec() {
echo
if [ "$1" = "certutil" -a "$2" = "-R" -o "$2" = "-S" ]; then
shift
echo certutil -s "$CU_SUBJECT" $@
certutil -s "$CU_SUBJECT" $@
RET=$?
else
echo $@
$@
RET=$?
fi
return $RET
}
signCert() {
dir=$1
crtDir=$2
crtName=$3
crtSN=$4
req=$5
cuAddParam=$6
repAndExec \
certutil $cuAddParam -C -c "TestCA" -m $crtSN -v 599 -d "${dir}" \
-i $req -o "$crtDir/${crtName}.crt" -f "${PW_FILE}" 2>&1
return $RET
}
createSignedCert() {
dir=$1
certName=$2
certSN=$3
certSubj=$4
keyType=$5
exportFile=$6
echo Creating cert $certName with SN=$certSN
CU_SUBJECT="$certSubj"
repAndExec \
certutil -R -d $dir -f "${PW_FILE}" -z "${NOISE_FILE}" \
-k $keyType -o $dir/req 2>&1
[ "$RET" -ne 0 ] && return $RET
signCert $dir $dir $certName $certSN $dir/req
ret=$?
[ "$ret" -ne 0 ] && return $ret
rm -f $dir/req
repAndExec \
certutil -A -n ${certName}-${keyType} -t "u,u,u" -d "${dir}" -f "${PW_FILE}" \
-i "$dir/${certName}.crt" 2>&1
[ "$RET" -ne 0 ] && return $RET
repAndExec \
pk12util -d $dir -o $exportFile -n ${certName}-${keyType} -k ${PW_FILE} -W iopr
[ "$RET" -ne 0 ] && return $RET
return 0
}
generateServerCerts() {
certDir=$1
serverName=$2
servCertReq=$3
[ -z "$certDir" ] && echo "Cert directory should not be empty" && exit 1
[ -z "$serverName" ] && echo "Server name should not be empty" && exit 1
mkdir -p $certDir
[ $? -ne 0 ] && echo "Can not create dir: $certDir" && exit 1
dir=/tmp/db.$$
if [ -d "$dir" ]; then
rm -f $dir
fi
mkdir -p $dir
[ $? -ne 0 ] && echo "Can not create dir: $dir" && exit 1
PW_FILE=$dir/nss.pwd
NOISE_FILE=$dir/nss.noise
echo nss > $PW_FILE
date >> ${NOISE_FILE} 2>&1
repAndExec \
certutil -d $dir -N -f $PW_FILE
[ "$RET" -ne 0 ] && return $RET
certName=TestCA
CU_SUBJECT="CN=NSS IOPR Test CA $$, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
repAndExec \
certutil -S -n $certName -t "CTu,CTu,CTu" -v 600 -x -d ${dir} -1 -2 \
-f ${PW_FILE} -z ${NOISE_FILE} -m 10000 2>&1 <<EOF
5
6
9
n
y
-1
n
EOF
repAndExec \
certutil -L -n $certName -r -d ${dir} -o $certDir/$certName.crt
[ "$RET" -ne 0 ] && return $RET
repAndExec \
pk12util -d $dir -o $certDir/$certName.p12 -n $certName -k ${PW_FILE} -W iopr
[ "$RET" -ne 0 ] && return $RET
if [ "$servCertReq" -a -f $servCertReq ]; then
grep REQUEST $servCertReq >/dev/null 2>&1
signCert $dir $certDir ${serverName}_ext 501 $servCertReq `test $? -eq 0 && echo -a`
ret=$?
[ "$ret" -ne 0 ] && return $ret
fi
certName=$serverName
certSubj="CN=$certName, E=${certName}-rsa@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
createSignedCert $dir $certName 500 "$certSubj" rsa $certDir/${certName}-rsa.p12
ret=$?
[ "$ret" -ne 0 ] && return $ret
certName=$serverName
certName=$serverName
certSubj="CN=$certName, E=${certName}-dsa@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
createSignedCert $dir $certName 501 "$certSubj" dsa $certDir/${certName}-dsa.p12
ret=$?
[ "$ret" -ne 0 ] && return $ret
certName=TestUser510
certSubj="CN=$certName, E=${certName}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
createSignedCert $dir $certName 510 "$certSubj" rsa $certDir/${certName}-rsa.p12
ret=$?
[ "$ret" -ne 0 ] && return $ret
certName=TestUser511
certSubj="CN=$certName, E=${certName}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
createSignedCert $dir $certName 511 "$certSubj" dsa $certDir/${certName}-dsa.p12
ret=$?
[ "$ret" -ne 0 ] && return $ret
certName=TestUser512
certSubj="CN=$certName, E=${certName}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
createSignedCert $dir $certName 512 "$certSubj" rsa $certDir/${certName}-rsa.p12
ret=$?
[ "$ret" -ne 0 ] && return $ret
certName=TestUser513
certSubj="CN=$certName, E=${certName}@bogus.com, O=BOGUS NSS, L=Mountain View, ST=California, C=US"
createSignedCert $dir $certName 513 "$certSubj" dsa $certDir/${certName}-dsa.p12
ret=$?
[ "$ret" -ne 0 ] && return $ret
crlUpdate=`date +%Y%m%d%H%M%SZ`
crlNextUpdate=`echo $crlUpdate | sed 's/20/21/'`
repAndExec \
crlutil -d $dir -G -n "TestCA" -f ${PW_FILE} -o $certDir/TestCA.crl <<EOF_CRLINI
update=$crlUpdate
nextupdate=$crlNextUpdate
addcert 509-511 $crlUpdate
EOF_CRLINI
[ "$RET" -ne 0 ] && return $RET
rm -rf $dir
return 0
}
if [ -z "$1" -o -z "$2" ]; then
echo "$0 <dest dir> <cert name> [cert req]"
exit 1
fi
generateServerCerts $1 $2 $3
exit $?

131
mozilla/security/nss/tests/iopr/server_scr/cipher.list Normal file
View File

@@ -0,0 +1,131 @@
nss openssl iis
#
# SSL v3.0 cipher suites.
#
SSL3_RSA_WITH_NULL_MD5 NULL-MD5 i
SSL3_RSA_WITH_NULL_SHA NULL-SHA z
SSL3_RSA_EXPORT_WITH_RC4_40_MD5 EXP-RC4-MD5 f
SSL3_RSA_WITH_RC4_128_MD5 RC4-MD5 c
SSL3_RSA_WITH_RC4_128_SHA RC4-SHA n
SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5 EXP-RC2-CBC-MD5 g
SSL3_RSA_WITH_IDEA_CBC_SHA IDEA-CBC-SHA
SSL3_RSA_EXPORT_WITH_DES40_CBC_SHA EXP-DES-CBC-SHA
SSL3_RSA_WITH_DES_CBC_SHA DES-CBC-SHA e
SSL3_RSA_WITH_3DES_EDE_CBC_SHA DES-CBC3-SHA d
SSL3_DH_DSS_EXPORT_WITH_DES40_CBC_SHA Not_implemented.
SSL3_DH_DSS_WITH_DES_CBC_SHA Not_implemented.
SSL3_DH_DSS_WITH_3DES_EDE_CBC_SHA Not_implemented.
SSL3_DH_RSA_EXPORT_WITH_DES40_CBC_SHA Not_implemented.
SSL3_DH_RSA_WITH_DES_CBC_SHA Not_implemented.
SSL3_DH_RSA_WITH_3DES_EDE_CBC_SHA Not_implemented.
SSL3_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA EXP-EDH-DSS-DES-CBC-SHA
SSL3_DHE_DSS_WITH_DES_CBC_SHA EDH-DSS-CBC-SHA s
SSL3_DHE_DSS_WITH_3DES_EDE_CBC_SHA EDH-DSS-DES-CBC3-SHA q
SSL3_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA EXP-EDH-RSA-DES-CBC-SHA
SSL3_DHE_RSA_WITH_DES_CBC_SHA EDH-RSA-DES-CBC-SHA
SSL3_DHE_RSA_WITH_3DES_EDE_CBC_SHA EDH-RSA-DES-CBC3-SHA
SSL3_DH_anon_EXPORT_WITH_RC4_40_MD5 EXP-ADH-RC4-MD5
SSL3_DH_anon_WITH_RC4_128_MD5 ADH-RC4-MD5
SSL3_DH_anon_EXPORT_WITH_DES40_CBC_SHA EXP-ADH-DES-CBC-SHA
SSL3_DH_anon_WITH_DES_CBC_SHA ADH-DES-CBC-SHA
SSL3_DH_anon_WITH_3DES_EDE_CBC_SHA ADH-DES-CBC3-SHA
SSL3_FORTEZZA_KEA_WITH_NULL_SHA Not_implemented.
SSL3_FORTEZZA_KEA_WITH_FORTEZZA_CBC_SHA Not_implemented.
SSL3_FORTEZZA_KEA_WITH_RC4_128_SHA Not_implemented.
#
# Next four added to have ciphers below for SSL3 protocol
#
SSL3_RSA_WITH_AES_128_CBC_SHA AES128-SHA
SSL3_RSA_WITH_AES_256_CBC_SHA AES256-SHA
SSL3_RSA_EXPORT_WITH_DES_CBC_SHA EXP1024-DES-CBC-SHA l
SSL3_RSA_EXPORT_WITH_RC4_56_SHA EXP1024-RC4-SHA m
#
#TLS v1.0 cipher suites.
#
TLS_RSA_WITH_NULL_MD5 NULL-MD5
TLS_RSA_WITH_NULL_SHA NULL-SHA
TLS_RSA_EXPORT_WITH_RC4_40_MD5 EXP-RC4-MD5
TLS_RSA_WITH_RC4_128_MD5 RC4-MD5
TLS_RSA_WITH_RC4_128_SHA RC4-SHA
TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 EXP-RC2-CBC-MD5
TLS_RSA_WITH_IDEA_CBC_SHA IDEA-CBC-SHA
TLS_RSA_EXPORT_WITH_DES40_CBC_SHA EXP-DES-CBC-SHA
TLS_RSA_WITH_DES_CBC_SHA DES-CBC-SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA DES-CBC3-SHA
TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA Not_implemented.
TLS_DH_DSS_WITH_DES_CBC_SHA Not_implemented.
TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA Not_implemented.
TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA Not_implemented.
TLS_DH_RSA_WITH_DES_CBC_SHA Not_implemented.
TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA Not_implemented.
TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA EXP-EDH-DSS-DES-CBC-SHA
TLS_DHE_DSS_WITH_DES_CBC_SHA EDH-DSS-CBC-SHA
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA EDH-DSS-DES-CBC3-SHA
TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA EXP-EDH-RSA-DES-CBC-SHA
TLS_DHE_RSA_WITH_DES_CBC_SHA EDH-RSA-DES-CBC-SHA
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA EDH-RSA-DES-CBC3-SHA
TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 EXP-ADH-RC4-MD5
TLS_DH_anon_WITH_RC4_128_MD5 ADH-RC4-MD5
TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA EXP-ADH-DES-CBC-SHA
TLS_DH_anon_WITH_DES_CBC_SHA ADH-DES-CBC-SHA
TLS_DH_anon_WITH_3DES_EDE_CBC_SHA ADH-DES-CBC3-SHA
#
#AES ciphersuites from RFC3268, extending TLS v1.0
#
TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA
TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA
TLS_DH_DSS_WITH_AES_128_CBC_SHA DH-DSS-AES128-SHA
TLS_DH_DSS_WITH_AES_256_CBC_SHA DH-DSS-AES256-SHA
TLS_DH_RSA_WITH_AES_128_CBC_SHA DH-RSA-AES128-SHA
TLS_DH_RSA_WITH_AES_256_CBC_SHA DH-RSA-AES256-SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA DHE-DSS-AES128-SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA DHE-DSS-AES256-SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA DHE-RSA-AES128-SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA DHE-RSA-AES256-SHA
TLS_DH_anon_WITH_AES_128_CBC_SHA ADH-AES128-SHA
TLS_DH_anon_WITH_AES_256_CBC_SHA ADH-AES256-SHA
#
#Additional Export 1024 and other cipher suites
#
#Note: these ciphers can also be used in SSL v3.
#
TLS_RSA_EXPORT_WITH_DES_CBC_SHA EXP1024-DES-CBC-SHA
TLS_RSA_EXPORT_WITH_RC4_56_SHA EXP1024-RC4-SHA
TLS_DHE_DSS_EXPORT_WITH_DES_CBC_SHA EXP1024-DHE-DSS-DES-CBC-SHA
TLS_DHE_DSS_EXPORT_WITH_RC4_56_SHA EXP1024-DHE-DSS-RC4-SHA
TLS_DHE_DSS_WITH_RC4_128_SHA DHE-DSS-RC4-SHA
#
#SSL v2.0 cipher suites.
#
SSL2_RC4_128_WITH_MD5 RC4-MD5
SSL2_RC4_128_EXPORT40_WITH_MD5 EXP-RC4-MD5
SSL2_RC2_128_CBC_WITH_MD5 RC2-MD5
SSL2_RC2_128_CBC_EXPORT40_WITH_MD5 EXP-RC2-MD5
SSL2_IDEA_128_CBC_WITH_MD5 IDEA-CBC-MD5
SSL2_DES_64_CBC_WITH_MD5 DES-CBC-MD5
SSL2_DES_192_EDE3_CBC_WITH_MD5 DES-CBC3-MD5
#
# FIPS cipher list
#
TLS_RSA_FIPS_WITH_3DES_EDE_CBC_SHA Not_implemented
TLS_RSA_FIPS_WITH_DES_CBC_SHA Not_implemented
SSL3_RSA_FIPS_WITH_3DES_EDE_CBC_SHA Not_implemented
SSL3_RSA_FIPS_WITH_DES_CBC_SHA Not_implemented

522
mozilla/security/nss/tests/iopr/server_scr/client.cgi Normal file
View File

@@ -0,0 +1,522 @@
#!/usr/bin/perl
#--------------------------------------------------------------
# cgi script that parses request argument to appropriate
# open ssl or tstclntw options and starts ssl client.
#
use CGI qw/:standard/;
use subs qw(debug);
#--------------------------------------------------------------
# Prints out an error string and exits the script with an
# exitStatus.
# Param:
# str : an error string
# exitStat: an exit status of the program
#
sub svr_error {
my ($str, $exitStat) = @_;
if (!defined $str || $str eq "") {
$str = $ERR;
}
print "SERVER ERROR: $str\n";
if ($exitStat) {
print end_html if ($osDataArr{wservRun});
exit $exitStat;
}
}
#--------------------------------------------------------------
# Prints out a debug message
# Params:
# str: debug message
# inVal: additional value to print(optional)
#
sub debug {
my ($str, $inVal) = @_;
print "-- DEBUG: $str ($inVal)\n" if ($DEBUG == 1);
}
#--------------------------------------------------------------
# Initializes execution context depending on a webserver the
# script is running under.
#
sub init {
%osDataArr = (
loadSupportedCipthersFn => \&osSpecific,
cipherIsSupportedFn => \&verifyCipherSupport,
cipherListFn => \&convertCipher,
buildCipherTableFn => \&buildCipherTable,
execCmdFn => \&osSpecific,
);
$scriptName = $ENV{'SCRIPT_NAME'};
if (!defined $scriptName) {
$DEBUG=1;
debug "Debug is ON";
}
$DEBUG=1;
$svrSoft = $ENV{'SERVER_SOFTWARE'};
if (defined $svrSoft) {
$_ = $svrSoft;
/.*Microsoft.*/ && ($osDataArr{wserv} = "IIS");
/.*Apache.*/ && ($osDataArr{wserv} = "Apache");
$osDataArr{wservRun} = 1;
} else {
$osDataArr{wserv} = "Apache";
$osDataArr{wservRun} = 0;
}
}
#--------------------------------------------------------------
# Function-spigot to handle errors is OS specific functions are
# not implemented for a particular OS.
# Returns:
# always returns 0(failure)
#
sub osSpecific {
$ERR = "This function should be swapped to os specific function.";
return 0;
}
#--------------------------------------------------------------
# Sets os specific execution context values.
# Returns:
# 1 upon success, or 0 upon failure(if OS was not recognized)
#
sub setFunctRefs {
debug("Entering setFunctRefs function", $osDataArr{wserv});
if ($osDataArr{wserv} eq "Apache") {
$osDataArr{osConfigFile} = "apache_unix.cfg";
$osDataArr{suppCiphersCmd} = '$opensslb ciphers ALL:NULL';
$osDataArr{clientRunCmd} = '$opensslb s_client -host $in_host -port $in_port -cert $certDir/$in_cert.crt -key $certDir/$in_cert.key -CAfile $caCertFile $proto $ciphers -ign_eof < $reqFile';
$osDataArr{loadSupportedCipthersFn} = \&getSupportedCipherList_Unix;
$osDataArr{execCmdFn} = \&execClientCmd_Unix;
} elsif ($osDataArr{wserv} eq "IIS") {
$osDataArr{osConfigFile} = "iis_windows.cfg";
$osDataArr{suppCiphersCmd} = '$tstclntwb';
$osDataArr{clientRunCmd} = '$tstclntwb -h $in_host -p $in_port -n $in_cert $proto $ciphers < $reqFile';
$osDataArr{loadSupportedCipthersFn} = \&getSupportedCipherList_Win;
$osDataArr{execCmdFn} = \&execClientCmd_Win;
} else {
$ERR = "Unknown Web Server type.";
return 0;
}
return 1;
}
#--------------------------------------------------------------
# Parses data from HTTP request. Will print a form if request
# does not contain sufficient number of parameters.
# Returns:
# 1 if request has sufficient number of parameters
# 0 if not.
sub getReqData {
my $debug = param('debug');
$in_host = param('host');
$in_port = param('port');
$in_cert = param('cert');
$in_cipher = param('cipher');
if (!$osDataArr{wservRun}) {
$in_host="goa1";
$in_port="443";
$in_cert="TestUser511";
$in_cipher = "SSL3_RSA_WITH_NULL_SHA";
}
debug("Entering getReqData function", "$in_port:$in_host:$in_cert:$in_cipher");
if (defined $debug && $debug == "debug on") {
$DEBUG = 1;
}
if (!defined $in_host || $in_host eq "" ||
!defined $in_port || $in_port eq "" ||
!defined $in_cert || $in_cert eq "") {
if ($osDataArr{wservRun}) {
print h1('Command description form:'),
start_form(-method=>"get"),
"Host: ",textfield('host'),p,
"Port: ",textfield('port'),p,
"Cert: ",textfield('cert'),p,
"Cipher: ",textfield('cipher'),p,
checkbox_group(-name=>'debug',
-values=>['debug on ']),
submit,
end_form,
hr;
} else {
print "Printing html form to get client arguments\n";
}
$ERR = "the following parameters are required: host, port, cert";
return 0;
} else {
print "<pre>" if ($osDataArr{wservRun});
return 1;
}
}
#--------------------------------------------------------------
# Building cipher conversion table from file based on the OS.
# Params:
# tfile: cipher conversion file.
# sysName: system name
# tblPrt: returned pointer to a table.
sub buildCipherTable {
my ($tfile, $sysName, $tblPrt) = @_;
my @retArr = @$tblPrt;
my %table, %rtable;
my $strCount = 0;
debug("Entering getReqData function", "$tfile:$sysName:$tblPrt");
($ERR = "No system name supplied" && return 0) if ($sysName =~ /^$/);
if (!open(TFILE, "$tfile")) {
$ERR = "Missing cipher conversion table file.";
return 0;
}
foreach (<TFILE>) {
chop;
/^#.*/ && next;
/^\s*$/ && next;
if ($strCount++ == 0) {
my @sysArr = split /\s+/;
$colCount = 0;
for (;$colCount <= $#sysArr;$colCount++) {
last if ($sysArr[$colCount] =~ /(.*:|^)$sysName.*/);
}
next;
}
my @ciphArr = split /\s+/, $_;
$table{$ciphArr[0]} = $ciphArr[$colCount];
$rtable{$ciphArr[$colCount]} = $ciphArr[0];
}
close(TFILE);
$cipherTablePtr[0] = \%table;
$cipherTablePtr[1] = \%rtable;
return 1
}
#--------------------------------------------------------------
# Client configuration function. Loads client configuration file.
# Initiates cipher table. Loads cipher list supported by ssl client.
#
sub configClient {
debug "Entering configClient function";
my $res = &setFunctRefs();
return $res if (!$res);
open(CFILE, $osDataArr{'osConfigFile'}) ||
($ERR = "Missing configuration file." && return 0);
foreach (<CFILE>) {
/^#.*/ && next;
chop;
eval $_;
}
close(CFILE);
local @cipherTablePtr = ();
$osDataArr{'buildCipherTableFn'}->($cipherTableFile, $clientSys) || return 0;
$osDataArr{cipherTable} = $cipherTablePtr[0];
$osDataArr{rcipherTable} = $cipherTablePtr[1];
local $suppCiphersTablePrt;
&{$osDataArr{'loadSupportedCipthersFn'}} || return 0;
$osDataArr{suppCiphersTable} = $suppCiphersTablePrt;
}
#--------------------------------------------------------------
# Verifies that a particular cipher is supported.
# Params:
# checkCipher: cipher name
# Returns:
# 1 - cipher is supported(also echos the cipher).
# 0 - not supported.
#
sub verifyCipherSupport {
my ($checkCipher) = @_;
my @suppCiphersTable = @{$osDataArr{suppCiphersTable}};
debug("Entering verifyCipherSupport", $checkCipher);
foreach (@suppCiphersTable) {
return 1 if ($checkCipher eq $_);
}
$ERR = "cipher is not supported.";
return 0;
}
#--------------------------------------------------------------
# Converts long(?name of the type?) cipher name to
# openssl/tstclntw cipher name.
# Returns:
# 0 if cipher was not listed. 1 upon success.
#
sub convertCipher {
my ($cipher) = @_;
my @retList;
my $resStr;
my %cipherTable = %{$osDataArr{cipherTable}};
debug("Entering convertCipher", $cipher);
if (defined $cipher) {
my $cphr = $cipherTable{$cipher};
if (!defined $cphr) {
$ERR = "cipher is not listed.";
return 0;
}
&{$osDataArr{'cipherIsSupportedFn'}}($cphr) || return 0;
$ciphers = "$cphr";
return 1;
}
return 0;
}
#################################################################
# UNIX Apache Specific functions
#----------------------------------------------------------------
#--------------------------------------------------------------
# Executes ssl client command to get a list of ciphers supported
# by client.
#
sub getSupportedCipherList_Unix {
my @arr, @suppCiphersTable;
debug "Entering getSupportedCipherList_Unix function";
eval '$sLisrCmd = "'.$osDataArr{'suppCiphersCmd'}.'"';
if (!open (OUT, "$sLisrCmd|")) {
$ERR="Can not run command to verify supported cipher list.";
return 0;
}
@arr = <OUT>;
chop $arr[0];
@suppCiphersTable = split /:/, $arr[0];
debug("Supported ciphers", $arr[0]);
$suppCiphersTablePrt = \@suppCiphersTable;
close(OUT);
return 1;
}
#--------------------------------------------------------------
# Lunches ssl client command in response to a request.
#
#
sub execClientCmd_Unix {
my $proto;
local $ciphers;
debug "Entering execClientCmd_Unix";
if (defined $in_cipher && $in_cipher ne "") {
my @arr = split /_/, $in_cipher, 2;
$proto = "-".$arr[0];
$proto =~ tr /SLT/slt/;
$proto = "-tls1" if ($proto eq "-tls");
return 0 if (!&{$osDataArr{'cipherListFn'}}($in_cipher));
$ciphers = "-cipher $ciphers";
debug("Return from cipher conversion", "$ciphers");
}
eval '$command = "'.$osDataArr{'clientRunCmd'}.'"';
debug("Executing command", $command);
if (!open CMD_OUT, "$command 2>&1 |") {
$ERR = "can not launch client";
return 0;
}
my @cmdOutArr = <CMD_OUT>;
foreach (@cmdOutArr) {
print $_;
}
my $haveVerify = 0;
my $haveErrors = 0;
foreach (@cmdOutArr) {
chop;
if (/unknown option/) {
$haveErrors++;
svr_error "unknown option\n";
next;
}
if (/:no ciphers available/) {
$haveErrors++;
svr_error "no cipthers available\n";
next;
}
if (/verify error:/) {
$haveErrors++;
svr_error "unable to do verification\n";
next;
}
if (/alert certificate revoked:/) {
$haveErrors++;
svr_error "attempt to connect with revoked sertificate\n";
next;
}
if (/(error|ERROR)/) {
$haveErrors++;
svr_error "found errors in server log\n";
next;
}
/verify return:1/ && ($haveVerify = 1);
}
if ($haveVerify == 0) {
svr_error "no 'verify return:1' found in server log\n";
$haveErrors++;
}
if ($haveErrors > 0) {
$ERR = "Have $haveErrors server errors";
debug "Exiting execClientCmd_Unix";
return 0;
}
debug "Exiting execClientCmd_Unix";
return 1;
}
#################################################################
# Windows IIS Specific functions
#----------------------------------------------------------------
#--------------------------------------------------------------
# Executes ssl client command to get a list of ciphers supported
# by client.
#
sub getSupportedCipherList_Win {
my @arr, @suppCiphersTable;
debug "Entering getSupportedCipherList_Win function";
eval '$sLisrCmd = "'.$osDataArr{'suppCiphersCmd'}.'"';
if (!open (OUT, "$sLisrCmd|")) {
$ERR="Can not run command to verify supported cipher list.";
return 0;
}
my $startCipherList = 0;
foreach (<OUT>) {
chop;
if ($startCipherList) {
/^([a-zA-Z])\s+/ && push @suppCiphersTable, $1;
next;
}
/.*from list below.*/ && ($startCipherList = 1);
}
debug("Supported ciphers", join ':', @suppCiphersTable);
$suppCiphersTablePrt = \@suppCiphersTable;
close(OUT);
return 1;
}
#--------------------------------------------------------------
# Lunches ssl client command in response to a request.
#
#
sub execClientCmd_Win {
my $proto;
local $ciphers;
debug "Entering execClientCmd_Win";
if (defined $in_cipher && $in_cipher ne "") {
my @arr = split /_/, $in_cipher, 2;
$proto = "-2 -3 -T";
$proto =~ s/-T// if ($arr[0] eq "TLS");
$proto =~ s/-3// if ($arr[0] eq "SSL3");
$proto =~ s/-2// if ($arr[0] eq "SSL2");
return 0 if (!&{$osDataArr{'cipherListFn'}}($in_cipher));
$ciphers = "-c $ciphers";
debug("Return from cipher conversion", $ciphers);
}
eval '$command = "'.$osDataArr{'clientRunCmd'}.'"';
debug("Executing command", $command);
if (!open CMD_OUT, "$command 2>&1 |") {
$ERR = "can not launch client";
return 0;
}
my @cmdOutArr = <CMD_OUT>;
foreach (@cmdOutArr) {
print $_;
}
my $haveVerify = 0;
my $haveErrors = 0;
foreach (@cmdOutArr) {
chop;
if (/unknown option/) {
$haveErrors++;
svr_error "unknown option\n";
next;
}
if (/Error performing handshake/) {
$haveErrors++;
svr_error "Error performing handshake\n";
next;
}
if (/Error creating credentials/) {
$haveErrors++;
svr_error "Error creating credentials\n";
next;
}
if (/Error .* authenticating server credentials!/) {
$haveErrors++;
svr_error "Error authenticating server credentials\n";
next;
}
if (/(error|ERROR|Error)/) {
$haveErrors++;
svr_error "found errors in server log\n";
next;
}
}
if ($haveErrors > 0) {
$ERR = "Have $haveErrors server errors";
debug "Exiting execClientCmd_Win";
return 0;
}
debug "Exiting execClientCmd_Win";
return 1;
}
#################################################################
# Main line of execution
#----------------------------------------------------------------
&init;
if ($osDataArr{wservRun}) {
print header('text/html').
start_html('iopr client');
}
print "SCRIPT=OK\n";
if (!&getReqData) {
svr_error($ERR, 1);
}
if (!&configClient) {
svr_error($ERR, 1);
}
&{$osDataArr{'execCmdFn'}} || svr_error;
if ($osDataArr{wservRun}) {
print "</pre>";
print end_html;
}

13
mozilla/security/nss/tests/iopr/server_scr/config Normal file
View File

@@ -0,0 +1,13 @@
certDir=/iopr
caCertName=TestCA
caCrlName=TestCA
userCertNames="TestUser510 TestUser511"
userRevokedCertNames="TestUser510"
reverseRunCGIScript="/cgi-bin/client.cgi"
supportedTests="SslSingleHs"
# SslSingleHs: ssl single handshake with out client cert auth
SslSingleHsPort=443
SslSingleHsUrl=/
SslSingleHsParam=NOAUTH:NOCOV:NOCRL
#ParamSslSingleHandshakeWithOutClientCertAuth="443 / NOAUTH:NOCOV:NOCRL"
#ParamSslSingleHandshakeWithOutClientCertAuth="443 /"

29
mozilla/security/nss/tests/iopr/server_scr/iis_windows.cfg Normal file
View File

@@ -0,0 +1,29 @@
#
# IIS windows configuration file
#
#
# Define what type of system this is.
#
$clientSys = "iis";
#
# Cipher conversion table file
#
$cipherTableFile = "cipher.list";
#--------------------------------------------
# Web server specific variables start here:
#
#
# Location of installed tstclntb binary
#
$tstclntwb = "./tstclntw.exe";
#
# HTTP Request file
#
$reqFile = "sslreq.dat";

2
mozilla/security/nss/tests/iopr/server_scr/sslreq.dat Normal file
View File

@@ -0,0 +1,2 @@
GET / HTTP/1.0

670
mozilla/security/nss/tests/iopr/ssl_iopr.sh Normal file
View File

@@ -0,0 +1,670 @@
#! /bin/sh
#
# ***** BEGIN LICENSE BLOCK *****
# Version: MPL 1.1/GPL 2.0/LGPL 2.1
#
# The contents of this file are subject to the Mozilla Public License Version
# 1.1 (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
# http://www.mozilla.org/MPL/
#
# Software distributed under the License is distributed on an "AS IS" basis,
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
# for the specific language governing rights and limitations under the
# License.
#
# The Original Code is the Netscape security libraries.
#
# The Initial Developer of the Original Code is
# Netscape Communications Corporation.
# Portions created by the Initial Developer are Copyright (C) 1994-2000
# the Initial Developer. All Rights Reserved.
#
# Alternatively, the contents of this file may be used under the terms of
# either the GNU General Public License Version 2 or later (the "GPL"), or
# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
# in which case the provisions of the GPL or the LGPL are applicable instead
# of those above. If you wish to allow use of your version of this file only
# under the terms of either the GPL or the LGPL, and not to allow others to
# use your version of this file under the terms of the MPL, indicate your
# decision by deleting the provisions above and replace them with the notice
# and other provisions required by the GPL or the LGPL. If you do not delete
# the provisions above, a recipient may use your version of this file under
# the terms of any one of the MPL, the GPL or the LGPL.
#
# ***** END LICENSE BLOCK *****
########################################################################
#
# mozilla/security/nss/tests/iopr/ssl_iopr.sh
#
# NSS SSL interoperability QA. This file is included from ssl.sh
#
# needs to work on all Unix and Windows platforms
#
# special strings
# ---------------
# FIXME ... known problems, search for this string
# NOTE .... unexpected behavior
#
# FIXME - Netscape - NSS
########################################################################
IOPR_SSL_SOURCED=1
########################################################################
# The functions works with variables defined in interoperability
# configuration file that was downloaded from a webserver.
# It tries to find unrevoked cert based on value of variable
# "userRevokedCertNames" defined in the configuration file.
# Params NONE.
# Returns 0 if found, 1 otherwise.
#
setValidCert() {
testUser=
for user in $userCertNames; do
if [ "`echo $userRevokedCertNames | grep -v $user`" != "" ]; then
testUser=$user
return 0
fi
done
return 1
}
########################################################################
# The funtions works with variables defined in interoperability
# configuration file that was downloaded from a webserver.
# The function sets port, url, param and description test parameters
# that was defind for a particular type of testing.
# Params:
# $1 - supported types of testing. Currently have maximum
# of two: forward and reverse. But more can be defined.
# No return value
#
setTestParam() {
type=$1
sslPort=`eval 'echo $'${type}Port`
sslUrl=`eval 'echo $'${type}Url`
testParam=`eval 'echo $'${type}Param`
testDescription=`eval 'echo $'${type}Descr`
[ -z "$sslPort" ] && sslPort=443
[ -z "$sslUrl" ] && sslUrl="/iopr_test/test_pg.html"
[ "$sslUrl" = "/" ] && sslUrl="/test_pg.html"
}
#######################################################################
# local shell function to perform SSL Cipher Suite Coverage tests
# in interoperability mode. Tests run against web server by using nss
# test client
# Params:
# $1 - supported type of testing.
# $2 - testing host
# $3 - nss db location
# No return value
#
ssl_iopr_cov_ext_server()
{
testType=$1
host=$2
dbDir=$3
setTestParam $testType
if [ "`echo $testParam | grep NOCOV`" != "" ]; then
echo "SSL Cipher Coverage of WebServ($IOPR_HOSTADDR) excluded from " \
"run by server configuration"
return 0
fi
html_head "SSL Cipher Coverage of WebServ($IOPR_HOSTADDR" \
"$BYPASS_STRING $NORM_EXT): $testDescription"
setValidCert; ret=$?
if [ $ret -ne 0 ]; then
html_failed "<TR><TD>Fail to find valid test cert(ws: $host)"
return $ret
fi
SSL_REQ_FILE=${TMP}/sslreq.dat.$$
echo "GET $sslUrl HTTP/1.0" > $SSL_REQ_FILE
echo >> $SSL_REQ_FILE
while read ecc tls param testname therest; do
[ -z "$ecc" -o "$ecc" = "#" -o "`echo $testname | grep FIPS`" -o \
"$ecc" = "ECC" ] && continue;
echo "$SCRIPTNAME: running $testname ----------------------------"
TLS_FLAG=-T
if [ "$tls" = "TLS" ]; then
TLS_FLAG=""
fi
resFile=${TMP}/$HOST.tmpRes.$$
rm $resFile 2>/dev/null
echo "tstclnt -p ${sslPort} -h ${host} -c ${param} ${TLS_FLAG} \\"
echo " -n $testUser -w nss ${CLIEN_OPTIONS} -f \\"
echo " -d ${dbDir} < ${SSL_REQ_FILE} > $resFile"
tstclnt -w nss -p ${sslPort} -h ${host} -c ${param} \
${TLS_FLAG} ${CLIEN_OPTIONS} -f -n $testUser -w nss \
-d ${dbDir} < ${SSL_REQ_FILE} >$resFile 2>&1
ret=$?
grep "ACCESS=OK" $resFile
test $? -eq 0 -a $ret -eq 0
ret=$?
[ $ret -ne 0 ] && cat ${TMP}/$HOST.tmp.$$
rm -f $resFile 2>/dev/null
html_msg $ret 0 "${testname}"
done < ${SSLCOV}
rm -f $SSL_REQ_FILE 2>/dev/null
html "</TABLE><BR>"
}
#######################################################################
# local shell function to perform SSL Client Authentication tests
# in interoperability mode. Tests run against web server by using nss
# test client
# Params:
# $1 - supported type of testing.
# $2 - testing host
# $3 - nss db location
# No return value
#
ssl_iopr_auth_ext_server()
{
testType=$1
host=$2
dbDir=$3
setTestParam $testType
if [ "`echo $testParam | grep NOAUTH`" != "" ]; then
echo "SSL Client Authentication WebServ($IOPR_HOSTADDR) excluded from " \
"run by server configuration"
return 0
fi
html_head "SSL Client Authentication WebServ($IOPR_HOSTADDR $BYPASS_STRING $NORM_EXT):
$testDescription"
setValidCert;ret=$?
if [ $ret -ne 0 ]; then
html_failed "<TR><TD>Fail to find valid test cert(ws: $host)"
return $ret
fi
SSL_REQ_FILE=${TMP}/sslreq.dat.$$
echo "GET $sslUrl HTTP/1.0" > $SSL_REQ_FILE
echo >> $SSL_REQ_FILE
SSLAUTH_TMP=${TMP}/authin.tl.tmp
grep -v "^#" ${SSLAUTH} | grep -- "-r_-r_-r_-r" > ${SSLAUTH_TMP}
while read ecc value sparam cparam testname; do
[ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
cparam=`echo $cparam | sed -e 's;_; ;g' -e "s/TestUser/$testUser/g" `
echo "tstclnt -p ${sslPort} -h ${host} ${CLIEN_OPTIONS} -f ${cparam} \\"
echo " -d ${dbDir} < ${SSL_REQ_FILE}"
resFile=${TMP}/$HOST.tmp.$$
rm $rsFile 2>/dev/null
tstclnt -p ${sslPort} -h ${host} ${CLIEN_OPTIONS} -f ${cparam} \
-d ${dbDir} < ${SSL_REQ_FILE} >$resFile 2>&1
ret=$?
grep "ACCESS=OK" $resFile
test $? -eq 0 -a $ret -eq 0
ret=$?
[ $ret -ne 0 ] && cat $resFile
rm $resFile 2>/dev/null
html_msg $ret $value "${testname}. Client params: $cparam"\
"produced a returncode of $ret, expected is $value"
done < ${SSLAUTH_TMP}
rm -f ${SSLAUTH_TMP} ${SSL_REQ_FILE}
html "</TABLE><BR>"
}
########################################################################
# local shell function to perform SSL interoperability test with/out
# revoked certs tests. Tests run against web server by using nss
# test client
# Params:
# $1 - supported type of testing.
# $2 - testing host
# $3 - nss db location
# No return value
#
ssl_iopr_crl_ext_server()
{
testType=$1
host=$2
dbDir=$3
setTestParam $testType
if [ "`echo $testParam | grep NOCRL`" != "" ]; then
echo "CRL SSL Client Tests of WebServerv($IOPR_HOSTADDR) excluded from " \
"run by server configuration"
return 0
fi
html_head "CRL SSL Client Tests of WebServer($IOPR_HOSTADDR $BYPASS_STRING $NORM_EXT): $testDescription"
setValidCert; ret=$?
if [ $ret -ne 0 ]; then
html_failed "<TR><TD>Fail to find valid test cert(ws: $host)"
return $ret
fi
SSL_REQ_FILE=${TMP}/sslreq.dat.$$
echo "GET $sslUrl HTTP/1.0" > $SSL_REQ_FILE
echo >> $SSL_REQ_FILE
SSLAUTH_TMP=${TMP}/authin.tl.tmp
grep -v "^#" ${SSLAUTH} | grep -- "-r_-r_-r_-r" | grep -v bogus | \
grep -v none > ${SSLAUTH_TMP}
while read ecc value sparam _cparam testname; do
[ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
rev_modvalue=254
for testUser in $userCertNames; do
cparam=`echo $_cparam | sed -e 's;_; ;g' -e "s/TestUser/$testUser/g" `
echo "tstclnt -p ${sslPort} -h ${host} ${CLIEN_OPTIONS} \\"
echo " -f -d ${dbDir} ${cparam} < ${SSL_REQ_FILE}"
resFile=${TMP}/$HOST.tmp.$$
rm -f $resFile 2>/dev/null
tstclnt -p ${sslPort} -h ${host} ${CLIEN_OPTIONS} -f ${cparam} \
-d ${dbDir} < ${SSL_REQ_FILE} \
> $resFile 2>&1
ret=$?
grep "ACCESS=OK" $resFile
test $? -eq 0 -a $ret -eq 0
ret=$?
[ $ret -ne 0 ] && ret=$rev_modvalue;
[ $ret -ne 0 ] && cat $resFile
rm -f $resFile 2>/dev/null
if [ "`echo $userRevokedCertNames | grep $testUser`" != "" ]; then
modvalue=$rev_modvalue
testAddMsg="revoked"
else
testAddMsg="not revoked"
modvalue=$value
fi
html_msg $ret $modvalue "${testname} (cert ${testUser} - $testAddMsg)" \
"produced a returncode of $ret, expected is $modvalue"
done
done < ${SSLAUTH_TMP}
rm -f ${SSLAUTH_TMP} ${SSL_REQ_FILE}
html "</TABLE><BR>"
}
########################################################################
# local shell function to perform SSL Cipher Coverage tests of nss server
# by invoking remote test client on web server side.
# Invoked only if reverse testing is supported by web server.
# Params:
# $1 - remote web server host
# $2 - open port to connect to invoke CGI script
# $3 - host where selfserv is running(name of the host nss tests
# are running)
# $4 - port where selfserv is running
# $5 - selfserv nss db location
# No return value
#
ssl_iopr_cov_ext_client()
{
host=$1
port=$2
sslHost=$3
sslPort=$4
serDbDir=$5
html_head "SSL Cipher Coverage of SelfServ $IOPR_HOSTADDR. $BYPASS_STRING $NORM_EXT"
setValidCert
ret=$?
if [ $res -ne 0 ]; then
html_failed "<TR><TD>Fail to find valid test cert(ws: $host)"
return $ret
fi
# P_R_SERVERDIR switch require for selfserv to work.
# Will be restored after test
OR_P_R_SERVERDIR=$P_R_SERVERDIR
P_R_SERVERDIR=$serDbDir
OR_P_R_CLIENTDIR=$P_R_CLIENTDIR
P_R_CLIENTDIR=$serDbDir
testname=""
sparam="-vvvc ABCDEFcdefgijklmnvyz"
# Launch the server
start_selfserv
while read ecc tls param cipher therest; do
[ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
echo "============= Beginning of the test ===================="
echo
is_selfserv_alive
TEST_IN=${TMP}/${HOST}_IN.tmp.$$
TEST_OUT=${TMP}/$HOST.tmp.$$
rm -f $TEST_IN $TEST_OUT 2>/dev/null
echo "GET $reverseRunCGIScript?host=$sslHost&port=$sslPort&cert=$testUser&cipher=$cipher HTTP/1.0" > $TEST_IN
echo >> $TEST_IN
echo "------- Request ----------------------"
cat $TEST_IN
echo "------- Command ----------------------"
echo tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
-h $host \< $TEST_IN \>\> $TEST_OUT
tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
-h $host <$TEST_IN > $TEST_OUT
echo "------- Server output Begin ----------"
cat $TEST_OUT
echo "------- Server output End ----------"
echo "Checking for errors in log file..."
grep "SCRIPT=OK" $TEST_OUT 2>&1 >/dev/null
if [ $? -eq 0 ]; then
grep "cipher is not supported" $TEST_OUT 2>&1 >/dev/null
if [ $? -eq 0 ]; then
echo "Skiping test: no support for the cipher $cipher on server side"
continue
fi
grep -i "SERVER ERROR:" $TEST_OUT
ret=$?
if [ $ret -eq 0 ]; then
echo "Found problems. Reseting exit code to failure."
ret=1
else
ret=0
fi
else
echo "Script was not executed. Reseting exit code to failure."
ret=11
fi
html_msg $ret 0 "Test ${cipher}. Server params: $sparam " \
" produced a returncode of $ret, expected is 0"
rm -f $TEST_OUT $TEST_IN 2>&1 > /dev/null
done < ${SSLCOV}
kill_selfserv
P_R_SERVERDIR=$OR_P_R_SERVERDIR
rm -f ${TEST_IN} ${TEST_OUT}
html "</TABLE><BR>"
}
########################################################################
# local shell function to perform SSL Authentication tests of nss server
# by invoking remove test client on web server side
# Invoked only if reverse testing is supported by web server.
# Params:
# $1 - remote web server host
# $2 - open port to connect to invoke CGI script
# $3 - host where selfserv is running(name of the host nss tests
# are running)
# $4 - port where selfserv is running
# $5 - selfserv nss db location
# No return value
#
ssl_iopr_auth_ext_client()
{
host=$1
port=$2
sslHost=$3
sslPort=$4
serDbDir=$5
html_head "SSL Client Authentication with Selfserv from $IOPR_HOSTADDR. $BYPASS_STRING $NORM_EXT"
setValidCert
ret=$?
if [ $res -ne 0 ]; then
html_failed "<TR><TD>Fail to find valid test cert(ws: $host)"
return $ret
fi
OR_P_R_SERVERDIR=$P_R_SERVERDIR
P_R_SERVERDIR=${serDbDir}
OR_P_R_CLIENTDIR=$P_R_CLIENTDIR
P_R_CLIENTDIR=$serDbDir
SSLAUTH_TMP=${TMP}/authin.tl.tmp
grep -v "^#" $SSLAUTH | grep "\s*0\s*" > ${SSLAUTH_TMP}
while read ecc value sparam cparam testname; do
[ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
echo "Server params: $sparam"
sparam=$sparam" -vvvc ABCDEFcdefgijklmnvyz"
start_selfserv
TEST_IN=${TMP}/$HOST_IN.tmp.$$
TEST_OUT=${TMP}/$HOST.tmp.$$
rm -f $TEST_IN $TEST_OUT 2>/dev/null
echo "GET $reverseRunCGIScript?host=$sslHost&port=$sslPort&cert=$testUser HTTP/1.0" > $TEST_IN
echo >> $TEST_IN
echo "------- Request ----------------------"
cat $TEST_IN
echo "------- Command ----------------------"
echo tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
-h $host \< $TEST_IN \>\> $TEST_OUT
tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
-h $host <$TEST_IN > $TEST_OUT
echo "------- Server output Begin ----------"
cat $TEST_OUT
echo "------- Server output End ----------"
echo "Checking for errors in log file..."
grep "SCRIPT=OK" $TEST_OUT 2>&1 >/dev/null
if [ $? -eq 0 ]; then
echo "Checking for error in log file..."
grep -i "SERVER ERROR:" $TEST_OUT
ret=$?
if [ $ret -eq 0 ]; then
echo "Found problems. Reseting exit code to failure."
ret=1
else
ret=0
fi
else
echo "Script was not executed. Reseting exit code to failure."
ret=11
fi
html_msg $ret $value "${testname}. Server params: $sparam"\
"produced a returncode of $ret, expected is $value"
kill_selfserv
rm -f $TEST_OUT $TEST_IN 2>&1 > /dev/null
done < ${SSLAUTH_TMP}
P_R_SERVERDIR=$OR_P_R_SERVERDIR
rm -f ${SSLAUTH_TMP} ${TEST_IN} ${TEST_OUT}
html "</TABLE><BR>"
}
#########################################################################
# local shell function to perform SSL CRL testing of nss server
# by invoking remote test client on web server side
# Invoked only if reverse testing is supported by web server.
# Params:
# $1 - remote web server host
# $2 - open port to connect to invoke CGI script
# $3 - host where selfserv is running(name of the host nss tests
# are running)
# $4 - port where selfserv is running
# $5 - selfserv nss db location
# No return value
#
ssl_iopr_crl_ext_client()
{
host=$1
port=$2
sslHost=$3
sslPort=$4
serDbDir=$5
html_head "CRL SSL Selfserv Tests from $IOPR_HOSTADDR. $BYPASS_STRING $NORM_EXT"
OR_P_R_SERVERDIR=$P_R_SERVERDIR
P_R_SERVERDIR=${serDbDir}
OR_P_R_CLIENTDIR=$P_R_CLIENTDIR
P_R_CLIENTDIR=$serDbDir
SSLAUTH_TMP=${TMP}/authin.tl.tmp
grep -v "^#" $SSLAUTH | grep "\s*0\s*" > ${SSLAUTH_TMP}
while read ecc value sparam _cparam testname; do
[ -z "$ecc" -o "$ecc" = "#" -o "$ecc" = "ECC" ] && continue;
sparam="$sparam -vvvc ABCDEFcdefgijklmnvyz"
start_selfserv
for testUser in $userCertNames; do
is_selfserv_alive
TEST_IN=${TMP}/${HOST}_IN.tmp.$$
TEST_OUT=${TMP}/$HOST.tmp.$$
rm -f $TEST_IN $TEST_OUT 2>/dev/null
echo "GET $reverseRunCGIScript?host=$sslHost&port=$sslPort&cert=$testUser HTTP/1.0" > $TEST_IN
echo >> $TEST_IN
echo "------- Request ----------------------"
cat $TEST_IN
echo "------- Command ----------------------"
echo tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
-h ${host} \< $TEST_IN \>\> $TEST_OUT
tstclnt -d $serDbDir -w ${R_PWFILE} -o -p $port \
-h ${host} <$TEST_IN > $TEST_OUT
echo "------- Request ----------------------"
cat $TEST_IN
echo "------- Server output Begin ----------"
cat $TEST_OUT
echo "------- Server output End ----------"
echo "Checking for errors in log file..."
grep "SCRIPT=OK" $TEST_OUT 2>&1 >/dev/null
if [ $? -eq 0 ]; then
grep -i "SERVER ERROR:" $TEST_OUT
ret=$?
if [ $ret -eq 0 ]; then
echo "Found problems. Reseting exit code to failure."
ret=1
else
ret=0
fi
else
echo "Script was not executed. Reseting exit code to failure."
ret=11
fi
if [ "`echo $userRevokedCertNames | grep $testUser`" != "" ]; then
modvalue=1
testAddMsg="revoked"
else
testAddMsg="not revoked"
modvalue=0
fi
html_msg $ret $modvalue "${testname} (cert ${testUser} - $testAddMsg)" \
"produced a returncode of $ret, expected is $modvalue(selfserv args: $sparam)"
rm -f $TEST_OUT $TEST_IN 2>&1 > /dev/null
done
kill_selfserv
done < ${SSLAUTH_TMP}
P_R_SERVERDIR=$OR_P_R_SERVERDIR
rm -f ${SSLAUTH_TMP}
html "</TABLE><BR>"
}
#####################################################################
# Initial point for running ssl test againt multiple hosts involved in
# interoperability testing. Called from nss/tests/ssl/ssl.sh
# It will only proceed with test run for a specific host if environment variable
# IOPR_HOSTADDR_LIST was set, had the host name in the list
# and all needed file were successfully downloaded and installed for the host.
#
# Returns 1 if interoperability testing is off, 0 otherwise.
#
ssl_iopr_run() {
NO_ECC_CERTS=1 # disable ECC for interoperability tests
if [ "$IOPR" -ne 1 ]; then
return 1
fi
cd ${CLIENTDIR}
num=1
IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
while [ "$IOPR_HOST_PARAM" ]; do
IOPR_HOSTADDR=`echo $IOPR_HOST_PARAM | cut -f 1 -d':'`
IOPR_OPEN_PORT=`echo "$IOPR_HOST_PARAM:" | cut -f 2 -d':'`
[ -z "$IOPR_OPEN_PORT" ] && IOPR_OPEN_PORT=443
. ${IOPR_CADIR}_${IOPR_HOSTADDR}/iopr_server.cfg
RES=$?
if [ $RES -ne 0 -o X`echo "$wsFlags" | grep NOIOPR` != X ]; then
num=`expr $num + 1`
IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
continue
fi
# Testing directories defined by webserver.
echo "Testing ssl interoperability.
Client: local(tstclnt).
Server: remote($IOPR_HOSTADDR:$IOPR_OPEN_PORT)"
for sslTestType in $supportedTests; do
ssl_iopr_cov_ext_server $sslTestType ${IOPR_HOSTADDR} \
${IOPR_CLIENTDIR}_${IOPR_HOSTADDR}
ssl_iopr_auth_ext_server $sslTestType ${IOPR_HOSTADDR} \
${IOPR_CLIENTDIR}_${IOPR_HOSTADDR}
ssl_iopr_crl_ext_server $sslTestType ${IOPR_HOSTADDR} \
${IOPR_CLIENTDIR}_${IOPR_HOSTADDR}
done
# Testing selfserv with client located at the webserver.
echo "Testing ssl interoperability.
Client: remote($IOPR_HOSTADDR:$PORT)
Server: local(selfserv)"
ssl_iopr_cov_ext_client ${IOPR_HOSTADDR} ${IOPR_OPEN_PORT} \
${HOSTADDR} ${PORT} ${R_IOPR_SERVERDIR}_${IOPR_HOSTADDR}
ssl_iopr_auth_ext_client ${IOPR_HOSTADDR} ${IOPR_OPEN_PORT} \
${HOSTADDR} ${PORT} ${R_IOPR_SERVERDIR}_${IOPR_HOSTADDR}
ssl_iopr_crl_ext_client ${IOPR_HOSTADDR} ${IOPR_OPEN_PORT} \
${HOSTADDR} ${PORT} ${R_IOPR_SERVERDIR}_${IOPR_HOSTADDR}
echo "================================================"
echo "Done testing interoperability with $IOPR_HOSTADDR"
num=`expr $num + 1`
IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
done
NO_ECC_CERTS=0 #disable ECC for interoperability
return 0
}

9
mozilla/security/nss/tests/ssl/ssl.sh
View File

@@ -67,6 +67,9 @@ ssl_init()
cd ../common
. ./init.sh
fi
if [ -z "${IOPR_SSL_SOURCED}" ]; then
. ../iopr/ssl_iopr.sh
fi
if [ ! -r $CERT_LOG_FILE ]; then # we need certificates here
cd ../cert
. ./cert.sh
@@ -211,7 +214,8 @@ start_selfserv()
echo "$SCRIPTNAME: $testname ----"
fi
sparam=`echo $sparam | sed -e 's;_; ;g'`
if [ -n "$NSS_ENABLE_ECC" ] ; then
if [ -n "$NSS_ENABLE_ECC" ] && \
[ -z "$NO_ECC_CERTS" -o "$NO_ECC_CERTS" != "1" ] ; then
ECC_OPTIONS="-e ${HOSTADDR}-ec"
else
ECC_OPTIONS=""
@@ -275,7 +279,7 @@ ssl_cov()
while read ectype tls param testname
do
p=`echo "$testname" | sed -e "s/ .*//"` #sonmi, only run extended test on SSL3 and TLS
p=`echo "$testname" | sed -e "s/_.*//"` #sonmi, only run extended test on SSL3 and TLS
if [ "$p" = "SSL2" -a "$NORM_EXT" = "Extended Test" ] ; then
echo "$SCRIPTNAME: skipping $testname for $NORM_EXT"
@@ -795,5 +799,6 @@ if [ -z "$DO_REM_ST" -a -z "$DO_DIST_ST" ] ; then
BYPASS_STRING="Server Bypass"
ssl_run
ssl_iopr_run
ssl_cleanup
fi

154
mozilla/security/nss/tests/ssl/sslcov.txt
View File

@@ -7,88 +7,88 @@
# Enable Enable Cipher Test Name
# EC TLS
#
noECC noTLS A SSL2 RC4 128 WITH MD5
noECC TLS B SSL2 RC4 128 EXPORT40 WITH MD5
noECC TLS C SSL2 RC2 128 CBC WITH MD5
noECC noTLS D SSL2 RC2 128 CBC EXPORT40 WITH MD5
noECC TLS E SSL2 DES 64 CBC WITH MD5
noECC noTLS F SSL2 DES 192 EDE3 CBC WITH MD5
noECC noTLS A SSL2_RC4_128_WITH_MD5
noECC TLS B SSL2_RC4_128_EXPORT40_WITH_MD5
noECC TLS C SSL2_RC2_128_CBC_WITH_MD5
noECC noTLS D SSL2_RC2_128_CBC_EXPORT40_WITH_MD5
noECC TLS E SSL2_DES_64_CBC_WITH_MD5
noECC noTLS F SSL2_DES_192_EDE3_CBC_WITH_MD5
#
# noECC noTLS a SSL3 FORTEZZA DMS WITH FORTEZZA CBC SHA
# noECC noTLS b SSL3 FORTEZZA DMS WITH RC4 128 SHA
noECC noTLS c SSL3 RSA WITH RC4 128 MD5
noECC noTLS d SSL3 RSA WITH 3DES EDE CBC SHA
noECC noTLS e SSL3 RSA WITH DES CBC SHA
noECC noTLS f SSL3 RSA EXPORT WITH RC4 40 MD5
noECC noTLS g SSL3 RSA EXPORT WITH RC2 CBC 40 MD5
# noECC noTLS h SSL3 FORTEZZA DMS WITH NULL SHA
noECC noTLS i SSL3 RSA WITH NULL MD5
noECC noTLS j SSL3 RSA FIPS WITH 3DES EDE CBC SHA
noECC noTLS k SSL3 RSA FIPS WITH DES CBC SHA
noECC noTLS l SSL3 RSA EXPORT WITH DES CBC SHA (new)
noECC noTLS m SSL3 RSA EXPORT WITH RC4 56 SHA (new)
noECC noTLS n SSL3 RSA WITH RC4 128 SHA
noECC noTLS v SSL3 RSA WITH AES 128 CBC SHA
noECC noTLS y SSL3 RSA WITH AES 256 CBC SHA
noECC noTLS z SSL3 RSA WITH NULL SHA
# noECC noTLS a SSL3_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA
# noECC noTLS b SSL3_FORTEZZA_DMS_WITH_RC4_128_SHA
noECC noTLS c SSL3_RSA_WITH_RC4_128_MD5
noECC noTLS d SSL3_RSA_WITH_3DES_EDE_CBC_SHA
noECC noTLS e SSL3_RSA_WITH_DES_CBC_SHA
noECC noTLS f SSL3_RSA_EXPORT_WITH_RC4_40_MD5
noECC noTLS g SSL3_RSA_EXPORT_WITH_RC2_CBC_40_MD5
# noECC noTLS h SSL3_FORTEZZA_DMS_WITH_NULL_SHA
noECC noTLS i SSL3_RSA_WITH_NULL_MD5
noECC noTLS j SSL3_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
noECC noTLS k SSL3_RSA_FIPS_WITH_DES_CBC_SHA
noECC noTLS l SSL3_RSA_EXPORT_WITH_DES_CBC_SHA (new)
noECC noTLS m SSL3_RSA_EXPORT_WITH_RC4_56_SHA (new)
noECC noTLS n SSL3_RSA_WITH_RC4_128_SHA
noECC noTLS v SSL3_RSA_WITH_AES_128_CBC_SHA
noECC noTLS y SSL3_RSA_WITH_AES_256_CBC_SHA
noECC noTLS z SSL3_RSA_WITH_NULL_SHA
#
noECC TLS c TLS RSA WITH RC4 128 MD5
noECC TLS d TLS RSA WITH 3DES EDE CBC SHA
noECC TLS e TLS RSA WITH DES CBC SHA
noECC TLS f TLS RSA EXPORT WITH RC4 40 MD5
noECC TLS g TLS RSA EXPORT WITH RC2 CBC 40 MD5
noECC TLS i TLS RSA WITH NULL MD5
noECC TLS j TLS RSA FIPS WITH 3DES EDE CBC SHA
noECC TLS k TLS RSA FIPS WITH DES CBC SHA
noECC TLS l TLS RSA EXPORT WITH DES CBC SHA (new)
noECC TLS m TLS RSA EXPORT WITH RC4 56 SHA (new)
noECC TLS n TLS RSA WITH RC4 128 SHA
noECC TLS v TLS RSA WITH AES 128 CBC SHA
noECC TLS y TLS RSA WITH AES 256 CBC SHA
noECC TLS z TLS RSA WITH NULL SHA
noECC TLS c TLS_RSA_WITH_RC4_128_MD5
noECC TLS d TLS_RSA_WITH_3DES_EDE_CBC_SHA
noECC TLS e TLS_RSA_WITH_DES_CBC_SHA
noECC TLS f TLS_RSA_EXPORT_WITH_RC4_40_MD5
noECC TLS g TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5
noECC TLS i TLS_RSA_WITH_NULL_MD5
noECC TLS j TLS_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
noECC TLS k TLS_RSA_FIPS_WITH_DES_CBC_SHA
noECC TLS l TLS_RSA_EXPORT_WITH_DES_CBC_SHA (new)
noECC TLS m TLS_RSA_EXPORT_WITH_RC4_56_SHA (new)
noECC TLS n TLS_RSA_WITH_RC4_128_SHA
noECC TLS v TLS_RSA_WITH_AES_128_CBC_SHA
noECC TLS y TLS_RSA_WITH_AES_256_CBC_SHA
noECC TLS z TLS_RSA_WITH_NULL_SHA
#
# ECC ciphers (SSL3)
#
ECC noTLS :C001 SSL3 ECDH ECDSA WITH NULL SHA
ECC noTLS :C002 SSL3 ECDH ECDSA WITH RC4 128 SHA
ECC noTLS :C003 SSL3 ECDH ECDSA WITH 3DES EDE CBC SHA
ECC noTLS :C004 SSL3 ECDH ECDSA WITH AES 128 CBC SHA
ECC noTLS :C005 SSL3 ECDH ECDSA WITH AES 256 CBC SHA
ECC noTLS :C006 SSL3 ECDHE ECDSA WITH NULL SHA
ECC noTLS :C007 SSL3 ECDHE ECDSA WITH RC4 128 SHA
ECC noTLS :C008 SSL3 ECDHE ECDSA WITH 3DES EDE CBC SHA
ECC noTLS :C009 SSL3 ECDHE ECDSA WITH AES 128 CBC SHA
ECC noTLS :C00A SSL3 ECDHE ECDSA WITH AES 256 CBC SHA
ECC noTLS :C00B SSL3 ECDH RSA WITH NULL SHA
ECC noTLS :C00C SSL3 ECDH RSA WITH RC4 128 SHA
ECC noTLS :C00D SSL3 ECDH RSA WITH 3DES EDE CBC SHA
ECC noTLS :C00E SSL3 ECDH RSA WITH AES 128 CBC SHA
ECC noTLS :C00F SSL3 ECDH RSA WITH AES 256 CBC SHA
ECC noTLS :C010 SSL3 ECDHE RSA WITH NULL SHA
ECC noTLS :C011 SSL3 ECDHE RSA WITH RC4 128 SHA
ECC noTLS :C012 SSL3 ECDHE RSA WITH 3DES EDE CBC SHA
ECC noTLS :C013 SSL3 ECDHE RSA WITH AES 128 CBC SHA
ECC noTLS :C014 SSL3 ECDHE RSA WITH AES 256 CBC SHA
ECC noTLS :C001 SSL3_ECDH_ECDSA_WITH_NULL_SHA
ECC noTLS :C002 SSL3_ECDH_ECDSA_WITH_RC4_128_SHA
ECC noTLS :C003 SSL3_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
ECC noTLS :C004 SSL3_ECDH_ECDSA_WITH_AES_128_CBC_SHA
ECC noTLS :C005 SSL3_ECDH_ECDSA_WITH_AES_256_CBC_SHA
ECC noTLS :C006 SSL3_ECDHE_ECDSA_WITH_NULL_SHA
ECC noTLS :C007 SSL3_ECDHE_ECDSA_WITH_RC4_128_SHA
ECC noTLS :C008 SSL3_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
ECC noTLS :C009 SSL3_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
ECC noTLS :C00A SSL3_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
ECC noTLS :C00B SSL3_ECDH_RSA_WITH_NULL_SHA
ECC noTLS :C00C SSL3_ECDH_RSA_WITH_RC4_128_SHA
ECC noTLS :C00D SSL3_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
ECC noTLS :C00E SSL3_ECDH_RSA_WITH_AES_128_CBC_SHA
ECC noTLS :C00F SSL3_ECDH_RSA_WITH_AES_256_CBC_SHA
ECC noTLS :C010 SSL3_ECDHE_RSA_WITH_NULL_SHA
ECC noTLS :C011 SSL3_ECDHE_RSA_WITH_RC4_128_SHA
ECC noTLS :C012 SSL3_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
ECC noTLS :C013 SSL3_ECDHE_RSA_WITH_AES_128_CBC_SHA
ECC noTLS :C014 SSL3_ECDHE_RSA_WITH_AES_256_CBC_SHA
#
# ECC ciphers (TLS)
#
ECC TLS :C001 TLS ECDH ECDSA WITH NULL SHA
ECC TLS :C002 TLS ECDH ECDSA WITH RC4 128 SHA
ECC TLS :C003 TLS ECDH ECDSA WITH 3DES EDE CBC SHA
ECC TLS :C004 TLS ECDH ECDSA WITH AES 128 CBC SHA
ECC TLS :C005 TLS ECDH ECDSA WITH AES 256 CBC SHA
ECC TLS :C006 TLS ECDHE ECDSA WITH NULL SHA
ECC TLS :C007 TLS ECDHE ECDSA WITH RC4 128 SHA
ECC TLS :C008 TLS ECDHE ECDSA WITH 3DES EDE CBC SHA
ECC TLS :C009 TLS ECDHE ECDSA WITH AES 128 CBC SHA
ECC TLS :C00A TLS ECDHE ECDSA WITH AES 256 CBC SHA
ECC TLS :C00B TLS ECDH RSA WITH NULL SHA
ECC TLS :C00C TLS ECDH RSA WITH RC4 128 SHA
ECC TLS :C00D TLS ECDH RSA WITH 3DES EDE CBC SHA
ECC TLS :C00E TLS ECDH RSA WITH AES 128 CBC SHA
ECC TLS :C00F TLS ECDH RSA WITH AES 256 CBC SHA
ECC TLS :C010 TLS ECDHE RSA WITH NULL SHA
ECC TLS :C011 TLS ECDHE RSA WITH RC4 128 SHA
ECC TLS :C012 TLS ECDHE RSA WITH 3DES EDE CBC SHA
ECC TLS :C013 TLS ECDHE RSA WITH AES 128 CBC SHA
ECC TLS :C014 TLS ECDHE RSA WITH AES 256 CBC SHA
ECC TLS :C001 TLS_ECDH_ECDSA_WITH_NULL_SHA
ECC TLS :C002 TLS_ECDH_ECDSA_WITH_RC4_128_SHA
ECC TLS :C003 TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
ECC TLS :C004 TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
ECC TLS :C005 TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
ECC TLS :C006 TLS_ECDHE_ECDSA_WITH_NULL_SHA
ECC TLS :C007 TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
ECC TLS :C008 TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
ECC TLS :C009 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
ECC TLS :C00A TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
ECC TLS :C00B TLS_ECDH_RSA_WITH_NULL_SHA
ECC TLS :C00C TLS_ECDH_RSA_WITH_RC4_128_SHA
ECC TLS :C00D TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
ECC TLS :C00E TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
ECC TLS :C00F TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
ECC TLS :C010 TLS_ECDHE_RSA_WITH_NULL_SHA
ECC TLS :C011 TLS_ECDHE_RSA_WITH_RC4_128_SHA
ECC TLS :C012 TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
ECC TLS :C013 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
ECC TLS :C014 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA