lib/hx509/test_cms.in

   1 #!/bin/sh
   2 #
   3 # Copyright (c) 2005 Kungliga Tekniska Högskolan
   4 # (Royal Institute of Technology, Stockholm, Sweden).
   5 # All rights reserved.
   6 #
   7 # Redistribution and use in source and binary forms, with or without
   8 # modification, are permitted provided that the following conditions
   9 # are met:
  10 #
  11 # 1. Redistributions of source code must retain the above copyright
  12 #    notice, this list of conditions and the following disclaimer.
  13 #
  14 # 2. Redistributions in binary form must reproduce the above copyright
  15 #    notice, this list of conditions and the following disclaimer in the
  16 #    documentation and/or other materials provided with the distribution.
  17 #
  18 # 3. Neither the name of the Institute nor the names of its contributors
  19 #    may be used to endorse or promote products derived from this software
  20 #    without specific prior written permission.
  21 #
  22 # THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  23 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25 # ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  26 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32 # SUCH DAMAGE.
  33 #
  34 # $Id$
  35 #
  36
  37 srcdir="@srcdir@"
  38 objdir="@objdir@"
  39
  40 stat="--statistic-file=${objdir}/statfile"
  41
  42 hxtool="${TESTS_ENVIRONMENT} ./hxtool ${stat}"
  43
  44 if ${hxtool} info | grep 'rsa: hcrypto null RSA' > /dev/null ; then
  45     exit 77
  46 fi
  47 if ${hxtool} info | grep 'rand: not available' > /dev/null ; then
  48     exit 77
  49 fi
  50
  51 echo "create signed data"
  52 ${hxtool} cms-create-sd \
  53         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
  54         "$srcdir/test_chain.in" \
  55         sd.data > /dev/null || exit 1
  56
  57 echo "verify signed data"
  58 ${hxtool} cms-verify-sd \
  59         --missing-revoke \
  60         --anchors=FILE:$srcdir/data/ca.crt \
  61         sd.data sd.data.out > /dev/null || exit 1
  62 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
  63
  64 echo "create signed data (id-by-name)"
  65 ${hxtool} cms-create-sd \
  66         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
  67         --id-by-name \
  68         "$srcdir/test_chain.in" \
  69         sd.data > /dev/null || exit 1
  70
  71 echo "verify signed data"
  72 ${hxtool} cms-verify-sd \
  73         --missing-revoke \
  74         --anchors=FILE:$srcdir/data/ca.crt \
  75         sd.data sd.data.out > /dev/null || exit 1
  76 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
  77
  78 echo "verify signed data (EE cert as anchor)"
  79 ${hxtool} cms-verify-sd \
  80         --missing-revoke \
  81         --anchors=FILE:$srcdir/data/test.crt \
  82         sd.data sd.data.out > /dev/null || exit 1
  83 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
  84
  85 echo "create signed data (password)"
  86 ${hxtool} cms-create-sd \
  87         --pass=PASS:foobar \
  88         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test-pw.key \
  89         "$srcdir/test_chain.in" \
  90         sd.data > /dev/null || exit 1
  91
  92 echo "verify signed data"
  93 ${hxtool} cms-verify-sd \
  94         --missing-revoke \
  95         --anchors=FILE:$srcdir/data/ca.crt \
  96         sd.data sd.data.out > /dev/null || exit 1
  97 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
  98
  99 echo "create signed data (combined)"
 100 ${hxtool} cms-create-sd \
 101         --certificate=FILE:$srcdir/data/test.combined.crt \
 102         "$srcdir/test_chain.in" \
 103         sd.data > /dev/null || exit 1
 104
 105 echo "verify signed data"
 106 ${hxtool} cms-verify-sd \
 107         --missing-revoke \
 108         --anchors=FILE:$srcdir/data/ca.crt \
 109         sd.data sd.data.out > /dev/null || exit 1
 110 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 111
 112 echo "create signed data  (content info)"
 113 ${hxtool} cms-create-sd \
 114         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 115         --content-info \
 116         "$srcdir/test_chain.in" \
 117         sd.data > /dev/null || exit 1
 118
 119 echo "verify signed data (content info)"
 120 ${hxtool} cms-verify-sd \
 121         --missing-revoke \
 122         --anchors=FILE:$srcdir/data/ca.crt \
 123         --content-info \
 124         sd.data sd.data.out > /dev/null || exit 1
 125 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 126
 127 echo "create signed data  (content type)"
 128 ${hxtool} cms-create-sd \
 129         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 130         --content-type=1.1.1.1 \
 131         "$srcdir/test_chain.in" \
 132         sd.data > /dev/null || exit 1
 133
 134 echo "verify signed data (content type)"
 135 ${hxtool} cms-verify-sd \
 136         --missing-revoke \
 137         --anchors=FILE:$srcdir/data/ca.crt \
 138         sd.data sd.data.out > /dev/null || exit 1
 139 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 140
 141 echo "create signed data (pem)"
 142 ${hxtool} cms-create-sd \
 143         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 144         --pem \
 145         "$srcdir/test_chain.in" \
 146         sd.data > /dev/null || exit 1
 147
 148 echo "verify signed data (pem)"
 149 ${hxtool} cms-verify-sd \
 150         --missing-revoke \
 151         --anchors=FILE:$srcdir/data/ca.crt \
 152         --pem \
 153         sd.data sd.data.out > /dev/null
 154 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 155
 156 echo "create signed data (pem, detached)"
 157 ${hxtool} cms-create-sd \
 158         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 159         --detached-signature \
 160         --pem \
 161         "$srcdir/test_chain.in" \
 162         sd.data > /dev/null || exit 1
 163
 164 echo "verify signed data (pem, detached)"
 165 ${hxtool} cms-verify-sd \
 166         --missing-revoke \
 167         --anchors=FILE:$srcdir/data/ca.crt \
 168         --pem \
 169         --signed-content="$srcdir/test_chain.in" \
 170         sd.data sd.data.out > /dev/null
 171 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 172
 173 echo "create signed data (p12)"
 174 ${hxtool} cms-create-sd \
 175         --pass=PASS:foobar \
 176         --certificate=PKCS12:$srcdir/data/test.p12 \
 177         --signer=friendlyname-test \
 178         "$srcdir/test_chain.in" \
 179         sd.data > /dev/null || exit 1
 180
 181 echo "verify signed data"
 182 ${hxtool} cms-verify-sd \
 183         --missing-revoke \
 184         --anchors=FILE:$srcdir/data/ca.crt \
 185         --content-info \
 186         "$srcdir/data/test-signed-data" sd.data.out > /dev/null || exit 1
 187 cmp "$srcdir/data/static-file" sd.data.out || exit 1
 188
 189 echo "verify signed data (no attr)"
 190 ${hxtool} cms-verify-sd \
 191         --missing-revoke \
 192         --anchors=FILE:$srcdir/data/ca.crt \
 193         --content-info \
 194         "$srcdir/data/test-signed-data-noattr" sd.data.out > /dev/null || exit 1
 195 cmp "$srcdir/data/static-file" sd.data.out || exit 1
 196
 197 echo "verify failure signed data (no attr, no certs)"
 198 ${hxtool} cms-verify-sd \
 199         --missing-revoke \
 200         --anchors=FILE:$srcdir/data/ca.crt \
 201         --content-info \
 202         "$srcdir/data/test-signed-data-noattr-nocerts" \
 203         sd.data.out > /dev/null 2>/dev/null && exit 1
 204
 205 echo "verify signed data (no attr, no certs)"
 206 ${hxtool} cms-verify-sd \
 207         --missing-revoke \
 208         --anchors=FILE:$srcdir/data/ca.crt \
 209         --certificate=FILE:$srcdir/data/test.crt \
 210         --content-info \
 211         "$srcdir/data/test-signed-data-noattr-nocerts" \
 212         sd.data.out > /dev/null || exit 1
 213 cmp "$srcdir/data/static-file" sd.data.out || exit 1
 214
 215 echo "create signed data (subcert, no certs)"
 216 ${hxtool} cms-create-sd \
 217         --certificate=FILE:$srcdir/data/sub-cert.crt,$srcdir/data/sub-cert.key \
 218         "$srcdir/test_chain.in" \
 219         sd.data > /dev/null || exit 1
 220
 221 echo "verify failure signed data"
 222 ${hxtool} cms-verify-sd \
 223         --missing-revoke \
 224         --anchors=FILE:$srcdir/data/ca.crt \
 225         sd.data sd.data.out > /dev/null 2> /dev/null && exit 1
 226
 227 echo "verify success signed data"
 228 ${hxtool} cms-verify-sd \
 229         --missing-revoke \
 230         --certificate=FILE:$srcdir/data/sub-ca.crt \
 231         --anchors=FILE:$srcdir/data/ca.crt \
 232         sd.data sd.data.out > /dev/null || exit 1
 233 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 234
 235 echo "create signed data (subcert, certs)"
 236 ${hxtool} cms-create-sd \
 237         --certificate=FILE:$srcdir/data/sub-cert.crt,$srcdir/data/sub-cert.key \
 238         --pool=FILE:$srcdir/data/sub-ca.crt \
 239         --anchors=FILE:$srcdir/data/ca.crt \
 240         "$srcdir/test_chain.in" \
 241         sd.data > /dev/null || exit 1
 242
 243 echo "verify success signed data"
 244 ${hxtool} cms-verify-sd \
 245         --missing-revoke \
 246         --anchors=FILE:$srcdir/data/ca.crt \
 247         sd.data sd.data.out > /dev/null || exit 1
 248 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 249
 250 echo "create signed data (subcert, certs, no-root)"
 251 ${hxtool} cms-create-sd \
 252         --certificate=FILE:$srcdir/data/sub-cert.crt,$srcdir/data/sub-cert.key \
 253         --pool=FILE:$srcdir/data/sub-ca.crt \
 254         "$srcdir/test_chain.in" \
 255         sd.data > /dev/null || exit 1
 256
 257 echo "verify success signed data"
 258 ${hxtool} cms-verify-sd \
 259         --missing-revoke \
 260         --anchors=FILE:$srcdir/data/ca.crt \
 261         sd.data sd.data.out > /dev/null || exit 1
 262 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 263
 264 echo "create signed data (subcert, no-subca, no-root)"
 265 ${hxtool} cms-create-sd \
 266         --certificate=FILE:$srcdir/data/sub-cert.crt,$srcdir/data/sub-cert.key \
 267         "$srcdir/test_chain.in" \
 268         sd.data > /dev/null || exit 1
 269
 270 echo "verify failure signed data"
 271 ${hxtool} cms-verify-sd \
 272         --missing-revoke \
 273         --anchors=FILE:$srcdir/data/ca.crt \
 274         sd.data sd.data.out > /dev/null 2>/dev/null && exit 1
 275
 276 echo "create signed data (sd cert)"
 277 ${hxtool} cms-create-sd \
 278         --certificate=FILE:$srcdir/data/test-ds-only.crt,$srcdir/data/test-ds-only.key \
 279         "$srcdir/test_chain.in" \
 280         sd.data > /dev/null || exit 1
 281
 282 echo "create signed data (ke cert)"
 283 ${hxtool} cms-create-sd \
 284         --certificate=FILE:$srcdir/data/test-ke-only.crt,$srcdir/data/test-ke-only.key \
 285         "$srcdir/test_chain.in" \
 286         sd.data > /dev/null 2>/dev/null && exit 1
 287
 288 echo "create signed data (sd + ke certs)"
 289 ${hxtool} cms-create-sd \
 290         --certificate=FILE:$srcdir/data/test-ke-only.crt,$srcdir/data/test-ke-only.key \
 291         --certificate=FILE:$srcdir/data/test-ds-only.crt,$srcdir/data/test-ds-only.key \
 292         "$srcdir/test_chain.in" \
 293         sd.data > /dev/null || exit 1
 294
 295 echo "create signed data (ke + sd certs)"
 296 ${hxtool} cms-create-sd \
 297         --certificate=FILE:$srcdir/data/test-ds-only.crt,$srcdir/data/test-ds-only.key \
 298         --certificate=FILE:$srcdir/data/test-ke-only.crt,$srcdir/data/test-ke-only.key \
 299         "$srcdir/test_chain.in" \
 300         sd.data > /dev/null || exit 1
 301
 302 echo "create signed data (detached)"
 303 ${hxtool} cms-create-sd \
 304         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 305         --detached-signature \
 306         "$srcdir/test_chain.in" \
 307         sd.data > /dev/null || exit 1
 308
 309 echo "verify signed data (detached)"
 310 ${hxtool} cms-verify-sd \
 311         --missing-revoke \
 312         --signed-content="$srcdir/test_chain.in" \
 313         --anchors=FILE:$srcdir/data/ca.crt \
 314         sd.data sd.data.out > /dev/null || exit 1
 315 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 316
 317 echo "verify failure signed data (detached)"
 318 ${hxtool} cms-verify-sd \
 319         --missing-revoke \
 320         --anchors=FILE:$srcdir/data/ca.crt \
 321         sd.data sd.data.out > /dev/null 2>/dev/null && exit 1
 322
 323 echo "create signed data (rsa)"
 324 ${hxtool} cms-create-sd \
 325         --peer-alg=1.2.840.113549.1.1.1 \
 326         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 327         "$srcdir/test_chain.in" \
 328         sd.data > /dev/null || exit 1
 329
 330 echo "verify signed data (rsa)"
 331 ${hxtool} cms-verify-sd \
 332         --missing-revoke \
 333         --anchors=FILE:$srcdir/data/ca.crt \
 334         sd.data sd.data.out > /dev/null 2>/dev/null || exit 1
 335 cmp "$srcdir/test_chain.in" sd.data.out || exit 1
 336
 337 echo "envelope data (content-type)"
 338 ${hxtool} cms-envelope \
 339         --certificate=FILE:$srcdir/data/test.crt \
 340         --content-type=1.1.1.1 \
 341         "$srcdir/data/static-file" \
 342         ev.data > /dev/null || exit 1
 343
 344 echo "unenvelope data (content-type)"
 345 ${hxtool} cms-unenvelope \
 346         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 347         ev.data ev.data.out \
 348         FILE:$srcdir/data/test.crt,$srcdir/data/test.key > /dev/null || exit 1
 349 cmp "$srcdir/data/static-file" ev.data.out || exit 1
 350
 351 echo "envelope data (content-info)"
 352 ${hxtool} cms-envelope \
 353         --certificate=FILE:$srcdir/data/test.crt \
 354         --content-info \
 355         "$srcdir/data/static-file" \
 356         ev.data > /dev/null || exit 1
 357
 358 echo "unenvelope data (content-info)"
 359 ${hxtool} cms-unenvelope \
 360         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 361         --content-info \
 362         ev.data ev.data.out \
 363         FILE:$srcdir/data/test.crt,$srcdir/data/test.key > /dev/null || exit 1
 364 cmp "$srcdir/data/static-file" ev.data.out || exit 1
 365
 366 for a in des-ede3 aes-128 aes-256; do
 367
 368         rm -f ev.data ev.data.out
 369         echo "envelope data ($a)"
 370         ${hxtool} cms-envelope \
 371                 --encryption-type="$a-cbc" \
 372                 --certificate=FILE:$srcdir/data/test.crt \
 373                 "$srcdir/data/static-file" \
 374                 ev.data  || exit 1
 375
 376         echo "unenvelope data ($a)"
 377         ${hxtool} cms-unenvelope \
 378                 --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 379                 ev.data ev.data.out > /dev/null || exit 1
 380         cmp "$srcdir/data/static-file" ev.data.out || exit 1
 381 done
 382
 383 for a in rc2-40 rc2-64 rc2-128 des-ede3 aes-128 aes-256; do
 384     echo "static unenvelope data ($a)"
 385
 386     rm -f ev.data.out
 387     ${hxtool} cms-unenvelope \
 388         --certificate=FILE:$srcdir/data/test.crt,$srcdir/data/test.key \
 389         --content-info \
 390         "$srcdir/data/test-enveloped-$a" ev.data.out > /dev/null || exit 1
 391     cmp "$srcdir/data/static-file" ev.data.out || exit 1
 392 done
 393
 394 exit 0