source4/heimdal/lib/hx509/test_req.in

   1 #!/bin/sh
   2 #
   3 # Copyright (c) 2005 - 2007 Kungliga Tekniska Högskolan
   4 # (Royal Institute of Technology, Stockholm, Sweden).
   5 # All rights reserved.
   6 #
   7 # Redistribution and use in source and binary forms, with or without
   8 # modification, are permitted provided that the following conditions
   9 # are met:
  10 #
  11 # 1. Redistributions of source code must retain the above copyright
  12 #    notice, this list of conditions and the following disclaimer.
  13 #
  14 # 2. Redistributions in binary form must reproduce the above copyright
  15 #    notice, this list of conditions and the following disclaimer in the
  16 #    documentation and/or other materials provided with the distribution.
  17 #
  18 # 3. Neither the name of the Institute nor the names of its contributors
  19 #    may be used to endorse or promote products derived from this software
  20 #    without specific prior written permission.
  21 #
  22 # THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  23 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25 # ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  26 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32 # SUCH DAMAGE.
  33 #
  34 # $Id$
  35 #
  36
  37 srcdir="@srcdir@"
  38 objdir="@objdir@"
  39
  40 stat="--statistic-file=${objdir}/statfile"
  41
  42 hxtool="${TESTS_ENVIRONMENT} ./hxtool ${stat}"
  43
  44 if ${hxtool} info | grep 'rsa: hcrypto null RSA' > /dev/null ; then
  45     exit 77
  46 fi
  47 if ${hxtool} info | grep 'rand: not available' > /dev/null ; then
  48     exit 77
  49 fi
  50
  51 ${hxtool} request-create \
  52          --subject="CN=Love,DC=it,DC=su,DC=se" \
  53          --key="FILE:$srcdir/data/key.der" \
  54          "${objdir}/request.out" || exit 1
  55
  56 ${hxtool} request-print \
  57          PKCS10:request.out > /dev/null || exit 1
  58
  59 ${hxtool} request-create \
  60          --subject="CN=Love,DC=it,DC=su,DC=se" \
  61          --eku=1.2.3.4.5.6.7 --eku=1.2.3.4.5.6.8 \
  62          --registered=1.2.3.4.5.6.9 --eku=1.2.3.4.5.6.10 \
  63          --dnsname=nutcracker.test.h5l.se \
  64          --dnsname=foo.nutcracker.test.h5l.se \
  65          --kerberos=HTTP/foo.nutcracker.it.su.se@TEST.H5L.SE \
  66          --kerberos=host/foo.nutcracker.it.su.se@TEST.H5L.SE \
  67          --email=foo@test.h5l.se \
  68          --key="FILE:$srcdir/data/key.der" \
  69          "${objdir}/request.out" || exit 1
  70
  71 cat > "$objdir/expected" <<EOF
  72 request print
  73 PKCS#10 CertificationRequest:
  74   name: CN=Love,DC=it,DC=su,DC=se
  75   eku: {1.2.3.4.5.6.7}, {1.2.3.4.5.6.8}, {1.2.3.4.5.6.10}
  76   san: rfc822Name: foo@test.h5l.se
  77   san: dNSName: nutcracker.test.h5l.se
  78   san: dNSName: foo.nutcracker.test.h5l.se
  79   san: pkinit: HTTP/foo.nutcracker.it.su.se@TEST.H5L.SE
  80   san: pkinit: host/foo.nutcracker.it.su.se@TEST.H5L.SE
  81   san: registeredID: 1.2.3.4.5.6.9
  82 EOF
  83
  84 # Check that we got what we wanted:
  85 ${hxtool} request-print \
  86          PKCS10:request.out > "${objdir}/actual" || exit 1
  87
  88 diff "$objdir/expected" "${objdir}/actual" || exit 1
  89
  90 # Check that OpenSSL can parse our request:
  91 if openssl version > /dev/null; then
  92     openssl req -inform DER -in "${objdir}/request.out" -text | head -25 > "${objdir}/actual"
  93
  94     # Various versions of openssl differ slightly in their text output for our
  95     # CSR.  Figure out what to expect:
  96     if grep "Version: 0" "${objdir}/actual" > /dev/null; then
  97         v=0
  98     else
  99         v=1
 100     fi
 101     if grep "RSA Public-Key:" "${objdir}/actual" > /dev/null; then
 102         k="RSA "
 103     else
 104         k=""
 105     fi
 106     # Note interpolation of $v and $k in the here doc below:
 107     cat > "$objdir/expected" <<EOF
 108 Certificate Request:
 109     Data:
 110         Version: $v (0x0)
 111         Subject: DC = se, DC = su, DC = it, CN = Love
 112         Subject Public Key Info:
 113             Public Key Algorithm: rsaEncryption
 114                 ${k}Public-Key: (1024 bit)
 115                 Modulus:
 116                     00:c2:aa:a2:42:b7:5b:99:a3:fd:ba:f0:9b:75:db:
 117                     ef:3c:9b:8c:cf:63:5f:46:d8:95:be:09:4a:a7:76:
 118                     79:77:61:30:ef:0b:98:d2:47:ea:9c:09:b9:b9:b7:
 119                     15:ac:4b:9c:2d:3f:f0:d9:99:9d:4d:5a:68:67:24:
 120                     58:5e:65:60:13:9f:4d:dc:2f:03:1d:cd:e9:b6:33:
 121                     c2:5c:c6:de:c9:93:6c:ec:8d:9a:67:0e:dd:31:20:
 122                     ac:91:39:7a:c1:8f:39:65:ff:b3:1f:cf:7a:aa:79:
 123                     8b:ed:eb:ad:a0:be:01:10:4c:5a:a7:47:1d:c6:ee:
 124                     79:39:5c:c7:11:6c:b9:e7:2b
 125                 Exponent: 65537 (0x10001)
 126         Attributes:
 127         Requested Extensions:
 128             X509v3 Extended Key Usage: critical
 129                 1.2.3.4.5.6.7, 1.2.3.4.5.6.8, 1.2.3.4.5.6.10
 130             X509v3 Subject Alternative Name:
 131                 email:foo@test.h5l.se, DNS:nutcracker.test.h5l.se, DNS:foo.nutcracker.test.h5l.se, othername:<unsupported>, othername:<unsupported>, Registered ID:1.2.3.4.5.6.9
 132     Signature Algorithm: sha256WithRSAEncryption
 133 EOF
 134     diff -w "${objdir}/expected" "${objdir}/actual" || exit 1
 135 fi