]>
git.ipfire.org Git - thirdparty/openssl.git/blob - test/recipes/80-test_tsa.t
2 # Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
14 use File
::Spec
::Functions qw
/splitdir curdir catfile/;
16 use OpenSSL
::Test qw
/:DEFAULT cmdstr srctop_file data_file/;
17 use OpenSSL
::Test
::Utils
;
21 plan skip_all
=> "TS is not supported by this OpenSSL build"
24 # All these are modified inside indir further down. They need to exist
25 # here, however, to be available in all subroutines.
30 my @QUERY = ("openssl", "ts", "-query");
32 my @VERIFY = ("openssl", "ts", "-verify");
38 $ENV{TSDNSECT
} = "ts_cert_dn";
40 ok
(run
(app
(["openssl", "req", "-config", $openssl_conf, "-new",
41 "-out", "tsa_req${INDEX}.pem",
42 "-key", srctop_file
("test", "certs", "alt${INDEX}-key.pem"),
43 "-keyout", "tsa_key${INDEX}.pem"])));
44 note
"using extension $EXT";
45 ok
(run
(app
(["openssl", "x509", "-req",
46 "-in", "tsa_req${INDEX}.pem",
47 "-out", "tsa_cert${INDEX}.pem",
48 "-CA", "tsaca.pem", "-CAkey", $tsacakey,
50 "-extfile", $openssl_conf, "-extensions", $EXT])));
56 my $queryfile = shift;
57 my $outputfile = shift;
59 ok
(run
(app
([@REPLY, "-section", $config, "-queryfile", $queryfile,
60 "-chain", $chain, # this overrides "certs" entry in config
61 "-out", $outputfile])));
66 my $queryfile = shift;
67 my $inputfile = shift;
68 my $untrustedfile = shift;
70 ok
(run
(app
([@VERIFY, "-queryfile", $queryfile, "-in", $inputfile,
71 "-CAfile", "tsaca.pem", "-untrusted", $untrustedfile])));
72 ok
(run
(app
([@VERIFY, "-data", $datafile, "-in", $inputfile,
73 "-CAfile", "tsaca.pem", "-untrusted", $untrustedfile])));
77 my $queryfile = shift;
78 my $inputfile = shift;
79 my $untrustedfile = shift; # is needed for resp2, but not for resp1
82 ok
(!run
(app
([@VERIFY, "-queryfile", $queryfile, "-in", $inputfile,
83 "-untrusted", $untrustedfile, "-CAfile", $cafile])));
90 note
"setting up TSA test directory";
93 $openssl_conf = srctop_file
("test", "CAtsa.cnf");
94 $testtsa = srctop_file
("test", "recipes", "80-test_tsa.t");
95 $tsacakey = srctop_file
("test", "certs", "ca-key.pem");
96 $CAtsa = srctop_file
("test", "CAtsa.cnf");
97 @REPLY = ("openssl", "ts", "-config", $openssl_conf, "-reply");
99 # ../apps/CA.pl needs these
100 $ENV{OPENSSL_CONFIG
} = "-config $openssl_conf";
101 $ENV{OPENSSL
} = cmdstr
(app
(["openssl"]), display
=> 1);
104 $ENV{TSDNSECT
} = "ts_ca_dn";
106 unless ok
(run
(app
(["openssl", "req", "-config", $openssl_conf,
107 "-new", "-x509", "-noenc",
108 "-out", "tsaca.pem", "-key", $tsacakey])),
109 'creating a new CA for the TSA tests');
112 unless subtest
'creating tsa_cert1.pem TSA server cert' => sub {
113 create_tsa_cert
("1", "tsa_cert")
117 unless subtest
'creating tsa_cert2.pem non-TSA server cert' => sub {
118 create_tsa_cert
("2", "non_tsa_cert")
122 unless ok
(run
(app
([@QUERY, "-data", $testtsa,
123 "-tspolicy", "tsa_policy1", "-cert",
124 "-out", "req1.tsq"])),
125 'creating req1.req time stamp request for file testtsa');
127 ok
(run
(app
([@QUERY, "-in", "req1.tsq", "-text"])),
128 'printing req1.req');
130 subtest
'generating valid response for req1.req' => sub {
131 create_resp
("tsa_config1", "tsaca.pem", "req1.tsq", "resp1.tsr")
134 subtest
'generating response with wrong 2nd certid for req1.req' => sub {
135 create_resp
("tsa_config1", "tsa_cert1.pem", "req1.tsq",
139 ok
(run
(app
([@REPLY, "-in", "resp1.tsr", "-text"])),
140 'printing response');
142 subtest
'verifying valid response' => sub {
143 verify_ok
($testtsa, "req1.tsq", "resp1.tsr", "tsa_cert1.pem")
147 unless subtest
'verifying valid token' => sub {
148 ok
(run
(app
([@REPLY, "-in", "resp1.tsr",
149 "-out", "resp1.tsr.token", "-token_out"])));
150 ok
(run
(app
([@VERIFY, "-queryfile", "req1.tsq",
151 "-in", "resp1.tsr.token", "-token_in",
152 "-CAfile", "tsaca.pem"])));
153 ok
(run
(app
([@VERIFY, "-data", $testtsa,
154 "-in", "resp1.tsr.token", "-token_in",
155 "-CAfile", "tsaca.pem"])));
159 unless ok
(run
(app
([@QUERY, "-data", $testtsa,
160 "-tspolicy", "tsa_policy2", "-no_nonce",
161 "-out", "req2.tsq"])),
162 'creating req2.req time stamp request for file testtsa');
164 ok
(run
(app
([@QUERY, "-in", "req2.tsq", "-text"])),
165 'printing req2.req');
168 unless subtest
'generating valid response for req2.req' => sub {
169 create_resp
("tsa_config1", "tsaca.pem", "req2.tsq", "resp2.tsr")
173 unless subtest
'checking -token_in and -token_out options with -reply' => sub {
174 my $RESPONSE2="resp2.tsr.copy.tsr";
175 my $TOKEN_DER="resp2.tsr.token.der";
177 ok
(run
(app
([@REPLY, "-in", "resp2.tsr",
178 "-out", "$TOKEN_DER", "-token_out"])));
179 ok
(run
(app
([@REPLY, "-in", "$TOKEN_DER",
180 "-token_in", "-out", "$RESPONSE2"])));
181 is
(compare
($RESPONSE2, "resp2.tsr"), 0);
182 ok
(run
(app
([@REPLY, "-in", "resp2.tsr",
183 "-text", "-token_out"])));
184 ok
(run
(app
([@REPLY, "-in", "$TOKEN_DER",
185 "-token_in", "-text", "-token_out"])));
186 ok
(run
(app
([@REPLY, "-queryfile", "req2.tsq",
187 "-text", "-token_out"])));
190 ok
(run
(app
([@REPLY, "-in", "resp2.tsr", "-text"])),
191 'printing response');
193 subtest
'verifying valid resp1, wrong untrusted is not used' => sub {
194 verify_ok
($testtsa, "req1.tsq", "resp1.tsr", "tsa_cert2.pem")
197 subtest
'verifying invalid resp1 with wrong 2nd certid' => sub {
198 verify_fail
($testtsa, "req1.tsq", "resp1_invalid.tsr", "tsa_cert2.pem")
201 subtest
'verifying valid resp2, correct untrusted being used' => sub {
202 verify_ok
($testtsa, "req2.tsq", "resp2.tsr", "tsa_cert1.pem")
205 subtest
'verifying resp2 against wrong req1 should fail' => sub {
206 verify_fail
("req1.tsq", "resp2.tsr", "tsa_cert1.pem", "tsaca.pem")
209 subtest
'verifying resp1 against wrong req2 should fail' => sub {
210 verify_fail
("req2.tsq", "resp1.tsr", "tsa_cert1.pem", "tsaca.pem")
213 subtest
'verifying resp1 using wrong untrusted should fail' => sub {
214 verify_fail
("req2.tsq", "resp2.tsr", "tsa_cert2.pem", "tsaca.pem")
217 subtest
'verifying resp1 using wrong root should fail' => sub {
218 verify_fail
("req1.tsq", "resp1.tsr", "tsa_cert1.pem", "tsa_cert1.pem")
222 unless ok
(run
(app
([@QUERY, "-data", $CAtsa,
223 "-no_nonce", "-out", "req3.tsq"])),
224 "creating req3.req time stamp request for file CAtsa.cnf");
226 ok
(run
(app
([@QUERY, "-in", "req3.tsq", "-text"])),
227 'printing req3.req');
229 subtest
'verifying resp1 against wrong req3 should fail' => sub {
230 verify_fail
("req3.tsq", "resp1.tsr", "tsa_cert1.pem", "tsaca.pem")
234 # verifying response with two ESSCertIDs, referring to leaf cert
235 # "sectigo-signer.pem" and intermediate cert "sectigo-time-stamping-ca.pem"
236 # 1. validation chain contains these certs and root "user-trust-ca.pem"
237 ok
(run
(app
([@VERIFY, "-no_check_time",
238 "-queryfile", data_file
("all-zero.tsq"),
239 "-in", data_file
("sectigo-all-zero.tsr"),
240 "-CAfile", data_file
("user-trust-ca.pem")])),
241 "validation with two ESSCertIDs and 3-element chain");
242 # 2. validation chain contains these certs, a cross-cert, and different root
243 ok
(run
(app
([@VERIFY, "-no_check_time",
244 "-queryfile", data_file
("all-zero.tsq"),
245 "-in", data_file
("sectigo-all-zero.tsr"),
246 "-untrusted", data_file
("user-trust-ca-aaa.pem"),
247 "-CAfile", data_file
("comodo-aaa.pem")])),
248 "validation with two ESSCertIDs and 4-element chain");
250 }, create
=> 1, cleanup
=> 1