gnutls-serv, gnutls-cli, gnutls-cli-debug: add --attime option

Signed-off-by: Daiki Ueno <ueno@gnu.org>

diff --git a/src/cli-debug.c b/src/cli-debug.c
index 96cc93306707864a38ee4ba9478dbe2786dc5429..3e2e8c4b37de1abf5907f94895d5e312db1f3041 100644 (file)
--- a/src/cli-debug.c
+++ b/src/cli-debug.c
@@ -39,6 +39,7 @@
 #include <socket.h>
 
 /* Gnulib portability files. */
+#include "parse-datetime.h"
 #include "sockets.h"
 
 static void cmd_parser(int argc, char **argv);
@@ -263,6 +264,18 @@ int main(int argc, char **argv)
                exit(1);
        }
 
+       if (ENABLED_OPT(ATTIME)) {
+               struct timespec r;
+
+               if (!parse_datetime(&r, OPT_ARG(ATTIME), NULL)) {
+                       fprintf(stderr,
+                               "%s option value %s is not a valid time\n",
+                               "attime", OPT_ARG(ATTIME));
+                       exit(1);
+               }
+               set_system_time(&r);
+       }
+
        gnutls_global_set_log_function(tls_log_func);
        gnutls_global_set_log_level(debug);
 

diff --git a/src/cli.c b/src/cli.c
index 2accea465bc0cd5159f817df839f074901016f66..73d2b946c27fd21256635fdb5b873dd80c981d26 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -59,6 +59,7 @@
 #include <read-file.h>
 #include <getpass.h>
 #include <minmax.h>
+#include "parse-datetime.h"
 
 #include "sockets.h"
 #include "benchmark.h"
@@ -1320,6 +1321,18 @@ int main(int argc, char **argv)
                exit(1);
        }
 
+       if (ENABLED_OPT(ATTIME)) {
+               struct timespec r;
+
+               if (!parse_datetime(&r, OPT_ARG(ATTIME), NULL)) {
+                       fprintf(stderr,
+                               "%s option value %s is not a valid time\n",
+                               "attime", OPT_ARG(ATTIME));
+                       exit(1);
+               }
+               set_system_time(&r);
+       }
+
        if (hostname == NULL) {
                fprintf(stderr, "No hostname given\n");
                exit(1);

diff --git a/src/gnutls-cli-debug-options.json b/src/gnutls-cli-debug-options.json
index 04f74c61a7582f5f1733e7ea1dee7de5adbf1bf3..e7cd32414ea404dbbc20e9b631afe35f1c28fbaf 100644 (file)
--- a/src/gnutls-cli-debug-options.json
+++ b/src/gnutls-cli-debug-options.json
@@ -47,8 +47,15 @@
           "description": "The application protocol to be used to obtain the server's certificate (https, ftp, smtp, imap, ldap, xmpp, lmtp, pop3, nntp, sieve, postgres)",
           "detail": "Specify the application layer protocol for STARTTLS. If the protocol is supported, gnutls-cli will proceed to the TLS negotiation.",
           "argument-type": "string"
+        },
+        {
+          "long-option": "attime",
+          "description": "Perform validation at the timestamp instead of the system time",
+          "detail": "timestamp is an instance in time encoded as Unix time or in a human\n readable timestring such as \"29 Feb 2004\", \"2004-02-29\".\nFull documentation available at \n<https://www.gnu.org/software/coreutils/manual/html_node/Date-input-formats.html>\nor locally via info '(coreutils) date invocation'.",
+          "argument-name": "timestamp",
+          "argument-type": "string"
         }
       ]
     }
   ]
-}
\ No newline at end of file
+}

diff --git a/src/gnutls-cli-options.json b/src/gnutls-cli-options.json
index 2d712ce434f976b51d4679436417c6c0492dd42d..e321aac3fca4406df621c6c89a146ef6083bf1c6 100644 (file)
--- a/src/gnutls-cli-options.json
+++ b/src/gnutls-cli-options.json
@@ -404,6 +404,13 @@
           "description": "Enable automatic retrieval of missing CA certificates",
           "detail": "This option enables the client to automatically retrieve the missing intermediate CA certificates in the certificate chain, based on the Authority Information Access (AIA) extension.",
           "disable-prefix": "no-"
+        },
+        {
+          "long-option": "attime",
+          "description": "Perform validation at the timestamp instead of the system time",
+          "detail": "timestamp is an instance in time encoded as Unix time or in a human\n readable timestring such as \"29 Feb 2004\", \"2004-02-29\".\nFull documentation available at \n<https://www.gnu.org/software/coreutils/manual/html_node/Date-input-formats.html>\nor locally via info '(coreutils) date invocation'.",
+          "argument-name": "timestamp",
+          "argument-type": "string"
         }
       ]
     }

diff --git a/src/gnutls-serv-options.json b/src/gnutls-serv-options.json
index d98f06124047fee4972508258c08eb09809a49e9..f773dbf48c7193b7e840aa5cd2f086a8864a9942 100644 (file)
--- a/src/gnutls-serv-options.json
+++ b/src/gnutls-serv-options.json
@@ -311,6 +311,13 @@
           "long-option": "timeout",
           "description": "The timeout period for server",
           "argument-type": "number"
+        },
+        {
+          "long-option": "attime",
+          "description": "Perform validation at the timestamp instead of the system time",
+          "detail": "timestamp is an instance in time encoded as Unix time or in a human\n readable timestring such as \"29 Feb 2004\", \"2004-02-29\".\nFull documentation available at \n<https://www.gnu.org/software/coreutils/manual/html_node/Date-input-formats.html>\nor locally via info '(coreutils) date invocation'.",
+          "argument-name": "timestamp",
+          "argument-type": "string"
         }
       ]
     }

diff --git a/src/serv.c b/src/serv.c
index 47632120a56936e64511dd2dc0351ec488c99bfa..eb6a213f9a34813851a5d8c28d69485b9789a5fe 100644 (file)
--- a/src/serv.c
+++ b/src/serv.c
@@ -47,6 +47,7 @@
 #include "gl_linked_list.h"
 #include "gl_xlist.h"
 #include "minmax.h"
+#include "parse-datetime.h"
 #include "read-file.h"
 #include "sockets.h"
 #include "xalloc.h"
@@ -1207,6 +1208,19 @@ int main(int argc, char **argv)
                fprintf(stderr, "global_init: %s\n", gnutls_strerror(ret));
                exit(1);
        }
+
+       if (ENABLED_OPT(ATTIME)) {
+               struct timespec r;
+
+               if (!parse_datetime(&r, OPT_ARG(ATTIME), NULL)) {
+                       fprintf(stderr,
+                               "%s option value %s is not a valid time\n",
+                               "attime", OPT_ARG(ATTIME));
+                       exit(1);
+               }
+               set_system_time(&r);
+       }
+
 #ifdef ENABLE_PKCS11
        if (HAVE_OPT(PROVIDER)) {
                ret = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);

diff --git a/tests/cert-reencoding.sh b/tests/cert-reencoding.sh
index 6e14ac84b29b0e12254ce94ae12671d7a12a748a..56eb8f203e0bd0137b613d753b1b34a9c0ae2aa6 100755 (executable)
--- a/tests/cert-reencoding.sh
+++ b/tests/cert-reencoding.sh
@@ -249,8 +249,7 @@ launch_bare_server \
 SERVER_PID="${!}"
 wait_server "${SERVER_PID}"
 
-"$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-      "${CLI}" --x509certfile ${CLIENT_CERT_FILE} \
+"${CLI}" --attime "${TESTDATE}" --x509certfile ${CLIENT_CERT_FILE} \
       --x509keyfile ${CLIENT_KEY_FILE} --x509cafile=${CA_FILE} \
       --port="${PORT}" localhost </dev/null
 rc=$?

diff --git a/tests/gnutls-cli-debug.sh b/tests/gnutls-cli-debug.sh
index 1a32cde4c82557769899788172ac2c119a81e9a2..fb1e4c12ff72452d86dc30f54cbea416823138ee 100755 (executable)
--- a/tests/gnutls-cli-debug.sh
+++ b/tests/gnutls-cli-debug.sh
@@ -48,8 +48,6 @@ SERV="${SERV} -q"
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
 
 KEY1=${srcdir}/../doc/credentials/x509/key-rsa.pem
 CERT1=${srcdir}/../doc/credentials/x509/cert-rsa.pem
@@ -71,8 +69,8 @@ launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:+VERS-TLS1.1" --x
 PID=$!
 wait_server ${PID}
 
-"$FAKETIME" "2017-08-9" timeout 1800 \
-"${DCLI}" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
+timeout 1800 \
+"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
 
 kill ${PID}
 wait
@@ -118,8 +116,8 @@ launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2" --x
 PID=$!
 wait_server ${PID}
 
-"$FAKETIME" "2017-08-9" timeout 1800 \
-"${DCLI}" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
+timeout 1800 \
+"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
 
 kill ${PID}
 wait
@@ -160,8 +158,8 @@ launch_server --echo --priority "NORMAL:-VERS-ALL:+VERS-TLS1.3:+VERS-TLS1.2:-RSA
 PID=$!
 wait_server ${PID}
 
-"$FAKETIME" "2017-08-9" timeout 1800 \
-"${DCLI}" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
+timeout 1800 \
+"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
 
 kill ${PID}
 wait
@@ -186,8 +184,8 @@ tls-disabled-cipher = CAMELLIA-256-CBC
 _EOF_
 
 GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}" \
-"$FAKETIME" "2017-08-9" timeout 1800 \
-"${DCLI}" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
+timeout 1800 \
+"${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
 
 kill ${PID}
 wait
@@ -209,8 +207,8 @@ if test "${ENABLE_GOST}" = "1" && test "${GNUTLS_FORCE_FIPS_MODE}" != 1 ; then
        PID=$!
        wait_server ${PID}
 
-       "$FAKETIME" "2017-08-9" timeout 1800 \
-       "${DCLI}" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
+       timeout 1800 \
+       "${DCLI}" --attime "2017-08-9" -p "${PORT}" localhost >$OUTFILE 2>&1 || fail ${PID} "gnutls-cli-debug run should have succeeded!"
 
        kill ${PID}
        wait

diff --git a/tests/gnutls-cli-invalid-crl.sh b/tests/gnutls-cli-invalid-crl.sh
index 574476d52f2f75a1b573d90945fe254e2a3a94ee..1d8d3b8ef6b4ed3403c7741351da336dd0a1fc6c 100755 (executable)
--- a/tests/gnutls-cli-invalid-crl.sh
+++ b/tests/gnutls-cli-invalid-crl.sh
@@ -47,8 +47,6 @@ SERV="${SERV} -q"
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
 echo "Checking whether connecting to a server but with an invalid CRL provided, returns the expected error"
 
 cat <<__EOF__ >${TMPFILE}
@@ -168,8 +166,7 @@ launch_server --echo --x509keyfile ${TMPFILE} --x509certfile ${TMPFILE}
 PID=$!
 wait_server ${PID}
 
-"$FAKETIME" "2018-9-19" \
-${VALGRIND} "${CLI}" -p "${PORT}" localhost --x509crlfile ${CRLFILE} --x509cafile ${CAFILE} >${TMPFILE} 2>&1 </dev/null && \
+${VALGRIND} "${CLI}" --attime "2018-9-19" -p "${PORT}" localhost --x509crlfile ${CRLFILE} --x509cafile ${CAFILE} >${TMPFILE} 2>&1 </dev/null && \
        fail ${PID} "1. handshake should have failed!"
 
 

diff --git a/tests/gnutls-cli-self-signed.sh b/tests/gnutls-cli-self-signed.sh
index 297abb0a1c021403486b1fbac5ed2b4eaf196b5b..6f17a0802ec79b9e69ebb1dd008adfb46cbc8c40 100755 (executable)
--- a/tests/gnutls-cli-self-signed.sh
+++ b/tests/gnutls-cli-self-signed.sh
@@ -45,8 +45,6 @@ SERV="${SERV} -q"
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
 echo "Checking whether connecting to a self signed certificate returns the expected error"
 
 cat <<__EOF__ >${TMPFILE}
@@ -123,8 +121,7 @@ launch_server --echo --x509keyfile ${TMPFILE} --x509certfile ${TMPFILE}
 PID=$!
 wait_server ${PID}
 
-"$FAKETIME" "2018-1-1" \
-${VALGRIND} "${CLI}" -p "${PORT}" localhost >${TMPFILE} 2>&1 </dev/null && \
+${VALGRIND} "${CLI}" --attime "2018-1-1" -p "${PORT}" localhost >${TMPFILE} 2>&1 </dev/null && \
        fail ${PID} "1. handshake should have failed!"
 
 

diff --git a/tests/ocsp-tests/ocsp-must-staple-connection.sh b/tests/ocsp-tests/ocsp-must-staple-connection.sh
index 3c58cf81dd396dda80ebc9c71435ce795c030348..6e63fa83bfc5c97ddfb1c39ac2a4fef971a6ce01 100755 (executable)
--- a/tests/ocsp-tests/ocsp-must-staple-connection.sh
+++ b/tests/ocsp-tests/ocsp-must-staple-connection.sh
@@ -101,7 +101,7 @@ echo "ocsp_uri=http://localhost:${OCSP_PORT}/ocsp/" >>"$TEMPLATE_FILE"
 
 # Generate certificates with the random port
 ${CERTTOOL} \
-        --attime "${CERTDATE}" \
+       --attime "${CERTDATE}" \
        --generate-certificate --load-ca-privkey "${srcdir}/ocsp-tests/certs/ca.key" \
        --load-ca-certificate "${srcdir}/ocsp-tests/certs/ca.pem" \
        --load-privkey "${srcdir}/ocsp-tests/certs/server_good.key" \
@@ -111,7 +111,7 @@ ${CERTTOOL} \
 echo "tls_feature = 5" >>"$TEMPLATE_FILE"
 
 ${CERTTOOL} \
-        --attime "${CERTDATE}" \
+       --attime "${CERTDATE}" \
        --generate-certificate --load-ca-privkey "${srcdir}/ocsp-tests/certs/ca.key" \
        --load-ca-certificate "${srcdir}/ocsp-tests/certs/ca.pem" \
        --load-privkey "${srcdir}/ocsp-tests/certs/server_good.key" \
@@ -171,20 +171,18 @@ echo "=== Test 1: Server with valid certificate - no staple ==="
 
 PORT=${TLS_SERVER_PORT}
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
-         --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-         --x509certfile="${SERVER_CERT_FILE}" \
-         --port="${TLS_SERVER_PORT}"
+       "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
+       --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
+       --x509certfile="${SERVER_CERT_FILE}" \
+       --port="${TLS_SERVER_PORT}"
 TLS_SERVER_PID="${!}"
 wait_server $TLS_SERVER_PID
 
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-             --port="${TLS_SERVER_PORT}" localhost
+       "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 
 if test "${rc}" != "1"; then
@@ -203,8 +201,7 @@ eval "${GETPORT}"
 TLS_SERVER_PORT=$PORT
 PORT=${TLS_SERVER_PORT}
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
+         "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
          --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
          --x509certfile="${SERVER_CERT_FILE}" \
          --port="${TLS_SERVER_PORT}" \
@@ -215,9 +212,8 @@ wait_server $TLS_SERVER_PID
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-             --port="${TLS_SERVER_PORT}" localhost
+       "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 
 if test "${rc}" != "0"; then
@@ -238,21 +234,19 @@ eval "${GETPORT}"
 TLS_SERVER_PORT=$PORT
 PORT=${TLS_SERVER_PORT}
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
-         --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-         --x509certfile="${SERVER_CERT_FILE}" \
-         --port="${TLS_SERVER_PORT}" \
-         --ocsp-response="${OCSP_RESPONSE_FILE}" --ignore-ocsp-response-errors
+       "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
+       --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
+       --x509certfile="${SERVER_CERT_FILE}" \
+       --port="${TLS_SERVER_PORT}" \
+       --ocsp-response="${OCSP_RESPONSE_FILE}" --ignore-ocsp-response-errors
 TLS_SERVER_PID="${!}"
 wait_server $TLS_SERVER_PID
 
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-             --port="${TLS_SERVER_PORT}" localhost
+       "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 
 if test "${rc}" != "1"; then
@@ -274,21 +268,19 @@ eval "${GETPORT}"
 TLS_SERVER_PORT=$PORT
 PORT=${TLS_SERVER_PORT}
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
-         --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-         --x509certfile="${SERVER_CERT_FILE}" \
-         --port="${TLS_SERVER_PORT}" \
-         --ocsp-response="${OCSP_RESPONSE_FILE}" --ignore-ocsp-response-errors
+       "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
+       --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
+       --x509certfile="${SERVER_CERT_FILE}" \
+       --port="${TLS_SERVER_PORT}" \
+       --ocsp-response="${OCSP_RESPONSE_FILE}" --ignore-ocsp-response-errors
 TLS_SERVER_PID="${!}"
 wait_server $TLS_SERVER_PID
 
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-             --port="${TLS_SERVER_PORT}" localhost
+       "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 
 if test "${rc}" != "1"; then
@@ -332,22 +324,20 @@ fi
 echo "=== Test 5.1: Server with valid certificate - expired staple (ignoring errors) ==="
 
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
-         --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-         --x509certfile="${SERVER_CERT_FILE}" \
-         --port="${TLS_SERVER_PORT}" \
-         --ignore-ocsp-response-errors \
-         --ocsp-response="${OCSP_RESPONSE_FILE}"
+       "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
+       --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
+       --x509certfile="${SERVER_CERT_FILE}" \
+       --port="${TLS_SERVER_PORT}" \
+       --ignore-ocsp-response-errors \
+       --ocsp-response="${OCSP_RESPONSE_FILE}"
 TLS_SERVER_PID="${!}"
 wait_server $TLS_SERVER_PID
 
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-             --port="${TLS_SERVER_PORT}" localhost
+       "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 
 if test "${rc}" != "1"; then
@@ -376,21 +366,19 @@ eval "${GETPORT}"
 TLS_SERVER_PORT=$PORT
 PORT=${TLS_SERVER_PORT}
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
-         --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-         --x509certfile="${SERVER_CERT_FILE}" \
-         --port="${TLS_SERVER_PORT}" \
-         --ocsp-response="${OCSP_RESPONSE_FILE}" --ignore-ocsp-response-errors
+       "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
+       --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
+       --x509certfile="${SERVER_CERT_FILE}" \
+       --port="${TLS_SERVER_PORT}" \
+       --ocsp-response="${OCSP_RESPONSE_FILE}" --ignore-ocsp-response-errors
 TLS_SERVER_PID="${!}"
 wait_server $TLS_SERVER_PID
 
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-             --port="${TLS_SERVER_PORT}" localhost
+       "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 
 if test "${rc}" != "1"; then
@@ -411,21 +399,19 @@ if test "${GNUTLS_FORCE_FIPS_MODE}" != 1; then
     TLS_SERVER_PORT=$PORT
     PORT=${TLS_SERVER_PORT}
     launch_bare_server \
-       "$FAKETIME" "${TESTDATE}" \
-       "${SERV}" --echo --disable-client-cert \
-       --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-       --x509certfile="${SERVER_CERT_FILE}" \
-       --port="${TLS_SERVER_PORT}" \
-       --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
+           "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
+           --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
+           --x509certfile="${SERVER_CERT_FILE}" \
+           --port="${TLS_SERVER_PORT}" \
+           --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
     TLS_SERVER_PID="${!}"
     wait_server $TLS_SERVER_PID
 
     wait_for_port "${TLS_SERVER_PORT}"
 
     echo "test 123456" | \
-       "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-                 "${CLI}" --priority "NORMAL:%NO_EXTENSIONS" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-                 --port="${TLS_SERVER_PORT}" localhost
+           "${CLI}" --attime "${TESTDATE}" --priority "NORMAL:%NO_EXTENSIONS" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                    --port="${TLS_SERVER_PORT}" localhost
     rc=$?
 
     if test "${rc}" != "0"; then
@@ -446,21 +432,19 @@ eval "${GETPORT}"
 TLS_SERVER_PORT=$PORT
 PORT=${TLS_SERVER_PORT}
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
-         --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-         --x509certfile="${SERVER_CERT_NO_EXT_FILE}" \
-         --port="${TLS_SERVER_PORT}" \
-         --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
+       "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
+       --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
+       --x509certfile="${SERVER_CERT_NO_EXT_FILE}" \
+       --port="${TLS_SERVER_PORT}" \
+       --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
 TLS_SERVER_PID="${!}"
 wait_server $TLS_SERVER_PID
 
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-             --port="${TLS_SERVER_PORT}" localhost
+       "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 
 if test "${rc}" != "0"; then
@@ -479,21 +463,19 @@ eval "${GETPORT}"
 TLS_SERVER_PORT=$PORT
 PORT=${TLS_SERVER_PORT}
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
-         --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
-         --x509certfile="${SERVER_CERT_FILE}" \
-         --port="${TLS_SERVER_PORT}" \
-         --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
+       "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
+       --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
+       --x509certfile="${SERVER_CERT_FILE}" \
+       --port="${TLS_SERVER_PORT}" \
+       --ocsp-response="${srcdir}/ocsp-tests/response3.der" --ignore-ocsp-response-errors
 TLS_SERVER_PID="${!}"
 wait_server $TLS_SERVER_PID
 
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
-             --port="${TLS_SERVER_PORT}" localhost
+       "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+                --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 
 if test "${rc}" = "0"; then

diff --git a/tests/ocsp-tests/ocsp-tls-connection.sh b/tests/ocsp-tests/ocsp-tls-connection.sh
index 2039ade2b3c083cfda4a2e3b44667abda80c76fc..4ca20417e59bf2ee046a0022f96fa22730d30e4b 100755 (executable)
--- a/tests/ocsp-tests/ocsp-tls-connection.sh
+++ b/tests/ocsp-tests/ocsp-tls-connection.sh
@@ -149,8 +149,7 @@ echo "=== Test 1: Server with valid certificate ==="
 
 PORT=${TLS_SERVER_PORT}
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
+         "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
          --x509keyfile="${srcdir}/ocsp-tests/certs/server_good.key" \
          --x509certfile="${SERVER_CERT_FILE}" \
          --port="${TLS_SERVER_PORT}"
@@ -160,8 +159,7 @@ wait_server $TLS_SERVER_PID
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+    "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
              --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 
@@ -195,8 +193,7 @@ eval "${GETPORT}"
 TLS_SERVER_PORT=$PORT
 
 launch_bare_server \
-         "$FAKETIME" "${TESTDATE}" \
-         "${SERV}" --echo --disable-client-cert \
+         "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
          --x509keyfile="${srcdir}/ocsp-tests/certs/server_bad.key" \
          --x509certfile="${SERVER_CERT_FILE}" \
          --port="${TLS_SERVER_PORT}"
@@ -205,8 +202,7 @@ wait_server ${TLS_SERVER_PID}
 wait_for_port "${TLS_SERVER_PORT}"
 
 echo "test 123456" | \
-    "$FAKETIME" "$FAKETIME_F_OPT" "${TESTDATE}" \
-             "${CLI}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
+    "${CLI}" --attime "${TESTDATE}" --ocsp --x509cafile="${srcdir}/ocsp-tests/certs/ca.pem" \
              --port="${TLS_SERVER_PORT}" localhost
 rc=$?
 

diff --git a/tests/server-multi-keys.sh b/tests/server-multi-keys.sh
index 6b6015ff200840e2a280c4ff247f58ea6a174c1f..c024db8977849938aa39def3893f27bedadd9622 100755 (executable)
--- a/tests/server-multi-keys.sh
+++ b/tests/server-multi-keys.sh
@@ -45,8 +45,6 @@ SERV="${SERV} -q"
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
 echo "Checking whether server can utilize multiple keys"
 
 KEY1=${srcdir}/../doc/credentials/x509/key-rsa.pem
@@ -64,16 +62,13 @@ launch_server --echo --priority "NORMAL:+ECDHE-RSA:+ECDHE-ECDSA" --x509keyfile $
 PID=$!
 wait_server ${PID}
 
-"$FAKETIME" "2017-08-9" timeout 1800 \
-"${CLI}" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-KX-ALL:+ECDHE-RSA" </dev/null || \
+"${CLI}" --attime "2017-08-9" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-KX-ALL:+ECDHE-RSA" </dev/null || \
        fail ${PID} "1. handshake with RSA should have succeeded!"
 
-"$FAKETIME" "2017-08-9" timeout 1800 \
-"${CLI}" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-KX-ALL:+ECDHE-ECDSA" </dev/null || \
+"${CLI}" --attime "2017-08-9" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-KX-ALL:+ECDHE-ECDSA" </dev/null || \
        fail ${PID} "2. handshake with ECC should have succeeded!"
 
-"$FAKETIME" "2017-08-9" timeout 1800 \
-"${CLI}" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:-KX-ALL:+ECDHE-RSA:-SIGN-ALL:+SIGN-RSA-SHA256" --save-cert ${TMPFILE} </dev/null || \
+"${CLI}" --attime "2017-08-9" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-VERS-ALL:+VERS-TLS1.2:-KX-ALL:+ECDHE-RSA:-SIGN-ALL:+SIGN-RSA-SHA256" --save-cert ${TMPFILE} </dev/null || \
        fail ${PID} "3. handshake with RSA should have succeeded!"
 
 cmp ${TMPFILE} ${CERT1}
@@ -81,14 +76,12 @@ if test $? != 0;then
        fail ${PID} "3. the certificate used by server was not the expected"
 fi
 
-"$FAKETIME" "2017-08-9" timeout 1800 \
-"${CLI}" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-KX-ALL:+ECDHE-RSA:+SIGN-RSA-SHA256:+SIGN-RSA-PSS-RSAE-SHA256" --save-cert ${TMPFILE} </dev/null || \
+"${CLI}" --attime "2017-08-9" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-KX-ALL:+ECDHE-RSA:+SIGN-RSA-SHA256:+SIGN-RSA-PSS-RSAE-SHA256" --save-cert ${TMPFILE} </dev/null || \
        fail ${PID} "4. handshake with RSA should have succeeded!"
 
 
 # check whether the server used the RSA-PSS certificate when we asked for RSA-PSS signature
-"$FAKETIME" "2017-08-9" timeout 1800 \
-"${CLI}" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-KX-ALL:+ECDHE-RSA:-SIGN-ALL:+SIGN-RSA-PSS-SHA256" --save-cert ${TMPFILE} </dev/null || \
+"${CLI}" --attime "2017-08-9" -p "${PORT}" localhost --x509cafile ${CAFILE} --priority "NORMAL:-KX-ALL:+ECDHE-RSA:-SIGN-ALL:+SIGN-RSA-PSS-SHA256" --save-cert ${TMPFILE} </dev/null || \
        fail ${PID} "4. handshake with RSA-PSS and SHA256 should have succeeded!"
 
 cmp ${TMPFILE} ${CERT3}

diff --git a/tests/server-weak-keys.sh b/tests/server-weak-keys.sh
index 2fa0d91852d9b258202f2e142c018990352d0ae4..339be2fbe10733f2690d6209013a01dc86325313 100755 (executable)
--- a/tests/server-weak-keys.sh
+++ b/tests/server-weak-keys.sh
@@ -45,8 +45,6 @@ SERV="${SERV} -q"
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
 echo "Checking whether a client will refuse weak but trusted keys"
 
 KEY1=${srcdir}/certs/rsa-512.pem
@@ -57,12 +55,10 @@ launch_server --echo --priority "NORMAL" --x509keyfile ${KEY1} --x509certfile ${
 PID=$!
 wait_server ${PID}
 
-"$FAKETIME" "2019-12-20" timeout 1800 \
-"${CLI}" -d 4 -p "${PORT}" localhost --x509cafile ${CERT1} --priority NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2 </dev/null && \
+"${CLI}" --attime "2019-12-20" -d 4 -p "${PORT}" localhost --x509cafile ${CERT1} --priority NORMAL:-VERS-TLS-ALL:+VERS-TLS1.2 </dev/null && \
        fail ${PID} "1. handshake with RSA should have failed!"
 
-"$FAKETIME" "2019-12-20" timeout 1800 \
-"${CLI}" -d 4 -p "${PORT}" localhost --x509cafile ${CERT1} --priority NORMAL </dev/null && \
+"${CLI}" --attime "2019-12-20" -d 4 -p "${PORT}" localhost --x509cafile ${CERT1} --priority NORMAL </dev/null && \
        fail ${PID} "2. handshake with RSA should have failed!"
 
 kill ${PID}

diff --git a/tests/system-override-profiles.sh b/tests/system-override-profiles.sh
index 099c70a2890772a0bdb296bb2e705a3c7bc4e0a6..724ff924db982d1d07f26e1b4438a6e7ef13ddb7 100755 (executable)
--- a/tests/system-override-profiles.sh
+++ b/tests/system-override-profiles.sh
@@ -41,8 +41,6 @@ fi
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
 CERT="${srcdir}/certs/cert-ecc256.pem"
 KEY="${srcdir}/certs/ecc256.pem"
 
@@ -62,18 +60,15 @@ _EOF_
 export GNUTLS_DEBUG_LEVEL=3
 unset GNUTLS_SYSTEM_PRIORITY_FILE
 
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null ||
        fail "expected connection to succeed (1)"
 
 export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}"
 
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:%PROFILE_LOW --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:%PROFILE_LOW --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null ||
        fail "expected connection to succeed (2)"
 
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:%PROFILE_MEDIUM --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:%PROFILE_MEDIUM --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null ||
        fail "expected connection to succeed (3)"
 
 # failure case, 384 bit min-profile, 256 bit key
@@ -85,18 +80,15 @@ _EOF_
 
 unset GNUTLS_SYSTEM_PRIORITY_FILE
 
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null ||
        fail "expected connection to succeed (1)"
 
 export GNUTLS_SYSTEM_PRIORITY_FILE="${TMPFILE}"
 
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:%PROFILE_LOW --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null &&
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:%PROFILE_LOW --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null &&
        fail "expected connection to fail (1)"
 
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:%PROFILE_MEDIUM --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null &&
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:%PROFILE_MEDIUM --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" --logfile ${TMPFILE2} </dev/null >/dev/null &&
        fail "expected connection to fail (2)"
 
 kill ${PID}

diff --git a/tests/system-override-tls.sh b/tests/system-override-tls.sh
index 93553479c4fc9ef0573a945e2eba6a7895557229..d0188ff3e12e94ad72ef83aeba041fe324d444f1 100755 (executable)
--- a/tests/system-override-tls.sh
+++ b/tests/system-override-tls.sh
@@ -40,8 +40,6 @@ fi
 
 . "${srcdir}/scripts/common.sh"
 
-skip_if_no_datefudge
-
 CERT="${srcdir}/certs/cert-ecc256.pem"
 KEY="${srcdir}/certs/ecc256.pem"
 
@@ -53,12 +51,10 @@ wait_server ${PID}
 #successful case, test whether the ciphers we disable below work
 echo "Sanity testing"
 
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-CIPHER-ALL:+AES-128-GCM:-GROUP-ALL:+GROUP-FFDHE2048 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:-CIPHER-ALL:+AES-128-GCM:-GROUP-ALL:+GROUP-FFDHE2048 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
        fail ${PID} "stage1: expected connection to succeed (1)"
 
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CBC:+AES-256-CBC:-MAC-ALL:+SHA1 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CBC:+AES-256-CBC:-MAC-ALL:+SHA1 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
        fail ${PID} "stage1: expected connection to succeed (2)"
 
 cat <<_EOF_ > ${TMPFILE}
@@ -76,44 +72,36 @@ export GNUTLS_SYSTEM_PRIORITY_FILE
 
 echo "Testing TLS1.3"
 echo " * sanity"
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
        fail ${PID} "stage2: expected connection to succeed (1)"
 
 echo " * fallback to good options"
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-CIPHER-ALL:+AES-128-GCM:+AES-256-GCM:-GROUP-ALL:+GROUP-FFDHE2048:+GROUP-FFDHE3072 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:-CIPHER-ALL:+AES-128-GCM:+AES-256-GCM:-GROUP-ALL:+GROUP-FFDHE2048:+GROUP-FFDHE3072 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
        fail ${PID} "stage2: expected connection to succeed (2)"
 
 echo " * disabled cipher"
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-CIPHER-ALL:+AES-128-GCM --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null && #>/dev/null &&
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:-CIPHER-ALL:+AES-128-GCM --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null && #>/dev/null &&
        fail ${PID} "stage2: expected connection to fail (1)"
 
 echo " * disabled group"
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-GROUP-ALL:+GROUP-FFDHE2048 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null &&
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:-GROUP-ALL:+GROUP-FFDHE2048 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null &&
        fail ${PID} "stage2: expected connection to fail (2)"
 
 echo "Testing TLS1.2"
 echo " * sanity"
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
        fail ${PID} "stage3: expected connection to succeed (1)"
 
 echo " * fallback to good options"
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CBC:+AES-256-CBC:+AES-256-GCM:-MAC-ALL:+SHA1:+AEAD --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CBC:+AES-256-CBC:+AES-256-GCM:-MAC-ALL:+SHA1:+AEAD --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null ||
        fail ${PID} "stage3: expected connection to succeed (2)"
 
 echo " * disabled cipher"
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CBC --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null &&
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:-CIPHER-ALL:+AES-128-CBC --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null &&
        fail ${PID} "stage3: expected connection to fail (1)"
 
 echo " * disabled MAC"
-"$FAKETIME" "2017-11-22" \
-"${CLI}" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:-MAC-ALL:+SHA1 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null &&
+"${CLI}" --attime "2017-11-22" -p "${PORT}" 127.0.0.1 --priority NORMAL:-VERS-ALL:+VERS-TLS1.2:-MAC-ALL:+SHA1 --verify-hostname localhost --x509cafile "${srcdir}/certs/ca-cert-ecc.pem" </dev/null >/dev/null &&
        fail ${PID} "stage3: expected connection to fail (2)"
 
 

diff --git a/tests/testpkcs11.sh b/tests/testpkcs11.sh
index 12568cfbcfe59e19dc6812329439afadc43ea49b..486a16db947afa87db28d8a0e88e3dea98b2857b 100755 (executable)
--- a/tests/testpkcs11.sh
+++ b/tests/testpkcs11.sh
@@ -80,8 +80,6 @@ exit_error () {
        exit 1
 }
 
-skip_if_no_datefudge
-
 # $1: token
 # $2: PIN
 # $3: filename
@@ -938,8 +936,7 @@ use_certificate_test () {
        echo -n "* Using PKCS #11 with gnutls-cli (${txt})... "
        # start server
        eval "${GETPORT}"
-       launch_bare_server "$FAKETIME" "$FAKETIME_F_OPT" "$TESTDATE" \
-               $VALGRIND $SERV $DEBUG -p "$PORT" \
+       launch_bare_server $VALGRIND $SERV $DEBUG --attime "$TESTDATE" -p "$PORT" \
                ${ADDITIONAL_PARAM} --debug 10 --echo --priority NORMAL --x509certfile="${certfile}" \
                --x509keyfile="$keyfile" --x509cafile="${cafile}" \
                --verify-client-cert --require-client-cert >>"${LOGFILE}" 2>&1
@@ -948,17 +945,14 @@ use_certificate_test () {
        wait_server ${PID}
 
        # connect to server using SC
-       "$FAKETIME" "$FAKETIME_F_OPT" "$TESTDATE" \
-       ${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509cafile="${cafile}" </dev/null >>"${LOGFILE}" 2>&1 && \
+       ${VALGRIND} "${CLI}" --attime "$TESTDATE" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509cafile="${cafile}" </dev/null >>"${LOGFILE}" 2>&1 && \
                fail ${PID} "Connection should have failed!"
 
-       "$FAKETIME" "$FAKETIME_F_OPT" "$TESTDATE" \
-       ${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${certfile}" \
+       ${VALGRIND} "${CLI}" --attime "$TESTDATE" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${certfile}" \
        --x509keyfile="$keyfile" --x509cafile="${cafile}" </dev/null >>"${LOGFILE}" 2>&1 || \
                fail ${PID} "Connection (with files) should have succeeded!"
 
-       "$FAKETIME" "$FAKETIME_F_OPT" "$TESTDATE" \
-       ${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${token};object=gnutls-client;object-type=cert" \
+       ${VALGRIND} "${CLI}" --attime "$TESTDATE" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${token};object=gnutls-client;object-type=cert" \
                --x509keyfile="${token};object=gnutls-client;object-type=private" \
                --x509cafile="${cafile}" </dev/null >>"${LOGFILE}" 2>&1 || \
                fail ${PID} "Connection (with SC) should have succeeded!"