206 lines
9.2 KiB
Tcl
206 lines
9.2 KiB
Tcl
#!/usr/bin/tclsh
|
||
lappend auto_path [file dirname [info script]]
|
||
package require ossltest
|
||
cd $::test::dir
|
||
start_tests "Тесты на команду cms - вторая подпись"
|
||
|
||
test "Creating CA" {
|
||
makeCA
|
||
} 0 1
|
||
|
||
makeFile cms_signed2.dat "Test data for 2 signatures"
|
||
|
||
|
||
foreach length {256 512} {
|
||
|
||
test "Creating users $length" {
|
||
makeRegisteredUser U_cms_1_$length gost2012_$length:A CN USER1_$length emailAddress test@cryptocom.ru
|
||
makeRegisteredUser U_cms_2_$length gost2012_$length:A CN USER2_$length emailAddress test@cryptocom.ru
|
||
} 0 1
|
||
|
||
test -createsfiles cms_signed2_1_$length.asn "Signing in DER format with 1st signature" {
|
||
openssl "cms -sign -binary -outform der -inform der -nodetach -inkey U_cms_1_$length/seckey.pem -signer U_cms_1_$length/cert.pem -in cms_signed2.dat -out cms_signed2_1_$length.asn"
|
||
file isfile cms_signed2_1_$length.asn
|
||
} 0 1
|
||
|
||
test -createsfiles cms_signed2_2_$length.asn "Signing in DER format with 2nd signature" {
|
||
openssl "cms -resign -binary -outform der -inform der -nodetach -inkey U_cms_2_$length/seckey.pem -signer U_cms_2_$length/cert.pem -in cms_signed2_1_$length.asn -out cms_signed2_2_$length.asn"
|
||
file isfile cms_signed2_2_$length.asn
|
||
} 0 1
|
||
|
||
test -createsfiles {was_signed.dat signer.certs} "Verifying signature in DER format" {
|
||
grep "Verif" [openssl "cms -verify -inform der -in cms_signed2_2_$length.asn -noverify -signer signer.certs -out was_signed.dat"]
|
||
} 0 {CMS Verification successful
|
||
}
|
||
|
||
test "Signed data is extracted correctly" {
|
||
string eq [getFile cms_signed2.dat] [getFile was_signed.dat]
|
||
} 0 1
|
||
|
||
### Test extracted sertificates
|
||
|
||
test "Extracting signer certificates" {
|
||
set i 0
|
||
set subjs {}
|
||
set certs [regexp -all -inline -- {-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----} [getFile signer.certs]]
|
||
foreach cert $certs {
|
||
makeFile cert[incr i].pem $cert
|
||
lappend subjs [regsub -all " = " [grep subject [openssl "x509 -in cert$i.pem -subject -noout"]] "=" ]
|
||
}
|
||
lsort $subjs
|
||
} 0 "{subject=C=RU, O=Cryptocom, OU=OpenSSL Team, CN=USER1_$length, emailAddress=test@cryptocom.ru
|
||
} {subject=C=RU, O=Cryptocom, OU=OpenSSL Team, CN=USER2_$length, emailAddress=test@cryptocom.ru
|
||
}"
|
||
|
||
test -createsfiles cms_signed2_1_$length\_op.msg "Signing opaque in S/MIME format with 1st signature" {
|
||
openssl "cms -sign -binary -inform der -nodetach -inkey U_cms_1_$length/seckey.pem -signer U_cms_1_$length/cert.pem -in cms_signed2.dat -out cms_signed2_1_$length\_op.msg"
|
||
file isfile cms_signed2_1_$length\_op.msg
|
||
} 0 1
|
||
|
||
test -createsfiles cms_signed2_2_$length\_op.msg "Signing opaque in S/MIME format with 2nd signature" {
|
||
openssl "cms -resign -binary -nodetach -inkey U_cms_2_$length/seckey.pem -signer U_cms_2_$length/cert.pem -in cms_signed2_1_$length\_op.msg -out cms_signed2_2_$length\_op.msg"
|
||
file isfile cms_signed2_2_$length\_op.msg
|
||
} 0 1
|
||
|
||
test -createsfiles {was_signed.dat signer.certs} "Verifying opaque signature in S/MIME format" {
|
||
grep "Verif" [openssl "cms -verify -in cms_signed2_2_$length\_op.msg -noverify -signer signer.certs -out was_signed.dat"]
|
||
} 0 {CMS Verification successful
|
||
}
|
||
|
||
test "Signed data is extracted correctly" {
|
||
string eq [getFile cms_signed2.dat] [getFile was_signed.dat]
|
||
} 0 1
|
||
|
||
### Test extracted sertificates
|
||
|
||
test "Extracting signer certificates" {
|
||
set i 0
|
||
set subjs {}
|
||
set certs [regexp -all -inline -- {-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----} [getFile signer.certs]]
|
||
foreach cert $certs {
|
||
makeFile cert[incr i].pem $cert
|
||
lappend subjs [regsub -all " = " [grep subject [openssl "x509 -in cert$i.pem -subject -noout"]] "=" ]
|
||
}
|
||
lsort $subjs
|
||
} 0 "{subject=C=RU, O=Cryptocom, OU=OpenSSL Team, CN=USER1_$length, emailAddress=test@cryptocom.ru
|
||
} {subject=C=RU, O=Cryptocom, OU=OpenSSL Team, CN=USER2_$length, emailAddress=test@cryptocom.ru
|
||
}"
|
||
|
||
test -createsfiles cms_signed2_1_$length\_det.asn "Signing detached in DER format with 1st signature" {
|
||
openssl "cms -sign -binary -outform der -inkey U_cms_1_$length/seckey.pem -signer U_cms_1_$length/cert.pem -in cms_signed2.dat -out cms_signed2_1_$length\_det.asn"
|
||
file isfile cms_signed2_1_$length\_det.asn
|
||
} 0 1
|
||
|
||
test -createsfiles cms_signed2_2_$length\_det.asn "Signing detached in DER format with 2nd signature" {
|
||
openssl "cms -resign -binary -inkey U_cms_2_$length/seckey.pem -signer U_cms_2_$length/cert.pem -in cms_signed2_1_$length\_det.asn -content cms_signed2.dat -inform der -outform der -out cms_signed2_2_$length\_det.asn"
|
||
file isfile cms_signed2_2_$length\_det.asn
|
||
} 0 1
|
||
|
||
test -createsfiles {was_signed.dat signer.certs} "Verifying detached signature in DER format" {
|
||
grep "Verif" [openssl "cms -verify -in cms_signed2_2_$length\_det.asn -noverify -signer signer.certs -out was_signed.dat -content signed2.dat -inform der"]
|
||
} 0 {CMS Verification successful
|
||
}
|
||
|
||
test "Signed data is extracted correctly" {
|
||
string eq [getFile cms_signed2.dat] [getFile was_signed.dat]
|
||
} 0 1
|
||
|
||
### Test extracted sertificates
|
||
|
||
test "Extracting signer certificates" {
|
||
set i 0
|
||
set subjs {}
|
||
set certs [regexp -all -inline -- {-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----} [getFile signer.certs]]
|
||
foreach cert $certs {
|
||
makeFile cert_asn[incr i].pem $cert
|
||
lappend subjs [regsub -all " = " [grep subject [openssl "x509 -in cert$i.pem -subject -noout"]] "=" ]
|
||
}
|
||
lsort $subjs
|
||
} 0 "{subject=C=RU, O=Cryptocom, OU=OpenSSL Team, CN=USER1_$length, emailAddress=test@cryptocom.ru
|
||
} {subject=C=RU, O=Cryptocom, OU=OpenSSL Team, CN=USER2_$length, emailAddress=test@cryptocom.ru
|
||
}"
|
||
|
||
test -createsfiles cms_signed2_1_$length.msg "Signing in S/MIME format with 1st signature" {
|
||
openssl "cms -sign -binary -inform der -inkey U_cms_1_$length/seckey.pem -signer U_cms_1_$length/cert.pem -in cms_signed2.dat -out cms_signed2_1_$length.msg"
|
||
file isfile cms_signed2_1_$length.msg
|
||
} 0 1
|
||
|
||
test -createsfiles cms_signed2_2_$length.msg "Signing in S/MIME format with 2nd signature" {
|
||
grep "SMIME" [openssl "cms -resign -binary -inkey U_cms_2_$length/seckey.pem -signer U_cms_2_$length/cert.pem -in cms_signed2_1_$length.msg -inform smime -out cms_signed2_2_$length.msg"]
|
||
} 0 ""
|
||
|
||
test -createsfiles {was_signed.dat signer.certs} "Verifying signature in S/MIME format" {
|
||
grep "Verif" [openssl "cms -verify -in cms_signed2_2_$length.msg -noverify -signer signer.certs -out was_signed.dat -inform smime"]
|
||
} 0 {CMS Verification successful
|
||
}
|
||
|
||
test "Signed data is extracted correctly" {
|
||
string eq [getFile cms_signed2.dat] [getFile was_signed.dat]
|
||
} 0 1
|
||
|
||
### Test extracted sertificates
|
||
|
||
test "Extracting signer certificates" {
|
||
set i 0
|
||
set subjs {}
|
||
set certs [regexp -all -inline -- {-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----} [getFile signer.certs]]
|
||
foreach cert $certs {
|
||
makeFile cert_cms[incr i].pem $cert
|
||
lappend subjs [regsub -all " = " [grep subject [openssl "x509 -in cert$i.pem -subject -noout"]] "=" ]
|
||
}
|
||
lsort $subjs
|
||
} 0 "{subject=C=RU, O=Cryptocom, OU=OpenSSL Team, CN=USER1_$length, emailAddress=test@cryptocom.ru
|
||
} {subject=C=RU, O=Cryptocom, OU=OpenSSL Team, CN=USER2_$length, emailAddress=test@cryptocom.ru
|
||
}"
|
||
|
||
}
|
||
|
||
|
||
test "Resigning in DER format with a unsuitable key length 512" {
|
||
openssl "cms -resign -binary -inform der -nodetach -inkey U_cms_2_512/seckey.pem -signer U_cms_2_512/cert.pem -in cms_signed2_1_256.asn"
|
||
} 1 "no matching digest"
|
||
|
||
test "Resigning in DER format with a unsuitable key length 256" {
|
||
openssl "cms -resign -binary -inform der -nodetach -inkey U_cms_2_256/seckey.pem -signer U_cms_2_256/cert.pem -in cms_signed2_1_512.asn"
|
||
} 1 "no matching digest"
|
||
|
||
test "Resigning opaque in S/MIME format with a unsuitable key length 512" {
|
||
openssl "cms -resign -binary -nodetach -inkey U_cms_2_512/seckey.pem -signer U_cms_2_512/cert.pem -in cms_signed2_1_256_op.msg"
|
||
} 1 "no matching digest"
|
||
|
||
test "Resigning opaque in S/MIME format with a unsuitable key length 256" {
|
||
openssl "cms -resign -binary -nodetach -inkey U_cms_2_256/seckey.pem -signer U_cms_2_256/cert.pem -in cms_signed2_1_512_op.msg"
|
||
} 1 "no matching digest"
|
||
|
||
test "Resigning detached in DER format with a unsuitable key length 512" {
|
||
openssl "cms -resign -binary -inform der -inkey U_cms_2_512/seckey.pem -signer U_cms_2_512/cert.pem -in cms_signed2_1_256_det.asn -content cms_signed2.dat"
|
||
} 1 "no matching digest"
|
||
|
||
test "Resigning detached in DER format with a unsuitable key length 256" {
|
||
openssl "cms -resign -binary -inform der -inkey U_cms_2_256/seckey.pem -signer U_cms_2_256/cert.pem -in cms_signed2_1_512_det.asn -content cms_signed2.dat"
|
||
} 1 "no matching digest"
|
||
|
||
test "Resigning in S/MIME format with a unsuitable key length 512" {
|
||
openssl "cms -resign -binary -inkey U_cms_2_512/seckey.pem -signer U_cms_2_512/cert.pem -in cms_signed2_1_256.msg"
|
||
} 1 "no matching digest"
|
||
|
||
test "Resigning in S/MIME format with a unsuitable key length 256" {
|
||
openssl "cms -resign -binary -inkey U_cms_2_256/seckey.pem -signer U_cms_2_256/cert.pem -in cms_signed2_1_512.msg"
|
||
} 1 "no matching digest"
|
||
|
||
|
||
end_tests
|
||
|
||
|
||
|
||
#./load_engine cms -sign -binary -outform der -inform der -nodetach -inkey certs/fstek.key -signer certs/fstek.crt -out cms_signed2 -in cms_signed1
|
||
#./load_engine cms -verify -inform der -in cms_signed2 -noverify
|
||
#./load_engine cms -verify -inform der -in cms_signed2 -noverify -signer sss
|
||
#cat sss
|
||
#history
|
||
#vim sss
|
||
#./load_engine x509 -in sss sss2
|
||
#./load_engine x509 -in sss
|
||
#./load_engine x509 -in sss -subject -noout
|
||
#./load_engine x509 -in sss2 -subject -noout
|
||
#./load_engine cms -verify -inform der -in cms_signed2 -noverify -signer sss -out qqq
|