blob: 92687b12e121b3a0f23e6f3a59388eb5d2644036 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
|
#!/usr/bin/tclsh
lappend auto_path [file dirname [info script]]
package require ossltest
cd $::test::dir
set testname [file rootname [file tail $::argv0]]
start_tests "Тесты на OCSP-запросы и ответы"
if {[info exists env(ALG_LIST)]} {
set alg_list $env(ALG_LIST)
} else {
switch -exact [engine_name] {
"ccore" {set alg_list {gost2001:A gost2012_256:A gost2012_512:B}}
"open" {set alg_list {gost2001:A gost2012_256:A gost2012_512:B}}
}
}
foreach alg $alg_list {
set alg_fn [string map {":" "_"} $alg]
set username U_smime_$alg_fn
test "Creating CA" {
makeCA ${testname}CA-$alg_fn $alg
} 0 1
after 1000
set server_args "-index $::test::ca/index.txt -rsigner $::test::ca/cacert.pem -rkey $::test::ca/private/cakey.pem -CA $::test::ca/cacert.pem -noverify"
set client_args "-issuer $::test::ca/cacert.pem -CAfile $::test::ca/cacert.pem"
test "Создаем юзера" {
makeRegisteredUser U_ocsp_$alg_fn $alg
makeRegisteredUser U_ocsp2_$alg_fn $alg
file exists U_ocsp_$alg_fn/cert.pem
} 0 1
after 1000
test -createsfiles {request1.der} "Создаеем неподписанный запрос SHA1 хэш по сертификату" {
openssl "ocsp $client_args -cert U_ocsp_$alg_fn/cert.pem -reqout request1.der"
file exists request1.der
} 0 1
test -skip {![file exists request1.der]} "Анализируем OID-ы в запросе" {
extract_oids request1.der DER
} 0 " OBJECT :sha1
"
test -skip {![file exists request1.der]} -createsfiles {response1.der} "Формируем ГОСТ-подписанный ответ" {
openssl "ocsp $server_args -reqin request1.der -respout response1.der"
} 0 ""
test -skip {![file exists request1.der]} "Анализируем OID-ы в ответе" {
extract_oids response1.der DER 30
} 0 " OBJECT :sha1\n[mkObjList [hash_with_sign_long_name $alg] [hash_with_sign_long_name $alg] [alg_long_name $alg] [pubkey_long_name $alg] [param_hash_long_name [param_hash $alg]] [hash_with_sign_long_name $alg]]"
test -skip {![file exists response1.der]} "Проверяем ГОСТ-подписанный ответ" {
openssl "ocsp $client_args -respin response1.der"
} 0 "STDERR CONTENTS:\nResponse verify OK"
test -skip {![file exists response1.der]} "Проверяем статус сертификата" {
grep "Cert Status" [openssl "ocsp -respin response1.der -text -CAfile $::test::ca/cacert.pem"]
} 0 " Cert Status: good\n"
test -createsfiles request2.der "Формируем ГОСТ-подписанный запрос с хэшом SHA1 по сертификату" {
openssl "ocsp $client_args -cert U_ocsp_$alg_fn/cert.pem -signer U_ocsp_$alg_fn/cert.pem -signkey U_ocsp_$alg_fn/seckey.pem -reqout request2.der"
} 0 ""
test -skip {![file exists request2.der]} "Анализируем OID-ы в запросе" {
extract_oids request2.der DER
} 0 " OBJECT :sha1\n[mkObjList [hash_with_sign_long_name $alg] [hash_with_sign_long_name $alg] [alg_long_name $alg] [pubkey_long_name $alg] [param_hash_long_name [param_hash $alg]] [hash_with_sign_long_name $alg]]"
test -createsfiles response2.der -skip {![file exists request2.der]} "Формируем ответ на подписанный запрос" {
openssl "ocsp $server_args -reqin request2.der -respout response2.der"
file exists response2.der
} 0 1
test -skip {![file exists response2.der]} "Проверяем ответ на запрос 2" {
grep "Response .erif" [openssl "ocsp $client_args -respin response2.der"]
} 0 "Response verify OK\n"
test -createsfiles request3.der "Формируем запрос с ГОСТ-овским хэшом по сертификату" {
openssl "ocsp $client_args -[hash_short_name [alg_hash $alg]] -cert U_ocsp_$alg_fn/cert.pem -reqout request3.der"
file exists request3.der
} 0 1
test -skip {![file exists request3.der]} "Анализируем OID-ы в запросе" {
extract_oids request3.der DER
} 0 [mkObjList [hash_long_name $alg]]
test -skip {![file exists request3.der]} -createsfiles response3.der "Формируем ответ на запрос с ГОСТ-овским хэшом" {
openssl "ocsp $server_args -reqin request3.der -respout response3.der"
file exists response3.der
} 0 1
test -skip {![file exists response3.der] } "Проверяем ответ на запрос 3" {
grep "Response .erif" [openssl "ocsp $client_args -respin response3.der"]
} 0 "Response verify OK\n"
test -skip {![file exists response3.der]} "Проверяем статус сертификата" {
grep "Cert Status" [openssl "ocsp -respin response3.der -text -CAfile $::test::ca/cacert.pem"]
} 0 " Cert Status: good\n"
test -createsfiles request4.der "Формируем запрос с ГОСТ-овским хэшом по serial" {
openssl "ocsp $client_args -[hash_short_name [alg_hash $alg]] -serial 0x11E -reqout request4.der"
} 0 ""
test -skip {![file exists request4.der]} "Проверяем OID-ы в запросе 4" {
extract_oids request4.der DER
} 0 [mkObjList [hash_long_name $alg]]
test -skip {![file exists request4.der]} -createsfiles response4.der "Формируем ответ на запрос с ГОСТ-овским хэшом" {
openssl "ocsp $server_args -reqin request4.der -respout response4.der"
file exists response4.der
} 0 1
test -skip {![file exists response4.der] } "Проверяем ответ на запрос 4" {
grep "Response .erif" [openssl "ocsp $client_args -respin response4.der"]
} 0 "Response verify OK\n"
test -createsfiles request5.der "Формируем запрос с двумя сертификатами и разными хэшами" {
openssl "ocsp $client_args -[hash_short_name [alg_hash $alg]] -cert U_ocsp_$alg_fn/cert.pem -sha1 -cert U_ocsp2_$alg_fn/cert.pem -reqout request5.der"
} 0 ""
test -skip {![file exists request5.der]} "Проверяем OID-ы в запросе 5" {
extract_oids request5.der DER
} 0 "[mkObjList [hash_long_name $alg]] OBJECT :sha1\n"
test -skip {![file exists request5.der]} -createsfiles response5.der "Формируем ответ на запрос с двумя хэшами" {
openssl "ocsp $server_args -reqin request5.der -respout response5.der"
file exists response5.der
} 0 1
test -skip {![file exists response5.der] } "Проверяем ответ на запрос 5" {
grep "Response .erif" [openssl "ocsp $client_args -respin response5.der"]
} 0 "Response verify OK\n"
test -skip {![file exists response5.der]} "Проверяем статус сертификатoв" {
grep "Cert Status" [openssl "ocsp -respin response5.der -text -CAfile $::test::ca/cacert.pem"]
} 0 " Cert Status: good\n Cert Status: good\n"
}
end_tests
|
