138{
139
141 char cryptomod[64] = "ssl";
142 char outname[256] = {0};
143
144
145 int i = 1;
146 for (; i < argc; i++) {
147
148 if (!strcmp(argv[i],
"-v") || !strcmp(argv[i],
"--verbose"))
Dbg = 1;
149 if (!strcmp(argv[i],
"-vv"))
Dbg = 2;
150
151 if (!strcmp(argv[i],
"-h") || !strcmp(argv[i],
"--help"))
Help = 1;
152 }
153
154
157 exit(0);
158 }
159
160
161
166
168 }
169
170
175
176
177
178 char *p = argv[0];
179 int k = strlen(argv[0]);
180 while (k--)
181 if (p[k] == '/') break;
182 strcpy(outname,p+k+1);
183
184
185
187 pdots(
" Cannot instantiate factory", 0);
188 exit(1);
189 }
192
194 pline(
"Crypto functionality tests for GSI");
196
197
198
199 struct passwd *pw = getpwuid(geteuid());
200 if (!pw) {
201 pdots(
" Could not resolve user info - exit", 0);
202 exit(1);
203 }
204 NOTIFY(
"effective user is : "<<pw->pw_name<<
", $HOME : "<<pw->pw_dir);
205
206
207
209 EEcert +=
"/.globus/usercert.pem";
210 if (getenv(
"X509_USER_CERT"))
EEcert = getenv(
"X509_USER_CERT");
213 if (xEE) {
215 } else {
216 pdots(
" Problems loading user EE cert", 0);
217 }
218 if (xEE)
pdots(
"Loading EEC", 1);
219
220
221
223 EEkey +=
"/.globus/userkey.pem";
224 if (getenv(
"X509_USER_KEY"))
EEkey = getenv(
"X509_USER_KEY");
226
227
229 PXcert += (int) pw->pw_uid;
230 if (getenv(
"X509_USER_PROXY"))
PXcert = getenv(
"X509_USER_PROXY");
233 if (xPX) {
235 } else {
236 pdots(
" Problems loading user proxy cert", 0);
237 }
238 if (xPX)
pdots(
"Loading User Proxy", 1);
239
240
242 pline(
"Recreate the proxy certificate");
247 X509_EXTENSION *ext = 0;
250 if (prc == 0) {
253 pdots(
"Recreating User Proxy", 1);
254 if ((ext = (X509_EXTENSION *)(xPXp->
GetExtension(
"1.3.6.1.4.1.3536.1.222")))) {
255 pdots(
"proxyCertInfo extension OK", 1);
256 }
257 }
258 } else {
259 pdots(
"Recreating User Proxy", 0);
260 exit(1);
261 }
262
263
264 if (!xPX)
265 xPX = xPXp;
266
267
269 pline(
"Load CA certificates");
270
272 if (getenv(
"X509_CERT_DIR"))
CAdir = getenv(
"X509_CERT_DIR");
275 bool rCAfound = 0;
276 int nCA = 0;
277 while (!rCAfound && nCA < 5) {
282 if (xCA[nCA]) {
284 pdots(
"Loading CA certificate", 1);
285 } else {
286 pdots(
"Loading CA certificate", 0);
287 rCAfound = 0;
288 break;
289 }
290
291 if (!strcmp(xCA[nCA]->IssuerHash(), xCA[nCA]->SubjectHash())) {
292 rCAfound = 1;
293 break;
294 }
295
296 xc = xCA[nCA];
297 nCA++;
298 }
299
300
302 pline(
"Testing ParseFile");
308 if (!(key = chain->
Begin()->
PKI())) {
309 pdots(
"getting PKI", 0);
310 }
311 NOTIFY(nci <<
" certificates found parsing file");
313 int jCA = nCA + 1;
314 while (jCA--) {
316 }
319 if (rCAfound) {
321 pdots(
"Chain reorder: ", (rorc != -1));
323 int verc = chain->
Verify(ecod);
324 pdots(
"Chain verify: ", verc);
325 } else {
326 pdots(
"Full CA chain verification", 0);
327 }
328 } else {
329 pdots(
"attaching to X509ParseFile", 0);
330 exit (1);
331 }
332
333
335 pline(
"Testing ExportChain");
338 if (ExportChain && chain->
End()) {
339 chainbck = (*ExportChain)(chain, 0);
340 pdots(
"Attach to X509ExportChain", 1);
341 } else {
342 pdots(
"Attach to X509ExportChain", 0);
343 exit (1);
344 }
345
347 pline(
"Testing Chain Import");
349 if (!ParseBucket)
pdots(
"attaching to X509ParseBucket", 0);
350
351 int jCA = nCA;
353 while (jCA) { CAchain->
PushBack(xCA[--jCA]); }
354 if (ParseBucket && CAchain) {
355 int nci = (*ParseBucket)(chainbck, CAchain);
356 NOTIFY(nci <<
" certificates found parsing bucket");
359 pdots(
"Chain reorder: ", (rorc != -1));
362 int verc = CAchain->
Verify(ecod);
363 pdots(
"Chain verify: ", verc);
364 } else {
365 pdots(
"creating new X509Chain", 0);
366 exit (1);
367 }
368
369
371 pline(
"Testing GSI chain import and verification");
372
373 jCA = nCA;
375 while (jCA) { GSIchain->
PushBack(xCA[--jCA]); }
376 if (ParseBucket && GSIchain) {
377 int nci = (*ParseBucket)(chainbck, GSIchain);
378 NOTIFY(nci <<
" certificates found parsing bucket");
382 int verc = GSIchain->
Verify(ecod, &vopt);
383 pdots(
"GSI chain verify: ", verc);
386 } else {
387 pdots(
"Creating new gsiX509Chain", 0);
388 exit (1);
389 }
390
391
393 pline(
"Testing GSI chain copy");
394
396 if (GSInew) {
400 int verc = GSInew->
Verify(ecod, &vopt);
401 if (!verc)
NOTIFY(
"GSI chain copy verify ERROR: "<<GSInew->
LastError());
402 pdots(
"GSI chain verify: ", verc);
404 } else {
405 pdots(
"Creating new gsiX509Chain with copy", 0);
406 exit (1);
407 }
408
409
411 pline(
"Testing Cert verification");
413 if (VerifyCert) {
414 bool ok;
415 jCA = nCA;
416 while (jCA >= 0) {
417 ok = xEE->
Verify(xCA[jCA]);
418 NOTIFY(
": verify cert: EE signed by CA? " <<ok<<
" ("<<xCA[jCA]->Subject()<<
")");
419 if (ok) xCAref = xCA[jCA];
420 jCA--;
421 }
422 pdots(
"verify cert: EE signed by CA", (xCAref ? 1 : 0));
424 pdots(
"verify cert: PX signed by EE", ok);
425 jCA = nCA;
426 bool refok = 0;
427 while (jCA >= 0) {
428 ok = xPX->
Verify(xCA[jCA]);
429 NOTIFY(
": verify cert: PX signed by CA? " <<ok<<
" ("<<xCA[jCA]->Subject()<<
")");
430 if (!refok && ok) refok = 1;
431 jCA--;
432 }
433 pdots(
"verify cert: PX not signed by CA", !refok);
434 } else {
435 pdots(
"Attaching to X509VerifyCert", 0);
436 exit (1);
437 }
438
439
440
442 pline(
"Testing request creation");
446 if (prc == 0) {
447 pdots(
"Creating request", 1);
448 if (
Dbg > 0) rPXp->Dump();
449 } else {
450 pdots(
"Creating request", 0);
451 exit(1);
452 }
453
454
456 pline(
"Testing request signature");
459 if (prc == 0) {
462 bool extok = 0;
464 pdots(
"Check proxyCertInfo extension", extok);
465 } else {
466 pdots(
"Signing request", 0);
467 exit(1);
468 }
469
470
472 pline(
"Testing export of signed proxy");
477
481 if (ChainToFile && PXchain) {
483 NOTIFY(
": problems saving signed proxy chain to file: "<<
PPXcert);
484 pdots(
"Saving signed proxy chain to file", 0);
485 } else {
486 pdots(
"Saving signed proxy chain to file", 1);
487 }
488 } else {
489 pdots(
"Creating new X509Chain", 0);
490 exit (1);
491 }
492
493
495 pline(
"Testing CRL identification");
496 X509_EXTENSION *crlext = 0;
497 if (xCAref) {
498 if ((crlext = (X509_EXTENSION *)xCAref->
GetExtension(
"crlDistributionPoints"))) {
499 pdots(
"Check CRL distribution points extension OK", 1);
500 } else {
501 pdots(
"Getting extension", 0);
502 }
503 }
504
505
507 pline(
"Testing CRL loading");
509 if (xCRL1) {
511 pdots(
"Loading CA1 crl", 1);
512
513 bool crlsig = 0, xsig = 0;
514 for (jCA = 0; jCA <= nCA; jCA++) {
515 xsig = xCRL1->
Verify(xCA[jCA]);
516 NOTIFY(
": CRL signature OK? "<<xsig<<
" ("<<xCA[jCA]->Subject()<<
")");
517 if (!crlsig && xsig) crlsig = 1;
518 }
519 pdots(
"CRL signature OK", crlsig);
520
522 NOTIFY(
": SN: 25 revoked? "<<snrev);
523
525 NOTIFY(
": SN: 32 revoked? "<<snrev);
526 } else {
527 pdots(
"Loading CA1 crl", 0);
528 }
529
531 exit(0);
532}
void XrdCryptoSetTrace(kXR_int32 trace)
#define cryptoTRACE_Debug
int(* XrdCryptoX509ChainToFile_t)(XrdCryptoX509Chain *, const char *)
#define gsiProxyCertInfo_OID
XrdSutBucket *(* XrdCryptoX509ExportChain_t)(XrdCryptoX509Chain *, bool)
int(* XrdCryptoX509ParseBucket_t)(XrdSutBucket *, XrdCryptoX509Chain *)
bool(* XrdCryptoX509VerifyCert_t)(XrdCryptoX509 *c, XrdCryptoX509 *r)
int(* XrdCryptoX509ParseFile_t)(const char *fname, XrdCryptoX509Chain *, const char *)
XrdCryptoX509ParseFile_t ParseFile
static void pline(const char *t)
static XrdSysLogger Logger
XrdCryptoFactory * gCryptoFactory
static XrdSysError eDest(0,"gsitest_")
static void pdots(const char *t, bool ok=1)
void XrdSutSetTrace(kXR_int32 trace)
virtual XrdCryptoX509ParseBucket_t X509ParseBucket()
virtual XrdCryptoX509CreateProxyReq_t X509CreateProxyReq()
virtual XrdCryptoX509 * X509(const char *cf, const char *kf=0)
virtual void SetTrace(kXR_int32 trace)
virtual XrdCryptoX509ParseFile_t X509ParseFile()
virtual XrdCryptoX509CreateProxy_t X509CreateProxy()
virtual XrdCryptoX509ChainToFile_t X509ChainToFile()
virtual XrdCryptoX509Crl * X509Crl(const char *crlfile, int opt=0)
static XrdCryptoFactory * GetCryptoFactory(const char *factoryname)
virtual XrdCryptoX509SignProxyReq_t X509SignProxyReq()
virtual XrdCryptoX509ExportChain_t X509ExportChain()
virtual XrdCryptoX509VerifyCert_t X509VerifyCert()
virtual XrdCryptoRSAdata Opaque()
virtual bool Verify(EX509ChainErr &e, x509ChainVerifyOpt_t *vopt=0)
const char * LastError() const
void PushBack(XrdCryptoX509 *c)
XrdCryptoX509 * End() const
virtual bool IsRevoked(int serialnumber, int when)
virtual bool Verify(XrdCryptoX509 *ref)
virtual bool Verify(XrdCryptoX509 *ref)
virtual XrdCryptoX509data GetExtension(const char *oid)
virtual void SetPKI(XrdCryptoX509data pki)
virtual XrdCryptoRSA * PKI()
virtual const char * IssuerHash(int)
bool Verify(EX509ChainErr &e, x509ChainVerifyOpt_t *vopt=0)
const char * c_str() const
XrdSysLogger * logger(XrdSysLogger *lp=0)