250 lines
8.4 KiB
Perl
250 lines
8.4 KiB
Perl
#! /usr/bin/env perl
|
|
# Copyright 2022 The Tongsuo Project Authors. All Rights Reserved.
|
|
#
|
|
# Licensed under the Apache License 2.0 (the "License"). You may not use
|
|
# this file except in compliance with the License. You can obtain a copy
|
|
# in the file LICENSE in the source distribution or at
|
|
# https://github.com/Tongsuo-Project/Tongsuo/blob/master/LICENSE.txt
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
use POSIX;
|
|
use File::Path 2.00 qw/rmtree/;
|
|
use OpenSSL::Test qw/:DEFAULT data_file merge_files/;
|
|
use OpenSSL::Test::Utils;
|
|
use File::Spec::Functions qw/catfile catdir/;
|
|
|
|
my $test_name = "test_sign_sm2";
|
|
setup($test_name);
|
|
|
|
plan skip_all => "sm2 is not supported by this OpenSSL build"
|
|
if disabled("sm2") || disabled("sm3");
|
|
|
|
plan tests => 22;
|
|
|
|
my $CADIR = catdir(".", "ca");
|
|
my $SUBCADIR = catdir(".", "subca");
|
|
|
|
rmtree(${test_name}, { safe => 0 });
|
|
rmtree(${CADIR}, { safe => 0 });
|
|
rmtree(${SUBCADIR}, { safe => 0 });
|
|
|
|
sub setup_ca {
|
|
my $CATOP = shift;
|
|
|
|
mkdir($CATOP);
|
|
mkdir(catdir($CATOP, "newcerts"));
|
|
mkdir(catdir($CATOP, "db"));
|
|
mkdir(catdir($CATOP, "private"));
|
|
mkdir(catdir($CATOP, "crl"));
|
|
|
|
open OUT, ">", catfile($CATOP, "db", "index");
|
|
close OUT;
|
|
open OUT, ">", catfile($CATOP, "db", "serial");
|
|
print OUT "00\n";
|
|
close OUT;
|
|
}
|
|
|
|
mkdir($test_name);
|
|
setup_ca(${CADIR});
|
|
setup_ca(${SUBCADIR});
|
|
|
|
# sm2 ca
|
|
ok(run(app(["openssl", "ecparam",
|
|
"-genkey", "-name", "SM2",
|
|
"-out", catfile(".", $test_name, "ca.key")])));
|
|
|
|
ok(run(app(["openssl", "req",
|
|
"-config", data_file("ca.cnf"),
|
|
"-new", "-key", catfile(".", $test_name, "ca.key"),
|
|
"-out", catfile(".", $test_name, "ca.csr"),
|
|
"-sm3", "-nodes", "-sigopt", "distid:1234567812345678",
|
|
"-subj", "/C=AA/ST=BB/O=CC/OU=DD/CN=root ca"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-selfsign", "-config", data_file("ca.cnf"),
|
|
"-in", catfile(".", $test_name, "ca.csr"),
|
|
"-keyfile", catfile(".", $test_name, "ca.key"),
|
|
"-extensions", "v3_ca",
|
|
"-days", "365",
|
|
"-notext", "-out", catfile(".", $test_name, "ca.crt"),
|
|
"-md", "sm3",
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-batch"])));
|
|
|
|
# sm2 subca
|
|
ok(run(app(["openssl", "ecparam",
|
|
"-genkey", "-name", "SM2",
|
|
"-out", catfile(".", $test_name, "subca.key")])));
|
|
|
|
ok(run(app(["openssl", "req",
|
|
"-config", data_file("ca.cnf"),
|
|
"-new", "-key", catfile(".", $test_name, "subca.key"),
|
|
"-out", catfile(".", $test_name, "subca.csr"),
|
|
"-sm3", "-nodes", "-sigopt", "distid:1234567812345678",
|
|
"-subj", "/C=AA/ST=BB/O=CC/OU=DD/CN=sub ca"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-config", data_file("ca.cnf"),
|
|
"-in", catfile(".", $test_name, "subca.csr"),
|
|
"-cert", catfile(".", $test_name, "ca.crt"),
|
|
"-keyfile", catfile(".", $test_name, "ca.key"),
|
|
"-extensions", "v3_intermediate_ca",
|
|
"-days", "365",
|
|
"-notext", "-out", catfile(".", $test_name, "subca.crt"),
|
|
"-md", "sm3",
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-batch"])));
|
|
|
|
# cat ca.crt subca.crt > chain-ca.crt
|
|
merge_files(catfile(".", $test_name, "ca.crt"),
|
|
catfile(".", $test_name, "subca.crt"),
|
|
catfile(".", $test_name, "chain-ca.crt"));
|
|
|
|
# server sm2 double certs
|
|
ok(run(app(["openssl", "ecparam",
|
|
"-genkey", "-name", "SM2",
|
|
"-out", catfile(".", $test_name, "server_sign.key")])));
|
|
|
|
ok(run(app(["openssl", "req",
|
|
"-config", data_file("subca.cnf"),
|
|
"-key", catfile(".", $test_name, "server_sign.key"),
|
|
"-sm3", "-nodes", "-sigopt", "distid:1234567812345678",
|
|
"-new", "-out", catfile(".", $test_name, "server_sign.csr"),
|
|
"-subj", "/C=AA/ST=BB/O=CC/OU=DD/CN=server sign"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-config", data_file("subca.cnf"),
|
|
"-extensions", "sign_req",
|
|
"-days", "365",
|
|
"-in", catfile(".", $test_name, "server_sign.csr"),
|
|
"-notext", "-out", catfile(".", $test_name, "server_sign.crt"),
|
|
"-cert", catfile(".", $test_name, "subca.crt"),
|
|
"-keyfile", catfile(".", $test_name, "subca.key"),
|
|
"-md", "sm3",
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-batch"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-config", data_file("subca.cnf"),
|
|
"-extensions", "sign_req",
|
|
"-startdate", "20000101000000Z",
|
|
"-enddate", "20010101000000Z",
|
|
"-in", catfile(".", $test_name, "server_sign.csr"),
|
|
"-notext", "-out", catfile(".", $test_name, "server_sign_expire.crt"),
|
|
"-cert", catfile(".", $test_name, "subca.crt"),
|
|
"-keyfile", catfile(".", $test_name, "subca.key"),
|
|
"-md", "sm3",
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-batch"])));
|
|
|
|
ok(run(app(["openssl", "ecparam",
|
|
"-genkey", "-name", "SM2",
|
|
"-out", catfile(".", $test_name, "server_enc.key")])));
|
|
|
|
ok(run(app(["openssl", "req",
|
|
"-config", data_file("subca.cnf"),
|
|
"-key", catfile(".", $test_name, "server_enc.key"),
|
|
"-nodes", "-sm3", "-sigopt", "distid:1234567812345678",
|
|
"-new", "-out", catfile(".", $test_name, "server_enc.csr"),
|
|
"-subj", "/C=AA/ST=BB/O=CC/OU=DD/CN=server enc"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-config", data_file("subca.cnf"),
|
|
"-extensions", "enc_req",
|
|
"-days", "365",
|
|
"-in", catfile(".", $test_name, "server_enc.csr"),
|
|
"-notext", "-out", catfile(".", $test_name, "server_enc.crt"),
|
|
"-cert", catfile(".", $test_name, "subca.crt"),
|
|
"-keyfile", catfile(".", $test_name, "subca.key"),
|
|
"-md", "sm3",
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-batch"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-config", data_file("subca.cnf"),
|
|
"-extensions", "enc_req",
|
|
"-startdate", "20000101000000Z",
|
|
"-enddate", "20010101000000Z",
|
|
"-in", catfile(".", $test_name, "server_enc.csr"),
|
|
"-notext", "-out", catfile(".", $test_name, "server_enc_expire.crt"),
|
|
"-cert", catfile(".", $test_name, "subca.crt"),
|
|
"-keyfile", catfile(".", $test_name, "subca.key"),
|
|
"-md", "sm3",
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-batch"])));
|
|
|
|
# client sm2 double certs
|
|
ok(run(app(["openssl", "ecparam",
|
|
"-genkey", "-name", "SM2",
|
|
"-out", catfile(".", $test_name, "client_sign.key")])));
|
|
|
|
ok(run(app(["openssl", "req",
|
|
"-config", data_file("subca.cnf"),
|
|
"-key", catfile(".", $test_name, "client_sign.key"),
|
|
"-nodes", "-sm3", "-sigopt", "distid:1234567812345678",
|
|
"-new", "-out", catfile(".", $test_name, "client_sign.csr"),
|
|
"-subj", "/C=AA/ST=BB/O=CC/OU=DD/CN=client sign"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-config", data_file("subca.cnf"),
|
|
"-extensions", "sign_req",
|
|
"-days", "365",
|
|
"-in", catfile(".", $test_name, "client_sign.csr"),
|
|
"-notext", "-out", catfile(".", $test_name, "client_sign.crt"),
|
|
"-cert", catfile(".", $test_name, "subca.crt"),
|
|
"-keyfile", catfile(".", $test_name, "subca.key"),
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-md", "sm3",
|
|
"-batch"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-config", data_file("subca.cnf"),
|
|
"-extensions", "sign_req",
|
|
"-startdate", "20000101000000Z",
|
|
"-enddate", "20010101000000Z",
|
|
"-in", catfile(".", $test_name, "client_sign.csr"),
|
|
"-notext", "-out", catfile(".", $test_name, "client_sign_expire.crt"),
|
|
"-cert", catfile(".", $test_name, "subca.crt"),
|
|
"-keyfile", catfile(".", $test_name, "subca.key"),
|
|
"-md", "sm3",
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-batch"])));
|
|
|
|
ok(run(app(["openssl", "ecparam",
|
|
"-genkey", "-name", "SM2",
|
|
"-out", catfile(".", $test_name, "client_enc.key")])));
|
|
|
|
ok(run(app(["openssl", "req",
|
|
"-config", data_file("subca.cnf"),
|
|
"-key", catfile(".", $test_name, "client_enc.key"),
|
|
"-nodes", "-sm3", "-sigopt", "distid:1234567812345678",
|
|
"-new", "-out", catfile(".", $test_name, "client_enc.csr"),
|
|
"-subj", "/C=AA/ST=BB/O=CC/OU=DD/CN=client enc"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-config", data_file("subca.cnf"),
|
|
"-extensions", "enc_req",
|
|
"-days", "365",
|
|
"-in", catfile(".", $test_name, "client_enc.csr"),
|
|
"-notext", "-out", catfile(".", $test_name, "client_enc.crt"),
|
|
"-cert", catfile(".", $test_name, "subca.crt"),
|
|
"-keyfile", catfile(".", $test_name, "subca.key"),
|
|
"-md", "sm3",
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-batch"])));
|
|
|
|
ok(run(app(["openssl", "ca",
|
|
"-config", data_file("subca.cnf"),
|
|
"-extensions", "enc_req",
|
|
"-startdate", "20000101000000Z",
|
|
"-enddate", "20010101000000Z",
|
|
"-in", catfile(".", $test_name, "client_enc.csr"),
|
|
"-notext", "-out", catfile(".", $test_name, "client_enc_expire.crt"),
|
|
"-cert", catfile(".", $test_name, "subca.crt"),
|
|
"-keyfile", catfile(".", $test_name, "subca.key"),
|
|
"-md", "sm3",
|
|
"-vfyopt", "distid:1234567812345678",
|
|
"-batch"])));
|