import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo

security/nss/tests/iopr/ocsp_iopr.sh

@@ -0,0 +1,231 @@
+#! /bin/bash
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+########################################################################
+#
+# mozilla/security/nss/tests/iopr/ocsp_iopr.sh
+#
+# NSS SSL interoperability QA. This file is included from ssl.sh
+#
+# needs to work on all Unix and Windows platforms
+#
+# special strings
+# ---------------
+#   FIXME ... known problems, search for this string
+#   NOTE .... unexpected behavior
+########################################################################
+IOPR_OCSP_SOURCED=1
+
+########################################################################
+# The funtion works with variables defined in interoperability 
+# configuration file that gets downloaded from a webserver.
+# The function sets test parameters defind for a particular type
+# of testing.
+#
+# No return value
+#
+setTestParam() {
+    type=$1
+    testParam=`eval 'echo $'${type}Param`
+    testDescription=`eval 'echo $'${type}Descr`
+    testProto=`eval 'echo $'${type}Proto`
+    testPort=`eval 'echo $'${type}Port`
+    testResponder=`eval 'echo $'${type}ResponderCert`
+    testValidCertNames=`eval 'echo $'${type}ValidCertNames`
+    testRevokedCertNames=`eval 'echo $'${type}RevokedCertNames`
+    testStatUnknownCertNames=`eval 'echo $'${type}StatUnknownCertNames`
+}
+
+########################################################################
+# The funtion checks status of a cert using ocspclnt.
+# Params:
+#    dbDir - nss cert db location
+#    cert - cert in question
+#    respUrl - responder url is available 
+#    defRespCert - trusted responder cert
+#
+# Return values:
+#    0 - test passed, 1 - otherwise.
+#
+ocsp_get_cert_status() {
+    dbDir=$1
+    cert=$2
+    respUrl=$3
+    defRespCert=$4
+    
+    if [ -n "$respUrl" -o -n "$defRespCert" ]; then
+        if [ -z "$respUrl" -o -z "$defRespCert" ]; then
+            html_failed "Incorrect test params" 
+            return 1
+        fi
+        clntParam="-l $respUrl -t $defRespCert"
+    fi
+
+    if [ -z "${MEMLEAK_DBG}" ]; then
+        outFile=$dbDir/ocsptest.out.$$
+        echo "ocspclnt -d $dbDir -S $cert $clntParam"
+        ${BINDIR}/ocspclnt -d $dbDir -S $cert $clntParam >$outFile 2>&1
+        ret=$?
+        echo "ocspclnt output:"
+        cat $outFile
+        [ -z "`grep succeeded $outFile`" ] && ret=1
+    
+        rm -f $outFile
+        return $ret
+    fi
+
+    OCSP_ATTR="-d $dbDir -S $cert $clntParam"
+    ${RUN_COMMAND_DBG} ${BINDIR}/ocspclnt ${OCSP_ATTR}
+}
+
+########################################################################
+# The funtion checks status of a cert using ocspclnt.
+# Params:
+#    testType - type of the test based on type of used responder
+#    servName - FQDM of the responder server
+#    dbDir - nss cert db location
+#
+# No return value
+#
+ocsp_iopr() {
+    testType=$1
+    servName=$2
+    dbDir=$3
+
+    setTestParam $testType
+    if [ "`echo $testParam | grep NOCOV`" != "" ]; then
+        echo "SSL Cipher Coverage of WebServ($IOPR_HOSTADDR) excluded from " \
+            "run by server configuration"
+        return 0
+    fi
+    
+    if [ -z "${MEMLEAK_DBG}" ]; then
+        html_head "OCSP testing with responder at $IOPR_HOSTADDR. <br>" \
+            "Test Type: $testDescription"
+    fi
+
+    if [ -n "$testResponder" ]; then
+        responderUrl="$testProto://$servName:$testPort"
+    else
+        responderUrl=""
+    fi
+
+    if [ -z "${MEMLEAK_DBG}" ]; then
+        for certName in $testValidCertNames; do
+            ocsp_get_cert_status $dbDir $certName "$responderUrl" \
+                "$testResponder"
+            html_msg $? 0 "Getting status of a valid cert ($certName)" \
+                "produced a returncode of $ret, expected is 0."
+        done
+
+        for certName in $testRevokedCertNames; do
+            ocsp_get_cert_status $dbDir $certName "$responderUrl" \
+                "$testResponder"
+            html_msg $? 1 "Getting status of a unvalid cert ($certName)" \
+                "produced a returncode of $ret, expected is 1." 
+        done
+
+        for certName in $testStatUnknownCertNames; do
+            ocsp_get_cert_status $dbDir $certName "$responderUrl" \
+                "$testResponder"
+            html_msg $? 1 "Getting status of a cert with unknown status " \
+                        "($certName) produced a returncode of $ret, expected is 1."
+        done
+    else
+        for certName in $testValidCertNames $testRevokedCertNames \
+            $testStatUnknownCertName; do
+            ocsp_get_cert_status $dbDir $certName "$responderUrl" \
+                "$testResponder" 
+        done
+    fi
+}
+  
+#####################################################################
+# Initial point for running ocsp test againt multiple hosts involved in
+# interoperability testing. Called from nss/tests/ocsp/ocsp.sh
+# It will only proceed with test run for a specific host if environment variable 
+# IOPR_HOSTADDR_LIST was set, had the host name in the list
+# and all needed file were successfully downloaded and installed for the host.
+#
+# Returns 1 if interoperability testing is off, 0 otherwise. 
+#
+ocsp_iopr_run() {
+    NO_ECC_CERTS=1 # disable ECC for interoperability tests
+
+    if [ "$IOPR" -ne 1 ]; then
+        return 1
+    fi
+    cd ${CLIENTDIR}
+
+    if [ -n "${MEMLEAK_DBG}" ]; then
+        html_head "Memory leak checking - IOPR"
+    fi
+
+    num=1
+    IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
+    while [ "$IOPR_HOST_PARAM" ]; do
+        IOPR_HOSTADDR=`echo $IOPR_HOST_PARAM | cut -f 1 -d':'`
+        IOPR_OPEN_PORT=`echo "$IOPR_HOST_PARAM:" | cut -f 2 -d':'`
+        [ -z "$IOPR_OPEN_PORT" ] && IOPR_OPEN_PORT=443
+        
+        . ${IOPR_CADIR}_${IOPR_HOSTADDR}/iopr_server.cfg
+        RES=$?
+        
+        num=`expr $num + 1`
+        IOPR_HOST_PARAM=`echo "${IOPR_HOSTADDR_LIST} " | cut -f $num -d' '`
+
+        if [ $RES -ne 0 -o X`echo "$wsFlags" | grep NOIOPR` != X ]; then
+            continue
+        fi
+        
+        #=======================================================
+        # Check what server is configured to run ssl tests
+        #
+        [ -z "`echo ${supportedTests_new} | grep -i ocsp`" ] && continue;
+
+        # Testing directories defined by webserver.
+        if [ -n "${MEMLEAK_DBG}" ]; then
+            LOGNAME=iopr-${IOPR_HOSTADDR}
+            LOGFILE=${LOGDIR}/${LOGNAME}.log
+        fi
+       
+        # Testing directories defined by webserver.
+        echo "Testing ocsp interoperability.
+                Client: local(tstclnt).
+                Responder: remote($IOPR_HOSTADDR)"
+
+        for ocspTestType in ${supportedTests_new}; do
+            if [ -z "`echo $ocspTestType | grep -i ocsp`" ]; then
+                continue
+            fi
+            if [ -n "${MEMLEAK_DBG}" ]; then
+                ocsp_iopr $ocspTestType ${IOPR_HOSTADDR} \
+                    ${IOPR_OCSP_CLIENTDIR}_${IOPR_HOSTADDR} 2>> ${LOGFILE}
+            else
+                ocsp_iopr $ocspTestType ${IOPR_HOSTADDR} \
+                    ${IOPR_OCSP_CLIENTDIR}_${IOPR_HOSTADDR}
+            fi
+        done
+
+        if [ -n "${MEMLEAK_DBG}" ]; then
+            log_parse
+            ret=$?
+            html_msg ${ret} 0 "${LOGNAME}" \
+                "produced a returncode of $ret, expected is 0"
+        fi
+
+        echo "================================================"
+        echo "Done testing ocsp interoperability with $IOPR_HOSTADDR"
+    done
+
+    if [ -n "${MEMLEAK_DBG}" ]; then
+        html "</TABLE><BR>"
+    fi
+
+    NO_ECC_CERTS=0
+    return 0
+}
+