|
 |
41734f |
From 46cd5a7d9434ed104093152bdf0a55404e6a1c6b Mon Sep 17 00:00:00 2001
|
|
|
41734f |
From: Rob Crittenden <rcritten@redhat.com>
|
|
|
41734f |
Date: Tue, 5 Oct 2021 11:04:10 -0400
|
|
|
41734f |
Subject: [PATCH] Update csrgen test to understand OpenSSL 3.0.0 output
|
|
|
41734f |
|
|
|
41734f |
OpenSSL 3.0.0 change a lot of output messages. When verifying
|
|
|
41734f |
a certificate instead of printing just "verify OK" it prints
|
|
|
41734f |
"Certificate request self-signature verify OK"
|
|
|
41734f |
|
|
|
41734f |
Modify the check to match both OpenSSL 1.x and 3.x
|
|
|
41734f |
|
|
|
41734f |
Related: https://pagure.io/certmonger/issue/223
|
|
|
41734f |
|
|
|
41734f |
Signed-off-by: Rob Crittenden <rcritten@redhat.com>
|
|
|
41734f |
---
|
|
|
41734f |
tests/003-csrgen-ec/run.sh | 4 ++--
|
|
|
41734f |
tests/003-csrgen-rsa/run.sh | 4 ++--
|
|
|
41734f |
tests/003-csrgen/run.sh | 4 ++--
|
|
|
41734f |
3 files changed, 6 insertions(+), 6 deletions(-)
|
|
|
41734f |
|
|
|
41734f |
diff --git a/tests/003-csrgen-ec/run.sh b/tests/003-csrgen-ec/run.sh
|
|
|
41734f |
index 91117ec8..7c0505f8 100755
|
|
|
41734f |
--- a/tests/003-csrgen-ec/run.sh
|
|
|
41734f |
+++ b/tests/003-csrgen-ec/run.sh
|
|
|
41734f |
@@ -42,8 +42,8 @@ grep ^minicert= entry.nss.$size | sed s,^minicert=,, | base64 -d > minicert.nss.
|
|
|
41734f |
openssl x509 -out minicert.nss.$size.pem -in minicert.nss.$size -inform der
|
|
|
41734f |
# The RSA tests already verify the contents of the requests, so we really only
|
|
|
41734f |
# need to care about the signatures passing verification.
|
|
|
41734f |
-openssl req -verify -noout < csr.nss.$size 2>&1
|
|
|
41734f |
-openssl req -verify -noout < csr.openssl.$size 2>&1
|
|
|
41734f |
+openssl req -verify -noout -noenc < csr.nss.$size 2>&1 | sed 's/Certificate request self-signature //'
|
|
|
41734f |
+openssl req -verify -noout -noenc < csr.openssl.$size 2>&1 | sed 's/Certificate request self-signature //'
|
|
|
41734f |
openssl spkac -verify -noout < spkac.nss.$size 2>&1
|
|
|
41734f |
openssl spkac -verify -noout < spkac.openssl.$size 2>&1
|
|
|
41734f |
openssl verify -CAfile minicert.openssl.$size.pem minicert.openssl.$size.pem 2>&1
|
|
|
41734f |
diff --git a/tests/003-csrgen-rsa/run.sh b/tests/003-csrgen-rsa/run.sh
|
|
|
41734f |
index bb8ebecb..4f0c0ef0 100755
|
|
|
41734f |
--- a/tests/003-csrgen-rsa/run.sh
|
|
|
41734f |
+++ b/tests/003-csrgen-rsa/run.sh
|
|
|
41734f |
@@ -118,14 +118,14 @@ iterate() {
|
|
|
41734f |
echo key_pubkey=616263 >> entry.openssl.$size
|
|
|
41734f |
$toolsdir/csrgen entry.nss.$size > csr.nss.$size
|
|
|
41734f |
# Both should verify.
|
|
|
41734f |
- if test "`openssl req -verify -key key.$size -in csr.openssl.$size -noout 2>&1`" != "verify OK" ; then
|
|
|
41734f |
+ if test "`openssl req -verify -key key.$size -in csr.openssl.$size -noout -noenc 2>&1 | grep -c "verify OK"`" != "1" ; then
|
|
|
41734f |
echo Signature failed for OpenSSL:
|
|
|
41734f |
cat csr.openssl.$size
|
|
|
41734f |
echo Private key:
|
|
|
41734f |
awk '/BEGIN PRIVATE KEY/,/END PRIVATE KEY/{print}{;}' $tmpdir/key.$size
|
|
|
41734f |
exit 1
|
|
|
41734f |
fi
|
|
|
41734f |
- if test "`openssl req -verify -key key.$size -in csr.nss.$size -noout 2>&1`" != "verify OK" ; then
|
|
|
41734f |
+ if test "`openssl req -verify -key key.$size -in csr.nss.$size -noout -noenc 2>&1 | grep -c "verify OK"`" != "1" ; then
|
|
|
41734f |
echo Signature failed for NSS:
|
|
|
41734f |
cat csr.nss.$size
|
|
|
41734f |
echo Private key:
|
|
|
41734f |
diff --git a/tests/003-csrgen/run.sh b/tests/003-csrgen/run.sh
|
|
|
41734f |
index d3dfbaf0..093beabf 100755
|
|
|
41734f |
--- a/tests/003-csrgen/run.sh
|
|
|
41734f |
+++ b/tests/003-csrgen/run.sh
|
|
|
41734f |
@@ -170,14 +170,14 @@ iterate() {
|
|
|
41734f |
echo key_pubkey=616263 >> entry.openssl.$size
|
|
|
41734f |
$toolsdir/csrgen entry.nss.$size > csr.nss.$size
|
|
|
41734f |
# Both should verify.
|
|
|
41734f |
- if test "`openssl req -verify -key key.$size -in csr.openssl.$size -noout 2>&1`" != "verify OK" ; then
|
|
|
41734f |
+ if test "`openssl req -verify -key key.$size -in csr.openssl.$size -noout -noenc 2>&1 | grep -c "verify OK"`" != "1" ; then
|
|
|
41734f |
echo Signature failed for OpenSSL:
|
|
|
41734f |
cat csr.openssl.$size
|
|
|
41734f |
echo Private key:
|
|
|
41734f |
awk '/BEGIN PRIVATE KEY/,/END PRIVATE KEY/{print}{;}' $tmpdir/key.$size
|
|
|
41734f |
exit 1
|
|
|
41734f |
fi
|
|
|
41734f |
- if test "`openssl req -verify -key key.$size -in csr.nss.$size -noout 2>&1`" != "verify OK" ; then
|
|
|
41734f |
+ if test "`openssl req -verify -key key.$size -in csr.nss.$size -noout -noenc 2>&1 | grep -c "verify OK"`" != "1" ; then
|
|
|
41734f |
echo Signature failed for NSS:
|
|
|
41734f |
cat csr.nss.$size
|
|
|
41734f |
echo Private key:
|
|
|
41734f |
--
|
|
|
41734f |
2.31.1
|
|
|
41734f |
|