|
 |
05700f |
From 40203390a48b8fa01d72c6a9739d963cf24556b8 Mon Sep 17 00:00:00 2001
|
|
|
05700f |
From: Daiki Ueno <ueno@gnu.org>
|
|
|
05700f |
Date: Mon, 28 Dec 2020 16:16:53 +0100
|
|
|
05700f |
Subject: [PATCH 2/2] testpkcs11: use datefudge to trick certificate expiry
|
|
|
05700f |
|
|
|
05700f |
The certificates stored in tests/testpkcs11-certs expired on
|
|
|
05700f |
2020-12-13. To avoid verification failure due to that, use datefudge
|
|
|
05700f |
to set custom date when calling gnutls-cli, gnutls-serv, and certtool.
|
|
|
05700f |
|
|
|
05700f |
Based on the patch by Andreas Metzler:
|
|
|
05700f |
https://gitlab.com/gnutls/gnutls/-/issues/1135#note_469682121
|
|
|
05700f |
|
|
|
05700f |
Signed-off-by: Daiki Ueno <ueno@gnu.org>
|
|
|
05700f |
---
|
|
|
05700f |
tests/scripts/common.sh | 5 +++++
|
|
|
05700f |
tests/testpkcs11.sh | 12 +++++++++++-
|
|
|
05700f |
2 files changed, 16 insertions(+), 1 deletion(-)
|
|
|
05700f |
|
|
|
05700f |
diff --git a/tests/scripts/common.sh b/tests/scripts/common.sh
|
|
|
05700f |
index 6ae19fa58..69b5fd612 100644
|
|
|
05700f |
--- a/tests/scripts/common.sh
|
|
|
05700f |
+++ b/tests/scripts/common.sh
|
|
|
05700f |
@@ -187,6 +187,11 @@ launch_bare_server() {
|
|
|
05700f |
${SERV} $* >${LOGFILE-/dev/null} &
|
|
|
05700f |
}
|
|
|
05700f |
|
|
|
05700f |
+launch_bare_server2() {
|
|
|
05700f |
+ wait_for_free_port "$PORT"
|
|
|
05700f |
+ "$@" >${LOGFILE-/dev/null} &
|
|
|
05700f |
+}
|
|
|
05700f |
+
|
|
|
05700f |
wait_server() {
|
|
|
05700f |
local PID=$1
|
|
|
05700f |
trap "test -n \"${PID}\" && kill ${PID};exit 1" 1 15 2
|
|
|
05700f |
diff --git a/tests/testpkcs11.sh b/tests/testpkcs11.sh
|
|
|
05700f |
index 9458af238..3d74bfea6 100755
|
|
|
05700f |
--- a/tests/testpkcs11.sh
|
|
|
05700f |
+++ b/tests/testpkcs11.sh
|
|
|
05700f |
@@ -67,6 +67,8 @@ have_ed25519=0
|
|
|
05700f |
P11TOOL="${VALGRIND} ${P11TOOL} --batch"
|
|
|
05700f |
SERV="${SERV} -q"
|
|
|
05700f |
|
|
|
05700f |
+TESTDATE=2020-12-01
|
|
|
05700f |
+
|
|
|
05700f |
. ${srcdir}/scripts/common.sh
|
|
|
05700f |
|
|
|
05700f |
rm -f "${LOGFILE}"
|
|
|
05700f |
@@ -79,6 +81,8 @@ exit_error () {
|
|
|
05700f |
exit 1
|
|
|
05700f |
}
|
|
|
05700f |
|
|
|
05700f |
+skip_if_no_datefudge
|
|
|
05700f |
+
|
|
|
05700f |
# $1: token
|
|
|
05700f |
# $2: PIN
|
|
|
05700f |
# $3: filename
|
|
|
05700f |
@@ -523,6 +527,7 @@ write_certificate_test () {
|
|
|
05700f |
pubkey="$5"
|
|
|
05700f |
|
|
|
05700f |
echo -n "* Generating client certificate... "
|
|
|
05700f |
+ datefudge -s "$TESTDATE" \
|
|
|
05700f |
"${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM} --generate-certificate --load-ca-privkey "${cakey}" --load-ca-certificate "${cacert}" \
|
|
|
05700f |
--template ${srcdir}/testpkcs11-certs/client-tmpl --load-privkey "${token};object=gnutls-client;object-type=private" \
|
|
|
05700f |
--load-pubkey "$pubkey" --outfile tmp-client.crt >>"${LOGFILE}" 2>&1
|
|
|
05700f |
@@ -900,7 +905,9 @@ use_certificate_test () {
|
|
|
05700f |
echo -n "* Using PKCS #11 with gnutls-cli (${txt})... "
|
|
|
05700f |
# start server
|
|
|
05700f |
eval "${GETPORT}"
|
|
|
05700f |
- launch_pkcs11_server $$ "${ADDITIONAL_PARAM}" --echo --priority NORMAL --x509certfile="${certfile}" \
|
|
|
05700f |
+ launch_bare_server2 datefudge -s "$TESTDATE" \
|
|
|
05700f |
+ $VALGRIND $SERV $DEBUG -p "$PORT" \
|
|
|
05700f |
+ ${ADDITIONAL_PARAM} --debug 10 --echo --priority NORMAL --x509certfile="${certfile}" \
|
|
|
05700f |
--x509keyfile="$keyfile" --x509cafile="${cafile}" \
|
|
|
05700f |
--verify-client-cert --require-client-cert >>"${LOGFILE}" 2>&1
|
|
|
05700f |
|
|
|
05700f |
@@ -908,13 +915,16 @@ use_certificate_test () {
|
|
|
05700f |
wait_server ${PID}
|
|
|
05700f |
|
|
|
05700f |
# connect to server using SC
|
|
|
05700f |
+ datefudge -s "$TESTDATE" \
|
|
|
05700f |
${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509cafile="${cafile}" </dev/null >>"${LOGFILE}" 2>&1 && \
|
|
|
05700f |
fail ${PID} "Connection should have failed!"
|
|
|
05700f |
|
|
|
05700f |
+ datefudge -s "$TESTDATE" \
|
|
|
05700f |
${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${certfile}" \
|
|
|
05700f |
--x509keyfile="$keyfile" --x509cafile="${cafile}" </dev/null >>"${LOGFILE}" 2>&1 || \
|
|
|
05700f |
fail ${PID} "Connection (with files) should have succeeded!"
|
|
|
05700f |
|
|
|
05700f |
+ datefudge -s "$TESTDATE" \
|
|
|
05700f |
${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${token};object=gnutls-client;object-type=cert" \
|
|
|
05700f |
--x509keyfile="${token};object=gnutls-client;object-type=private" \
|
|
|
05700f |
--x509cafile="${cafile}" </dev/null >>"${LOGFILE}" 2>&1 || \
|
|
|
05700f |
--
|
|
|
05700f |
2.29.2
|
|
|
05700f |
|