update upstream changelog

[monkeysphere-validation-agent.git] / tests / basic

diff --git a/tests/basic b/tests/basic
index 8605b132ad0228ece111b9b804ff621f79f2624c..371f20883a41a411a5b9395e5b1e2fa7dcc72467 100755 (executable)
--- a/tests/basic
+++ b/tests/basic
@@ -25,7 +25,7 @@ srcdir=$(dirname $0)/..
 
 REPS=5
 
-CERTTYPES="x509pem x509der opensshpubkey rfc4716"
+CERTTYPES="x509pem x509der opensshpubkey rfc4716 openpgp4fpr"
 
 printf "testing %d reps of simple/quick true/false:\n" "$REPS"
 for n in $(seq 1 "$REPS") ; do
@@ -60,9 +60,29 @@ for name in x y z ; do
     ssh-keygen -e -P '' -f "${WORKDIR}/sec/${name}.key" > "${WORKDIR}/pkc/${name}.rfc4716"
 done
 
+# make 2 client certs (A and B) with self-signed certs
+for name in a b ; do 
+    openssl req -x509 -subj "/eMail=${name}@example.net/CN=${name}/" -nodes -sha256 -newkey rsa:1024 -keyout "${WORKDIR}/sec/${name}.key" -outform DER -out "${WORKDIR}/pkc/${name}.x509der"
+    chmod 0400  "${WORKDIR}/sec/${name}.key"
+    openssl x509 -inform DER -outform PEM < "${WORKDIR}/pkc/${name}.x509der" > "${WORKDIR}/pkc/${name}.x509pem"
+    ssh-keygen -y -P '' -f "${WORKDIR}/sec/${name}.key" > "${WORKDIR}/pkc/${name}.opensshpubkey"
+    ssh-keygen -e -P '' -f "${WORKDIR}/sec/${name}.key" > "${WORKDIR}/pkc/${name}.rfc4716"
+done
+
 # translate X and Y's keys into OpenPGP cert
 for name in x y; do
-    PEM2OPENPGP_USAGE_FLAGS=authenticate pem2openpgp "https://${name}.example.net" < "${WORKDIR}/sec/${name}.key" | gpg --import
+    uid="https://${name}.example.net"
+    PEM2OPENPGP_USAGE_FLAGS=authenticate pem2openpgp "$uid" < "${WORKDIR}/sec/${name}.key" | gpg --import
+    # export fingerprint for openpgp4fpr
+    gpg --with-colons --fingerprint "=${uid}" | grep '^fpr:' | cut -d: -f10 > "${WORKDIR}/pkc/${name}.openpgp4fpr"
+done
+# and the same for the clients A and B
+for name in a b; do
+    uid="${name} <${name}@example.net>"
+    # make user keys 'a' and 's' capable
+    PEM2OPENPGP_USAGE_FLAGS=authenticate,sign pem2openpgp "$uid" < "${WORKDIR}/sec/${name}.key" | gpg --import
+    # export fingerprint for openpgp4fpr
+    gpg --with-colons --fingerprint "=${uid}" | grep '^fpr:' | cut -d: -f10 > "${WORKDIR}/pkc/${name}.openpgp4fpr"
 done
 
 runtests() {
@@ -72,9 +92,16 @@ runtests() {
             ! "${srcdir}"/test-msva msva-perl "${srcdir}"/test-msva msva-query-agent https "${name}.example.net" "${ctype}" < "${WORKDIR}/pkc/x.${ctype}"
         done
     done
+    # A shouldn't validate as A or B:
+    for name in a b; do
+        for ctype in $CERTTYPES; do
+            ! "${srcdir}"/test-msva msva-perl "${srcdir}"/test-msva msva-query-agent https "${name} <${name}@example.net>" "${ctype}" client < "${WORKDIR}/pkc/a.${ctype}"
+        done
+    done
     
-    # certify X's OpenPGP cert with CA
+    # certify X and A's OpenPGP cert with CA
     gpg --batch --yes --sign-key https://x.example.net
+    gpg --batch --yes --sign-key a@example.net
 
     echo "Testing bad data:"
     # it should fail if we pass it the wrong kind of data:
@@ -85,11 +112,16 @@ runtests() {
     for ctype in $CERTTYPES; do 
     # X should now validate as X
         "${srcdir}"/test-msva msva-perl "${srcdir}"/test-msva msva-query-agent https x.example.net "${ctype}" < "${WORKDIR}/pkc/x.${ctype}"
+        "${srcdir}"/test-msva msva-perl "${srcdir}"/test-msva msva-query-agent https 'a <a@example.net>' "${ctype}" client < "${WORKDIR}/pkc/a.${ctype}"
+       # also test "email" context
+        "${srcdir}"/test-msva msva-perl "${srcdir}"/test-msva msva-query-agent email 'a <a@example.net>' "${ctype}" < "${WORKDIR}/pkc/a.${ctype}"
         
     # but X should not validate as Y or Z:
         for name in x y z; do
             ! "${srcdir}"/test-msva msva-perl "${srcdir}"/test-msva msva-query-agent https "${name}.example.net" "${ctype}" < "${WORKDIR}/pkc/x.${ctype}"
         done
+        # and A shouldn't validate as B:
+        ! "${srcdir}"/test-msva msva-perl "${srcdir}"/test-msva msva-query-agent https "b <b@example.net>" "${ctype}" client < "${WORKDIR}/pkc/a.${ctype}"
 
     # neither Y nor Z should validate as any of them:
         for src in y z; do
@@ -97,6 +129,8 @@ runtests() {
                 ! "${srcdir}"/test-msva msva-perl "${srcdir}"/test-msva msva-query-agent https "${targ}.example.net" "${ctype}" < "${WORKDIR}/pkc/${src}.${ctype}"
             done
         done
+        # B should also still not validate as itself:
+        ! "${srcdir}"/test-msva msva-perl "${srcdir}"/test-msva msva-query-agent https "b <b@example.net>" "${ctype}" client < "${WORKDIR}/pkc/b.${ctype}"
     done
 }