2 # -*- coding: cp1251 -*-
3 lappend auto_path [file dirname [info script]]
4 package require ossltest
6 set testname [file rootname [file tail $::argv0]]
8 start_tests "Тесты на команду cms"
10 test "Creating CA 2001" {
11 makeCA ${testname}CA gost2001:A
14 test "Creating CA 2012" {
19 if {[info exists env(ALG_LIST)]} {
20 set alg_list $env(ALG_LIST)
22 switch -exact [engine_name] {
23 "ccore" {set alg_list {gost2001:A gost2001:B gost2001:C gost2012_256:A gost2012_256:B gost2012_256:C gost2012_512:A gost2012_512:B}}
24 "open" {set alg_list {gost2001:A gost2001:B gost2001:C gost2012_256:A gost2012_256:B gost2012_256:C gost2012_512:A gost2012_512:B}}
28 foreach alg $alg_list {
29 set alg_fn [string map {":" "_"} $alg]
30 set username U_cms_$alg_fn
32 gost2012* {set ::test::ca ${testname}CA-2012
33 set ca_sign_alg hash_with_sign12_512
35 * {set ::test::ca ${testname}CA
36 set ca_sign_alg hash_with_sign01_cp
40 test "Creating user with signing key $alg" {
41 makeRegisteredUser $username $alg
43 if {![file exists $username/req.pem]&&[file exists $username/cert.pem]} {
44 file delete $username/cert.pem
46 file exists $username/cert.pem
49 test -skip {![file exists $username/cert.pem]} -createsfiles [list cms_sign.dat cms_sign_$alg_fn.msg] "Signing a message without cert by $alg" {
50 makeFile cms_sign.dat [string repeat "Test data to cms_sign.\n" 100]
51 openssl "cms -sign -in cms_sign.dat -text -out cms_sign_$alg_fn.msg -signer $username/cert.pem -inkey $username/seckey.pem -nocerts"
52 file isfile cms_sign_$alg_fn.msg
55 test -skip {![file exist cms_sign_$alg_fn.msg]} "Checking micalg param in signed without cert $alg message" {
56 regexp -- micalg="[micalg [alg_hash $alg]]" [grep micalg [getFile cms_sign_$alg_fn.msg]]
59 test -createsfiles cms_sign_$alg_fn.pem -skip {![file exist cms_sign_$alg_fn.msg]} "Extracting CMS from signed without cert $alg message" {
60 openssl "cms -cmsout -out cms_sign_$alg_fn.pem -outform PEM -in cms_sign_$alg_fn.msg"
61 file isfile cms_sign_$alg_fn.pem
65 test -skip {![file exists cms_sign_$alg_fn.pem]} "Checking oids in cms struct" {
66 extract_oids cms_sign_$alg_fn.pem PEM
67 } 0 [mkObjList [hash_long_name $alg] [hash_long_name $alg] "GOST R 34.11-2012 with 256 bit hash" "GOST R 34.11-2012 with 512 bit hash" "GOST R 34.11-94" "GOST 28147-89" [alg_long_name $alg]]
68 # hash_12_256 hash_12_512 hash_94 crypt89_cc are from sMIMECapabilities
70 test -skip {![file exists cms_sign_$alg_fn.msg]} "Verifying a message signed with $alg without ca " {
71 grep Veri [openssl "cms -verify -text -in cms_sign_$alg_fn.msg -out cms_verified.txt -noverify -certfile $username/cert.pem"]
72 } 0 "Verification successful
75 test -skip {![file exists cms_sign_$alg_fn.msg]} "Verifying a message signed with $alg with ca" {
76 grep Veri [openssl "cms -verify -text -in cms_sign_$alg_fn.msg -out cms_verified.txt -certfile $username/cert.pem -CAfile $::test::ca/cacert.pem"]
77 } 0 "Verification successful
80 test -skip {![file exists cms_sign_$alg_fn.msg]} -createsfiles [list cms_bad_$alg_fn.msg cms_verified.txt] "Verifying corrupted messages signed with $alg" {
81 set corrupted [getFile cms_sign_$alg_fn.msg]
82 set index [string first "Test data" $corrupted ]
83 makeFile cms_bad_$alg_fn.msg [string replace $corrupted $index [expr $index+9] "Bad data"]
84 grep Verification [openssl "cms -verify -text -in cms_bad_$alg_fn.msg -out cms_verified.txt -noverify -certfile $username/cert.pem"]
85 } 1 "Verification failure"
87 test -skip {![file exists $username/cert.pem]} -createsfiles [list cms_sign.dat cms_sign_c_$alg_fn.msg] "Signing a message by $alg with cert" {
88 makeFile cms_sign.dat [string repeat "Test data to sign.\n" 100]
89 openssl "cms -sign -in cms_sign.dat -crlfeol -text -out cms_sign_c_$alg_fn.msg -signer $username/cert.pem -inkey $username/seckey.pem"
90 file isfile cms_sign_c_$alg_fn.msg
93 test -skip {![file exist cms_sign_c_$alg_fn.msg]} "Checking micalg param in signed with cert $alg message" {
94 regexp -- micalg="[micalg [alg_hash $alg]]" [grep micalg [getFile cms_sign_c_$alg_fn.msg]]
97 test -skip {![file exists cms_sign_c_$alg_fn.msg]} "Verifying a message signed with $alg having cert inside without ca" {
98 grep Veri [openssl "cms -verify -text -in cms_sign_c_$alg_fn.msg -out cms_verified.txt -noverify"]
99 } 0 "Verification successful
102 test -skip {![file exists cms_sign_c_$alg_fn.msg]} "Verifying a message signed with $alg having cert with ca" {
103 grep Veri [openssl "cms -verify -text -in cms_sign_c_$alg_fn.msg -out cms_verified.txt -CAfile $::test::ca/cacert.pem"]
104 } 0 "Verification successful
107 test -skip {![file exists $username/cert.pem]} -createsfiles {cms_sign.dat cms_sign_op_$alg_fn.msg} "Signing a message by $alg with cert using opaque signing" {
108 makeFile cms_sign.dat [string repeat "Test data to cms_sign.\n" 100]
109 openssl "cms -sign -in cms_sign.dat -text -out cms_sign_op_$alg_fn.msg -signer $username/cert.pem -inkey $username/seckey.pem -nodetach"
110 file isfile cms_sign_op_$alg_fn.msg
113 test -createsfiles cms_verified.txt -skip {![file exists cms_sign_op_$alg_fn.msg]} "Verifying a message signed by $alg having cert inside without ca" {
114 grep Veri [openssl "cms -verify -text -in cms_sign_op_$alg_fn.msg -out cms_verified.txt -noverify"]
115 } 0 "Verification successful
118 test -createsfiles cms_verified.txt -skip {![file exists cms_sign_op_$alg_fn.msg]} "Verifying a $alg opaque message with ca" {
119 grep Veri [openssl "cms -verify -text -in cms_sign_op_$alg_fn.msg -out cms_verified.txt -CAfile $::test::ca/cacert.pem"]
120 } 0 "Verification successful
123 test -createsfiles cms_broken_op_$alg_fn.msg -skip {![file exists cms_sign_op_$alg_fn.msg]} "Verifying broken $alg opaque message" {
124 set data [getFile cms_sign_op_$alg_fn.msg]
125 regexp "(.*)\n\r?\n(.+)" $data match header encoded
126 set asnstruct [::base64::decode $encoded]
127 makeFile cms_broken_op_$alg_fn.msg "$header\n\n[::base64::encode [regsub -all\
128 "Test data" $asnstruct "Best data"]]"
129 grep Verification [openssl "cms -verify -text -in cms_broken_op_$alg_fn.msg -out cms_verified.txt -CAfile $::test::ca/cacert.pem"]
130 } 1 "Verification failure"
133 test -createsfiles "cms_sign_det_$alg_fn.msg" -skip {![file exists $username/cert.pem]||![file exists cms_sign.dat]} "Creating detached $alg signature" {
134 openssl "cms -sign -binary -in cms_sign.dat -out cms_sign_det_$alg_fn.msg -signer $username/cert.pem -inkey $username/seckey.pem"
135 file exists cms_sign_det_$alg_fn.msg
138 test -skip {![file exist cms_sign_det_$alg_fn.msg]} "Checking micalg param in detached $alg signature" {
139 regexp -- micalg="[micalg [alg_hash $alg]]" [grep micalg [getFile cms_sign_det_$alg_fn.msg]]
142 test -createsfiles cms_sign_det_$alg_fn.pem -skip {![file exist cms_sign_det_$alg_fn.msg]} "Extracting CMS from signed $alg message" {
143 openssl "cms -cmsout -out cms_sign_det_$alg_fn.pem -outform PEM -in cms_sign_det_$alg_fn.msg"
144 file isfile cms_sign_$alg_fn.pem
147 #We expect cryptocom oids because of cert cms_signed by ca with Cryptocom algs
150 # 2. algorithm of CA key
151 # 3. algorithm of current key
152 # 4. algorithm of CA key
154 # 6. digests from sMIMECapabilities
155 # 7. encryption from sMIMECapabilities
156 # 8. algorithm of current key
157 test -skip {![file exists cms_sign_$alg_fn.pem]} "Checking oids in cms struct" {
158 extract_oids cms_sign_det_$alg_fn.pem PEM
159 } 0 [mkObjList [hash_long_name $alg] [smime_hash_with_sign_long_name $ca_sign_alg] [alg_long_name $alg] [pubkey_long_name $alg] [param_hash_long_name [param_hash $alg]] [smime_hash_with_sign_long_name $ca_sign_alg] [hash_long_name $alg] "GOST R 34.11-2012 with 256 bit hash" "GOST R 34.11-2012 with 512 bit hash" "GOST R 34.11-94" "GOST 28147-89" [alg_long_name $alg]]
161 test -skip {![file exists cms_sign_det_$alg_fn.pem]} "Verifying detached $alg cms_signature" {
162 grep Veri [openssl "cms -verify -content cms_sign.dat -inform PEM -in cms_sign_det_$alg_fn.pem -out cms_verified.txt -noverify"]
163 } 0 "Verification successful
166 test -skip {![file exists cms_sign_det_$alg_fn.msg]} -createsfiles {bad.dat} "Verifying corrupted $alg detached cms_signature" {
167 makeFile bad.dat [regsub Test [getFile cms_sign.dat] Best]
168 grep Verification [openssl "cms -verify -content bad.dat -in cms_sign_det_$alg_fn.msg -out cms_verified.txt -CAfile $::test::ca/cacert.pem"]
169 } 1 "Verification failure"