X-Git-Url: http://wagner.pp.ru/gitweb/?a=blobdiff_plain;ds=sidebyside;f=tcl_tests%2Fclient.try;fp=tcl_tests%2Fclient.try;h=d6abcb35b5baf782e49fb7f130c6a8ed68ec48b2;hb=3b8ddfe2f303b8931842e52bdb5c07c97042f651;hp=0000000000000000000000000000000000000000;hpb=e09d5a86fe1cb876b3c7cf5eb0d890f557b466d0;p=openssl-gost%2Fengine.git

diff --git a/tcl_tests/client.try b/tcl_tests/client.try
new file mode 100644
index 0000000..d6abcb3
--- /dev/null
+++ b/tcl_tests/client.try
@@ -0,0 +1,143 @@
+#!/usr/bin/tclsh
+# -*- coding: cp1251 -*-
+lappend auto_path [file dirname [info script]]
+
+package require ossltest
+
+if {$argc != 1} {
+	puts stderr "Usage $argv0 cipher-list-file"
+	exit 1
+}	
+
+array set protos {
+	SSLv2 -ssl2
+	SSLv3 -ssl3
+	TLSv1 -tls1
+	TLSv1.1 -tls1_1
+	TLSv1.2 -tls1_2
+    "default" {}
+}	
+get_hosts [lindex $argv 0]
+cd $::test::dir 
+start_tests "TLS-соединение от клиента [lindex $argv 0]"
+
+set CAhost lynx.lan.cryptocom.ru
+set CAprefix /cgi-bin/autoca
+
+
+foreach alg [array names hosts] {
+	set alg2 [regsub {(gost\d+)cp} $alg {\1}]
+	set alg_fn [string map {":" "_"} $alg2]
+	set alg_ca [regexp -inline {^[^:]+} $alg]
+	log "alg_fn=$alg_fn"
+	if {[string match gost2001* $alg]} {
+                set alg_cli_list "gost2001_A gost2001_XA"
+        } elseif {[string match gost2012* $alg]} {
+                set alg_cli_list "gost2001_A gost2012_256_A gost2012_256_XA gost2012_512_A gost2012_512_B"
+	} else {
+		set alg_cli_list $alg_ca
+	}
+
+
+	test -skip {[file exist ca_$alg_ca.pem]} "Получить сертификат $alg_ca CA" {
+		getCAcert $CAhost $CAprefix $alg_ca
+	} 0 "ca_$alg_ca.pem"
+
+	test -skip {[file exist srv_$alg_fn/cert.pem]} "Получить сертификат $alg для сервера" {
+		getCAAlgParams $CAhost $CAprefix $alg_ca
+		if {![makeUser srv_$alg_fn $alg2 CN [info hostname]]} {
+			error "Request generation failed"
+		}
+		registerUserAtCA srv_$alg_fn $CAhost $CAprefix $alg_ca
+		file exists srv_$alg_fn/cert.pem
+	} 0 1
+
+	if {[array exists suites]} {array unset suites}
+	array set suites $hosts($alg)
+	foreach suite [array names suites] {
+		if {![regexp {(.+):(.+)} $suite => proto cs]} {
+			set cs $suite
+			set proto "default"
+		}	
+		if {[info exists suite_map($cs)]} {
+			set mycs $suite_map($cs)
+		} else {
+			set mycs $cs
+		}	
+		set host [lindex [split $suites($suite) :] 0]
+		set host_short [lindex [split $host .] 0]
+		# We assume that CA certificates are already copied into Apache
+		# cert dir
+		set ca_file "/etc/apache/ssl.crt/${alg_ca}-root.crt"
+
+		test "Корректный хэндшейк $suite" {
+			remote_client $host
+			set list [client_server [list -connect [info hostname]:4433 \
+				-CAfile $ca_file -state -cipher $cs] \
+				[concat [list -www -cert srv_$alg_fn/cert.pem \
+				-key srv_$alg_fn/seckey.pem -cipher $mycs] $protos($proto)] {}]
+			set cln_exit_code [lindex $list 2]
+			set srv_error [string match "*error*" [lindex $list 4]]
+			if {[regexp -lineanchor \
+			{^\s*Protocol\s*:\s*(\S*)\s*$.*^\s*Cipher\s*:\s*(\S*)\s*$} \
+			[lindex $list 0] -> result_proto result_cipher]} {
+				if {$proto == "default"} {set result_proto "default"}
+				list $cln_exit_code $srv_error $result_proto $result_cipher
+			} else {
+				lindex $list 1
+			}	
+		} 0 [list 0 0 $proto $cs]
+
+
+		test "Сервер требует сертификат, сертификата нет $suite" {
+			remote_client $host
+			set list [client_server [list -connect [info hostname]:4433 \
+				-CAfile $ca_file -state -cipher $cs] \
+				[concat [list -www -cert srv_$alg_fn/cert.pem \
+				-key srv_$alg_fn/seckey.pem -cipher $mycs -Verify 3 \
+				-verify_return_error] $protos($proto)] {}]
+			string match "*error*" [lindex $list 4]
+		} 0 1 
+
+
+		test "Некорректный клиентский сертфиикат $suite" {
+			remote_client $host
+			set list [client_server [list -connect [info hostname]:4433 \
+				-cert /home/build/client-$alg_ca/cert.pem \
+				-key /home/build/client-$alg_ca/seckey.pem \
+				-CAfile $ca_file -state -cipher $cs] \
+				[concat [list -www -cert srv_$alg_fn/cert.pem \
+				-key srv_$alg_fn/seckey.pem -cipher $mycs -Verify 3 \
+				-verify_return_error] $protos($proto)] {}]
+			string match "*error*" [lindex $list 4]
+		} 0 1
+
+
+
+		foreach alg_cli $alg_cli_list {
+
+			test "Клиентский сертификат $alg_cli $suite" {
+				remote_client $host
+				set list [client_server [list -connect [info hostname]:4433 \
+					-cert /home/build/client-$alg_cli/cert.pem \
+					-key /home/build/client-$alg_cli/seckey.pem \
+					-CAfile $ca_file -state -cipher $cs] \
+					[concat [list -www -cert srv_$alg_fn/cert.pem \
+					-key srv_$alg_fn/seckey.pem -CAfile ca_$alg_ca.pem \
+					-cipher $mycs -Verify 3 -verify_return_error] \
+					$protos($proto)] {}]
+				set cln_exit_code [lindex $list 2]
+				set srv_error [string match "*error*" [lindex $list 4]]
+				if {[regexp -lineanchor \
+				{^\s*Protocol\s*:\s*(\S*)\s*$.*^\s*Cipher\s*:\s*(\S*)\s*$} \
+				[lindex $list 0] -> result_proto result_cipher]} {
+					if {$proto == "default"} {set result_proto "default"}
+					list $cln_exit_code $srv_error $result_proto $result_cipher
+				} else {
+					lindex $list 1
+				}	
+			} 0 [list 0 0 $proto $cs]
+		}
+	}
+}	
+end_tests