📄 scert.c
字号:
return( TRUE );
}
/* Perform a client/server loopback test */
#ifdef WINDOWS_THREADS
unsigned __stdcall scepServerThread( void *dummy )
{
testSessionSCEPServer();
_endthreadex( 0 );
return( 0 );
}
int testSessionSCEPClientServer( void )
{
HANDLE hThread;
unsigned threadID;
int status;
#if ( SCEP_NO != 1 )
/* Because the code has to handle so many CA-specific peculiarities, we
can only perform this test when the CA being used is the cryptlib
CA */
puts( "Error: The local SCEP session test only works with SCEP_NO == 1." );
return( FALSE );
#endif /* cryptlib CA */
/* Start the server and wait for it to initialise (this takes a bit
longer than the other servers because we have to work with a cert
store so we wait a bit longer than usual) */
hThread = ( HANDLE ) _beginthreadex( NULL, 0, &scepServerThread,
NULL, 0, &threadID );
Sleep( 3000 );
/* Connect to the local server */
status = testSessionSCEP();
waitForThread( hThread );
return( status );
}
#endif /* WINDOWS_THREADS */
/****************************************************************************
* *
* CMP Routines Test *
* *
****************************************************************************/
/* There are various CMP test CAs available, the following mappings can be
used to test different ones. Implementation peculiarities:
#1 - cryptlib: Implicitly revokes cert being replaced during a kur (this
is a requirement for maintaining cert store consistency).
Tested: ir, cr/kur, rr
#2 - cryptlib with PKIBoot/PnP PKI functionality, otherwise as for #1.
#3 - Certicom: Requires signature for revocation rather than MAC,
requires that all certs created after the ir one have the same
DN as the ir cert.
Tested: ir, cr/kur, rr
#4 - ssh old: None (recently re-issued their CA cert which is broken, CA
couldn't be re-tested. In addition since CMP identifies the
sender by DN the new cert can't be distinguished from the old
one, causing all sig checks to fail).
Tested (late 2000): ir, cr/kur, rr
#5 - ssh new:
#6 - Entrust: Won't allow altNames, changes sender and request DN,
returns rejected response under an altered DN belonging to a
completely different EE for anything but ir.
Tested: ir
#7 - Trustcenter: Requires HTTPS and pre-existing trusted private key
distributed as PKCS #12 file, couldn't be tested.
#8 - Baltimore: Server unavailable for testing.
Tested: -
#9 - Initech: Needs DN cn=CryptLIB EE 1,o=INITECH,c=KR.
Tested: ir, cr/kur, rr
#10 - RSA labs: Rejects signed requests, couldn't be tested beyond initial
(MACd) ir. Attempt to revoke newly-issued cert with MACd rr
returns error indicating that the cert is already revoked.
Tested: ir
#11 - Cylink: Invalid CA root cert, requires use of DN from RA rather
than CA when communicating with server.
Tested: - */
#define CA_CRYPTLIB 1
#define CA_CRYPTLIB_PNPPKI 2
#define CA_NO CA_CRYPTLIB
typedef struct {
const char *name;
const C_CHR *url, *user, *password;
} CA_INFO;
static const CA_INFO caInfo[] = {
{ NULL }, /* Dummy so index == CA_NO */
{ /*1*/ "cryptlib", TEXT( "http://localhost" ), TEXT( "interop" ), TEXT( "interop" ) },
{ /*2*/ "cryptlib/PKIBoot", /*"_pkiboot._tcp.cryptoapps.com"*/TEXT( "http://localhost" ), TEXT( "interop" ), TEXT( "interop" ) },
{ /*3*/ "Certicom", TEXT( "cmp://gandalf.trustpoint.com:8081" ), TEXT( "interop" ), TEXT( "interop" ) },
{ /*4*/ "ssh", TEXT( "cmp://interop-ca.ssh.com:8290" ), TEXT( "123456" ), TEXT( "interop" ) },
{ /*5*/ "ssh", TEXT( "http://pki.ssh.com:8080/pkix/" ), TEXT( "62154" ), TEXT( "ssh" ) },
{ /*6*/ "Entrust", TEXT( "cmp://204.101.128.45:829" ), TEXT( "39141091" ), TEXT( "ABCDEFGHIJK" ) },
{ /*7*/ "Trustcenter", TEXT( "cmp://demo.trustcenter.de/cgi-bin/cmp:829" ), TEXT( "interop" ), TEXT( "interop" ) },
{ /*8*/ "Baltimore", TEXT( "cmp://hip.baltimore.ie:8290" ), TEXT( "pgutmann" ), TEXT( "the-magical-land-near-oz" ) },
{ /*9*/ "Initech", TEXT( "cmp://61.74.133.49:8290" ), TEXT( "interop" ), TEXT( "interop" ) },
{ /*A*/ "RSA", TEXT( "cmp://ca1.kcspilot.com:32829" ), TEXT( "interop" ), TEXT( "interop" ) },
{ /*B*/ "Cylink", TEXT( "cmp://216.252.217.227:8082" ), TEXT( "3986" ), TEXT( "11002" ) /* "3987", "6711" */ }
};
/* Enable additional tests if we're using cryptlib as the server */
#if ( CA_NO == CA_CRYPTLIB ) || ( CA_NO == CA_CRYPTLIB_PNPPKI )
#define SERVER_IS_CRYPTLIB
#if ( CA_NO == CA_CRYPTLIB_PNPPKI )
#define SERVER_PKIBOOT
#endif /* cryptlib PKIBoot server */
#endif /* Extra tests for cryptib CA */
/* Define the following to work around CA bugs/quirks */
#if ( CA_NO == 3 ) /* Certicom */
#define SERVER_IR_DN
#endif /* CA that requires same DN in cr as ir */
#if ( CA_NO == 6 ) /* Entrust */
#define SERVER_NO_ALTNAMES
#endif /* CAs that won't allow altNames in requests */
#if ( CA_NO == 9 ) /* Initech */
#define SERVER_FIXED_DN
#endif /* CAs that require a fixed DN in requests */
/* The following defines can be used to selectively enable or disable some
of the test (for example to do an ir + rr, or ir + kur + rr) */
#ifdef SERVER_IS_CRYPTLIB
#define TEST_IR
/*#define TEST_DUP_IR */
#define TEST_KUR
#define TEST_CR
#define TEST_RR
/* 3 cert reqs, 1 rev.req (kur = impl.rev) plus duplicate ir to check for
rejection of second request for same user. The duplicate-ir check is
currently disabled because it's enforced via database transaction
constraints, which means that once the initial ir has been recorded all
further issue operations with the same ID are excluded by the presence
of the ID for the ir. This is a strong guarantee that subsequent
requests with the same ID will be disallowed, but not terribly useful
for self-test purposes */
#define NO_CA_REQUESTS ( 4 + 0 )
#else
#define TEST_IR
#define TEST_KUR
#define TEST_CR
#define TEST_RR
/* Loopback test requires SERVER_IS_CRYPTLIB */
#define NO_CA_REQUESTS 0
#endif /* SERVER_IS_CRYPTLIB */
/* Define the following to enable testing of servers where the initial DN is
supplied by the server (i.e. the user supplies a null DN) */
#ifdef SERVER_IS_CRYPTLIB
#define SERVER_PROVIDES_DN
#endif /* CAs where the server provides the DN */
/* Cert request data for the various types of certs that a CMP CA can return */
static const CERT_DATA cmpRsaSignRequestData[] = {
/* Identification information */
#ifdef SERVER_FIXED_DN
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "KR" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "INITECH" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "CryptLIB EE 1" ) },
#else
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Dave's Signature Key" ) },
#endif /* CAs that require a fixed DN in requests */
/* Subject altName */
#ifndef SERVER_NO_ALTNAMES
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "dave@wetas-r-us.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
#endif /* CAs that won't allow altNames in requests */
/* Signature-only key */
{ CRYPT_CERTINFO_KEYUSAGE, IS_NUMERIC, CRYPT_KEYUSAGE_DIGITALSIGNATURE },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA cmpRsaSignRequestNoDNData[] = {
/* Identification information - none, it's provided by the server */
/* Subject altName */
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "dave@wetas-r-us.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
/* Signature-only key */
{ CRYPT_CERTINFO_KEYUSAGE, IS_NUMERIC, CRYPT_KEYUSAGE_DIGITALSIGNATURE },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA cmpRsaEncryptRequestData[] = {
/* Identification information */
#ifdef SERVER_FIXED_DN
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "KR" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "INITECH" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "CryptLIB EE 1" ) },
#else
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Dave's Encryption Key" ) },
#endif /* CAs that require a fixed DN in requests */
/* Subject altName */
#ifndef SERVER_NO_ALTNAMES
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "dave@wetas-r-us.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
#endif /* CAs that won't allow altNames in requests */
/* Encryption-only key */
{ CRYPT_CERTINFO_KEYUSAGE, IS_NUMERIC, CRYPT_KEYUSAGE_KEYENCIPHERMENT },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA cmpRsaCaRequestData[] = {
/* Identification information */
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Dave's Intermediate CA Key" ) },
/* Subject altName */
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "dave-ca@wetas-r-us.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
/* CA key */
{ CRYPT_CERTINFO_CA, IS_NUMERIC, TRUE },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA cmpDsaRequestData[] = {
/* Identification information */
#ifdef SERVER_FIXED_DN
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "KR" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "INITECH" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "CryptLIB EE 1" ) },
#else
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
#ifdef SERVER_IR_DN
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Dave's Signature Key" ) },
#else
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Dave's DSA Key" ) },
#endif /* CA that requires same DN in cr as ir */
#endif /* CAs that require a fixed DN in requests */
/* Subject altName */
#ifndef SERVER_NO_ALTNAMES
{ CRYPT_CERTINFO_RFC822NAME, IS_STRING, 0, TEXT( "dave@wetas-r-us.com" ) },
{ CRYPT_CERTINFO_UNIFORMRESOURCEIDENTIFIER, IS_STRING, 0, TEXT( "http://www.wetas-r-us.com" ) },
#endif /* CAs that won't allow altNames in requests */
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
/* PKI user data to authorise the issuing of the various certs */
static const CERT_DATA cmpPkiUserData[] = {
/* Identification information */
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Test PKI user" ) },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
static const CERT_DATA cmpPkiUserCaData[] = {
/* Identification information */
{ CRYPT_CERTINFO_COUNTRYNAME, IS_STRING, 0, TEXT( "NZ" ) },
{ CRYPT_CERTINFO_ORGANIZATIONNAME, IS_STRING, 0, TEXT( "Dave's Wetaburgers" ) },
{ CRYPT_CERTINFO_ORGANIZATIONALUNITNAME, IS_STRING, 0, TEXT( "Procurement" ) },
{ CRYPT_CERTINFO_COMMONNAME, IS_STRING, 0, TEXT( "Test CA PKI user" ) },
/* CA extensions */
{ CRYPT_CERTINFO_KEYUSAGE, IS_NUMERIC,
CRYPT_KEYUSAGE_KEYCERTSIGN | CRYPT_KEYUSAGE_CRLSIGN },
{ CRYPT_CERTINFO_CA, IS_NUMERIC, TRUE },
{ CRYPT_ATTRIBUTE_NONE, IS_VOID }
};
/* Create various CMP objects */
static int createCmpRequest( const CERT_DATA *requestData,
const CRYPT_CONTEXT privateKey,
const CRYPT_ALGO_TYPE cryptAlgo,
const BOOLEAN useFixedKey,
const CRYPT_KEYSET cryptKeyset )
{
CRYPT_CERTIFICATE cryptRequest;
int status;
/* Create the CMP (CRMF) request */
if( privateKey != CRYPT_UNUSED )
{
time_t startTime;
int dummy;
/* If we're updating an existing cert we have to vary something in
the request to make sure that the result doesn't duplicate an
existing cert, to do this we fiddle the start time */
status = cryptGetAttributeString( privateKey, CRYPT_CERTINFO_VALIDFROM,
&startTime, &dummy );
if( cryptStatusError( status ) )
return( FALSE );
startTime++;
/* It's an update of existing information, sign the request with the
given private key */
status = cryptCreateCert( &cryptRequest, CRYPT_UNUSED,
CRYPT_CERTTYPE_REQUEST_CERT );
if( cryptStatusOK( status ) )
status = cryptSetAttribute( cryptRequest,
CRYPT_CERTINFO_CERTIFICATE, privateKey );
if( cryptStatusOK( status ) )
status = cryptSetAttributeString( cryptRequest,
CRYPT_CERTINFO_VALIDFROM, &startTime, sizeof( time_t ) );
if( cryptStatusOK( status ) )
status = cryptSignCert( cryptRequest, privateKey );
if( cryptKeyset != CRYPT_UNUSED )
{
if( cryptStatusError( \
cryptAddPrivateKey( cryptKeyset, privateKey,
TEST_PRIVKEY_PASSWORD ) ) )
return( FALSE );
}
}
else
{
CRYPT_CONTEXT cryptContext;
/* It's a new request, generate a private key and create a self-
signed request */
if( useFixedKey )
{
/* Use a fixed private key, for testing purposes */
if( cryptAlgo == CRYPT_ALGO_RSA )
loadRSAContextsEx( CRYPT_UNUSED, NULL, &cryptContext, NULL,
USER_PRIVKEY_LABEL );
else
loadDSAContextsEx( CRYPT_UNUSED, &cryptContext, NULL,
USER_PRIVKEY_LABEL, NULL );
status = CRYPT_OK;
}
else
{
cryptCreateContext( &cryptContext, CRYPT_UNUSED, cryptAlgo );
cryptSetAttributeString( cryptContext, CRYPT_CTXINFO_LABEL,
USER_PRIVKEY_LABEL,
paramStrlen( USER_PRIVKEY_LABEL ) );
cryptSetAttribute( cryptContext, CRYPT_CTXINFO_KEYSIZE, 64 );
status = cryptGenerateKey( cryptContext );
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -