Hi, On Wed, Nov 25, 2015 at 12:40:40PM +0100, Guido Günther wrote: > Source: nss > Severity: wishlist > Tags: patch > > Hi, > while dealing with nss issues I ended up testing the same things so > here's a small autopkgtest that handles at least some prominent > cases. Would be great to have this in sid so it comes to other > versions as well.
Attached is an updated patch that moves in the fips test from debian/rules and is a bit more strict on the build-deps. Cheers, -- Guido
>From 64705b30a2003d73f33231ce5bdef85ae78cb724 Mon Sep 17 00:00:00 2001 Message-Id: <64705b30a2003d73f33231ce5bdef85ae78cb724.1448722395.git....@sigxcpu.org> From: =?UTF-8?q?Guido=20G=C3=BCnther?= <[email protected]> Date: Wed, 25 Nov 2015 11:59:02 +0100 Subject: [PATCH] Add minimal autopkgtest This test does two things: test-cert.sh - make sure we can create, sign and import certificates test-fips.sh - make sure we can enable fips mode test-link.make - make sure we can link against libnss --- debian/tests/control | 5 +++++ debian/tests/test-cert.sh | 42 ++++++++++++++++++++++++++++++++++++++++++ debian/tests/test-fips.sh | 22 ++++++++++++++++++++++ debian/tests/test-link.cpp | 25 +++++++++++++++++++++++++ debian/tests/test-link.make | 10 ++++++++++ 5 files changed, 104 insertions(+) create mode 100644 debian/tests/control create mode 100755 debian/tests/test-cert.sh create mode 100755 debian/tests/test-fips.sh create mode 100644 debian/tests/test-link.cpp create mode 100755 debian/tests/test-link.make diff --git a/debian/tests/control b/debian/tests/control new file mode 100644 index 0000000..d5d9065 --- /dev/null +++ b/debian/tests/control @@ -0,0 +1,5 @@ +Tests: test-cert.sh test-fips.sh +Depends: libnss3-tools + +Tests: test-link.make +Depends: libnss3-dev, pkg-config, g++ diff --git a/debian/tests/test-cert.sh b/debian/tests/test-cert.sh new file mode 100755 index 0000000..43b3518 --- /dev/null +++ b/debian/tests/test-cert.sh @@ -0,0 +1,42 @@ +#!/bin/bash +# +# Check some basic CA operations + +set -e + +cleanup() { + [ -z "$DIR" ] || rm -rf "$DIR" +} + + +run_certutil() { + CMD="certutil -z $DIR/random -f $DIR/passwd -d sql:$DIR $@" + echo "Running: $CMD" + $CMD +} + +DIR=`mktemp -p . -d` +trap cleanup EXIT ERR + +dd bs=20 count=1 if=/dev/urandom of=$DIR/random 2>/dev/null +echo "password" > $DIR/passwd + +# Create the database +run_certutil -N +# Create a self signed certificate +run_certutil -S -k rsa -n test-ca -s CN=testca -t c -x 2>/dev/null +# Create a certificate request +run_certutil -R -k rsa -g 2048 -n test-cert -s "CN=testcert" -o $DIR/cert.req -a 2>/dev/null +# Sign with ca +run_certutil -C -m 10000 -c test-ca -i $DIR/cert.req -o $DIR/cert.cer -a +run_certutil -A -n test-cert -i $DIR/cert.cer -t c -a + +echo -n "Checking if ca is present..." +run_certutil -L -n test-ca >/dev/null +echo "OK." + +echo -n "Checking if cert present..." +run_certutil -L -n test-cert >/dev/null +echo "OK." + +exit 0 diff --git a/debian/tests/test-fips.sh b/debian/tests/test-fips.sh new file mode 100755 index 0000000..6707724 --- /dev/null +++ b/debian/tests/test-fips.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# +# Enable fips mode + +set -e + +cleanup() { + [ -z "$DIR" ] || rm -rf "$DIR" +} + + +run_certutil() { + CMD="certutil -z $DIR/random -f $DIR/passwd -d sql:$DIR $@" + echo "Running: $CMD" + $CMD +} + +DIR=`mktemp -p . -d` +trap cleanup EXIT ERR + +modutil -create -dbdir $DIR < /dev/null +modutil -fips true -dbdir $DIR < /dev/null diff --git a/debian/tests/test-link.cpp b/debian/tests/test-link.cpp new file mode 100644 index 0000000..0880b4e --- /dev/null +++ b/debian/tests/test-link.cpp @@ -0,0 +1,25 @@ +#include <stdio.h> +#include <stdlib.h> +#include <errno.h> + +#include <nss.h> + +int main() +{ + int ret = 0; + SECStatus s; + char *t = strdup("/tmp/nss.XXXXXX"); + char *tmpdir = mkdtemp(t); + + if (tmpdir == NULL) + fprintf(stderr, "Failed to create temp directory: %s", strerror(errno)); + + s = NSS_InitReadWrite(tmpdir); + if (s != SECSuccess) + ret = 2; + + NSS_Shutdown(); + free(t); + + return ret; +} diff --git a/debian/tests/test-link.make b/debian/tests/test-link.make new file mode 100755 index 0000000..19e4e7c --- /dev/null +++ b/debian/tests/test-link.make @@ -0,0 +1,10 @@ +#!/usr/bin/make -f + +all: a.out + ./a.out + rm -f a.out + +a.out: debian/tests/test-link.cpp + g++ -Wall -Werror $< $(shell pkg-config --cflags nss) $(shell pkg-config --libs nss) + +.PHONY: all -- 2.6.2
