#!/bin/sh

# Test case: Try to establish TLS connections with gnutls-cli and
# check the validity of the server certificate via OCSP
#
# Copyright (C) 2016 Thomas Klute
#
# This file is part of GnuTLS.
#
# GnuTLS is free software; you can redistribute it and/or modify it
# under the terms of the GNU General Public License as published by the
# Free Software Foundation; either version 3 of the License, or (at
# your option) any later version.
#
# GnuTLS is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
# General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with GnuTLS; if not, write to the Free Software Foundation,
# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

srcdir="${srcdir:-.}"
CERTTOOL="${CERTTOOL:-../src/certtool${EXEEXT}}"
OCSPTOOL="${OCSPTOOL:-../src/ocsptool${EXEEXT}}"
GNUTLS_SERV="${GNUTLS_SERV:-../src/gnutls-serv${EXEEXT}}"
GNUTLS_CLI="${GNUTLS_CLI:-../src/gnutls-cli${EXEEXT}}"
DIFF="${DIFF:-diff}"
SERVER_CERT_FILE="cert.$$.pem.tmp"
SERVER_KEY_FILE="key.$$.pem.tmp"
CLIENT_CERT_FILE="cli-cert.$$.pem.tmp"
CLIENT_KEY_FILE="cli-key.$$.pem.tmp"
CA_FILE="ca.$$.pem.tmp"

if ! test -x "${CERTTOOL}"; then
	exit 77
fi

if ! test -x "${OCSPTOOL}"; then
	exit 77
fi

if ! test -x "${GNUTLS_SERV}"; then
	exit 77
fi

if ! test -x "${GNUTLS_CLI}"; then
	exit 77
fi

if ! test -z "${VALGRIND}"; then
	VALGRIND="${LIBTOOL:-libtool} --mode=execute ${VALGRIND} --error-exitcode=15"
fi

export TZ="UTC"

. "${srcdir}/scripts/common.sh"

skip_if_no_datefudge

eval "${GETPORT}"
# Port for gnutls-serv
TLS_SERVER_PORT=$PORT

# Port to use for OCSP server, must match the OCSP URI set in the
# server_*.pem certificates
eval "${GETPORT}"

# Check for OpenSSL
OPENSSL=`which openssl`
if ! test -x "${OPENSSL}"; then
    echo "You need openssl to run this test."
    exit 77
fi

SERVER_PID=""
TLS_SERVER_PID=""
stop_servers ()
{
	test -z "${SERVER_PID}" || kill "${SERVER_PID}"
	rm -f "${SERVER_CERT_FILE}"
	rm -f "${SERVER_KEY_FILE}"
	rm -f "${CLIENT_CERT_FILE}"
	rm -f "${CLIENT_KEY_FILE}"
	rm -f "${CA_FILE}"
}
trap stop_servers 1 15 2 EXIT


cat >${CA_FILE} <<_EOF
-----BEGIN CERTIFICATE-----
[payload removed: 1000 characters in 16 lines]
-----END CERTIFICATE-----
_EOF

cat >${SERVER_KEY_FILE} <<_EOF
-----BEGIN RSA PRIVATE KEY-----
[payload removed: 1588 characters in 25 lines]
-----END RSA PRIVATE KEY-----
_EOF

cat >${SERVER_CERT_FILE} <<_EOF
-----BEGIN CERTIFICATE-----
[payload removed: 1444 characters in 23 lines]
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
[payload removed: 1000 characters in 16 lines]
-----END CERTIFICATE-----
_EOF

cat >${CLIENT_KEY_FILE} <<_EOF
-----BEGIN RSA PRIVATE KEY-----
[payload removed: 1592 characters in 25 lines]
-----END RSA PRIVATE KEY-----
_EOF

cat >${CLIENT_CERT_FILE} <<_EOF
-----BEGIN CERTIFICATE-----
[payload removed: 1080 characters in 17 lines]
-----END CERTIFICATE-----
_EOF

echo "=== Bringing TLS server up ==="

TESTDATE="2018-03-01"

# Start OpenSSL TLS server
#
launch_bare_server $$ \
	  datefudge "${TESTDATE}" \
	  "${OPENSSL}" s_server -cert ${SERVER_CERT_FILE} -key ${SERVER_KEY_FILE} \
	  -CAfile ${CA_FILE} -port ${PORT} -Verify 1 -verify_return_error -www
SERVER_PID="${!}"
wait_server "${SERVER_PID}"

datefudge -s "${TESTDATE}" \
      "${GNUTLS_CLI}" --x509certfile ${CLIENT_CERT_FILE} \
      --x509keyfile ${CLIENT_KEY_FILE} --x509cafile=${CA_FILE} \
      --port="${PORT}" localhost </dev/null
rc=$?

if test "${rc}" != "0"; then
    echo "Failed to connect to server"
    exit 1
fi

kill ${SERVER_PID}

rm -f "${SERVER_CERT_FILE}"
rm -f "${SERVER_KEY_FILE}"
rm -f "${CLIENT_CERT_FILE}"
rm -f "${CLIENT_KEY_FILE}"
rm -f "${CA_FILE}"

exit 0
