From 8ae9f1395539ba4d261617343214d9478b12d30a Mon Sep 17 00:00:00 2001
From: Joni Hahkala <joni.hahkala@cern.ch>
Date: Fri, 25 Jun 2010 22:18:42 +0000
Subject: [PATCH] add bad ca, remove old files

---
 test/bad-ca/bad.cert           |  19 +++++++
 test/bad-ca/bad.namespaces     |   3 ++
 test/bad-ca/bad.p12            | Bin 0 -> 1789 bytes
 test/bad-ca/bad.priv           |  15 ++++++
 test/bad-ca/bad.signing_policy |   4 ++
 test/bad-ca/index.txt          |   0
 test/bad-ca/req_conf.cnf       | 112 +++++++++++++++++++++++++++++++++++++++++
 test/bad-ca/serial.txt         |   1 +
 test/root-ca/index.txt.attr    |   1 -
 test/subca-ca/index.txt.attr   |   1 -
 10 files changed, 154 insertions(+), 2 deletions(-)
 create mode 100644 test/bad-ca/bad.cert
 create mode 100644 test/bad-ca/bad.namespaces
 create mode 100644 test/bad-ca/bad.p12
 create mode 100644 test/bad-ca/bad.priv
 create mode 100644 test/bad-ca/bad.signing_policy
 create mode 100644 test/bad-ca/index.txt
 create mode 100644 test/bad-ca/req_conf.cnf
 create mode 100644 test/bad-ca/serial.txt
 delete mode 100644 test/root-ca/index.txt.attr
 delete mode 100644 test/subca-ca/index.txt.attr

diff --git a/test/bad-ca/bad.cert b/test/bad-ca/bad.cert
new file mode 100644
index 0000000..6287061
--- /dev/null
+++ b/test/bad-ca/bad.cert
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIC/zCCAmigAwIBAgIJAJ4hwgDLvpEpMA0GCSqGSIb3DQEBBQUAMFkxCzAJBgNV
+BAYTAlVHMQ8wDQYDVQQHEwZUcm9waWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UE
+CxMKUmVsYXhhdGlvbjETMBEGA1UEAxMKdGhlIGJhZCBDQTAeFw0xMDA2MjUyMjEy
+MTFaFw0zNzExMTAyMjEyMTFaMFkxCzAJBgNVBAYTAlVHMQ8wDQYDVQQHEwZUcm9w
+aWMxDzANBgNVBAoTBlV0b3BpYTETMBEGA1UECxMKUmVsYXhhdGlvbjETMBEGA1UE
+AxMKdGhlIGJhZCBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyr9blLti
+ikrL64vCRn394ISlaEMVpUYTQaWEo0rBQk4McvGTNJdpaFw1y/8k8gpQn0knpMnu
+vnPI461QNjaL6LYnUZiKPbnrIjVgxBpIVWRIeq5BCycJ6CM8bcwbkMk8Lmh7d0ED
+JaBrf086F7HeLupx4s5xekawZCdYcbADrJ8CAwEAAaOBzjCByzAMBgNVHRMEBTAD
+AQH/MB0GA1UdDgQWBBQboo1tr9iap/o8oR7I2D7+ZSPoFDCBiwYDVR0jBIGDMIGA
+gBQboo1tr9iap/o8oR7I2D7+ZSPoFKFdpFswWTELMAkGA1UEBhMCVUcxDzANBgNV
+BAcTBlRyb3BpYzEPMA0GA1UEChMGVXRvcGlhMRMwEQYDVQQLEwpSZWxheGF0aW9u
+MRMwEQYDVQQDEwp0aGUgYmFkIENBggkAniHCAMu+kSkwDgYDVR0PAQH/BAQDAgEG
+MA0GCSqGSIb3DQEBBQUAA4GBAL+xTR559iYKmUaO5mvOmQ2Z2kZ2ujRk9YRtKucx
+OQsCQVj8rMIMMeKmlNRkgF7cOX5yomu9IKkXt9dOKjtKh4wgSEAwBjVAkcY6QTRU
+B56sL7jutBPhneeWapUcYDJ+yEeJFwKqpDJgX+zJPlYPK22ZZDPAQNj3+8qWjtB8
+AYBq
+-----END CERTIFICATE-----
diff --git a/test/bad-ca/bad.namespaces b/test/bad-ca/bad.namespaces
new file mode 100644
index 0000000..9da4f08
--- /dev/null
+++ b/test/bad-ca/bad.namespaces
@@ -0,0 +1,3 @@
+# Namespace for the /C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the bad CA"
+TO Issuer "/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the bad CA"   PERMIT Subject "/C=UG/L=Tropic/O=Utopia/OU=Relaxation/*"
+ 
diff --git a/test/bad-ca/bad.p12 b/test/bad-ca/bad.p12
new file mode 100644
index 0000000000000000000000000000000000000000..8a2679201bb816b6ba8f30193383510073e9ef73
GIT binary patch
literal 1789
zcmY+Dc{CJ?9>-@h%`_3Nt!X$I<XSRA#u7cEMzY+>WXf1BV;JLFFIgf+*_EvlV;{0d
zvNg6`q3p^M$ufp!7@8~3mGE@Vd+)yY$M5{k`Fzjs_t*D>p+k2-Krn_5?SR77Vl85~
zg@H$a1$1aFgbuAb#AO&d`03vfw15uIIz*WuAmDJN{G9+XDCp6De>et&VniS?O8jet
z2_rQa1cCvg=wKK0mSSr&t9@*<HrUZsZ|2IXI9RG=5Us0}hGXSOQrf`G%ApZpo35Hl
z&Ornmu&@@?MTD)ezqsd9AsdmxtqiBO)Ct4ihcV-Ry#pysdt_I!*y*&T&*!<M_R3f8
zN-ruk9frI<UDP)y)ceqxXDvvd{4RgjBoVlYBk~*t%tl{p8_Ut?%NJZPccxiv_*uWK
zkN8$Y8!WBm|D>hhf~~H%6A3}e;dQayMn!!blLstKW1-N2_t{<@`!^}WGLr+_Z_gFd
zQi;d*UZB;i@ikYkVIy}0@kn$+p<-PIxN0%fzeXWNV`qaprx{*yBTUEmUA?Q=rbX5k
zYHr^7uRGx;stueDh6Lf8;w|#)aIK9&HJTNg_r`3DXf**S&o&$4YdPBAD^zkW<wDK~
z+Z_pw>|Qz$-=AWak*2Irx$ijdeS;&q6-^XskhEo&;jL)BKt4R{c?j++pkNvv%gN5P
zt-UHJagh1v3E`w^$O-*t5bCV^TcGZ)gxf^60o!c1(*GxfHk5h36}VVhtYy-ie~V&>
z2oqTa$mk(r>@PawI%ONCa{W*+uk}9VeDv<vJaxD_u~n44(aQJ@dhU@y{CHLlZNSq!
zAmJWyo?Y2r?H{@4y>EXb71r}y|Hhu%q?LC;DZ~Dt?pKO-`fQ2qreq4&>EXyKDqid!
zwrEOahWg17(qd8S%I6VIyS^gC@cv@d3x~J%BXX-oQ?-x8Jn^wzQ3#Wztnizpx)7t~
z@M1nNu9g@exA&Q!xuJhQnWydict!hBg84~8!0=S8^LpJ((~tws?4U2{-J~F8`%%Y~
zF9+tJ&fE<kh-uEPT2}p1`%<N?dNV4C5_PPHlOI;x6CqjTo?lY2wS<ju+F_r#R=UC|
zq$PjEhg=wbE#2tj-e%ksEElD8!^Xh3WyAB_2W6e(%$U6jt!Rn-O`K0xWllVM!<~rI
zr0?$*ai25TPvkNuPM%SWKHvhTHJmnzsqLL6qzD9`<8g;`>d6C4#ig)SQI8{$){SRx
zr!#WTbk=Vc26Sxxo^jr8d9(<>5@h8#rqg$&kj5BuRRK60AlS}<z#_g1^9d?s*B&3l
zlwZ3hj(hC<8QF2}(<wnIuIZgmx$NzD6(4o_h#R<<=p45rgrS3W{zu3HI*13MgO(5R
z;^BOPBL1W2Q6T6rEIoup|7R`uhqX(;HQ@Pq&&+>Vdw3pYmL)TUH!Co;*OPK?sd25I
zn~gJ*Clrv(UnWg|;hFfw%xquh0knj^A7pr~K$Ytrs8W-@iSD3JZtbPW2?okd7_E=O
zI5yAp!i06IwifI{0q%~KuVrVgSyH}_D@(}h#HZ~YUkxqs%t+IKkd}qC7tM9-g+<hT
zR{o2&FHdbv$#Ey7tE89AJ!6eXMGw=$kvAKQryn>u1kuxYq|~{4nFnt#kj-^Vq`TiV
zJx26+D-gyi%ha0zv;R=_7-!j3`=1S#o9iO@+Xa%)36wXk>|_x&PzcKtSHLtjy|e}!
zy|rTn9eE$uq|BX92i%t=Q#*^yuGnzO5v!-7H@fP%LEF_N%u)dIduNah7AeWD?hLs`
z<tMcC82J&t(nCMqR`}Dj{H%uK8!wu#%r+=9E<qM^cmKM8;xVJzD87&f{q=hKWtX15
zGFIL4vtQP8ueR5D4UXuucNY|ct1^7y%faGnsm*r1*R=rY+%9W3#r}#vtxLT7)mRlS
z66>hDxrCv~_GYUsl0)n&XfF}l9%!hVLLQC!BGAFy{8^{1L6m2S4qb3%uf@K!I7%yU
za=bh}Jfw_n+9NHa-b)N#xSvo;Pv|hu)e5tm*A2`Cig{S{r%yhN;sU<)!@kjJ0rE5B
zqTs@o_~#iRN`6}1WQ8FAkMemR5@+`B_~@K*k}m10g`*~xd%sFaYTMMs;RNb=@)|m<
ztfq!!cUvaDjE}$RHf}VYZ8<}}v`>!1M#Bj4p5&Z6<;&cj_NnctrU0ax4LB&JnZNiD
zN_jQj>z2N)a@uFgcy`a%{NiUKjpvRnbZK=fAJ(V-u@;ncyzIE4DVmgw<Z6^-l`-i5
zwi+&pm4Zmr6_3m%!Xpg{)r{beN-XdFxjAJF7NdZHLxt2uz#ya$03xyP<Yw?)?i87Z
b=1R!JFh=YH1tJ6{U0en;rU~c#X!pMWzyDQm

literal 0
HcmV?d00001

diff --git a/test/bad-ca/bad.priv b/test/bad-ca/bad.priv
new file mode 100644
index 0000000..67f0ca2
--- /dev/null
+++ b/test/bad-ca/bad.priv
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXgIBAAKBgQDKv1uUu2KKSsvri8JGff3ghKVoQxWlRhNBpYSjSsFCTgxy8ZM0
+l2loXDXL/yTyClCfSSekye6+c8jjrVA2NovotidRmIo9uesiNWDEGkhVZEh6rkEL
+JwnoIzxtzBuQyTwuaHt3QQMloGt/TzoXsd4u6nHiznF6RrBkJ1hxsAOsnwIDAQAB
+AoGBAJb0+582FhyZrFNo7/HEhW7R1MZYjJlOH7BVKPjcBCD2M9axf8U8p0MIxRVq
+l3uPqo+uzFGp+JTdaMn8lSiIXIpIAjWgjrrB0CfAliNYfI/R/X5E69FuU7hoKdlr
+tApVHbkpkskmydrNAuoXSaEOW1XYCo5COSAp/+Zon8PWldthAkEA973pHV9FXJBM
+p7jRTzZacKEaGHzIX8y+26LXA3ptMSZ59YOoT2yWzX8KTCsQqGlzLvl+eW0CdWQ1
+eaV9k0ojgwJBANGBfZ6sU8t91FpxIpWEI4uEik/qoXPrzsqkOGIxQW3crQDEINH3
+6+ZY2dsapsxdm0ATEA0Kf9FMGKQjqc/TW7UCQQCVe8nFJ0864vbd3O6u1SUNAKg2
+TlS5OVmQPVlvh9eK6KR+N8q+4c68gAM+ol2SwM33ciOWMOhi3OxHUkvLK9jxAkEA
+0M1zCsKLnUMicqVRJ50T5AhL5Uxeb280oYg8XbjjkgAfOKVAZKPoK6KgNhwA46vj
+gF+/Xo/5RfrGkEivBN+NBQJAIWDK8Hg6DErzemxIeqYa7JKxk+DwN0liPeb577Al
+5fRGvlhbKUpR/ot42OC7GqCgXfbLsMf28EzW0aJyRFZVoQ==
+-----END RSA PRIVATE KEY-----
diff --git a/test/bad-ca/bad.signing_policy b/test/bad-ca/bad.signing_policy
new file mode 100644
index 0000000..f01254c
--- /dev/null
+++ b/test/bad-ca/bad.signing_policy
@@ -0,0 +1,4 @@
+# Signing policy file for the /C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the bad CA"
+access_id_CA            X509    '/C=UG/L=Tropic/O=Utopia/OU=Relaxation/CN=the bad CA'
+pos_rights              globus  CA:sign
+cond_subjects           globus  '"/C=UG/L=Tropic/O=Utopia/OU=Relaxation/*"'
diff --git a/test/bad-ca/index.txt b/test/bad-ca/index.txt
new file mode 100644
index 0000000..e69de29
diff --git a/test/bad-ca/req_conf.cnf b/test/bad-ca/req_conf.cnf
new file mode 100644
index 0000000..4d796dd
--- /dev/null
+++ b/test/bad-ca/req_conf.cnf
@@ -0,0 +1,112 @@
+### req command
+
+oid_section		= new_oids
+
+[ new_oids ]
+limitedProxyOid		= 1.3.6.1.4.1.3536.1.1.1.9
+
+[ req ]
+default_bits		= 1024
+distinguished_name	= req_distinguished_name
+
+[ req_distinguished_name ]
+
+[ ca_cert_req ]
+basicConstraints	= CA:true
+subjectKeyIdentifier	= hash
+authorityKeyIdentifier	= keyid:always,issuer:always
+keyUsage		= critical, cRLSign, keyCertSign
+
+[ ca_cert_req_nokeyusage ]
+basicConstraints	= CA:true
+subjectKeyIdentifier	= hash
+authorityKeyIdentifier	= keyid:always,issuer:always
+keyUsage		= critical, cRLSign
+
+[ proxy_cert_req ]
+
+[ proxy_proxy_cert_req ]
+
+#### ca command
+
+[ca]
+default_ca 		= CA_default
+
+[CA_default]
+dir 			= $ENV::CASROOT/bad-ca
+database 		= $dir/index.txt
+serial 			= $dir/serial.txt
+default_md 		= sha1
+
+certificate 		= $dir/bad.cert
+private_key 		= $dir/bad.priv
+
+policy = policy_any
+
+[policy_any]
+countryName		= supplied
+stateOrProvinceName	= optional
+localityName		= optional
+organizationName	= optional
+organizationalUnitName	= optional
+commonName		= supplied
+emailAddress		= optional
+userId			= optional
+serialNumber		= optional
+
+[ ca_cert ]
+basicConstraints	= CA:TRUE
+
+
+[ ca_server ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+# For an object signing certificate this would be used.
+# nsCertType 		= objsign
+
+[ ca_altname ]
+# This is OK for an SSL server.
+nsCertType		= server
+nsComment		= "OpenSSL Generated Server Certificate"
+subjectAltName 		= DNS:*.hoo.org,DNS:joo.haa.org,IP:123.124.220.1,DNS:g*a.e*.com
+
+[ ca_client ]
+# For normal client use this is typical
+nsCertType 		= client, email
+nsComment		= "OpenSSL Generated Client Certificate"
+
+[ ca_clientserver ]
+# For normal client use this is typical
+nsCertType 		= server, client, email
+nsComment		= "OpenSSL Generated Client Server Certificate"
+
+[ ca_fclient ]
+# This is typical in keyUsage for a client certificate.
+basicConstraints	= CA:false
+keyUsage 		= critical, nonRepudiation, digitalSignature, keyEncipherment
+nsComment		= "OpenSSL Generated Client Certificate with key usage"
+
+[ ca_none ]
+nsComment		= "OpenSSL Generated Client Certificate without Flags"
+
+[ proxy_none ]
+keyUsage		= critical,digitalSignature,keyEncipherment
+
+[ proxy_invalid_usage ]
+keyUsage		= critical,keyEncipherment
+
+[ proxy_rfc_pathLen1 ]
+proxyCertInfo=critical,language:id-ppl-inheritAll,pathlen:1
+
+[ proxy_rfc ]
+proxyCertInfo=critical,language:id-ppl-inheritAll
+
+[ proxy_rfc_anypolicy ]
+proxyCertInfo=critical,language:id-ppl-anyLanguage,policy:text:AB
+
+[ proxy_rfc_independent ]
+proxyCertInfo=critical,language:id-ppl-independent,pathlen:1
+
+[ proxy_rfc_limited ]
+proxyCertInfo=critical,language:limitedProxyOid
diff --git a/test/bad-ca/serial.txt b/test/bad-ca/serial.txt
new file mode 100644
index 0000000..3dcc795
--- /dev/null
+++ b/test/bad-ca/serial.txt
@@ -0,0 +1 @@
+0176
diff --git a/test/root-ca/index.txt.attr b/test/root-ca/index.txt.attr
deleted file mode 100644
index 8f7e63a..0000000
--- a/test/root-ca/index.txt.attr
+++ /dev/null
@@ -1 +0,0 @@
-unique_subject = yes
diff --git a/test/subca-ca/index.txt.attr b/test/subca-ca/index.txt.attr
deleted file mode 100644
index 8f7e63a..0000000
--- a/test/subca-ca/index.txt.attr
+++ /dev/null
@@ -1 +0,0 @@
-unique_subject = yes
-- 
1.8.2.3