| #!/bin/sh |
| |
| . STlsVars |
| |
| # this is usually something like "localhost:", so we need to strip the : |
| OURHOST=`echo $SNMP_TEST_DEST | sed 's/:.*//'` |
| |
| # create a CA |
| |
| CAPTURE $NSCERT genca --cn ca-net-snmp.org $NSCERTARGS |
| CAFP=`$NSCERT showcas --fingerprint --brief ca-net-snmp.org $NSCERTARGS` |
| CHECKVALUEISNT "$CAFP" "" "generated fingerprint for ca-net-snmp.org certificate" |
| |
| # create a server certificate using the CA certificate |
| CAPTURE $NSCERT gencert -t snmpd --with-ca ca-net-snmp.org $checknametype ${checknameprefix}$OURHOST $NSCERTARGS |
| SNMPDFP=`$NSCERT showcert --fingerprint --brief snmpd $NSCERTARGS` |
| |
| CONFIGAGENT '[snmp]' serverCert $SNMPDFP |
| |
| # create a user certificate |
| CAPTURE $NSCERT gencert -t snmpapp --cn 'testuser' $NSCERTARGS |
| TESTUSERFP=`$NSCERT showcerts --fingerprint --brief snmpapp $NSCERTARGS` |
| CHECKVALUEISNT "$TESTUSERFP" "" "generated fingerprint for testuser certificate" |
| |
| CONFIGAGENT certSecName 10 $TESTUSERFP --cn |
| CONFIGAGENT rwuser -s tsm testuser authpriv |
| |
| CONFIGAPP clientCert $TESTUSERFP |
| |
| # start the agent up |
| FLAGS="-On $SNMP_FLAGS $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT" |
| |
| # start up the agent |
| STARTAGENT |
| |
| ######################################## |
| # Positive tests |
| # (should work) |
| |
| # ensure we can access it via a direct FP check |
| DOSETTEST fingerprintIdentity "-T their_identity=$SNMPDFP $FLAGS" |
| |
| # directly specify the host name |
| DOSETTEST hostnameIdentity "-T trust_cert=$CAFP -T their_hostname=$OURHOST $FLAGS" |
| |
| # This should also work because we: |
| # - trust the CA cert |
| # - use a session destname that matches the certificate |
| DOSETTEST sessionnameIdentity "-T trust_cert=$CAFP $FLAGS" |
| |
| ######################################## |
| # DONE |
| |
| #sleep 500 |
| STOPAGENT |
| |
| FINISHED |
