12ad951881f2bc7791ecf478cb00b8b88eadc318
[openssl.git] / test / recipes / 90-test_store.t
1 #! /usr/bin/env perl
2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
3 #
4 # Licensed under the OpenSSL license (the "License").  You may not use
5 # this file except in compliance with the License.  You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
8
9 use File::Spec;
10 use File::Copy;
11 use MIME::Base64;
12 use OpenSSL::Test qw(:DEFAULT srctop_file srctop_dir bldtop_file data_file);
13
14 my $test_name = "test_store";
15 setup($test_name);
16
17 my @noexist_files =
18     ( "test/blahdiblah.pem",
19       "test/blahdibleh.der" );
20 my @src_files =
21     ( "test/testx509.pem",
22       "test/testrsa.pem",
23       "test/testrsapub.pem",
24       "test/testcrl.pem",
25       "apps/server.pem" );
26 my @generated_files =
27     (
28      ### generated from the source files
29
30      "testx509.der",
31      "testrsa.der",
32      "testrsapub.der",
33      "testcrl.der",
34
35      ### generated locally
36
37      "rsa-key-pkcs1.pem", "rsa-key-pkcs1.der",
38      "rsa-key-pkcs1-aes128.pem",
39      "rsa-key-pkcs8.pem", "rsa-key-pkcs8.der",
40      "rsa-key-pkcs8-pbes1-sha1-3des.pem", "rsa-key-pkcs8-pbes1-sha1-3des.der",
41      "rsa-key-pkcs8-pbes2-sha1.pem", "rsa-key-pkcs8-pbes2-sha1.der",
42      "rsa-key-sha1-3des-sha1.p12", "rsa-key-sha1-3des-sha256.p12",
43      "rsa-key-aes256-cbc-sha256.p12",
44      "rsa-key-md5-des-sha1.p12",
45      "rsa-key-aes256-cbc-md5-des-sha256.p12",
46      "rsa-key-pkcs8-pbes2-sha256.pem", "rsa-key-pkcs8-pbes2-sha256.der",
47      "rsa-key-pkcs8-pbes1-md5-des.pem", "rsa-key-pkcs8-pbes1-md5-des.der",
48      "dsa-key-pkcs1.pem", "dsa-key-pkcs1.der",
49      "dsa-key-pkcs1-aes128.pem",
50      "dsa-key-pkcs8.pem", "dsa-key-pkcs8.der",
51      "dsa-key-pkcs8-pbes2-sha1.pem", "dsa-key-pkcs8-pbes2-sha1.der",
52      "dsa-key-aes256-cbc-sha256.p12",
53      "ec-key-pkcs1.pem", "ec-key-pkcs1.der",
54      "ec-key-pkcs1-aes128.pem",
55      "ec-key-pkcs8.pem", "ec-key-pkcs8.der",
56      "ec-key-pkcs8-pbes2-sha1.pem", "ec-key-pkcs8-pbes2-sha1.der",
57      "ec-key-aes256-cbc-sha256.p12",
58     );
59 my %generated_file_files =
60     $^O eq 'linux'
61     ? ( "test/testx509.pem" => "file:testx509.pem",
62         "test/testrsa.pem" => "file:testrsa.pem",
63         "test/testrsapub.pem" => "file:testrsapub.pem",
64         "test/testcrl.pem" => "file:testcrl.pem",
65         "apps/server.pem" => "file:server.pem" )
66     : ();
67 my @noexist_file_files =
68     ( "file:blahdiblah.pem",
69       "file:test/blahdibleh.der" );
70
71
72 my $n = (3 * scalar @noexist_files)
73     + (6 * scalar @src_files)
74     + (4 * scalar @generated_files)
75     + (scalar keys %generated_file_files)
76     + (scalar @noexist_file_files)
77     + 4;
78
79 plan tests => $n;
80
81 indir "store_$$" => sub {
82  SKIP:
83     {
84         skip "failed initialisation", $n unless init();
85
86         # test PEM_read_bio_PrivateKey
87         ok(run(app(["openssl", "rsa", "-in", "rsa-key-pkcs8-pbes2-sha256.pem",
88                     "-passin", "pass:password"])));
89
90         foreach (@noexist_files) {
91             my $file = srctop_file($_);
92             ok(!run(app(["openssl", "storeutl", $file])));
93             ok(!run(app(["openssl", "storeutl", to_abs_file($file)])));
94             ok(!run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
95         }
96         foreach (@src_files) {
97             my $file = srctop_file($_);
98             ok(run(app(["openssl", "storeutl", $file])));
99             ok(run(app(["openssl", "storeutl", to_abs_file($file)])));
100             ok(run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
101             ok(run(app(["openssl", "storeutl", to_abs_file_uri($file, 0,
102                                                                "")])));
103             ok(run(app(["openssl", "storeutl", to_abs_file_uri($file, 0,
104                                                                "localhost")])));
105             ok(!run(app(["openssl", "storeutl", to_abs_file_uri($file, 0,
106                                                                 "dummy")])));
107         }
108         foreach (@generated_files) {
109             ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
110                         $_])));
111             ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
112                         to_abs_file($_)])));
113             ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
114                         to_abs_file_uri($_)])));
115             ok(!run(app(["openssl", "storeutl", "-passin", "pass:password",
116                          to_file_uri($_)])));
117         }
118         foreach (values %generated_file_files) {
119             ok(run(app(["openssl", "storeutl", $_])));
120         }
121         foreach (@noexist_file_files) {
122             ok(!run(app(["openssl", "storeutl", $_])));
123         }
124         {
125             my $dir = srctop_dir("test", "certs");
126             ok(run(app(["openssl", "storeutl", $dir])));
127             ok(run(app(["openssl", "storeutl", to_abs_file($dir, 1)])));
128             ok(run(app(["openssl", "storeutl", to_abs_file_uri($dir, 1)])));
129         }
130     }
131 }, create => 1, cleanup => 1;
132
133 sub init {
134     return (
135             # rsa-key-pkcs1.pem
136             run(app(["openssl", "genrsa",
137                      "-out", "rsa-key-pkcs1.pem", "2432"]))
138             # dsa-key-pkcs1.pem
139             && run(app(["openssl", "dsaparam", "-genkey",
140                         "-out", "dsa-key-pkcs1.pem", "1024"]))
141             # ec-key-pkcs1.pem (one might think that 'genec' would be practical)
142             && run(app(["openssl", "ecparam", "-genkey", "-name", "prime256v1",
143                         "-out", "ec-key-pkcs1.pem"]))
144             # rsa-key-pkcs1-aes128.pem
145             && run(app(["openssl", "rsa", "-passout", "pass:password", "-aes128",
146                         "-in", "rsa-key-pkcs1.pem",
147                         "-out", "rsa-key-pkcs1-aes128.pem"]))
148             # dsa-key-pkcs1-aes128.pem
149             && run(app(["openssl", "dsa", "-passout", "pass:password", "-aes128",
150                         "-in", "dsa-key-pkcs1.pem",
151                         "-out", "dsa-key-pkcs1-aes128.pem"]))
152             # ec-key-pkcs1-aes128.pem
153             && run(app(["openssl", "ec", "-passout", "pass:password", "-aes128",
154                         "-in", "ec-key-pkcs1.pem",
155                         "-out", "ec-key-pkcs1-aes128.pem"]))
156             # *-key-pkcs8.pem
157             && runall(sub {
158                           my $dstfile = shift;
159                           (my $srcfile = $dstfile)
160                               =~ s/-key-pkcs8\.pem$/-key-pkcs1.pem/i;
161                           run(app(["openssl", "pkcs8", "-topk8", "-nocrypt",
162                                    "-in", $srcfile, "-out", $dstfile]));
163                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
164             # *-key-pkcs8-pbes1-sha1-3des.pem
165             && runall(sub {
166                           my $dstfile = shift;
167                           (my $srcfile = $dstfile)
168                               =~ s/-key-pkcs8-pbes1-sha1-3des\.pem$
169                                   /-key-pkcs8.pem/ix;
170                           run(app(["openssl", "pkcs8", "-topk8",
171                                    "-passout", "pass:password",
172                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
173                                    "-in", $srcfile, "-out", $dstfile]));
174                       }, grep(/-key-pkcs8-pbes1-sha1-3des\.pem$/, @generated_files))
175             # *-key-pkcs8-pbes1-md5-des.pem
176             && runall(sub {
177                           my $dstfile = shift;
178                           (my $srcfile = $dstfile)
179                               =~ s/-key-pkcs8-pbes1-md5-des\.pem$
180                                   /-key-pkcs8.pem/ix;
181                           run(app(["openssl", "pkcs8", "-topk8",
182                                    "-passout", "pass:password",
183                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
184                                    "-in", $srcfile, "-out", $dstfile]));
185                       }, grep(/-key-pkcs8-pbes1-md5-des\.pem$/, @generated_files))
186             # *-key-pkcs8-pbes2-sha1.pem
187             && runall(sub {
188                           my $dstfile = shift;
189                           (my $srcfile = $dstfile)
190                               =~ s/-key-pkcs8-pbes2-sha1\.pem$
191                                   /-key-pkcs8.pem/ix;
192                           run(app(["openssl", "pkcs8", "-topk8",
193                                    "-passout", "pass:password",
194                                    "-v2", "aes256", "-v2prf", "hmacWithSHA1",
195                                    "-in", $srcfile, "-out", $dstfile]));
196                       }, grep(/-key-pkcs8-pbes2-sha1\.pem$/, @generated_files))
197             # *-key-pkcs8-pbes2-sha1.pem
198             && runall(sub {
199                           my $dstfile = shift;
200                           (my $srcfile = $dstfile)
201                               =~ s/-key-pkcs8-pbes2-sha256\.pem$
202                                   /-key-pkcs8.pem/ix;
203                           run(app(["openssl", "pkcs8", "-topk8",
204                                    "-passout", "pass:password",
205                                    "-v2", "aes256", "-v2prf", "hmacWithSHA256",
206                                    "-in", $srcfile, "-out", $dstfile]));
207                       }, grep(/-key-pkcs8-pbes2-sha256\.pem$/, @generated_files))
208             # *-cert.pem (intermediary for the .p12 inits)
209             && run(app(["openssl", "req", "-x509",
210                         "-config", data_file("ca.cnf"), "-nodes",
211                         "-out", "cacert.pem", "-keyout", "cakey.pem"]))
212             && runall(sub {
213                           my $srckey = shift;
214                           (my $dstfile = $srckey) =~ s|-key-pkcs8\.|-cert.|;
215                           (my $csr = $dstfile) =~ s|\.pem|.csr|;
216
217                           (run(app(["openssl", "req", "-new",
218                                     "-config", data_file("user.cnf"),
219                                     "-key", $srckey, "-out", $csr]))
220                            &&
221                            run(app(["openssl", "x509", "-days", "3650",
222                                     "-CA", "cacert.pem",
223                                     "-CAkey", "cakey.pem",
224                                     "-set_serial", time(), "-req",
225                                     "-in", $csr, "-out", $dstfile])));
226                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
227             # *.p12
228             && runall(sub {
229                           my $dstfile = shift;
230                           my ($type, $certpbe_index, $keypbe_index,
231                               $macalg_index) =
232                               $dstfile =~ m{^(.*)-key-(?|
233                                                 # cert and key PBE are same
234                                                 ()             #
235                                                 ([^-]*-[^-]*)- # key & cert PBE
236                                                 ([^-]*)        # MACalg
237                                             |
238                                                 # cert and key PBE are not same
239                                                 ([^-]*-[^-]*)- # cert PBE
240                                                 ([^-]*-[^-]*)- # key PBE
241                                                 ([^-]*)        # MACalg
242                                             )\.}x;
243                           if (!$certpbe_index) {
244                               $certpbe_index = $keypbe_index;
245                           }
246                           my $srckey = "$type-key-pkcs8.pem";
247                           my $srccert = "$type-cert.pem";
248                           my %pbes =
249                               (
250                                "sha1-3des" => "pbeWithSHA1And3-KeyTripleDES-CBC",
251                                "md5-des" => "pbeWithMD5AndDES-CBC",
252                                "aes256-cbc" => "AES-256-CBC",
253                               );
254                           my %macalgs =
255                               (
256                                "sha1" => "SHA1",
257                                "sha256" => "SHA256",
258                               );
259                           my $certpbe = $pbes{$certpbe_index};
260                           my $keypbe = $pbes{$keypbe_index};
261                           my $macalg = $macalgs{$macalg_index};
262                           if (!defined($certpbe) || !defined($keypbe)
263                               || !defined($macalg)) {
264                               print STDERR "Cert PBE for $pbe_index not defined\n"
265                                   unless defined $certpbe;
266                               print STDERR "Key PBE for $pbe_index not defined\n"
267                                   unless defined $keypbe;
268                               print STDERR "MACALG for $macalg_index not defined\n"
269                                   unless defined $macalg;
270                               print STDERR "(destination file was $dstfile)\n";
271                               return 0;
272                           }
273                           run(app(["openssl", "pkcs12", "-inkey", $srckey,
274                                    "-in", $srccert, "-passout", "pass:password",
275                                    "-export", "-macalg", $macalg,
276                                    "-certpbe", $certpbe, "-keypbe", $keypbe,
277                                    "-out", $dstfile]));
278                       }, grep(/\.p12/, @generated_files))
279             # *.der (the end all init)
280             && runall(sub {
281                           my $dstfile = shift;
282                           (my $srcfile = $dstfile) =~ s/\.der$/.pem/i;
283                           if (! -f $srcfile) {
284                               $srcfile = srctop_file("test", $srcfile);
285                           }
286                           my $infh;
287                           unless (open $infh, $srcfile) {
288                               return 0;
289                           }
290                           my $l;
291                           while (($l = <$infh>) !~ /^-----BEGIN\s/
292                                  || $l =~ /^-----BEGIN.*PARAMETERS-----/) {
293                           }
294                           my $b64 = "";
295                           while (($l = <$infh>) !~ /^-----END\s/) {
296                               $l =~ s|\R$||;
297                               $b64 .= $l unless $l =~ /:/;
298                           }
299                           close $infh;
300                           my $der = decode_base64($b64);
301                           unless (length($b64) / 4 * 3 - length($der) < 3) {
302                               print STDERR "Length error, ",length($b64),
303                                   " bytes of base64 became ",length($der),
304                                   " bytes of der? ($srcfile => $dstfile)\n";
305                               return 0;
306                           }
307                           my $outfh;
308                           unless (open $outfh, ">:raw", $dstfile) {
309                               return 0;
310                           }
311                           print $outfh $der;
312                           close $outfh;
313                           return 1;
314                       }, grep(/\.der$/, @generated_files))
315             && runall(sub {
316                           my $srcfile = shift;
317                           my $dstfile = $generated_file_files{$srcfile};
318
319                           unless (copy srctop_file($srcfile), $dstfile) {
320                               warn "$!\n";
321                               return 0;
322                           }
323                           return 1;
324                       }, keys %generated_file_files)
325            );
326 }
327
328 sub runall {
329     my ($function, @items) = @_;
330
331     foreach (@items) {
332         return 0 unless $function->($_);
333     }
334     return 1;
335 }
336
337 # According to RFC8089, a relative file: path is invalid.  We still produce
338 # them for testing purposes.
339 sub to_file_uri {
340     my ($file, $isdir, $authority) = @_;
341     my $vol;
342     my $dir;
343
344     die "to_file_uri: No file given\n" if !defined($file) || $file eq '';
345
346     ($vol, $dir, $file) = File::Spec->splitpath($file, $isdir // 0);
347
348     # Make sure we have a Unix style directory.
349     $dir = join('/', File::Spec->splitdir($dir));
350     # Canonicalise it (note: it seems to be only needed on Unix)
351     while (1) {
352         my $newdir = $dir;
353         $newdir =~ s|/[^/]*[^/\.]+[^/]*/\.\./|/|g;
354         last if $newdir eq $dir;
355         $dir = $newdir;
356     }
357     # Take care of the corner cases the loop can't handle, and that $dir
358     # ends with a / unless it's empty
359     $dir =~ s|/[^/]*[^/\.]+[^/]*/\.\.$|/|;
360     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\./|/|;
361     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\.$||;
362     if ($isdir // 0) {
363         $dir =~ s|/$|| if $dir ne '/';
364     } else {
365         $dir .= '/' if $dir ne '' && $dir !~ m|/$|;
366     }
367
368     # If the file system has separate volumes (at present, Windows and VMS)
369     # we need to handle them.  In URIs, they are invariably the first
370     # component of the path, which is always absolute.
371     # On VMS, user:[foo.bar] translates to /user/foo/bar
372     # On Windows, c:\Users\Foo translates to /c:/Users/Foo
373     if ($vol ne '') {
374         $vol =~ s|:||g if ($^O eq "VMS");
375         $dir = '/' . $dir if $dir ne '' && $dir !~ m|^/|;
376         $dir = '/' . $vol . $dir;
377     }
378     $file = $dir . $file;
379
380     return "file://$authority$file" if defined $authority;
381     return "file:$file";
382 }
383
384 sub to_abs_file {
385     my ($file) = @_;
386
387     return File::Spec->rel2abs($file);
388 }
389
390 sub to_abs_file_uri {
391     my ($file, $isdir, $authority) = @_;
392
393     die "to_abs_file_uri: No file given\n" if !defined($file) || $file eq '';
394     return to_file_uri(to_abs_file($file), $isdir, $authority);
395 }