test/recipes/90-test_store.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the OpenSSL license (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9 use File::Spec;
  10 use MIME::Base64;
  11 use OpenSSL::Test qw(:DEFAULT srctop_file bldtop_file);
  12
  13 my $test_name = "test_store";
  14 setup($test_name);
  15
  16 my @noexist_files =
  17     ( "test/blahdiblah.pem",
  18       "test/blahdibleh.der" );
  19 my @src_files =
  20     ( "test/testx509.pem",
  21       "test/testrsa.pem",
  22       "test/testrsapub.pem",
  23       "test/testcrl.pem",
  24       "apps/server.pem" );
  25 my @generated_files =
  26     (
  27      ### generated from the source files
  28
  29      "testx509.der",
  30      "testrsa.der",
  31      "testrsapub.der",
  32      "testcrl.der",
  33
  34      ### generated locally
  35      ### These examples were pilfered from OpenConnect's test suite
  36
  37      "rsa-key-pkcs1.pem", "rsa-key-pkcs1.der",
  38      "rsa-key-pkcs1-aes128.pem",
  39      "rsa-key-pkcs8.pem", "rsa-key-pkcs8.der",
  40      "rsa-key-pkcs8-pbes1-sha1-3des.pem", "rsa-key-pkcs8-pbes1-sha1-3des.der",
  41      "rsa-key-pkcs8-pbes2-sha1.pem", "rsa-key-pkcs8-pbes2-sha1.der",
  42      "rsa-key-sha1-3des-sha1.p12", "rsa-key-sha1-3des-sha256.p12",
  43      "rsa-key-aes256-cbc-sha256.p12",
  44      "rsa-key-md5-des-sha1.p12",
  45      "rsa-key-aes256-cbc-md5-des-sha256.p12",
  46      "rsa-key-pkcs8-pbes2-sha256.pem", "rsa-key-pkcs8-pbes2-sha256.der",
  47      "rsa-key-pkcs8-pbes1-md5-des.pem", "rsa-key-pkcs8-pbes1-md5-des.der",
  48      "dsa-key-pkcs1.pem", "dsa-key-pkcs1.der",
  49      "dsa-key-pkcs1-aes128.pem",
  50      "dsa-key-pkcs8.pem", "dsa-key-pkcs8.der",
  51      "dsa-key-pkcs8-pbes2-sha1.pem", "dsa-key-pkcs8-pbes2-sha1.der",
  52      "dsa-key-aes256-cbc-sha256.p12",
  53      "ec-key-pkcs1.pem", "ec-key-pkcs1.der",
  54      "ec-key-pkcs1-aes128.pem",
  55      "ec-key-pkcs8.pem", "ec-key-pkcs8.der",
  56      "ec-key-pkcs8-pbes2-sha1.pem", "ec-key-pkcs8-pbes2-sha1.der",
  57      "ec-key-aes256-cbc-sha256.p12",
  58     );
  59
  60 my $n = (2 * scalar @noexist_files)
  61     + (5 * scalar @src_files)
  62     + (3 * scalar @generated_files);
  63
  64 plan tests => $n;
  65
  66 indir "store_$$" => sub {
  67  SKIP:
  68     {
  69         skip "failed initialisation", $n unless init();
  70
  71         foreach (@noexist_files) {
  72             my $file = srctop_file($_);
  73             ok(!run(app(["openssl", "storeutl", $file])));
  74             ok(!run(app(["openssl", "storeutl", to_file_uri($file)])));
  75         }
  76         foreach (@src_files) {
  77             my $file = srctop_file($_);
  78             ok(run(app(["openssl", "storeutl", $file])));
  79             ok(run(app(["openssl", "storeutl", to_file_uri($file)])));
  80             ok(run(app(["openssl", "storeutl", to_file_uri($file, 0,
  81                                                            "")])));
  82             ok(run(app(["openssl", "storeutl", to_file_uri($file, 0,
  83                                                            "localhost")])));
  84             ok(!run(app(["openssl", "storeutl", to_file_uri($file, 0,
  85                                                             "dummy")])));
  86         }
  87         foreach (@generated_files) {
  88         SKIP:
  89             {
  90                 skip "PKCS#12 files not currently supported", 3 if m|\.p12$|;
  91
  92                 ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
  93                             $_])));
  94                 ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
  95                             to_file_uri($_)])));
  96                 ok(!run(app(["openssl", "storeutl", "-passin", "pass:password",
  97                              to_rel_file_uri($_)])));
  98             }
  99         }
 100     }
 101 }, create => 1, cleanup => 1;
 102
 103 sub init {
 104     return (
 105             # rsa-key-pkcs1.pem
 106             run(app(["openssl", "genrsa",
 107                      "-out", "rsa-key-pkcs1.pem", "2432"]))
 108             # dsa-key-pkcs1.pem
 109             && run(app(["openssl", "dsaparam", "-genkey",
 110                         "-out", "dsa-key-pkcs1.pem", "1024"]))
 111             # ec-key-pkcs1.pem (one might think that 'genec' would be practical)
 112             && run(app(["openssl", "ecparam", "-genkey", "-name", "prime256v1",
 113                         "-out", "ec-key-pkcs1.pem"]))
 114             # rsa-key-pkcs1-aes128.pem
 115             && run(app(["openssl", "rsa", "-passout", "pass:password", "-aes128",
 116                         "-in", "rsa-key-pkcs1.pem",
 117                         "-out", "rsa-key-pkcs1-aes128.pem"]))
 118             # dsa-key-pkcs1-aes128.pem
 119             && run(app(["openssl", "dsa", "-passout", "pass:password", "-aes128",
 120                         "-in", "dsa-key-pkcs1.pem",
 121                         "-out", "dsa-key-pkcs1-aes128.pem"]))
 122             # ec-key-pkcs1-aes128.pem
 123             && run(app(["openssl", "ec", "-passout", "pass:password", "-aes128",
 124                         "-in", "ec-key-pkcs1.pem",
 125                         "-out", "ec-key-pkcs1-aes128.pem"]))
 126             # *-key-pkcs8.pem
 127             && runall(sub {
 128                           my $dstfile = shift;
 129                           (my $srcfile = $dstfile)
 130                               =~ s/-key-pkcs8\.pem$/-key-pkcs1.pem/i;
 131                           run(app(["openssl", "pkcs8", "-topk8", "-nocrypt",
 132                                    "-in", $srcfile, "-out", $dstfile]));
 133                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
 134             # *-key-pkcs8-pbes1-sha1-3des.pem
 135             && runall(sub {
 136                           my $dstfile = shift;
 137                           (my $srcfile = $dstfile)
 138                               =~ s/-key-pkcs8-pbes1-sha1-3des\.pem$
 139                                   /-key-pkcs8.pem/ix;
 140                           run(app(["openssl", "pkcs8", "-topk8",
 141                                    "-passout", "pass:password",
 142                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
 143                                    "-in", $srcfile, "-out", $dstfile]));
 144                       }, grep(/-key-pkcs8-pbes1-sha1-3des\.pem$/, @generated_files))
 145             # *-key-pkcs8-pbes1-md5-des.pem
 146             && runall(sub {
 147                           my $dstfile = shift;
 148                           (my $srcfile = $dstfile)
 149                               =~ s/-key-pkcs8-pbes1-md5-des\.pem$
 150                                   /-key-pkcs8.pem/ix;
 151                           run(app(["openssl", "pkcs8", "-topk8",
 152                                    "-passout", "pass:password",
 153                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
 154                                    "-in", $srcfile, "-out", $dstfile]));
 155                       }, grep(/-key-pkcs8-pbes1-md5-des\.pem$/, @generated_files))
 156             # *-key-pkcs8-pbes2-sha1.pem
 157             && runall(sub {
 158                           my $dstfile = shift;
 159                           (my $srcfile = $dstfile)
 160                               =~ s/-key-pkcs8-pbes2-sha1\.pem$
 161                                   /-key-pkcs8.pem/ix;
 162                           run(app(["openssl", "pkcs8", "-topk8",
 163                                    "-passout", "pass:password",
 164                                    "-v2", "aes256", "-v2prf", "hmacWithSHA1",
 165                                    "-in", $srcfile, "-out", $dstfile]));
 166                       }, grep(/-key-pkcs8-pbes2-sha1\.pem$/, @generated_files))
 167             # *-key-pkcs8-pbes2-sha1.pem
 168             && runall(sub {
 169                           my $dstfile = shift;
 170                           (my $srcfile = $dstfile)
 171                               =~ s/-key-pkcs8-pbes2-sha256\.pem$
 172                                   /-key-pkcs8.pem/ix;
 173                           run(app(["openssl", "pkcs8", "-topk8",
 174                                    "-passout", "pass:password",
 175                                    "-v2", "aes256", "-v2prf", "hmacWithSHA256",
 176                                    "-in", $srcfile, "-out", $dstfile]));
 177                       }, grep(/-key-pkcs8-pbes2-sha256\.pem$/, @generated_files))
 178             # *.der (the end all init)
 179             && runall(sub {
 180                           my $dstfile = shift;
 181                           (my $srcfile = $dstfile) =~ s/\.der$/.pem/i;
 182                           if (! -f $srcfile) {
 183                               $srcfile = srctop_file("test", $srcfile);
 184                           }
 185                           my $infh;
 186                           unless (open $infh, $srcfile) {
 187                               return 0;
 188                           }
 189                           my $l;
 190                           while (($l = <$infh>) !~ /^-----BEGIN\s/
 191                                  || $l =~ /^-----BEGIN.*PARAMETERS-----/) {
 192                           }
 193                           my $b64 = "";
 194                           while (($l = <$infh>) !~ /^-----END\s/) {
 195                               $l =~ s|\R$||;
 196                               $b64 .= $l unless $l =~ /:/;
 197                           }
 198                           close $infh;
 199                           my $der = decode_base64($b64);
 200                           unless (length($b64) / 4 * 3 - length($der) < 3) {
 201                               print STDERR "Length error, ",length($b64),
 202                                   " bytes of base64 became ",length($der),
 203                                   " bytes of der? ($srcfile => $dstfile)\n";
 204                               return 0;
 205                           }
 206                           my $outfh;
 207                           unless (open $outfh, ">:raw", $dstfile) {
 208                               return 0;
 209                           }
 210                           print $outfh $der;
 211                           close $outfh;
 212                           return 1;
 213                       }, grep(/\.der$/, @generated_files))
 214            );
 215 }
 216
 217 sub runall {
 218     my ($function, @items) = @_;
 219
 220     foreach (@items) {
 221         return 0 unless $function->($_);
 222     }
 223     return 1;
 224 }
 225
 226 # According to RFC8089, a relative file: path is invalid.  We still produce
 227 # them for testing purposes.
 228 sub to_rel_file_uri {
 229     my ($file, $isdir, $authority) = @_;
 230     my $vol;
 231     my $dir;
 232
 233     die "to_rel_file_uri: No file given\n" if !defined($file) || $file eq '';
 234
 235     ($vol, $dir, $file) = File::Spec->splitpath($file, $isdir // 0);
 236
 237     # Make sure we have a Unix style directory.
 238     $dir = join('/', File::Spec->splitdir($dir));
 239     # Canonicalise it (note: it seems to be only needed on Unix)
 240     while (1) {
 241         my $newdir = $dir;
 242         $newdir =~ s|/[^/]*[^/\.]+[^/]*/\.\./|/|g;
 243         last if $newdir eq $dir;
 244         $dir = $newdir;
 245     }
 246     # Take care of the corner cases the loop can't handle, and that $dir
 247     # ends with a / unless it's empty
 248     $dir =~ s|/[^/]*[^/\.]+[^/]*/\.\.$|/|;
 249     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\./|/|;
 250     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\.$||;
 251     if ($isdir // 0) {
 252         $dir =~ s|/$|| if $dir ne '/';
 253     } else {
 254         $dir .= '/' if $dir ne '' && $dir !~ m|/$|;
 255     }
 256
 257     # If the file system has separate volumes (at present, Windows and VMS)
 258     # we need to handle them.  In URIs, they are invariably the first
 259     # component of the path, which is always absolute.
 260     # On VMS, user:[foo.bar] translates to /user/foo/bar
 261     # On Windows, c:\Users\Foo translates to /c:/Users/Foo
 262     if ($vol ne '') {
 263         $vol =~ s|:||g if ($^O eq "VMS");
 264         $dir = '/' . $dir if $dir ne '' && $dir !~ m|^/|;
 265         $dir = '/' . $vol . $dir;
 266     }
 267     $file = $dir . $file;
 268
 269     return "file://$authority$file" if defined $authority;
 270     return "file:$file";
 271 }
 272
 273 sub to_file_uri {
 274     my ($file, $isdir, $authority) = @_;
 275
 276     die "to_file_uri: No file given\n" if !defined($file) || $file eq '';
 277     return to_rel_file_uri(File::Spec->rel2abs($file), $isdir, $authority);
 278 }