test/recipes/90-test_store.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the OpenSSL license (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9 use File::Spec;
  10 use File::Copy;
  11 use MIME::Base64;
  12 use OpenSSL::Test qw(:DEFAULT srctop_file srctop_dir bldtop_file data_file);
  13
  14 my $test_name = "test_store";
  15 setup($test_name);
  16
  17 my @noexist_files =
  18     ( "test/blahdiblah.pem",
  19       "test/blahdibleh.der" );
  20 my @src_files =
  21     ( "test/testx509.pem",
  22       "test/testrsa.pem",
  23       "test/testrsapub.pem",
  24       "test/testcrl.pem",
  25       "apps/server.pem" );
  26 my @generated_files =
  27     (
  28      ### generated from the source files
  29
  30      "testx509.der",
  31      "testrsa.der",
  32      "testrsapub.der",
  33      "testcrl.der",
  34
  35      ### generated locally
  36
  37      "rsa-key-pkcs1.pem", "rsa-key-pkcs1.der",
  38      "rsa-key-pkcs1-aes128.pem",
  39      "rsa-key-pkcs8.pem", "rsa-key-pkcs8.der",
  40      "rsa-key-pkcs8-pbes1-sha1-3des.pem", "rsa-key-pkcs8-pbes1-sha1-3des.der",
  41      "rsa-key-pkcs8-pbes2-sha1.pem", "rsa-key-pkcs8-pbes2-sha1.der",
  42      "rsa-key-sha1-3des-sha1.p12", "rsa-key-sha1-3des-sha256.p12",
  43      "rsa-key-aes256-cbc-sha256.p12",
  44      "rsa-key-md5-des-sha1.p12",
  45      "rsa-key-aes256-cbc-md5-des-sha256.p12",
  46      "rsa-key-pkcs8-pbes2-sha256.pem", "rsa-key-pkcs8-pbes2-sha256.der",
  47      "rsa-key-pkcs8-pbes1-md5-des.pem", "rsa-key-pkcs8-pbes1-md5-des.der",
  48      "dsa-key-pkcs1.pem", "dsa-key-pkcs1.der",
  49      "dsa-key-pkcs1-aes128.pem",
  50      "dsa-key-pkcs8.pem", "dsa-key-pkcs8.der",
  51      "dsa-key-pkcs8-pbes2-sha1.pem", "dsa-key-pkcs8-pbes2-sha1.der",
  52      "dsa-key-aes256-cbc-sha256.p12",
  53      "ec-key-pkcs1.pem", "ec-key-pkcs1.der",
  54      "ec-key-pkcs1-aes128.pem",
  55      "ec-key-pkcs8.pem", "ec-key-pkcs8.der",
  56      "ec-key-pkcs8-pbes2-sha1.pem", "ec-key-pkcs8-pbes2-sha1.der",
  57      "ec-key-aes256-cbc-sha256.p12",
  58     );
  59 my %generated_file_files =
  60     $^O eq 'linux'
  61     ? ( "test/testx509.pem" => "file:testx509.pem",
  62         "test/testrsa.pem" => "file:testrsa.pem",
  63         "test/testrsapub.pem" => "file:testrsapub.pem",
  64         "test/testcrl.pem" => "file:testcrl.pem",
  65         "apps/server.pem" => "file:server.pem" )
  66     : ();
  67 my @noexist_file_files =
  68     ( "file:blahdiblah.pem",
  69       "file:test/blahdibleh.der" );
  70
  71
  72 my $n = (3 * scalar @noexist_files)
  73     + (6 * scalar @src_files)
  74     + (4 * scalar @generated_files)
  75     + (scalar keys %generated_file_files)
  76     + (scalar @noexist_file_files)
  77     + 3;
  78
  79 plan tests => $n;
  80
  81 indir "store_$$" => sub {
  82  SKIP:
  83     {
  84         skip "failed initialisation", $n unless init();
  85
  86         foreach (@noexist_files) {
  87             my $file = srctop_file($_);
  88             ok(!run(app(["openssl", "storeutl", $file])));
  89             ok(!run(app(["openssl", "storeutl", to_abs_file($file)])));
  90             ok(!run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
  91         }
  92         foreach (@src_files) {
  93             my $file = srctop_file($_);
  94             ok(run(app(["openssl", "storeutl", $file])));
  95             ok(run(app(["openssl", "storeutl", to_abs_file($file)])));
  96             ok(run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
  97             ok(run(app(["openssl", "storeutl", to_abs_file_uri($file, 0,
  98                                                                "")])));
  99             ok(run(app(["openssl", "storeutl", to_abs_file_uri($file, 0,
 100                                                                "localhost")])));
 101             ok(!run(app(["openssl", "storeutl", to_abs_file_uri($file, 0,
 102                                                                 "dummy")])));
 103         }
 104         foreach (@generated_files) {
 105             ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
 106                         $_])));
 107             ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
 108                         to_abs_file($_)])));
 109             ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
 110                         to_abs_file_uri($_)])));
 111             ok(!run(app(["openssl", "storeutl", "-passin", "pass:password",
 112                          to_file_uri($_)])));
 113         }
 114         foreach (values %generated_file_files) {
 115             ok(run(app(["openssl", "storeutl", $_])));
 116         }
 117         foreach (@noexist_file_files) {
 118             ok(!run(app(["openssl", "storeutl", $_])));
 119         }
 120         {
 121             my $dir = srctop_dir("test", "certs");
 122             ok(run(app(["openssl", "storeutl", $dir])));
 123             ok(run(app(["openssl", "storeutl", to_abs_file($dir, 1)])));
 124             ok(run(app(["openssl", "storeutl", to_abs_file_uri($dir, 1)])));
 125         }
 126     }
 127 }, create => 1, cleanup => 1;
 128
 129 sub init {
 130     return (
 131             # rsa-key-pkcs1.pem
 132             run(app(["openssl", "genrsa",
 133                      "-out", "rsa-key-pkcs1.pem", "2432"]))
 134             # dsa-key-pkcs1.pem
 135             && run(app(["openssl", "dsaparam", "-genkey",
 136                         "-out", "dsa-key-pkcs1.pem", "1024"]))
 137             # ec-key-pkcs1.pem (one might think that 'genec' would be practical)
 138             && run(app(["openssl", "ecparam", "-genkey", "-name", "prime256v1",
 139                         "-out", "ec-key-pkcs1.pem"]))
 140             # rsa-key-pkcs1-aes128.pem
 141             && run(app(["openssl", "rsa", "-passout", "pass:password", "-aes128",
 142                         "-in", "rsa-key-pkcs1.pem",
 143                         "-out", "rsa-key-pkcs1-aes128.pem"]))
 144             # dsa-key-pkcs1-aes128.pem
 145             && run(app(["openssl", "dsa", "-passout", "pass:password", "-aes128",
 146                         "-in", "dsa-key-pkcs1.pem",
 147                         "-out", "dsa-key-pkcs1-aes128.pem"]))
 148             # ec-key-pkcs1-aes128.pem
 149             && run(app(["openssl", "ec", "-passout", "pass:password", "-aes128",
 150                         "-in", "ec-key-pkcs1.pem",
 151                         "-out", "ec-key-pkcs1-aes128.pem"]))
 152             # *-key-pkcs8.pem
 153             && runall(sub {
 154                           my $dstfile = shift;
 155                           (my $srcfile = $dstfile)
 156                               =~ s/-key-pkcs8\.pem$/-key-pkcs1.pem/i;
 157                           run(app(["openssl", "pkcs8", "-topk8", "-nocrypt",
 158                                    "-in", $srcfile, "-out", $dstfile]));
 159                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
 160             # *-key-pkcs8-pbes1-sha1-3des.pem
 161             && runall(sub {
 162                           my $dstfile = shift;
 163                           (my $srcfile = $dstfile)
 164                               =~ s/-key-pkcs8-pbes1-sha1-3des\.pem$
 165                                   /-key-pkcs8.pem/ix;
 166                           run(app(["openssl", "pkcs8", "-topk8",
 167                                    "-passout", "pass:password",
 168                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
 169                                    "-in", $srcfile, "-out", $dstfile]));
 170                       }, grep(/-key-pkcs8-pbes1-sha1-3des\.pem$/, @generated_files))
 171             # *-key-pkcs8-pbes1-md5-des.pem
 172             && runall(sub {
 173                           my $dstfile = shift;
 174                           (my $srcfile = $dstfile)
 175                               =~ s/-key-pkcs8-pbes1-md5-des\.pem$
 176                                   /-key-pkcs8.pem/ix;
 177                           run(app(["openssl", "pkcs8", "-topk8",
 178                                    "-passout", "pass:password",
 179                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
 180                                    "-in", $srcfile, "-out", $dstfile]));
 181                       }, grep(/-key-pkcs8-pbes1-md5-des\.pem$/, @generated_files))
 182             # *-key-pkcs8-pbes2-sha1.pem
 183             && runall(sub {
 184                           my $dstfile = shift;
 185                           (my $srcfile = $dstfile)
 186                               =~ s/-key-pkcs8-pbes2-sha1\.pem$
 187                                   /-key-pkcs8.pem/ix;
 188                           run(app(["openssl", "pkcs8", "-topk8",
 189                                    "-passout", "pass:password",
 190                                    "-v2", "aes256", "-v2prf", "hmacWithSHA1",
 191                                    "-in", $srcfile, "-out", $dstfile]));
 192                       }, grep(/-key-pkcs8-pbes2-sha1\.pem$/, @generated_files))
 193             # *-key-pkcs8-pbes2-sha1.pem
 194             && runall(sub {
 195                           my $dstfile = shift;
 196                           (my $srcfile = $dstfile)
 197                               =~ s/-key-pkcs8-pbes2-sha256\.pem$
 198                                   /-key-pkcs8.pem/ix;
 199                           run(app(["openssl", "pkcs8", "-topk8",
 200                                    "-passout", "pass:password",
 201                                    "-v2", "aes256", "-v2prf", "hmacWithSHA256",
 202                                    "-in", $srcfile, "-out", $dstfile]));
 203                       }, grep(/-key-pkcs8-pbes2-sha256\.pem$/, @generated_files))
 204             # *-cert.pem (intermediary for the .p12 inits)
 205             && run(app(["openssl", "req", "-x509",
 206                         "-config", data_file("ca.cnf"), "-nodes",
 207                         "-out", "cacert.pem", "-keyout", "cakey.pem"]))
 208             && runall(sub {
 209                           my $srckey = shift;
 210                           (my $dstfile = $srckey) =~ s|-key-pkcs8\.|-cert.|;
 211                           (my $csr = $dstfile) =~ s|\.pem|.csr|;
 212
 213                           (run(app(["openssl", "req", "-new",
 214                                     "-config", data_file("user.cnf"),
 215                                     "-key", $srckey, "-out", $csr]))
 216                            &&
 217                            run(app(["openssl", "x509", "-days", "3650",
 218                                     "-CA", "cacert.pem",
 219                                     "-CAkey", "cakey.pem",
 220                                     "-set_serial", time(), "-req",
 221                                     "-in", $csr, "-out", $dstfile])));
 222                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
 223             # *.p12
 224             && runall(sub {
 225                           my $dstfile = shift;
 226                           my ($type, $certpbe_index, $keypbe_index,
 227                               $macalg_index) =
 228                               $dstfile =~ m{^(.*)-key-(?|
 229                                                 # cert and key PBE are same
 230                                                 ()             #
 231                                                 ([^-]*-[^-]*)- # key & cert PBE
 232                                                 ([^-]*)        # MACalg
 233                                             |
 234                                                 # cert and key PBE are not same
 235                                                 ([^-]*-[^-]*)- # cert PBE
 236                                                 ([^-]*-[^-]*)- # key PBE
 237                                                 ([^-]*)        # MACalg
 238                                             )\.}x;
 239                           if (!$certpbe_index) {
 240                               $certpbe_index = $keypbe_index;
 241                           }
 242                           my $srckey = "$type-key-pkcs8.pem";
 243                           my $srccert = "$type-cert.pem";
 244                           my %pbes =
 245                               (
 246                                "sha1-3des" => "pbeWithSHA1And3-KeyTripleDES-CBC",
 247                                "md5-des" => "pbeWithMD5AndDES-CBC",
 248                                "aes256-cbc" => "AES-256-CBC",
 249                               );
 250                           my %macalgs =
 251                               (
 252                                "sha1" => "SHA1",
 253                                "sha256" => "SHA256",
 254                               );
 255                           my $certpbe = $pbes{$certpbe_index};
 256                           my $keypbe = $pbes{$keypbe_index};
 257                           my $macalg = $macalgs{$macalg_index};
 258                           if (!defined($certpbe) || !defined($keypbe)
 259                               || !defined($macalg)) {
 260                               print STDERR "Cert PBE for $pbe_index not defined\n"
 261                                   unless defined $certpbe;
 262                               print STDERR "Key PBE for $pbe_index not defined\n"
 263                                   unless defined $keypbe;
 264                               print STDERR "MACALG for $macalg_index not defined\n"
 265                                   unless defined $macalg;
 266                               print STDERR "(destination file was $dstfile)\n";
 267                               return 0;
 268                           }
 269                           run(app(["openssl", "pkcs12", "-inkey", $srckey,
 270                                    "-in", $srccert, "-passout", "pass:password",
 271                                    "-export", "-macalg", $macalg,
 272                                    "-certpbe", $certpbe, "-keypbe", $keypbe,
 273                                    "-out", $dstfile]));
 274                       }, grep(/\.p12/, @generated_files))
 275             # *.der (the end all init)
 276             && runall(sub {
 277                           my $dstfile = shift;
 278                           (my $srcfile = $dstfile) =~ s/\.der$/.pem/i;
 279                           if (! -f $srcfile) {
 280                               $srcfile = srctop_file("test", $srcfile);
 281                           }
 282                           my $infh;
 283                           unless (open $infh, $srcfile) {
 284                               return 0;
 285                           }
 286                           my $l;
 287                           while (($l = <$infh>) !~ /^-----BEGIN\s/
 288                                  || $l =~ /^-----BEGIN.*PARAMETERS-----/) {
 289                           }
 290                           my $b64 = "";
 291                           while (($l = <$infh>) !~ /^-----END\s/) {
 292                               $l =~ s|\R$||;
 293                               $b64 .= $l unless $l =~ /:/;
 294                           }
 295                           close $infh;
 296                           my $der = decode_base64($b64);
 297                           unless (length($b64) / 4 * 3 - length($der) < 3) {
 298                               print STDERR "Length error, ",length($b64),
 299                                   " bytes of base64 became ",length($der),
 300                                   " bytes of der? ($srcfile => $dstfile)\n";
 301                               return 0;
 302                           }
 303                           my $outfh;
 304                           unless (open $outfh, ">:raw", $dstfile) {
 305                               return 0;
 306                           }
 307                           print $outfh $der;
 308                           close $outfh;
 309                           return 1;
 310                       }, grep(/\.der$/, @generated_files))
 311             && runall(sub {
 312                           my $srcfile = shift;
 313                           my $dstfile = $generated_file_files{$srcfile};
 314
 315                           unless (copy srctop_file($srcfile), $dstfile) {
 316                               warn "$!\n";
 317                               return 0;
 318                           }
 319                           return 1;
 320                       }, keys %generated_file_files)
 321            );
 322 }
 323
 324 sub runall {
 325     my ($function, @items) = @_;
 326
 327     foreach (@items) {
 328         return 0 unless $function->($_);
 329     }
 330     return 1;
 331 }
 332
 333 # According to RFC8089, a relative file: path is invalid.  We still produce
 334 # them for testing purposes.
 335 sub to_file_uri {
 336     my ($file, $isdir, $authority) = @_;
 337     my $vol;
 338     my $dir;
 339
 340     die "to_file_uri: No file given\n" if !defined($file) || $file eq '';
 341
 342     ($vol, $dir, $file) = File::Spec->splitpath($file, $isdir // 0);
 343
 344     # Make sure we have a Unix style directory.
 345     $dir = join('/', File::Spec->splitdir($dir));
 346     # Canonicalise it (note: it seems to be only needed on Unix)
 347     while (1) {
 348         my $newdir = $dir;
 349         $newdir =~ s|/[^/]*[^/\.]+[^/]*/\.\./|/|g;
 350         last if $newdir eq $dir;
 351         $dir = $newdir;
 352     }
 353     # Take care of the corner cases the loop can't handle, and that $dir
 354     # ends with a / unless it's empty
 355     $dir =~ s|/[^/]*[^/\.]+[^/]*/\.\.$|/|;
 356     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\./|/|;
 357     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\.$||;
 358     if ($isdir // 0) {
 359         $dir =~ s|/$|| if $dir ne '/';
 360     } else {
 361         $dir .= '/' if $dir ne '' && $dir !~ m|/$|;
 362     }
 363
 364     # If the file system has separate volumes (at present, Windows and VMS)
 365     # we need to handle them.  In URIs, they are invariably the first
 366     # component of the path, which is always absolute.
 367     # On VMS, user:[foo.bar] translates to /user/foo/bar
 368     # On Windows, c:\Users\Foo translates to /c:/Users/Foo
 369     if ($vol ne '') {
 370         $vol =~ s|:||g if ($^O eq "VMS");
 371         $dir = '/' . $dir if $dir ne '' && $dir !~ m|^/|;
 372         $dir = '/' . $vol . $dir;
 373     }
 374     $file = $dir . $file;
 375
 376     return "file://$authority$file" if defined $authority;
 377     return "file:$file";
 378 }
 379
 380 sub to_abs_file {
 381     my ($file) = @_;
 382
 383     return File::Spec->rel2abs($file);
 384 }
 385
 386 sub to_abs_file_uri {
 387     my ($file, $isdir, $authority) = @_;
 388
 389     die "to_abs_file_uri: No file given\n" if !defined($file) || $file eq '';
 390     return to_file_uri(to_abs_file($file), $isdir, $authority);
 391 }