test/recipes/90-test_store.t

   1 #! /usr/bin/env perl
   2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the OpenSSL license (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9 use File::Spec;
  10 use MIME::Base64;
  11 use OpenSSL::Test qw(:DEFAULT srctop_file srctop_dir bldtop_file data_file);
  12
  13 my $test_name = "test_store";
  14 setup($test_name);
  15
  16 my @noexist_files =
  17     ( "test/blahdiblah.pem",
  18       "test/blahdibleh.der" );
  19 my @src_files =
  20     ( "test/testx509.pem",
  21       "test/testrsa.pem",
  22       "test/testrsapub.pem",
  23       "test/testcrl.pem",
  24       "apps/server.pem" );
  25 my @generated_files =
  26     (
  27      ### generated from the source files
  28
  29      "testx509.der",
  30      "testrsa.der",
  31      "testrsapub.der",
  32      "testcrl.der",
  33
  34      ### generated locally
  35
  36      "rsa-key-pkcs1.pem", "rsa-key-pkcs1.der",
  37      "rsa-key-pkcs1-aes128.pem",
  38      "rsa-key-pkcs8.pem", "rsa-key-pkcs8.der",
  39      "rsa-key-pkcs8-pbes1-sha1-3des.pem", "rsa-key-pkcs8-pbes1-sha1-3des.der",
  40      "rsa-key-pkcs8-pbes2-sha1.pem", "rsa-key-pkcs8-pbes2-sha1.der",
  41      "rsa-key-sha1-3des-sha1.p12", "rsa-key-sha1-3des-sha256.p12",
  42      "rsa-key-aes256-cbc-sha256.p12",
  43      "rsa-key-md5-des-sha1.p12",
  44      "rsa-key-aes256-cbc-md5-des-sha256.p12",
  45      "rsa-key-pkcs8-pbes2-sha256.pem", "rsa-key-pkcs8-pbes2-sha256.der",
  46      "rsa-key-pkcs8-pbes1-md5-des.pem", "rsa-key-pkcs8-pbes1-md5-des.der",
  47      "dsa-key-pkcs1.pem", "dsa-key-pkcs1.der",
  48      "dsa-key-pkcs1-aes128.pem",
  49      "dsa-key-pkcs8.pem", "dsa-key-pkcs8.der",
  50      "dsa-key-pkcs8-pbes2-sha1.pem", "dsa-key-pkcs8-pbes2-sha1.der",
  51      "dsa-key-aes256-cbc-sha256.p12",
  52      "ec-key-pkcs1.pem", "ec-key-pkcs1.der",
  53      "ec-key-pkcs1-aes128.pem",
  54      "ec-key-pkcs8.pem", "ec-key-pkcs8.der",
  55      "ec-key-pkcs8-pbes2-sha1.pem", "ec-key-pkcs8-pbes2-sha1.der",
  56      "ec-key-aes256-cbc-sha256.p12",
  57     );
  58
  59 my $n = (3 * scalar @noexist_files)
  60     + (6 * scalar @src_files)
  61     + (4 * scalar @generated_files)
  62     + 3;
  63
  64 plan tests => $n;
  65
  66 indir "store_$$" => sub {
  67  SKIP:
  68     {
  69         skip "failed initialisation", $n unless init();
  70
  71         foreach (@noexist_files) {
  72             my $file = srctop_file($_);
  73             ok(!run(app(["openssl", "storeutl", $file])));
  74             ok(!run(app(["openssl", "storeutl", to_abs_file($file)])));
  75             ok(!run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
  76         }
  77         foreach (@src_files) {
  78             my $file = srctop_file($_);
  79             ok(run(app(["openssl", "storeutl", $file])));
  80             ok(run(app(["openssl", "storeutl", to_abs_file($file)])));
  81             ok(run(app(["openssl", "storeutl", to_abs_file_uri($file)])));
  82             ok(run(app(["openssl", "storeutl", to_abs_file_uri($file, 0,
  83                                                                "")])));
  84             ok(run(app(["openssl", "storeutl", to_abs_file_uri($file, 0,
  85                                                                "localhost")])));
  86             ok(!run(app(["openssl", "storeutl", to_abs_file_uri($file, 0,
  87                                                                 "dummy")])));
  88         }
  89         foreach (@generated_files) {
  90             ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
  91                         $_])));
  92             ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
  93                         to_abs_file($_)])));
  94             ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
  95                         to_abs_file_uri($_)])));
  96             ok(!run(app(["openssl", "storeutl", "-passin", "pass:password",
  97                          to_file_uri($_)])));
  98         }
  99         {
 100             my $dir = srctop_dir("test", "certs");
 101             ok(run(app(["openssl", "storeutl", $dir])));
 102             ok(run(app(["openssl", "storeutl", to_abs_file($dir, 1)])));
 103             ok(run(app(["openssl", "storeutl", to_abs_file_uri($dir, 1)])));
 104         }
 105     }
 106 }, create => 1, cleanup => 1;
 107
 108 sub init {
 109     return (
 110             # rsa-key-pkcs1.pem
 111             run(app(["openssl", "genrsa",
 112                      "-out", "rsa-key-pkcs1.pem", "2432"]))
 113             # dsa-key-pkcs1.pem
 114             && run(app(["openssl", "dsaparam", "-genkey",
 115                         "-out", "dsa-key-pkcs1.pem", "1024"]))
 116             # ec-key-pkcs1.pem (one might think that 'genec' would be practical)
 117             && run(app(["openssl", "ecparam", "-genkey", "-name", "prime256v1",
 118                         "-out", "ec-key-pkcs1.pem"]))
 119             # rsa-key-pkcs1-aes128.pem
 120             && run(app(["openssl", "rsa", "-passout", "pass:password", "-aes128",
 121                         "-in", "rsa-key-pkcs1.pem",
 122                         "-out", "rsa-key-pkcs1-aes128.pem"]))
 123             # dsa-key-pkcs1-aes128.pem
 124             && run(app(["openssl", "dsa", "-passout", "pass:password", "-aes128",
 125                         "-in", "dsa-key-pkcs1.pem",
 126                         "-out", "dsa-key-pkcs1-aes128.pem"]))
 127             # ec-key-pkcs1-aes128.pem
 128             && run(app(["openssl", "ec", "-passout", "pass:password", "-aes128",
 129                         "-in", "ec-key-pkcs1.pem",
 130                         "-out", "ec-key-pkcs1-aes128.pem"]))
 131             # *-key-pkcs8.pem
 132             && runall(sub {
 133                           my $dstfile = shift;
 134                           (my $srcfile = $dstfile)
 135                               =~ s/-key-pkcs8\.pem$/-key-pkcs1.pem/i;
 136                           run(app(["openssl", "pkcs8", "-topk8", "-nocrypt",
 137                                    "-in", $srcfile, "-out", $dstfile]));
 138                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
 139             # *-key-pkcs8-pbes1-sha1-3des.pem
 140             && runall(sub {
 141                           my $dstfile = shift;
 142                           (my $srcfile = $dstfile)
 143                               =~ s/-key-pkcs8-pbes1-sha1-3des\.pem$
 144                                   /-key-pkcs8.pem/ix;
 145                           run(app(["openssl", "pkcs8", "-topk8",
 146                                    "-passout", "pass:password",
 147                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
 148                                    "-in", $srcfile, "-out", $dstfile]));
 149                       }, grep(/-key-pkcs8-pbes1-sha1-3des\.pem$/, @generated_files))
 150             # *-key-pkcs8-pbes1-md5-des.pem
 151             && runall(sub {
 152                           my $dstfile = shift;
 153                           (my $srcfile = $dstfile)
 154                               =~ s/-key-pkcs8-pbes1-md5-des\.pem$
 155                                   /-key-pkcs8.pem/ix;
 156                           run(app(["openssl", "pkcs8", "-topk8",
 157                                    "-passout", "pass:password",
 158                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
 159                                    "-in", $srcfile, "-out", $dstfile]));
 160                       }, grep(/-key-pkcs8-pbes1-md5-des\.pem$/, @generated_files))
 161             # *-key-pkcs8-pbes2-sha1.pem
 162             && runall(sub {
 163                           my $dstfile = shift;
 164                           (my $srcfile = $dstfile)
 165                               =~ s/-key-pkcs8-pbes2-sha1\.pem$
 166                                   /-key-pkcs8.pem/ix;
 167                           run(app(["openssl", "pkcs8", "-topk8",
 168                                    "-passout", "pass:password",
 169                                    "-v2", "aes256", "-v2prf", "hmacWithSHA1",
 170                                    "-in", $srcfile, "-out", $dstfile]));
 171                       }, grep(/-key-pkcs8-pbes2-sha1\.pem$/, @generated_files))
 172             # *-key-pkcs8-pbes2-sha1.pem
 173             && runall(sub {
 174                           my $dstfile = shift;
 175                           (my $srcfile = $dstfile)
 176                               =~ s/-key-pkcs8-pbes2-sha256\.pem$
 177                                   /-key-pkcs8.pem/ix;
 178                           run(app(["openssl", "pkcs8", "-topk8",
 179                                    "-passout", "pass:password",
 180                                    "-v2", "aes256", "-v2prf", "hmacWithSHA256",
 181                                    "-in", $srcfile, "-out", $dstfile]));
 182                       }, grep(/-key-pkcs8-pbes2-sha256\.pem$/, @generated_files))
 183             # *-cert.pem (intermediary for the .p12 inits)
 184             && run(app(["openssl", "req", "-x509",
 185                         "-config", data_file("ca.cnf"), "-nodes",
 186                         "-out", "cacert.pem", "-keyout", "cakey.pem"]))
 187             && runall(sub {
 188                           my $srckey = shift;
 189                           (my $dstfile = $srckey) =~ s|-key-pkcs8\.|-cert.|;
 190                           (my $csr = $dstfile) =~ s|\.pem|.csr|;
 191
 192                           (run(app(["openssl", "req", "-new",
 193                                     "-config", data_file("user.cnf"),
 194                                     "-key", $srckey, "-out", $csr]))
 195                            &&
 196                            run(app(["openssl", "x509", "-days", "3650",
 197                                     "-CA", "cacert.pem",
 198                                     "-CAkey", "cakey.pem",
 199                                     "-set_serial", time(), "-req",
 200                                     "-in", $csr, "-out", $dstfile])));
 201                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
 202             # *.p12
 203             && runall(sub {
 204                           my $dstfile = shift;
 205                           my ($type, $certpbe_index, $keypbe_index,
 206                               $macalg_index) =
 207                               $dstfile =~ m{^(.*)-key-(?|
 208                                                 # cert and key PBE are same
 209                                                 ()             #
 210                                                 ([^-]*-[^-]*)- # key & cert PBE
 211                                                 ([^-]*)        # MACalg
 212                                             |
 213                                                 # cert and key PBE are not same
 214                                                 ([^-]*-[^-]*)- # cert PBE
 215                                                 ([^-]*-[^-]*)- # key PBE
 216                                                 ([^-]*)        # MACalg
 217                                             )\.}x;
 218                           if (!$certpbe_index) {
 219                               $certpbe_index = $keypbe_index;
 220                           }
 221                           my $srckey = "$type-key-pkcs8.pem";
 222                           my $srccert = "$type-cert.pem";
 223                           my %pbes =
 224                               (
 225                                "sha1-3des" => "pbeWithSHA1And3-KeyTripleDES-CBC",
 226                                "md5-des" => "pbeWithMD5AndDES-CBC",
 227                                "aes256-cbc" => "AES-256-CBC",
 228                               );
 229                           my %macalgs =
 230                               (
 231                                "sha1" => "SHA1",
 232                                "sha256" => "SHA256",
 233                               );
 234                           my $certpbe = $pbes{$certpbe_index};
 235                           my $keypbe = $pbes{$keypbe_index};
 236                           my $macalg = $macalgs{$macalg_index};
 237                           if (!defined($certpbe) || !defined($keypbe)
 238                               || !defined($macalg)) {
 239                               print STDERR "Cert PBE for $pbe_index not defined\n"
 240                                   unless defined $certpbe;
 241                               print STDERR "Key PBE for $pbe_index not defined\n"
 242                                   unless defined $keypbe;
 243                               print STDERR "MACALG for $macalg_index not defined\n"
 244                                   unless defined $macalg;
 245                               print STDERR "(destination file was $dstfile)\n";
 246                               return 0;
 247                           }
 248                           run(app(["openssl", "pkcs12", "-inkey", $srckey,
 249                                    "-in", $srccert, "-passout", "pass:password",
 250                                    "-export", "-macalg", $macalg,
 251                                    "-certpbe", $certpbe, "-keypbe", $keypbe,
 252                                    "-out", $dstfile]));
 253                       }, grep(/\.p12/, @generated_files))
 254             # *.der (the end all init)
 255             && runall(sub {
 256                           my $dstfile = shift;
 257                           (my $srcfile = $dstfile) =~ s/\.der$/.pem/i;
 258                           if (! -f $srcfile) {
 259                               $srcfile = srctop_file("test", $srcfile);
 260                           }
 261                           my $infh;
 262                           unless (open $infh, $srcfile) {
 263                               return 0;
 264                           }
 265                           my $l;
 266                           while (($l = <$infh>) !~ /^-----BEGIN\s/
 267                                  || $l =~ /^-----BEGIN.*PARAMETERS-----/) {
 268                           }
 269                           my $b64 = "";
 270                           while (($l = <$infh>) !~ /^-----END\s/) {
 271                               $l =~ s|\R$||;
 272                               $b64 .= $l unless $l =~ /:/;
 273                           }
 274                           close $infh;
 275                           my $der = decode_base64($b64);
 276                           unless (length($b64) / 4 * 3 - length($der) < 3) {
 277                               print STDERR "Length error, ",length($b64),
 278                                   " bytes of base64 became ",length($der),
 279                                   " bytes of der? ($srcfile => $dstfile)\n";
 280                               return 0;
 281                           }
 282                           my $outfh;
 283                           unless (open $outfh, ">:raw", $dstfile) {
 284                               return 0;
 285                           }
 286                           print $outfh $der;
 287                           close $outfh;
 288                           return 1;
 289                       }, grep(/\.der$/, @generated_files))
 290            );
 291 }
 292
 293 sub runall {
 294     my ($function, @items) = @_;
 295
 296     foreach (@items) {
 297         return 0 unless $function->($_);
 298     }
 299     return 1;
 300 }
 301
 302 # According to RFC8089, a relative file: path is invalid.  We still produce
 303 # them for testing purposes.
 304 sub to_file_uri {
 305     my ($file, $isdir, $authority) = @_;
 306     my $vol;
 307     my $dir;
 308
 309     die "to_file_uri: No file given\n" if !defined($file) || $file eq '';
 310
 311     ($vol, $dir, $file) = File::Spec->splitpath($file, $isdir // 0);
 312
 313     # Make sure we have a Unix style directory.
 314     $dir = join('/', File::Spec->splitdir($dir));
 315     # Canonicalise it (note: it seems to be only needed on Unix)
 316     while (1) {
 317         my $newdir = $dir;
 318         $newdir =~ s|/[^/]*[^/\.]+[^/]*/\.\./|/|g;
 319         last if $newdir eq $dir;
 320         $dir = $newdir;
 321     }
 322     # Take care of the corner cases the loop can't handle, and that $dir
 323     # ends with a / unless it's empty
 324     $dir =~ s|/[^/]*[^/\.]+[^/]*/\.\.$|/|;
 325     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\./|/|;
 326     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\.$||;
 327     if ($isdir // 0) {
 328         $dir =~ s|/$|| if $dir ne '/';
 329     } else {
 330         $dir .= '/' if $dir ne '' && $dir !~ m|/$|;
 331     }
 332
 333     # If the file system has separate volumes (at present, Windows and VMS)
 334     # we need to handle them.  In URIs, they are invariably the first
 335     # component of the path, which is always absolute.
 336     # On VMS, user:[foo.bar] translates to /user/foo/bar
 337     # On Windows, c:\Users\Foo translates to /c:/Users/Foo
 338     if ($vol ne '') {
 339         $vol =~ s|:||g if ($^O eq "VMS");
 340         $dir = '/' . $dir if $dir ne '' && $dir !~ m|^/|;
 341         $dir = '/' . $vol . $dir;
 342     }
 343     $file = $dir . $file;
 344
 345     return "file://$authority$file" if defined $authority;
 346     return "file:$file";
 347 }
 348
 349 sub to_abs_file {
 350     my ($file) = @_;
 351
 352     return File::Spec->rel2abs($file);
 353 }
 354
 355 sub to_abs_file_uri {
 356     my ($file, $isdir, $authority) = @_;
 357
 358     die "to_abs_file_uri: No file given\n" if !defined($file) || $file eq '';
 359     return to_file_uri(to_abs_file($file), $isdir, $authority);
 360 }