Add APIs for custom X509_LOOKUP_METHOD creation
[openssl.git] / test / recipes / 90-test_store.t
1 #! /usr/bin/env perl
2 # Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
3 #
4 # Licensed under the OpenSSL license (the "License").  You may not use
5 # this file except in compliance with the License.  You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
8
9 use File::Spec::Functions;
10 use File::Copy;
11 use MIME::Base64;
12 use OpenSSL::Test qw(:DEFAULT srctop_file srctop_dir bldtop_file data_file);
13 use OpenSSL::Test::Utils;
14
15 my $test_name = "test_store";
16 setup($test_name);
17
18 my @noexist_files =
19     ( "test/blahdiblah.pem",
20       "test/blahdibleh.der" );
21 my @src_files =
22     ( "test/testx509.pem",
23       "test/testrsa.pem",
24       "test/testrsapub.pem",
25       "test/testcrl.pem",
26       "apps/server.pem" );
27 my @generated_files =
28     (
29      ### generated from the source files
30
31      "testx509.der",
32      "testrsa.der",
33      "testrsapub.der",
34      "testcrl.der",
35
36      ### generated locally
37
38      "rsa-key-pkcs1.pem", "rsa-key-pkcs1.der",
39      "rsa-key-pkcs1-aes128.pem",
40      "rsa-key-pkcs8.pem", "rsa-key-pkcs8.der",
41      "rsa-key-pkcs8-pbes1-sha1-3des.pem", "rsa-key-pkcs8-pbes1-sha1-3des.der",
42      "rsa-key-pkcs8-pbes2-sha1.pem", "rsa-key-pkcs8-pbes2-sha1.der",
43      "rsa-key-sha1-3des-sha1.p12", "rsa-key-sha1-3des-sha256.p12",
44      "rsa-key-aes256-cbc-sha256.p12",
45      "rsa-key-md5-des-sha1.p12",
46      "rsa-key-aes256-cbc-md5-des-sha256.p12",
47      "rsa-key-pkcs8-pbes2-sha256.pem", "rsa-key-pkcs8-pbes2-sha256.der",
48      "rsa-key-pkcs8-pbes1-md5-des.pem", "rsa-key-pkcs8-pbes1-md5-des.der",
49      "dsa-key-pkcs1.pem", "dsa-key-pkcs1.der",
50      "dsa-key-pkcs1-aes128.pem",
51      "dsa-key-pkcs8.pem", "dsa-key-pkcs8.der",
52      "dsa-key-pkcs8-pbes2-sha1.pem", "dsa-key-pkcs8-pbes2-sha1.der",
53      "dsa-key-aes256-cbc-sha256.p12",
54      "ec-key-pkcs1.pem", "ec-key-pkcs1.der",
55      "ec-key-pkcs1-aes128.pem",
56      "ec-key-pkcs8.pem", "ec-key-pkcs8.der",
57      "ec-key-pkcs8-pbes2-sha1.pem", "ec-key-pkcs8-pbes2-sha1.der",
58      "ec-key-aes256-cbc-sha256.p12",
59     );
60 my %generated_file_files =
61     $^O eq 'linux'
62     ? ( "test/testx509.pem" => "file:testx509.pem",
63         "test/testrsa.pem" => "file:testrsa.pem",
64         "test/testrsapub.pem" => "file:testrsapub.pem",
65         "test/testcrl.pem" => "file:testcrl.pem",
66         "apps/server.pem" => "file:server.pem" )
67     : ();
68 my @noexist_file_files =
69     ( "file:blahdiblah.pem",
70       "file:test/blahdibleh.der" );
71
72 my $n = (3 * scalar @noexist_files)
73     + (6 * scalar @src_files)
74     + (4 * scalar @generated_files)
75     + (scalar keys %generated_file_files)
76     + (scalar @noexist_file_files)
77     + 3
78     + 11;
79
80 plan tests => $n;
81
82 indir "store_$$" => sub {
83  SKIP:
84     {
85         skip "failed initialisation", $n unless init();
86
87         my $rehash = init_rehash();
88
89         foreach (@noexist_files) {
90             my $file = srctop_file($_);
91
92             ok(!run(app(["openssl", "storeutl", "-noout", $file])));
93             ok(!run(app(["openssl", "storeutl", "-noout",
94                          to_abs_file($file)])));
95             {
96                 local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
97
98                 ok(!run(app(["openssl", "storeutl", "-noout",
99                              to_abs_file_uri($file)])));
100             }
101         }
102         foreach (@src_files) {
103             my $file = srctop_file($_);
104
105             ok(run(app(["openssl", "storeutl", "-noout", $file])));
106             ok(run(app(["openssl", "storeutl", "-noout", to_abs_file($file)])));
107             {
108                 local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
109
110                 ok(run(app(["openssl", "storeutl", "-noout",
111                             to_abs_file_uri($file)])));
112                 ok(run(app(["openssl", "storeutl", "-noout",
113                             to_abs_file_uri($file, 0, "")])));
114                 ok(run(app(["openssl", "storeutl", "-noout",
115                             to_abs_file_uri($file, 0, "localhost")])));
116                 ok(!run(app(["openssl", "storeutl", "-noout",
117                              to_abs_file_uri($file, 0, "dummy")])));
118             }
119         }
120         foreach (@generated_files) {
121             ok(run(app(["openssl", "storeutl", "-noout", "-passin",
122                         "pass:password", $_])));
123             ok(run(app(["openssl", "storeutl",  "-noout", "-passin",
124                         "pass:password", to_abs_file($_)])));
125
126             {
127                 local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
128
129                 ok(run(app(["openssl", "storeutl", "-noout", "-passin",
130                             "pass:password", to_abs_file_uri($_)])));
131                 ok(!run(app(["openssl", "storeutl", "-noout", "-passin",
132                              "pass:password", to_file_uri($_)])));
133             }
134         }
135         foreach (values %generated_file_files) {
136             local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
137
138             ok(run(app(["openssl", "storeutl",  "-noout", $_])));
139         }
140         foreach (@noexist_file_files) {
141             local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
142
143             ok(!run(app(["openssl", "storeutl",  "-noout", $_])));
144         }
145         {
146             my $dir = srctop_dir("test", "certs");
147
148             ok(run(app(["openssl", "storeutl",  "-noout", $dir])));
149             ok(run(app(["openssl", "storeutl",  "-noout",
150                         to_abs_file($dir, 1)])));
151             {
152                 local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
153
154                 ok(run(app(["openssl", "storeutl",  "-noout",
155                             to_abs_file_uri($dir, 1)])));
156             }
157         }
158
159         ok(!run(app(['openssl', 'storeutl', '-noout',
160                      '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
161                      srctop_file('test', 'testx509.pem')])),
162            "Checking that -subject can't be used with a single file");
163
164         ok(run(app(['openssl', 'storeutl', '-certs', '-noout',
165                     srctop_file('test', 'testx509.pem')])),
166            "Checking that -certs returns 1 object on a certificate file");
167         ok(run(app(['openssl', 'storeutl', '-certs', '-noout',
168                      srctop_file('test', 'testcrl.pem')])),
169            "Checking that -certs returns 0 objects on a CRL file");
170
171         ok(run(app(['openssl', 'storeutl', '-crls', '-noout',
172                      srctop_file('test', 'testx509.pem')])),
173            "Checking that -crls returns 0 objects on a certificate file");
174         ok(run(app(['openssl', 'storeutl', '-crls', '-noout',
175                     srctop_file('test', 'testcrl.pem')])),
176            "Checking that -crls returns 1 object on a CRL file");
177
178     SKIP: {
179             skip "failed rehash initialisation", 6 unless $rehash;
180
181             # subject from testx509.pem:
182             # '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert'
183             # issuer from testcrl.pem:
184             # '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority'
185             ok(run(app(['openssl', 'storeutl', '-noout',
186                         '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
187                         catdir(curdir(), 'rehash')])));
188             ok(run(app(['openssl', 'storeutl', '-noout',
189                         '-subject',
190                         '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
191                         catdir(curdir(), 'rehash')])));
192             ok(run(app(['openssl', 'storeutl', '-noout', '-certs',
193                         '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
194                         catdir(curdir(), 'rehash')])));
195             ok(run(app(['openssl', 'storeutl', '-noout', '-crls',
196                         '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
197                         catdir(curdir(), 'rehash')])));
198             ok(run(app(['openssl', 'storeutl', '-noout', '-certs',
199                         '-subject',
200                         '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
201                         catdir(curdir(), 'rehash')])));
202             ok(run(app(['openssl', 'storeutl', '-noout', '-crls',
203                         '-subject',
204                         '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
205                         catdir(curdir(), 'rehash')])));
206         }
207     }
208 }, create => 1, cleanup => 1;
209
210 sub init {
211     return (
212             # rsa-key-pkcs1.pem
213             run(app(["openssl", "genrsa",
214                      "-out", "rsa-key-pkcs1.pem", "2432"]))
215             # dsa-key-pkcs1.pem
216             && run(app(["openssl", "dsaparam", "-genkey",
217                         "-out", "dsa-key-pkcs1.pem", "1024"]))
218             # ec-key-pkcs1.pem (one might think that 'genec' would be practical)
219             && run(app(["openssl", "ecparam", "-genkey", "-name", "prime256v1",
220                         "-out", "ec-key-pkcs1.pem"]))
221             # rsa-key-pkcs1-aes128.pem
222             && run(app(["openssl", "rsa", "-passout", "pass:password", "-aes128",
223                         "-in", "rsa-key-pkcs1.pem",
224                         "-out", "rsa-key-pkcs1-aes128.pem"]))
225             # dsa-key-pkcs1-aes128.pem
226             && run(app(["openssl", "dsa", "-passout", "pass:password", "-aes128",
227                         "-in", "dsa-key-pkcs1.pem",
228                         "-out", "dsa-key-pkcs1-aes128.pem"]))
229             # ec-key-pkcs1-aes128.pem
230             && run(app(["openssl", "ec", "-passout", "pass:password", "-aes128",
231                         "-in", "ec-key-pkcs1.pem",
232                         "-out", "ec-key-pkcs1-aes128.pem"]))
233             # *-key-pkcs8.pem
234             && runall(sub {
235                           my $dstfile = shift;
236                           (my $srcfile = $dstfile)
237                               =~ s/-key-pkcs8\.pem$/-key-pkcs1.pem/i;
238                           run(app(["openssl", "pkcs8", "-topk8", "-nocrypt",
239                                    "-in", $srcfile, "-out", $dstfile]));
240                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
241             # *-key-pkcs8-pbes1-sha1-3des.pem
242             && runall(sub {
243                           my $dstfile = shift;
244                           (my $srcfile = $dstfile)
245                               =~ s/-key-pkcs8-pbes1-sha1-3des\.pem$
246                                   /-key-pkcs8.pem/ix;
247                           run(app(["openssl", "pkcs8", "-topk8",
248                                    "-passout", "pass:password",
249                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
250                                    "-in", $srcfile, "-out", $dstfile]));
251                       }, grep(/-key-pkcs8-pbes1-sha1-3des\.pem$/, @generated_files))
252             # *-key-pkcs8-pbes1-md5-des.pem
253             && runall(sub {
254                           my $dstfile = shift;
255                           (my $srcfile = $dstfile)
256                               =~ s/-key-pkcs8-pbes1-md5-des\.pem$
257                                   /-key-pkcs8.pem/ix;
258                           run(app(["openssl", "pkcs8", "-topk8",
259                                    "-passout", "pass:password",
260                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
261                                    "-in", $srcfile, "-out", $dstfile]));
262                       }, grep(/-key-pkcs8-pbes1-md5-des\.pem$/, @generated_files))
263             # *-key-pkcs8-pbes2-sha1.pem
264             && runall(sub {
265                           my $dstfile = shift;
266                           (my $srcfile = $dstfile)
267                               =~ s/-key-pkcs8-pbes2-sha1\.pem$
268                                   /-key-pkcs8.pem/ix;
269                           run(app(["openssl", "pkcs8", "-topk8",
270                                    "-passout", "pass:password",
271                                    "-v2", "aes256", "-v2prf", "hmacWithSHA1",
272                                    "-in", $srcfile, "-out", $dstfile]));
273                       }, grep(/-key-pkcs8-pbes2-sha1\.pem$/, @generated_files))
274             # *-key-pkcs8-pbes2-sha1.pem
275             && runall(sub {
276                           my $dstfile = shift;
277                           (my $srcfile = $dstfile)
278                               =~ s/-key-pkcs8-pbes2-sha256\.pem$
279                                   /-key-pkcs8.pem/ix;
280                           run(app(["openssl", "pkcs8", "-topk8",
281                                    "-passout", "pass:password",
282                                    "-v2", "aes256", "-v2prf", "hmacWithSHA256",
283                                    "-in", $srcfile, "-out", $dstfile]));
284                       }, grep(/-key-pkcs8-pbes2-sha256\.pem$/, @generated_files))
285             # *-cert.pem (intermediary for the .p12 inits)
286             && run(app(["openssl", "req", "-x509",
287                         "-config", data_file("ca.cnf"), "-nodes",
288                         "-out", "cacert.pem", "-keyout", "cakey.pem"]))
289             && runall(sub {
290                           my $srckey = shift;
291                           (my $dstfile = $srckey) =~ s|-key-pkcs8\.|-cert.|;
292                           (my $csr = $dstfile) =~ s|\.pem|.csr|;
293
294                           (run(app(["openssl", "req", "-new",
295                                     "-config", data_file("user.cnf"),
296                                     "-key", $srckey, "-out", $csr]))
297                            &&
298                            run(app(["openssl", "x509", "-days", "3650",
299                                     "-CA", "cacert.pem",
300                                     "-CAkey", "cakey.pem",
301                                     "-set_serial", time(), "-req",
302                                     "-in", $csr, "-out", $dstfile])));
303                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
304             # *.p12
305             && runall(sub {
306                           my $dstfile = shift;
307                           my ($type, $certpbe_index, $keypbe_index,
308                               $macalg_index) =
309                               $dstfile =~ m{^(.*)-key-(?|
310                                                 # cert and key PBE are same
311                                                 ()             #
312                                                 ([^-]*-[^-]*)- # key & cert PBE
313                                                 ([^-]*)        # MACalg
314                                             |
315                                                 # cert and key PBE are not same
316                                                 ([^-]*-[^-]*)- # cert PBE
317                                                 ([^-]*-[^-]*)- # key PBE
318                                                 ([^-]*)        # MACalg
319                                             )\.}x;
320                           if (!$certpbe_index) {
321                               $certpbe_index = $keypbe_index;
322                           }
323                           my $srckey = "$type-key-pkcs8.pem";
324                           my $srccert = "$type-cert.pem";
325                           my %pbes =
326                               (
327                                "sha1-3des" => "pbeWithSHA1And3-KeyTripleDES-CBC",
328                                "md5-des" => "pbeWithMD5AndDES-CBC",
329                                "aes256-cbc" => "AES-256-CBC",
330                               );
331                           my %macalgs =
332                               (
333                                "sha1" => "SHA1",
334                                "sha256" => "SHA256",
335                               );
336                           my $certpbe = $pbes{$certpbe_index};
337                           my $keypbe = $pbes{$keypbe_index};
338                           my $macalg = $macalgs{$macalg_index};
339                           if (!defined($certpbe) || !defined($keypbe)
340                               || !defined($macalg)) {
341                               print STDERR "Cert PBE for $pbe_index not defined\n"
342                                   unless defined $certpbe;
343                               print STDERR "Key PBE for $pbe_index not defined\n"
344                                   unless defined $keypbe;
345                               print STDERR "MACALG for $macalg_index not defined\n"
346                                   unless defined $macalg;
347                               print STDERR "(destination file was $dstfile)\n";
348                               return 0;
349                           }
350                           run(app(["openssl", "pkcs12", "-inkey", $srckey,
351                                    "-in", $srccert, "-passout", "pass:password",
352                                    "-export", "-macalg", $macalg,
353                                    "-certpbe", $certpbe, "-keypbe", $keypbe,
354                                    "-out", $dstfile]));
355                       }, grep(/\.p12/, @generated_files))
356             # *.der (the end all init)
357             && runall(sub {
358                           my $dstfile = shift;
359                           (my $srcfile = $dstfile) =~ s/\.der$/.pem/i;
360                           if (! -f $srcfile) {
361                               $srcfile = srctop_file("test", $srcfile);
362                           }
363                           my $infh;
364                           unless (open $infh, $srcfile) {
365                               return 0;
366                           }
367                           my $l;
368                           while (($l = <$infh>) !~ /^-----BEGIN\s/
369                                  || $l =~ /^-----BEGIN.*PARAMETERS-----/) {
370                           }
371                           my $b64 = "";
372                           while (($l = <$infh>) !~ /^-----END\s/) {
373                               $l =~ s|\R$||;
374                               $b64 .= $l unless $l =~ /:/;
375                           }
376                           close $infh;
377                           my $der = decode_base64($b64);
378                           unless (length($b64) / 4 * 3 - length($der) < 3) {
379                               print STDERR "Length error, ",length($b64),
380                                   " bytes of base64 became ",length($der),
381                                   " bytes of der? ($srcfile => $dstfile)\n";
382                               return 0;
383                           }
384                           my $outfh;
385                           unless (open $outfh, ">:raw", $dstfile) {
386                               return 0;
387                           }
388                           print $outfh $der;
389                           close $outfh;
390                           return 1;
391                       }, grep(/\.der$/, @generated_files))
392             && runall(sub {
393                           my $srcfile = shift;
394                           my $dstfile = $generated_file_files{$srcfile};
395
396                           unless (copy srctop_file($srcfile), $dstfile) {
397                               warn "$!\n";
398                               return 0;
399                           }
400                           return 1;
401                       }, keys %generated_file_files)
402            );
403 }
404
405 sub init_rehash {
406     return (
407             mkdir(catdir(curdir(), 'rehash'))
408             && copy(srctop_file('test', 'testx509.pem'),
409                     catdir(curdir(), 'rehash'))
410             && copy(srctop_file('test', 'testcrl.pem'),
411                     catdir(curdir(), 'rehash'))
412             && run(app(['openssl', 'rehash', catdir(curdir(), 'rehash')]))
413            );
414 }
415
416 sub runall {
417     my ($function, @items) = @_;
418
419     foreach (@items) {
420         return 0 unless $function->($_);
421     }
422     return 1;
423 }
424
425 # According to RFC8089, a relative file: path is invalid.  We still produce
426 # them for testing purposes.
427 sub to_file_uri {
428     my ($file, $isdir, $authority) = @_;
429     my $vol;
430     my $dir;
431
432     die "to_file_uri: No file given\n" if !defined($file) || $file eq '';
433
434     ($vol, $dir, $file) = File::Spec->splitpath($file, $isdir // 0);
435
436     # Make sure we have a Unix style directory.
437     $dir = join('/', File::Spec->splitdir($dir));
438     # Canonicalise it (note: it seems to be only needed on Unix)
439     while (1) {
440         my $newdir = $dir;
441         $newdir =~ s|/[^/]*[^/\.]+[^/]*/\.\./|/|g;
442         last if $newdir eq $dir;
443         $dir = $newdir;
444     }
445     # Take care of the corner cases the loop can't handle, and that $dir
446     # ends with a / unless it's empty
447     $dir =~ s|/[^/]*[^/\.]+[^/]*/\.\.$|/|;
448     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\./|/|;
449     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\.$||;
450     if ($isdir // 0) {
451         $dir =~ s|/$|| if $dir ne '/';
452     } else {
453         $dir .= '/' if $dir ne '' && $dir !~ m|/$|;
454     }
455
456     # If the file system has separate volumes (at present, Windows and VMS)
457     # we need to handle them.  In URIs, they are invariably the first
458     # component of the path, which is always absolute.
459     # On VMS, user:[foo.bar] translates to /user/foo/bar
460     # On Windows, c:\Users\Foo translates to /c:/Users/Foo
461     if ($vol ne '') {
462         $vol =~ s|:||g if ($^O eq "VMS");
463         $dir = '/' . $dir if $dir ne '' && $dir !~ m|^/|;
464         $dir = '/' . $vol . $dir;
465     }
466     $file = $dir . $file;
467
468     return "file://$authority$file" if defined $authority;
469     return "file:$file";
470 }
471
472 sub to_abs_file {
473     my ($file) = @_;
474
475     return File::Spec->rel2abs($file);
476 }
477
478 sub to_abs_file_uri {
479     my ($file, $isdir, $authority) = @_;
480
481     die "to_abs_file_uri: No file given\n" if !defined($file) || $file eq '';
482     return to_file_uri(to_abs_file($file), $isdir, $authority);
483 }