Add a test that checks the store utility
[openssl.git] / test / recipes / 90-test_store.t
1 #! /usr/bin/env perl
2 # Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved.
3 #
4 # Licensed under the OpenSSL license (the "License").  You may not use
5 # this file except in compliance with the License.  You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
8
9 use File::Spec;
10 use MIME::Base64;
11 use OpenSSL::Test qw(:DEFAULT srctop_file bldtop_file);
12
13 my $test_name = "test_store";
14 setup($test_name);
15
16 my @noexist_files =
17     ( "test/blahdiblah.pem",
18       "test/blahdibleh.der" );
19 my @src_files =
20     ( "test/testx509.pem",
21       "test/testrsa.pem",
22       "test/testrsapub.pem",
23       "test/testcrl.pem",
24       "apps/server.pem" );
25 my @generated_files =
26     (
27      ### generated from the source files
28
29      "testx509.der",
30      "testrsa.der",
31      "testrsapub.der",
32      "testcrl.der",
33
34      ### generated locally
35      ### These examples were pilfered from OpenConnect's test suite
36
37      "rsa-key-pkcs1.pem", "rsa-key-pkcs1.der",
38      "rsa-key-pkcs1-aes128.pem",
39      "rsa-key-pkcs8.pem", "rsa-key-pkcs8.der",
40      "rsa-key-pkcs8-pbes1-sha1-3des.pem", "rsa-key-pkcs8-pbes1-sha1-3des.der",
41      "rsa-key-pkcs8-pbes2-sha1.pem", "rsa-key-pkcs8-pbes2-sha1.der",
42      "rsa-key-sha1-3des-sha1.p12", "rsa-key-sha1-3des-sha256.p12",
43      "rsa-key-aes256-cbc-sha256.p12",
44      "rsa-key-md5-des-sha1.p12",
45      "rsa-key-aes256-cbc-md5-des-sha256.p12",
46      "rsa-key-pkcs8-pbes2-sha256.pem", "rsa-key-pkcs8-pbes2-sha256.der",
47      "rsa-key-pkcs8-pbes1-md5-des.pem", "rsa-key-pkcs8-pbes1-md5-des.der",
48      "dsa-key-pkcs1.pem", "dsa-key-pkcs1.der",
49      "dsa-key-pkcs1-aes128.pem",
50      "dsa-key-pkcs8.pem", "dsa-key-pkcs8.der",
51      "dsa-key-pkcs8-pbes2-sha1.pem", "dsa-key-pkcs8-pbes2-sha1.der",
52      "dsa-key-aes256-cbc-sha256.p12",
53      "ec-key-pkcs1.pem", "ec-key-pkcs1.der",
54      "ec-key-pkcs1-aes128.pem",
55      "ec-key-pkcs8.pem", "ec-key-pkcs8.der",
56      "ec-key-pkcs8-pbes2-sha1.pem", "ec-key-pkcs8-pbes2-sha1.der",
57      "ec-key-aes256-cbc-sha256.p12",
58     );
59
60 my $n = (2 * scalar @noexist_files)
61     + (5 * scalar @src_files)
62     + (3 * scalar @generated_files);
63
64 plan tests => $n;
65
66 indir "store_$$" => sub {
67  SKIP:
68     {
69         skip "failed initialisation", $n unless init();
70
71         foreach (@noexist_files) {
72             my $file = srctop_file($_);
73             ok(!run(app(["openssl", "storeutl", $file])));
74             ok(!run(app(["openssl", "storeutl", to_file_uri($file)])));
75         }
76         foreach (@src_files) {
77             my $file = srctop_file($_);
78             ok(run(app(["openssl", "storeutl", $file])));
79             ok(run(app(["openssl", "storeutl", to_file_uri($file)])));
80             ok(run(app(["openssl", "storeutl", to_file_uri($file, 0,
81                                                            "")])));
82             ok(run(app(["openssl", "storeutl", to_file_uri($file, 0,
83                                                            "localhost")])));
84             ok(!run(app(["openssl", "storeutl", to_file_uri($file, 0,
85                                                             "dummy")])));
86         }
87         foreach (@generated_files) {
88         SKIP:
89             {
90                 skip "PKCS#12 files not currently supported", 3 if m|\.p12$|;
91
92                 ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
93                             $_])));
94                 ok(run(app(["openssl", "storeutl", "-passin", "pass:password",
95                             to_file_uri($_)])));
96                 ok(!run(app(["openssl", "storeutl", "-passin", "pass:password",
97                              to_rel_file_uri($_)])));
98             }
99         }
100     }
101 }, create => 1, cleanup => 1;
102
103 sub init {
104     return (
105             # rsa-key-pkcs1.pem
106             run(app(["openssl", "genrsa",
107                      "-out", "rsa-key-pkcs1.pem", "2432"]))
108             # dsa-key-pkcs1.pem
109             && run(app(["openssl", "dsaparam", "-genkey",
110                         "-out", "dsa-key-pkcs1.pem", "1024"]))
111             # ec-key-pkcs1.pem (one might think that 'genec' would be practical)
112             && run(app(["openssl", "ecparam", "-genkey", "-name", "prime256v1",
113                         "-out", "ec-key-pkcs1.pem"]))
114             # rsa-key-pkcs1-aes128.pem
115             && run(app(["openssl", "rsa", "-passout", "pass:password", "-aes128",
116                         "-in", "rsa-key-pkcs1.pem",
117                         "-out", "rsa-key-pkcs1-aes128.pem"]))
118             # dsa-key-pkcs1-aes128.pem
119             && run(app(["openssl", "dsa", "-passout", "pass:password", "-aes128",
120                         "-in", "dsa-key-pkcs1.pem",
121                         "-out", "dsa-key-pkcs1-aes128.pem"]))
122             # ec-key-pkcs1-aes128.pem
123             && run(app(["openssl", "ec", "-passout", "pass:password", "-aes128",
124                         "-in", "ec-key-pkcs1.pem",
125                         "-out", "ec-key-pkcs1-aes128.pem"]))
126             # *-key-pkcs8.pem
127             && runall(sub {
128                           my $dstfile = shift;
129                           (my $srcfile = $dstfile)
130                               =~ s/-key-pkcs8\.pem$/-key-pkcs1.pem/i;
131                           run(app(["openssl", "pkcs8", "-topk8", "-nocrypt",
132                                    "-in", $srcfile, "-out", $dstfile]));
133                       }, grep(/-key-pkcs8\.pem$/, @generated_files))
134             # *-key-pkcs8-pbes1-sha1-3des.pem
135             && runall(sub {
136                           my $dstfile = shift;
137                           (my $srcfile = $dstfile)
138                               =~ s/-key-pkcs8-pbes1-sha1-3des\.pem$
139                                   /-key-pkcs8.pem/ix;
140                           run(app(["openssl", "pkcs8", "-topk8",
141                                    "-passout", "pass:password",
142                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
143                                    "-in", $srcfile, "-out", $dstfile]));
144                       }, grep(/-key-pkcs8-pbes1-sha1-3des\.pem$/, @generated_files))
145             # *-key-pkcs8-pbes1-md5-des.pem
146             && runall(sub {
147                           my $dstfile = shift;
148                           (my $srcfile = $dstfile)
149                               =~ s/-key-pkcs8-pbes1-md5-des\.pem$
150                                   /-key-pkcs8.pem/ix;
151                           run(app(["openssl", "pkcs8", "-topk8",
152                                    "-passout", "pass:password",
153                                    "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
154                                    "-in", $srcfile, "-out", $dstfile]));
155                       }, grep(/-key-pkcs8-pbes1-md5-des\.pem$/, @generated_files))
156             # *-key-pkcs8-pbes2-sha1.pem
157             && runall(sub {
158                           my $dstfile = shift;
159                           (my $srcfile = $dstfile)
160                               =~ s/-key-pkcs8-pbes2-sha1\.pem$
161                                   /-key-pkcs8.pem/ix;
162                           run(app(["openssl", "pkcs8", "-topk8",
163                                    "-passout", "pass:password",
164                                    "-v2", "aes256", "-v2prf", "hmacWithSHA1",
165                                    "-in", $srcfile, "-out", $dstfile]));
166                       }, grep(/-key-pkcs8-pbes2-sha1\.pem$/, @generated_files))
167             # *-key-pkcs8-pbes2-sha1.pem
168             && runall(sub {
169                           my $dstfile = shift;
170                           (my $srcfile = $dstfile)
171                               =~ s/-key-pkcs8-pbes2-sha256\.pem$
172                                   /-key-pkcs8.pem/ix;
173                           run(app(["openssl", "pkcs8", "-topk8",
174                                    "-passout", "pass:password",
175                                    "-v2", "aes256", "-v2prf", "hmacWithSHA256",
176                                    "-in", $srcfile, "-out", $dstfile]));
177                       }, grep(/-key-pkcs8-pbes2-sha256\.pem$/, @generated_files))
178             # *.der (the end all init)
179             && runall(sub {
180                           my $dstfile = shift;
181                           (my $srcfile = $dstfile) =~ s/\.der$/.pem/i;
182                           if (! -f $srcfile) {
183                               $srcfile = srctop_file("test", $srcfile);
184                           }
185                           my $infh;
186                           unless (open $infh, $srcfile) {
187                               return 0;
188                           }
189                           my $l;
190                           while (($l = <$infh>) !~ /^-----BEGIN\s/
191                                  || $l =~ /^-----BEGIN.*PARAMETERS-----/) {
192                           }
193                           my $b64 = "";
194                           while (($l = <$infh>) !~ /^-----END\s/) {
195                               $l =~ s|\R$||;
196                               $b64 .= $l unless $l =~ /:/;
197                           }
198                           close $infh;
199                           my $der = decode_base64($b64);
200                           unless (length($b64) / 4 * 3 - length($der) < 3) {
201                               print STDERR "Length error, ",length($b64),
202                                   " bytes of base64 became ",length($der),
203                                   " bytes of der? ($srcfile => $dstfile)\n";
204                               return 0;
205                           }
206                           my $outfh;
207                           unless (open $outfh, ">:raw", $dstfile) {
208                               return 0;
209                           }
210                           print $outfh $der;
211                           close $outfh;
212                           return 1;
213                       }, grep(/\.der$/, @generated_files))
214            );
215 }
216
217 sub runall {
218     my ($function, @items) = @_;
219
220     foreach (@items) {
221         return 0 unless $function->($_);
222     }
223     return 1;
224 }
225
226 # According to RFC8089, a relative file: path is invalid.  We still produce
227 # them for testing purposes.
228 sub to_rel_file_uri {
229     my ($file, $isdir, $authority) = @_;
230     my $vol;
231     my $dir;
232
233     die "to_rel_file_uri: No file given\n" if !defined($file) || $file eq '';
234
235     ($vol, $dir, $file) = File::Spec->splitpath($file, $isdir // 0);
236
237     # Make sure we have a Unix style directory.
238     $dir = join('/', File::Spec->splitdir($dir));
239     # Canonicalise it (note: it seems to be only needed on Unix)
240     while (1) {
241         my $newdir = $dir;
242         $newdir =~ s|/[^/]*[^/\.]+[^/]*/\.\./|/|g;
243         last if $newdir eq $dir;
244         $dir = $newdir;
245     }
246     # Take care of the corner cases the loop can't handle, and that $dir
247     # ends with a / unless it's empty
248     $dir =~ s|/[^/]*[^/\.]+[^/]*/\.\.$|/|;
249     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\./|/|;
250     $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\.$||;
251     if ($isdir // 0) {
252         $dir =~ s|/$|| if $dir ne '/';
253     } else {
254         $dir .= '/' if $dir ne '' && $dir !~ m|/$|;
255     }
256
257     # If the file system has separate volumes (at present, Windows and VMS)
258     # we need to handle them.  In URIs, they are invariably the first
259     # component of the path, which is always absolute.
260     # On VMS, user:[foo.bar] translates to /user/foo/bar
261     # On Windows, c:\Users\Foo translates to /c:/Users/Foo
262     if ($vol ne '') {
263         $vol =~ s|:||g if ($^O eq "VMS");
264         $dir = '/' . $dir if $dir ne '' && $dir !~ m|^/|;
265         $dir = '/' . $vol . $dir;
266     }
267     $file = $dir . $file;
268
269     return "file://$authority$file" if defined $authority;
270     return "file:$file";
271 }
272
273 sub to_file_uri {
274     my ($file, $isdir, $authority) = @_;
275
276     die "to_file_uri: No file given\n" if !defined($file) || $file eq '';
277     return to_rel_file_uri(File::Spec->rel2abs($file), $isdir, $authority);
278 }