2 # Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
9 use File::Spec::Functions;
12 use OpenSSL::Test qw(:DEFAULT srctop_file srctop_dir bldtop_file bldtop_dir
14 use OpenSSL::Test::Utils;
16 my $test_name = "test_store";
19 my $use_md5 = !disabled("md5");
20 my $use_des = !(disabled("des") || disabled("legacy")); # also affects 3des and pkcs12 app
21 my $use_dsa = !disabled("dsa");
22 my $use_ecc = !disabled("ec");
25 ( "test/blahdiblah.pem",
26 "test/blahdibleh.der" );
28 ( "test/testx509.pem",
30 "test/testrsapub.pem",
37 unless disabled("legacy") || disabled("rc4");
40 "test/testrsapub.pem" );
43 ### generated from the source files
52 "rsa-key-pkcs1.pem", "rsa-key-pkcs1.der",
53 "rsa-key-pkcs1-aes128.pem",
54 "rsa-key-pkcs8.pem", "rsa-key-pkcs8.der",
55 "rsa-key-pkcs8-pbes2-sha1.pem", "rsa-key-pkcs8-pbes2-sha1.der",
56 "rsa-key-pkcs8-pbes2-sha256.pem", "rsa-key-pkcs8-pbes2-sha256.der",
58 push(@generated_files, (
59 "rsa-key-pkcs8-pbes1-sha1-3des.pem", "rsa-key-pkcs8-pbes1-sha1-3des.der",
61 push(@generated_files, (
62 "rsa-key-sha1-3des-sha1.p12", "rsa-key-sha1-3des-sha256.p12",
63 "rsa-key-aes256-cbc-sha256.p12",
64 "rsa-key-md5-des-sha1.p12",
65 "rsa-key-aes256-cbc-md5-des-sha256.p12"
67 push(@generated_files, (
68 "rsa-key-pkcs8-pbes1-md5-des.pem", "rsa-key-pkcs8-pbes1-md5-des.der"
69 )) if $use_md5 && $use_des;
70 push(@generated_files, (
71 "dsa-key-pkcs1.pem", "dsa-key-pkcs1.der",
72 "dsa-key-pkcs1-aes128.pem",
73 "dsa-key-pkcs8.pem", "dsa-key-pkcs8.der",
74 "dsa-key-pkcs8-pbes2-sha1.pem", "dsa-key-pkcs8-pbes2-sha1.der",
76 push(@generated_files, "dsa-key-aes256-cbc-sha256.p12") if $use_dsa && $use_des;
77 push(@generated_files, (
78 "ec-key-pkcs1.pem", "ec-key-pkcs1.der",
79 "ec-key-pkcs1-aes128.pem",
80 "ec-key-pkcs8.pem", "ec-key-pkcs8.der",
81 "ec-key-pkcs8-pbes2-sha1.pem", "ec-key-pkcs8-pbes2-sha1.der",
83 push(@generated_files, "ec-key-aes256-cbc-sha256.p12") if $use_ecc && $use_des;
84 my %generated_file_files =
86 ? ( "test/testx509.pem" => "file:testx509.pem",
87 "test/testrsa.pem" => "file:testrsa.pem",
88 "test/testrsapub.pem" => "file:testrsapub.pem",
89 "test/testcrl.pem" => "file:testcrl.pem",
90 "apps/server.pem" => "file:server.pem" )
92 my @noexist_file_files =
93 ( "file:blahdiblah.pem",
94 "file:test/blahdibleh.der" );
96 # There is more than one method to get a 'file:' loader.
97 # The default is a built-in provider implementation.
98 # However, there is also an engine, specially for testing purposes.
100 # @methods is a collection of extra 'openssl storeutl' arguments used to
101 # try the different methods.
103 my @prov_method = qw(-provider default);
104 push @prov_method, qw(-provider legacy) unless disabled('legacy');
105 push @methods, [ @prov_method ];
106 push @methods, [qw(-engine loader_attic)]
107 unless disabled('loadereng');
109 my $n = scalar @methods
110 * ( (3 * scalar @noexist_files)
111 + (6 * scalar @src_files)
112 + (2 * scalar @data_files)
113 + (4 * scalar @generated_files)
114 + (scalar keys %generated_file_files)
115 + (scalar @noexist_file_files)
119 # Test doesn't work under msys because the file name munging doesn't work
120 # correctly with the "ot:" prefix
121 my $do_test_ossltest_store =
122 !(disabled("engine") || disabled("dynamic-engine") || $^O =~ /^msys$/);
124 if ($do_test_ossltest_store) {
125 # test loading with apps 'org.openssl.engine:' loader, using the
127 $n += 4 * scalar @src_rsa_files;
130 plan skip_all => "No plan" if $n == 0;
134 indir "store_$$" => sub {
135 if ($do_test_ossltest_store) {
136 # ossltest loads PEM files, with names prefixed with 'ot:'.
137 # This prefix ensures that the files are, in fact, loaded through
138 # that engine and not mistakenly going through the 'file:' loader.
140 my $engine_scheme = 'org.openssl.engine:';
141 $ENV{OPENSSL_ENGINES} = bldtop_dir("engines");
143 foreach (@src_rsa_files) {
144 my $file = srctop_file($_);
145 my $file_abs = to_abs_file($file);
146 my @pubin = $_ =~ m|pub\.pem$| ? ("-pubin") : ();
148 ok(run(app(["openssl", "rsa", "-text", "-noout", @pubin,
149 "-engine", "ossltest", "-inform", "engine",
150 "-in", "ot:$file"])));
151 ok(run(app(["openssl", "rsa", "-text", "-noout", @pubin,
152 "-engine", "ossltest", "-inform", "engine",
153 "-in", "ot:$file_abs"])));
154 ok(run(app(["openssl", "rsa", "-text", "-noout", @pubin,
155 "-in", "${engine_scheme}ossltest:ot:$file"])));
156 ok(run(app(["openssl", "rsa", "-text", "-noout", @pubin,
157 "-in", "${engine_scheme}ossltest:ot:$file_abs"])));
163 init() or die "init failed";
165 my $rehash = init_rehash();
167 foreach my $method (@methods) {
168 my @storeutl = ( qw(openssl storeutl), @$method );
170 foreach (@noexist_files) {
171 my $file = srctop_file($_);
173 ok(!run(app([@storeutl, "-noout", $file])));
174 ok(!run(app([@storeutl, "-noout", to_abs_file($file)])));
176 local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
178 ok(!run(app([@storeutl, "-noout",
179 to_abs_file_uri($file)])));
182 foreach (@src_files) {
183 my $file = srctop_file($_);
185 ok(run(app([@storeutl, "-noout", $file])));
186 ok(run(app([@storeutl, "-noout", to_abs_file($file)])));
189 skip "file: tests disabled on MingW", 4 if $^O =~ /^msys$/;
191 ok(run(app([@storeutl, "-noout",
192 to_abs_file_uri($file)])));
193 ok(run(app([@storeutl, "-noout",
194 to_abs_file_uri($file, 0, "")])));
195 ok(run(app([@storeutl, "-noout",
196 to_abs_file_uri($file, 0, "localhost")])));
197 ok(!run(app([@storeutl, "-noout",
198 to_abs_file_uri($file, 0, "dummy")])));
201 foreach (@data_files) {
202 my $file = data_file($_);
204 ok(run(app([@storeutl, "-noout", "-passin", "pass:password",
206 ok(run(app([@storeutl, "-noout", "-passin", "pass:password",
207 to_abs_file($file)])));
209 foreach (@generated_files) {
210 ok(run(app([@storeutl, "-noout", "-passin", "pass:password",
212 ok(run(app([@storeutl, "-noout", "-passin", "pass:password",
217 skip "file: tests disabled on MingW", 2 if $^O =~ /^msys$/;
219 ok(run(app([@storeutl, "-noout", "-passin",
220 "pass:password", to_abs_file_uri($_)])));
221 ok(!run(app([@storeutl, "-noout", "-passin",
222 "pass:password", to_file_uri($_)])));
225 foreach (values %generated_file_files) {
228 skip "file: tests disabled on MingW", 1 if $^O =~ /^msys$/;
230 ok(run(app([@storeutl, "-noout", $_])));
233 foreach (@noexist_file_files) {
236 skip "file: tests disabled on MingW", 1 if $^O =~ /^msys$/;
238 ok(!run(app([@storeutl, "-noout", $_])));
242 my $dir = srctop_dir("test", "certs");
244 ok(run(app([@storeutl, "-noout", $dir])));
245 ok(run(app([@storeutl, "-noout", to_abs_file($dir, 1)])));
248 skip "file: tests disabled on MingW", 1 if $^O =~ /^msys$/;
250 ok(run(app([@storeutl, "-noout",
251 to_abs_file_uri($dir, 1)])));
255 ok(!run(app([@storeutl, '-noout',
256 '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
257 srctop_file('test', 'testx509.pem')])),
258 "Checking that -subject can't be used with a single file");
260 ok(run(app([@storeutl, '-certs', '-noout',
261 srctop_file('test', 'testx509.pem')])),
262 "Checking that -certs returns 1 object on a certificate file");
263 ok(run(app([@storeutl, '-certs', '-noout',
264 srctop_file('test', 'testcrl.pem')])),
265 "Checking that -certs returns 0 objects on a CRL file");
267 ok(run(app([@storeutl, '-crls', '-noout',
268 srctop_file('test', 'testx509.pem')])),
269 "Checking that -crls returns 0 objects on a certificate file");
270 ok(run(app([@storeutl, '-crls', '-noout',
271 srctop_file('test', 'testcrl.pem')])),
272 "Checking that -crls returns 1 object on a CRL file");
275 skip "failed rehash initialisation", 6 unless $rehash;
277 # subject from testx509.pem:
278 # '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert'
279 # issuer from testcrl.pem:
280 # '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority'
281 ok(run(app([@storeutl, '-noout',
282 '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
283 catdir(curdir(), 'rehash')])));
284 ok(run(app([@storeutl, '-noout',
286 '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
287 catdir(curdir(), 'rehash')])));
288 ok(run(app([@storeutl, '-noout', '-certs',
289 '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
290 catdir(curdir(), 'rehash')])));
291 ok(run(app([@storeutl, '-noout', '-crls',
292 '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
293 catdir(curdir(), 'rehash')])));
294 ok(run(app([@storeutl, '-noout', '-certs',
296 '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
297 catdir(curdir(), 'rehash')])));
298 ok(run(app([@storeutl, '-noout', '-crls',
300 '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
301 catdir(curdir(), 'rehash')])));
305 }, create => 1, cleanup => 1;
308 my $cnf = srctop_file('test', 'ca-and-certs.cnf');
309 my $cakey = srctop_file('test', 'certs', 'ca-key.pem');
310 my @std_args = qw(-provider default);
311 push @std_args, qw(-provider legacy)
312 unless disabled('legacy');
315 run(app(["openssl", "pkey", @std_args,
316 "-in", data_file("rsa-key-2432.pem"),
317 "-out", "rsa-key-pkcs1.pem"]))
318 # rsa-key-pkcs1-aes128.pem
319 && run(app(["openssl", "rsa", @std_args,
320 "-passout", "pass:password", "-aes128",
321 "-in", "rsa-key-pkcs1.pem",
322 "-out", "rsa-key-pkcs1-aes128.pem"]))
325 || run(app(["openssl", "gendsa", @std_args,
326 "-out", "dsa-key-pkcs1.pem",
327 data_file("dsaparam.pem")])))
328 # dsa-key-pkcs1-aes128.pem
330 || run(app(["openssl", "dsa", @std_args,
331 "-passout", "pass:password", "-aes128",
332 "-in", "dsa-key-pkcs1.pem",
333 "-out", "dsa-key-pkcs1-aes128.pem"])))
334 # ec-key-pkcs1.pem (one might think that 'genec' would be practical)
336 || run(app(["openssl", "ecparam", @std_args,
338 "-name", "prime256v1",
339 "-out", "ec-key-pkcs1.pem"])))
340 # ec-key-pkcs1-aes128.pem
342 || run(app(["openssl", "ec", @std_args,
343 "-passout", "pass:password", "-aes128",
344 "-in", "ec-key-pkcs1.pem",
345 "-out", "ec-key-pkcs1-aes128.pem"])))
349 (my $srcfile = $dstfile)
350 =~ s/-key-pkcs8\.pem$/-key-pkcs1.pem/i;
351 run(app(["openssl", "pkcs8", @std_args,
352 "-topk8", "-nocrypt",
353 "-in", $srcfile, "-out", $dstfile]));
354 }, grep(/-key-pkcs8\.pem$/, @generated_files))
355 # *-key-pkcs8-pbes1-sha1-3des.pem
358 (my $srcfile = $dstfile)
359 =~ s/-key-pkcs8-pbes1-sha1-3des\.pem$
361 run(app(["openssl", "pkcs8", @std_args,
363 "-passout", "pass:password",
364 "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
365 "-in", $srcfile, "-out", $dstfile]));
366 }, grep(/-key-pkcs8-pbes1-sha1-3des\.pem$/, @generated_files))
367 # *-key-pkcs8-pbes1-md5-des.pem
370 (my $srcfile = $dstfile)
371 =~ s/-key-pkcs8-pbes1-md5-des\.pem$
373 run(app(["openssl", "pkcs8", @std_args,
375 "-passout", "pass:password",
376 "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
377 "-in", $srcfile, "-out", $dstfile]));
378 }, grep(/-key-pkcs8-pbes1-md5-des\.pem$/, @generated_files))
379 # *-key-pkcs8-pbes2-sha1.pem
382 (my $srcfile = $dstfile)
383 =~ s/-key-pkcs8-pbes2-sha1\.pem$
385 run(app(["openssl", "pkcs8", @std_args,
387 "-passout", "pass:password",
388 "-v2", "aes256", "-v2prf", "hmacWithSHA1",
389 "-in", $srcfile, "-out", $dstfile]));
390 }, grep(/-key-pkcs8-pbes2-sha1\.pem$/, @generated_files))
391 # *-key-pkcs8-pbes2-sha1.pem
394 (my $srcfile = $dstfile)
395 =~ s/-key-pkcs8-pbes2-sha256\.pem$
397 run(app(["openssl", "pkcs8", @std_args,
399 "-passout", "pass:password",
400 "-v2", "aes256", "-v2prf", "hmacWithSHA256",
401 "-in", $srcfile, "-out", $dstfile]));
402 }, grep(/-key-pkcs8-pbes2-sha256\.pem$/, @generated_files))
403 # *-cert.pem (intermediary for the .p12 inits)
404 && run(app(["openssl", "req", "-x509", @std_args,
405 "-config", $cnf, "-reqexts", "v3_ca", "-noenc",
406 "-key", $cakey, "-out", "cacert.pem"]))
409 (my $dstfile = $srckey) =~ s|-key-pkcs8\.|-cert.|;
410 (my $csr = $dstfile) =~ s|\.pem|.csr|;
412 (run(app(["openssl", "req", "-new", @std_args,
413 "-config", $cnf, "-section", "userreq",
414 "-key", $srckey, "-out", $csr]))
416 run(app(["openssl", "x509", @std_args,
420 "-set_serial", time(), "-req",
421 "-in", $csr, "-out", $dstfile])));
422 }, grep(/-key-pkcs8\.pem$/, @generated_files))
426 my ($type, $certpbe_index, $keypbe_index,
428 $dstfile =~ m{^(.*)-key-(?|
429 # cert and key PBE are same
431 ([^-]*-[^-]*)- # key & cert PBE
434 # cert and key PBE are not same
435 ([^-]*-[^-]*)- # cert PBE
436 ([^-]*-[^-]*)- # key PBE
439 if (!$certpbe_index) {
440 $certpbe_index = $keypbe_index;
442 my $srckey = "$type-key-pkcs8.pem";
443 my $srccert = "$type-cert.pem";
446 "sha1-3des" => "pbeWithSHA1And3-KeyTripleDES-CBC",
447 "md5-des" => "pbeWithMD5AndDES-CBC",
448 "aes256-cbc" => "AES-256-CBC",
453 "sha256" => "SHA256",
455 my $certpbe = $pbes{$certpbe_index};
456 my $keypbe = $pbes{$keypbe_index};
457 my $macalg = $macalgs{$macalg_index};
458 if (!defined($certpbe) || !defined($keypbe)
459 || !defined($macalg)) {
460 print STDERR "Cert PBE for $certpbe_index not defined\n"
461 unless defined $certpbe;
462 print STDERR "Key PBE for $keypbe_index not defined\n"
463 unless defined $keypbe;
464 print STDERR "MACALG for $macalg_index not defined\n"
465 unless defined $macalg;
466 print STDERR "(destination file was $dstfile)\n";
469 run(app(["openssl", "pkcs12", @std_args,
471 "-in", $srccert, "-passout", "pass:password",
472 "-chain", "-CAfile", "cacert.pem",
473 "-export", "-macalg", $macalg,
474 "-certpbe", $certpbe, "-keypbe", $keypbe,
476 }, grep(/\.p12/, @generated_files))
477 # *.der (the end all init)
480 (my $srcfile = $dstfile) =~ s/\.der$/.pem/i;
482 $srcfile = srctop_file("test", $srcfile);
485 unless (open $infh, $srcfile) {
489 while (($l = <$infh>) !~ /^-----BEGIN\s/
490 || $l =~ /^-----BEGIN.*PARAMETERS-----/) {
493 while (($l = <$infh>) !~ /^-----END\s/) {
495 $b64 .= $l unless $l =~ /:/;
498 my $der = decode_base64($b64);
499 unless (length($b64) / 4 * 3 - length($der) < 3) {
500 print STDERR "Length error, ",length($b64),
501 " bytes of base64 became ",length($der),
502 " bytes of der? ($srcfile => $dstfile)\n";
506 unless (open $outfh, ">:raw", $dstfile) {
512 }, grep(/\.der$/, @generated_files))
515 my $dstfile = $generated_file_files{$srcfile};
517 unless (copy srctop_file($srcfile), $dstfile) {
522 }, keys %generated_file_files)
528 mkdir(catdir(curdir(), 'rehash'))
529 && copy(srctop_file('test', 'testx509.pem'),
530 catdir(curdir(), 'rehash'))
531 && copy(srctop_file('test', 'testcrl.pem'),
532 catdir(curdir(), 'rehash'))
533 && run(app(['openssl', 'rehash', catdir(curdir(), 'rehash')]))
538 my ($function, @items) = @_;
541 return 0 unless $function->($_);
546 # According to RFC8089, a relative file: path is invalid. We still produce
547 # them for testing purposes.
549 my ($file, $isdir, $authority) = @_;
553 die "to_file_uri: No file given\n" if !defined($file) || $file eq '';
555 ($vol, $dir, $file) = File::Spec->splitpath($file, $isdir // 0);
557 # Make sure we have a Unix style directory.
558 $dir = join('/', File::Spec->splitdir($dir));
559 # Canonicalise it (note: it seems to be only needed on Unix)
562 $newdir =~ s|/[^/]*[^/\.]+[^/]*/\.\./|/|g;
563 last if $newdir eq $dir;
566 # Take care of the corner cases the loop can't handle, and that $dir
567 # ends with a / unless it's empty
568 $dir =~ s|/[^/]*[^/\.]+[^/]*/\.\.$|/|;
569 $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\./|/|;
570 $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\.$||;
572 $dir =~ s|/$|| if $dir ne '/';
574 $dir .= '/' if $dir ne '' && $dir !~ m|/$|;
577 # If the file system has separate volumes (at present, Windows and VMS)
578 # we need to handle them. In URIs, they are invariably the first
579 # component of the path, which is always absolute.
580 # On VMS, user:[foo.bar] translates to /user/foo/bar
581 # On Windows, c:\Users\Foo translates to /c:/Users/Foo
583 $vol =~ s|:||g if ($^O eq "VMS");
584 $dir = '/' . $dir if $dir ne '' && $dir !~ m|^/|;
585 $dir = '/' . $vol . $dir;
587 $file = $dir . $file;
589 return "file://$authority$file" if defined $authority;
596 return File::Spec->rel2abs($file);
599 sub to_abs_file_uri {
600 my ($file, $isdir, $authority) = @_;
602 die "to_abs_file_uri: No file given\n" if !defined($file) || $file eq '';
603 return to_file_uri(to_abs_file($file), $isdir, $authority);