| 1 | #! /usr/bin/env perl
|
|---|
| 2 | # Copyright 2007-2022 The OpenSSL Project Authors. All Rights Reserved.
|
|---|
| 3 | # Copyright Nokia 2007-2019
|
|---|
| 4 | # Copyright Siemens AG 2015-2019
|
|---|
| 5 | #
|
|---|
| 6 | # Licensed under the Apache License 2.0 (the "License"). You may not use
|
|---|
| 7 | # this file except in compliance with the License. You can obtain a copy
|
|---|
| 8 | # in the file LICENSE in the source distribution or at
|
|---|
| 9 | # https://www.openssl.org/source/license.html
|
|---|
| 10 |
|
|---|
| 11 | use strict;
|
|---|
| 12 | use warnings;
|
|---|
| 13 |
|
|---|
| 14 | use POSIX;
|
|---|
| 15 | use OpenSSL::Test qw/:DEFAULT cmdstr data_file data_dir srctop_dir bldtop_dir result_dir/;
|
|---|
| 16 | use OpenSSL::Test::Utils;
|
|---|
| 17 |
|
|---|
| 18 | BEGIN {
|
|---|
| 19 | setup("test_cmp_http");
|
|---|
| 20 | }
|
|---|
| 21 | use lib srctop_dir('Configurations');
|
|---|
| 22 | use lib bldtop_dir('.');
|
|---|
| 23 |
|
|---|
| 24 | plan skip_all => "These tests are not supported in a fuzz build"
|
|---|
| 25 | if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/;
|
|---|
| 26 |
|
|---|
| 27 | plan skip_all => "These tests are not supported in a no-cmp build"
|
|---|
| 28 | if disabled("cmp");
|
|---|
| 29 | plan skip_all => "These tests are not supported in a no-ec build"
|
|---|
| 30 | if disabled("ec");
|
|---|
| 31 | plan skip_all => "These tests are not supported in a no-sock build"
|
|---|
| 32 | if disabled("sock");
|
|---|
| 33 |
|
|---|
| 34 | plan skip_all => "Tests involving local HTTP server not available on Windows or VMS"
|
|---|
| 35 | if $^O =~ /^(VMS|MSWin32|msys)$/;
|
|---|
| 36 | plan skip_all => "Tests involving local HTTP server not available in cross-compile builds"
|
|---|
| 37 | if defined $ENV{EXE_SHELL};
|
|---|
| 38 |
|
|---|
| 39 | sub chop_dblquot { # chop any leading and trailing '"' (needed for Windows)
|
|---|
| 40 | my $str = shift;
|
|---|
| 41 | $str =~ s/^\"(.*?)\"$/$1/;
|
|---|
| 42 | return $str;
|
|---|
| 43 | }
|
|---|
| 44 |
|
|---|
| 45 | my $proxy = chop_dblquot($ENV{http_proxy} // $ENV{HTTP_PROXY} // "");
|
|---|
| 46 | $proxy = "<EMPTY>" if $proxy eq "";
|
|---|
| 47 | $proxy =~ s{^https?://}{}i;
|
|---|
| 48 | my $no_proxy = $ENV{no_proxy} // $ENV{NO_PROXY};
|
|---|
| 49 |
|
|---|
| 50 | my @app = qw(openssl cmp);
|
|---|
| 51 |
|
|---|
| 52 | # the CMP server configuration consists of:
|
|---|
| 53 | my $ca_dn; # The CA's Distinguished Name
|
|---|
| 54 | my $server_dn; # The server's Distinguished Name
|
|---|
| 55 | my $server_host;# The server's host name or IP address
|
|---|
| 56 | my $server_port;# The server's port
|
|---|
| 57 | my $server_tls; # The server's TLS port, if any, or 0
|
|---|
| 58 | my $server_path;# The server's CMP alias
|
|---|
| 59 | my $server_cert;# The server's cert
|
|---|
| 60 | my $kur_port; # The server's port for kur (cert update)
|
|---|
| 61 | my $pbm_port; # The server port to be used for PBM
|
|---|
| 62 | my $pbm_ref; # The reference for PBM
|
|---|
| 63 | my $pbm_secret; # The secret for PBM
|
|---|
| 64 | my $column; # The column number of the expected result
|
|---|
| 65 | my $sleep = 0; # The time to sleep between two requests
|
|---|
| 66 | my $server_fh; # Server file handle
|
|---|
| 67 |
|
|---|
| 68 | # The local $server_name variables below are among others taken as the name of a
|
|---|
| 69 | # sub-directory with server-specific certs etc. and CA-specific config section.
|
|---|
| 70 |
|
|---|
| 71 | sub load_config {
|
|---|
| 72 | my $server_name = shift;
|
|---|
| 73 | my $section = shift;
|
|---|
| 74 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf";
|
|---|
| 75 | open (CH, $test_config) or die "Cannot open $test_config: $!";
|
|---|
| 76 | my $active = 0;
|
|---|
| 77 | while (<CH>) {
|
|---|
| 78 | if (m/\[\s*$section\s*\]/) {
|
|---|
| 79 | $active = 1;
|
|---|
| 80 | } elsif (m/\[\s*.*?\s*\]/) {
|
|---|
| 81 | $active = 0;
|
|---|
| 82 | } elsif ($active) {
|
|---|
| 83 | $ca_dn = $1 eq "" ? '""""' : $1 if m/^\s*ca_dn\s*=\s*(.*)?\s*$/;
|
|---|
| 84 | $server_dn = $1 eq "" ? '""""' : $1 if m/^\s*server_dn\s*=\s*(.*)?\s*$/;
|
|---|
| 85 | $server_host = $1 eq "" ? '""""' : $1 if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/;
|
|---|
| 86 | $server_port = $1 eq "" ? '""""' : $1 if m/^\s*server_port\s*=\s*(.*)?\s*$/;
|
|---|
| 87 | $server_tls = $1 eq "" ? '""""' : $1 if m/^\s*server_tls\s*=\s*(.*)?\s*$/;
|
|---|
| 88 | $server_path = $1 eq "" ? '""""' : $1 if m/^\s*server_path\s*=\s*(.*)?\s*$/;
|
|---|
| 89 | $server_cert = $1 eq "" ? '""""' : $1 if m/^\s*server_cert\s*=\s*(.*)?\s*$/;
|
|---|
| 90 | $kur_port = $1 eq "" ? '""""' : $1 if m/^\s*kur_port\s*=\s*(.*)?\s*$/;
|
|---|
| 91 | $pbm_port = $1 eq "" ? '""""' : $1 if m/^\s*pbm_port\s*=\s*(.*)?\s*$/;
|
|---|
| 92 | $pbm_ref = $1 eq "" ? '""""' : $1 if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/;
|
|---|
| 93 | $pbm_secret = $1 eq "" ? '""""' : $1 if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/;
|
|---|
| 94 | $column = $1 eq "" ? '""""' : $1 if m/^\s*column\s*=\s*(.*)?\s*$/;
|
|---|
| 95 | $sleep = $1 eq "" ? '""""' : $1 if m/^\s*sleep\s*=\s*(.*)?\s*$/;
|
|---|
| 96 | }
|
|---|
| 97 | }
|
|---|
| 98 | close CH;
|
|---|
| 99 | die "Cannot find all CMP server config values in $test_config section [$section]\n"
|
|---|
| 100 | if !defined $ca_dn
|
|---|
| 101 | || !defined $server_dn || !defined $server_host
|
|---|
| 102 | || !defined $server_port || !defined $server_tls
|
|---|
| 103 | || !defined $server_path || !defined $server_cert
|
|---|
| 104 | || !defined $kur_port || !defined $pbm_port
|
|---|
| 105 | || !defined $pbm_ref || !defined $pbm_secret
|
|---|
| 106 | || !defined $column || !defined $sleep;
|
|---|
| 107 | $server_dn = $server_dn // $ca_dn;
|
|---|
| 108 | }
|
|---|
| 109 |
|
|---|
| 110 | my @server_configurations = ("Mock");
|
|---|
| 111 | @server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER} if $ENV{OPENSSL_CMP_SERVER};
|
|---|
| 112 | # set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers
|
|---|
| 113 |
|
|---|
| 114 | my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment");
|
|---|
| 115 | @all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS} if $ENV{OPENSSL_CMP_ASPECTS};
|
|---|
| 116 | # set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects
|
|---|
| 117 |
|
|---|
| 118 | my $faillog;
|
|---|
| 119 | my $file = $ENV{HARNESS_FAILLOG}; # pathname relative to result_dir
|
|---|
| 120 | if ($file) {
|
|---|
| 121 | open($faillog, ">", $file) or die "Cannot open $file for writing: $!";
|
|---|
| 122 | }
|
|---|
| 123 |
|
|---|
| 124 | sub test_cmp_http {
|
|---|
| 125 | my $server_name = shift;
|
|---|
| 126 | my $aspect = shift;
|
|---|
| 127 | my $n = shift;
|
|---|
| 128 | my $i = shift;
|
|---|
| 129 | my $title = shift;
|
|---|
| 130 | my $params = shift;
|
|---|
| 131 | my $expected_result = shift;
|
|---|
| 132 | $params = [ '-server', "127.0.0.1:$server_port", @$params ]
|
|---|
| 133 | unless grep { $_ eq '-server' } @$params;
|
|---|
| 134 | my $cmd = app([@app, @$params]);
|
|---|
| 135 |
|
|---|
| 136 | unless (is(my $actual_result = run($cmd), $expected_result, $title)) {
|
|---|
| 137 | if ($faillog) {
|
|---|
| 138 | my $quote_spc_empty = sub { $_ eq "" ? '""' : $_ =~ m/ / ? '"'.$_.'"' : $_ };
|
|---|
| 139 | my $invocation = cmdstr($cmd, display => 1);
|
|---|
| 140 | print $faillog "$server_name $aspect \"$title\" ($i/$n)".
|
|---|
| 141 | " expected=$expected_result actual=$actual_result\n";
|
|---|
| 142 | print $faillog "$invocation\n\n";
|
|---|
| 143 | }
|
|---|
| 144 | }
|
|---|
| 145 | }
|
|---|
| 146 |
|
|---|
| 147 | sub test_cmp_http_aspect {
|
|---|
| 148 | my $server_name = shift;
|
|---|
| 149 | my $aspect = shift;
|
|---|
| 150 | my $tests = shift;
|
|---|
| 151 | subtest "CMP app CLI $server_name $aspect\n" => sub {
|
|---|
| 152 | my $n = scalar @$tests;
|
|---|
| 153 | plan tests => $n;
|
|---|
| 154 | my $i = 1;
|
|---|
| 155 | foreach (@$tests) {
|
|---|
| 156 | test_cmp_http($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]);
|
|---|
| 157 | sleep($sleep);
|
|---|
| 158 | }
|
|---|
| 159 | };
|
|---|
| 160 | # not unlinking test.certout*.pem, test.cacerts.pem, and test.extracerts.pem
|
|---|
| 161 | }
|
|---|
| 162 |
|
|---|
| 163 | # The input files for the tests done here dynamically depend on the test server
|
|---|
| 164 | # selected (where the Mock server used by default is just one possibility).
|
|---|
| 165 | # On the other hand the main test configuration file test.cnf, which references
|
|---|
| 166 | # several server-dependent input files by relative file names, is static.
|
|---|
| 167 | # Moreover the tests use much greater variety of input files than output files.
|
|---|
| 168 | # Therefore we chose the current directory as a subdirectory of $SRCTOP and it
|
|---|
| 169 | # was simpler to prepend the output file names by BLDTOP than doing the tests
|
|---|
| 170 | # from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP.
|
|---|
| 171 |
|
|---|
| 172 | indir data_dir() => sub {
|
|---|
| 173 | plan tests => 1 + @server_configurations * @all_aspects
|
|---|
| 174 | - (grep(/^Mock$/, @server_configurations)
|
|---|
| 175 | && grep(/^certstatus$/, @all_aspects));
|
|---|
| 176 |
|
|---|
| 177 | foreach my $server_name (@server_configurations) {
|
|---|
| 178 | $server_name = chop_dblquot($server_name);
|
|---|
| 179 | load_config($server_name, $server_name);
|
|---|
| 180 | {
|
|---|
| 181 | SKIP: {
|
|---|
| 182 | my $pid;
|
|---|
| 183 | if ($server_name eq "Mock") {
|
|---|
| 184 | indir "Mock" => sub {
|
|---|
| 185 | $pid = start_mock_server("");
|
|---|
| 186 | die "Cannot start or find the started CMP mock server" unless $pid;
|
|---|
| 187 | }
|
|---|
| 188 | }
|
|---|
| 189 | foreach my $aspect (@all_aspects) {
|
|---|
| 190 | $aspect = chop_dblquot($aspect);
|
|---|
| 191 | next if $server_name eq "Mock" && $aspect eq "certstatus";
|
|---|
| 192 | load_config($server_name, $aspect); # update with any aspect-specific settings
|
|---|
| 193 | indir $server_name => sub {
|
|---|
| 194 | my $tests = load_tests($server_name, $aspect);
|
|---|
| 195 | test_cmp_http_aspect($server_name, $aspect, $tests);
|
|---|
| 196 | };
|
|---|
| 197 | };
|
|---|
| 198 | stop_mock_server($pid) if $pid;
|
|---|
| 199 | ok(1, "killing mock server");
|
|---|
| 200 | }
|
|---|
| 201 | }
|
|---|
| 202 | };
|
|---|
| 203 | };
|
|---|
| 204 |
|
|---|
| 205 | close($faillog) if $faillog;
|
|---|
| 206 |
|
|---|
| 207 | sub load_tests {
|
|---|
| 208 | my $server_name = shift;
|
|---|
| 209 | my $aspect = shift;
|
|---|
| 210 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf";
|
|---|
| 211 | my $file = data_file("test_$aspect.csv");
|
|---|
| 212 | my $result_dir = result_dir();
|
|---|
| 213 | my @result;
|
|---|
| 214 |
|
|---|
| 215 | open(my $data, '<', $file) || die "Cannot open $file for reading: $!";
|
|---|
| 216 | LOOP:
|
|---|
| 217 | while (my $line = <$data>) {
|
|---|
| 218 | chomp $line;
|
|---|
| 219 | $line =~ s{\r\n}{\n}g; # adjust line endings
|
|---|
| 220 | $line =~ s{_CA_DN}{$ca_dn}g;
|
|---|
| 221 | $line =~ s{_SERVER_DN}{$server_dn}g;
|
|---|
| 222 | $line =~ s{_SERVER_HOST}{$server_host}g;
|
|---|
| 223 | $line =~ s{_SERVER_PORT}{$server_port}g;
|
|---|
| 224 | $line =~ s{_SERVER_TLS}{$server_tls}g;
|
|---|
| 225 | $line =~ s{_SERVER_PATH}{$server_path}g;
|
|---|
| 226 | $line =~ s{_SERVER_CERT}{$server_cert}g;
|
|---|
| 227 | $line =~ s{_KUR_PORT}{$kur_port}g;
|
|---|
| 228 | $line =~ s{_PBM_PORT}{$pbm_port}g;
|
|---|
| 229 | $line =~ s{_PBM_REF}{$pbm_ref}g;
|
|---|
| 230 | $line =~ s{_PBM_SECRET}{$pbm_secret}g;
|
|---|
| 231 | $line =~ s{_RESULT_DIR}{$result_dir}g;
|
|---|
| 232 |
|
|---|
| 233 | next LOOP if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/;
|
|---|
| 234 | my $noproxy = $no_proxy;
|
|---|
| 235 | if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) {
|
|---|
| 236 | $noproxy = $1;
|
|---|
| 237 | } elsif ($server_host eq "127.0.0.1") {
|
|---|
| 238 | # do connections to localhost (e.g., Mock server) without proxy
|
|---|
| 239 | $line =~ s{-section,,}{-section,,-no_proxy,127.0.0.1,} ;
|
|---|
| 240 | }
|
|---|
| 241 | if ($line =~ m/,\s*-proxy\s*,/) {
|
|---|
| 242 | next LOOP if $no_proxy && ($noproxy =~ $server_host);
|
|---|
| 243 | } else {
|
|---|
| 244 | $line =~ s{-section,,}{-section,,-proxy,$proxy,};
|
|---|
| 245 | }
|
|---|
| 246 | $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,};
|
|---|
| 247 | $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,};
|
|---|
| 248 |
|
|---|
| 249 | my @fields = grep /\S/, split ",", $line;
|
|---|
| 250 | s/^<EMPTY>$// for (@fields); # used for proxy=""
|
|---|
| 251 | s/^\s+// for (@fields); # remove leading whitespace from elements
|
|---|
| 252 | s/\s+$// for (@fields); # remove trailing whitespace from elements
|
|---|
| 253 | s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements
|
|---|
| 254 | my $expected_result = $fields[$column];
|
|---|
| 255 | my $description = 1;
|
|---|
| 256 | my $title = $fields[$description];
|
|---|
| 257 | next LOOP if (!defined($expected_result)
|
|---|
| 258 | || ($expected_result ne 0 && $expected_result ne 1));
|
|---|
| 259 | @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1];
|
|---|
| 260 | push @result, [$title, \@fields, $expected_result];
|
|---|
| 261 | }
|
|---|
| 262 | close($data);
|
|---|
| 263 | return \@result;
|
|---|
| 264 | }
|
|---|
| 265 |
|
|---|
| 266 | sub start_mock_server {
|
|---|
| 267 | my $args = $_[0]; # optional further CLI arguments
|
|---|
| 268 | my $cmd = cmdstr(app([@app, '-config', 'server.cnf',
|
|---|
| 269 | $args ? $args : ()]), display => 1);
|
|---|
| 270 | print "Current directory is ".getcwd()."\n";
|
|---|
| 271 | print "Launching mock server: $cmd\n";
|
|---|
| 272 | die "Invalid port: $server_port" unless $server_port =~ m/^\d+$/;
|
|---|
| 273 | my $pid = open($server_fh, "$cmd|") or die "Trying to $cmd";
|
|---|
| 274 | print "Pid is: $pid\n";
|
|---|
| 275 | if ($server_port == 0) {
|
|---|
| 276 | # Find out the actual server port
|
|---|
| 277 | while (<$server_fh>) {
|
|---|
| 278 | print "Server output: $_";
|
|---|
| 279 | next if m/using section/;
|
|---|
| 280 | s/\R$//; # Better chomp
|
|---|
| 281 | ($server_port, $pid) = ($1, $2) if /^ACCEPT\s.*:(\d+) PID=(\d+)$/;
|
|---|
| 282 | last; # Do not loop further to prevent hangs on server misbehavior
|
|---|
| 283 | }
|
|---|
| 284 | }
|
|---|
| 285 | unless ($server_port > 0) {
|
|---|
| 286 | stop_mock_server($pid);
|
|---|
| 287 | return 0;
|
|---|
| 288 | }
|
|---|
| 289 | $server_tls = $kur_port = $pbm_port = $server_port;
|
|---|
| 290 | return $pid;
|
|---|
| 291 | }
|
|---|
| 292 |
|
|---|
| 293 | sub stop_mock_server {
|
|---|
| 294 | my $pid = $_[0];
|
|---|
| 295 | print "Killing mock server with pid=$pid\n";
|
|---|
| 296 | kill('KILL', $pid);
|
|---|
| 297 | waitpid($pid, 0);
|
|---|
| 298 | }
|
|---|
