]>
Commit | Line | Data |
---|---|---|
c87bcdbd | 1 | #! /usr/bin/env perl |
a28d06f3 | 2 | # Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved. |
c87bcdbd DDO |
3 | # Copyright Nokia 2007-2019 |
4 | # Copyright Siemens AG 2015-2019 | |
5 | # | |
6 | # Licensed under the Apache License 2.0 (the "License"). You may not use | |
7 | # this file except in compliance with the License. You can obtain a copy | |
8 | # in the file LICENSE in the source distribution or at | |
9 | # https://www.openssl.org/source/license.html | |
10 | ||
11 | use strict; | |
12 | use warnings; | |
13 | ||
14 | use POSIX; | |
d63053bb | 15 | use OpenSSL::Test qw/:DEFAULT cmdstr data_file data_dir srctop_dir bldtop_dir result_dir/; |
c87bcdbd DDO |
16 | use OpenSSL::Test::Utils; |
17 | ||
18 | BEGIN { | |
19 | setup("test_cmp_http"); | |
20 | } | |
21 | use lib srctop_dir('Configurations'); | |
22 | use lib bldtop_dir('.'); | |
e25b4db7 | 23 | |
c87bcdbd | 24 | plan skip_all => "These tests are not supported in a fuzz build" |
c6b72390 | 25 | if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/; |
c87bcdbd DDO |
26 | |
27 | plan skip_all => "These tests are not supported in a no-cmp build" | |
28 | if disabled("cmp"); | |
29 | plan skip_all => "These tests are not supported in a no-ec build" | |
30 | if disabled("ec"); | |
b422ba3d RL |
31 | plan skip_all => "These tests are not supported in a no-sock build" |
32 | if disabled("sock"); | |
c87bcdbd | 33 | |
f6b6574c | 34 | plan skip_all => "Tests involving local HTTP server not available on Windows or VMS" |
53d0d01f | 35 | if $^O =~ /^(VMS|MSWin32|msys)$/; |
c87bcdbd DDO |
36 | plan skip_all => "Tests involving local HTTP server not available in cross-compile builds" |
37 | if defined $ENV{EXE_SHELL}; | |
c87bcdbd DDO |
38 | |
39 | sub chop_dblquot { # chop any leading and trailing '"' (needed for Windows) | |
40 | my $str = shift; | |
41 | $str =~ s/^\"(.*?)\"$/$1/; | |
42 | return $str; | |
43 | } | |
44 | ||
1ed3249f DDO |
45 | my $proxy = chop_dblquot($ENV{http_proxy} // $ENV{HTTP_PROXY} // ""); |
46 | $proxy = "<EMPTY>" if $proxy eq ""; | |
c87bcdbd DDO |
47 | $proxy =~ s{^https?://}{}i; |
48 | my $no_proxy = $ENV{no_proxy} // $ENV{NO_PROXY}; | |
49 | ||
321a48cd | 50 | my @app = qw(openssl cmp); |
c87bcdbd | 51 | |
1738eb21 | 52 | # the server-dependent client configuration consists of: |
c87bcdbd DDO |
53 | my $ca_dn; # The CA's Distinguished Name |
54 | my $server_dn; # The server's Distinguished Name | |
9929c817 | 55 | my $server_host;# The server's hostname or IP address |
c87bcdbd DDO |
56 | my $server_port;# The server's port |
57 | my $server_tls; # The server's TLS port, if any, or 0 | |
58 | my $server_path;# The server's CMP alias | |
59 | my $server_cert;# The server's cert | |
60 | my $kur_port; # The server's port for kur (cert update) | |
61 | my $pbm_port; # The server port to be used for PBM | |
62 | my $pbm_ref; # The reference for PBM | |
63 | my $pbm_secret; # The secret for PBM | |
64 | my $column; # The column number of the expected result | |
65 | my $sleep = 0; # The time to sleep between two requests | |
1738eb21 DDO |
66 | |
67 | # the dynamic server info: | |
b422ba3d | 68 | my $server_fh; # Server file handle |
c87bcdbd | 69 | |
8d703a04 DDO |
70 | sub subst_env { |
71 | my $val = shift; | |
72 | return '""""' if $val eq ""; | |
73 | return $ENV{$1} if $val =~ /^\$\{ENV::(\w+)}$/; | |
74 | return $val; | |
75 | } | |
76 | ||
1738eb21 DDO |
77 | # The local $server_name variables in the subroutines below are used |
78 | # both as the name of a sub-directory with server-specific credentials | |
79 | # and as the name of a server-dependent client config section. | |
80 | ||
c87bcdbd DDO |
81 | sub load_config { |
82 | my $server_name = shift; | |
83 | my $section = shift; | |
84 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
85 | open (CH, $test_config) or die "Cannot open $test_config: $!"; | |
86 | my $active = 0; | |
87 | while (<CH>) { | |
88 | if (m/\[\s*$section\s*\]/) { | |
89 | $active = 1; | |
90 | } elsif (m/\[\s*.*?\s*\]/) { | |
91 | $active = 0; | |
92 | } elsif ($active) { | |
1738eb21 | 93 | # if there are multiple entries with same key, the last one prevails |
8d703a04 DDO |
94 | $ca_dn = subst_env($1) if m/^\s*ca_dn\s*=\s*(.*)?\s*$/; |
95 | $server_dn = subst_env($1) if m/^\s*server_dn\s*=\s*(.*)?\s*$/; | |
96 | $server_host = subst_env($1) if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/; | |
1738eb21 | 97 | $server_port = subst_env($1) if m/^\s*server_port\s*=\s*(\S*)?\s*(\#.*)?$/; |
8d703a04 DDO |
98 | $server_tls = subst_env($1) if m/^\s*server_tls\s*=\s*(.*)?\s*$/; |
99 | $server_path = subst_env($1) if m/^\s*server_path\s*=\s*(.*)?\s*$/; | |
100 | $server_cert = subst_env($1) if m/^\s*server_cert\s*=\s*(.*)?\s*$/; | |
101 | $kur_port = subst_env($1) if m/^\s*kur_port\s*=\s*(.*)?\s*$/; | |
102 | $pbm_port = subst_env($1) if m/^\s*pbm_port\s*=\s*(.*)?\s*$/; | |
103 | $pbm_ref = subst_env($1) if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/; | |
104 | $pbm_secret = subst_env($1) if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/; | |
105 | $column = subst_env($1) if m/^\s*column\s*=\s*(.*)?\s*$/; | |
106 | $sleep = subst_env($1) if m/^\s*sleep\s*=\s*(.*)?\s*$/; | |
c87bcdbd DDO |
107 | } |
108 | } | |
109 | close CH; | |
1738eb21 | 110 | die "Cannot find all server-dependent config values in $test_config section [$section]\n" |
c87bcdbd DDO |
111 | if !defined $ca_dn |
112 | || !defined $server_dn || !defined $server_host | |
113 | || !defined $server_port || !defined $server_tls | |
114 | || !defined $server_path || !defined $server_cert | |
115 | || !defined $kur_port || !defined $pbm_port | |
116 | || !defined $pbm_ref || !defined $pbm_secret | |
117 | || !defined $column || !defined $sleep; | |
1738eb21 DDO |
118 | die "Invalid server_port number in $test_config section [$section]: $server_port" |
119 | unless $server_port =~ m/^\d+$/; | |
c87bcdbd DDO |
120 | $server_dn = $server_dn // $ca_dn; |
121 | } | |
122 | ||
123 | my @server_configurations = ("Mock"); | |
124 | @server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER} if $ENV{OPENSSL_CMP_SERVER}; | |
125 | # set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers | |
126 | ||
127 | my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment"); | |
128 | @all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS} if $ENV{OPENSSL_CMP_ASPECTS}; | |
129 | # set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects | |
130 | ||
131 | my $faillog; | |
132 | my $file = $ENV{HARNESS_FAILLOG}; # pathname relative to result_dir | |
133 | if ($file) { | |
8d703a04 | 134 | open($faillog, ">", $file) or die "Cannot open '$file' for writing: $!"; |
c87bcdbd DDO |
135 | } |
136 | ||
137 | sub test_cmp_http { | |
138 | my $server_name = shift; | |
139 | my $aspect = shift; | |
140 | my $n = shift; | |
141 | my $i = shift; | |
142 | my $title = shift; | |
143 | my $params = shift; | |
b6f0f050 | 144 | my $expected_result = shift; |
b422ba3d | 145 | $params = [ '-server', "127.0.0.1:$server_port", @$params ] |
8d703a04 | 146 | if ($server_name eq "Mock" && !(grep { $_ eq '-server' } @$params)); |
321a48cd | 147 | my $cmd = app([@app, @$params]); |
b422ba3d | 148 | |
321a48cd | 149 | unless (is(my $actual_result = run($cmd), $expected_result, $title)) { |
d00be9f3 | 150 | if ($faillog) { |
c87bcdbd | 151 | my $quote_spc_empty = sub { $_ eq "" ? '""' : $_ =~ m/ / ? '"'.$_.'"' : $_ }; |
321a48cd | 152 | my $invocation = cmdstr($cmd, display => 1); |
c87bcdbd | 153 | print $faillog "$server_name $aspect \"$title\" ($i/$n)". |
1738eb21 DDO |
154 | " expected=$expected_result (". |
155 | ($expected_result ? "success" : "failure").")". | |
156 | " actual=$actual_result\n"; | |
c87bcdbd DDO |
157 | print $faillog "$invocation\n\n"; |
158 | } | |
8d703a04 | 159 | sleep($sleep) if $expected_result == 1; |
d00be9f3 | 160 | } |
c87bcdbd DDO |
161 | } |
162 | ||
163 | sub test_cmp_http_aspect { | |
164 | my $server_name = shift; | |
165 | my $aspect = shift; | |
166 | my $tests = shift; | |
167 | subtest "CMP app CLI $server_name $aspect\n" => sub { | |
168 | my $n = scalar @$tests; | |
169 | plan tests => $n; | |
170 | my $i = 1; | |
171 | foreach (@$tests) { | |
172 | test_cmp_http($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]); | |
c87bcdbd DDO |
173 | } |
174 | }; | |
8d703a04 | 175 | # not unlinking test.cert.pem, test.cacerts.pem, and test.extracerts.pem |
c87bcdbd DDO |
176 | } |
177 | ||
178 | # The input files for the tests done here dynamically depend on the test server | |
8d703a04 | 179 | # selected (where the mock server used by default is just one possibility). |
c87bcdbd DDO |
180 | # On the other hand the main test configuration file test.cnf, which references |
181 | # several server-dependent input files by relative file names, is static. | |
182 | # Moreover the tests use much greater variety of input files than output files. | |
183 | # Therefore we chose the current directory as a subdirectory of $SRCTOP and it | |
184 | # was simpler to prepend the output file names by BLDTOP than doing the tests | |
185 | # from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP. | |
186 | ||
187 | indir data_dir() => sub { | |
128d1c3c | 188 | plan tests => 1 + @server_configurations * @all_aspects |
7a86cb69 | 189 | - (grep(/^Mock$/, @server_configurations) |
c87bcdbd DDO |
190 | && grep(/^certstatus$/, @all_aspects)); |
191 | ||
192 | foreach my $server_name (@server_configurations) { | |
193 | $server_name = chop_dblquot($server_name); | |
194 | load_config($server_name, $server_name); | |
195 | { | |
c6df354c | 196 | SKIP: { |
c87bcdbd DDO |
197 | my $pid; |
198 | if ($server_name eq "Mock") { | |
199 | indir "Mock" => sub { | |
1738eb21 DDO |
200 | $pid = start_server($server_name, ""); |
201 | next unless $pid; | |
c87bcdbd DDO |
202 | } |
203 | } | |
204 | foreach my $aspect (@all_aspects) { | |
205 | $aspect = chop_dblquot($aspect); | |
8d703a04 | 206 | if ($server_name eq "Mock" && $aspect eq "certstatus") { |
1738eb21 | 207 | print "Skipping certstatus check as not supported by $server_name server\n"; |
8d703a04 DDO |
208 | next; |
209 | } | |
c87bcdbd DDO |
210 | load_config($server_name, $aspect); # update with any aspect-specific settings |
211 | indir $server_name => sub { | |
212 | my $tests = load_tests($server_name, $aspect); | |
213 | test_cmp_http_aspect($server_name, $aspect, $tests); | |
214 | }; | |
215 | }; | |
1738eb21 DDO |
216 | stop_server($server_name, $pid) if $pid; |
217 | ok(1, "$server_name server has terminated"); | |
c6df354c | 218 | } |
c87bcdbd DDO |
219 | } |
220 | }; | |
221 | }; | |
222 | ||
223 | close($faillog) if $faillog; | |
224 | ||
225 | sub load_tests { | |
226 | my $server_name = shift; | |
227 | my $aspect = shift; | |
228 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
229 | my $file = data_file("test_$aspect.csv"); | |
230 | my $result_dir = result_dir(); | |
231 | my @result; | |
232 | ||
8d703a04 | 233 | open(my $data, '<', $file) || die "Cannot open '$file' for reading: $!"; |
c87bcdbd DDO |
234 | LOOP: |
235 | while (my $line = <$data>) { | |
236 | chomp $line; | |
237 | $line =~ s{\r\n}{\n}g; # adjust line endings | |
238 | $line =~ s{_CA_DN}{$ca_dn}g; | |
239 | $line =~ s{_SERVER_DN}{$server_dn}g; | |
240 | $line =~ s{_SERVER_HOST}{$server_host}g; | |
241 | $line =~ s{_SERVER_PORT}{$server_port}g; | |
242 | $line =~ s{_SERVER_TLS}{$server_tls}g; | |
243 | $line =~ s{_SERVER_PATH}{$server_path}g; | |
244 | $line =~ s{_SERVER_CERT}{$server_cert}g; | |
245 | $line =~ s{_KUR_PORT}{$kur_port}g; | |
246 | $line =~ s{_PBM_PORT}{$pbm_port}g; | |
247 | $line =~ s{_PBM_REF}{$pbm_ref}g; | |
248 | $line =~ s{_PBM_SECRET}{$pbm_secret}g; | |
249 | $line =~ s{_RESULT_DIR}{$result_dir}g; | |
250 | ||
251 | next LOOP if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/; | |
252 | my $noproxy = $no_proxy; | |
253 | if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) { | |
254 | $noproxy = $1; | |
255 | } elsif ($server_host eq "127.0.0.1") { | |
8d703a04 | 256 | # do connections to localhost (e.g., mock server) without proxy |
c87bcdbd DDO |
257 | $line =~ s{-section,,}{-section,,-no_proxy,127.0.0.1,} ; |
258 | } | |
259 | if ($line =~ m/,\s*-proxy\s*,/) { | |
260 | next LOOP if $no_proxy && ($noproxy =~ $server_host); | |
261 | } else { | |
262 | $line =~ s{-section,,}{-section,,-proxy,$proxy,}; | |
263 | } | |
75cce8dd DDO |
264 | $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,} |
265 | if $aspect ne "commands" || $line =~ m/,\s*-cmd\s*,\s*(ir|cr|p10cr|kur)\s*,/; | |
c87bcdbd DDO |
266 | $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,}; |
267 | ||
268 | my @fields = grep /\S/, split ",", $line; | |
269 | s/^<EMPTY>$// for (@fields); # used for proxy="" | |
270 | s/^\s+// for (@fields); # remove leading whitespace from elements | |
271 | s/\s+$// for (@fields); # remove trailing whitespace from elements | |
272 | s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements | |
b6f0f050 | 273 | my $expected_result = $fields[$column]; |
c87bcdbd DDO |
274 | my $description = 1; |
275 | my $title = $fields[$description]; | |
b6f0f050 DDO |
276 | next LOOP if (!defined($expected_result) |
277 | || ($expected_result ne 0 && $expected_result ne 1)); | |
c87bcdbd | 278 | @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1]; |
b6f0f050 | 279 | push @result, [$title, \@fields, $expected_result]; |
c87bcdbd DDO |
280 | } |
281 | close($data); | |
282 | return \@result; | |
283 | } | |
284 | ||
1738eb21 DDO |
285 | sub start_server { |
286 | my $server_name = shift; | |
287 | my $args = shift; # optional further CLI arguments | |
321a48cd | 288 | my $cmd = cmdstr(app([@app, '-config', 'server.cnf', |
d63053bb | 289 | $args ? $args : ()]), display => 1); |
b9cd82f9 | 290 | print "Current directory is ".getcwd()."\n"; |
1738eb21 DDO |
291 | print "Launching $server_name server: $cmd\n"; |
292 | my $pid = open($server_fh, "$cmd|"); | |
293 | unless ($pid) { | |
294 | print "Error launching $cmd, cannot obtain $server_name server PID"; | |
295 | return 0; | |
296 | } | |
297 | print "$server_name server PID=$pid\n"; | |
298 | ||
c796cc97 | 299 | if ($server_port == 0) { |
1738eb21 DDO |
300 | # Find out the actual server port and possibly different PID |
301 | $pid = 0; | |
d357dd51 | 302 | while (<$server_fh>) { |
1738eb21 | 303 | print "$server_name server output: $_"; |
ee1d1db8 | 304 | next if m/using section/; |
d357dd51 | 305 | s/\R$//; # Better chomp |
d63053bb | 306 | ($server_port, $pid) = ($1, $2) if /^ACCEPT\s.*:(\d+) PID=(\d+)$/; |
ee1d1db8 | 307 | last; # Do not loop further to prevent hangs on server misbehavior |
97cf9b05 | 308 | } |
b422ba3d | 309 | } |
ee1d1db8 | 310 | unless ($server_port > 0) { |
1738eb21 DDO |
311 | stop_server($server_name, $pid); |
312 | print "Cannot get expected output from the $server_name server"; | |
ee1d1db8 DDO |
313 | return 0; |
314 | } | |
1738eb21 DDO |
315 | $kur_port = $server_port if $kur_port eq "\$server_port"; |
316 | $pbm_port = $server_port if $pbm_port eq "\$server_port"; | |
317 | $server_tls = $server_port if $server_tls; | |
97cf9b05 | 318 | return $pid; |
c87bcdbd DDO |
319 | } |
320 | ||
1738eb21 DDO |
321 | sub stop_server { |
322 | my $server_name = shift; | |
323 | my $pid = shift; | |
324 | print "Killing $server_name server with PID=$pid\n"; | |
e23206ae | 325 | kill('KILL', $pid); |
128d1c3c | 326 | waitpid($pid, 0); |
c87bcdbd | 327 | } |