]>
Commit | Line | Data |
---|---|---|
c87bcdbd | 1 | #! /usr/bin/env perl |
a28d06f3 | 2 | # Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved. |
c87bcdbd DDO |
3 | # Copyright Nokia 2007-2019 |
4 | # Copyright Siemens AG 2015-2019 | |
5 | # | |
6 | # Licensed under the Apache License 2.0 (the "License"). You may not use | |
7 | # this file except in compliance with the License. You can obtain a copy | |
8 | # in the file LICENSE in the source distribution or at | |
9 | # https://www.openssl.org/source/license.html | |
10 | ||
11 | use strict; | |
12 | use warnings; | |
13 | ||
14 | use POSIX; | |
d63053bb | 15 | use OpenSSL::Test qw/:DEFAULT cmdstr data_file data_dir srctop_dir bldtop_dir result_dir/; |
c87bcdbd DDO |
16 | use OpenSSL::Test::Utils; |
17 | ||
18 | BEGIN { | |
19 | setup("test_cmp_http"); | |
20 | } | |
21 | use lib srctop_dir('Configurations'); | |
22 | use lib bldtop_dir('.'); | |
e25b4db7 | 23 | |
c87bcdbd | 24 | plan skip_all => "These tests are not supported in a fuzz build" |
c6b72390 | 25 | if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/; |
c87bcdbd DDO |
26 | |
27 | plan skip_all => "These tests are not supported in a no-cmp build" | |
28 | if disabled("cmp"); | |
29 | plan skip_all => "These tests are not supported in a no-ec build" | |
30 | if disabled("ec"); | |
b422ba3d RL |
31 | plan skip_all => "These tests are not supported in a no-sock build" |
32 | if disabled("sock"); | |
c87bcdbd | 33 | |
f6b6574c | 34 | plan skip_all => "Tests involving local HTTP server not available on Windows or VMS" |
53d0d01f | 35 | if $^O =~ /^(VMS|MSWin32|msys)$/; |
c87bcdbd DDO |
36 | plan skip_all => "Tests involving local HTTP server not available in cross-compile builds" |
37 | if defined $ENV{EXE_SHELL}; | |
c87bcdbd DDO |
38 | |
39 | sub chop_dblquot { # chop any leading and trailing '"' (needed for Windows) | |
40 | my $str = shift; | |
41 | $str =~ s/^\"(.*?)\"$/$1/; | |
42 | return $str; | |
43 | } | |
44 | ||
1ed3249f DDO |
45 | my $proxy = chop_dblquot($ENV{http_proxy} // $ENV{HTTP_PROXY} // ""); |
46 | $proxy = "<EMPTY>" if $proxy eq ""; | |
c87bcdbd DDO |
47 | $proxy =~ s{^https?://}{}i; |
48 | my $no_proxy = $ENV{no_proxy} // $ENV{NO_PROXY}; | |
49 | ||
321a48cd | 50 | my @app = qw(openssl cmp); |
c87bcdbd DDO |
51 | |
52 | # the CMP server configuration consists of: | |
53 | my $ca_dn; # The CA's Distinguished Name | |
54 | my $server_dn; # The server's Distinguished Name | |
55 | my $server_host;# The server's host name or IP address | |
56 | my $server_port;# The server's port | |
57 | my $server_tls; # The server's TLS port, if any, or 0 | |
58 | my $server_path;# The server's CMP alias | |
59 | my $server_cert;# The server's cert | |
60 | my $kur_port; # The server's port for kur (cert update) | |
61 | my $pbm_port; # The server port to be used for PBM | |
62 | my $pbm_ref; # The reference for PBM | |
63 | my $pbm_secret; # The secret for PBM | |
64 | my $column; # The column number of the expected result | |
65 | my $sleep = 0; # The time to sleep between two requests | |
b422ba3d | 66 | my $server_fh; # Server file handle |
c87bcdbd DDO |
67 | |
68 | # The local $server_name variables below are among others taken as the name of a | |
69 | # sub-directory with server-specific certs etc. and CA-specific config section. | |
70 | ||
71 | sub load_config { | |
72 | my $server_name = shift; | |
73 | my $section = shift; | |
74 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
75 | open (CH, $test_config) or die "Cannot open $test_config: $!"; | |
76 | my $active = 0; | |
77 | while (<CH>) { | |
78 | if (m/\[\s*$section\s*\]/) { | |
79 | $active = 1; | |
80 | } elsif (m/\[\s*.*?\s*\]/) { | |
81 | $active = 0; | |
82 | } elsif ($active) { | |
83 | $ca_dn = $1 eq "" ? '""""' : $1 if m/^\s*ca_dn\s*=\s*(.*)?\s*$/; | |
84 | $server_dn = $1 eq "" ? '""""' : $1 if m/^\s*server_dn\s*=\s*(.*)?\s*$/; | |
85 | $server_host = $1 eq "" ? '""""' : $1 if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/; | |
86 | $server_port = $1 eq "" ? '""""' : $1 if m/^\s*server_port\s*=\s*(.*)?\s*$/; | |
87 | $server_tls = $1 eq "" ? '""""' : $1 if m/^\s*server_tls\s*=\s*(.*)?\s*$/; | |
88 | $server_path = $1 eq "" ? '""""' : $1 if m/^\s*server_path\s*=\s*(.*)?\s*$/; | |
89 | $server_cert = $1 eq "" ? '""""' : $1 if m/^\s*server_cert\s*=\s*(.*)?\s*$/; | |
90 | $kur_port = $1 eq "" ? '""""' : $1 if m/^\s*kur_port\s*=\s*(.*)?\s*$/; | |
91 | $pbm_port = $1 eq "" ? '""""' : $1 if m/^\s*pbm_port\s*=\s*(.*)?\s*$/; | |
92 | $pbm_ref = $1 eq "" ? '""""' : $1 if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/; | |
93 | $pbm_secret = $1 eq "" ? '""""' : $1 if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/; | |
94 | $column = $1 eq "" ? '""""' : $1 if m/^\s*column\s*=\s*(.*)?\s*$/; | |
95 | $sleep = $1 eq "" ? '""""' : $1 if m/^\s*sleep\s*=\s*(.*)?\s*$/; | |
96 | } | |
97 | } | |
98 | close CH; | |
99 | die "Cannot find all CMP server config values in $test_config section [$section]\n" | |
100 | if !defined $ca_dn | |
101 | || !defined $server_dn || !defined $server_host | |
102 | || !defined $server_port || !defined $server_tls | |
103 | || !defined $server_path || !defined $server_cert | |
104 | || !defined $kur_port || !defined $pbm_port | |
105 | || !defined $pbm_ref || !defined $pbm_secret | |
106 | || !defined $column || !defined $sleep; | |
107 | $server_dn = $server_dn // $ca_dn; | |
108 | } | |
109 | ||
110 | my @server_configurations = ("Mock"); | |
111 | @server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER} if $ENV{OPENSSL_CMP_SERVER}; | |
112 | # set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers | |
113 | ||
114 | my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment"); | |
115 | @all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS} if $ENV{OPENSSL_CMP_ASPECTS}; | |
116 | # set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects | |
117 | ||
118 | my $faillog; | |
119 | my $file = $ENV{HARNESS_FAILLOG}; # pathname relative to result_dir | |
120 | if ($file) { | |
121 | open($faillog, ">", $file) or die "Cannot open $file for writing: $!"; | |
122 | } | |
123 | ||
124 | sub test_cmp_http { | |
125 | my $server_name = shift; | |
126 | my $aspect = shift; | |
127 | my $n = shift; | |
128 | my $i = shift; | |
129 | my $title = shift; | |
130 | my $params = shift; | |
b6f0f050 | 131 | my $expected_result = shift; |
b422ba3d RL |
132 | $params = [ '-server', "127.0.0.1:$server_port", @$params ] |
133 | unless grep { $_ eq '-server' } @$params; | |
321a48cd | 134 | my $cmd = app([@app, @$params]); |
b422ba3d | 135 | |
321a48cd | 136 | unless (is(my $actual_result = run($cmd), $expected_result, $title)) { |
d00be9f3 | 137 | if ($faillog) { |
c87bcdbd | 138 | my $quote_spc_empty = sub { $_ eq "" ? '""' : $_ =~ m/ / ? '"'.$_.'"' : $_ }; |
321a48cd | 139 | my $invocation = cmdstr($cmd, display => 1); |
c87bcdbd | 140 | print $faillog "$server_name $aspect \"$title\" ($i/$n)". |
b6f0f050 | 141 | " expected=$expected_result actual=$actual_result\n"; |
c87bcdbd DDO |
142 | print $faillog "$invocation\n\n"; |
143 | } | |
d00be9f3 | 144 | } |
c87bcdbd DDO |
145 | } |
146 | ||
147 | sub test_cmp_http_aspect { | |
148 | my $server_name = shift; | |
149 | my $aspect = shift; | |
150 | my $tests = shift; | |
151 | subtest "CMP app CLI $server_name $aspect\n" => sub { | |
152 | my $n = scalar @$tests; | |
153 | plan tests => $n; | |
154 | my $i = 1; | |
155 | foreach (@$tests) { | |
156 | test_cmp_http($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]); | |
157 | sleep($sleep); | |
158 | } | |
159 | }; | |
160 | # not unlinking test.certout*.pem, test.cacerts.pem, and test.extracerts.pem | |
161 | } | |
162 | ||
163 | # The input files for the tests done here dynamically depend on the test server | |
164 | # selected (where the Mock server used by default is just one possibility). | |
165 | # On the other hand the main test configuration file test.cnf, which references | |
166 | # several server-dependent input files by relative file names, is static. | |
167 | # Moreover the tests use much greater variety of input files than output files. | |
168 | # Therefore we chose the current directory as a subdirectory of $SRCTOP and it | |
169 | # was simpler to prepend the output file names by BLDTOP than doing the tests | |
170 | # from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP. | |
171 | ||
172 | indir data_dir() => sub { | |
173 | plan tests => @server_configurations * @all_aspects | |
174 | + (grep(/^Mock$/, @server_configurations) | |
175 | && grep(/^certstatus$/, @all_aspects)); | |
176 | ||
177 | foreach my $server_name (@server_configurations) { | |
178 | $server_name = chop_dblquot($server_name); | |
179 | load_config($server_name, $server_name); | |
180 | { | |
c6df354c | 181 | SKIP: { |
c87bcdbd DDO |
182 | my $pid; |
183 | if ($server_name eq "Mock") { | |
184 | indir "Mock" => sub { | |
185 | $pid = start_mock_server(""); | |
d357dd51 | 186 | die "Cannot start or find the started CMP mock server" unless $pid; |
c87bcdbd DDO |
187 | } |
188 | } | |
189 | foreach my $aspect (@all_aspects) { | |
190 | $aspect = chop_dblquot($aspect); | |
191 | next if $server_name eq "Mock" && $aspect eq "certstatus"; | |
192 | load_config($server_name, $aspect); # update with any aspect-specific settings | |
193 | indir $server_name => sub { | |
194 | my $tests = load_tests($server_name, $aspect); | |
195 | test_cmp_http_aspect($server_name, $aspect, $tests); | |
196 | }; | |
197 | }; | |
198 | stop_mock_server($pid) if $pid; | |
c6df354c | 199 | } |
c87bcdbd DDO |
200 | } |
201 | }; | |
202 | }; | |
203 | ||
204 | close($faillog) if $faillog; | |
205 | ||
206 | sub load_tests { | |
207 | my $server_name = shift; | |
208 | my $aspect = shift; | |
209 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
210 | my $file = data_file("test_$aspect.csv"); | |
211 | my $result_dir = result_dir(); | |
212 | my @result; | |
213 | ||
214 | open(my $data, '<', $file) || die "Cannot open $file for reading: $!"; | |
215 | LOOP: | |
216 | while (my $line = <$data>) { | |
217 | chomp $line; | |
218 | $line =~ s{\r\n}{\n}g; # adjust line endings | |
219 | $line =~ s{_CA_DN}{$ca_dn}g; | |
220 | $line =~ s{_SERVER_DN}{$server_dn}g; | |
221 | $line =~ s{_SERVER_HOST}{$server_host}g; | |
222 | $line =~ s{_SERVER_PORT}{$server_port}g; | |
223 | $line =~ s{_SERVER_TLS}{$server_tls}g; | |
224 | $line =~ s{_SERVER_PATH}{$server_path}g; | |
225 | $line =~ s{_SERVER_CERT}{$server_cert}g; | |
226 | $line =~ s{_KUR_PORT}{$kur_port}g; | |
227 | $line =~ s{_PBM_PORT}{$pbm_port}g; | |
228 | $line =~ s{_PBM_REF}{$pbm_ref}g; | |
229 | $line =~ s{_PBM_SECRET}{$pbm_secret}g; | |
230 | $line =~ s{_RESULT_DIR}{$result_dir}g; | |
231 | ||
232 | next LOOP if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/; | |
233 | my $noproxy = $no_proxy; | |
234 | if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) { | |
235 | $noproxy = $1; | |
236 | } elsif ($server_host eq "127.0.0.1") { | |
237 | # do connections to localhost (e.g., Mock server) without proxy | |
238 | $line =~ s{-section,,}{-section,,-no_proxy,127.0.0.1,} ; | |
239 | } | |
240 | if ($line =~ m/,\s*-proxy\s*,/) { | |
241 | next LOOP if $no_proxy && ($noproxy =~ $server_host); | |
242 | } else { | |
243 | $line =~ s{-section,,}{-section,,-proxy,$proxy,}; | |
244 | } | |
245 | $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,}; | |
246 | $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,}; | |
247 | ||
248 | my @fields = grep /\S/, split ",", $line; | |
249 | s/^<EMPTY>$// for (@fields); # used for proxy="" | |
250 | s/^\s+// for (@fields); # remove leading whitespace from elements | |
251 | s/\s+$// for (@fields); # remove trailing whitespace from elements | |
252 | s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements | |
b6f0f050 | 253 | my $expected_result = $fields[$column]; |
c87bcdbd DDO |
254 | my $description = 1; |
255 | my $title = $fields[$description]; | |
b6f0f050 DDO |
256 | next LOOP if (!defined($expected_result) |
257 | || ($expected_result ne 0 && $expected_result ne 1)); | |
c87bcdbd | 258 | @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1]; |
b6f0f050 | 259 | push @result, [$title, \@fields, $expected_result]; |
c87bcdbd DDO |
260 | } |
261 | close($data); | |
262 | return \@result; | |
263 | } | |
264 | ||
c87bcdbd DDO |
265 | sub start_mock_server { |
266 | my $args = $_[0]; # optional further CLI arguments | |
321a48cd | 267 | my $cmd = cmdstr(app([@app, '-config', 'server.cnf', |
d63053bb | 268 | $args ? $args : ()]), display => 1); |
b9cd82f9 | 269 | print "Current directory is ".getcwd()."\n"; |
b422ba3d | 270 | print "Launching mock server: $cmd\n"; |
d357dd51 | 271 | die "Invalid port: $server_port" unless $server_port =~ m/^\d+$/; |
b422ba3d RL |
272 | my $pid = open($server_fh, "$cmd|") or die "Trying to $cmd"; |
273 | print "Pid is: $pid\n"; | |
c796cc97 | 274 | if ($server_port == 0) { |
d357dd51 DDO |
275 | # Find out the actual server port |
276 | while (<$server_fh>) { | |
ee1d1db8 DDO |
277 | print "Server output: $_"; |
278 | next if m/using section/; | |
d357dd51 | 279 | s/\R$//; # Better chomp |
d63053bb | 280 | ($server_port, $pid) = ($1, $2) if /^ACCEPT\s.*:(\d+) PID=(\d+)$/; |
ee1d1db8 | 281 | last; # Do not loop further to prevent hangs on server misbehavior |
97cf9b05 | 282 | } |
b422ba3d | 283 | } |
ee1d1db8 DDO |
284 | unless ($server_port > 0) { |
285 | stop_mock_server($pid); | |
286 | return 0; | |
287 | } | |
97cf9b05 RL |
288 | $server_tls = $kur_port = $pbm_port = $server_port; |
289 | return $pid; | |
c87bcdbd DDO |
290 | } |
291 | ||
292 | sub stop_mock_server { | |
293 | my $pid = $_[0]; | |
f7c4d862 | 294 | print "Killing mock server with pid=$pid\n"; |
e23206ae | 295 | kill('KILL', $pid); |
c87bcdbd | 296 | } |