]>
Commit | Line | Data |
---|---|---|
c87bcdbd | 1 | #! /usr/bin/env perl |
da1c088f | 2 | # Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved. |
c87bcdbd DDO |
3 | # Copyright Nokia 2007-2019 |
4 | # Copyright Siemens AG 2015-2019 | |
5 | # | |
6 | # Licensed under the Apache License 2.0 (the "License"). You may not use | |
7 | # this file except in compliance with the License. You can obtain a copy | |
8 | # in the file LICENSE in the source distribution or at | |
9 | # https://www.openssl.org/source/license.html | |
10 | ||
11 | use strict; | |
12 | use warnings; | |
13 | ||
14 | use POSIX; | |
d63053bb | 15 | use OpenSSL::Test qw/:DEFAULT cmdstr data_file data_dir srctop_dir bldtop_dir result_dir/; |
c87bcdbd DDO |
16 | use OpenSSL::Test::Utils; |
17 | ||
18 | BEGIN { | |
19 | setup("test_cmp_http"); | |
20 | } | |
21 | use lib srctop_dir('Configurations'); | |
22 | use lib bldtop_dir('.'); | |
e25b4db7 | 23 | |
c87bcdbd | 24 | plan skip_all => "These tests are not supported in a fuzz build" |
c6b72390 | 25 | if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/; |
c87bcdbd DDO |
26 | |
27 | plan skip_all => "These tests are not supported in a no-cmp build" | |
28 | if disabled("cmp"); | |
01b04851 DDO |
29 | plan skip_all => "These tests are not supported in a no-ecx build" |
30 | if disabled("ecx"); # EC and EDDSA test certs, e.g., in Mock/newWithNew.pem | |
b422ba3d RL |
31 | plan skip_all => "These tests are not supported in a no-sock build" |
32 | if disabled("sock"); | |
3ca28c9e VK |
33 | plan skip_all => "These tests are not supported in a no-http build" |
34 | if disabled("http"); | |
c87bcdbd | 35 | |
f6b6574c | 36 | plan skip_all => "Tests involving local HTTP server not available on Windows or VMS" |
53d0d01f | 37 | if $^O =~ /^(VMS|MSWin32|msys)$/; |
c87bcdbd DDO |
38 | plan skip_all => "Tests involving local HTTP server not available in cross-compile builds" |
39 | if defined $ENV{EXE_SHELL}; | |
c87bcdbd DDO |
40 | |
41 | sub chop_dblquot { # chop any leading and trailing '"' (needed for Windows) | |
42 | my $str = shift; | |
43 | $str =~ s/^\"(.*?)\"$/$1/; | |
44 | return $str; | |
45 | } | |
46 | ||
1ed3249f DDO |
47 | my $proxy = chop_dblquot($ENV{http_proxy} // $ENV{HTTP_PROXY} // ""); |
48 | $proxy = "<EMPTY>" if $proxy eq ""; | |
c87bcdbd DDO |
49 | $proxy =~ s{^https?://}{}i; |
50 | my $no_proxy = $ENV{no_proxy} // $ENV{NO_PROXY}; | |
51 | ||
321a48cd | 52 | my @app = qw(openssl cmp); |
c87bcdbd | 53 | |
1738eb21 | 54 | # the server-dependent client configuration consists of: |
c87bcdbd DDO |
55 | my $ca_dn; # The CA's Distinguished Name |
56 | my $server_dn; # The server's Distinguished Name | |
9929c817 | 57 | my $server_host;# The server's hostname or IP address |
c87bcdbd DDO |
58 | my $server_port;# The server's port |
59 | my $server_tls; # The server's TLS port, if any, or 0 | |
60 | my $server_path;# The server's CMP alias | |
61 | my $server_cert;# The server's cert | |
62 | my $kur_port; # The server's port for kur (cert update) | |
63 | my $pbm_port; # The server port to be used for PBM | |
64 | my $pbm_ref; # The reference for PBM | |
65 | my $pbm_secret; # The secret for PBM | |
66 | my $column; # The column number of the expected result | |
67 | my $sleep = 0; # The time to sleep between two requests | |
1738eb21 DDO |
68 | |
69 | # the dynamic server info: | |
b422ba3d | 70 | my $server_fh; # Server file handle |
c87bcdbd | 71 | |
8d703a04 DDO |
72 | sub subst_env { |
73 | my $val = shift; | |
74 | return '""""' if $val eq ""; | |
75 | return $ENV{$1} if $val =~ /^\$\{ENV::(\w+)}$/; | |
76 | return $val; | |
77 | } | |
78 | ||
1738eb21 DDO |
79 | # The local $server_name variables in the subroutines below are used |
80 | # both as the name of a sub-directory with server-specific credentials | |
81 | # and as the name of a server-dependent client config section. | |
82 | ||
c87bcdbd DDO |
83 | sub load_config { |
84 | my $server_name = shift; | |
85 | my $section = shift; | |
86 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
87 | open (CH, $test_config) or die "Cannot open $test_config: $!"; | |
88 | my $active = 0; | |
89 | while (<CH>) { | |
90 | if (m/\[\s*$section\s*\]/) { | |
91 | $active = 1; | |
92 | } elsif (m/\[\s*.*?\s*\]/) { | |
93 | $active = 0; | |
94 | } elsif ($active) { | |
1738eb21 | 95 | # if there are multiple entries with same key, the last one prevails |
8d703a04 DDO |
96 | $ca_dn = subst_env($1) if m/^\s*ca_dn\s*=\s*(.*)?\s*$/; |
97 | $server_dn = subst_env($1) if m/^\s*server_dn\s*=\s*(.*)?\s*$/; | |
98 | $server_host = subst_env($1) if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/; | |
1738eb21 | 99 | $server_port = subst_env($1) if m/^\s*server_port\s*=\s*(\S*)?\s*(\#.*)?$/; |
8d703a04 DDO |
100 | $server_tls = subst_env($1) if m/^\s*server_tls\s*=\s*(.*)?\s*$/; |
101 | $server_path = subst_env($1) if m/^\s*server_path\s*=\s*(.*)?\s*$/; | |
102 | $server_cert = subst_env($1) if m/^\s*server_cert\s*=\s*(.*)?\s*$/; | |
103 | $kur_port = subst_env($1) if m/^\s*kur_port\s*=\s*(.*)?\s*$/; | |
104 | $pbm_port = subst_env($1) if m/^\s*pbm_port\s*=\s*(.*)?\s*$/; | |
105 | $pbm_ref = subst_env($1) if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/; | |
106 | $pbm_secret = subst_env($1) if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/; | |
107 | $column = subst_env($1) if m/^\s*column\s*=\s*(.*)?\s*$/; | |
108 | $sleep = subst_env($1) if m/^\s*sleep\s*=\s*(.*)?\s*$/; | |
c87bcdbd DDO |
109 | } |
110 | } | |
111 | close CH; | |
1738eb21 | 112 | die "Cannot find all server-dependent config values in $test_config section [$section]\n" |
c87bcdbd DDO |
113 | if !defined $ca_dn |
114 | || !defined $server_dn || !defined $server_host | |
115 | || !defined $server_port || !defined $server_tls | |
116 | || !defined $server_path || !defined $server_cert | |
117 | || !defined $kur_port || !defined $pbm_port | |
118 | || !defined $pbm_ref || !defined $pbm_secret | |
119 | || !defined $column || !defined $sleep; | |
1738eb21 DDO |
120 | die "Invalid server_port number in $test_config section [$section]: $server_port" |
121 | unless $server_port =~ m/^\d+$/; | |
c87bcdbd DDO |
122 | $server_dn = $server_dn // $ca_dn; |
123 | } | |
124 | ||
125 | my @server_configurations = ("Mock"); | |
126 | @server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER} if $ENV{OPENSSL_CMP_SERVER}; | |
127 | # set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers | |
128 | ||
129 | my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment"); | |
130 | @all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS} if $ENV{OPENSSL_CMP_ASPECTS}; | |
131 | # set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects | |
132 | ||
133 | my $faillog; | |
134 | my $file = $ENV{HARNESS_FAILLOG}; # pathname relative to result_dir | |
135 | if ($file) { | |
8d703a04 | 136 | open($faillog, ">", $file) or die "Cannot open '$file' for writing: $!"; |
c87bcdbd DDO |
137 | } |
138 | ||
139 | sub test_cmp_http { | |
140 | my $server_name = shift; | |
141 | my $aspect = shift; | |
142 | my $n = shift; | |
143 | my $i = shift; | |
144 | my $title = shift; | |
145 | my $params = shift; | |
b6f0f050 | 146 | my $expected_result = shift; |
b422ba3d | 147 | $params = [ '-server', "127.0.0.1:$server_port", @$params ] |
8d703a04 | 148 | if ($server_name eq "Mock" && !(grep { $_ eq '-server' } @$params)); |
321a48cd | 149 | my $cmd = app([@app, @$params]); |
b422ba3d | 150 | |
321a48cd | 151 | unless (is(my $actual_result = run($cmd), $expected_result, $title)) { |
d00be9f3 | 152 | if ($faillog) { |
c87bcdbd | 153 | my $quote_spc_empty = sub { $_ eq "" ? '""' : $_ =~ m/ / ? '"'.$_.'"' : $_ }; |
321a48cd | 154 | my $invocation = cmdstr($cmd, display => 1); |
c87bcdbd | 155 | print $faillog "$server_name $aspect \"$title\" ($i/$n)". |
1738eb21 DDO |
156 | " expected=$expected_result (". |
157 | ($expected_result ? "success" : "failure").")". | |
158 | " actual=$actual_result\n"; | |
c87bcdbd DDO |
159 | print $faillog "$invocation\n\n"; |
160 | } | |
8d703a04 | 161 | sleep($sleep) if $expected_result == 1; |
d00be9f3 | 162 | } |
c87bcdbd DDO |
163 | } |
164 | ||
165 | sub test_cmp_http_aspect { | |
166 | my $server_name = shift; | |
167 | my $aspect = shift; | |
168 | my $tests = shift; | |
169 | subtest "CMP app CLI $server_name $aspect\n" => sub { | |
170 | my $n = scalar @$tests; | |
171 | plan tests => $n; | |
172 | my $i = 1; | |
173 | foreach (@$tests) { | |
174 | test_cmp_http($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]); | |
c87bcdbd DDO |
175 | } |
176 | }; | |
8d703a04 | 177 | # not unlinking test.cert.pem, test.cacerts.pem, and test.extracerts.pem |
c87bcdbd DDO |
178 | } |
179 | ||
180 | # The input files for the tests done here dynamically depend on the test server | |
8d703a04 | 181 | # selected (where the mock server used by default is just one possibility). |
c87bcdbd DDO |
182 | # On the other hand the main test configuration file test.cnf, which references |
183 | # several server-dependent input files by relative file names, is static. | |
184 | # Moreover the tests use much greater variety of input files than output files. | |
185 | # Therefore we chose the current directory as a subdirectory of $SRCTOP and it | |
186 | # was simpler to prepend the output file names by BLDTOP than doing the tests | |
187 | # from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP. | |
188 | ||
189 | indir data_dir() => sub { | |
128d1c3c | 190 | plan tests => 1 + @server_configurations * @all_aspects |
7a86cb69 | 191 | - (grep(/^Mock$/, @server_configurations) |
c87bcdbd DDO |
192 | && grep(/^certstatus$/, @all_aspects)); |
193 | ||
194 | foreach my $server_name (@server_configurations) { | |
195 | $server_name = chop_dblquot($server_name); | |
196 | load_config($server_name, $server_name); | |
197 | { | |
c6df354c | 198 | SKIP: { |
c87bcdbd DDO |
199 | my $pid; |
200 | if ($server_name eq "Mock") { | |
201 | indir "Mock" => sub { | |
1738eb21 DDO |
202 | $pid = start_server($server_name, ""); |
203 | next unless $pid; | |
c87bcdbd DDO |
204 | } |
205 | } | |
206 | foreach my $aspect (@all_aspects) { | |
207 | $aspect = chop_dblquot($aspect); | |
8d703a04 | 208 | if ($server_name eq "Mock" && $aspect eq "certstatus") { |
1738eb21 | 209 | print "Skipping certstatus check as not supported by $server_name server\n"; |
8d703a04 DDO |
210 | next; |
211 | } | |
c87bcdbd DDO |
212 | load_config($server_name, $aspect); # update with any aspect-specific settings |
213 | indir $server_name => sub { | |
214 | my $tests = load_tests($server_name, $aspect); | |
215 | test_cmp_http_aspect($server_name, $aspect, $tests); | |
216 | }; | |
217 | }; | |
1738eb21 DDO |
218 | stop_server($server_name, $pid) if $pid; |
219 | ok(1, "$server_name server has terminated"); | |
c6df354c | 220 | } |
c87bcdbd DDO |
221 | } |
222 | }; | |
223 | }; | |
224 | ||
225 | close($faillog) if $faillog; | |
226 | ||
227 | sub load_tests { | |
228 | my $server_name = shift; | |
229 | my $aspect = shift; | |
230 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
231 | my $file = data_file("test_$aspect.csv"); | |
232 | my $result_dir = result_dir(); | |
233 | my @result; | |
234 | ||
8d703a04 | 235 | open(my $data, '<', $file) || die "Cannot open '$file' for reading: $!"; |
c87bcdbd DDO |
236 | LOOP: |
237 | while (my $line = <$data>) { | |
238 | chomp $line; | |
239 | $line =~ s{\r\n}{\n}g; # adjust line endings | |
240 | $line =~ s{_CA_DN}{$ca_dn}g; | |
241 | $line =~ s{_SERVER_DN}{$server_dn}g; | |
242 | $line =~ s{_SERVER_HOST}{$server_host}g; | |
243 | $line =~ s{_SERVER_PORT}{$server_port}g; | |
244 | $line =~ s{_SERVER_TLS}{$server_tls}g; | |
245 | $line =~ s{_SERVER_PATH}{$server_path}g; | |
246 | $line =~ s{_SERVER_CERT}{$server_cert}g; | |
247 | $line =~ s{_KUR_PORT}{$kur_port}g; | |
248 | $line =~ s{_PBM_PORT}{$pbm_port}g; | |
249 | $line =~ s{_PBM_REF}{$pbm_ref}g; | |
250 | $line =~ s{_PBM_SECRET}{$pbm_secret}g; | |
251 | $line =~ s{_RESULT_DIR}{$result_dir}g; | |
252 | ||
253 | next LOOP if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/; | |
254 | my $noproxy = $no_proxy; | |
255 | if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) { | |
256 | $noproxy = $1; | |
257 | } elsif ($server_host eq "127.0.0.1") { | |
8d703a04 | 258 | # do connections to localhost (e.g., mock server) without proxy |
c87bcdbd DDO |
259 | $line =~ s{-section,,}{-section,,-no_proxy,127.0.0.1,} ; |
260 | } | |
261 | if ($line =~ m/,\s*-proxy\s*,/) { | |
262 | next LOOP if $no_proxy && ($noproxy =~ $server_host); | |
263 | } else { | |
264 | $line =~ s{-section,,}{-section,,-proxy,$proxy,}; | |
265 | } | |
75cce8dd DDO |
266 | $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,} |
267 | if $aspect ne "commands" || $line =~ m/,\s*-cmd\s*,\s*(ir|cr|p10cr|kur)\s*,/; | |
c87bcdbd DDO |
268 | $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,}; |
269 | ||
270 | my @fields = grep /\S/, split ",", $line; | |
271 | s/^<EMPTY>$// for (@fields); # used for proxy="" | |
272 | s/^\s+// for (@fields); # remove leading whitespace from elements | |
273 | s/\s+$// for (@fields); # remove trailing whitespace from elements | |
274 | s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements | |
b6f0f050 | 275 | my $expected_result = $fields[$column]; |
c87bcdbd DDO |
276 | my $description = 1; |
277 | my $title = $fields[$description]; | |
b6f0f050 DDO |
278 | next LOOP if (!defined($expected_result) |
279 | || ($expected_result ne 0 && $expected_result ne 1)); | |
56562c47 | 280 | next LOOP if ($line =~ m/-server,\[.*:.*\]/ && !have_IPv6()); |
c87bcdbd | 281 | @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1]; |
b6f0f050 | 282 | push @result, [$title, \@fields, $expected_result]; |
c87bcdbd DDO |
283 | } |
284 | close($data); | |
285 | return \@result; | |
286 | } | |
287 | ||
1738eb21 DDO |
288 | sub start_server { |
289 | my $server_name = shift; | |
290 | my $args = shift; # optional further CLI arguments | |
321a48cd | 291 | my $cmd = cmdstr(app([@app, '-config', 'server.cnf', |
d63053bb | 292 | $args ? $args : ()]), display => 1); |
b9cd82f9 | 293 | print "Current directory is ".getcwd()."\n"; |
1738eb21 DDO |
294 | print "Launching $server_name server: $cmd\n"; |
295 | my $pid = open($server_fh, "$cmd|"); | |
296 | unless ($pid) { | |
297 | print "Error launching $cmd, cannot obtain $server_name server PID"; | |
298 | return 0; | |
299 | } | |
300 | print "$server_name server PID=$pid\n"; | |
301 | ||
c796cc97 | 302 | if ($server_port == 0) { |
1738eb21 DDO |
303 | # Find out the actual server port and possibly different PID |
304 | $pid = 0; | |
d357dd51 | 305 | while (<$server_fh>) { |
1738eb21 | 306 | print "$server_name server output: $_"; |
ee1d1db8 | 307 | next if m/using section/; |
d357dd51 | 308 | s/\R$//; # Better chomp |
d63053bb | 309 | ($server_port, $pid) = ($1, $2) if /^ACCEPT\s.*:(\d+) PID=(\d+)$/; |
ee1d1db8 | 310 | last; # Do not loop further to prevent hangs on server misbehavior |
97cf9b05 | 311 | } |
b422ba3d | 312 | } |
ee1d1db8 | 313 | unless ($server_port > 0) { |
1738eb21 DDO |
314 | stop_server($server_name, $pid); |
315 | print "Cannot get expected output from the $server_name server"; | |
ee1d1db8 DDO |
316 | return 0; |
317 | } | |
1738eb21 DDO |
318 | $kur_port = $server_port if $kur_port eq "\$server_port"; |
319 | $pbm_port = $server_port if $pbm_port eq "\$server_port"; | |
320 | $server_tls = $server_port if $server_tls; | |
97cf9b05 | 321 | return $pid; |
c87bcdbd DDO |
322 | } |
323 | ||
1738eb21 DDO |
324 | sub stop_server { |
325 | my $server_name = shift; | |
326 | my $pid = shift; | |
327 | print "Killing $server_name server with PID=$pid\n"; | |
e23206ae | 328 | kill('KILL', $pid); |
128d1c3c | 329 | waitpid($pid, 0); |
c87bcdbd | 330 | } |