]>
Commit | Line | Data |
---|---|---|
c87bcdbd | 1 | #! /usr/bin/env perl |
a28d06f3 | 2 | # Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved. |
c87bcdbd DDO |
3 | # Copyright Nokia 2007-2019 |
4 | # Copyright Siemens AG 2015-2019 | |
5 | # | |
6 | # Licensed under the Apache License 2.0 (the "License"). You may not use | |
7 | # this file except in compliance with the License. You can obtain a copy | |
8 | # in the file LICENSE in the source distribution or at | |
9 | # https://www.openssl.org/source/license.html | |
10 | ||
11 | use strict; | |
12 | use warnings; | |
13 | ||
14 | use POSIX; | |
d00be9f3 | 15 | use OpenSSL::Test qw/:DEFAULT data_file data_dir srctop_dir bldtop_dir result_dir/; |
c87bcdbd DDO |
16 | use OpenSSL::Test::Utils; |
17 | ||
18 | BEGIN { | |
19 | setup("test_cmp_http"); | |
20 | } | |
21 | use lib srctop_dir('Configurations'); | |
22 | use lib bldtop_dir('.'); | |
e25b4db7 | 23 | |
c87bcdbd | 24 | plan skip_all => "These tests are not supported in a fuzz build" |
c6b72390 | 25 | if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/; |
c87bcdbd DDO |
26 | |
27 | plan skip_all => "These tests are not supported in a no-cmp build" | |
28 | if disabled("cmp"); | |
29 | plan skip_all => "These tests are not supported in a no-ec build" | |
30 | if disabled("ec"); | |
b422ba3d RL |
31 | plan skip_all => "These tests are not supported in a no-sock build" |
32 | if disabled("sock"); | |
c87bcdbd | 33 | |
f6b6574c JS |
34 | plan skip_all => "Tests involving local HTTP server not available on Windows or VMS" |
35 | if $^O =~ /^(VMS|MSWin32)$/; | |
c87bcdbd DDO |
36 | plan skip_all => "Tests involving local HTTP server not available in cross-compile builds" |
37 | if defined $ENV{EXE_SHELL}; | |
c87bcdbd DDO |
38 | |
39 | sub chop_dblquot { # chop any leading and trailing '"' (needed for Windows) | |
40 | my $str = shift; | |
41 | $str =~ s/^\"(.*?)\"$/$1/; | |
42 | return $str; | |
43 | } | |
44 | ||
45 | my $proxy = "<EMPTY>"; | |
46 | $proxy = chop_dblquot($ENV{http_proxy} // $ENV{HTTP_PROXY} // $proxy); | |
47 | $proxy =~ s{^https?://}{}i; | |
48 | my $no_proxy = $ENV{no_proxy} // $ENV{NO_PROXY}; | |
49 | ||
50 | my $app = "apps/openssl cmp"; | |
51 | ||
52 | # the CMP server configuration consists of: | |
53 | my $ca_dn; # The CA's Distinguished Name | |
54 | my $server_dn; # The server's Distinguished Name | |
55 | my $server_host;# The server's host name or IP address | |
56 | my $server_port;# The server's port | |
57 | my $server_tls; # The server's TLS port, if any, or 0 | |
58 | my $server_path;# The server's CMP alias | |
59 | my $server_cert;# The server's cert | |
60 | my $kur_port; # The server's port for kur (cert update) | |
61 | my $pbm_port; # The server port to be used for PBM | |
62 | my $pbm_ref; # The reference for PBM | |
63 | my $pbm_secret; # The secret for PBM | |
64 | my $column; # The column number of the expected result | |
65 | my $sleep = 0; # The time to sleep between two requests | |
b422ba3d | 66 | my $server_fh; # Server file handle |
c87bcdbd DDO |
67 | |
68 | # The local $server_name variables below are among others taken as the name of a | |
69 | # sub-directory with server-specific certs etc. and CA-specific config section. | |
70 | ||
71 | sub load_config { | |
72 | my $server_name = shift; | |
73 | my $section = shift; | |
74 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
75 | open (CH, $test_config) or die "Cannot open $test_config: $!"; | |
76 | my $active = 0; | |
77 | while (<CH>) { | |
78 | if (m/\[\s*$section\s*\]/) { | |
79 | $active = 1; | |
80 | } elsif (m/\[\s*.*?\s*\]/) { | |
81 | $active = 0; | |
82 | } elsif ($active) { | |
83 | $ca_dn = $1 eq "" ? '""""' : $1 if m/^\s*ca_dn\s*=\s*(.*)?\s*$/; | |
84 | $server_dn = $1 eq "" ? '""""' : $1 if m/^\s*server_dn\s*=\s*(.*)?\s*$/; | |
85 | $server_host = $1 eq "" ? '""""' : $1 if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/; | |
86 | $server_port = $1 eq "" ? '""""' : $1 if m/^\s*server_port\s*=\s*(.*)?\s*$/; | |
87 | $server_tls = $1 eq "" ? '""""' : $1 if m/^\s*server_tls\s*=\s*(.*)?\s*$/; | |
88 | $server_path = $1 eq "" ? '""""' : $1 if m/^\s*server_path\s*=\s*(.*)?\s*$/; | |
89 | $server_cert = $1 eq "" ? '""""' : $1 if m/^\s*server_cert\s*=\s*(.*)?\s*$/; | |
90 | $kur_port = $1 eq "" ? '""""' : $1 if m/^\s*kur_port\s*=\s*(.*)?\s*$/; | |
91 | $pbm_port = $1 eq "" ? '""""' : $1 if m/^\s*pbm_port\s*=\s*(.*)?\s*$/; | |
92 | $pbm_ref = $1 eq "" ? '""""' : $1 if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/; | |
93 | $pbm_secret = $1 eq "" ? '""""' : $1 if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/; | |
94 | $column = $1 eq "" ? '""""' : $1 if m/^\s*column\s*=\s*(.*)?\s*$/; | |
95 | $sleep = $1 eq "" ? '""""' : $1 if m/^\s*sleep\s*=\s*(.*)?\s*$/; | |
96 | } | |
97 | } | |
98 | close CH; | |
99 | die "Cannot find all CMP server config values in $test_config section [$section]\n" | |
100 | if !defined $ca_dn | |
101 | || !defined $server_dn || !defined $server_host | |
102 | || !defined $server_port || !defined $server_tls | |
103 | || !defined $server_path || !defined $server_cert | |
104 | || !defined $kur_port || !defined $pbm_port | |
105 | || !defined $pbm_ref || !defined $pbm_secret | |
106 | || !defined $column || !defined $sleep; | |
107 | $server_dn = $server_dn // $ca_dn; | |
108 | } | |
109 | ||
110 | my @server_configurations = ("Mock"); | |
111 | @server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER} if $ENV{OPENSSL_CMP_SERVER}; | |
112 | # set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers | |
113 | ||
114 | my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment"); | |
115 | @all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS} if $ENV{OPENSSL_CMP_ASPECTS}; | |
116 | # set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects | |
117 | ||
118 | my $faillog; | |
119 | my $file = $ENV{HARNESS_FAILLOG}; # pathname relative to result_dir | |
120 | if ($file) { | |
121 | open($faillog, ">", $file) or die "Cannot open $file for writing: $!"; | |
122 | } | |
123 | ||
124 | sub test_cmp_http { | |
125 | my $server_name = shift; | |
126 | my $aspect = shift; | |
127 | my $n = shift; | |
128 | my $i = shift; | |
129 | my $title = shift; | |
130 | my $params = shift; | |
b6f0f050 | 131 | my $expected_result = shift; |
c87bcdbd | 132 | my $path_app = bldtop_dir($app); |
b422ba3d RL |
133 | $params = [ '-server', "127.0.0.1:$server_port", @$params ] |
134 | unless grep { $_ eq '-server' } @$params; | |
135 | ||
d00be9f3 RL |
136 | unless (is(my $actual_result = run(cmd([$path_app, @$params,])), |
137 | $expected_result, | |
138 | $title)) { | |
139 | if ($faillog) { | |
c87bcdbd DDO |
140 | my $quote_spc_empty = sub { $_ eq "" ? '""' : $_ =~ m/ / ? '"'.$_.'"' : $_ }; |
141 | my $invocation = "$path_app ".join(' ', map $quote_spc_empty->($_), @$params); | |
142 | print $faillog "$server_name $aspect \"$title\" ($i/$n)". | |
b6f0f050 | 143 | " expected=$expected_result actual=$actual_result\n"; |
c87bcdbd DDO |
144 | print $faillog "$invocation\n\n"; |
145 | } | |
d00be9f3 | 146 | } |
c87bcdbd DDO |
147 | } |
148 | ||
149 | sub test_cmp_http_aspect { | |
150 | my $server_name = shift; | |
151 | my $aspect = shift; | |
152 | my $tests = shift; | |
153 | subtest "CMP app CLI $server_name $aspect\n" => sub { | |
154 | my $n = scalar @$tests; | |
155 | plan tests => $n; | |
156 | my $i = 1; | |
157 | foreach (@$tests) { | |
158 | test_cmp_http($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]); | |
159 | sleep($sleep); | |
160 | } | |
161 | }; | |
162 | # not unlinking test.certout*.pem, test.cacerts.pem, and test.extracerts.pem | |
163 | } | |
164 | ||
165 | # The input files for the tests done here dynamically depend on the test server | |
166 | # selected (where the Mock server used by default is just one possibility). | |
167 | # On the other hand the main test configuration file test.cnf, which references | |
168 | # several server-dependent input files by relative file names, is static. | |
169 | # Moreover the tests use much greater variety of input files than output files. | |
170 | # Therefore we chose the current directory as a subdirectory of $SRCTOP and it | |
171 | # was simpler to prepend the output file names by BLDTOP than doing the tests | |
172 | # from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP. | |
173 | ||
174 | indir data_dir() => sub { | |
175 | plan tests => @server_configurations * @all_aspects | |
176 | + (grep(/^Mock$/, @server_configurations) | |
177 | && grep(/^certstatus$/, @all_aspects)); | |
178 | ||
179 | foreach my $server_name (@server_configurations) { | |
180 | $server_name = chop_dblquot($server_name); | |
181 | load_config($server_name, $server_name); | |
182 | { | |
c6df354c | 183 | SKIP: { |
c87bcdbd DDO |
184 | my $pid; |
185 | if ($server_name eq "Mock") { | |
186 | indir "Mock" => sub { | |
187 | $pid = start_mock_server(""); | |
d357dd51 | 188 | die "Cannot start or find the started CMP mock server" unless $pid; |
c87bcdbd DDO |
189 | } |
190 | } | |
191 | foreach my $aspect (@all_aspects) { | |
192 | $aspect = chop_dblquot($aspect); | |
193 | next if $server_name eq "Mock" && $aspect eq "certstatus"; | |
194 | load_config($server_name, $aspect); # update with any aspect-specific settings | |
195 | indir $server_name => sub { | |
196 | my $tests = load_tests($server_name, $aspect); | |
197 | test_cmp_http_aspect($server_name, $aspect, $tests); | |
198 | }; | |
199 | }; | |
200 | stop_mock_server($pid) if $pid; | |
c6df354c | 201 | } |
c87bcdbd DDO |
202 | } |
203 | }; | |
204 | }; | |
205 | ||
206 | close($faillog) if $faillog; | |
207 | ||
208 | sub load_tests { | |
209 | my $server_name = shift; | |
210 | my $aspect = shift; | |
211 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
212 | my $file = data_file("test_$aspect.csv"); | |
213 | my $result_dir = result_dir(); | |
214 | my @result; | |
215 | ||
216 | open(my $data, '<', $file) || die "Cannot open $file for reading: $!"; | |
217 | LOOP: | |
218 | while (my $line = <$data>) { | |
219 | chomp $line; | |
220 | $line =~ s{\r\n}{\n}g; # adjust line endings | |
221 | $line =~ s{_CA_DN}{$ca_dn}g; | |
222 | $line =~ s{_SERVER_DN}{$server_dn}g; | |
223 | $line =~ s{_SERVER_HOST}{$server_host}g; | |
224 | $line =~ s{_SERVER_PORT}{$server_port}g; | |
225 | $line =~ s{_SERVER_TLS}{$server_tls}g; | |
226 | $line =~ s{_SERVER_PATH}{$server_path}g; | |
227 | $line =~ s{_SERVER_CERT}{$server_cert}g; | |
228 | $line =~ s{_KUR_PORT}{$kur_port}g; | |
229 | $line =~ s{_PBM_PORT}{$pbm_port}g; | |
230 | $line =~ s{_PBM_REF}{$pbm_ref}g; | |
231 | $line =~ s{_PBM_SECRET}{$pbm_secret}g; | |
232 | $line =~ s{_RESULT_DIR}{$result_dir}g; | |
233 | ||
234 | next LOOP if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/; | |
235 | my $noproxy = $no_proxy; | |
236 | if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) { | |
237 | $noproxy = $1; | |
238 | } elsif ($server_host eq "127.0.0.1") { | |
239 | # do connections to localhost (e.g., Mock server) without proxy | |
240 | $line =~ s{-section,,}{-section,,-no_proxy,127.0.0.1,} ; | |
241 | } | |
242 | if ($line =~ m/,\s*-proxy\s*,/) { | |
243 | next LOOP if $no_proxy && ($noproxy =~ $server_host); | |
244 | } else { | |
245 | $line =~ s{-section,,}{-section,,-proxy,$proxy,}; | |
246 | } | |
247 | $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,}; | |
248 | $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,}; | |
249 | ||
250 | my @fields = grep /\S/, split ",", $line; | |
251 | s/^<EMPTY>$// for (@fields); # used for proxy="" | |
252 | s/^\s+// for (@fields); # remove leading whitespace from elements | |
253 | s/\s+$// for (@fields); # remove trailing whitespace from elements | |
254 | s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements | |
b6f0f050 | 255 | my $expected_result = $fields[$column]; |
c87bcdbd DDO |
256 | my $description = 1; |
257 | my $title = $fields[$description]; | |
b6f0f050 DDO |
258 | next LOOP if (!defined($expected_result) |
259 | || ($expected_result ne 0 && $expected_result ne 1)); | |
c87bcdbd | 260 | @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1]; |
b6f0f050 | 261 | push @result, [$title, \@fields, $expected_result]; |
c87bcdbd DDO |
262 | } |
263 | close($data); | |
264 | return \@result; | |
265 | } | |
266 | ||
c87bcdbd DDO |
267 | sub start_mock_server { |
268 | my $args = $_[0]; # optional further CLI arguments | |
269 | my $dir = bldtop_dir(""); | |
b422ba3d RL |
270 | local $ENV{LD_LIBRARY_PATH} = $dir; |
271 | local $ENV{DYLD_LIBRARY_PATH} = $dir; | |
272 | my $cmd = bldtop_dir($app) . " -config server.cnf $args"; | |
b9cd82f9 | 273 | print "Current directory is ".getcwd()."\n"; |
b422ba3d | 274 | print "Launching mock server: $cmd\n"; |
d357dd51 | 275 | die "Invalid port: $server_port" unless $server_port =~ m/^\d+$/; |
b422ba3d RL |
276 | my $pid = open($server_fh, "$cmd|") or die "Trying to $cmd"; |
277 | print "Pid is: $pid\n"; | |
c796cc97 | 278 | if ($server_port == 0) { |
d357dd51 DDO |
279 | # Find out the actual server port |
280 | while (<$server_fh>) { | |
ee1d1db8 DDO |
281 | print "Server output: $_"; |
282 | next if m/using section/; | |
d357dd51 | 283 | s/\R$//; # Better chomp |
ee1d1db8 DDO |
284 | $server_port = $1 if /^ACCEPT\s.*:(\d+)$/; |
285 | last; # Do not loop further to prevent hangs on server misbehavior | |
97cf9b05 | 286 | } |
b422ba3d | 287 | } |
ee1d1db8 DDO |
288 | unless ($server_port > 0) { |
289 | stop_mock_server($pid); | |
290 | return 0; | |
291 | } | |
97cf9b05 RL |
292 | $server_tls = $kur_port = $pbm_port = $server_port; |
293 | return $pid; | |
c87bcdbd DDO |
294 | } |
295 | ||
296 | sub stop_mock_server { | |
297 | my $pid = $_[0]; | |
f7c4d862 | 298 | print "Killing mock server with pid=$pid\n"; |
b422ba3d | 299 | kill('QUIT', $pid) if $pid; |
c87bcdbd | 300 | } |