]>
Commit | Line | Data |
---|---|---|
c87bcdbd | 1 | #! /usr/bin/env perl |
a28d06f3 | 2 | # Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved. |
c87bcdbd DDO |
3 | # Copyright Nokia 2007-2019 |
4 | # Copyright Siemens AG 2015-2019 | |
5 | # | |
6 | # Licensed under the Apache License 2.0 (the "License"). You may not use | |
7 | # this file except in compliance with the License. You can obtain a copy | |
8 | # in the file LICENSE in the source distribution or at | |
9 | # https://www.openssl.org/source/license.html | |
10 | ||
11 | use strict; | |
12 | use warnings; | |
13 | ||
14 | use POSIX; | |
15 | use OpenSSL::Test qw/:DEFAULT with data_file data_dir srctop_dir bldtop_dir result_dir/; | |
16 | use OpenSSL::Test::Utils; | |
17 | ||
18 | BEGIN { | |
19 | setup("test_cmp_http"); | |
20 | } | |
21 | use lib srctop_dir('Configurations'); | |
22 | use lib bldtop_dir('.'); | |
e25b4db7 | 23 | |
c87bcdbd DDO |
24 | plan skip_all => "These tests are not supported in a fuzz build" |
25 | if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION/; | |
26 | ||
27 | plan skip_all => "These tests are not supported in a no-cmp build" | |
28 | if disabled("cmp"); | |
29 | plan skip_all => "These tests are not supported in a no-ec build" | |
30 | if disabled("ec"); | |
31 | ||
ed2e5b61 SL |
32 | plan skip_all => "Tests involving local HTTP server not available on Windows, AIX or VMS" |
33 | if $^O =~ /^(VMS|MSWin32|AIX)$/; | |
c87bcdbd DDO |
34 | plan skip_all => "Tests involving local HTTP server not available in cross-compile builds" |
35 | if defined $ENV{EXE_SHELL}; | |
36 | plan skip_all => "Tests involving local HTTP server require 'kill' command" | |
37 | if system("which kill"); | |
38 | plan skip_all => "Tests involving local HTTP server require 'lsof' command" | |
39 | if system("which lsof"); # this typically excludes Solaris | |
40 | ||
41 | sub chop_dblquot { # chop any leading and trailing '"' (needed for Windows) | |
42 | my $str = shift; | |
43 | $str =~ s/^\"(.*?)\"$/$1/; | |
44 | return $str; | |
45 | } | |
46 | ||
47 | my $proxy = "<EMPTY>"; | |
48 | $proxy = chop_dblquot($ENV{http_proxy} // $ENV{HTTP_PROXY} // $proxy); | |
49 | $proxy =~ s{^https?://}{}i; | |
50 | my $no_proxy = $ENV{no_proxy} // $ENV{NO_PROXY}; | |
51 | ||
52 | my $app = "apps/openssl cmp"; | |
53 | ||
54 | # the CMP server configuration consists of: | |
55 | my $ca_dn; # The CA's Distinguished Name | |
56 | my $server_dn; # The server's Distinguished Name | |
57 | my $server_host;# The server's host name or IP address | |
58 | my $server_port;# The server's port | |
59 | my $server_tls; # The server's TLS port, if any, or 0 | |
60 | my $server_path;# The server's CMP alias | |
61 | my $server_cert;# The server's cert | |
62 | my $kur_port; # The server's port for kur (cert update) | |
63 | my $pbm_port; # The server port to be used for PBM | |
64 | my $pbm_ref; # The reference for PBM | |
65 | my $pbm_secret; # The secret for PBM | |
66 | my $column; # The column number of the expected result | |
67 | my $sleep = 0; # The time to sleep between two requests | |
68 | ||
69 | # The local $server_name variables below are among others taken as the name of a | |
70 | # sub-directory with server-specific certs etc. and CA-specific config section. | |
71 | ||
72 | sub load_config { | |
73 | my $server_name = shift; | |
74 | my $section = shift; | |
75 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
76 | open (CH, $test_config) or die "Cannot open $test_config: $!"; | |
77 | my $active = 0; | |
78 | while (<CH>) { | |
79 | if (m/\[\s*$section\s*\]/) { | |
80 | $active = 1; | |
81 | } elsif (m/\[\s*.*?\s*\]/) { | |
82 | $active = 0; | |
83 | } elsif ($active) { | |
84 | $ca_dn = $1 eq "" ? '""""' : $1 if m/^\s*ca_dn\s*=\s*(.*)?\s*$/; | |
85 | $server_dn = $1 eq "" ? '""""' : $1 if m/^\s*server_dn\s*=\s*(.*)?\s*$/; | |
86 | $server_host = $1 eq "" ? '""""' : $1 if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/; | |
87 | $server_port = $1 eq "" ? '""""' : $1 if m/^\s*server_port\s*=\s*(.*)?\s*$/; | |
88 | $server_tls = $1 eq "" ? '""""' : $1 if m/^\s*server_tls\s*=\s*(.*)?\s*$/; | |
89 | $server_path = $1 eq "" ? '""""' : $1 if m/^\s*server_path\s*=\s*(.*)?\s*$/; | |
90 | $server_cert = $1 eq "" ? '""""' : $1 if m/^\s*server_cert\s*=\s*(.*)?\s*$/; | |
91 | $kur_port = $1 eq "" ? '""""' : $1 if m/^\s*kur_port\s*=\s*(.*)?\s*$/; | |
92 | $pbm_port = $1 eq "" ? '""""' : $1 if m/^\s*pbm_port\s*=\s*(.*)?\s*$/; | |
93 | $pbm_ref = $1 eq "" ? '""""' : $1 if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/; | |
94 | $pbm_secret = $1 eq "" ? '""""' : $1 if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/; | |
95 | $column = $1 eq "" ? '""""' : $1 if m/^\s*column\s*=\s*(.*)?\s*$/; | |
96 | $sleep = $1 eq "" ? '""""' : $1 if m/^\s*sleep\s*=\s*(.*)?\s*$/; | |
97 | } | |
98 | } | |
99 | close CH; | |
100 | die "Cannot find all CMP server config values in $test_config section [$section]\n" | |
101 | if !defined $ca_dn | |
102 | || !defined $server_dn || !defined $server_host | |
103 | || !defined $server_port || !defined $server_tls | |
104 | || !defined $server_path || !defined $server_cert | |
105 | || !defined $kur_port || !defined $pbm_port | |
106 | || !defined $pbm_ref || !defined $pbm_secret | |
107 | || !defined $column || !defined $sleep; | |
108 | $server_dn = $server_dn // $ca_dn; | |
109 | } | |
110 | ||
111 | my @server_configurations = ("Mock"); | |
112 | @server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER} if $ENV{OPENSSL_CMP_SERVER}; | |
113 | # set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers | |
114 | ||
115 | my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment"); | |
116 | @all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS} if $ENV{OPENSSL_CMP_ASPECTS}; | |
117 | # set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects | |
118 | ||
119 | my $faillog; | |
120 | my $file = $ENV{HARNESS_FAILLOG}; # pathname relative to result_dir | |
121 | if ($file) { | |
122 | open($faillog, ">", $file) or die "Cannot open $file for writing: $!"; | |
123 | } | |
124 | ||
125 | sub test_cmp_http { | |
126 | my $server_name = shift; | |
127 | my $aspect = shift; | |
128 | my $n = shift; | |
129 | my $i = shift; | |
130 | my $title = shift; | |
131 | my $params = shift; | |
132 | my $expected_exit = shift; | |
133 | my $path_app = bldtop_dir($app); | |
134 | with({ exit_checker => sub { | |
135 | my $actual_exit = shift; | |
136 | my $OK = $actual_exit == $expected_exit; | |
137 | if ($faillog && !$OK) { | |
138 | my $quote_spc_empty = sub { $_ eq "" ? '""' : $_ =~ m/ / ? '"'.$_.'"' : $_ }; | |
139 | my $invocation = "$path_app ".join(' ', map $quote_spc_empty->($_), @$params); | |
140 | print $faillog "$server_name $aspect \"$title\" ($i/$n)". | |
141 | " expected=$expected_exit actual=$actual_exit\n"; | |
142 | print $faillog "$invocation\n\n"; | |
143 | } | |
144 | return $OK; } }, | |
145 | sub { ok(run(cmd([$path_app, @$params,])), | |
146 | $title); }); | |
147 | } | |
148 | ||
149 | sub test_cmp_http_aspect { | |
150 | my $server_name = shift; | |
151 | my $aspect = shift; | |
152 | my $tests = shift; | |
153 | subtest "CMP app CLI $server_name $aspect\n" => sub { | |
154 | my $n = scalar @$tests; | |
155 | plan tests => $n; | |
156 | my $i = 1; | |
157 | foreach (@$tests) { | |
158 | test_cmp_http($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]); | |
159 | sleep($sleep); | |
160 | } | |
161 | }; | |
162 | # not unlinking test.certout*.pem, test.cacerts.pem, and test.extracerts.pem | |
163 | } | |
164 | ||
165 | # The input files for the tests done here dynamically depend on the test server | |
166 | # selected (where the Mock server used by default is just one possibility). | |
167 | # On the other hand the main test configuration file test.cnf, which references | |
168 | # several server-dependent input files by relative file names, is static. | |
169 | # Moreover the tests use much greater variety of input files than output files. | |
170 | # Therefore we chose the current directory as a subdirectory of $SRCTOP and it | |
171 | # was simpler to prepend the output file names by BLDTOP than doing the tests | |
172 | # from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP. | |
173 | ||
174 | indir data_dir() => sub { | |
175 | plan tests => @server_configurations * @all_aspects | |
176 | + (grep(/^Mock$/, @server_configurations) | |
177 | && grep(/^certstatus$/, @all_aspects)); | |
178 | ||
179 | foreach my $server_name (@server_configurations) { | |
180 | $server_name = chop_dblquot($server_name); | |
181 | load_config($server_name, $server_name); | |
182 | { | |
c6df354c | 183 | SKIP: { |
c87bcdbd DDO |
184 | my $pid; |
185 | if ($server_name eq "Mock") { | |
186 | indir "Mock" => sub { | |
187 | $pid = start_mock_server(""); | |
188 | skip "Cannot start or find the started CMP mock server", | |
189 | scalar @all_aspects unless $pid; | |
190 | } | |
191 | } | |
192 | foreach my $aspect (@all_aspects) { | |
193 | $aspect = chop_dblquot($aspect); | |
194 | next if $server_name eq "Mock" && $aspect eq "certstatus"; | |
195 | load_config($server_name, $aspect); # update with any aspect-specific settings | |
196 | indir $server_name => sub { | |
197 | my $tests = load_tests($server_name, $aspect); | |
198 | test_cmp_http_aspect($server_name, $aspect, $tests); | |
199 | }; | |
200 | }; | |
201 | stop_mock_server($pid) if $pid; | |
c6df354c | 202 | } |
c87bcdbd DDO |
203 | } |
204 | }; | |
205 | }; | |
206 | ||
207 | close($faillog) if $faillog; | |
208 | ||
209 | sub load_tests { | |
210 | my $server_name = shift; | |
211 | my $aspect = shift; | |
212 | my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; | |
213 | my $file = data_file("test_$aspect.csv"); | |
214 | my $result_dir = result_dir(); | |
215 | my @result; | |
216 | ||
217 | open(my $data, '<', $file) || die "Cannot open $file for reading: $!"; | |
218 | LOOP: | |
219 | while (my $line = <$data>) { | |
220 | chomp $line; | |
221 | $line =~ s{\r\n}{\n}g; # adjust line endings | |
222 | $line =~ s{_CA_DN}{$ca_dn}g; | |
223 | $line =~ s{_SERVER_DN}{$server_dn}g; | |
224 | $line =~ s{_SERVER_HOST}{$server_host}g; | |
225 | $line =~ s{_SERVER_PORT}{$server_port}g; | |
226 | $line =~ s{_SERVER_TLS}{$server_tls}g; | |
227 | $line =~ s{_SERVER_PATH}{$server_path}g; | |
228 | $line =~ s{_SERVER_CERT}{$server_cert}g; | |
229 | $line =~ s{_KUR_PORT}{$kur_port}g; | |
230 | $line =~ s{_PBM_PORT}{$pbm_port}g; | |
231 | $line =~ s{_PBM_REF}{$pbm_ref}g; | |
232 | $line =~ s{_PBM_SECRET}{$pbm_secret}g; | |
233 | $line =~ s{_RESULT_DIR}{$result_dir}g; | |
234 | ||
235 | next LOOP if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/; | |
236 | my $noproxy = $no_proxy; | |
237 | if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) { | |
238 | $noproxy = $1; | |
239 | } elsif ($server_host eq "127.0.0.1") { | |
240 | # do connections to localhost (e.g., Mock server) without proxy | |
241 | $line =~ s{-section,,}{-section,,-no_proxy,127.0.0.1,} ; | |
242 | } | |
243 | if ($line =~ m/,\s*-proxy\s*,/) { | |
244 | next LOOP if $no_proxy && ($noproxy =~ $server_host); | |
245 | } else { | |
246 | $line =~ s{-section,,}{-section,,-proxy,$proxy,}; | |
247 | } | |
248 | $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,}; | |
249 | $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,}; | |
250 | ||
251 | my @fields = grep /\S/, split ",", $line; | |
252 | s/^<EMPTY>$// for (@fields); # used for proxy="" | |
253 | s/^\s+// for (@fields); # remove leading whitespace from elements | |
254 | s/\s+$// for (@fields); # remove trailing whitespace from elements | |
255 | s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements | |
256 | my $expected_exit = $fields[$column]; | |
257 | my $description = 1; | |
258 | my $title = $fields[$description]; | |
259 | next LOOP if (!defined($expected_exit) | |
260 | || ($expected_exit ne 0 && $expected_exit ne 1)); | |
261 | @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1]; | |
262 | push @result, [$title, \@fields, $expected_exit]; | |
263 | } | |
264 | close($data); | |
265 | return \@result; | |
266 | } | |
267 | ||
268 | sub mock_server_pid { | |
269 | return `lsof -iTCP:$server_port` =~ m/\n\S+\s+(\d+)\s+[^\n]+LISTEN/s ? $1 : 0; | |
270 | } | |
271 | ||
272 | sub start_mock_server { | |
273 | my $args = $_[0]; # optional further CLI arguments | |
274 | my $dir = bldtop_dir(""); | |
275 | my $cmd = "LD_LIBRARY_PATH=$dir DYLD_LIBRARY_PATH=$dir " . | |
276 | bldtop_dir($app) . " -config server.cnf $args"; | |
277 | my $pid = mock_server_pid(); | |
f7c4d862 DDO |
278 | if ($pid) { |
279 | print "Mock server already running with pid=$pid\n"; | |
280 | return $pid; | |
281 | } | |
282 | print "Launching mock server: $cmd\n"; | |
c87bcdbd DDO |
283 | return system("$cmd &") == 0 # start in background, check for success |
284 | ? (sleep 1, mock_server_pid()) : 0; | |
285 | } | |
286 | ||
287 | sub stop_mock_server { | |
288 | my $pid = $_[0]; | |
f7c4d862 | 289 | print "Killing mock server with pid=$pid\n"; |
c87bcdbd DDO |
290 | system("kill $pid") if $pid; |
291 | } |