]>
git.ipfire.org Git - thirdparty/openssl.git/blob - test/recipes/80-test_cmp_http.t
4fd03e8b2d9e5b07b21b610cb0ea7e714a921775
2 # Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
3 # Copyright Nokia 2007-2019
4 # Copyright Siemens AG 2015-2019
6 # Licensed under the Apache License 2.0 (the "License"). You may not use
7 # this file except in compliance with the License. You can obtain a copy
8 # in the file LICENSE in the source distribution or at
9 # https://www.openssl.org/source/license.html
15 use OpenSSL
::Test qw
/:DEFAULT cmdstr data_file data_dir srctop_dir bldtop_dir result_dir/;
16 use OpenSSL
::Test
::Utils
;
19 setup
("test_cmp_http");
21 use lib srctop_dir
('Configurations');
22 use lib bldtop_dir
('.');
24 plan skip_all
=> "These tests are not supported in a fuzz build"
25 if config
('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/;
27 plan skip_all
=> "These tests are not supported in a no-cmp build"
29 plan skip_all
=> "These tests are not supported in a no-ec build"
31 plan skip_all
=> "These tests are not supported in a no-sock build"
33 plan skip_all
=> "These tests are not supported in a no-http build"
36 plan skip_all
=> "Tests involving local HTTP server not available on Windows or VMS"
37 if $^O
=~ /^(VMS|MSWin32|msys)$/;
38 plan skip_all
=> "Tests involving local HTTP server not available in cross-compile builds"
39 if defined $ENV{EXE_SHELL
};
41 sub chop_dblquot
{ # chop any leading and trailing '"' (needed for Windows)
43 $str =~ s/^\"(.*?)\"$/$1/;
47 my $proxy = chop_dblquot
($ENV{http_proxy
} // $ENV{HTTP_PROXY
} // "");
48 $proxy = "<EMPTY>" if $proxy eq "";
49 $proxy =~ s{^https?://}{}i;
50 my $no_proxy = $ENV{no_proxy
} // $ENV{NO_PROXY
};
52 my @app = qw(openssl cmp);
54 # the server-dependent client configuration consists of:
55 my $ca_dn; # The CA's Distinguished Name
56 my $server_dn; # The server's Distinguished Name
57 my $server_host;# The server's hostname or IP address
58 my $server_port;# The server's port
59 my $server_tls; # The server's TLS port, if any, or 0
60 my $server_path;# The server's CMP alias
61 my $server_cert;# The server's cert
62 my $kur_port; # The server's port for kur (cert update)
63 my $pbm_port; # The server port to be used for PBM
64 my $pbm_ref; # The reference for PBM
65 my $pbm_secret; # The secret for PBM
66 my $column; # The column number of the expected result
67 my $sleep = 0; # The time to sleep between two requests
69 # the dynamic server info:
70 my $server_fh; # Server file handle
74 return '""""' if $val eq "";
75 return $ENV{$1} if $val =~ /^\$\{ENV::(\w+)}$/;
79 # The local $server_name variables in the subroutines below are used
80 # both as the name of a sub-directory with server-specific credentials
81 # and as the name of a server-dependent client config section.
84 my $server_name = shift;
86 my $test_config = $ENV{OPENSSL_CMP_CONFIG
} // "$server_name/test.cnf";
87 open (CH
, $test_config) or die "Cannot open $test_config: $!";
90 if (m/\[\s*$section\s*\]/) {
92 } elsif (m/\[\s*.*?\s*\]/) {
95 # if there are multiple entries with same key, the last one prevails
96 $ca_dn = subst_env
($1) if m/^\s*ca_dn\s*=\s*(.*)?\s*$/;
97 $server_dn = subst_env
($1) if m/^\s*server_dn\s*=\s*(.*)?\s*$/;
98 $server_host = subst_env
($1) if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/;
99 $server_port = subst_env
($1) if m/^\s*server_port\s*=\s*(\S*)?\s*(\#.*)?$/;
100 $server_tls = subst_env
($1) if m/^\s*server_tls\s*=\s*(.*)?\s*$/;
101 $server_path = subst_env
($1) if m/^\s*server_path\s*=\s*(.*)?\s*$/;
102 $server_cert = subst_env
($1) if m/^\s*server_cert\s*=\s*(.*)?\s*$/;
103 $kur_port = subst_env
($1) if m/^\s*kur_port\s*=\s*(.*)?\s*$/;
104 $pbm_port = subst_env
($1) if m/^\s*pbm_port\s*=\s*(.*)?\s*$/;
105 $pbm_ref = subst_env
($1) if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/;
106 $pbm_secret = subst_env
($1) if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/;
107 $column = subst_env
($1) if m/^\s*column\s*=\s*(.*)?\s*$/;
108 $sleep = subst_env
($1) if m/^\s*sleep\s*=\s*(.*)?\s*$/;
112 die "Cannot find all server-dependent config values in $test_config section [$section]\n"
114 || !defined $server_dn || !defined $server_host
115 || !defined $server_port || !defined $server_tls
116 || !defined $server_path || !defined $server_cert
117 || !defined $kur_port || !defined $pbm_port
118 || !defined $pbm_ref || !defined $pbm_secret
119 || !defined $column || !defined $sleep;
120 die "Invalid server_port number in $test_config section [$section]: $server_port"
121 unless $server_port =~ m/^\d+$/;
122 $server_dn = $server_dn // $ca_dn;
125 my @server_configurations = ("Mock");
126 @server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER
} if $ENV{OPENSSL_CMP_SERVER
};
127 # set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers
129 my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment");
130 @all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS
} if $ENV{OPENSSL_CMP_ASPECTS
};
131 # set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects
134 my $file = $ENV{HARNESS_FAILLOG
}; # pathname relative to result_dir
136 open($faillog, ">", $file) or die "Cannot open '$file' for writing: $!";
140 my $server_name = shift;
146 my $expected_result = shift;
147 $params = [ '-server', "127.0.0.1:$server_port", @
$params ]
148 if ($server_name eq "Mock" && !(grep { $_ eq '-server' } @
$params));
149 my $cmd = app
([@app, @
$params]);
151 unless (is
(my $actual_result = run
($cmd), $expected_result, $title)) {
153 my $quote_spc_empty = sub { $_ eq "" ?
'""' : $_ =~ m/ / ?
'"'.$_.'"' : $_ };
154 my $invocation = cmdstr
($cmd, display
=> 1);
155 print $faillog "$server_name $aspect \"$title\" ($i/$n)".
156 " expected=$expected_result (".
157 ($expected_result ?
"success" : "failure").")".
158 " actual=$actual_result\n";
159 print $faillog "$invocation\n\n";
161 sleep($sleep) if $expected_result == 1;
165 sub test_cmp_http_aspect
{
166 my $server_name = shift;
169 subtest
"CMP app CLI $server_name $aspect\n" => sub {
170 my $n = scalar @
$tests;
174 test_cmp_http
($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]);
177 # not unlinking test.cert.pem, test.cacerts.pem, and test.extracerts.pem
180 # The input files for the tests done here dynamically depend on the test server
181 # selected (where the mock server used by default is just one possibility).
182 # On the other hand the main test configuration file test.cnf, which references
183 # several server-dependent input files by relative file names, is static.
184 # Moreover the tests use much greater variety of input files than output files.
185 # Therefore we chose the current directory as a subdirectory of $SRCTOP and it
186 # was simpler to prepend the output file names by BLDTOP than doing the tests
187 # from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP.
189 indir data_dir
() => sub {
190 plan tests
=> 1 + @server_configurations * @all_aspects
191 - (grep(/^Mock$/, @server_configurations)
192 && grep(/^certstatus$/, @all_aspects));
194 foreach my $server_name (@server_configurations) {
195 $server_name = chop_dblquot
($server_name);
196 load_config
($server_name, $server_name);
200 if ($server_name eq "Mock") {
201 indir
"Mock" => sub {
202 $pid = start_server
($server_name, "");
206 foreach my $aspect (@all_aspects) {
207 $aspect = chop_dblquot
($aspect);
208 if ($server_name eq "Mock" && $aspect eq "certstatus") {
209 print "Skipping certstatus check as not supported by $server_name server\n";
212 load_config
($server_name, $aspect); # update with any aspect-specific settings
213 indir
$server_name => sub {
214 my $tests = load_tests
($server_name, $aspect);
215 test_cmp_http_aspect
($server_name, $aspect, $tests);
218 stop_server
($server_name, $pid) if $pid;
219 ok
(1, "$server_name server has terminated");
225 close($faillog) if $faillog;
228 my $server_name = shift;
230 my $test_config = $ENV{OPENSSL_CMP_CONFIG
} // "$server_name/test.cnf";
231 my $file = data_file
("test_$aspect.csv");
232 my $result_dir = result_dir
();
235 open(my $data, '<', $file) || die "Cannot open '$file' for reading: $!";
237 while (my $line = <$data>) {
239 $line =~ s{\r\n}{\n}g; # adjust line endings
240 $line =~ s{_CA_DN}{$ca_dn}g;
241 $line =~ s{_SERVER_DN}{$server_dn}g;
242 $line =~ s{_SERVER_HOST}{$server_host}g;
243 $line =~ s{_SERVER_PORT}{$server_port}g;
244 $line =~ s{_SERVER_TLS}{$server_tls}g;
245 $line =~ s{_SERVER_PATH}{$server_path}g;
246 $line =~ s{_SERVER_CERT}{$server_cert}g;
247 $line =~ s{_KUR_PORT}{$kur_port}g;
248 $line =~ s{_PBM_PORT}{$pbm_port}g;
249 $line =~ s{_PBM_REF}{$pbm_ref}g;
250 $line =~ s{_PBM_SECRET}{$pbm_secret}g;
251 $line =~ s{_RESULT_DIR}{$result_dir}g;
253 next LOOP
if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/;
254 my $noproxy = $no_proxy;
255 if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) {
257 } elsif ($server_host eq "127.0.0.1") {
258 # do connections to localhost (e.g., mock server) without proxy
259 $line =~ s{-section,,}{-section,,-no_proxy,127.0.0.1,} ;
261 if ($line =~ m/,\s*-proxy\s*,/) {
262 next LOOP
if $no_proxy && ($noproxy =~ $server_host);
264 $line =~ s{-section,,}{-section,,-proxy,$proxy,};
266 $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,}
267 if $aspect ne "commands" || $line =~ m/,\s*-cmd\s*,\s*(ir|cr|p10cr|kur)\s*,/;
268 $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,};
270 my @fields = grep /\S/, split ",", $line;
271 s/^<EMPTY>$// for (@fields); # used for proxy=""
272 s/^\s+// for (@fields); # remove leading whitespace from elements
273 s/\s+$// for (@fields); # remove trailing whitespace from elements
274 s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements
275 my $expected_result = $fields[$column];
277 my $title = $fields[$description];
278 next LOOP
if (!defined($expected_result)
279 || ($expected_result ne 0 && $expected_result ne 1));
280 @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1];
281 push @result, [$title, \
@fields, $expected_result];
288 my $server_name = shift;
289 my $args = shift; # optional further CLI arguments
290 my $cmd = cmdstr
(app
([@app, '-config', 'server.cnf',
291 $args ?
$args : ()]), display
=> 1);
292 print "Current directory is ".getcwd
()."\n";
293 print "Launching $server_name server: $cmd\n";
294 my $pid = open($server_fh, "$cmd|");
296 print "Error launching $cmd, cannot obtain $server_name server PID";
299 print "$server_name server PID=$pid\n";
301 if ($server_port == 0) {
302 # Find out the actual server port and possibly different PID
304 while (<$server_fh>) {
305 print "$server_name server output: $_";
306 next if m/using section/;
307 s/\R$//; # Better chomp
308 ($server_port, $pid) = ($1, $2) if /^ACCEPT\s.*:(\d+) PID=(\d+)$/;
309 last; # Do not loop further to prevent hangs on server misbehavior
312 unless ($server_port > 0) {
313 stop_server
($server_name, $pid);
314 print "Cannot get expected output from the $server_name server";
317 $kur_port = $server_port if $kur_port eq "\$server_port";
318 $pbm_port = $server_port if $pbm_port eq "\$server_port";
319 $server_tls = $server_port if $server_tls;
324 my $server_name = shift;
326 print "Killing $server_name server with PID=$pid\n";