]>
git.ipfire.org Git - thirdparty/openssl.git/blob - test/recipes/80-test_cmp_http.t
2 # Copyright 2007-2021 The OpenSSL Project Authors. All Rights Reserved.
3 # Copyright Nokia 2007-2019
4 # Copyright Siemens AG 2015-2019
6 # Licensed under the Apache License 2.0 (the "License"). You may not use
7 # this file except in compliance with the License. You can obtain a copy
8 # in the file LICENSE in the source distribution or at
9 # https://www.openssl.org/source/license.html
15 use OpenSSL
::Test qw
/:DEFAULT with data_file data_dir srctop_dir bldtop_dir result_dir/;
16 use OpenSSL
::Test
::Utils
;
19 setup
("test_cmp_http");
21 use lib srctop_dir
('Configurations');
22 use lib bldtop_dir
('.');
24 plan skip_all
=> "These tests are not supported in a fuzz build"
25 if config
('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION/;
27 plan skip_all
=> "These tests are not supported in a no-cmp build"
29 plan skip_all
=> "These tests are not supported in a no-ec build"
32 plan skip_all
=> "Tests involving local HTTP server not available on Windows, AIX or VMS"
33 if $^O
=~ /^(VMS|MSWin32|AIX)$/;
34 plan skip_all
=> "Tests involving local HTTP server not available in cross-compile builds"
35 if defined $ENV{EXE_SHELL
};
36 plan skip_all
=> "Tests involving local HTTP server require 'kill' command"
37 if system("which kill");
38 plan skip_all
=> "Tests involving local HTTP server require 'lsof' command"
39 if system("which lsof"); # this typically excludes Solaris
41 sub chop_dblquot
{ # chop any leading and trailing '"' (needed for Windows)
43 $str =~ s/^\"(.*?)\"$/$1/;
47 my $proxy = "<EMPTY>";
48 $proxy = chop_dblquot
($ENV{http_proxy
} // $ENV{HTTP_PROXY
} // $proxy);
49 $proxy =~ s{^https?://}{}i;
50 my $no_proxy = $ENV{no_proxy
} // $ENV{NO_PROXY
};
52 my $app = "apps/openssl cmp";
54 # the CMP server configuration consists of:
55 my $ca_dn; # The CA's Distinguished Name
56 my $server_dn; # The server's Distinguished Name
57 my $server_host;# The server's host name or IP address
58 my $server_port;# The server's port
59 my $server_tls; # The server's TLS port, if any, or 0
60 my $server_path;# The server's CMP alias
61 my $server_cert;# The server's cert
62 my $kur_port; # The server's port for kur (cert update)
63 my $pbm_port; # The server port to be used for PBM
64 my $pbm_ref; # The reference for PBM
65 my $pbm_secret; # The secret for PBM
66 my $column; # The column number of the expected result
67 my $sleep = 0; # The time to sleep between two requests
69 # The local $server_name variables below are among others taken as the name of a
70 # sub-directory with server-specific certs etc. and CA-specific config section.
73 my $server_name = shift;
75 my $test_config = $ENV{OPENSSL_CMP_CONFIG
} // "$server_name/test.cnf";
76 open (CH
, $test_config) or die "Cannot open $test_config: $!";
79 if (m/\[\s*$section\s*\]/) {
81 } elsif (m/\[\s*.*?\s*\]/) {
84 $ca_dn = $1 eq "" ?
'""""' : $1 if m/^\s*ca_dn\s*=\s*(.*)?\s*$/;
85 $server_dn = $1 eq "" ?
'""""' : $1 if m/^\s*server_dn\s*=\s*(.*)?\s*$/;
86 $server_host = $1 eq "" ?
'""""' : $1 if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/;
87 $server_port = $1 eq "" ?
'""""' : $1 if m/^\s*server_port\s*=\s*(.*)?\s*$/;
88 $server_tls = $1 eq "" ?
'""""' : $1 if m/^\s*server_tls\s*=\s*(.*)?\s*$/;
89 $server_path = $1 eq "" ?
'""""' : $1 if m/^\s*server_path\s*=\s*(.*)?\s*$/;
90 $server_cert = $1 eq "" ?
'""""' : $1 if m/^\s*server_cert\s*=\s*(.*)?\s*$/;
91 $kur_port = $1 eq "" ?
'""""' : $1 if m/^\s*kur_port\s*=\s*(.*)?\s*$/;
92 $pbm_port = $1 eq "" ?
'""""' : $1 if m/^\s*pbm_port\s*=\s*(.*)?\s*$/;
93 $pbm_ref = $1 eq "" ?
'""""' : $1 if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/;
94 $pbm_secret = $1 eq "" ?
'""""' : $1 if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/;
95 $column = $1 eq "" ?
'""""' : $1 if m/^\s*column\s*=\s*(.*)?\s*$/;
96 $sleep = $1 eq "" ?
'""""' : $1 if m/^\s*sleep\s*=\s*(.*)?\s*$/;
100 die "Cannot find all CMP server config values in $test_config section [$section]\n"
102 || !defined $server_dn || !defined $server_host
103 || !defined $server_port || !defined $server_tls
104 || !defined $server_path || !defined $server_cert
105 || !defined $kur_port || !defined $pbm_port
106 || !defined $pbm_ref || !defined $pbm_secret
107 || !defined $column || !defined $sleep;
108 $server_dn = $server_dn // $ca_dn;
111 my @server_configurations = ("Mock");
112 @server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER
} if $ENV{OPENSSL_CMP_SERVER
};
113 # set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers
115 my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment");
116 @all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS
} if $ENV{OPENSSL_CMP_ASPECTS
};
117 # set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects
120 my $file = $ENV{HARNESS_FAILLOG
}; # pathname relative to result_dir
122 open($faillog, ">", $file) or die "Cannot open $file for writing: $!";
126 my $server_name = shift;
132 my $expected_exit = shift;
133 my $path_app = bldtop_dir
($app);
134 with
({ exit_checker
=> sub {
135 my $actual_exit = shift;
136 my $OK = $actual_exit == $expected_exit;
137 if ($faillog && !$OK) {
138 my $quote_spc_empty = sub { $_ eq "" ?
'""' : $_ =~ m/ / ?
'"'.$_.'"' : $_ };
139 my $invocation = "$path_app ".join(' ', map $quote_spc_empty->($_), @
$params);
140 print $faillog "$server_name $aspect \"$title\" ($i/$n)".
141 " expected=$expected_exit actual=$actual_exit\n";
142 print $faillog "$invocation\n\n";
145 sub { ok
(run
(cmd
([$path_app, @
$params,])),
149 sub test_cmp_http_aspect
{
150 my $server_name = shift;
153 subtest
"CMP app CLI $server_name $aspect\n" => sub {
154 my $n = scalar @
$tests;
158 test_cmp_http
($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]);
162 # not unlinking test.certout*.pem, test.cacerts.pem, and test.extracerts.pem
165 # The input files for the tests done here dynamically depend on the test server
166 # selected (where the Mock server used by default is just one possibility).
167 # On the other hand the main test configuration file test.cnf, which references
168 # several server-dependent input files by relative file names, is static.
169 # Moreover the tests use much greater variety of input files than output files.
170 # Therefore we chose the current directory as a subdirectory of $SRCTOP and it
171 # was simpler to prepend the output file names by BLDTOP than doing the tests
172 # from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP.
174 indir data_dir
() => sub {
175 plan tests
=> @server_configurations * @all_aspects
176 + (grep(/^Mock$/, @server_configurations)
177 && grep(/^certstatus$/, @all_aspects));
179 foreach my $server_name (@server_configurations) {
180 $server_name = chop_dblquot
($server_name);
181 load_config
($server_name, $server_name);
185 if ($server_name eq "Mock") {
186 indir
"Mock" => sub {
187 $pid = start_mock_server
("");
188 skip
"Cannot start or find the started CMP mock server",
189 scalar @all_aspects unless $pid;
192 foreach my $aspect (@all_aspects) {
193 $aspect = chop_dblquot
($aspect);
194 next if $server_name eq "Mock" && $aspect eq "certstatus";
195 load_config
($server_name, $aspect); # update with any aspect-specific settings
196 indir
$server_name => sub {
197 my $tests = load_tests
($server_name, $aspect);
198 test_cmp_http_aspect
($server_name, $aspect, $tests);
201 stop_mock_server
($pid) if $pid;
207 close($faillog) if $faillog;
210 my $server_name = shift;
212 my $test_config = $ENV{OPENSSL_CMP_CONFIG
} // "$server_name/test.cnf";
213 my $file = data_file
("test_$aspect.csv");
214 my $result_dir = result_dir
();
217 open(my $data, '<', $file) || die "Cannot open $file for reading: $!";
219 while (my $line = <$data>) {
221 $line =~ s{\r\n}{\n}g; # adjust line endings
222 $line =~ s{_CA_DN}{$ca_dn}g;
223 $line =~ s{_SERVER_DN}{$server_dn}g;
224 $line =~ s{_SERVER_HOST}{$server_host}g;
225 $line =~ s{_SERVER_PORT}{$server_port}g;
226 $line =~ s{_SERVER_TLS}{$server_tls}g;
227 $line =~ s{_SERVER_PATH}{$server_path}g;
228 $line =~ s{_SERVER_CERT}{$server_cert}g;
229 $line =~ s{_KUR_PORT}{$kur_port}g;
230 $line =~ s{_PBM_PORT}{$pbm_port}g;
231 $line =~ s{_PBM_REF}{$pbm_ref}g;
232 $line =~ s{_PBM_SECRET}{$pbm_secret}g;
233 $line =~ s{_RESULT_DIR}{$result_dir}g;
235 next LOOP
if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/;
236 my $noproxy = $no_proxy;
237 if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) {
239 } elsif ($server_host eq "127.0.0.1") {
240 # do connections to localhost (e.g., Mock server) without proxy
241 $line =~ s{-section,,}{-section,,-no_proxy,127.0.0.1,} ;
243 if ($line =~ m/,\s*-proxy\s*,/) {
244 next LOOP
if $no_proxy && ($noproxy =~ $server_host);
246 $line =~ s{-section,,}{-section,,-proxy,$proxy,};
248 $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,};
249 $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,};
251 my @fields = grep /\S/, split ",", $line;
252 s/^<EMPTY>$// for (@fields); # used for proxy=""
253 s/^\s+// for (@fields); # remove leading whitespace from elements
254 s/\s+$// for (@fields); # remove trailing whitespace from elements
255 s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements
256 my $expected_exit = $fields[$column];
258 my $title = $fields[$description];
259 next LOOP
if (!defined($expected_exit)
260 || ($expected_exit ne 0 && $expected_exit ne 1));
261 @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1];
262 push @result, [$title, \
@fields, $expected_exit];
268 sub mock_server_pid
{
269 return `lsof -iTCP:$server_port` =~ m/\n\S+\s+(\d+)\s+[^\n]+LISTEN/s ?
$1 : 0;
272 sub start_mock_server
{
273 my $args = $_[0]; # optional further CLI arguments
274 my $dir = bldtop_dir
("");
275 my $cmd = "LD_LIBRARY_PATH=$dir DYLD_LIBRARY_PATH=$dir " .
276 bldtop_dir
($app) . " -config server.cnf $args";
277 my $pid = mock_server_pid
();
279 print "Mock server already running with pid=$pid\n";
282 print "Launching mock server: $cmd\n";
283 return system("$cmd &") == 0 # start in background, check for success
284 ?
(sleep 1, mock_server_pid
()) : 0;
287 sub stop_mock_server
{
289 print "Killing mock server with pid=$pid\n";
290 system("kill $pid") if $pid;