1#! /usr/bin/env perl 2# Copyright 2007-2022 The OpenSSL Project Authors. All Rights Reserved. 3# Copyright Nokia 2007-2019 4# Copyright Siemens AG 2015-2019 5# 6# Licensed under the Apache License 2.0 (the "License"). You may not use 7# this file except in compliance with the License. You can obtain a copy 8# in the file LICENSE in the source distribution or at 9# https://www.openssl.org/source/license.html 10 11use strict; 12use warnings; 13 14use POSIX; 15use OpenSSL::Test qw/:DEFAULT cmdstr data_file data_dir srctop_dir bldtop_dir result_dir/; 16use OpenSSL::Test::Utils; 17 18BEGIN { 19 setup("test_cmp_http"); 20} 21use lib srctop_dir('Configurations'); 22use lib bldtop_dir('.'); 23 24plan skip_all => "These tests are not supported in a fuzz build" 25 if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/; 26 27plan skip_all => "These tests are not supported in a no-cmp build" 28 if disabled("cmp"); 29plan skip_all => "These tests are not supported in a no-ec build" 30 if disabled("ec"); 31plan skip_all => "These tests are not supported in a no-sock build" 32 if disabled("sock"); 33 34plan skip_all => "Tests involving local HTTP server not available on Windows or VMS" 35 if $^O =~ /^(VMS|MSWin32|msys)$/; 36plan skip_all => "Tests involving local HTTP server not available in cross-compile builds" 37 if defined $ENV{EXE_SHELL}; 38 39sub chop_dblquot { # chop any leading and trailing '"' (needed for Windows) 40 my $str = shift; 41 $str =~ s/^\"(.*?)\"$/$1/; 42 return $str; 43} 44 45my $proxy = chop_dblquot($ENV{http_proxy} // $ENV{HTTP_PROXY} // ""); 46$proxy = "<EMPTY>" if $proxy eq ""; 47$proxy =~ s{^https?://}{}i; 48my $no_proxy = $ENV{no_proxy} // $ENV{NO_PROXY}; 49 50my @app = qw(openssl cmp); 51 52# the CMP server configuration consists of: 53my $ca_dn; # The CA's Distinguished Name 54my $server_dn; # The server's Distinguished Name 55my $server_host;# The server's host name or IP address 56my $server_port;# The server's port 57my $server_tls; # The server's TLS port, if any, or 0 58my $server_path;# The server's CMP alias 59my $server_cert;# The server's cert 60my $kur_port; # The server's port for kur (cert update) 61my $pbm_port; # The server port to be used for PBM 62my $pbm_ref; # The reference for PBM 63my $pbm_secret; # The secret for PBM 64my $column; # The column number of the expected result 65my $sleep = 0; # The time to sleep between two requests 66my $server_fh; # Server file handle 67 68# The local $server_name variables below are among others taken as the name of a 69# sub-directory with server-specific certs etc. and CA-specific config section. 70 71sub load_config { 72 my $server_name = shift; 73 my $section = shift; 74 my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; 75 open (CH, $test_config) or die "Cannot open $test_config: $!"; 76 my $active = 0; 77 while (<CH>) { 78 if (m/\[\s*$section\s*\]/) { 79 $active = 1; 80 } elsif (m/\[\s*.*?\s*\]/) { 81 $active = 0; 82 } elsif ($active) { 83 $ca_dn = $1 eq "" ? '""""' : $1 if m/^\s*ca_dn\s*=\s*(.*)?\s*$/; 84 $server_dn = $1 eq "" ? '""""' : $1 if m/^\s*server_dn\s*=\s*(.*)?\s*$/; 85 $server_host = $1 eq "" ? '""""' : $1 if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/; 86 $server_port = $1 eq "" ? '""""' : $1 if m/^\s*server_port\s*=\s*(.*)?\s*$/; 87 $server_tls = $1 eq "" ? '""""' : $1 if m/^\s*server_tls\s*=\s*(.*)?\s*$/; 88 $server_path = $1 eq "" ? '""""' : $1 if m/^\s*server_path\s*=\s*(.*)?\s*$/; 89 $server_cert = $1 eq "" ? '""""' : $1 if m/^\s*server_cert\s*=\s*(.*)?\s*$/; 90 $kur_port = $1 eq "" ? '""""' : $1 if m/^\s*kur_port\s*=\s*(.*)?\s*$/; 91 $pbm_port = $1 eq "" ? '""""' : $1 if m/^\s*pbm_port\s*=\s*(.*)?\s*$/; 92 $pbm_ref = $1 eq "" ? '""""' : $1 if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/; 93 $pbm_secret = $1 eq "" ? '""""' : $1 if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/; 94 $column = $1 eq "" ? '""""' : $1 if m/^\s*column\s*=\s*(.*)?\s*$/; 95 $sleep = $1 eq "" ? '""""' : $1 if m/^\s*sleep\s*=\s*(.*)?\s*$/; 96 } 97 } 98 close CH; 99 die "Cannot find all CMP server config values in $test_config section [$section]\n" 100 if !defined $ca_dn 101 || !defined $server_dn || !defined $server_host 102 || !defined $server_port || !defined $server_tls 103 || !defined $server_path || !defined $server_cert 104 || !defined $kur_port || !defined $pbm_port 105 || !defined $pbm_ref || !defined $pbm_secret 106 || !defined $column || !defined $sleep; 107 $server_dn = $server_dn // $ca_dn; 108} 109 110my @server_configurations = ("Mock"); 111@server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER} if $ENV{OPENSSL_CMP_SERVER}; 112# set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers 113 114my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment"); 115@all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS} if $ENV{OPENSSL_CMP_ASPECTS}; 116# set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects 117 118my $faillog; 119my $file = $ENV{HARNESS_FAILLOG}; # pathname relative to result_dir 120if ($file) { 121 open($faillog, ">", $file) or die "Cannot open $file for writing: $!"; 122} 123 124sub test_cmp_http { 125 my $server_name = shift; 126 my $aspect = shift; 127 my $n = shift; 128 my $i = shift; 129 my $title = shift; 130 my $params = shift; 131 my $expected_result = shift; 132 $params = [ '-server', "127.0.0.1:$server_port", @$params ] 133 unless grep { $_ eq '-server' } @$params; 134 my $cmd = app([@app, @$params]); 135 136 unless (is(my $actual_result = run($cmd), $expected_result, $title)) { 137 if ($faillog) { 138 my $quote_spc_empty = sub { $_ eq "" ? '""' : $_ =~ m/ / ? '"'.$_.'"' : $_ }; 139 my $invocation = cmdstr($cmd, display => 1); 140 print $faillog "$server_name $aspect \"$title\" ($i/$n)". 141 " expected=$expected_result actual=$actual_result\n"; 142 print $faillog "$invocation\n\n"; 143 } 144 } 145} 146 147sub test_cmp_http_aspect { 148 my $server_name = shift; 149 my $aspect = shift; 150 my $tests = shift; 151 subtest "CMP app CLI $server_name $aspect\n" => sub { 152 my $n = scalar @$tests; 153 plan tests => $n; 154 my $i = 1; 155 foreach (@$tests) { 156 test_cmp_http($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]); 157 sleep($sleep); 158 } 159 }; 160 # not unlinking test.certout*.pem, test.cacerts.pem, and test.extracerts.pem 161} 162 163# The input files for the tests done here dynamically depend on the test server 164# selected (where the Mock server used by default is just one possibility). 165# On the other hand the main test configuration file test.cnf, which references 166# several server-dependent input files by relative file names, is static. 167# Moreover the tests use much greater variety of input files than output files. 168# Therefore we chose the current directory as a subdirectory of $SRCTOP and it 169# was simpler to prepend the output file names by BLDTOP than doing the tests 170# from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP. 171 172indir data_dir() => sub { 173 plan tests => 1 + @server_configurations * @all_aspects 174 - (grep(/^Mock$/, @server_configurations) 175 && grep(/^certstatus$/, @all_aspects)); 176 177 foreach my $server_name (@server_configurations) { 178 $server_name = chop_dblquot($server_name); 179 load_config($server_name, $server_name); 180 { 181 SKIP: { 182 my $pid; 183 if ($server_name eq "Mock") { 184 indir "Mock" => sub { 185 $pid = start_mock_server(""); 186 die "Cannot start or find the started CMP mock server" unless $pid; 187 } 188 } 189 foreach my $aspect (@all_aspects) { 190 $aspect = chop_dblquot($aspect); 191 next if $server_name eq "Mock" && $aspect eq "certstatus"; 192 load_config($server_name, $aspect); # update with any aspect-specific settings 193 indir $server_name => sub { 194 my $tests = load_tests($server_name, $aspect); 195 test_cmp_http_aspect($server_name, $aspect, $tests); 196 }; 197 }; 198 stop_mock_server($pid) if $pid; 199 ok(1, "killing mock server"); 200 } 201 } 202 }; 203}; 204 205close($faillog) if $faillog; 206 207sub load_tests { 208 my $server_name = shift; 209 my $aspect = shift; 210 my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; 211 my $file = data_file("test_$aspect.csv"); 212 my $result_dir = result_dir(); 213 my @result; 214 215 open(my $data, '<', $file) || die "Cannot open $file for reading: $!"; 216 LOOP: 217 while (my $line = <$data>) { 218 chomp $line; 219 $line =~ s{\r\n}{\n}g; # adjust line endings 220 $line =~ s{_CA_DN}{$ca_dn}g; 221 $line =~ s{_SERVER_DN}{$server_dn}g; 222 $line =~ s{_SERVER_HOST}{$server_host}g; 223 $line =~ s{_SERVER_PORT}{$server_port}g; 224 $line =~ s{_SERVER_TLS}{$server_tls}g; 225 $line =~ s{_SERVER_PATH}{$server_path}g; 226 $line =~ s{_SERVER_CERT}{$server_cert}g; 227 $line =~ s{_KUR_PORT}{$kur_port}g; 228 $line =~ s{_PBM_PORT}{$pbm_port}g; 229 $line =~ s{_PBM_REF}{$pbm_ref}g; 230 $line =~ s{_PBM_SECRET}{$pbm_secret}g; 231 $line =~ s{_RESULT_DIR}{$result_dir}g; 232 233 next LOOP if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/; 234 my $noproxy = $no_proxy; 235 if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) { 236 $noproxy = $1; 237 } elsif ($server_host eq "127.0.0.1") { 238 # do connections to localhost (e.g., Mock server) without proxy 239 $line =~ s{-section,,}{-section,,-no_proxy,127.0.0.1,} ; 240 } 241 if ($line =~ m/,\s*-proxy\s*,/) { 242 next LOOP if $no_proxy && ($noproxy =~ $server_host); 243 } else { 244 $line =~ s{-section,,}{-section,,-proxy,$proxy,}; 245 } 246 $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,}; 247 $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,}; 248 249 my @fields = grep /\S/, split ",", $line; 250 s/^<EMPTY>$// for (@fields); # used for proxy="" 251 s/^\s+// for (@fields); # remove leading whitespace from elements 252 s/\s+$// for (@fields); # remove trailing whitespace from elements 253 s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements 254 my $expected_result = $fields[$column]; 255 my $description = 1; 256 my $title = $fields[$description]; 257 next LOOP if (!defined($expected_result) 258 || ($expected_result ne 0 && $expected_result ne 1)); 259 @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1]; 260 push @result, [$title, \@fields, $expected_result]; 261 } 262 close($data); 263 return \@result; 264} 265 266sub start_mock_server { 267 my $args = $_[0]; # optional further CLI arguments 268 my $cmd = cmdstr(app([@app, '-config', 'server.cnf', 269 $args ? $args : ()]), display => 1); 270 print "Current directory is ".getcwd()."\n"; 271 print "Launching mock server: $cmd\n"; 272 die "Invalid port: $server_port" unless $server_port =~ m/^\d+$/; 273 my $pid = open($server_fh, "$cmd|") or die "Trying to $cmd"; 274 print "Pid is: $pid\n"; 275 if ($server_port == 0) { 276 # Find out the actual server port 277 while (<$server_fh>) { 278 print "Server output: $_"; 279 next if m/using section/; 280 s/\R$//; # Better chomp 281 ($server_port, $pid) = ($1, $2) if /^ACCEPT\s.*:(\d+) PID=(\d+)$/; 282 last; # Do not loop further to prevent hangs on server misbehavior 283 } 284 } 285 unless ($server_port > 0) { 286 stop_mock_server($pid); 287 return 0; 288 } 289 $server_tls = $kur_port = $pbm_port = $server_port; 290 return $pid; 291} 292 293sub stop_mock_server { 294 my $pid = $_[0]; 295 print "Killing mock server with pid=$pid\n"; 296 kill('KILL', $pid); 297 waitpid($pid, 0); 298} 299