1#! /usr/bin/env perl 2# Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved. 3# Copyright Nokia 2007-2019 4# Copyright Siemens AG 2015-2019 5# 6# Licensed under the Apache License 2.0 (the "License"). You may not use 7# this file except in compliance with the License. You can obtain a copy 8# in the file LICENSE in the source distribution or at 9# https://www.openssl.org/source/license.html 10 11use strict; 12use warnings; 13 14use POSIX; 15use OpenSSL::Test qw/:DEFAULT cmdstr data_file data_dir srctop_dir bldtop_dir result_dir/; 16use OpenSSL::Test::Utils; 17 18BEGIN { 19 setup("test_cmp_http"); 20} 21use lib srctop_dir('Configurations'); 22use lib bldtop_dir('.'); 23 24plan skip_all => "These tests are not supported in a fuzz build" 25 if config('options') =~ /-DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION|enable-fuzz-afl/; 26 27plan skip_all => "These tests are not supported in a no-cmp build" 28 if disabled("cmp"); 29plan skip_all => "These tests are not supported in a no-ecx build" 30 if disabled("ecx"); # EC and EDDSA test certs, e.g., in Mock/newWithNew.pem 31plan skip_all => "These tests are not supported in a no-sock build" 32 if disabled("sock"); 33plan skip_all => "These tests are not supported in a no-http build" 34 if disabled("http"); 35plan skip_all => "These tests are not supported in a no-cms build" 36 if disabled("cms"); # central key pair generation 37 38plan skip_all => "Tests involving local HTTP server not available on Windows or VMS" 39 if $^O =~ /^(VMS|MSWin32|msys)$/; 40plan skip_all => "Tests involving local HTTP server not available in cross-compile builds" 41 if defined $ENV{EXE_SHELL}; 42 43sub chop_dblquot { # chop any leading and trailing '"' (needed for Windows) 44 my $str = shift; 45 $str =~ s/^\"(.*?)\"$/$1/; 46 return $str; 47} 48 49my $proxy = chop_dblquot($ENV{http_proxy} // $ENV{HTTP_PROXY} // ""); 50$proxy = "<EMPTY>" if $proxy eq ""; 51$proxy =~ s{^https?://}{}i; 52my $no_proxy = $ENV{no_proxy} // $ENV{NO_PROXY}; 53 54my @app = qw(openssl cmp); 55 56# the server-dependent client configuration consists of: 57my $ca_dn; # The CA's Distinguished Name 58my $server_dn; # The server's Distinguished Name 59my $server_host;# The server's hostname or IP address 60my $server_port;# The server's port 61my $server_tls; # The server's TLS port, if any, or 0 62my $server_path;# The server's CMP alias 63my $server_cert;# The server's cert 64my $kur_port; # The server's port for kur (cert update) 65my $pbm_port; # The server port to be used for PBM 66my $pbm_ref; # The reference for PBM 67my $pbm_secret; # The secret for PBM 68my $column; # The column number of the expected result 69my $sleep = 0; # The time to sleep between two requests 70 71# the dynamic server info: 72my $server_fh; # Server file handle 73 74sub subst_env { 75 my $val = shift; 76 return '""""' if $val eq ""; 77 return $ENV{$1} if $val =~ /^\$\{ENV::(\w+)}$/; 78 return $val; 79} 80 81# The local $server_name variables in the subroutines below are used 82# both as the name of a sub-directory with server-specific credentials 83# and as the name of a server-dependent client config section. 84 85sub load_config { 86 my $server_name = shift; 87 my $section = shift; 88 my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; 89 open (CH, $test_config) or die "Cannot open $test_config: $!"; 90 my $active = 0; 91 while (<CH>) { 92 if (m/\[\s*$section\s*\]/) { 93 $active = 1; 94 } elsif (m/\[\s*.*?\s*\]/) { 95 $active = 0; 96 } elsif ($active) { 97 # if there are multiple entries with same key, the last one prevails 98 $ca_dn = subst_env($1) if m/^\s*ca_dn\s*=\s*(.*)?\s*$/; 99 $server_dn = subst_env($1) if m/^\s*server_dn\s*=\s*(.*)?\s*$/; 100 $server_host = subst_env($1) if m/^\s*server_host\s*=\s*(\S*)?\s*(\#.*)?$/; 101 $server_port = subst_env($1) if m/^\s*server_port\s*=\s*(\S*)?\s*(\#.*)?$/; 102 $server_tls = subst_env($1) if m/^\s*server_tls\s*=\s*(.*)?\s*$/; 103 $server_path = subst_env($1) if m/^\s*server_path\s*=\s*(.*)?\s*$/; 104 $server_cert = subst_env($1) if m/^\s*server_cert\s*=\s*(.*)?\s*$/; 105 $kur_port = subst_env($1) if m/^\s*kur_port\s*=\s*(.*)?\s*$/; 106 $pbm_port = subst_env($1) if m/^\s*pbm_port\s*=\s*(.*)?\s*$/; 107 $pbm_ref = subst_env($1) if m/^\s*pbm_ref\s*=\s*(.*)?\s*$/; 108 $pbm_secret = subst_env($1) if m/^\s*pbm_secret\s*=\s*(.*)?\s*$/; 109 $column = subst_env($1) if m/^\s*column\s*=\s*(.*)?\s*$/; 110 $sleep = subst_env($1) if m/^\s*sleep\s*=\s*(.*)?\s*$/; 111 } 112 } 113 close CH; 114 die "Cannot find all server-dependent config values in $test_config section [$section]\n" 115 if !defined $ca_dn 116 || !defined $server_dn || !defined $server_host 117 || !defined $server_port || !defined $server_tls 118 || !defined $server_path || !defined $server_cert 119 || !defined $kur_port || !defined $pbm_port 120 || !defined $pbm_ref || !defined $pbm_secret 121 || !defined $column || !defined $sleep; 122 die "Invalid server_port number in $test_config section [$section]: $server_port" 123 unless $server_port =~ m/^\d+$/; 124 $server_dn = $server_dn // $ca_dn; 125} 126 127my @server_configurations = ("Mock"); 128@server_configurations = split /\s+/, $ENV{OPENSSL_CMP_SERVER} if $ENV{OPENSSL_CMP_SERVER}; 129# set env variable, e.g., OPENSSL_CMP_SERVER="Mock Insta" to include further CMP servers 130 131my @all_aspects = ("connection", "verification", "credentials", "commands", "enrollment"); 132@all_aspects = split /\s+/, $ENV{OPENSSL_CMP_ASPECTS} if $ENV{OPENSSL_CMP_ASPECTS}; 133# set env variable, e.g., OPENSSL_CMP_ASPECTS="commands enrollment" to select specific aspects 134 135my $Mock_serverlog; 136my $faillog; 137my $faillog_file = $ENV{HARNESS_FAILLOG} // "failed_client_invocations.txt"; # pathname relative to result_dir 138open($faillog, ">", $faillog_file) or die "Cannot open '$faillog_file' for writing: $!"; 139 140sub test_cmp_http { 141 my $server_name = shift; 142 my $aspect = shift; 143 my $n = shift; 144 my $i = shift; 145 my $title = shift; 146 my $params = shift; 147 my $expected_result = shift; 148 $params = [ '-server', "$server_host:$server_port", @$params ] 149 if ($server_name eq "Mock" && !(grep { $_ eq '-server' } @$params)); 150 my $cmd = app([@app, @$params]); 151 152 unless (is(my $actual_result = run($cmd), $expected_result, $title)) { 153 if ($faillog) { 154 my $quote_spc_empty = sub { $_ eq "" ? '""' : $_ =~ m/ / ? '"'.$_.'"' : $_ }; 155 my $invocation = cmdstr($cmd, display => 1); 156 print $faillog "$server_name $aspect \"$title\" ($i/$n)". 157 " expected=$expected_result (". 158 ($expected_result ? "success" : "failure").")". 159 " actual=$actual_result\n"; 160 print $faillog "$invocation\n\n"; 161 } 162 sleep($sleep) if $expected_result == 1; 163 } 164} 165 166sub test_cmp_http_aspect { 167 my $server_name = shift; 168 my $aspect = shift; 169 my $tests = shift; 170 subtest "CMP app CLI $server_name $aspect\n" => sub { 171 my $n = scalar @$tests; 172 plan tests => $n; 173 my $i = 1; 174 foreach (@$tests) { 175 test_cmp_http($server_name, $aspect, $n, $i++, $$_[0], $$_[1], $$_[2]); 176 } 177 }; 178 # not unlinking test.cert.pem, test.cacerts.pem, and test.extracerts.pem 179} 180 181sub print_file_prefixed { 182 my ($file, $desc) = @_; 183 print "$desc (each line prefixed by \"# \"):\n"; 184 if (open F, $file) { 185 while (<F>) { 186 print "# $_"; 187 } 188 close F; 189 } 190} 191 192# The input files for the tests done here dynamically depend on the test server 193# selected (where the mock server used by default is just one possibility). 194# On the other hand the main test configuration file test.cnf, which references 195# several server-dependent input files by relative file names, is static. 196# Moreover the tests use much greater variety of input files than output files. 197# Therefore we chose the current directory as a subdirectory of $SRCTOP and it 198# was simpler to prepend the output file names by BLDTOP than doing the tests 199# from $BLDTOP/test-runs/test_cmp_http and prepending the input files by SRCTOP. 200 201indir data_dir() => sub { 202 plan tests => 1 + @server_configurations * @all_aspects 203 - (grep(/^Mock$/, @server_configurations) 204 && grep(/^certstatus$/, @all_aspects)); 205 206 foreach my $server_name (@server_configurations) { 207 $server_name = chop_dblquot($server_name); 208 load_config($server_name, $server_name); 209 { 210 SKIP: { 211 my $pid; 212 if ($server_name eq "Mock") { 213 indir "Mock" => sub { 214 $pid = start_server($server_name, ""); 215 next unless $pid; 216 } 217 } 218 foreach my $aspect (@all_aspects) { 219 $aspect = chop_dblquot($aspect); 220 if ($server_name eq "Mock" && $aspect eq "certstatus") { 221 print "Skipping certstatus check as not supported by $server_name server\n"; 222 next; 223 } 224 load_config($server_name, $aspect); # update with any aspect-specific settings 225 indir $server_name => sub { 226 my $tests = load_tests($server_name, $aspect); 227 test_cmp_http_aspect($server_name, $aspect, $tests); 228 }; 229 }; 230 231 if ($server_name eq "Mock") { 232 stop_server($server_name, $pid) if $pid; 233 ok(1, "$server_name server has terminated"); 234 235 if (-s $faillog) { 236 indir "Mock" => sub { 237 print_file_prefixed($Mock_serverlog, "$server_name server STDERR output is"); 238 } 239 } 240 } 241 } 242 } 243 }; 244}; 245 246close($faillog) if $faillog; 247if (-s $faillog_file) { 248 print "# ------------------------------------------------------------------------------\n"; 249 print_file_prefixed($faillog_file, "Failed client invocations are"); 250 print "# ------------------------------------------------------------------------------\n"; 251} 252 253sub load_tests { 254 my $server_name = shift; 255 my $aspect = shift; 256 my $test_config = $ENV{OPENSSL_CMP_CONFIG} // "$server_name/test.cnf"; 257 my $file = data_file("test_$aspect.csv"); 258 my $result_dir = result_dir(); 259 my @result; 260 261 open(my $data, '<', $file) || die "Cannot open '$file' for reading: $!"; 262 LOOP: 263 while (my $line = <$data>) { 264 chomp $line; 265 $line =~ s{\r\n}{\n}g; # adjust line endings 266 $line =~ s{_CA_DN}{$ca_dn}g; 267 $line =~ s{_SERVER_DN}{$server_dn}g; 268 $line =~ s{_SERVER_HOST}{$server_host}g; 269 $line =~ s{_SERVER_PORT}{$server_port}g; 270 $line =~ s{_SERVER_TLS}{$server_tls}g; 271 $line =~ s{_SERVER_PATH}{$server_path}g; 272 $line =~ s{_SERVER_CERT}{$server_cert}g; 273 $line =~ s{_KUR_PORT}{$kur_port}g; 274 $line =~ s{_PBM_PORT}{$pbm_port}g; 275 $line =~ s{_PBM_REF}{$pbm_ref}g; 276 $line =~ s{_PBM_SECRET}{$pbm_secret}g; 277 $line =~ s{_RESULT_DIR}{$result_dir}g; 278 279 next LOOP if $server_tls == 0 && $line =~ m/,\s*-tls_used\s*,/; 280 my $noproxy = $no_proxy; 281 my $server_plain = $server_host =~ m/^\[(.*)\]$/ ? $1 : $server_host; 282 if ($line =~ m/,\s*-no_proxy\s*,(.*?)(,|$)/) { 283 $noproxy = $1; 284 } elsif ($server_plain eq "127.0.0.1" || $server_plain eq "::1") { 285 # do connections to localhost (e.g., mock server) without proxy 286 $line =~ s{-section,,}{-section,,-no_proxy,$server_plain,} ; 287 } 288 if ($line =~ m/,\s*-proxy\s*,/) { 289 next LOOP if $no_proxy && ($noproxy =~ $server_plain); 290 } else { 291 $line =~ s{-section,,}{-section,,-proxy,$proxy,}; 292 } 293 $line =~ s{-section,,}{-section,,-certout,$result_dir/test.cert.pem,} 294 if $aspect ne "commands" || $line =~ m/,\s*-cmd\s*,\s*(ir|cr|p10cr|kur)\s*,/; 295 $line =~ s{-section,,}{-config,../$test_config,-section,$server_name $aspect,}; 296 297 my @fields = grep /\S/, split ",", $line; 298 s/^<EMPTY>$// for (@fields); # used for proxy="" 299 s/^\s+// for (@fields); # remove leading whitespace from elements 300 s/\s+$// for (@fields); # remove trailing whitespace from elements 301 s/^\"(\".*?\")\"$/$1/ for (@fields); # remove escaping from quotation marks from elements 302 my $expected_result = $fields[$column]; 303 my $description = 1; 304 my $title = $fields[$description]; 305 next LOOP if (!defined($expected_result) 306 || ($expected_result ne 0 && $expected_result ne 1)); 307 next LOOP if ($line =~ m/-server,\[.*:.*\]/ && !have_IPv6()); 308 @fields = grep {$_ ne 'BLANK'} @fields[$description + 1 .. @fields - 1]; 309 push @result, [$title, \@fields, $expected_result]; 310 } 311 close($data); 312 return \@result; 313} 314 315sub start_server { 316 my $server_name = shift; 317 my $args = shift; # optional further CLI arguments 318 my $cmd = cmdstr(app([@app, '-config', 'server.cnf', 319 $args ? $args : ()]), display => 1); 320 print "Current directory is ".getcwd()."\n"; 321 print "Launching $server_name server: $cmd\n"; 322 $Mock_serverlog = result_dir()."/Mock_server_STDERR.txt"; 323 my $pid = open($server_fh, "$cmd 2>$Mock_serverlog |"); 324 unless ($pid) { 325 print "Error launching $cmd, cannot obtain $server_name server PID"; 326 return 0; 327 } 328 print "$server_name server PID=$pid\n"; 329 330 if ($server_host eq '*' || $server_port == 0) { 331 # Find out the actual server host and port and possibly different PID 332 my ($host, $port); 333 my $pid0 = $pid; 334 while (<$server_fh>) { 335 print "$server_name server output: $_"; 336 next if m/using section/; 337 s/\R$//; # Better chomp 338 ($host, $port, $pid) = ($1, $2, $3) 339 if /^ACCEPT\s(.*?):(\d+) PID=(\d+)$/; 340 last; # Do not loop further to prevent hangs on server misbehavior 341 } 342 if ($server_host eq '*' && defined $host) { 343 $server_host = "[::1]" if $host eq "[::]"; 344 $server_host = "127.0.0.1" if $host eq "0.0.0.0"; 345 } 346 $server_port = $port if $server_port == 0 && defined $port; 347 if ($pid0 != $pid) { 348 # kill the shell process 349 kill('KILL', $pid0); 350 waitpid($pid0, 0); 351 } 352 } 353 if ($server_host eq '*' || $server_port == 0) { 354 stop_server($server_name, $pid) if $pid; 355 print "Cannot get expected output from the $server_name server\n"; 356 return 0; 357 } 358 $kur_port = $server_port if $kur_port eq "\$server_port"; 359 $pbm_port = $server_port if $pbm_port eq "\$server_port"; 360 $server_tls = $server_port if $server_tls; 361 return $pid; 362 363} 364 365sub stop_server { 366 my $server_name = shift; 367 my $pid = shift; 368 print "Killing $server_name server with PID=$pid\n"; 369 kill('KILL', $pid); 370 waitpid($pid, 0); 371} 372