2 # Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
9 use File::Spec::Functions;
12 use OpenSSL::Test qw(:DEFAULT srctop_file srctop_dir bldtop_file data_file);
13 use OpenSSL::Test::Utils;
15 my $test_name = "test_store";
18 my $mingw = config('target') =~ m|^mingw|;
20 my $use_md5 = !disabled("md5");
21 my $use_des = !disabled("des"); # also affects 3des and pkcs12 app
22 my $use_dsa = !disabled("dsa");
23 my $use_ecc = !disabled("ec");
26 ( "test/blahdiblah.pem",
27 "test/blahdibleh.der" );
29 ( "test/testx509.pem",
31 "test/testrsapub.pem",
36 ### generated from the source files
45 "rsa-key-pkcs1.pem", "rsa-key-pkcs1.der",
46 "rsa-key-pkcs1-aes128.pem",
47 "rsa-key-pkcs8.pem", "rsa-key-pkcs8.der",
48 "rsa-key-pkcs8-pbes2-sha1.pem", "rsa-key-pkcs8-pbes2-sha1.der",
49 "rsa-key-pkcs8-pbes2-sha256.pem", "rsa-key-pkcs8-pbes2-sha256.der",
51 push(@generated_files, (
52 "rsa-key-pkcs8-pbes1-sha1-3des.pem", "rsa-key-pkcs8-pbes1-sha1-3des.der",
54 push(@generated_files, (
55 "rsa-key-sha1-3des-sha1.p12", "rsa-key-sha1-3des-sha256.p12",
56 "rsa-key-aes256-cbc-sha256.p12",
57 "rsa-key-md5-des-sha1.p12",
58 "rsa-key-aes256-cbc-md5-des-sha256.p12"
60 push(@generated_files, (
61 "rsa-key-pkcs8-pbes1-md5-des.pem", "rsa-key-pkcs8-pbes1-md5-des.der"
62 )) if $use_md5 && $use_des;
63 push(@generated_files, (
64 "dsa-key-pkcs1.pem", "dsa-key-pkcs1.der",
65 "dsa-key-pkcs1-aes128.pem",
66 "dsa-key-pkcs8.pem", "dsa-key-pkcs8.der",
67 "dsa-key-pkcs8-pbes2-sha1.pem", "dsa-key-pkcs8-pbes2-sha1.der",
69 push(@generated_files, "dsa-key-aes256-cbc-sha256.p12") if $use_dsa && $use_des;
70 push(@generated_files, (
71 "ec-key-pkcs1.pem", "ec-key-pkcs1.der",
72 "ec-key-pkcs1-aes128.pem",
73 "ec-key-pkcs8.pem", "ec-key-pkcs8.der",
74 "ec-key-pkcs8-pbes2-sha1.pem", "ec-key-pkcs8-pbes2-sha1.der",
76 push(@generated_files, "ec-key-aes256-cbc-sha256.p12") if $use_ecc && $use_des;
77 my %generated_file_files =
79 ? ( "test/testx509.pem" => "file:testx509.pem",
80 "test/testrsa.pem" => "file:testrsa.pem",
81 "test/testrsapub.pem" => "file:testrsapub.pem",
82 "test/testcrl.pem" => "file:testcrl.pem",
83 "apps/server.pem" => "file:server.pem" )
85 my @noexist_file_files =
86 ( "file:blahdiblah.pem",
87 "file:test/blahdibleh.der" );
89 my $n = (3 * scalar @noexist_files)
90 + (6 * scalar @src_files)
91 + (4 * scalar @generated_files)
92 + (scalar keys %generated_file_files)
93 + (scalar @noexist_file_files)
99 indir "store_$$" => sub {
102 init() or die "init failed";
104 my $rehash = init_rehash();
106 foreach (@noexist_files) {
107 my $file = srctop_file($_);
109 ok(!run(app(["openssl", "storeutl", "-noout", $file])));
110 ok(!run(app(["openssl", "storeutl", "-noout",
111 to_abs_file($file)])));
113 local $ENV{MSYS2_ARG_CONV_EXCL} = "file:";
115 ok(!run(app(["openssl", "storeutl", "-noout",
116 to_abs_file_uri($file)])));
119 foreach (@src_files) {
120 my $file = srctop_file($_);
122 ok(run(app(["openssl", "storeutl", "-noout", $file])));
123 ok(run(app(["openssl", "storeutl", "-noout", to_abs_file($file)])));
126 skip "file: tests disabled on MingW", 4 if $mingw;
128 ok(run(app(["openssl", "storeutl", "-noout",
129 to_abs_file_uri($file)])));
130 ok(run(app(["openssl", "storeutl", "-noout",
131 to_abs_file_uri($file, 0, "")])));
132 ok(run(app(["openssl", "storeutl", "-noout",
133 to_abs_file_uri($file, 0, "localhost")])));
134 ok(!run(app(["openssl", "storeutl", "-noout",
135 to_abs_file_uri($file, 0, "dummy")])));
138 foreach (@generated_files) {
139 ok(run(app(["openssl", "storeutl", "-noout", "-passin",
140 "pass:password", $_])));
141 ok(run(app(["openssl", "storeutl", "-noout", "-passin",
142 "pass:password", to_abs_file($_)])));
146 skip "file: tests disabled on MingW", 2 if $mingw;
148 ok(run(app(["openssl", "storeutl", "-noout", "-passin",
149 "pass:password", to_abs_file_uri($_)])));
150 ok(!run(app(["openssl", "storeutl", "-noout", "-passin",
151 "pass:password", to_file_uri($_)])));
154 foreach (values %generated_file_files) {
157 skip "file: tests disabled on MingW", 1 if $mingw;
159 ok(run(app(["openssl", "storeutl", "-noout", $_])));
162 foreach (@noexist_file_files) {
165 skip "file: tests disabled on MingW", 1 if $mingw;
167 ok(!run(app(["openssl", "storeutl", "-noout", $_])));
171 my $dir = srctop_dir("test", "certs");
173 ok(run(app(["openssl", "storeutl", "-noout", $dir])));
174 ok(run(app(["openssl", "storeutl", "-noout",
175 to_abs_file($dir, 1)])));
178 skip "file: tests disabled on MingW", 1 if $mingw;
180 ok(run(app(["openssl", "storeutl", "-noout",
181 to_abs_file_uri($dir, 1)])));
185 ok(!run(app(['openssl', 'storeutl', '-noout',
186 '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
187 srctop_file('test', 'testx509.pem')])),
188 "Checking that -subject can't be used with a single file");
190 ok(run(app(['openssl', 'storeutl', '-certs', '-noout',
191 srctop_file('test', 'testx509.pem')])),
192 "Checking that -certs returns 1 object on a certificate file");
193 ok(run(app(['openssl', 'storeutl', '-certs', '-noout',
194 srctop_file('test', 'testcrl.pem')])),
195 "Checking that -certs returns 0 objects on a CRL file");
197 ok(run(app(['openssl', 'storeutl', '-crls', '-noout',
198 srctop_file('test', 'testx509.pem')])),
199 "Checking that -crls returns 0 objects on a certificate file");
200 ok(run(app(['openssl', 'storeutl', '-crls', '-noout',
201 srctop_file('test', 'testcrl.pem')])),
202 "Checking that -crls returns 1 object on a CRL file");
205 skip "failed rehash initialisation", 6 unless $rehash;
207 # subject from testx509.pem:
208 # '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert'
209 # issuer from testcrl.pem:
210 # '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority'
211 ok(run(app(['openssl', 'storeutl', '-noout',
212 '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
213 catdir(curdir(), 'rehash')])));
214 ok(run(app(['openssl', 'storeutl', '-noout',
216 '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
217 catdir(curdir(), 'rehash')])));
218 ok(run(app(['openssl', 'storeutl', '-noout', '-certs',
219 '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
220 catdir(curdir(), 'rehash')])));
221 ok(run(app(['openssl', 'storeutl', '-noout', '-crls',
222 '-subject', '/C=AU/ST=QLD/CN=SSLeay\/rsa test cert',
223 catdir(curdir(), 'rehash')])));
224 ok(run(app(['openssl', 'storeutl', '-noout', '-certs',
226 '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
227 catdir(curdir(), 'rehash')])));
228 ok(run(app(['openssl', 'storeutl', '-noout', '-crls',
230 '/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority',
231 catdir(curdir(), 'rehash')])));
234 }, create => 1, cleanup => 1;
237 my $cnf = srctop_file('test', 'ca-and-certs.cnf');
238 my $cakey = srctop_file('test', 'certs', 'ca-key.pem');
241 run(app(["openssl", "pkey",
242 "-in", data_file("rsa-key-2432.pem"),
243 "-out", "rsa-key-pkcs1.pem"]))
244 # rsa-key-pkcs1-aes128.pem
245 && run(app(["openssl", "rsa", "-passout", "pass:password", "-aes128",
246 "-in", "rsa-key-pkcs1.pem",
247 "-out", "rsa-key-pkcs1-aes128.pem"]))
249 && (!$use_dsa || run(app(["openssl", "gendsa",
250 "-out", "dsa-key-pkcs1.pem",
251 data_file("dsaparam.pem")])))
252 # dsa-key-pkcs1-aes128.pem
253 && (!$use_dsa || run(app(["openssl", "dsa",
254 "-passout", "pass:password", "-aes128",
255 "-in", "dsa-key-pkcs1.pem",
256 "-out", "dsa-key-pkcs1-aes128.pem"])))
257 # ec-key-pkcs1.pem (one might think that 'genec' would be practical)
258 && (!$use_ecc || run(app(["openssl", "ecparam", "-genkey",
259 "-name", "prime256v1",
260 "-out", "ec-key-pkcs1.pem"])))
261 # ec-key-pkcs1-aes128.pem
262 && (!$use_ecc || run(app(["openssl", "ec",
263 "-passout", "pass:password", "-aes128",
264 "-in", "ec-key-pkcs1.pem",
265 "-out", "ec-key-pkcs1-aes128.pem"])))
269 (my $srcfile = $dstfile)
270 =~ s/-key-pkcs8\.pem$/-key-pkcs1.pem/i;
271 run(app(["openssl", "pkcs8", "-topk8", "-nocrypt",
272 "-in", $srcfile, "-out", $dstfile]));
273 }, grep(/-key-pkcs8\.pem$/, @generated_files))
274 # *-key-pkcs8-pbes1-sha1-3des.pem
277 (my $srcfile = $dstfile)
278 =~ s/-key-pkcs8-pbes1-sha1-3des\.pem$
280 run(app(["openssl", "pkcs8", "-topk8",
281 "-passout", "pass:password",
282 "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
283 "-in", $srcfile, "-out", $dstfile]));
284 }, grep(/-key-pkcs8-pbes1-sha1-3des\.pem$/, @generated_files))
285 # *-key-pkcs8-pbes1-md5-des.pem
288 (my $srcfile = $dstfile)
289 =~ s/-key-pkcs8-pbes1-md5-des\.pem$
291 run(app(["openssl", "pkcs8", "-topk8",
292 "-passout", "pass:password",
293 "-v1", "pbeWithSHA1And3-KeyTripleDES-CBC",
294 "-in", $srcfile, "-out", $dstfile]));
295 }, grep(/-key-pkcs8-pbes1-md5-des\.pem$/, @generated_files))
296 # *-key-pkcs8-pbes2-sha1.pem
299 (my $srcfile = $dstfile)
300 =~ s/-key-pkcs8-pbes2-sha1\.pem$
302 run(app(["openssl", "pkcs8", "-topk8",
303 "-passout", "pass:password",
304 "-v2", "aes256", "-v2prf", "hmacWithSHA1",
305 "-in", $srcfile, "-out", $dstfile]));
306 }, grep(/-key-pkcs8-pbes2-sha1\.pem$/, @generated_files))
307 # *-key-pkcs8-pbes2-sha1.pem
310 (my $srcfile = $dstfile)
311 =~ s/-key-pkcs8-pbes2-sha256\.pem$
313 run(app(["openssl", "pkcs8", "-topk8",
314 "-passout", "pass:password",
315 "-v2", "aes256", "-v2prf", "hmacWithSHA256",
316 "-in", $srcfile, "-out", $dstfile]));
317 }, grep(/-key-pkcs8-pbes2-sha256\.pem$/, @generated_files))
318 # *-cert.pem (intermediary for the .p12 inits)
319 && run(app(["openssl", "req", "-x509",
320 "-config", $cnf, "-nodes",
321 "-key", $cakey, "-out", "cacert.pem"]))
324 (my $dstfile = $srckey) =~ s|-key-pkcs8\.|-cert.|;
325 (my $csr = $dstfile) =~ s|\.pem|.csr|;
327 (run(app(["openssl", "req", "-new",
328 "-config", $cnf, "-section", "userreq",
329 "-key", $srckey, "-out", $csr]))
331 run(app(["openssl", "x509", "-days", "3650",
334 "-set_serial", time(), "-req",
335 "-in", $csr, "-out", $dstfile])));
336 }, grep(/-key-pkcs8\.pem$/, @generated_files))
340 my ($type, $certpbe_index, $keypbe_index,
342 $dstfile =~ m{^(.*)-key-(?|
343 # cert and key PBE are same
345 ([^-]*-[^-]*)- # key & cert PBE
348 # cert and key PBE are not same
349 ([^-]*-[^-]*)- # cert PBE
350 ([^-]*-[^-]*)- # key PBE
353 if (!$certpbe_index) {
354 $certpbe_index = $keypbe_index;
356 my $srckey = "$type-key-pkcs8.pem";
357 my $srccert = "$type-cert.pem";
360 "sha1-3des" => "pbeWithSHA1And3-KeyTripleDES-CBC",
361 "md5-des" => "pbeWithMD5AndDES-CBC",
362 "aes256-cbc" => "AES-256-CBC",
367 "sha256" => "SHA256",
369 my $certpbe = $pbes{$certpbe_index};
370 my $keypbe = $pbes{$keypbe_index};
371 my $macalg = $macalgs{$macalg_index};
372 if (!defined($certpbe) || !defined($keypbe)
373 || !defined($macalg)) {
374 print STDERR "Cert PBE for $certpbe_index not defined\n"
375 unless defined $certpbe;
376 print STDERR "Key PBE for $keypbe_index not defined\n"
377 unless defined $keypbe;
378 print STDERR "MACALG for $macalg_index not defined\n"
379 unless defined $macalg;
380 print STDERR "(destination file was $dstfile)\n";
383 run(app(["openssl", "pkcs12",
384 "-provider", "default",
385 "-provider", "legacy",
387 "-in", $srccert, "-passout", "pass:password",
388 "-chain", "-CAfile", "cacert.pem",
389 "-export", "-macalg", $macalg,
390 "-certpbe", $certpbe, "-keypbe", $keypbe,
392 }, grep(/\.p12/, @generated_files))
393 # *.der (the end all init)
396 (my $srcfile = $dstfile) =~ s/\.der$/.pem/i;
398 $srcfile = srctop_file("test", $srcfile);
401 unless (open $infh, $srcfile) {
405 while (($l = <$infh>) !~ /^-----BEGIN\s/
406 || $l =~ /^-----BEGIN.*PARAMETERS-----/) {
409 while (($l = <$infh>) !~ /^-----END\s/) {
411 $b64 .= $l unless $l =~ /:/;
414 my $der = decode_base64($b64);
415 unless (length($b64) / 4 * 3 - length($der) < 3) {
416 print STDERR "Length error, ",length($b64),
417 " bytes of base64 became ",length($der),
418 " bytes of der? ($srcfile => $dstfile)\n";
422 unless (open $outfh, ">:raw", $dstfile) {
428 }, grep(/\.der$/, @generated_files))
431 my $dstfile = $generated_file_files{$srcfile};
433 unless (copy srctop_file($srcfile), $dstfile) {
438 }, keys %generated_file_files)
444 mkdir(catdir(curdir(), 'rehash'))
445 && copy(srctop_file('test', 'testx509.pem'),
446 catdir(curdir(), 'rehash'))
447 && copy(srctop_file('test', 'testcrl.pem'),
448 catdir(curdir(), 'rehash'))
449 && run(app(['openssl', 'rehash', catdir(curdir(), 'rehash')]))
454 my ($function, @items) = @_;
457 return 0 unless $function->($_);
462 # According to RFC8089, a relative file: path is invalid. We still produce
463 # them for testing purposes.
465 my ($file, $isdir, $authority) = @_;
469 die "to_file_uri: No file given\n" if !defined($file) || $file eq '';
471 ($vol, $dir, $file) = File::Spec->splitpath($file, $isdir // 0);
473 # Make sure we have a Unix style directory.
474 $dir = join('/', File::Spec->splitdir($dir));
475 # Canonicalise it (note: it seems to be only needed on Unix)
478 $newdir =~ s|/[^/]*[^/\.]+[^/]*/\.\./|/|g;
479 last if $newdir eq $dir;
482 # Take care of the corner cases the loop can't handle, and that $dir
483 # ends with a / unless it's empty
484 $dir =~ s|/[^/]*[^/\.]+[^/]*/\.\.$|/|;
485 $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\./|/|;
486 $dir =~ s|^[^/]*[^/\.]+[^/]*/\.\.$||;
488 $dir =~ s|/$|| if $dir ne '/';
490 $dir .= '/' if $dir ne '' && $dir !~ m|/$|;
493 # If the file system has separate volumes (at present, Windows and VMS)
494 # we need to handle them. In URIs, they are invariably the first
495 # component of the path, which is always absolute.
496 # On VMS, user:[foo.bar] translates to /user/foo/bar
497 # On Windows, c:\Users\Foo translates to /c:/Users/Foo
499 $vol =~ s|:||g if ($^O eq "VMS");
500 $dir = '/' . $dir if $dir ne '' && $dir !~ m|^/|;
501 $dir = '/' . $vol . $dir;
503 $file = $dir . $file;
505 return "file://$authority$file" if defined $authority;
512 return File::Spec->rel2abs($file);
515 sub to_abs_file_uri {
516 my ($file, $isdir, $authority) = @_;
518 die "to_abs_file_uri: No file given\n" if !defined($file) || $file eq '';
519 return to_file_uri(to_abs_file($file), $isdir, $authority);