80-test_pkcs12.t 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235
  1. #! /usr/bin/env perl
  2. # Copyright 2016-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the Apache License 2.0 (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. use strict;
  9. use warnings;
  10. use OpenSSL::Test qw/:DEFAULT srctop_file/;
  11. use OpenSSL::Test::Utils;
  12. use Encode;
  13. setup("test_pkcs12");
  14. my $pass = "σύνθημα γνώρισμα";
  15. my $savedcp;
  16. if (eval { require Win32::API; 1; }) {
  17. # Trouble is that Win32 perl uses CreateProcessA, which
  18. # makes it problematic to pass non-ASCII arguments, from perl[!]
  19. # that is. This is because CreateProcessA is just a wrapper for
  20. # CreateProcessW and will call MultiByteToWideChar and use
  21. # system default locale. Since we attempt Greek pass-phrase
  22. # conversion can be done only with Greek locale.
  23. Win32::API->Import("kernel32","UINT GetSystemDefaultLCID()");
  24. if (GetSystemDefaultLCID() != 0x408) {
  25. plan skip_all => "Non-Greek system locale";
  26. } else {
  27. # Ensure correct code page so that VERBOSE output is right.
  28. Win32::API->Import("kernel32","UINT GetConsoleOutputCP()");
  29. Win32::API->Import("kernel32","BOOL SetConsoleOutputCP(UINT cp)");
  30. $savedcp = GetConsoleOutputCP();
  31. SetConsoleOutputCP(1253);
  32. $pass = Encode::encode("cp1253",Encode::decode("utf-8",$pass));
  33. }
  34. } elsif ($^O eq "MSWin32") {
  35. plan skip_all => "Win32::API unavailable";
  36. } elsif ($^O ne "VMS") {
  37. # Running MinGW tests transparently under Wine apparently requires
  38. # UTF-8 locale...
  39. foreach(`locale -a`) {
  40. s/\R$//;
  41. if ($_ =~ m/^C\.UTF\-?8/i) {
  42. $ENV{LC_ALL} = $_;
  43. last;
  44. }
  45. }
  46. }
  47. $ENV{OPENSSL_WIN32_UTF8}=1;
  48. plan tests => 24;
  49. # Test different PKCS#12 formats
  50. ok(run(test(["pkcs12_format_test"])), "test pkcs12 formats");
  51. # Test with legacy APIs
  52. ok(run(test(["pkcs12_format_test", "-legacy"])), "test pkcs12 formats using legacy APIs");
  53. # Test with a non-default library context (and no loaded providers in the default context)
  54. ok(run(test(["pkcs12_format_test", "-context"])), "test pkcs12 formats using a non-default library context");
  55. SKIP: {
  56. skip "VMS doesn't have command line UTF-8 support yet in DCL", 1
  57. if $^O eq "VMS";
  58. # just see that we can read shibboleth.pfx protected with $pass
  59. ok(run(app(["openssl", "pkcs12", "-noout",
  60. "-password", "pass:$pass",
  61. "-in", srctop_file("test", "shibboleth.pfx")])),
  62. "test_load_cert_pkcs12");
  63. }
  64. my @path = qw(test certs);
  65. my $outfile1 = "out1.p12";
  66. my $outfile2 = "out2.p12";
  67. my $outfile3 = "out3.p12";
  68. my $outfile4 = "out4.p12";
  69. my $outfile5 = "out5.p12";
  70. my $outfile6 = "out6.p12";
  71. my $outfile7 = "out7.p12";
  72. # Test the -chain option with -untrusted
  73. ok(run(app(["openssl", "pkcs12", "-export", "-chain",
  74. "-CAfile", srctop_file(@path, "sroot-cert.pem"),
  75. "-untrusted", srctop_file(@path, "ca-cert.pem"),
  76. "-in", srctop_file(@path, "ee-cert.pem"),
  77. "-nokeys", "-passout", "pass:", "-out", $outfile1])),
  78. "test_pkcs12_chain_untrusted");
  79. # Test the -passcerts option
  80. SKIP: {
  81. skip "Skipping PKCS#12 test because DES is disabled in this build", 1
  82. if disabled("des");
  83. ok(run(app(["openssl", "pkcs12", "-export",
  84. "-in", srctop_file(@path, "ee-cert.pem"),
  85. "-certfile", srctop_file(@path, "v3-certs-TDES.p12"),
  86. "-passcerts", "pass:v3-certs",
  87. "-nokeys", "-passout", "pass:v3-certs", "-descert",
  88. "-out", $outfile2])),
  89. "test_pkcs12_passcerts");
  90. }
  91. SKIP: {
  92. skip "Skipping legacy PKCS#12 test because the required algorithms are disabled", 1
  93. if disabled("des") || disabled("rc2") || disabled("legacy");
  94. # Test reading legacy PKCS#12 file
  95. ok(run(app(["openssl", "pkcs12", "-export",
  96. "-in", srctop_file(@path, "v3-certs-RC2.p12"),
  97. "-passin", "pass:v3-certs",
  98. "-provider", "default", "-provider", "legacy",
  99. "-nokeys", "-passout", "pass:v3-certs", "-descert",
  100. "-out", $outfile3])),
  101. "test_pkcs12_passcerts_legacy");
  102. }
  103. # Test export of PEM file with both cert and key
  104. # -nomac necessary to avoid legacy provider requirement
  105. ok(run(app(["openssl", "pkcs12", "-export",
  106. "-inkey", srctop_file(@path, "cert-key-cert.pem"),
  107. "-in", srctop_file(@path, "cert-key-cert.pem"),
  108. "-passout", "pass:v3-certs",
  109. "-nomac", "-out", $outfile4], stderr => "outerr.txt")),
  110. "test_export_pkcs12_cert_key_cert");
  111. open DATA, "outerr.txt";
  112. my @match = grep /:error:/, <DATA>;
  113. close DATA;
  114. ok(scalar @match > 0 ? 0 : 1, "test_export_pkcs12_outerr_empty");
  115. ok(run(app(["openssl", "pkcs12",
  116. "-in", $outfile4,
  117. "-passin", "pass:v3-certs",
  118. "-nomacver", "-nodes"])),
  119. "test_import_pkcs12_cert_key_cert");
  120. ok(run(app(["openssl", "pkcs12", "-export", "-out", $outfile5,
  121. "-in", srctop_file(@path, "ee-cert.pem"), "-caname", "testname",
  122. "-nokeys", "-passout", "pass:", "-certpbe", "NONE"])),
  123. "test nokeys single cert");
  124. my @pkcs12info = run(app(["openssl", "pkcs12", "-info", "-in", $outfile5,
  125. "-passin", "pass:"]), capture => 1);
  126. # Test that with one input certificate, we get one output certificate
  127. ok(grep(/subject=CN\s*=\s*server.example/, @pkcs12info) == 1,
  128. "test one cert in output");
  129. # Test that the expected friendly name is present in the output
  130. ok(grep(/testname/, @pkcs12info) == 1, "test friendly name in output");
  131. # Test there's no Oracle Trusted Key Usage bag attribute
  132. ok(grep(/Trusted key usage (Oracle)/, @pkcs12info) == 0,
  133. "test no oracle trusted key usage");
  134. # Test export of PEM file with both cert and key, without password.
  135. # -nomac necessary to avoid legacy provider requirement
  136. {
  137. ok(run(app(["openssl", "pkcs12", "-export",
  138. "-inkey", srctop_file(@path, "cert-key-cert.pem"),
  139. "-in", srctop_file(@path, "cert-key-cert.pem"),
  140. "-passout", "pass:",
  141. "-nomac", "-out", $outfile6], stderr => "outerr6.txt")),
  142. "test_export_pkcs12_cert_key_cert_no_pass");
  143. open DATA, "outerr6.txt";
  144. my @match = grep /:error:/, <DATA>;
  145. close DATA;
  146. ok(scalar @match > 0 ? 0 : 1, "test_export_pkcs12_outerr6_empty");
  147. }
  148. # Test with Oracle Trusted Key Usage specified in openssl.cnf
  149. {
  150. ok(run(app(["openssl", "pkcs12", "-export", "-out", $outfile7,
  151. "-jdktrust", "anyExtendedKeyUsage", "-in", srctop_file(@path, "ee-cert.pem"),
  152. "-nokeys", "-passout", "pass:", "-certpbe", "NONE"])),
  153. "test nokeys single cert");
  154. my @pkcs12info = run(app(["openssl", "pkcs12", "-info", "-in", $outfile7,
  155. "-passin", "pass:"]), capture => 1);
  156. ok(grep(/Trusted key usage \(Oracle\): Any Extended Key Usage \(2.5.29.37.0\)/, @pkcs12info) == 1,
  157. "test oracle trusted key usage is set");
  158. delete $ENV{OPENSSL_CONF}
  159. }
  160. # Tests for pkcs12_parse
  161. ok(run(test(["pkcs12_api_test",
  162. "-in", $outfile1,
  163. "-has-ca", 1,
  164. ])), "Test pkcs12_parse()");
  165. SKIP: {
  166. skip "Skipping PKCS#12 parse test because DES is disabled in this build", 1
  167. if disabled("des");
  168. ok(run(test(["pkcs12_api_test",
  169. "-in", $outfile2,
  170. "-pass", "v3-certs",
  171. "-has-ca", 1,
  172. ])), "Test pkcs12_parse()");
  173. }
  174. SKIP: {
  175. skip "Skipping PKCS#12 parse test because the required algorithms are disabled", 1
  176. if disabled("des") || disabled("rc2") || disabled("legacy");
  177. ok(run(test(["pkcs12_api_test",
  178. "-in", $outfile3,
  179. "-pass", "v3-certs",
  180. "-has-ca", 1,
  181. ])), "Test pkcs12_parse()");
  182. }
  183. ok(run(test(["pkcs12_api_test",
  184. "-in", $outfile4,
  185. "-pass", "v3-certs",
  186. "-has-ca", 1,
  187. "-has-key", 1,
  188. "-has-cert", 1,
  189. ])), "Test pkcs12_parse()");
  190. ok(run(test(["pkcs12_api_test",
  191. "-in", $outfile5,
  192. "-has-ca", 1,
  193. ])), "Test pkcs12_parse()");
  194. ok(run(test(["pkcs12_api_test",
  195. "-in", $outfile6,
  196. "-pass", "",
  197. "-has-ca", 1,
  198. "-has-key", 1,
  199. "-has-cert", 1,
  200. ])), "Test pkcs12_parse()");
  201. SetConsoleOutputCP($savedcp) if (defined($savedcp));