#!/bin/sh

#       $NetBSD: t_certctl.sh,v 1.10 2023/09/05 12:32:30 riastradh Exp $
#
# Copyright (c) 2023 The NetBSD Foundation, Inc.
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions
# are met:
# 1. Redistributions of source code must retain the above copyright
#    notice, this list of conditions and the following disclaimer.
# 2. Redistributions in binary form must reproduce the above copyright
#    notice, this list of conditions and the following disclaimer in the
#    documentation and/or other materials provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
# ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#

CERTCTL="certctl -C certs.conf -c certs -u untrusted"

# setupconf <subdir>...
#
#       Create certs/ and set up certs.conf to search the specified
#       subdirectories of the source directory.
#
setupconf()
{
       local sep subdir dir

       mkdir certs
       cat <<EOF >certs.conf
netbsd-certctl 20230816

# comment at line start
       # comment not at line start, plus some intentional whitespace

# THE WHITESPACE ABOVE IS INTENTIONAL, DO NOT DELETE
EOF
       # Start with a continuation line separator; then switch to
       # non-continuation lines.
       sep=$(printf ' \\\n\t')
       for subdir; do
               dir=$(atf_get_srcdir)/$subdir
               cat <<EOF >>certs.conf
path$sep$(printf '%s' "$dir" | vis -M)
EOF
               sep=' '
       done
}

# check_empty
#
#       Verify the certs directory is empty after dry runs or after
#       clearing the directory.
#
check_empty()
{
       local why

       why=${1:-dry run}
       for x in certs/*; do
               if [ -e "$x" -o -h "$x" ]; then
                       atf_fail "certs/ should be empty after $why"
               fi
       done
}

# check_nonempty
#
#       Verify the certs directory is nonempty.
#
check_nonempty()
{
       for x in certs/*.0; do
               test -e "$x" && test -h "$x" && return
       done
       atf_fail "certs/ should be nonempty"
}

# checks <certsN>...
#
#       Run various checks with certctl.
#
checks()
{
       local certs1 diginotar_base diginotar diginotar_hash subdir srcdir

       certs1=$(atf_get_srcdir)/certs1
       diginotar_base=Explicitly_Distrust_DigiNotar_Root_CA.pem
       diginotar=$certs1/$diginotar_base
       diginotar_hash=$(openssl x509 -hash -noout <$diginotar)

       # Do a dry run of rehash and make sure the directory is still
       # empty.
       atf_check -s exit:0 $CERTCTL -n rehash
       check_empty

       # Distrust and trust one CA, as a dry run.  The trust should
       # fail because it's not currently distrusted.
       atf_check -s exit:0 $CERTCTL -n untrust "$diginotar"
       check_empty
       atf_check -s not-exit:0 -e match:currently \
           $CERTCTL -n trust "$diginotar"
       check_empty

       # Do a real rehash, not a dry run.
       atf_check -s exit:0 $CERTCTL rehash

       # Make sure all the certificates are trusted.
       for subdir; do
               case $subdir in
               /*)     srcdir=$subdir;;
               *)      srcdir=$(atf_get_srcdir)/$subdir;;
               esac
               for cert in "$srcdir"/*.pem; do
                       # Verify the certificate is linked by its base name.
                       certbase=$(basename "$cert")
                       atf_check -s exit:0 -o inline:"$cert" \
                           readlink -n "certs/$certbase"

                       # Verify the certificate is linked by a hash.
                       hash=$(openssl x509 -hash -noout <$cert)
                       counter=0
                       found=false
                       while [ $counter -lt 10 ]; do
                               if cmp -s "certs/$hash.$counter" "$cert"; then
                                       found=true
                                       break
                               fi
                               counter=$((counter + 1))
                       done
                       if ! $found; then
                               atf_fail "missing $cert"
                       fi

                       # Delete both links.
                       rm "certs/$certbase"
                       rm "certs/$hash.$counter"
               done
       done

       # Verify the certificate bundle is there with the right
       # permissions (0644) and delete it.
       #
       # XXX Verify its content.
       atf_check -s exit:0 test -f certs/ca-certificates.crt
       atf_check -s exit:0 test ! -h certs/ca-certificates.crt
       atf_check -s exit:0 -o inline:'100644\n' \
           stat -f %p certs/ca-certificates.crt
       rm certs/ca-certificates.crt

       # Make sure after deleting everything there's nothing left.
       check_empty "removing all expected certificates"

       # Distrust, trust, and re-distrust one CA, and verify that it
       # ceases to appear, reappears, and again ceases to appear.
       # (This one has no subject hash collisions to worry about, so
       # we hard-code the `.0' suffix.)
       atf_check -s exit:0 $CERTCTL untrust "$diginotar"
       atf_check -s exit:0 test -e "untrusted/$diginotar_base"
       atf_check -s exit:0 test -h "untrusted/$diginotar_base"
       atf_check -s exit:0 test ! -e "certs/$diginotar_base"
       atf_check -s exit:0 test ! -h "certs/$diginotar_base"
       atf_check -s exit:0 test ! -e "certs/$diginotar_hash.0"
       atf_check -s exit:0 test ! -h "certs/$diginotar_hash.0"
       check_nonempty

       atf_check -s exit:0 $CERTCTL trust "$diginotar"
       atf_check -s exit:0 test ! -e "untrusted/$diginotar_base"
       atf_check -s exit:0 test ! -h "untrusted/$diginotar_base"
       atf_check -s exit:0 test -e "certs/$diginotar_base"
       atf_check -s exit:0 test -h "certs/$diginotar_base"
       atf_check -s exit:0 test -e "certs/$diginotar_hash.0"
       atf_check -s exit:0 test -h "certs/$diginotar_hash.0"
       rm "certs/$diginotar_base"
       rm "certs/$diginotar_hash.0"
       check_nonempty

       atf_check -s exit:0 $CERTCTL untrust "$diginotar"
       atf_check -s exit:0 test -e "untrusted/$diginotar_base"
       atf_check -s exit:0 test -h "untrusted/$diginotar_base"
       atf_check -s exit:0 test ! -e "certs/$diginotar_base"
       atf_check -s exit:0 test ! -h "certs/$diginotar_base"
       atf_check -s exit:0 test ! -e "certs/$diginotar_hash.0"
       atf_check -s exit:0 test ! -h "certs/$diginotar_hash.0"
       check_nonempty
}

atf_test_case empty
empty_head()
{
       atf_set "descr" "Test empty certificates store"
}
empty_body()
{
       setupconf               # no directories
       check_empty "empty cert path"
       atf_check -s exit:0 $CERTCTL -n rehash
       check_empty
       atf_check -s exit:0 $CERTCTL rehash
       atf_check -s exit:0 test -f certs/ca-certificates.crt
       atf_check -s exit:0 test \! -h certs/ca-certificates.crt
       atf_check -s exit:0 test \! -s certs/ca-certificates.crt
       atf_check -s exit:0 rm certs/ca-certificates.crt
       check_empty "empty cert path"
}

atf_test_case onedir
onedir_head()
{
       atf_set "descr" "Test one certificates directory"
}
onedir_body()
{
       setupconf certs1
       checks certs1
}

atf_test_case twodir
twodir_head()
{
       atf_set "descr" "Test two certificates directories"
}
twodir_body()
{
       setupconf certs1 certs2
       checks certs1 certs2
}

atf_test_case collidehash
collidehash_head()
{
       atf_set "descr" "Test colliding hashes"
}
collidehash_body()
{
       # certs3 has two certificates with the same subject hash
       setupconf certs1 certs3
       checks certs1 certs3
}

atf_test_case collidebase
collidebase_head()
{
       atf_set "descr" "Test colliding base names"
}
collidebase_body()
{
       # certs1 and certs4 both have DigiCert_Global_Root_CA.pem,
       # which should cause list and rehash to fail and mention
       # duplicates.
       setupconf certs1 certs4
       atf_check -s not-exit:0 -o ignore -e match:duplicate $CERTCTL list
       atf_check -s not-exit:0 -o ignore -e match:duplicate $CERTCTL rehash
}

atf_test_case manual
manual_head()
{
       atf_set "descr" "Test manual operation"
}
manual_body()
{
       local certs1 diginotar_base diginotar diginotar_hash

       certs1=$(atf_get_srcdir)/certs1
       diginotar_base=Explicitly_Distrust_DigiNotar_Root_CA.pem
       diginotar=$certs1/$diginotar_base
       diginotar_hash=$(openssl x509 -hash -noout <$diginotar)

       setupconf certs1 certs2
       cat <<EOF >>certs.conf
manual
EOF
       touch certs/bogus.pem
       ln -s bogus.pem certs/0123abcd.0

       # Listing shouldn't mention anything in the certs/ cache.
       atf_check -s exit:0 -o not-match:bogus $CERTCTL list
       atf_check -s exit:0 -o not-match:bogus $CERTCTL untrusted

       # Rehashing and changing the configuration should succeed, but
       # mention `manual' in a warning message and should not touch
       # the cache.
       atf_check -s exit:0 -e match:manual $CERTCTL rehash
       atf_check -s exit:0 -e match:manual $CERTCTL untrust "$diginotar"
       atf_check -s exit:0 -e match:manual $CERTCTL trust "$diginotar"

       # The files we created should still be there.
       atf_check -s exit:0 test -f certs/bogus.pem
       atf_check -s exit:0 test -h certs/0123abcd.0
}

atf_test_case evilcertsdir
evilcertsdir_head()
{
       atf_set "descr" "Test certificate directory with evil characters"
}
evilcertsdir_body()
{
       local certs1 diginotar_base diginotar evilcertsdir evildistrustdir

       certs1=$(atf_get_srcdir)/certs1
       diginotar_base=Explicitly_Distrust_DigiNotar_Root_CA.pem
       diginotar=$certs1/$diginotar_base

       evilcertsdir=$(printf '-evil certs\n.')
       evilcertsdir=${evilcertsdir%.}
       evildistrustdir=$(printf '-evil untrusted\n.')
       evildistrustdir=${evildistrustdir%.}

       setupconf certs1

       # initial (re)hash, nonexistent certs directory
       atf_check -s exit:0 $CERTCTL rehash
       atf_check -s exit:0 certctl -C certs.conf \
           -c "$evilcertsdir" -u "$evildistrustdir" \
           rehash
       atf_check -s exit:0 diff -ruN -- certs "$evilcertsdir"
       atf_check -s exit:0 test ! -e untrusted
       atf_check -s exit:0 test ! -h untrusted
       atf_check -s exit:0 test ! -e "$evildistrustdir"
       atf_check -s exit:0 test ! -h "$evildistrustdir"

       # initial (re)hash, empty certs directory
       atf_check -s exit:0 rm -rf -- certs
       atf_check -s exit:0 rm -rf -- "$evilcertsdir"
       atf_check -s exit:0 mkdir -- certs
       atf_check -s exit:0 mkdir -- "$evilcertsdir"
       atf_check -s exit:0 $CERTCTL rehash
       atf_check -s exit:0 certctl -C certs.conf \
           -c "$evilcertsdir" -u "$evildistrustdir" \
           rehash
       atf_check -s exit:0 diff -ruN -- certs "$evilcertsdir"
       atf_check -s exit:0 test ! -e untrusted
       atf_check -s exit:0 test ! -h untrusted
       atf_check -s exit:0 test ! -e "$evildistrustdir"
       atf_check -s exit:0 test ! -h "$evildistrustdir"

       # test distrusting a CA
       atf_check -s exit:0 $CERTCTL untrust "$diginotar"
       atf_check -s exit:0 certctl -C certs.conf \
           -c "$evilcertsdir" -u "$evildistrustdir" \
           untrust "$diginotar"
       atf_check -s exit:0 diff -ruN -- certs "$evilcertsdir"
       atf_check -s exit:0 diff -ruN -- untrusted "$evildistrustdir"

       # second rehash
       atf_check -s exit:0 $CERTCTL rehash
       atf_check -s exit:0 certctl -C certs.conf \
           -c "$evilcertsdir" -u "$evildistrustdir" \
           rehash
       atf_check -s exit:0 diff -ruN -- certs "$evilcertsdir"
       atf_check -s exit:0 diff -ruN -- untrusted "$evildistrustdir"
}

atf_test_case evilpath
evilpath_head()
{
       atf_set "descr" "Test certificate paths with evil characters"
}
evilpath_body()
{
       local evildir

       evildir=$(printf 'evil\n.')
       evildir=${evildir%.}
       mkdir "$evildir"

       cp -p "$(atf_get_srcdir)/certs2"/*.pem "$evildir"/

       setupconf certs1
       cat <<EOF >>certs.conf
path $(printf '%s' "$(pwd)/$evildir" | vis -M)
EOF
       checks certs1 "$(pwd)/$evildir"
}

atf_test_case missingconf
missingconf_head()
{
       atf_set "descr" "Test certctl with missing certs.conf"
}
missingconf_body()
{
       mkdir certs
       atf_check -s exit:0 test ! -e certs.conf
       atf_check -s not-exit:0 -e match:'certs\.conf' \
           $CERTCTL rehash
}

atf_test_case nonexistentcertsdir
nonexistentcertsdir_head()
{
       atf_set "descr" "Test certctl succeeds when certsdir is nonexistent"
}
nonexistentcertsdir_body()
{
       setupconf certs1
       rmdir certs
       checks certs1
}

atf_test_case symlinkcertsdir
symlinkcertsdir_head()
{
       atf_set "descr" "Test certctl fails when certsdir is a symlink"
}
symlinkcertsdir_body()
{
       setupconf certs1
       rmdir certs
       mkdir empty
       ln -sfn empty certs

       atf_check -s not-exit:0 -e match:symlink $CERTCTL -n rehash
       atf_check -s not-exit:0 -e match:symlink $CERTCTL rehash
       atf_check -s exit:0 rmdir empty
}

atf_test_case regularfilecertsdir
regularfilecertsdir_head()
{
       atf_set "descr" "Test certctl fails when certsdir is a regular file"
}
regularfilecertsdir_body()
{
       setupconf certs1
       rmdir certs
       echo 'hello world' >certs

       atf_check -s not-exit:0 -e match:directory $CERTCTL -n rehash
       atf_check -s not-exit:0 -e match:directory $CERTCTL rehash
       atf_check -s exit:0 rm certs
}

atf_test_case prepopulatedcerts
prepopulatedcerts_head()
{
       atf_set "descr" "Test certctl fails when directory is prepopulated"
}
prepopulatedcerts_body()
{
       local cert certbase target

       setupconf certs1
       ln -sfn "$(atf_get_srcdir)/certs2"/*.pem certs/

       atf_check -s not-exit:0 -e match:manual $CERTCTL -n rehash
       atf_check -s not-exit:0 -e match:manual $CERTCTL rehash
       for cert in "$(atf_get_srcdir)/certs2"/*.pem; do
               certbase=$(basename "$cert")
               atf_check -s exit:0 -o inline:"$cert" \
                   readlink -n "certs/$certbase"
               rm "certs/$certbase"
       done
       check_empty
}

atf_init_test_cases()
{
       atf_add_test_case collidebase
       atf_add_test_case collidehash
       atf_add_test_case empty
       atf_add_test_case evilcertsdir
       atf_add_test_case evilpath
       atf_add_test_case manual
       atf_add_test_case missingconf
       atf_add_test_case nonexistentcertsdir
       atf_add_test_case onedir
       atf_add_test_case prepopulatedcerts
       atf_add_test_case regularfilecertsdir
       atf_add_test_case symlinkcertsdir
       atf_add_test_case twodir
}

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.