wget/tests/Test-https-badcerts.px

#!/usr/bin/env perl

use strict;
use warnings;
use POSIX;

use SSLTest;

###############################################################################

# code, msg, headers, content
my %urls = (
    '/somefile.txt' => {
        code => "200",
        msg => "Dontcare",
        headers => {
            "Content-type" => "text/plain",
        },
        content => "blabla",
    },
);

# Skip the test if openssl is not available
my $ossl = `openssl version`;
unless ($ossl =~ m/OpenSSL 1/)
{
  exit 77;
}

my $cdir = $ENV{'PWD'};

# HOSTALIASES env variable allows us to create hosts file alias.
my $testhostname = "WgetTestingServer";
$ENV{'HOSTALIASES'} = "$cdir/certs/wgethosts";

# Create certindex
open  CERTID, ">", "$cdir/certs/certindex" or
      warn "Cannot overwrite file $cdir/certs/certindex";
close CERTID;

# Create certserial
open  CERTSN, ">", "$cdir/certs/certserial" or
      warn "Cannot overwrite file $cdir/certs/certserial";
print CERTSN "1122";
close CERTSN;

# Create crlnumber
open  CRLN, ">", "$cdir/certs/crlnumber" or
      warn "Cannot overwrite file $cdir/certs/crlnumber";
print CRLN "1122";
close CRLN;

my $caconf     = "$cdir/certs/rootca.conf";
my $cacrt      = "$cdir/certs/test-ca-cert.pem";
my $cakey      = "$cdir/certs/test-ca-key.pem";

# Prepare expired server certificate
my $servercrt  = "certs/tmpserver3.crt";
my $serverkey  = "certs/tmpserver3.key";
my $servercsr  = "$cdir/certs/tmpserver3.csr";
my $enddate    = strftime "%y%m%d%H%M%S%z", localtime(time-86400);
my $startdate  = strftime "%y%m%d%H%M%S%z", localtime(time+86400);
my $serversubj = "/C=US/ST=CA/L=Server Mystery Spot/O=Serv/CN=".
                 "$testhostname/emailAddress=servertester";
my $servercmd  = "openssl genrsa -out $serverkey 4096 && openssl req -new".
                 " -sha256 -key $serverkey -out $servercsr -days 365 ".
                 " -subj \"$serversubj\" &&".
                 "openssl ca -batch -config $caconf -notext ".
                 "-enddate $enddate -in $servercsr".
                 " -out $servercrt";
system($servercmd);

my $servercheck =`(openssl x509 -noout -modulus -in $servercrt | openssl md5 ;
                   openssl rsa  -noout -modulus -in $serverkey | openssl md5) |
                   uniq | wc -l`;
# Check if certificate and key are made correctly.
unless(-e $servercrt && -e $serverkey && $servercheck == 1)
{
    exit 77; # skip
}

# Try Wget using SSL with expired cert. Expect Failure.
my $port    = 30443;
my $cmdline = $WgetTest::WGETPATH . " --ca-certificate=$cacrt".
                                    " https://$testhostname:$port/somefile.txt";
my $expected_error_code = 5;
my %existing_files = (
);

my %expected_downloaded_files = (
  'somefile.txt' => {
    content => "blabla",
  },
);

my $sslsock = SSLTest->new(cmdline   => $cmdline,
                           input     => \%urls,
                           errcode   => $expected_error_code,
                           existing  => \%existing_files,
                           output    => \%expected_downloaded_files,
                           certfile  => $servercrt,
                           keyfile   => $serverkey,
                           lhostname => $testhostname,
                           sslport   => $port);
if ($sslsock->run() == 0)
{
  exit -1;
}
print "Test successful.\n";

system("/bin/rm $servercrt $serverkey $servercsr");
$servercmd  = "openssl genrsa -out $serverkey 4096 && openssl req -new".
              " -sha256 -key $serverkey -out $servercsr -days 365 ".
              " -subj \"$serversubj\" &&".
              "openssl ca -batch -config $caconf -notext ".
              " -startdate $startdate -in $servercsr".
              " -out $servercrt";
system($servercmd);

$servercheck =`(openssl x509 -noout -modulus -in $servercrt | openssl md5 ;
                openssl rsa  -noout -modulus -in $serverkey | openssl md5) |
                uniq | wc -l`;
# Check if certificate and key are made correctly.
unless(-e $servercrt && -e $serverkey && $servercheck == 1)
{
    exit 77; # skip
}


# Retry the test with --no-check-certificate. expect success
$port    = 20443;
$cmdline = $WgetTest::WGETPATH . " --ca-certificate=$cacrt".
                                 " https://$testhostname:$port/somefile.txt";

$expected_error_code = 5;

my $retryssl = SSLTest->new(cmdline  => $cmdline,
                           input     => \%urls,
                           errcode   => $expected_error_code,
                           existing  => \%existing_files,
                           output    => \%expected_downloaded_files,
                           certfile  => $servercrt,
                           keyfile   => $serverkey,
                           lhostname => $testhostname,
                           sslport   => $port);
if ($retryssl->run() == 0)
{
  exit 0;
}
else
{
  exit -1;
}
# vim: et ts=4 sw=4