src/test/test_key_expiration.sh

   1 #!/bin/sh
   2
   3 # Note: some of this code is lifted from zero_length_keys.sh and
   4 # test_keygen.sh, and could be unified.
   5
   6 umask 077
   7 set -e
   8
   9 if [ $# -eq 0 ] || [ ! -f "${1}" ] || [ ! -x "${1}" ]; then
  10   if [ "$TESTING_TOR_BINARY" = "" ] ; then
  11     echo "Usage: ${0} PATH_TO_TOR [case-number]"
  12     exit 1
  13   fi
  14 fi
  15
  16 UNAME_OS=$(uname -s | cut -d_ -f1)
  17 if test "$UNAME_OS" = 'CYGWIN' || \
  18    test "$UNAME_OS" = 'MSYS' || \
  19    test "$UNAME_OS" = 'MINGW'; then
  20   echo "This test is unreliable on Windows. See trac #26076. Skipping." >&2
  21   exit 77
  22 fi
  23
  24 if [ $# -ge 1 ]; then
  25   TOR_BINARY="${1}"
  26   shift
  27 else
  28   TOR_BINARY="${TESTING_TOR_BINARY}"
  29 fi
  30
  31 if [ $# -ge 1 ]; then
  32   dflt=0
  33 else
  34   dflt=1
  35 fi
  36
  37 CASE1=$dflt
  38 CASE2=$dflt
  39 CASE3=$dflt
  40
  41 if [ $# -ge 1 ]; then
  42   eval "CASE${1}"=1
  43 fi
  44
  45
  46 dump() { xxd -p "$1" | tr -d '\n '; }
  47 die() { echo "$1" >&2 ; exit 5; }
  48 check_dir() { [ -d "$1" ] || die "$1 did not exist"; }
  49 check_file() { [ -e "$1" ] || die "$1 did not exist"; }
  50 check_no_file() { if [ -e "$1" ]; then die "$1 was not supposed to exist"; fi }
  51 check_files_eq() { cmp "$1" "$2" || die "$1 and $2 did not match: $(dump "$1") vs $(dump "$2")"; }
  52 check_keys_eq() { check_files_eq "${SRC}/keys/${1}" "${ME}/keys/${1}"; }
  53
  54 DATA_DIR=$(mktemp -d -t tor_key_expiration_tests.XXXXXX)
  55 if [ -z "$DATA_DIR" ]; then
  56   echo "Failure: mktemp invocation returned empty string" >&2
  57   exit 3
  58 fi
  59 if [ ! -d "$DATA_DIR" ]; then
  60   echo "Failure: mktemp invocation result doesn't point to directory" >&2
  61   exit 3
  62 fi
  63 trap 'rm -rf "$DATA_DIR"' 0
  64
  65 # Use an absolute path for this or Tor will complain
  66 DATA_DIR=$(cd "${DATA_DIR}" && pwd)
  67
  68 touch "${DATA_DIR}/empty_torrc"
  69
  70 QUIETLY="--hush"
  71 SILENTLY="--quiet"
  72 TOR="${TOR_BINARY} --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 12345 --ExitRelay 0 -f ${DATA_DIR}/empty_torrc --DataDirectory ${DATA_DIR}"
  73
  74 ##### SETUP
  75 #
  76 # Here we create a set of keys.
  77
  78 # Step 1: Start Tor with --list-fingerprint --quiet.  Make sure everything is there.
  79 echo "Setup step #1"
  80 ${TOR} --list-fingerprint ${SILENTLY} > /dev/null
  81
  82 check_dir "${DATA_DIR}/keys"
  83 check_file "${DATA_DIR}/keys/ed25519_master_id_public_key"
  84 check_file "${DATA_DIR}/keys/ed25519_master_id_secret_key"
  85 check_file "${DATA_DIR}/keys/ed25519_signing_cert"
  86 check_file "${DATA_DIR}/keys/ed25519_signing_secret_key"
  87 check_file "${DATA_DIR}/keys/secret_id_key"
  88 check_file "${DATA_DIR}/keys/secret_onion_key"
  89 check_file "${DATA_DIR}/keys/secret_onion_key_ntor"
  90
  91 ##### TEST CASES
  92
  93 echo "=== Starting key expiration tests."
  94
  95 FN="${DATA_DIR}/stderr"
  96
  97 if [ "$CASE1" = 1 ]; then
  98   echo "==== Case 1: Test --key-expiration without argument and ensure usage"
  99   echo "             instructions are printed."
 100
 101   ${TOR} ${QUIETLY} --key-expiration 2>"$FN" || true
 102   grep "No valid argument to --key-expiration found!" "$FN" >/dev/null || \
 103     die "Tor didn't mention supported --key-expiration argmuents"
 104
 105   echo "==== Case 1: ok"
 106 fi
 107
 108 if [ "$CASE2" = 1 ]; then
 109   echo "==== Case 2: Start Tor with --key-expiration 'sign' and make sure it prints an expiration."
 110
 111   ${TOR} ${QUIETLY} --key-expiration sign 2>"$FN"
 112   grep "signing-cert-expiry:" "$FN" >/dev/null || \
 113     die "Tor didn't print an expiration"
 114
 115   echo "==== Case 2: ok"
 116 fi
 117
 118 if [ "$CASE3" = 1 ]; then
 119   echo "==== Case 3: Start Tor with --key-expiration 'sign', when there is no"
 120   echo "             signing key, and make sure that Tor generates a new key"
 121   echo "             and prints its certificate's expiration."
 122
 123   mv "${DATA_DIR}/keys/ed25519_signing_cert" \
 124      "${DATA_DIR}/keys/ed25519_signing_cert.bak"
 125
 126   ${TOR} --key-expiration sign > "$FN" 2>&1
 127   grep "It looks like I need to generate and sign a new medium-term signing key" "$FN" >/dev/null || \
 128     die "Tor didn't create a new signing key"
 129   check_file "${DATA_DIR}/keys/ed25519_signing_cert"
 130   grep "signing-cert-expiry:" "$FN" >/dev/null || \
 131     die "Tor didn't print an expiration"
 132
 133   mv "${DATA_DIR}/keys/ed25519_signing_cert.bak" \
 134      "${DATA_DIR}/keys/ed25519_signing_cert"
 135
 136   echo "==== Case 3: ok"
 137 fi