test_key_expiration.sh 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137
  1. #!/bin/sh
  2. # Note: some of this code is lifted from zero_length_keys.sh and
  3. # test_keygen.sh, and could be unified.
  4. umask 077
  5. set -e
  6. if [ $# -eq 0 ] || [ ! -f ${1} ] || [ ! -x ${1} ]; then
  7. if [ "$TESTING_TOR_BINARY" = "" ] ; then
  8. echo "Usage: ${0} PATH_TO_TOR [case-number]"
  9. exit 1
  10. fi
  11. fi
  12. UNAME_OS=`uname -s | cut -d_ -f1`
  13. if test "$UNAME_OS" = 'CYGWIN' || \
  14. test "$UNAME_OS" = 'MSYS' || \
  15. test "$UNAME_OS" = 'MINGW'; then
  16. echo "This test is unreliable on Windows. See trac #26076. Skipping." >&2
  17. exit 77
  18. fi
  19. if [ $# -ge 1 ]; then
  20. TOR_BINARY="${1}"
  21. shift
  22. else
  23. TOR_BINARY="${TESTING_TOR_BINARY}"
  24. fi
  25. if [ $# -ge 1 ]; then
  26. dflt=0
  27. else
  28. dflt=1
  29. fi
  30. CASE1=$dflt
  31. CASE2=$dflt
  32. CASE3=$dflt
  33. if [ $# -ge 1 ]; then
  34. eval "CASE${1}"=1
  35. fi
  36. dump() { xxd -p "$1" | tr -d '\n '; }
  37. die() { echo "$1" >&2 ; exit 5; }
  38. check_dir() { [ -d "$1" ] || die "$1 did not exist"; }
  39. check_file() { [ -e "$1" ] || die "$1 did not exist"; }
  40. check_no_file() { [ -e "$1" ] && die "$1 was not supposed to exist" || true; }
  41. check_files_eq() { cmp "$1" "$2" || die "$1 and $2 did not match: `dump $1` vs `dump $2`"; }
  42. check_keys_eq() { check_files_eq "${SRC}/keys/${1}" "${ME}/keys/${1}"; }
  43. DATA_DIR=`mktemp -d -t tor_key_expiration_tests.XXXXXX`
  44. if [ -z "$DATA_DIR" ]; then
  45. echo "Failure: mktemp invocation returned empty string" >&2
  46. exit 3
  47. fi
  48. if [ ! -d "$DATA_DIR" ]; then
  49. echo "Failure: mktemp invocation result doesn't point to directory" >&2
  50. exit 3
  51. fi
  52. trap "rm -rf '$DATA_DIR'" 0
  53. # Use an absolute path for this or Tor will complain
  54. DATA_DIR=`cd "${DATA_DIR}" && pwd`
  55. touch "${DATA_DIR}/empty_torrc"
  56. QUIETLY="--hush"
  57. SILENTLY="--quiet"
  58. TOR="${TOR_BINARY} --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 12345 --ExitRelay 0 -f ${DATA_DIR}/empty_torrc --DataDirectory ${DATA_DIR}"
  59. ##### SETUP
  60. #
  61. # Here we create a set of keys.
  62. # Step 1: Start Tor with --list-fingerprint --quiet. Make sure everything is there.
  63. echo "Setup step #1"
  64. ${TOR} --list-fingerprint ${SILENTLY} > /dev/null
  65. check_dir "${DATA_DIR}/keys"
  66. check_file "${DATA_DIR}/keys/ed25519_master_id_public_key"
  67. check_file "${DATA_DIR}/keys/ed25519_master_id_secret_key"
  68. check_file "${DATA_DIR}/keys/ed25519_signing_cert"
  69. check_file "${DATA_DIR}/keys/ed25519_signing_secret_key"
  70. check_file "${DATA_DIR}/keys/secret_id_key"
  71. check_file "${DATA_DIR}/keys/secret_onion_key"
  72. check_file "${DATA_DIR}/keys/secret_onion_key_ntor"
  73. ##### TEST CASES
  74. echo "=== Starting key expiration tests."
  75. FN="${DATA_DIR}/stderr"
  76. if [ "$CASE1" = 1 ]; then
  77. echo "==== Case 1: Test --key-expiration without argument and ensure usage"
  78. echo " instructions are printed."
  79. ${TOR} ${QUIETLY} --key-expiration 2>"$FN" || true
  80. grep "No valid argument to --key-expiration found!" "$FN" >/dev/null || \
  81. die "Tor didn't mention supported --key-expiration argmuents"
  82. echo "==== Case 1: ok"
  83. fi
  84. if [ "$CASE2" = 1 ]; then
  85. echo "==== Case 2: Start Tor with --key-expiration 'sign' and make sure it prints an expiration."
  86. ${TOR} ${QUIETLY} --key-expiration sign 2>"$FN"
  87. grep "signing-cert-expiry:" "$FN" >/dev/null || \
  88. die "Tor didn't print an expiration"
  89. echo "==== Case 2: ok"
  90. fi
  91. if [ "$CASE3" = 1 ]; then
  92. echo "==== Case 3: Start Tor with --key-expiration 'sign', when there is no"
  93. echo " signing key, and make sure that Tor generates a new key"
  94. echo " and prints its certificate's expiration."
  95. mv "${DATA_DIR}/keys/ed25519_signing_cert" \
  96. "${DATA_DIR}/keys/ed25519_signing_cert.bak"
  97. ${TOR} --key-expiration sign > "$FN" 2>&1
  98. grep "It looks like I need to generate and sign a new medium-term signing key" "$FN" >/dev/null || \
  99. die "Tor didn't create a new signing key"
  100. check_file "${DATA_DIR}/keys/ed25519_signing_cert"
  101. grep "signing-cert-expiry:" "$FN" >/dev/null || \
  102. die "Tor didn't print an expiration"
  103. mv "${DATA_DIR}/keys/ed25519_signing_cert.bak" \
  104. "${DATA_DIR}/keys/ed25519_signing_cert"
  105. echo "==== Case 3: ok"
  106. fi