test_key_expiration.sh 3.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129
  1. #!/bin/sh
  2. # Note: some of this code is lifted from zero_length_keys.sh and
  3. # test_keygen.sh, and could be unified.
  4. umask 077
  5. set -e
  6. if [ $# -eq 0 ] || [ ! -f ${1} ] || [ ! -x ${1} ]; then
  7. if [ "$TESTING_TOR_BINARY" = "" ] ; then
  8. echo "Usage: ${0} PATH_TO_TOR [case-number]"
  9. exit 1
  10. fi
  11. fi
  12. if [ $# -ge 1 ]; then
  13. TOR_BINARY="${1}"
  14. shift
  15. else
  16. TOR_BINARY="${TESTING_TOR_BINARY}"
  17. fi
  18. if [ $# -ge 1 ]; then
  19. dflt=0
  20. else
  21. dflt=1
  22. fi
  23. CASE1=$dflt
  24. CASE2=$dflt
  25. CASE3=$dflt
  26. if [ $# -ge 1 ]; then
  27. eval "CASE${1}"=1
  28. fi
  29. dump() { xxd -p "$1" | tr -d '\n '; }
  30. die() { echo "$1" >&2 ; exit 5; }
  31. check_dir() { [ -d "$1" ] || die "$1 did not exist"; }
  32. check_file() { [ -e "$1" ] || die "$1 did not exist"; }
  33. check_no_file() { [ -e "$1" ] && die "$1 was not supposed to exist" || true; }
  34. check_files_eq() { cmp "$1" "$2" || die "$1 and $2 did not match: `dump $1` vs `dump $2`"; }
  35. check_keys_eq() { check_files_eq "${SRC}/keys/${1}" "${ME}/keys/${1}"; }
  36. DATA_DIR=`mktemp -d -t tor_key_expiration_tests.XXXXXX`
  37. if [ -z "$DATA_DIR" ]; then
  38. echo "Failure: mktemp invocation returned empty string" >&2
  39. exit 3
  40. fi
  41. if [ ! -d "$DATA_DIR" ]; then
  42. echo "Failure: mktemp invocation result doesn't point to directory" >&2
  43. exit 3
  44. fi
  45. trap "rm -rf '$DATA_DIR'" 0
  46. # Use an absolute path for this or Tor will complain
  47. DATA_DIR=`cd "${DATA_DIR}" && pwd`
  48. touch "${DATA_DIR}/empty_torrc"
  49. QUIETLY="--hush"
  50. SILENTLY="--quiet"
  51. TOR="${TOR_BINARY} --DisableNetwork 1 --ShutdownWaitLength 0 --ORPort 12345 --ExitRelay 0 -f ${DATA_DIR}/empty_torrc --DataDirectory ${DATA_DIR}"
  52. ##### SETUP
  53. #
  54. # Here we create a set of keys.
  55. # Step 1: Start Tor with --list-fingerprint --quiet. Make sure everything is there.
  56. echo "Setup step #1"
  57. ${TOR} --list-fingerprint ${SILENTLY} > /dev/null
  58. check_dir "${DATA_DIR}/keys"
  59. check_file "${DATA_DIR}/keys/ed25519_master_id_public_key"
  60. check_file "${DATA_DIR}/keys/ed25519_master_id_secret_key"
  61. check_file "${DATA_DIR}/keys/ed25519_signing_cert"
  62. check_file "${DATA_DIR}/keys/ed25519_signing_secret_key"
  63. check_file "${DATA_DIR}/keys/secret_id_key"
  64. check_file "${DATA_DIR}/keys/secret_onion_key"
  65. check_file "${DATA_DIR}/keys/secret_onion_key_ntor"
  66. ##### TEST CASES
  67. echo "=== Starting key expiration tests."
  68. FN="${DATA_DIR}/stderr"
  69. if [ "$CASE1" = 1 ]; then
  70. echo "==== Case 1: Test --key-expiration without argument and ensure usage"
  71. echo " instructions are printed."
  72. ${TOR} ${QUIETLY} --key-expiration 2>"$FN" || true
  73. grep "No valid argument to --key-expiration found!" "$FN" >/dev/null || \
  74. die "Tor didn't mention supported --key-expiration argmuents"
  75. echo "==== Case 1: ok"
  76. fi
  77. if [ "$CASE2" = 1 ]; then
  78. echo "==== Case 2: Start Tor with --key-expiration 'sign' and make sure it prints an expiration."
  79. ${TOR} ${QUIETLY} --key-expiration sign 2>"$FN"
  80. grep "signing-cert-expiry:" "$FN" >/dev/null || \
  81. die "Tor didn't print an expiration"
  82. echo "==== Case 2: ok"
  83. fi
  84. if [ "$CASE3" = 1 ]; then
  85. echo "==== Case 3: Start Tor with --key-expiration 'sign', when there is no"
  86. echo " signing key, and make sure that Tor generates a new key"
  87. echo " and prints its certificate's expiration."
  88. mv "${DATA_DIR}/keys/ed25519_signing_cert" \
  89. "${DATA_DIR}/keys/ed25519_signing_cert.bak"
  90. ${TOR} --key-expiration sign > "$FN" 2>&1
  91. grep "It looks like I need to generate and sign a new medium-term signing key" "$FN" >/dev/null || \
  92. die "Tor didn't create a new signing key"
  93. check_file "${DATA_DIR}/keys/ed25519_signing_cert"
  94. grep "signing-cert-expiry:" "$FN" >/dev/null || \
  95. die "Tor didn't print an expiration"
  96. mv "${DATA_DIR}/keys/ed25519_signing_cert.bak" \
  97. "${DATA_DIR}/keys/ed25519_signing_cert"
  98. echo "==== Case 3: ok"
  99. fi