]>
Commit | Line | Data |
---|---|---|
1561e9fc | 1 | #!/usr/bin/env bash |
a4e7c43a LS |
2 | |
3 | # Fail early | |
4 | set -eu -o pipefail | |
5 | ||
6 | # Check if running in CI environment | |
7 | if [[ ! "${CI:-false}" == "true" ]]; then | |
8 | echo "ERROR: Not running in CI environment!" | |
9 | exit 1 | |
10 | fi | |
11 | ||
12 | _TEST() { | |
d3bc67eb | 13 | echo |
40556950 LS |
14 | echo "${1} " |
15 | } | |
16 | _SUBTEST() { | |
17 | echo -n " + ${1} " | |
a4e7c43a LS |
18 | } |
19 | _PASS() { | |
40556950 | 20 | echo -e "[\u001B[32mPASS\u001B[0m]" |
a4e7c43a LS |
21 | } |
22 | _FAIL() { | |
23 | echo -e "[\u001B[31mFAIL\u001B[0m]" | |
24 | echo | |
25 | echo "Problem: ${@}" | |
26 | echo | |
27 | echo "STDOUT:" | |
28 | cat tmplog | |
29 | echo | |
30 | echo "STDERR:" | |
31 | cat errorlog | |
32 | exit 1 | |
33 | } | |
34 | _CHECK_FILE() { | |
d3bc67eb | 35 | _SUBTEST "Checking if file '${1}' exists..." |
40556950 LS |
36 | if [[ -e "${1}" ]]; then |
37 | _PASS | |
38 | else | |
39 | _FAIL "Missing file: ${1}" | |
40 | fi | |
a4e7c43a LS |
41 | } |
42 | _CHECK_LOG() { | |
d3bc67eb | 43 | _SUBTEST "Checking if log contains '${1}'..." |
40556950 LS |
44 | if grep -- "${1}" tmplog > /dev/null; then |
45 | _PASS | |
46 | else | |
47 | _FAIL "Missing in log: ${1}" | |
48 | fi | |
49 | } | |
341f5252 | 50 | _CHECK_NOT_LOG() { |
d3bc67eb | 51 | _SUBTEST "Checking if log doesn't contain '${1}'..." |
341f5252 LS |
52 | if grep -- "${1}" tmplog > /dev/null; then |
53 | _FAIL "Found in log: ${1}" | |
54 | else | |
55 | _PASS | |
56 | fi | |
57 | } | |
40556950 LS |
58 | _CHECK_ERRORLOG() { |
59 | _SUBTEST "Checking if errorlog is empty..." | |
60 | if [[ -z "$(cat errorlog)" ]]; then | |
61 | _PASS | |
62 | else | |
63 | _FAIL "Non-empty errorlog" | |
64 | fi | |
a4e7c43a LS |
65 | } |
66 | ||
67 | # If not found (should be cached in travis) download ngrok | |
68 | if [[ ! -e "ngrok/ngrok" ]]; then | |
69 | ( | |
70 | mkdir -p ngrok | |
ebe9ea3d | 71 | cd ngrok |
ad21b41e LS |
72 | if [ "${TRAVIS_OS_NAME}" = "linux" ]; then |
73 | wget -O ngrok.zip https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-amd64.zip | |
74 | elif [ "${TRAVIS_OS_NAME}" = "osx" ]; then | |
75 | wget -O ngrok.zip https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-darwin-amd64.zip | |
76 | else | |
77 | echo "No ngrok for ${TRAVIS_OS_NAME}" | |
78 | exit 1 | |
79 | fi | |
a4e7c43a LS |
80 | unzip ngrok.zip ngrok |
81 | chmod +x ngrok | |
82 | ) | |
83 | fi | |
84 | ||
85 | # Run ngrok and grab temporary url from logfile | |
86 | ngrok/ngrok http 8080 --log stdout --log-format logfmt --log-level debug > tmp.log & | |
338ec308 | 87 | ngrok/ngrok http 8080 --log stdout --log-format logfmt --log-level debug > tmp2.log & |
c9823c25 | 88 | ngrok/ngrok http 8080 --log stdout --log-format logfmt --log-level debug > tmp3.log & |
a4e7c43a LS |
89 | sleep 2 |
90 | TMP_URL="$(grep -Eo "Hostname:[a-z0-9]+.ngrok.io" tmp.log | head -1 | cut -d':' -f2)" | |
338ec308 | 91 | TMP2_URL="$(grep -Eo "Hostname:[a-z0-9]+.ngrok.io" tmp2.log | head -1 | cut -d':' -f2)" |
c9823c25 LS |
92 | TMP3_URL="$(grep -Eo "Hostname:[a-z0-9]+.ngrok.io" tmp3.log | head -1 | cut -d':' -f2)" |
93 | if [[ -z "${TMP_URL}" ]] || [[ -z "${TMP2_URL}" ]] || [[ -z "${TMP3_URL}" ]]; then | |
ec49a443 | 94 | echo "Couldn't get an url from ngrok, not a dehydrated bug, tests can't continue." |
a4e7c43a LS |
95 | exit 1 |
96 | fi | |
97 | ||
98 | # Run python webserver in .acme-challenges directory to serve challenge responses | |
99 | mkdir -p .acme-challenges/.well-known/acme-challenge | |
100 | ( | |
101 | cd .acme-challenges | |
102 | python -m SimpleHTTPServer 8080 > /dev/null 2> /dev/null | |
103 | ) & | |
104 | ||
105 | # Generate config and create empty domains.txt | |
d5b28586 | 106 | echo 'CA="https://testca.kurz.pw/directory"' > config |
6a32f20e | 107 | echo 'CA_TERMS="https://testca.kurz.pw/terms"' >> config |
d5b28586 LS |
108 | echo 'WELLKNOWN=".acme-challenges/.well-known/acme-challenge"' >> config |
109 | echo 'RENEW_DAYS="14"' >> config | |
a4e7c43a LS |
110 | touch domains.txt |
111 | ||
112 | # Check if help command is working | |
113 | _TEST "Checking if help command is working..." | |
ec49a443 | 114 | ./dehydrated --help > tmplog 2> errorlog || _FAIL "Script execution failed" |
a4e7c43a | 115 | _CHECK_LOG "Default command: help" |
40556950 LS |
116 | _CHECK_LOG "--help (-h)" |
117 | _CHECK_LOG "--domain (-d) domain.tld" | |
118 | _CHECK_ERRORLOG | |
a4e7c43a | 119 | |
6a32f20e LS |
120 | # Register account key without LICENSE set |
121 | _TEST "Register account key without LICENSE set" | |
122 | ./dehydrated --register > tmplog 2> errorlog && _FAIL "Script execution failed" | |
123 | _CHECK_LOG "To accept these terms" | |
124 | _CHECK_ERRORLOG | |
125 | ||
126 | # Register account key and agreeing to terms | |
127 | _TEST "Register account key without LICENSE set" | |
128 | ./dehydrated --register --accept-terms > tmplog 2> errorlog || _FAIL "Script execution failed" | |
129 | _CHECK_LOG "Registering account key" | |
130 | _CHECK_FILE accounts/*/account_key.pem | |
131 | _CHECK_ERRORLOG | |
132 | ||
133 | # Delete accounts and add LICENSE to config for normal operation | |
134 | rm -rf accounts | |
135 | echo 'LICENSE="https://testca.kurz.pw/terms/v1"' >> config | |
136 | ||
a4e7c43a LS |
137 | # Run in cron mode with empty domains.txt (should only generate private key and exit) |
138 | _TEST "First run in cron mode, checking if private key is generated and registered" | |
ec49a443 | 139 | ./dehydrated --cron > tmplog 2> errorlog || _FAIL "Script execution failed" |
a4e7c43a | 140 | _CHECK_LOG "Registering account key" |
034ec30c | 141 | _CHECK_FILE accounts/*/account_key.pem |
40556950 | 142 | _CHECK_ERRORLOG |
a4e7c43a LS |
143 | |
144 | # Temporarily move config out of the way and try signing certificate by using temporary config location | |
145 | _TEST "Try signing using temporary config location and with domain as command line parameter" | |
d5b28586 | 146 | mv config tmp_config |
6a32f20e | 147 | ./dehydrated --cron --domain "${TMP_URL}" --domain "${TMP2_URL}" --accept-terms -f tmp_config > tmplog 2> errorlog || _FAIL "Script execution failed" |
6a8f4482 | 148 | _CHECK_NOT_LOG "Checking domain name(s) of existing cert" |
a4e7c43a LS |
149 | _CHECK_LOG "Generating private key" |
150 | _CHECK_LOG "Requesting challenge for ${TMP_URL}" | |
338ec308 | 151 | _CHECK_LOG "Requesting challenge for ${TMP2_URL}" |
a4e7c43a LS |
152 | _CHECK_LOG "Challenge is valid!" |
153 | _CHECK_LOG "Creating fullchain.pem" | |
154 | _CHECK_LOG "Done!" | |
40556950 | 155 | _CHECK_ERRORLOG |
d5b28586 | 156 | mv tmp_config config |
a4e7c43a | 157 | |
c9823c25 LS |
158 | # Add third domain to command-lime, should force renewal. |
159 | _TEST "Run in cron mode again, this time adding third domain, should force renewal." | |
ec49a443 | 160 | ./dehydrated --cron --domain "${TMP_URL}" --domain "${TMP2_URL}" --domain "${TMP3_URL}" > tmplog 2> errorlog || _FAIL "Script execution failed" |
c9823c25 LS |
161 | _CHECK_LOG "Domain name(s) are not matching!" |
162 | _CHECK_LOG "Forcing renew." | |
a2867410 | 163 | _CHECK_LOG "Generating private key" |
c9823c25 LS |
164 | _CHECK_LOG "Requesting challenge for ${TMP_URL}" |
165 | _CHECK_LOG "Requesting challenge for ${TMP2_URL}" | |
166 | _CHECK_LOG "Requesting challenge for ${TMP3_URL}" | |
167 | _CHECK_LOG "Challenge is valid!" | |
168 | _CHECK_LOG "Creating fullchain.pem" | |
169 | _CHECK_LOG "Done!" | |
170 | _CHECK_ERRORLOG | |
171 | ||
33f07fcc LS |
172 | # Prepare domains.txt |
173 | # Modify TMP3_URL to be uppercase to check for upper-lower-case mismatch bugs | |
174 | echo "${TMP_URL} ${TMP2_URL} $(tr 'a-z' 'A-Z' <<<"${TMP3_URL}")" >> domains.txt | |
175 | ||
176 | # Run in cron mode again (should find a non-expiring certificate and do nothing) | |
a4e7c43a | 177 | _TEST "Run in cron mode again, this time with domain in domains.txt, should find non-expiring certificate" |
ec49a443 | 178 | ./dehydrated --cron > tmplog 2> errorlog || _FAIL "Script execution failed" |
6a8f4482 | 179 | _CHECK_LOG "Checking domain name(s) of existing cert... unchanged." |
64b23e7a | 180 | _CHECK_LOG "Skipping renew" |
40556950 | 181 | _CHECK_ERRORLOG |
a4e7c43a | 182 | |
a2867410 | 183 | # Disable private key renew |
d5b28586 | 184 | echo 'PRIVATE_KEY_RENEW="no"' >> config |
a2867410 | 185 | |
341f5252 LS |
186 | # Run in cron mode one last time, with domain in domains.txt and force-resign (should find certificate, resign anyway, and not generate private key) |
187 | _TEST "Run in cron mode one last time, with domain in domains.txt and force-resign" | |
ec49a443 | 188 | ./dehydrated --cron --force > tmplog 2> errorlog || _FAIL "Script execution failed" |
6a8f4482 | 189 | _CHECK_LOG "Checking domain name(s) of existing cert... unchanged." |
2d097c92 | 190 | _CHECK_LOG "Ignoring because renew was forced!" |
af2bc7a9 | 191 | _CHECK_NOT_LOG "Generating private key" |
341f5252 | 192 | _CHECK_LOG "Requesting challenge for ${TMP_URL}" |
338ec308 | 193 | _CHECK_LOG "Requesting challenge for ${TMP2_URL}" |
c9823c25 | 194 | _CHECK_LOG "Requesting challenge for ${TMP3_URL}" |
6a32f20e | 195 | _CHECK_LOG "Already validated!" |
341f5252 LS |
196 | _CHECK_LOG "Creating fullchain.pem" |
197 | _CHECK_LOG "Done!" | |
198 | _CHECK_ERRORLOG | |
199 | ||
c9823c25 LS |
200 | # Check if signcsr command is working |
201 | _TEST "Running signcsr command" | |
ec49a443 | 202 | ./dehydrated --signcsr certs/${TMP_URL}/cert.csr > tmplog 2> errorlog || _FAIL "Script execution failed" |
bfb45d8b LS |
203 | _CHECK_LOG "BEGIN CERTIFICATE" |
204 | _CHECK_LOG "END CERTIFICATE" | |
205 | _CHECK_NOT_LOG "ERROR" | |
c9823c25 | 206 | |
85b3f191 LS |
207 | # Check if renewal works |
208 | _TEST "Run in cron mode again, to check if renewal works" | |
d5b28586 | 209 | echo 'RENEW_DAYS="300"' >> config |
ec49a443 | 210 | ./dehydrated --cron > tmplog 2> errorlog || _FAIL "Script execution failed" |
85b3f191 LS |
211 | _CHECK_LOG "Checking domain name(s) of existing cert... unchanged." |
212 | _CHECK_LOG "Renewing!" | |
213 | _CHECK_ERRORLOG | |
214 | ||
a4e7c43a LS |
215 | # Check if certificate is valid in various ways |
216 | _TEST "Verifying certificate..." | |
d3bc67eb LS |
217 | _SUBTEST "Verifying certificate on its own..." |
218 | openssl x509 -in "certs/${TMP_URL}/cert.pem" -noout -text > tmplog 2> errorlog && _PASS || _FAIL | |
a4e7c43a | 219 | _CHECK_LOG "CN=${TMP_URL}" |
338ec308 | 220 | _CHECK_LOG "${TMP2_URL}" |
d3bc67eb LS |
221 | _SUBTEST "Verifying file with full chain..." |
222 | openssl x509 -in "certs/${TMP_URL}/fullchain.pem" -noout -text > /dev/null 2>> errorlog && _PASS || _FAIL | |
223 | _SUBTEST "Verifying certificate against CA certificate..." | |
ee65261e LS |
224 | curl -s https://testca.kurz.pw/acme/issuer-cert | openssl x509 -inform DER -outform PEM > ca.pem |
225 | (openssl verify -verbose -CAfile "ca.pem" -purpose sslserver "certs/${TMP_URL}/fullchain.pem" 2>&1 || true) | (grep -v ': OK$' || true) >> errorlog 2>> errorlog && _PASS || _FAIL | |
40556950 | 226 | _CHECK_ERRORLOG |
a4e7c43a LS |
227 | |
228 | # Revoke certificate using certificate key | |
229 | _TEST "Revoking certificate..." | |
ec49a443 | 230 | ./dehydrated --revoke "certs/${TMP_URL}/cert.pem" --privkey "certs/${TMP_URL}/privkey.pem" > tmplog 2> errorlog || _FAIL "Script execution failed" |
c7018036 MG |
231 | REAL_CERT="$(readlink -n "certs/${TMP_URL}/cert.pem")" |
232 | _CHECK_LOG "Revoking certs/${TMP_URL}/${REAL_CERT}" | |
3dcfa8b4 | 233 | _CHECK_LOG "Done." |
c7018036 | 234 | _CHECK_FILE "certs/${TMP_URL}/${REAL_CERT}-revoked" |
40556950 | 235 | _CHECK_ERRORLOG |
a4e7c43a | 236 | |
a13e4103 | 237 | # Enable private key renew |
238 | echo 'PRIVATE_KEY_RENEW="yes"' >> config | |
239 | echo 'PRIVATE_KEY_ROLLOVER="yes"' >> config | |
240 | ||
241 | # Check if Rolloverkey creation works | |
242 | _TEST "Testing Rolloverkeys..." | |
243 | _SUBTEST "First Run: Creating rolloverkey" | |
244 | ./dehydrated --cron --domain "${TMP2_URL}" > tmplog 2> errorlog || _FAIL "Script execution failed" | |
ad21b41e | 245 | CERT_ROLL_HASH=$(openssl rsa -in certs/${TMP2_URL}/privkey.roll.pem -outform DER -pubout 2>/dev/null | openssl sha -sha256) |
a13e4103 | 246 | _CHECK_LOG "Generating private key" |
247 | _CHECK_LOG "Generating private rollover key" | |
248 | _SUBTEST "Second Run: Force Renew, Use rolloverkey" | |
249 | ./dehydrated --cron --force --domain "${TMP2_URL}" > tmplog 2> errorlog || _FAIL "Script execution failed" | |
ad21b41e | 250 | CERT_NEW_HASH=$(openssl rsa -in certs/${TMP2_URL}/privkey.pem -outform DER -pubout 2>/dev/null | openssl sha -sha256) |
a13e4103 | 251 | _CHECK_LOG "Generating private key" |
252 | _CHECK_LOG "Moving Rolloverkey into position" | |
253 | _SUBTEST "Verifying Hash Rolloverkey and private key second run" | |
254 | [[ "${CERT_ROLL_HASH}" = "${CERT_NEW_HASH}" ]] && _PASS || _FAIL | |
255 | _CHECK_ERRORLOG | |
256 | ||
a35b89e9 LS |
257 | # Test cleanup command |
258 | _TEST "Cleaning up certificates" | |
ec49a443 | 259 | ./dehydrated --cleanup > tmplog 2> errorlog || _FAIL "Script execution failed" |
a35b89e9 LS |
260 | _CHECK_LOG "Moving unused file to archive directory: ${TMP_URL}/cert-" |
261 | _CHECK_LOG "Moving unused file to archive directory: ${TMP_URL}/chain-" | |
262 | _CHECK_LOG "Moving unused file to archive directory: ${TMP_URL}/fullchain-" | |
263 | _CHECK_ERRORLOG | |
264 | ||
a4e7c43a LS |
265 | # All done |
266 | exit 0 |