#!/usr/bin/python2.6

#

# CDDL HEADER START

#

# The contents of this file are subject to the terms of the

# Common Development and Distribution License (the "License").

# You may not use this file except in compliance with the License.

#

# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

# or http://www.opensolaris.org/os/licensing.

# See the License for the specific language governing permissions

# and limitations under the License.

#

# When distributing Covered Code, include this CDDL HEADER in each

# file and include the License file at usr/src/OPENSOLARIS.LICENSE.

# If applicable, add the following below this CDDL HEADER, with the

# fields enclosed by brackets "[]" replaced with your own identifying

# information: Portions Copyright [yyyy] [name of copyright owner]

#

# CDDL HEADER END

#

#

# Copyright (c) 2010, 2014, Oracle and/or its affiliates. All rights reserved.

#

import testutils

if __name__ == "__main__":

        testutils.setup_environment("../../../proto")

import pkg5unittest

import os

import re

import shutil

import sys

import tempfile

import unittest

import pkg.actions as action

import pkg.actions.signature as signature

import pkg.client.api_errors as apx

import pkg.digest as digest

import pkg.facet as facet

import pkg.fmri as fmri

import pkg.misc as misc

import pkg.portable as portable

import M2Crypto as m2

from pkg.client.debugvalues import DebugValues

from pkg.pkggzip import PkgGzipFile

try:

        import pkg.sha512_t

        sha512_supported = True

except ImportError:

        sha512_supported = False

obsolete_pkg = """

    open [email protected],5.11-0

    add set name=pkg.obsolete value=true

    add set name=pkg.summary value="An obsolete package"

    close """

renamed_pkg = """

    open [email protected],5.11-0

    add set name=pkg.renamed value=true

    add depend [email protected] type=require

    close """

class TestPkgSign(pkg5unittest.SingleDepotTestCase):

        # Tests in this suite use the read only data directory.

        need_ro_data = True

        example_pkg10 = """

            open [email protected],5.11-0

            add dir mode=0755 owner=root group=bin path=/bin

            add dir mode=0755 owner=root group=bin path=/bin/example_dir

            add dir mode=0755 owner=root group=bin path=/usr/lib/python2.7/vendor-packages/OpenSSL

            add file tmp/example_file mode=0555 owner=root group=bin path=/bin/example_path

            add set name=com.sun.service.incorporated_changes value="6556919 6627937"

            add set name=com.sun.service.random_test value=42 value=79

            add set name=com.sun.service.bug_ids value="4641790 4725245 4817791 4851433 4897491 4913776 6178339 6556919 6627937"

            add set name=com.sun.service.keywords value="sort null -n -m -t sort 0x86 separator"

            add set name=com.sun.service.info_url value=http://service.opensolaris.com/xml/pkg/[email protected],5.11-1:20080514I120000Z

            add set description='FOOO bAr O OO OOO'

            add set name='weirdness' value='] [ * ?'

            close """

        example_pkg20 = """

            open [email protected],5.11-0

            close """

        varsig_pkg = """

            open [email protected],5.15-0

            add set name=variant.arch value=sparc value=i386

            add dir mode=0755 owner=root group=bin path=/bin

            add signature tmp/example_file value=d2ff algorithm=sha256 variant.arch=i386

            close """

        var_pkg = """

            open [email protected],5.11-0

            add set name=variant.arch value=sparc value=i386

            add dir mode=0755 owner=root group=bin path=/bin variant.arch=sparc

            add dir mode=0755 owner=root group=bin path=/baz variant.arch=i386

            close """

        facet_pkg = """

            open [email protected],5.11-0

            add set name=variant.arch value=sparc value=i386

            add file tmp/example_file mode=0444 owner=root group=bin path=usr/share/doc/i386_doc.txt facet.doc=true variant.arch=i386

            add file tmp/example_file mode=0444 owner=root group=bin path=usr/share/doc/sparc_devel.txt facet.devel=true variant.arch=sparc

            close """

        med_pkg = """

            open [email protected],5.11-0

            add file tmp/example_file mode=0755 owner=root group=bin path=/bin/example-1.6

            add file tmp/example_file mode=0755 owner=root group=bin path=/bin/example-1.7

            add link path=bin/example target=bin/example-1.6 mediator=example mediator-version=1.6

            add link path=bin/example target=bin/example-1.7 mediator=example mediator-version=1.7

            close """

        conflict_pkgs = """

            open [email protected],5.11-0

            add file tmp/example_file mode=0444 owner=root group=root path=etc/release

            close

            open [email protected],5.11-0

            add file tmp/example_file2 mode=0444 owner=root group=root path=etc/release

            close """

        need_renamed_pkg = """

            open [email protected],5.11-0

            add depend fmri=renamed type=require

            close """

        pub2_example = """

            open pkg://pub2/[email protected],5.11-0

            add set description='a package with an alternate publisher'

            close """

        pub2_pkg = """

            open pkg://pub2/[email protected],5.11-0

            add set description='a package with an alternate publisher'

            close """

        bug_18880_pkg = """

            open [email protected],5.11-0

            add file tmp/example_file mode=0555 owner=root group=bin path=bin/example_path variant.foo=bar

            add file tmp/example_file2 mode=0555 owner=root group=bin path=bin/example_path variant.foo=baz

            close"""

        image_files = ['simple_file']

        misc_files = ['tmp/example_file', 'tmp/example_file2']

        def pkg(self, command, *args, **kwargs):

                # The value for crl_host is pulled from DebugValues because

                # crl__host needs to be set there so the api object calls work

                # as desired.

                command = "--debug crl_host=%s %s" % \

                    (DebugValues["crl_host"], command)

                return pkg5unittest.SingleDepotTestCase.pkg(self, command,

                    *args, **kwargs)

        def setUp(self):

                pkg5unittest.SingleDepotTestCase.setUp(self, image_count=2)

                self.make_misc_files(self.misc_files)

                self.durl1 = self.dcs[1].get_depot_url()

                self.rurl1 = self.dcs[1].get_repo_url()

                DebugValues["crl_host"] = self.durl1

        def test_sign_0(self):

                """Test that packages signed with hashes only work correctly."""

                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)

                # Test that things work with unsigned packages.

                self.image_create(self.rurl1)

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy ignore")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy verify")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy require-signatures")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.RequiredSignaturePolicyException,

                    self._api_install, api_obj, ["example_pkg"])

                # Tests that the cli handles RequiredSignaturePolicyExceptions.

                self.pkg("install example_pkg", exit=1)

                self.pkg("set-property signature-policy require-names foo")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.MissingRequiredNamesException,

                    self._api_install, api_obj, ["example_pkg"])

                # Tests that the cli handles MissingRequiredNamesException.

                self.pkg("install example_pkg", exit=1)

                self.pkg("unset-property signature-policy")

                self.pkg("set-publisher --set-property signature-policy=ignore "

                    "test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher --set-property signature-policy=verify "

                    "test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher "

                    "--set-property signature-policy=require-signatures test")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.RequiredSignaturePolicyException,

                    self._api_install, api_obj, ["example_pkg"])

                self.pkg("set-publisher "

                    "--set-property signature-policy=require-names "

                    "--set-property signature-required-names=foo test")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.MissingRequiredNamesException,

                    self._api_install, api_obj, ["example_pkg"])

                self.pkgsign(self.rurl1, plist[0])

                self.image_destroy()

                self.image_create(self.rurl1)

                # Test that things work hashes instead of signatures.

                self.pkg("refresh --full")

                self.pkg("set-publisher --unset-property signature-policy "

                    "--unset-property signature-required-names test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self.pkg("search -l sha256")

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy ignore")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy verify")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy require-signatures")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.RequiredSignaturePolicyException,

                    self._api_install, api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy require-names foo")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.MissingRequiredNamesException,

                    self._api_install, api_obj, ["example_pkg"])

                self.pkg("unset-property signature-policy")

                self.pkg("set-publisher --set-property signature-policy=ignore "

                    "test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher --set-property signature-policy=verify "

                    "test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher --set-property "

                    "signature-policy=require-signatures test")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.RequiredSignaturePolicyException,

                    self._api_install, api_obj, ["example_pkg"])

                self.pkg("set-publisher "

                    "--set-property signature-policy=require-names "

                    "--set-property signature-required-names=foo test")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.MissingRequiredNamesException,

                    self._api_install, api_obj, ["example_pkg"])

        def test_sign_1(self):

                """Test that packages signed using private keys function

                correctly.  Uses a chain of certificates three certificates

                long."""

                chain_cert_path = os.path.join(self.chain_certs_dir,

                    "ch1_ta3_cert.pem")

                ta_cert_path = os.path.join(self.raw_trust_anchor_dir,

                    "ta3_cert.pem")

                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)

                sign_args = "-k %(key)s -c %(cert)s -i %(ch1)s %(name)s" % {

                        "name": plist[0],

                        "key": os.path.join(self.keys_dir,

                            "cs1_ch1_ta3_key.pem"),

                        "cert": os.path.join(self.cs_dir,

                            "cs1_ch1_ta3_cert.pem"),

                        "ch1": chain_cert_path

                }

                td = os.environ["TMPDIR"]

                sd = os.path.join(td, "tmp_sign")

                os.makedirs(sd)

                os.environ["TMPDIR"] = sd

                # Specify location as filesystem path.

                self.pkgsign(self.dc.get_repodir(), sign_args)

                # Ensure that all temp files from signing have been removed.

                self.assertEqual(os.listdir(sd), [])

                os.environ["TMPDIR"] = td

                self.pkg_image_create(self.rurl1)

                self.seed_ta_dir("ta3")

                # Find the hash of the publisher CA cert used.

                hsh = self.calc_pem_hash(chain_cert_path)

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self.pkg("search -l rsa-sha256")

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy ignore")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy verify")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                emptyCA = os.path.join(self.img_path(), "emptyCA")

                os.makedirs(emptyCA)

                self.pkg("set-property trust-anchor-directory emptyCA")

                # This should fail because the chain is rooted in an untrusted

                # self-signed cert.

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.BrokenChain, self._api_install, api_obj,

                    ["example_pkg"])

                # Test that the cli handles BrokenChain exceptions.

                self.pkg("install example_pkg", exit=1)

                # Now seed the emptyCA directory to test that certs can be

                # pulled from it correctly.

                self.seed_ta_dir("ta3", dest_dir=emptyCA)

                self.pkg("set-property signature-policy require-signatures")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy require-names foo")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.MissingRequiredNamesException,

                    self._api_install, api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy "

                    "require-names 'cs1_ch1_ta3'")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("add-property-value signature-required-names "

                    "'ch1_ta3'")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("remove-property-value signature-required-names "

                    "'cs1_ch1_ta3'")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                # Test setting publisher level policies.

                self.pkg("unset-property signature-policy")

                self.pkg("set-publisher --set-property signature-policy=ignore "

                    "test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher --set-property signature-policy=verify "

                    "test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher "

                    "--set-property signature-policy=require-signatures test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher "

                    "--set-property signature-policy=require-names "

                    "--set-property signature-required-names='cs1_ch1_ta3' "

                    "test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher --add-property-value "

                    "signature-required-names='ch1_ta3' test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher --remove-property-value "

                    "signature-required-names='cs1_ch1_ta3' test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("set-publisher --add-property-value "

                    "signature-required-names='foo' test")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.MissingRequiredNamesException,

                    self._api_install, api_obj, ["example_pkg"])

                self.pkg("set-publisher --remove-property-value "

                    "signature-required-names='foo' test")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                # Test combining publisher and image require-names policies.

                self.pkg("set-property signature-policy require-names foo")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.MissingRequiredNamesException,

                    self._api_install, api_obj, ["example_pkg"])

                self.pkg("set-property signature-policy require-names "

                    "ch1_ta3")

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self._api_uninstall(api_obj, ["example_pkg"])

                self.pkg("unset-property signature-policy")

                # Test removing and adding chain certs

                self.pkg("set-publisher --set-property signature-policy=verify "

                    "test")

                self.pkg("set-publisher --revoke-ca-cert=%s test" % hsh)

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.BrokenChain, self._api_install, api_obj,

                    ["example_pkg"])

                self.pkg("set-publisher --approve-ca-cert=%s test" %

                    chain_cert_path)

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

                self.pkg("set-publisher --revoke-ca-cert=%s test" % hsh)

                self.pkg("verify", exit=1)

                self.pkg("fix", exit=1)

                self.pkg("set-publisher --set-property signature-policy=ignore "

                    "test")

                # These should fail because the image, though not the publisher

                # verifies signatures.

                self.pkg("set-property signature-policy verify")

                self.pkg("verify", exit=1)

                self.pkg("fix", exit=1)

                self.pkg("set-property signature-policy ignore")

                self.pkg("verify")

                self.pkg("set-publisher --set-property signature-policy=verify "

                    "test")

                # These should fail because the publisher, though not the image

                # verifies signatures.

                self.pkg("verify", exit=1)

                self.pkg("fix", exit=1)

                self.pkg("set-publisher --approve-ca-cert=%s test" %

                    chain_cert_path)

                self.pkg("verify")

                api_obj = self.get_img_api_obj()

                self._api_uninstall(api_obj, ["example_pkg"])

                # Test that manually approving a trust anchor works.

                self.pkg("set-publisher --unset-ca-cert=%s test" % hsh)

                self.pkg("set-publisher --approve-ca-cert=%s test" %

                    ta_cert_path)

                api_obj = self.get_img_api_obj()

                self._api_install(api_obj, ["example_pkg"])

        def test_sign_2(self):

                """Test that verification of the CS cert failing means the

                install fails."""

                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)

                sign_args = "-k %(key)s -c %(cert)s %(name)s" % {

                        "name": plist[0],

                        "key": os.path.join(self.keys_dir,

                            "cs1_ch1_ta3_key.pem"),

                        "cert": os.path.join(self.cs_dir,

                            "cs1_ch1_ta3_cert.pem")

                }

                # Specify repository location as relative path.

                cwd = os.getcwd()

                repodir = self.dc.get_repodir()

                os.chdir(os.path.dirname(repodir))

                self.pkgsign(os.path.basename(repodir), sign_args)

                os.chdir(cwd)

                self.image_create(self.rurl1)

                self.pkg("set-property signature-policy verify")

                api_obj = self.get_img_api_obj()

                self.assertRaises(apx.BrokenChain, self._api_install, api_obj,

                    ["example_pkg"])

        def test_sign_3(self):

                """Test that using a chain seven certificates long works.  It

                also tests that having an extra chain certificate doesn't break

                anything."""

                plist = self.pkgsend_bulk(self.rurl1, self.example_pkg10)

                sign_args = "-k %(key)s -c %(cert)s -i %(i1)s -i %(i2)s " \

                    "-i %(i3)s -i %(i4)s -i %(i5)s -i %(i6)s %(pkg)s" % {

                      "key": os.path.join(self.keys_dir, "cs1_ch5_ta1_key.pem"),

                      "cert": os.path.join(self.cs_dir, "cs1_ch5_ta1_cert.pem"),

                      "i1": os.path.join(self.chain_certs_dir,

                          "ch1_ta1_cert.pem"),