google-nomulus/javatests/google/registry/rde/GhostrydeGpgIntegrationTest.java
jianglai 6bd0fc58de Fix some GPG related test issues
We were running FOSS tests on an old version of Ubuntu (14.04) which comes with a rather old gpg version 1.4.16 compared to the current version 2.1.22 (https://lists.gnupg.org/pipermail/gnupg-announce/2017q3/000411.html). As a result some default settings have changed between these versions, leading to test failures when tests are run on newer platforms. In this CL several of the settings are made explicit, no longer depending on default values, which makes them work on either platform.

1. "--no-mdc-error" is set. We do not have mdc integrity protection for the test keys, which results in a non-zero return value for newer versions of GPG. Setting this flag makes return value zero again.

2. "--keyid-format" long is set. GPG key IDs are the last 16 (long key id) or 8 (short key id) octets of the key fingerprint (https://security.stackexchange.com/questions/84280/short-openpgp-key-ids-are-insecure-how-to-configure-gnupg-to-use-long-key-ids-i). Older version uses the short id as default, whereas newer versions defaults to long id. Also change the expected key ID to 16 bytes accordingly.

3. Output stderr in GpgSystemCommandRule when failure occurs during key import. This help debug key import failure due to too long gpg root path. Note: this failure itself is not fixed and still would occur on newer Debian or macOS systems.

4. Set gpg root folder permission correctly to 700, otherwise the newer version gpg will return non-zero value. Previously used method set it to 755.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=178163297
2017-12-13 12:43:45 -05:00

171 lines
5.6 KiB
Java

// Copyright 2017 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package google.registry.rde;
import static com.google.common.base.Strings.repeat;
import static com.google.common.truth.Truth.assertThat;
import static com.google.common.truth.Truth.assertWithMessage;
import static google.registry.testing.SystemInfo.hasCommand;
import static java.nio.charset.StandardCharsets.UTF_8;
import static org.junit.Assume.assumeTrue;
import com.google.common.io.CharStreams;
import google.registry.keyring.api.Keyring;
import google.registry.testing.BouncyCastleProviderRule;
import google.registry.testing.FakeKeyringModule;
import google.registry.testing.GpgSystemCommandRule;
import google.registry.testing.ShardableTestCase;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStream;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.joda.time.DateTime;
import org.junit.Rule;
import org.junit.experimental.theories.DataPoints;
import org.junit.experimental.theories.Theories;
import org.junit.experimental.theories.Theory;
import org.junit.runner.RunWith;
/** GnuPG integration tests for {@link Ghostryde}. */
@RunWith(Theories.class)
@SuppressWarnings("resource")
public class GhostrydeGpgIntegrationTest extends ShardableTestCase {
@Rule
public final BouncyCastleProviderRule bouncy = new BouncyCastleProviderRule();
@Rule
public final GpgSystemCommandRule gpg =
new GpgSystemCommandRule(
RdeTestData.loadBytes("pgp-public-keyring.asc"),
RdeTestData.loadBytes("pgp-private-keyring-registry.asc"));
@DataPoints
public static GpgCommand[] commands = new GpgCommand[] {
new GpgCommand("gpg"),
new GpgCommand("gpg2"),
};
@DataPoints
public static BufferSize[] bufferSizes = new BufferSize[] {
new BufferSize(1),
new BufferSize(7),
};
@DataPoints
public static Filename[] filenames = new Filename[] {
new Filename("lol.txt"),
// new Filename("(◕‿◕).txt"), // gpg displays this with zany hex characters.
};
@DataPoints
public static Content[] contents = new Content[] {
new Content("(◕‿◕)"),
new Content(repeat("Fanatics have their dreams, wherewith they weave\n", 1000)),
new Content("\0yolo"),
new Content(""),
};
@Theory
public void test(GpgCommand cmd, BufferSize bufferSize, Filename filename, Content content)
throws Exception {
assumeTrue(hasCommand(cmd.get() + " --version"));
Keyring keyring = new FakeKeyringModule().get();
PGPPublicKey publicKey = keyring.getRdeStagingEncryptionKey();
File file = new File(gpg.getCwd(), "love.gpg");
byte[] data = content.get().getBytes(UTF_8);
DateTime mtime = DateTime.parse("1984-12-18T00:30:00Z");
Ghostryde ghost = new Ghostryde(bufferSize.get());
try (OutputStream output = new FileOutputStream(file);
Ghostryde.Encryptor encryptor = ghost.openEncryptor(output, publicKey);
Ghostryde.Compressor kompressor = ghost.openCompressor(encryptor);
OutputStream os = ghost.openOutput(kompressor, filename.get(), mtime)) {
os.write(data);
}
Process pid = gpg.exec(cmd.get(), "--list-packets", "--keyid-format", "long", file.getPath());
String stdout = CharStreams.toString(new InputStreamReader(pid.getInputStream(), UTF_8));
String stderr = CharStreams.toString(new InputStreamReader(pid.getErrorStream(), UTF_8));
assertWithMessage(stderr).that(pid.waitFor()).isEqualTo(0);
assertThat(stdout).contains(":compressed packet:");
assertThat(stdout).contains(":encrypted data packet:");
assertThat(stdout).contains("version 3, algo 1, keyid A59C132F3589A1D5");
assertThat(stdout).contains("name=\"" + filename.get() + "\"");
assertThat(stderr).contains("encrypted with 2048-bit RSA key, ID A59C132F3589A1D5");
pid = gpg.exec(cmd.get(), "--use-embedded-filename", file.getPath());
stderr = CharStreams.toString(new InputStreamReader(pid.getErrorStream(), UTF_8));
assertWithMessage(stderr).that(pid.waitFor()).isEqualTo(0);
File dataFile = new File(gpg.getCwd(), filename.get());
assertThat(dataFile.exists()).isTrue();
assertThat(slurp(dataFile)).isEqualTo(content.get());
}
private String slurp(File file) throws IOException {
return CharStreams.toString(new InputStreamReader(new FileInputStream(file), UTF_8));
}
private static class GpgCommand {
private final String value;
GpgCommand(String value) {
this.value = value;
}
String get() {
return value;
}
}
private static class BufferSize {
private final int value;
BufferSize(int value) {
this.value = value;
}
int get() {
return value;
}
}
private static class Filename {
private final String value;
Filename(String value) {
this.value = value;
}
String get() {
return value;
}
}
private static class Content {
private final String value;
Content(String value) {
this.value = value;
}
String get() {
return value;
}
}
}