From 7a3f8958cd7fc3fa0ab97fdbb96be50ac27c3d99 Mon Sep 17 00:00:00 2001 From: Daiki Ueno Date: Fri, 27 Oct 2023 18:38:37 +0900 Subject: [PATCH] tests: Run tests using SoftHSM after installation This makes the unit tests self-contained so all possible code paths are exercised without optional packages installed. The integration tests against SoftHSM can still run after installation, through "make installcheck" or running the scripts manually. Signed-off-by: Daiki Ueno --- .github/actions/basic-autotools/action.yaml | 4 +- .github/actions/basic-meson/action.yaml | 18 ++ Makefile.am | 14 ++ p11-kit/Makefile.am | 14 +- .../{softhsm2.module => fourteen.module} | 2 +- p11-kit/meson.build | 4 +- p11-kit/mock-module-ep12.c | 203 ++++++++++++++++++ p11-kit/test-generate-keypair.sh | 77 +++---- p11-kit/test-import-public.sh | 79 ++----- p11-kit/test-lists.sh | 17 ++ p11-kit/test-softhsm2.sh | 180 ++++++++++++++++ trust/Makefile.am | 8 +- 12 files changed, 493 insertions(+), 127 deletions(-) rename p11-kit/fixtures/package-modules/{softhsm2.module => fourteen.module} (62%) create mode 100644 p11-kit/mock-module-ep12.c create mode 100755 p11-kit/test-softhsm2.sh diff --git a/.github/actions/basic-autotools/action.yaml b/.github/actions/basic-autotools/action.yaml index ba7b9e4f..4fe6749a 100644 --- a/.github/actions/basic-autotools/action.yaml +++ b/.github/actions/basic-autotools/action.yaml @@ -48,5 +48,7 @@ runs: DD=gdd export DD fi - make installcheck + # This is necessary for 'p11-kit/test-softhsm2.sh' + cp /usr/share/p11-kit/modules/softhsm2.module $GITHUB_WORKSPACE/$INSTALLDIR/share/p11-kit/modules + PATH=$GITHUB_WORKSPACE/$INSTALLDIR/bin:$PATH LD_LIBRARY_PATH=$GITHUB_WORKSPACE/$INSTALLDIR/lib abs_top_builddir=$GITHUB_WORKSPACE/$BUILDDIR abs_top_srcdir=$GITHUB_WORKSPACE make installcheck shell: bash diff --git a/.github/actions/basic-meson/action.yaml b/.github/actions/basic-meson/action.yaml index 67519e99..2e8b2132 100644 --- a/.github/actions/basic-meson/action.yaml +++ b/.github/actions/basic-meson/action.yaml @@ -35,3 +35,21 @@ runs: - name: Install run: ninja -C $GITHUB_WORKSPACE/$BUILDDIR install shell: bash + + - name: Post-install Test + run: | + # This is necessary for 'trust/test-extract.sh' + mkdir -p $GITHUB_WORKSPACE/$INSTALLDIR/libexec/p11-kit + ln -sf /usr/bin/true $GITHUB_WORKSPACE/$INSTALLDIR/libexec/p11-kit/trust-extract-compat + if [ "$RUNNER_OS" = "macOS" ]; then + DD=gdd + export DD + fi + # This is necessary for 'p11-kit/test-softhsm2.sh' + cp /usr/share/p11-kit/modules/softhsm2.module $GITHUB_WORKSPACE/$INSTALLDIR/share/p11-kit/modules + for t in p11-kit/test-softhsm2.sh trust/test-extract.sh trust/test-trust.sh; do + PATH=$GITHUB_WORKSPACE/$INSTALLDIR/bin:$PATH LD_LIBRARY_PATH=$GITHUB_WORKSPACE/$INSTALLDIR/lib abs_top_builddir=$GITHUB_WORKSPACE/$BUILDDIR abs_top_srcdir=$GITHUB_WORKSPACE /bin/sh $t + ret=$? + test $ret -eq 0 || exit $ret + done + shell: bash diff --git a/Makefile.am b/Makefile.am index da5990b1..dc14913c 100644 --- a/Makefile.am +++ b/Makefile.am @@ -43,6 +43,9 @@ c_tests = sh_tests = TESTS = $(c_tests) $(sh_tests) +post_install_tests = +noinst_SCRIPTS = $(post_install_tests) + moduledir = $(p11_module_path) module_LTLIBRARIES = @@ -76,6 +79,8 @@ DISTCHECK_CONFIGURE_FLAGS = \ AM_TESTS_ENVIRONMENT = \ abs_top_builddir="$(abs_top_builddir)"; \ export abs_top_builddir; \ + abs_top_srcdir="$(abs_top_srcdir)"; \ + export abs_top_srcdir; \ P11_MODULE_PATH="$(abs_top_builddir)/.libs"; \ export P11_MODULE_PATH; AM_TESTS_FD_REDIRECT = 9>&2; @@ -113,6 +118,15 @@ dist-hook: echo A git clone is required to generate a ChangeLog >&2; \ fi +noinst_SCRIPTS += $(post_install_tests) + +if !OS_WIN32 +installcheck-local: + for t in $(post_install_tests); do \ + abs_top_builddir="$(abs_top_builddir)" $(SHELL) $(srcdir)/$$t; \ + done +endif + if WITH_COVERAGE coverage: mkdir -p build/coverage diff --git a/p11-kit/Makefile.am b/p11-kit/Makefile.am index 8465478a..6f28166d 100644 --- a/p11-kit/Makefile.am +++ b/p11-kit/Makefile.am @@ -545,7 +545,8 @@ check_LTLIBRARIES += \ mock-ten.la \ mock-eleven.la \ mock-twelve.la \ - mock-thirteen.la + mock-thirteen.la \ + mock-fourteen.la mock_one_la_SOURCES = p11-kit/mock-module-ep.c mock_one_la_LIBADD = libp11-test.la libp11-common.la @@ -622,6 +623,16 @@ else mock_thirteen_la_LIBADD = $(mock_one_la_LIBADD) endif +mock_fourteen_la_SOURCES = p11-kit/mock-module-ep12.c +mock_fourteen_la_LDFLAGS = $(mock_one_la_LDFLAGS) +if WITH_ASN1 +mock_fourteen_la_LIBADD = libp11-asn1.la $(mock_one_la_LIBADD) $(LIBTASN1_LIBS) +else +mock_fourteen_la_LIBADD = $(mock_one_la_LIBADD) +endif + +post_install_tests += p11-kit/test-softhsm2.sh + EXTRA_DIST += \ p11-kit/fixtures \ p11-kit/templates \ @@ -637,4 +648,5 @@ EXTRA_DIST += \ p11-kit/test-import-public.sh \ p11-kit/test-list-mechanisms.sh \ p11-kit/test-generate-keypair.sh \ + p11-kit/test-softhsm2.sh \ $(NULL) diff --git a/p11-kit/fixtures/package-modules/softhsm2.module b/p11-kit/fixtures/package-modules/fourteen.module similarity index 62% rename from p11-kit/fixtures/package-modules/softhsm2.module rename to p11-kit/fixtures/package-modules/fourteen.module index d64528c8..e3fd1d4b 100644 --- a/p11-kit/fixtures/package-modules/softhsm2.module +++ b/p11-kit/fixtures/package-modules/fourteen.module @@ -1,4 +1,4 @@ -module: libsofthsm2.so +module: mock-fourteen.so managed: yes enable-in: p11-kit-testable diff --git a/p11-kit/meson.build b/p11-kit/meson.build index 70583f14..4144d3b1 100644 --- a/p11-kit/meson.build +++ b/p11-kit/meson.build @@ -386,6 +386,7 @@ if get_option('test') p11_kit_tests_env = environment() p11_kit_tests_env.set('abs_top_builddir', top_build_dir) + p11_kit_tests_env.set('abs_top_srcdir', top_source_dir) p11_kit_tests_env.set('P11_MODULE_PATH', meson.current_build_dir()) if host_system != 'windows' @@ -447,7 +448,8 @@ if get_option('test') 'mock-ten': ['mock-module-ep8.c'], 'mock-eleven': ['mock-module-ep9.c'], 'mock-twelve': ['mock-module-ep10.c'], - 'mock-thirteen': ['mock-module-ep11.c'] + 'mock-thirteen': ['mock-module-ep11.c'], + 'mock-fourteen': ['mock-module-ep12.c'] } if host_system != 'windows' diff --git a/p11-kit/mock-module-ep12.c b/p11-kit/mock-module-ep12.c new file mode 100644 index 00000000..ea5dafb8 --- /dev/null +++ b/p11-kit/mock-module-ep12.c @@ -0,0 +1,203 @@ +/* + * Copyright (c) 2023, Red Hat Inc. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the + * following disclaimer. + * * Redistributions in binary form must reproduce the + * above copyright notice, this list of conditions and + * the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * * The names of contributors to this software may not be + * used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF + * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH + * DAMAGE. + * + * Author: Zoltan Fridrich , Daiki Ueno + */ + +#include "config.h" + +#define CRYPTOKI_EXPORTS 1 +#include "pkcs11.h" + +#include "attrs.h" +#include "debug.h" +#include "mock.h" + +#ifdef WITH_ASN1 +#include "persist.h" +#endif + +#include +#include + +static const CK_TOKEN_INFO MOCK_TOKEN_INFO = { + "PERSIST LABEL ONE ", + "PERSIST MANUFACTURER ", + "PERSIST MODEL ", + "PERSIST SERIAL ", + CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_CLOCK_ON_TOKEN | CKF_TOKEN_INITIALIZED, + 1, + 2, + 3, + 4, + 5, + 6, + 7, + 8, + 9, + 10, + { 75, 175 }, + { 85, 185 }, + { '1', '9', '9', '9', '0', '5', '2', '5', '0', '9', '1', '9', '5', '9', '0', '0' } +}; + +static CK_RV +override_C_GetTokenInfo (CK_SLOT_ID slot_id, + CK_TOKEN_INFO_PTR info) +{ + return_val_if_fail (info != NULL, CKR_ARGUMENTS_BAD); + + switch (slot_id) { + case MOCK_SLOT_ONE_ID: + memcpy (info, &MOCK_TOKEN_INFO, sizeof (*info)); + return CKR_OK; + case MOCK_SLOT_TWO_ID: + return CKR_TOKEN_NOT_PRESENT; + default: + return CKR_SLOT_ID_INVALID; + } +} + +#ifdef WITH_ASN1 +static CK_RV +override_C_Initialize (CK_VOID_PTR init_args) +{ + bool ok; + size_t i, size = 0; + void *data = NULL; + const char *filename = "test-persist.p11-kit"; + p11_mmap *map = NULL; + p11_persist *persist = NULL; + p11_array *objects = NULL; + CK_ATTRIBUTE *attrs = NULL; + CK_RV rv; + + map = p11_mmap_open (filename, NULL, &data, &size); + if (map == NULL) + return mock_C_Initialize (init_args); + + ok = p11_persist_magic (data, size); + return_val_if_fail (ok, CKR_GENERAL_ERROR); + + persist = p11_persist_new (); + return_val_if_fail (persist != NULL, CKR_HOST_MEMORY); + + objects = p11_array_new (NULL); + return_val_if_fail (objects != NULL, CKR_HOST_MEMORY); + + ok = p11_persist_read (persist, filename, (const unsigned char *)data, size, objects); + return_val_if_fail (ok, CKR_GENERAL_ERROR); + + rv = mock_C_Initialize (init_args); + for (i = 0; i < objects->num; ++i) { + attrs = p11_attrs_build (objects->elem[i], NULL); + mock_module_add_object (MOCK_SLOT_ONE_ID, attrs); + p11_attrs_free (attrs); + } + + p11_array_free (objects); + p11_persist_free (persist); + p11_mmap_close (map); + return rv; +} + +struct WriteData { + p11_persist *persist; + p11_buffer buf; +}; + +static bool +persist_enumerator (CK_OBJECT_HANDLE handle, + CK_ATTRIBUTE *attrs, + void *user_data) +{ + struct WriteData *data = user_data; + + p11_persist_write (data->persist, attrs, &data->buf); + + return true; +} + +static CK_RV +override_C_Finalize (CK_VOID_PTR reserved) +{ + bool ok; + FILE *f = NULL; + const char *filename = "test-persist.p11-kit"; + CK_SESSION_HANDLE session = 0; + struct WriteData data; + CK_RV rv; + + ok = p11_buffer_init (&data.buf, 0); + return_val_if_fail (ok, CKR_HOST_MEMORY); + + data.persist = p11_persist_new (); + return_val_if_fail (data.persist != NULL, CKR_HOST_MEMORY); + + rv = mock_C_OpenSession (MOCK_SLOT_ONE_ID, CKF_SERIAL_SESSION, NULL, NULL, &session); + return_val_if_fail (rv == CKR_OK, CKR_GENERAL_ERROR); + + mock_module_enumerate_objects (session, + persist_enumerator, + &data); + + rv = mock_C_CloseSession (session); + return_val_if_fail (rv == CKR_OK, CKR_GENERAL_ERROR); + + f = fopen (filename, "wb"); + return_val_if_fail (f != NULL, CKR_HOST_MEMORY); + fwrite (data.buf.data, 1, data.buf.len, f); + fclose (f); + + p11_persist_free (data.persist); + p11_buffer_uninit (&data.buf); + return mock_C_Finalize (reserved); +} +#endif /* WITH_ASN1 */ + +#ifdef OS_WIN32 +__declspec(dllexport) +#endif +CK_RV +C_GetFunctionList (CK_FUNCTION_LIST_PTR_PTR list) +{ + mock_module_init (); +#ifdef WITH_ASN1 + mock_module.C_Initialize = override_C_Initialize; + mock_module.C_Finalize = override_C_Finalize; +#endif + mock_module.C_GetFunctionList = C_GetFunctionList; + mock_module.C_GetTokenInfo = override_C_GetTokenInfo; + if (list == NULL) + return CKR_ARGUMENTS_BAD; + *list = &mock_module; + return CKR_OK; +} diff --git a/p11-kit/test-generate-keypair.sh b/p11-kit/test-generate-keypair.sh index fcc56067..8371dfce 100755 --- a/p11-kit/test-generate-keypair.sh +++ b/p11-kit/test-generate-keypair.sh @@ -10,83 +10,60 @@ test "${abs_top_builddir+set}" = set || { : ${P11_MODULE_PATH="$abs_top_builddir"/.libs} setup() { - testdir=$PWD/test-objects-$$ + testdir=$PWD/test-genkey-$$ test -d "$testdir" || mkdir "$testdir" cd "$testdir" - mkdir tokens - cat > softhsm2.conf </dev/null; then - skip "softhsm2-util not found" - return - fi - softhsm2-util --init-token --free --label test-genkey --so-pin 12345 --pin 12345 - - : ${PKG_CONFIG=pkg-config} - if ! "$PKG_CONFIG" p11-kit-1 --exists; then - skip "pkgconfig(p11-kit-1) not found" - return - fi - - module_path=$("$PKG_CONFIG" p11-kit-1 --variable=p11_module_path) - if ! test -e "$module_path/libsofthsm2.so"; then - skip "unable to resolve libsofthsm2.so" - return - fi - - ln -sf "$module_path"/libsofthsm2.so "$P11_MODULE_PATH" } teardown() { - unset SOFTHSM2_CONF rm -rf "$testdir" } +test_generate_keypair_mock() { + if ! "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label=mock --type=mock "pkcs11:token=PUBKEY%20LABEL?pin-value=booo"; then + assert_fail "unable to run p11-kit generate-keypair" + fi +} + test_generate_keypair_rsa() { - if ! "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label=rsa --type=rsa --bits=2048 "pkcs11:token=test-genkey?pin-value=12345"; then - assert_fail "unable to run: p11-kit generate-keypair" + if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label=rsa --type=rsa --bits=2048 "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then + assert_fail "expected to fail: p11-kit generate-keypair" + fi + assert_contains err.out "key-pair generation failed: The crypto mechanism is invalid or unrecognized" + + if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label=rsa --type=rsa "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then + assert_fail "expected to fail: p11-kit generate-keypair" fi + assert_contains err.out "no bits specified" } test_generate_keypair_ecdsa() { for curve in secp256r1 secp384r1 secp521r1; do - if ! "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="ecdsa-$curve" --type=ecdsa --curve="$curve" "pkcs11:token=test-genkey?pin-value=12345"; then - assert_fail "unable to run: p11-kit generate-keypair" + if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="ecdsa-$curve" --type=ecdsa --curve="$curve" "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then + assert_fail "expected to fail: p11-kit generate-keypair" fi done + assert_contains err.out "key-pair generation failed: The crypto mechanism is invalid or unrecognized" - if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="ecdsa-unknown" --type=ecdsa --curve=unknown "pkcs11:token=test-genkey?pin-value=12345"; then + if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="ecdsa-unknown" --type=ecdsa --curve=unknown "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then assert_fail "p11-kit generate-keypair succeeded for unknown ecdsa curve" fi + assert_contains err.out "unknown curve name: unknown" } test_generate_keypair_eddsa() { - curves= - mech=$("$abs_top_builddir"/p11-kit/p11-kit-testable list-mechanisms "pkcs11:token=test-genkey" | sed -n '/CKM_EDDSA/p') - if test -z "$mech"; then - skip "no support for EdDSA" - return - fi - if expr "$mech" : ".*key-size=256-" > /dev/null; then - curve="$curve ed25519" - fi - if expr "$mech" : ".*key-size=.*-456" > /dev/null; then - curve="$curve ed448" - fi - for curve in $curves; do - if ! "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="eddsa-$curve" --type=eddsa --curve="$curve" "pkcs11:token=test-genkey?pin-value=12345"; then + for curve in ed25519 ed448; do + if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="eddsa-$curve" --type=eddsa --curve="$curve" "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then assert_fail "unable to run: p11-kit generate-keypair" fi done + assert_contains err.out "key-pair generation failed: The crypto mechanism is invalid or unrecognized" - if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="eddsa-unknown" --type=eddsa --curve=unknown "pkcs11:token=test-genkey?pin-value=12345"; then + if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="eddsa-unknown" --type=eddsa --curve=unknown "pkcs11:token=PUBKEY%20LABEL?pin-value=booo"; then assert_fail "p11-kit generate-keypair succeeded for unknown eddsa curve" fi + assert_contains err.out "unknown curve name: unknown" } -run test_generate_keypair_rsa test_generate_keypair_ecdsa \ - test_generate_keypair_ecdsa +run test_generate_keypair_mock test_generate_keypair_rsa \ + test_generate_keypair_ecdsa test_generate_keypair_ecdsa diff --git a/p11-kit/test-import-public.sh b/p11-kit/test-import-public.sh index 604f4316..1972a8ba 100755 --- a/p11-kit/test-import-public.sh +++ b/p11-kit/test-import-public.sh @@ -5,87 +5,34 @@ test "${abs_top_builddir+set}" = set || { exit 1 } -. "$abs_top_builddir/common/test-init.sh" +test "${abs_top_srcdir+set}" = set || { + echo "set abs_top_srcdir" 1>&2 + exit 1 +} -: ${P11_MODULE_PATH="$abs_top_builddir"/.libs} +. "$abs_top_builddir/common/test-init.sh" setup() { - testdir=$PWD/test-objects-$$ + testdir=$PWD/test-import-$$ test -d "$testdir" || mkdir "$testdir" cd "$testdir" - mkdir tokens - cat > softhsm2.conf </dev/null; then - skip "softhsm2-util not found" - return - fi - softhsm2-util --init-token --free --label test-import-key --so-pin 12345 --pin 12345 - - : ${PKG_CONFIG=pkg-config} - if ! "$PKG_CONFIG" p11-kit-1 --exists; then - skip "pkgconfig(p11-kit-1) not found" - return - fi - - module_path=$("$PKG_CONFIG" p11-kit-1 --variable=p11_module_path) - if ! test -e "$module_path/libsofthsm2.so"; then - skip "unable to resolve libsofthsm2.so" - return - fi - - ln -sf "$module_path"/libsofthsm2.so "$P11_MODULE_PATH" } teardown() { - unset SOFTHSM2_CONF rm -rf "$testdir" } test_import_cert() { - # Taken from: trust/fixtures/thawte.pem - cat > export.exp < export.out; then + if ! "$abs_top_builddir"/p11-kit/p11-kit-testable export-object -q --login "pkcs11:token=PERSIST%20LABEL%20ONE;object=cert?pin-value=booo" > export.out; then assert_fail "unable to run: p11-kit export-object" fi : ${DIFF=diff} - if ! ${DIFF} export.exp export.out > export.diff; then + if ! ${DIFF} "$abs_top_srcdir"/trust/fixtures/cacert3.pem export.out > export.diff; then sed 's/^/# /' export.diff assert_fail "output contains incorrect result" fi @@ -107,11 +54,11 @@ fQIDAQAB -----END PUBLIC KEY----- EOF - if ! "$abs_top_builddir"/p11-kit/p11-kit-testable import-object -q --login --file="export.exp" --label=rsa "pkcs11:token=test-import-key?pin-value=12345"; then + if ! "$abs_top_builddir"/p11-kit/p11-kit-testable import-object -q --login --file="export.exp" --label=rsa "pkcs11:token=PERSIST%20LABEL%20ONE?pin-value=booo"; then assert_fail "unable to run: p11-kit import-object" fi - if ! "$abs_top_builddir"/p11-kit/p11-kit-testable export-object -q --login "pkcs11:token=test-import-key;object=rsa?pin-value=12345" > export.out; then + if ! "$abs_top_builddir"/p11-kit/p11-kit-testable export-object -q --login "pkcs11:token=PERSIST%20LABEL%20ONE;object=rsa?pin-value=booo" > export.out; then assert_fail "unable to run: p11-kit export-object" fi @@ -133,11 +80,11 @@ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsaTJt0debXaW7Hpcrpn7X07SsTk9 -----END PUBLIC KEY----- EOF - if ! "$abs_top_builddir"/p11-kit/p11-kit-testable import-object -q --login --file="export.exp" --label=ec "pkcs11:token=test-import-key?pin-value=12345"; then + if ! "$abs_top_builddir"/p11-kit/p11-kit-testable import-object -q --login --file="export.exp" --label=ec "pkcs11:token=PERSIST%20LABEL%20ONE?pin-value=booo"; then assert_fail "unable to run: p11-kit import-object" fi - if ! "$abs_top_builddir"/p11-kit/p11-kit-testable export-object -q --login "pkcs11:token=test-import-key;object=ec?pin-value=12345" > export.out; then + if ! "$abs_top_builddir"/p11-kit/p11-kit-testable export-object -q --login "pkcs11:token=PERSIST%20LABEL%20ONE;object=ec?pin-value=booo" > export.out; then assert_fail "unable to run: p11-kit export-object" fi diff --git a/p11-kit/test-lists.sh b/p11-kit/test-lists.sh index ae2d30cc..6a460002 100755 --- a/p11-kit/test-lists.sh +++ b/p11-kit/test-lists.sh @@ -53,6 +53,23 @@ module: eleven user-pin-initialized clock-on-token token-initialized +module: fourteen + uri: pkcs11:library-description=MOCK%20LIBRARY;library-manufacturer=MOCK%20MANUFACTURER + library-description: MOCK LIBRARY + library-manufacturer: MOCK MANUFACTURER + library-version: 45.145 + token: PERSIST LABEL ONE + uri: pkcs11:model=PERSIST%20MODEL;manufacturer=PERSIST%20MANUFACTURER;serial=PERSIST%20SERIAL;token=PERSIST%20LABEL%20ONE + manufacturer: PERSIST MANUFACTURER + model: PERSIST MODEL + serial-number: PERSIST SERIAL + hardware-version: 75.175 + firmware-version: 85.185 + flags: + login-required + user-pin-initialized + clock-on-token + token-initialized module: one uri: pkcs11:library-description=MOCK%20LIBRARY;library-manufacturer=MOCK%20MANUFACTURER library-description: MOCK LIBRARY diff --git a/p11-kit/test-softhsm2.sh b/p11-kit/test-softhsm2.sh new file mode 100755 index 00000000..0aefd8ae --- /dev/null +++ b/p11-kit/test-softhsm2.sh @@ -0,0 +1,180 @@ +#!/bin/sh + +test "${abs_top_builddir+set}" = set || { + echo "set abs_top_builddir" 1>&2 + exit 1 +} + +. "$abs_top_builddir/common/test-init.sh" + +setup() { + testdir=$PWD/test-objects-$$ + test -d "$testdir" || mkdir "$testdir" + cd "$testdir" + mkdir tokens + cat > softhsm2.conf </dev/null; then + skip "softhsm2-util not found" + return + fi + softhsm2-util --init-token --free --label test-genkey --so-pin 12345 --pin 12345 + softhsm2-util --init-token --free --label test-import --so-pin 12345 --pin 12345 +} + +teardown() { + unset SOFTHSM2_CONF + rm -rf "$testdir" +} + +test_generate_keypair_rsa() { + if ! p11-kit generate-keypair --login --label=rsa --type=rsa --bits=2048 "pkcs11:token=test-genkey?pin-value=12345"; then + assert_fail "unable to run: p11-kit generate-keypair" + fi +} + +test_generate_keypair_ecdsa() { + for curve in secp256r1 secp384r1 secp521r1; do + if ! p11-kit generate-keypair --login --label="ecdsa-$curve" --type=ecdsa --curve="$curve" "pkcs11:token=test-genkey?pin-value=12345"; then + assert_fail "unable to run: p11-kit generate-keypair" + fi + done + + if p11-kit generate-keypair --login --label="ecdsa-unknown" --type=ecdsa --curve=unknown "pkcs11:token=test-genkey?pin-value=12345"; then + assert_fail "p11-kit generate-keypair succeeded for unknown ecdsa curve" + fi +} + +test_generate_keypair_eddsa() { + curves= + mech=$(p11-kit list-mechanisms "pkcs11:token=test-genkey" | sed -n '/CKM_EDDSA/p') + if test -z "$mech"; then + skip "no support for EdDSA" + return + fi + if expr "$mech" : ".*key-size=256-" > /dev/null; then + curve="$curve ed25519" + fi + if expr "$mech" : ".*key-size=.*-456" > /dev/null; then + curve="$curve ed448" + fi + for curve in $curves; do + if ! p11-kit generate-keypair --login --label="eddsa-$curve" --type=eddsa --curve="$curve" "pkcs11:token=test-genkey?pin-value=12345"; then + assert_fail "unable to run: p11-kit generate-keypair" + fi + done + + if p11-kit generate-keypair --login --label="eddsa-unknown" --type=eddsa --curve=unknown "pkcs11:token=test-genkey?pin-value=12345"; then + assert_fail "p11-kit generate-keypair succeeded for unknown eddsa curve" + fi +} + +test_import_cert() { + # Taken from: trust/fixtures/thawte.pem + cat > export.exp < export.out; then + assert_fail "unable to run: p11-kit export-object" + fi + + : ${DIFF=diff} + if ! ${DIFF} export.exp export.out > export.diff; then + sed 's/^/# /' export.diff + assert_fail "output contains incorrect result" + fi +} + +test_import_pubkey_rsa() { + # Generated and extracted with: + # p11-kit generate-keypair --type=rsa --bits=2048 --label=RSA 'pkcs11:model=SoftHSM%20v2' + # p11tool --export 'pkcs11:model=SoftHSM%20v2;object=RSA;type=public' + cat > export.exp < export.out; then + assert_fail "unable to run: p11-kit export-object" + fi + + : ${DIFF=diff} + if ! ${DIFF} export.exp export.out > export.diff; then + sed 's/^/# /' export.diff + assert_fail "output contains incorrect result" + fi +} + +test_import_pubkey_ec() { + # Generated and extracted with: + # p11-kit generate-keypair --type=ecdsa --curve=secp256r1 --label=EC 'pkcs11:model=SoftHSM%20v2' + # p11tool --export 'pkcs11:model=SoftHSM%20v2;object=EC;type=public' + cat > export.exp < export.out; then + assert_fail "unable to run: p11-kit export-object" + fi + + : ${DIFF=diff} + if ! ${DIFF} export.exp export.out > export.diff; then + sed 's/^/# /' export.diff + assert_fail "output contains incorrect result" + fi +} + +run test_generate_keypair_rsa test_generate_keypair_ecdsa \ + test_generate_keypair_ecdsa \ + test_import_cert test_import_pubkey_rsa test_import_pubkey_ec diff --git a/trust/Makefile.am b/trust/Makefile.am index 564f6e17..89bc2e0f 100644 --- a/trust/Makefile.am +++ b/trust/Makefile.am @@ -292,13 +292,7 @@ frob_token_SOURCES = trust/frob-token.c frob_token_LDADD = $(trust_LIBS) frob_token_CFLAGS = $(trust_CFLAGS) -noinst_SCRIPTS += trust/test-extract.sh trust/test-trust.sh - -if !OS_WIN32 -installcheck-local: - abs_top_builddir="$(abs_top_builddir)" $(SHELL) $(srcdir)/trust/test-extract.sh - abs_top_builddir="$(abs_top_builddir)" $(SHELL) $(srcdir)/trust/test-trust.sh -endif +post_install_tests += trust/test-extract.sh trust/test-trust.sh EXTRA_DIST += \ trust/input \