added test openCryptoki-PIN-conversion-tool

2021-04-23 11:26:54 +02:00 · 2021-04-23 11:26:54 +02:00 · a02b624cd0
commit a02b624cd0
parent beeea4a573
2 changed files with 125 additions and 0 deletions
--- a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf
+++ b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf
@ -0,0 +1,40 @@
+summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool)
+description: |
+    Bug summary: [IBM 8.3 FEAT] openCryptoki: PIN conversion tool
+    Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1780294
+contact: Karel Srot <ksrot@redhat.com>
+component:
+- openCryptoki
+test: ./runtest.sh
+framework: beakerlib
+require:
+- url: https://src.fedoraproject.org/tests/opencryptoki.git
+  name: /Library/token-manipulation
+recommend:
+- opencryptoki
+- opencryptoki-swtok
+- openssl
+- gnutls-utils
+- opensc
+- expect
+duration: 5m
+enabled: true
+tag:
+- CI-Tier-1
+- NoRHEL4
+- NoRHEL5
+- NoRHEL6
+- NoRHEL7
+- Tier1
+- rhel9_broken
+tier: '1'
+link:
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1780294
+-   relates: https://bugzilla.redhat.com/show_bug.cgi?id=1853420
+adjust:
+-   enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
+    continue: false
+extra-nitrate: TC#0607912
+extra-summary: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool
+extra-task: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool
--- a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh
+++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh
@ -0,0 +1,85 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool
+#   Description: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool)
+#   Author: Karel Srot <ksrot@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2020 Red Hat, Inc.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="opencryptoki"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm $PACKAGE
+        rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
+        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        rlRun "pushd $TmpDir"
+        rlFileBackup /etc/opencryptoki/opencryptoki.conf
+        rlServiceStop pkcsslotd
+        rlRun "pkcsResetTokens"
+        rlServiceStart pkcsslotd
+        sleep 1
+        rlRun "pkcsconf -t | grep 'Soft'"
+        SLOT=$( pkcsGetTokenSlot sw )
+        rlRun "sed -i '/tokversion = 3.12/ d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present"
+        rlRun "pkcsInitToken $SLOT"
+        rlRun "pkcsconf -t"
+        rlRun "p11tool --generate-rsa  --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:model=Soft;manufacturer=IBM' --label id_rsa.pub"
+        rlAssertExists id_rsa.pub
+        rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so  --list-objects --slot 0x$SLOT"
+        rlAssertGrep "Public Key Object" $rlRun_LOG
+        rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
+        rlServiceStop pkcsslotd
+        sleep 5
+    rlPhaseEnd
+
+    rlPhaseStartTest "Token migration"
+        ps -ef
+        rlRun -s "echo y | pkcstok_migrate -s $SLOT -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN"
+        rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG
+        grep -A 4 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf
+        rlRun "grep -A 4 -i 'slot $SLOT' /etc/opencryptoki/opencryptoki.conf | grep 'tokversion = 3.12'" 0 "Verify that slot configuration has been updated with 'tokversion = 3.12'"
+        rlServiceStart pkcsslotd
+        sleep 1
+        rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" 0 "Verify I still can list imported RSA key"
+        rlAssertGrep "Public Key Object" $rlRun_LOG
+        rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
+        rlLog "Exporting stored RSA key"
+        rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der --slot 0x$SLOT"
+        rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format"
+        rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlServiceStop pkcsslotd
+        rlRun "pkcsRestoreTokens"
+        rlFileRestore
+        rlServiceRestore pkcsslotd
+        rlRun "popd"
+        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd