From a02b624cd0386c87ecf397fd0f9ffead66f913c3 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 23 Apr 2021 11:26:54 +0200 Subject: [PATCH] added test openCryptoki-PIN-conversion-tool --- .../openCryptoki-PIN-conversion-tool/main.fmf | 40 +++++++++ .../runtest.sh | 85 +++++++++++++++++++ 2 files changed, 125 insertions(+) create mode 100644 Sanity/openCryptoki-PIN-conversion-tool/main.fmf create mode 100755 Sanity/openCryptoki-PIN-conversion-tool/runtest.sh diff --git a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf new file mode 100644 index 0000000..ff14eaf --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf @@ -0,0 +1,40 @@ +summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) +description: | + Bug summary: [IBM 8.3 FEAT] openCryptoki: PIN conversion tool + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- openssl +- gnutls-utils +- opensc +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- NoRHEL7 +- Tier1 +- rhel9_broken +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1853420 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0607912 +extra-summary: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool +extra-task: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh new file mode 100755 index 0000000..5d73c0c --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh @@ -0,0 +1,85 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool +# Description: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t | grep 'Soft'" + SLOT=$( pkcsGetTokenSlot sw ) + rlRun "sed -i '/tokversion = 3.12/ d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present" + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:model=Soft;manufacturer=IBM' --label id_rsa.pub" + rlAssertExists id_rsa.pub + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlServiceStop pkcsslotd + sleep 5 + rlPhaseEnd + + rlPhaseStartTest "Token migration" + ps -ef + rlRun -s "echo y | pkcstok_migrate -s $SLOT -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" + rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG + grep -A 4 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf + rlRun "grep -A 4 -i 'slot $SLOT' /etc/opencryptoki/opencryptoki.conf | grep 'tokversion = 3.12'" 0 "Verify that slot configuration has been updated with 'tokversion = 3.12'" + rlServiceStart pkcsslotd + sleep 1 + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" 0 "Verify I still can list imported RSA key" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlLog "Exporting stored RSA key" + rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der --slot 0x$SLOT" + rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" + rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd