From beeea4a5732988f0e87b2c3e64e373beef38ff6f Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 23 Apr 2021 09:25:52 +0200 Subject: [PATCH] added test p11sak-key-management-tool-basic-functionality --- .../main.fmf | 38 +++++ .../runtest.sh | 141 ++++++++++++++++++ 2 files changed, 179 insertions(+) create mode 100644 Sanity/p11sak-key-management-tool-basic-functionality/main.fmf create mode 100755 Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf new file mode 100644 index 0000000..a2cdf1c --- /dev/null +++ b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf @@ -0,0 +1,38 @@ +summary: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool) +description: | + Bug summary: [IBM 8.3 FEAT] openCryptoki key management tool: list keys function + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +- library(nvr/nvr) +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- NoRHEL7 +- TIPfail_Security +- Tier1 +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851109 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0607944 +extra-summary: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality +extra-task: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh new file mode 100755 index 0000000..ca2919c --- /dev/null +++ b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh @@ -0,0 +1,141 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality +# Description: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +[ -n "$SLOT" ] || SLOT=sw + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t | grep 'Soft'" + SLOT=$( pkcsGetTokenSlot $SLOT ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + rlPhaseEnd + + rlPhaseStartTest "Test key generation and listing" + rlRun -s "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" + rlAssertGrep "Generate symmetric key AES with keylen=128 and label=\[aes_key\]" $rlRun_LOG + rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "AES 128 | aes_key" $rlRun_LOG + + rlRun -s "p11sak gen-key 3des --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" + rlAssertGrep "Generate symmetric key 3DES with keylen=192 and label=\[3des_key\]" $rlRun_LOG + rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "3DES | 3des_key" $rlRun_LOG + + rlRun -s "p11sak gen-key rsa 2048 --exponent 257 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" + rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG + rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG + rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "public RSA | rsa_key:pub" $rlRun_LOG + rlAssertGrep "private RSA | rsa_key:prv" $rlRun_LOG + + # The soft token does not support EC mechanisms right now. + rlRun -s "p11sak gen-key ec prime192 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" 112,64 + rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG + rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "Label: aes_key" $rlRun_LOG + rlAssertGrep "Label: 3des_key" $rlRun_LOG + rlAssertNotGrep "Label: rsa_key" $rlRun_LOG + + rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "Label: rsa_key:prv" $rlRun_LOG + rlAssertNotGrep "Label: rsa_key:pub" $rlRun_LOG + rlPhaseEnd + +if nvrTestPackage opencryptoki '>=' 3.15.0; then + rlPhaseStartTest "Test key removal" + rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + rlAssertGrep "Skip deleting Key. User input CKR_CANCEL" $rlRun_LOG + rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "aes_key" $rlRun_LOG + + rlRun -s "echo n | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + rlAssertGrep "Skip deleting Key" $rlRun_LOG + rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "aes_key" $rlRun_LOG + + rlRun -s "echo y | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + rlAssertGrep "Object with Label: aes_key found and destroyed" $rlRun_LOG + rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertNotGrep "aes_key" $rlRun_LOG + + rlRun -s "p11sak rm-key 3des --force --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" + rlAssertGrep "Object with Label: 3des_key found and destroyed" $rlRun_LOG + rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertNotGrep "3des_key" $rlRun_LOG + + rlRun -s "p11sak rm rsa --force --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key:pub" + rlAssertGrep "Object with Label: rsa_key:pub found and destroyed" $rlRun_LOG + rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertNotGrep "rsa_key:pub" $rlRun_LOG + rlPhaseEnd +fi + + rlPhaseStartTest "Test help printing" + rlRun -s "p11sak --help" + rlAssertGrep "Usage: p11sak COMMAND \[ARGS\] \[OPTIONS\]" $rlRun_LOG + + rlRun -s "p11sak generate-key --help" 7 + rlAssertGrep "Usage: p11sak generate-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG + + rlRun -s "p11sak list-key --help" 7 + rlAssertGrep "Usage: p11sak list-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG + + +if nvrTestPackage opencryptoki '>=' 3.15.0; then + rlRun -s "p11sak remove-key --help" 7 + rlAssertGrep "Usage: p11sak remove-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG +fi + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd