From e5d68caa015cdfca95d9805db8d065fcddbce783 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 8 Feb 2021 10:28:17 +0100 Subject: [PATCH 01/86] fixed variable reference --- Library/token-manipulation/lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Library/token-manipulation/lib.sh b/Library/token-manipulation/lib.sh index d57f00c..ff3cc86 100644 --- a/Library/token-manipulation/lib.sh +++ b/Library/token-manipulation/lib.sh @@ -181,7 +181,7 @@ send "${SOPIN}\r" sleep .1 expect "label: " sleep .1 -send "{$LABEL}\r" +send "${LABEL}\r" sleep .1 expect eof {} \ "Incorrect PIN Entered." {exit 1} From 05a9bfc77db6eecf64651ec491dbc04ded03c7d3 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Wed, 21 Apr 2021 14:14:06 +0200 Subject: [PATCH 02/86] added test pkcsslotd-to-create-lock-and-log-directories --- .../main.fmf | 48 ++++++++ .../runtest.sh | 111 ++++++++++++++++++ 2 files changed, 159 insertions(+) create mode 100644 Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf create mode 100755 Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf new file mode 100644 index 0000000..1c15594 --- /dev/null +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf @@ -0,0 +1,48 @@ +summary: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories) +description: | + Bug summary: RHEL7.3 - patch to create lock and log directories from opencryptoki + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1343671 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +#- library(distribution/nvr) +- url: https://github.com/beakerlib/nvr.git + name: /nvr +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-ccatok +- opencryptoki-icsftok +- opencryptoki-icatok +- expect +- libselinux-utils +- policycoreutils +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- TIPpass_Security +- Tier1 +- Tier1security +- TierCandidatesPASS +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1343671 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373833 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697489 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0532369 +extra-summary: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories +extra-task: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh new file mode 100755 index 0000000..53bd9a5 --- /dev/null +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh @@ -0,0 +1,111 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories +# Description: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +USER="bz1343671user" + +TESTDIR=`pwd` + +LOCKDIR=/run/lock # see bz#1373833 +rlIsRHEL '<7' && LOCKDIR=/var/lock + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport nvr" || rlDie "cannot import nvr library" + rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library" + # need library path so we can import it as a test user + LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'` + echo "LIBPATH=$LIBPATH" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStop pkcsslotd + rlFileBackup --clean /var/lib/opencryptoki /var/log/opencryptoki $LOCKDIR/opencryptoki + # avoid using /var/lock symlink to properly test bug 1373833 + if [ "$LOCKDIR" == "/run/lock" ]; then + [ -L /var/lock ] && rlFileBackup /var/lock && rlRun "rm -f /var/lock" + fi + rlRun "useradd -m $USER -G pkcs11" + rlPhaseEnd + + rlPhaseStartTest "testing directory creation during pkcsslotd start" + rlRun "rm -rf /var/log/opencryptoki $LOCKDIR/opencryptoki" + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + rlAssertExists /var/log/opencryptoki + rlAssertExists $LOCKDIR/opencryptoki + rlRun "matchpathcon /var/log/opencryptoki" + rlRun "matchpathcon $LOCKDIR/opencryptoki" + rlRun "su $USER -c 'pkcsconf -t' &> query1.log" + cat query1.log + if nvrTestPackage opencryptoki '<' 3.14.0; then + rlAssertGrep "Model: IBM SoftTok" query1.log + else + rlAssertGrep "Model: Soft " query1.log + fi + rlPhaseEnd + + # initialize every token available + for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do + + rlPhaseStartTest "initialize token #$SLOT" + rlRun "su $USER -c 'source $LIBPATH && pkcsInitToken $SLOT'" + rlRun "su $USER -c 'pkcsconf -t -c $SLOT' &> query2.log" + cat query2.log + rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E + rlPhaseEnd + + done + + if [ "$LOCKDIR" == "/run/lock" ]; then + rlPhaseStartTest "checking there is no /var/lock in filelist" + rlRun "rpm -ql $(rpm -qa | grep opencryptoki | tr '\n' ' ') | grep /var/lock" 1 + rlPhaseEnd + fi + + rlPhaseStartTest "checking $LOCKDIR/opencryptoki selinux contexts" + rlRun -s "restorecon -Rnv $LOCKDIR/opencryptoki" + rlAssertNotGrep "restorecon reset" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlFileRestore + rlRun "pkcsRestoreTokens" + rlServiceRestore pkcsslotd + rlLog "Waiting 12 sec for systemd --user process to exit..." + sleep 12 + rlRun "userdel -r $USER" || ps -ef + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 1690aa2971f25571be1e22ad2aea43f51111fa6f Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Wed, 21 Apr 2021 14:35:36 +0200 Subject: [PATCH 03/86] added test pkcsslotd-to-create-lock-and-log-directories --- .../main.fmf | 48 ++++++++ .../runtest.sh | 111 ++++++++++++++++++ 2 files changed, 159 insertions(+) create mode 100644 Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf create mode 100755 Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf new file mode 100644 index 0000000..1c15594 --- /dev/null +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf @@ -0,0 +1,48 @@ +summary: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories) +description: | + Bug summary: RHEL7.3 - patch to create lock and log directories from opencryptoki + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1343671 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +#- library(distribution/nvr) +- url: https://github.com/beakerlib/nvr.git + name: /nvr +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-ccatok +- opencryptoki-icsftok +- opencryptoki-icatok +- expect +- libselinux-utils +- policycoreutils +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- TIPpass_Security +- Tier1 +- Tier1security +- TierCandidatesPASS +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1343671 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373833 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697489 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0532369 +extra-summary: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories +extra-task: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh new file mode 100755 index 0000000..53bd9a5 --- /dev/null +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh @@ -0,0 +1,111 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories +# Description: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +USER="bz1343671user" + +TESTDIR=`pwd` + +LOCKDIR=/run/lock # see bz#1373833 +rlIsRHEL '<7' && LOCKDIR=/var/lock + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport nvr" || rlDie "cannot import nvr library" + rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library" + # need library path so we can import it as a test user + LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'` + echo "LIBPATH=$LIBPATH" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStop pkcsslotd + rlFileBackup --clean /var/lib/opencryptoki /var/log/opencryptoki $LOCKDIR/opencryptoki + # avoid using /var/lock symlink to properly test bug 1373833 + if [ "$LOCKDIR" == "/run/lock" ]; then + [ -L /var/lock ] && rlFileBackup /var/lock && rlRun "rm -f /var/lock" + fi + rlRun "useradd -m $USER -G pkcs11" + rlPhaseEnd + + rlPhaseStartTest "testing directory creation during pkcsslotd start" + rlRun "rm -rf /var/log/opencryptoki $LOCKDIR/opencryptoki" + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + rlAssertExists /var/log/opencryptoki + rlAssertExists $LOCKDIR/opencryptoki + rlRun "matchpathcon /var/log/opencryptoki" + rlRun "matchpathcon $LOCKDIR/opencryptoki" + rlRun "su $USER -c 'pkcsconf -t' &> query1.log" + cat query1.log + if nvrTestPackage opencryptoki '<' 3.14.0; then + rlAssertGrep "Model: IBM SoftTok" query1.log + else + rlAssertGrep "Model: Soft " query1.log + fi + rlPhaseEnd + + # initialize every token available + for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do + + rlPhaseStartTest "initialize token #$SLOT" + rlRun "su $USER -c 'source $LIBPATH && pkcsInitToken $SLOT'" + rlRun "su $USER -c 'pkcsconf -t -c $SLOT' &> query2.log" + cat query2.log + rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E + rlPhaseEnd + + done + + if [ "$LOCKDIR" == "/run/lock" ]; then + rlPhaseStartTest "checking there is no /var/lock in filelist" + rlRun "rpm -ql $(rpm -qa | grep opencryptoki | tr '\n' ' ') | grep /var/lock" 1 + rlPhaseEnd + fi + + rlPhaseStartTest "checking $LOCKDIR/opencryptoki selinux contexts" + rlRun -s "restorecon -Rnv $LOCKDIR/opencryptoki" + rlAssertNotGrep "restorecon reset" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlFileRestore + rlRun "pkcsRestoreTokens" + rlServiceRestore pkcsslotd + rlLog "Waiting 12 sec for systemd --user process to exit..." + sleep 12 + rlRun "userdel -r $USER" || ps -ef + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From b5d4cc1f3df8921299d7ec9947f60377e94a39d7 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 22 Apr 2021 15:46:06 +0200 Subject: [PATCH 04/86] changed nvr library reference in main.fmf --- .../pkcsslotd-to-create-lock-and-log-directories/main.fmf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf index 1c15594..d5cc960 100644 --- a/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf @@ -8,9 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: -#- library(distribution/nvr) -- url: https://github.com/beakerlib/nvr.git - name: /nvr +- library(distribution/nvr) +#- url: https://github.com/beakerlib/nvr.git +# name: /nvr - url: https://src.fedoraproject.org/tests/opencryptoki.git name: /Library/token-manipulation recommend: From 414c9349b68691787d2c79092bb77a23e09ca861 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 23 Apr 2021 09:24:55 +0200 Subject: [PATCH 05/86] fix references to nvr library --- Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf | 4 +--- .../pkcsslotd-to-create-lock-and-log-directories/runtest.sh | 2 +- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf index d5cc960..13b45b4 100644 --- a/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf @@ -8,9 +8,7 @@ component: test: ./runtest.sh framework: beakerlib require: -- library(distribution/nvr) -#- url: https://github.com/beakerlib/nvr.git -# name: /nvr +- library(nvr/nvr) - url: https://src.fedoraproject.org/tests/opencryptoki.git name: /Library/token-manipulation recommend: diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh index 53bd9a5..1c77c05 100755 --- a/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh @@ -41,7 +41,7 @@ rlIsRHEL '<7' && LOCKDIR=/var/lock rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE - rlRun "rlImport nvr" || rlDie "cannot import nvr library" + rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library" # need library path so we can import it as a test user LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'` From beeea4a5732988f0e87b2c3e64e373beef38ff6f Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 23 Apr 2021 09:25:52 +0200 Subject: [PATCH 06/86] added test p11sak-key-management-tool-basic-functionality --- .../main.fmf | 38 +++++ .../runtest.sh | 141 ++++++++++++++++++ 2 files changed, 179 insertions(+) create mode 100644 Sanity/p11sak-key-management-tool-basic-functionality/main.fmf create mode 100755 Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf new file mode 100644 index 0000000..a2cdf1c --- /dev/null +++ b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf @@ -0,0 +1,38 @@ +summary: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool) +description: | + Bug summary: [IBM 8.3 FEAT] openCryptoki key management tool: list keys function + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +- library(nvr/nvr) +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- NoRHEL7 +- TIPfail_Security +- Tier1 +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851109 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0607944 +extra-summary: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality +extra-task: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh new file mode 100755 index 0000000..ca2919c --- /dev/null +++ b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh @@ -0,0 +1,141 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality +# Description: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +[ -n "$SLOT" ] || SLOT=sw + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t | grep 'Soft'" + SLOT=$( pkcsGetTokenSlot $SLOT ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + rlPhaseEnd + + rlPhaseStartTest "Test key generation and listing" + rlRun -s "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" + rlAssertGrep "Generate symmetric key AES with keylen=128 and label=\[aes_key\]" $rlRun_LOG + rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "AES 128 | aes_key" $rlRun_LOG + + rlRun -s "p11sak gen-key 3des --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" + rlAssertGrep "Generate symmetric key 3DES with keylen=192 and label=\[3des_key\]" $rlRun_LOG + rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "3DES | 3des_key" $rlRun_LOG + + rlRun -s "p11sak gen-key rsa 2048 --exponent 257 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" + rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG + rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG + rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "public RSA | rsa_key:pub" $rlRun_LOG + rlAssertGrep "private RSA | rsa_key:prv" $rlRun_LOG + + # The soft token does not support EC mechanisms right now. + rlRun -s "p11sak gen-key ec prime192 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" 112,64 + rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG + rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "Label: aes_key" $rlRun_LOG + rlAssertGrep "Label: 3des_key" $rlRun_LOG + rlAssertNotGrep "Label: rsa_key" $rlRun_LOG + + rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "Label: rsa_key:prv" $rlRun_LOG + rlAssertNotGrep "Label: rsa_key:pub" $rlRun_LOG + rlPhaseEnd + +if nvrTestPackage opencryptoki '>=' 3.15.0; then + rlPhaseStartTest "Test key removal" + rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + rlAssertGrep "Skip deleting Key. User input CKR_CANCEL" $rlRun_LOG + rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "aes_key" $rlRun_LOG + + rlRun -s "echo n | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + rlAssertGrep "Skip deleting Key" $rlRun_LOG + rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "aes_key" $rlRun_LOG + + rlRun -s "echo y | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + rlAssertGrep "Object with Label: aes_key found and destroyed" $rlRun_LOG + rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertNotGrep "aes_key" $rlRun_LOG + + rlRun -s "p11sak rm-key 3des --force --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" + rlAssertGrep "Object with Label: 3des_key found and destroyed" $rlRun_LOG + rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertNotGrep "3des_key" $rlRun_LOG + + rlRun -s "p11sak rm rsa --force --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key:pub" + rlAssertGrep "Object with Label: rsa_key:pub found and destroyed" $rlRun_LOG + rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertNotGrep "rsa_key:pub" $rlRun_LOG + rlPhaseEnd +fi + + rlPhaseStartTest "Test help printing" + rlRun -s "p11sak --help" + rlAssertGrep "Usage: p11sak COMMAND \[ARGS\] \[OPTIONS\]" $rlRun_LOG + + rlRun -s "p11sak generate-key --help" 7 + rlAssertGrep "Usage: p11sak generate-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG + + rlRun -s "p11sak list-key --help" 7 + rlAssertGrep "Usage: p11sak list-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG + + +if nvrTestPackage opencryptoki '>=' 3.15.0; then + rlRun -s "p11sak remove-key --help" 7 + rlAssertGrep "Usage: p11sak remove-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG +fi + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From a02b624cd0386c87ecf397fd0f9ffead66f913c3 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 23 Apr 2021 11:26:54 +0200 Subject: [PATCH 07/86] added test openCryptoki-PIN-conversion-tool --- .../openCryptoki-PIN-conversion-tool/main.fmf | 40 +++++++++ .../runtest.sh | 85 +++++++++++++++++++ 2 files changed, 125 insertions(+) create mode 100644 Sanity/openCryptoki-PIN-conversion-tool/main.fmf create mode 100755 Sanity/openCryptoki-PIN-conversion-tool/runtest.sh diff --git a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf new file mode 100644 index 0000000..ff14eaf --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf @@ -0,0 +1,40 @@ +summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) +description: | + Bug summary: [IBM 8.3 FEAT] openCryptoki: PIN conversion tool + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- openssl +- gnutls-utils +- opensc +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- NoRHEL7 +- Tier1 +- rhel9_broken +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1853420 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0607912 +extra-summary: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool +extra-task: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh new file mode 100755 index 0000000..5d73c0c --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh @@ -0,0 +1,85 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool +# Description: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t | grep 'Soft'" + SLOT=$( pkcsGetTokenSlot sw ) + rlRun "sed -i '/tokversion = 3.12/ d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present" + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:model=Soft;manufacturer=IBM' --label id_rsa.pub" + rlAssertExists id_rsa.pub + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlServiceStop pkcsslotd + sleep 5 + rlPhaseEnd + + rlPhaseStartTest "Token migration" + ps -ef + rlRun -s "echo y | pkcstok_migrate -s $SLOT -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" + rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG + grep -A 4 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf + rlRun "grep -A 4 -i 'slot $SLOT' /etc/opencryptoki/opencryptoki.conf | grep 'tokversion = 3.12'" 0 "Verify that slot configuration has been updated with 'tokversion = 3.12'" + rlServiceStart pkcsslotd + sleep 1 + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" 0 "Verify I still can list imported RSA key" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlLog "Exporting stored RSA key" + rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der --slot 0x$SLOT" + rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" + rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 30eace59649c2f6c52e8b5b24454f15417cc0e6b Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 23 Apr 2021 11:48:51 +0200 Subject: [PATCH 08/86] added test tools-should-inform-user-about-pkcs11-group --- .../main.fmf | 31 ++++++++++ .../runtest.sh | 57 +++++++++++++++++++ 2 files changed, 88 insertions(+) create mode 100644 Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf create mode 100755 Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh diff --git a/Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf b/Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf new file mode 100644 index 0000000..17939f1 --- /dev/null +++ b/Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf @@ -0,0 +1,31 @@ +summary: tools should inform user about pkcs11 group +description: | + Bug summary: RFE opencryptoki tools should inform the user that he is not in pkcs11 group + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1063763 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +duration: 5m +enabled: true +tag: +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- TIPpass_Security +- Tier2 +- Tier2security +tier: '2' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1063763 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697494 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0598649 +extra-summary: /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that +extra-task: /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that diff --git a/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh b/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh new file mode 100755 index 0000000..7d90bf3 --- /dev/null +++ b/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh @@ -0,0 +1,57 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that +# Description: Test for BZ#1063763 (RFE opencryptoki tools should inform the user that) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlServiceStart pkcsslotd + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "useradd -m bz1063763user" + rlPhaseEnd + + rlPhaseStartTest + rlRun -s "su - bz1063763user -c 'pkcsconf -t'" 144 + rlAssertGrep "Error initializing the PKCS11 library" $rlRun_LOG + rlAssertGrep "Note: all non-root users that require access to PKCS#11 tokens using opencryptoki must be assigned to the pkcs11 group to be able to communicate with the pkcsslotd daemon." $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlLog "Waiting 12 sec for systemd --user process to exit..." && sleep 12 + rlRun "userdel -r bz1063763user" 0 + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlServiceRestore pkcsslotd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From d6f766d1cb91c62dffe015099b182e67e2eec2fc Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 23 Apr 2021 14:41:57 +0200 Subject: [PATCH 09/86] added upstream testsuite wrapper --- Sanity/testsuite/main.fmf | 39 +++++++ Sanity/testsuite/runtest.sh | 202 ++++++++++++++++++++++++++++++++++++ 2 files changed, 241 insertions(+) create mode 100644 Sanity/testsuite/main.fmf create mode 100755 Sanity/testsuite/runtest.sh diff --git a/Sanity/testsuite/main.fmf b/Sanity/testsuite/main.fmf new file mode 100644 index 0000000..bcf8372 --- /dev/null +++ b/Sanity/testsuite/main.fmf @@ -0,0 +1,39 @@ +summary: Executes testsuite shipped with opencryptoki +description: | + it seems it should work with softoken on all architectures +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- openCryptoki +- opencryptoki +- gcc +- yum-utils +- rpm-build +- opencryptoki-swtok +- opencryptoki-ccatok +- opencryptoki-icatok +duration: 100m +enabled: true +tag: +- TIPfail_Security +- noExpectedness +# test duration is big for tiers +- notier +- rhel8-buildroot +- rhel9-buildroot +- rhel9_broken +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=644284 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1099175 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=904937 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=650482 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1099193 +extra-nitrate: TC#0063178 +extra-summary: /CoreOS/openCryptoki/Sanity/testsuite +extra-task: /CoreOS/openCryptoki/Sanity/testsuite diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh new file mode 100755 index 0000000..7de0a19 --- /dev/null +++ b/Sanity/testsuite/runtest.sh @@ -0,0 +1,202 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Sanity/testsuite +# Description: Executes testsuite shipped with openCryptoki +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +# At the moment of creation of this test a lot of upstream tests +# were not fully functional. Please check README documents and +# try enable additional tests if possible +# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +# find out package name +PACKAGE="opencryptoki" + +LOGDIR=`mktemp -d` + + +function reset_tokens() { + rlLogInfo "Reseting tokens..." + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + rlLogInfo "Initializing tokens..." + rlRun "pkcsInitToken $SLOT" +} + +function get_test_id() { + ID=`cat $TmpDir/testid` + ID=$(( $ID+1 )) + echo $ID > $TmpDir/testid + echo $ID +} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + export PKCS11_USER_PIN=$pkcsUSER_PIN + export PKCS11_SO_PIN=$pkcsSO_PIN + rlAssertRpm $PACKAGE + rlAssertRpm "openssl-devel" + TmpDir=`mktemp -d` + pushd $TmpDir + rlFetchSrcForInstalled $PACKAGE + rlRun "rpm -ivh $PACKAGE*.src.rpm" 0 "Installing $PACKAGE src rpm" + rlRun "yum-builddep -y ~/rpmbuild/SPECS/opencryptoki.spec" + # opencryptoki needs to enable building test cases during the pkg build + rlRun "sed -i 's/^%configure /%configure --enable-testcases /' ~/rpmbuild/SPECS/opencryptoki.spec" + rlRun "rpmbuild -bc ~/rpmbuild/SPECS/opencryptoki.spec &> build.log" 0 "Building opencryptoki files" + tail build.log + TESTDIR=`ls -d ~/rpmbuild/BUILD/opencryptoki*/testcases` + + rlServiceStart pkcsslotd + rlLogInfo "Available tokens" + pkcsconf -t + # allow to pass SLOT number as a parameter + # or take the first available slot (Token) + [ -z "$SLOT" ] && SLOT=`pkcsconf -t | sed -n 's/^Token #\([0-9]\).*/\1/gp' | head -n 1` + rlLogInfo "Token under a test" + pkcsconf -t -c $SLOT + + NOSKIP="" + # !!!!!!!!!!!!!!!!!!!!!!! + # tests doings writes are not skipped only for a softoken because they could descrease flash memory + # lifetime on real tokens + pkcsconf -t -c $SLOT | grep -qi 'soft' && NOSKIP="-noskip" + rlPhaseEnd + + echo 0 > $TmpDir/testid + + rlPhaseStartTest "crypto" + reset_tokens + if [ -d $TESTDIR/crypto ]; then + export PKCS11_USER_PIN=01234567 + export PKCS11_SO_PIN=76543210 + pushd $TESTDIR/crypto + for TEST in *_tests; do + # skip test if it is on TODO list in README + if grep -A 1 $TEST README | grep -q TODO; then + rlLogWarning "Skipping $TEST since it is on TODO list in README" + else + ID=`get_test_id` + rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" + RESULT=$? + grep Total $TmpDir/testlog.$ID + rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID + rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID + # print log in case of error + [ $RESULT -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID + fi + done + popd + else + rlFail "No crypto tests available!" + fi + rlPhaseEnd + + rlPhaseStartTest "misc_tests" + if [ -d $TESTDIR/misc_tests ]; then + reset_tokens + pushd $TESTDIR/misc_tests + + # obj_mgmt_tests + ID=`get_test_id` + rlRun "./obj_mgmt_tests $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + + #spinlock_tests.sh + ID=`get_test_id` + rlRun "./spinlock_tests.sh -s 1 -p 10 -l 20 &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + + #fork + ID=`get_test_id` + rlRun "./fork -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + + popd + else + rlFail "No misc_tests test available!" + fi + rlPhaseEnd + + rlPhaseStartTest "pkcs11" + if [ -d $TESTDIR/pkcs11 ]; then + reset_tokens + pushd $TESTDIR/pkcs11 + for TEST in get_interface attribute copyobjects findobjects generate_keypair; do + ID=`get_test_id` + rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" + RESULT=$? + grep Total $TmpDir/testlog.$ID + rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID + rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID + # print log in case of error + [ $RESULT -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID + done + + # now run additiona tests with specific + #sess_opstate + ID=`get_test_id` + rlRun "./sess_opstate -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep "TESTCASE sess_opstate_funcs PASS" $TmpDir/testlog.$ID + + #getobjectsize + ID=`get_test_id` + rlRun "./getobjectsize -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep "C_GetObjectSize test passed" $TmpDir/testlog.$ID + + #hw_fn + ID=`get_test_id` + rlRun "./hw_fn -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep "Hardware Feature tests succeeded." $TmpDir/testlog.$ID + + popd + + else + rlFail "No pkcs11_tests test available!" + fi + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlBundleLogs testlogs $TmpDir/testlog* build.log + #rlRun "rpmbuild --clean -bp ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Clean the BUILD root" + rlRun "rm -rf $TmpDir" + [ -d $TESTDIR ] && rlRun "rm -rf $TESTDIR" + rlFileRestore + rlRun "pkcsRestoreTokens" + rlServiceRestore pkcsslotd + rlPhaseEnd + +rlJournalPrintText +rlJournalEnd From eebcf4b03a4e7ceb3a4e9d06b028be55e227a377 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 23 Apr 2021 15:42:20 +0200 Subject: [PATCH 10/86] remove openssl-devel version check --- Sanity/testsuite/runtest.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh index 7de0a19..8dcd34d 100755 --- a/Sanity/testsuite/runtest.sh +++ b/Sanity/testsuite/runtest.sh @@ -63,7 +63,6 @@ rlJournalStart export PKCS11_USER_PIN=$pkcsUSER_PIN export PKCS11_SO_PIN=$pkcsSO_PIN rlAssertRpm $PACKAGE - rlAssertRpm "openssl-devel" TmpDir=`mktemp -d` pushd $TmpDir rlFetchSrcForInstalled $PACKAGE From 6c765253ebe664c825dd5dab745a29e3a3f3eeb5 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 27 Apr 2021 13:53:57 +0200 Subject: [PATCH 11/86] added test bz415971-pkcsconf-validation-of-PIN-is-wrong --- .../main.fmf | 26 ++++++++ .../pkcsconf.exp | 46 +++++++++++++ .../runtest.sh | 65 +++++++++++++++++++ 3 files changed, 137 insertions(+) create mode 100644 Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf create mode 100755 Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp create mode 100755 Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf new file mode 100644 index 0000000..5ad3734 --- /dev/null +++ b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf @@ -0,0 +1,26 @@ +summary: Tests if validation PIN is actually checked for correctness +description: '' +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-libs +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- TIPpass_Security +- Tier2 +- Tier2security +- TierCandidatesPASS +tier: '2' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=415971 +extra-nitrate: TC#0067826 +extra-summary: /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong +extra-task: /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp new file mode 100755 index 0000000..1752178 --- /dev/null +++ b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp @@ -0,0 +1,46 @@ +#!/usr/bin/expect +set cmd [lrange $argv 0 0] + +log_user 1 +spawn $cmd -I -c 0 +expect "Enter the SO PIN: " +sleep .1 +send "87654321\r" +sleep .1 +expect "label: " +sleep .1 +send "cryptotest\r" +sleep .1 +expect eof + +spawn $cmd -u -c 0 +expect "Enter the SO PIN: " +sleep .1 +send "87654321\r" +sleep .1 +expect "Enter the new user PIN: " +sleep .1 +send "test\r" +sleep .1 +expect "Re-enter the new user PIN: " +sleep .1 +send "test\r" +sleep .1 +expect eof + +spawn $cmd -p -c 0 +expect "Enter user PIN: " +sleep .1 +send "test\r" +sleep .1 +expect "Enter the new user PIN: " +sleep .1 +send "text\r" +sleep .1 +expect "Re-enter the new user PIN: " +sleep .1 +send "text1\r" +sleep .1 +expect eof + + diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh new file mode 100755 index 0000000..e26f26f --- /dev/null +++ b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh @@ -0,0 +1,65 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong +# Description: Tests if validation PIN is actually checked for correctness +# Author: Miroslav Vadkerti +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +PKCSCONF="pkcsconf" + +TMP=`mktemp` + +function reset_tokens() { + rlLogInfo "Reseting tokens..." + rlServiceStop pkcsslotd + rlRun "find /var/lib/opencryptoki/ -type f -exec rm {} \\;" + rlServiceStart pkcsslotd + rlLogInfo "--- reset finished ---" +} + + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlFileBackup --clean /var/lib/opencryptoki + [ -d /etc/opencryptoki ] && rlFileBackup --clean /etc/opencryptoki + reset_tokens + rlPhaseEnd + + rlPhaseStartTest + rlRun "./pkcsconf.exp $PKCSCONF 2>&1 | tee $TMP" + rlAssertGrep "New PINs do not match." $TMP + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf $TMP" + rlFileRestore + rlServiceRestore pkcsslotd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 514ae8c3a0fcfd0bd1363c26f46f273bddf4d644 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 27 Apr 2021 14:28:27 +0200 Subject: [PATCH 12/86] added test bz612274-Opencryptoki-session-object-performance-degradation --- .../main.fmf | 38 ++++++++ .../runtest.sh | 88 +++++++++++++++++++ 2 files changed, 126 insertions(+) create mode 100644 Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf create mode 100755 Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf new file mode 100644 index 0000000..d195647 --- /dev/null +++ b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf @@ -0,0 +1,38 @@ +summary: Tests if overall performance of cryptographic operations degrades exponentially + with the number of objects per token or open sessions per process +description: | + Test Case Relevancy: + arch = ia64: False +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-swtok +- gcc +- automake +- libtool +- openssl-devel +- expect +- trousers-devel +- yum-utils +- bzip2 +- rpm-build +- libica-devel +duration: 20m +enabled: true +tag: +- TIPpass_Security +- Tier3 +- Tier3security +- rhel8-buildroot +- rhel9-buildroot +tier: '3' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=612274 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=627560 +extra-nitrate: TC#0075518 +extra-summary: /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation +extra-task: /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh new file mode 100755 index 0000000..b34ab63 --- /dev/null +++ b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation +# Description: Tests if overall performance of cryptographic operations degrades exponentially with the number of objects per token or open sessions per process +# Author: Miroslav Vadkerti +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +PACKAGES="gcc automake libtool openssl-devel expect trousers-devel" +TMPDIR=`mktemp -d` +TMP=`mktemp` +SRC="src.tbz" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + for PKG in $PACKAGES; do + rlAssertRpm $PKG + done + PKGVER=`rpm -q --qf '%{VERSION}' opencryptoki` + rlServiceStart "pkcsslotd" + # use always software slot + # SLOT=$(($(pkcsconf -s | grep -B1 Soft | grep -o '#[0-9]' | tr -d '#')-1)) + SLOT=$(pkcsconf -s | egrep -B1 '(Soft|Linux)' | grep -o '#[0-9]' | tr -d '#') + rlLog "Using slot $SLOT" + rlRun "pushd ." + rlRun "cd $TMPDIR" + rlFetchSrcForInstalled opencryptoki + rlRun "yum-builddep -y opencryptoki*src.rpm" + rlRun "rpm -i opencryptoki*src.rpm" + + # opencryptoki version >= 3.11.0 needs to enable building test cases during the pkg build + rlRun "sed -i 's/^%configure /%configure --enable-testcases /' ~/rpmbuild/SPECS/opencryptoki.spec" + rlRun "rpmbuild -bp ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Preparing builddir" + TESTDIR=`ls -d ~/rpmbuild/BUILD/opencryptoki*/testcases` + rlRun "pushd . && cd $TESTDIR" + rlRun "sed -i 's/50000/10000/g' pkcs11/sess_perf.c" 0 "Adjusting testcase" + rlRun "rpmbuild -bc --short-circuit ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Building opencryptoki files" + popd + rlPhaseEnd + + rlPhaseStartTest + cd $TESTDIR + if [ -d driver ]; then + rlRun "cd driver" + rlRun "./sess_perf_tests -slot $SLOT | tee $TMP" + else + rlRun "cd pkcs11" + rlRun "./sess_bench -slot $SLOT | tee $TMP" + fi + rlRun "cat $TMP | grep CKR" 1 "Checking for errors" + # Count the number occurrences when performance test time exceeds >10ms + # In buggy version this will happen a lot and the performance will degrade. + # The count (3) currently tested may need more adjustment. + COUNT=$(cat $TMP | grep Time | egrep -c '[0-9][0-9]+') + rlAssertGreater "Checking performance" 3 $COUNT + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -rf $TMPDIR $TMP" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 4d7d21067e74f89ad5119c55216c25af7b0dd1f9 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 27 Apr 2021 15:04:29 +0200 Subject: [PATCH 13/86] added test bz1154647-opencryptoki-libs-should-Requires-pre/ --- .../main.fmf | 24 +++++++++ .../runtest.sh | 54 +++++++++++++++++++ 2 files changed, 78 insertions(+) create mode 100644 Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf create mode 100755 Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh diff --git a/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf new file mode 100644 index 0000000..2ca6f1d --- /dev/null +++ b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf @@ -0,0 +1,24 @@ +summary: Test for BZ#1154647 (opencryptoki-libs should Requires(pre)) +description: | + Bug summary: opencryptoki-libs should Requires(pre) shadow-utils + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1154647 +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-libs +duration: 3m +enabled: true +tag: +- TIPpass_Security +- Tier3 +- Tier3security +tier: '3' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1154647 +extra-nitrate: TC#0430383 +extra-summary: /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre +extra-task: /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre diff --git a/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh new file mode 100755 index 0000000..c919416 --- /dev/null +++ b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre +# Description: Test for BZ#1154647 (opencryptoki-libs should Requires(pre)) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlPhaseEnd + + rlPhaseStartTest + if rpm -q --scripts opencryptoki-libs | grep groupadd; then + rlPass "Just check that opencryptoki-libs are calling groupadd" + rlRun -s "rpm -qv --requires opencryptoki-libs" + rlAssertGrep 'pre: shadow-utils' $rlRun_LOG + rm $rlRun_LOG + else + rlLogInfo "This test is not relevant for opencryptoki-libs which does not call grupadd in scripts" + fi + + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From faa4ac7a0f5b4e6da12f3a41a6d287b8fd2a4e7b Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 27 Apr 2021 15:34:42 +0200 Subject: [PATCH 14/86] fixed typo in Library/token-manipulation/lib.sh --- Library/token-manipulation/lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Library/token-manipulation/lib.sh b/Library/token-manipulation/lib.sh index d57f00c..ff3cc86 100644 --- a/Library/token-manipulation/lib.sh +++ b/Library/token-manipulation/lib.sh @@ -181,7 +181,7 @@ send "${SOPIN}\r" sleep .1 expect "label: " sleep .1 -send "{$LABEL}\r" +send "${LABEL}\r" sleep .1 expect eof {} \ "Incorrect PIN Entered." {exit 1} From 19543a73ab89d384c9047d21c7c4365744072265 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 27 Apr 2021 15:38:12 +0200 Subject: [PATCH 15/86] added test sign-opencryptoki-certificate-for-NSS --- .../main.fmf | 32 ++++ .../runtest.sh | 149 ++++++++++++++++++ 2 files changed, 181 insertions(+) create mode 100644 Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf create mode 100755 Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh diff --git a/Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf b/Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf new file mode 100644 index 0000000..96dd4b1 --- /dev/null +++ b/Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf @@ -0,0 +1,32 @@ +summary: Tests if signing certificate via opencryptoki module in NSS works +description: +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +require: +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- expect +- nss-tools +- rng-utils +duration: 20m +enabled: true +tag: +- CI-Tier-1 +- TIPpass_Security +- Tier2 +- Tier2security +tier: '2' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=654088 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1056036 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1059176 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600434 +extra-nitrate: TC#0102977 +extra-summary: /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS +extra-task: /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS diff --git a/Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh b/Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh new file mode 100755 index 0000000..b2c57a2 --- /dev/null +++ b/Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh @@ -0,0 +1,149 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS +# Description: Tests if signing certificate via opencryptoki module in NSS works +# Author: Miroslav Vadkerti +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +PASS="redhat" +PASSTOKEN="01234567" +PASSTOKEN2="87654321" +SERVICE="pkcsslotd" +[ -n "$SLOT" ] || SLOT=sw +NSSDB_D="nssdb" +PASSWORD_F="${NSSDB_D}/nsspassword" +NSSDB_PREFIX="sql:" +rlIsRHEL 3 4 5 && NSSDB_PREFIX="" +M=0 +CACERT_NAME="cacert" +USERCERT_NAME="mycert" +USERCERT_REQ_F="${USERCERT_NAME}.req" +USERCERT_DER_F="${USERCERT_NAME}.der" +USERCERT_PEM_F="${USERCERT_NAME}.pem" +LOG_F="${PACKAGE}.log" +CONF_F="/usr/share/p11-kit/modules/opencryptoki.module" +LIB_F=$( rpm -ql opencryptoki-libs | grep pkcs11/libopencryptoki.so | head -1 ) + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlAssertRpm $PACKAGE + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop $SERVICE + rlRun "pkcsResetTokens" + rlServiceStart $SERVICE + sleep 1 + rlRun "pkcsconf -t" + SLOT=$( pkcsGetTokenSlot $SLOT ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + # prepar entropy generator + pidof rngd || ENTROPY=true + $ENTROPY && rngd -r /dev/urandom + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "mkdir -p ${NSSDB_D}" 0 + rlRun "echo '${PASS}' > ${PASSWORD_F}" 0 + rlRun "certutil -N -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F}" + M=`expr ${M} + 1` + rlRun "while [ 1 -eq 1 ]; do dd if=/dev/urandom bs=1 count=1; echo; sleep 0.0${RANDOM}; done 2>/dev/null | certutil -S -n ${CACERT_NAME} -s 'cn=CAcert' -x -t 'C,C,C' -m ${M} -v 120 -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F}" 0 "Generating CA certificate" + rlRun "certutil -L -d ${NSSDB_PREFIX}${NSSDB_D}" 0 "Certificate listing" + rlPhaseEnd + + rlPhaseStartTest + rlLog "Adding opencryptoki as an external module to opencryptoki" + + if rlIsRHEL '<8'; then + if [ -r /usr/lib64/opencryptoki/PKCS11_API.so ]; then + rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -nocertdb -add opencryptoki -libfile /usr/lib64/opencryptoki/PKCS11_API.so" + else + rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -nocertdb -add opencryptoki -libfile /usr/lib/opencryptoki/PKCS11_API.so" + fi + rlLog "Setting opencryptoki as the default module for all mechanisms" + rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -default opencryptoki -mechanisms RSA:DSA:DH:RC2:RC4:RC5:AES:CAMELLIA:DES:MD2:MD5:SHA1:SHA256:SHA512:SSL:TLS:RANDOM" + rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -list" + export TOKPARAM="" + export PINPARAM="" + else + [ -f $CONF_F ] && rlFileBackup $CONF_F; + echo $LIB_F + rlRun "cat > $CONF_F < pin + export TOKPARAM="-h softtok" + export PINPARAM="-f pin" + fi + + rlRun "while [ 1 -eq 1 ]; do dd if=/dev/urandom bs=1 count=1; echo; sleep 0.0${RANDOM}; done 2>/dev/null | certutil -f ${PASSWORD_F} -R -s 'CN=John Smith, O=Netscape, L=Mountain View, ST=California, C=US' -p '650-555-8888' -o ${USERCERT_REQ_F} -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F} ${TOKPARAM} ${PINPARAM}" 0 "Generating user certificate" + rlAssertExists "${USERCERT_REQ_F}" + M=`expr ${M} + 1` + expect -c " +spawn certutil -C -m ${M} -i ${USERCERT_REQ_F} -o ${USERCERT_PEM_F} -c ${CACERT_NAME} -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F} ${TOKPARAM} +expect {L13} {send -- $PASSTOKEN\r} +expect { + {L13} {send -- \"$PASTOKEN2\r\"; exp_continue} + eof { exit 0 } +} +" + rlAssertExists "${USERCERT_PEM_F}" + [ "x$(stat -c '%s' ${USERCERT_PEM_F})" = "x0" ] && rlFail "${USERCERT_PEM_F} is empty" || rlPass "${USERCERT_DER_F} create OK" + M=`expr ${M} + 1` + expect -c " +spawn certutil -C -d ${NSSDB_PREFIX}${NSSDB_D} -c ${CACERT_NAME} -i ${USERCERT_REQ_F} -o ${USERCERT_DER_F} -m ${M} -v 48 -1 -f ${PASSWORD_F} -5 ${TOKPARAM} +expect {L13} {send -- $PASSTOKEN\r} +expect { + {L13} {send -- \"$PASSTOKEN2\"\r; exp_continue} + {>} {send -- 01234567\r} +} +expect {y/N} {send -- N\r} +expect {>} {send -- 01234567\r} +expect {y/N} {send -- N\r} +expect eof +" + rlAssertExists "${USERCERT_DER_F}" + [ "x$(stat -c '%s' ${USERCERT_DER_F})" = "x0" ] && rlFail "${USERCERT_DER_F} is empty" || rlPass "${USERCERT_DER_F} create OK" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $CONF_F" + rlServiceStop $SERVICE + rlRun "pkcsRestoreTokens" + rlFileRestore + $ENTROPY && killall rngd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlServiceRestore $SERVICE + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From c0311ac0090080e1e2df2171b8ef2c267fe8e3a6 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 27 Apr 2021 15:59:51 +0200 Subject: [PATCH 16/86] added test bz732756-do-not-add-root-to-pkcs11-group --- .../main.fmf | 28 +++++++++ .../runtest.sh | 58 +++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100644 Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf create mode 100755 Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh diff --git a/Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf b/Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf new file mode 100644 index 0000000..40b6ccc --- /dev/null +++ b/Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf @@ -0,0 +1,28 @@ +summary: Checks if root is not added to the pkcs11 group +description: +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: +- TIPpass_Security +- Tier3 +- Tier3security +tier: '3' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=732756 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=833828 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1054442 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1013017 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=833818 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1058814 +extra-nitrate: TC#0111303 +extra-summary: /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group +extra-task: /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group diff --git a/Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh b/Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh new file mode 100755 index 0000000..a339076 --- /dev/null +++ b/Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh @@ -0,0 +1,58 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group +# Description: Checks if root is not added to the pkcs11 group and opencryptoki works well in this case +# Author: Miroslav Vadkerti +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +ROOT=$(mktemp -d) + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + if rlIsFedora '>=22'; then + # dnf is not able to use system relesever when changing installroot (#1173107) + RELEASEVER=$(. /etc/os-release; echo $VERSION_ID) + rlRun -s "dnf -y install --nogpg --releasever=$RELEASEVER --installroot=$ROOT opencryptoki opencryptoki-swtok 2>&1" + rlAssertNotGrep "group pkcs11 does not exist" $rlRun_LOG + else + rlRun -s "yum -y install --nogpg --installroot=$ROOT opencryptoki opencryptoki-swtok 2>&1" + rlAssertNotGrep "group pkcs11 does not exist" $rlRun_LOG + fi + rlPhaseEnd + + rlPhaseStartTest "pkcs11 group should exist but root should not be a member" + rlAssertGrep "^pkcs11" "$ROOT/etc/group" -E + rlAssertNotGrep "^pkcs11.*root" "$ROOT/etc/group" -E + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf $ROOT" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 92d624d02f281558cd82914b58d003b76cbc344f Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 27 Apr 2021 16:05:13 +0200 Subject: [PATCH 17/86] added lock-files-are-persistent-across-system-reboot --- .../main.fmf | 28 ++++++++ .../runtest.sh | 70 +++++++++++++++++++ 2 files changed, 98 insertions(+) create mode 100644 Sanity/lock-files-are-persistent-across-system-reboot/main.fmf create mode 100755 Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh diff --git a/Sanity/lock-files-are-persistent-across-system-reboot/main.fmf b/Sanity/lock-files-are-persistent-across-system-reboot/main.fmf new file mode 100644 index 0000000..e957fbb --- /dev/null +++ b/Sanity/lock-files-are-persistent-across-system-reboot/main.fmf @@ -0,0 +1,28 @@ +summary: Test for BZ#1054442 (lock files are not persistent after system reboot) +description: | + Bug summary: lock files are not persistent after system reboot even though the lock files are entered in tmpfiles.d (opencryptoki) + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1054442 +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-icsftok +- opencryptoki-icatok +- opencryptoki-ccatok +duration: 15m +enabled: true +tag: +- TIPpass_FIPS +- TIPpass_Security +- TierCandidatesPASS +- notier +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1054442 +extra-nitrate: TC#0336748 +extra-summary: /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot +extra-task: /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot diff --git a/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh b/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh new file mode 100755 index 0000000..1b1fafa --- /dev/null +++ b/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh @@ -0,0 +1,70 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot +# Description: Test for BZ#1054442 (lock files are not persistent after system reboot) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStart pkcsslotd + rlPhaseEnd + + rlPhaseStartTest + if arch | grep s390; then + SUBDIRS="ccatok icsf lite swtok" + else + SUBDIRS="icsf swtok" + fi + rlIsRHEL '<=8' && SUBDIRS="$SUBDIRS tpm" + for DIR in $SUBDIRS; do + rlAssertExists /var/lib/opencryptoki/$DIR + done + for DIR in $SUBDIRS; do + rlAssertExists /var/lock/opencryptoki/$DIR + done + rlAssertExists /var/lock/opencryptoki/LCK..APIlock + if [ ! -f /bz1054442-rebooted ]; then + touch /bz1054442-rebooted + rlRun "/usr/bin/rhts-reboot" + else + rlRun "rm /bz1054442-rebooted" + fi + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From bda76c92832d5c51dafb4a6b77c0f8a1149d0258 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 30 Apr 2021 11:23:34 +0200 Subject: [PATCH 18/86] debug: print pkcsslotd status prior token conversion --- Sanity/openCryptoki-PIN-conversion-tool/runtest.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh index 5d73c0c..3a3c441 100755 --- a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh +++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh @@ -57,6 +57,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "Token migration" + systemctl status pkcsslotd ps -ef rlRun -s "echo y | pkcstok_migrate -s $SLOT -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG From f2c46bdcd261a1361acd1cfcecfc7ac99a7e6c3b Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 17 May 2021 10:38:49 +0200 Subject: [PATCH 19/86] update test dependencies in main.fmf --- Sanity/testsuite/main.fmf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Sanity/testsuite/main.fmf b/Sanity/testsuite/main.fmf index bcf8372..657c1fd 100644 --- a/Sanity/testsuite/main.fmf +++ b/Sanity/testsuite/main.fmf @@ -3,14 +3,13 @@ description: | it seems it should work with softoken on all architectures contact: Karel Srot component: -- openCryptoki +- opencryptoki test: ./runtest.sh framework: beakerlib require: - url: https://src.fedoraproject.org/tests/opencryptoki.git name: /Library/token-manipulation recommend: -- openCryptoki - opencryptoki - gcc - yum-utils From bba0627c832cd4d5ab1643aaad44303bd638e8d7 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Wed, 19 May 2021 13:27:03 +0200 Subject: [PATCH 20/86] remove tag rhel9_broken --- Sanity/testsuite/main.fmf | 1 - 1 file changed, 1 deletion(-) diff --git a/Sanity/testsuite/main.fmf b/Sanity/testsuite/main.fmf index 657c1fd..37563bb 100644 --- a/Sanity/testsuite/main.fmf +++ b/Sanity/testsuite/main.fmf @@ -26,7 +26,6 @@ tag: - notier - rhel8-buildroot - rhel9-buildroot -- rhel9_broken link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=644284 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1099175 From 19dcfb923b986ad56e31e38394ca842216ce98d4 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 24 May 2021 16:25:02 +0200 Subject: [PATCH 21/86] run ./events in misc_tests due to bug 1924120 --- Sanity/testsuite/main.fmf | 1 + Sanity/testsuite/runtest.sh | 12 ++++++++++++ 2 files changed, 13 insertions(+) diff --git a/Sanity/testsuite/main.fmf b/Sanity/testsuite/main.fmf index 37563bb..c306132 100644 --- a/Sanity/testsuite/main.fmf +++ b/Sanity/testsuite/main.fmf @@ -9,6 +9,7 @@ framework: beakerlib require: - url: https://src.fedoraproject.org/tests/opencryptoki.git name: /Library/token-manipulation +- library(nvr/nvr) recommend: - opencryptoki - gcc diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh index 8dcd34d..0d54a15 100755 --- a/Sanity/testsuite/runtest.sh +++ b/Sanity/testsuite/runtest.sh @@ -60,6 +60,7 @@ function get_test_id() { rlJournalStart rlPhaseStartSetup rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library" export PKCS11_USER_PIN=$pkcsUSER_PIN export PKCS11_SO_PIN=$pkcsSO_PIN rlAssertRpm $PACKAGE @@ -138,6 +139,17 @@ rlJournalStart ID=`get_test_id` rlRun "./fork -slot $SLOT &> $TmpDir/testlog.$ID" [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID + rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID + + # events - added in 3.16.0-3.el9 + if nvrTestPackage opencryptoki '>=' 3.16.0; then + ID=`get_test_id` + rlRun "./events -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID + rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID + fi popd else From 8977420bc758588fd8e43a43b27d64a96e2edcb6 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 25 May 2021 09:25:58 +0200 Subject: [PATCH 22/86] added reference to bug 1964304 --- Sanity/openCryptoki-PIN-conversion-tool/main.fmf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf index ff14eaf..2ecedbf 100644 --- a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf +++ b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf @@ -26,11 +26,11 @@ tag: - NoRHEL6 - NoRHEL7 - Tier1 -- rhel9_broken tier: '1' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1853420 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1964304 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 From 81ec9854f3871176df16efcb65bc9a453afd53f2 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 18 Jun 2021 15:23:07 +0200 Subject: [PATCH 23/86] fix gen-key parameters --- .../runtest.sh | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh index ca2919c..e0344f4 100755 --- a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh +++ b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh @@ -63,15 +63,14 @@ rlJournalStart rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep "3DES | 3des_key" $rlRun_LOG - rlRun -s "p11sak gen-key rsa 2048 --exponent 257 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" + rlRun -s "p11sak gen-key rsa 2048 --exponent 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep "public RSA | rsa_key:pub" $rlRun_LOG rlAssertGrep "private RSA | rsa_key:prv" $rlRun_LOG - # The soft token does not support EC mechanisms right now. - rlRun -s "p11sak gen-key ec prime192 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" 112,64 + rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep "Label: aes_key" $rlRun_LOG From 5631730f71e31474c305446581f2b96be02dad53 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 21 Jun 2021 11:07:06 +0200 Subject: [PATCH 24/86] added --no-pager option to systemctl status cmd --- Sanity/openCryptoki-PIN-conversion-tool/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh index 3a3c441..e42b49a 100755 --- a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh +++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh @@ -57,7 +57,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "Token migration" - systemctl status pkcsslotd + systemctl status pkcsslotd --no-pager ps -ef rlRun -s "echo y | pkcstok_migrate -s $SLOT -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG From 3f4267eb65fcccd6c3d2877cbe0ed6b2c08d2e06 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 22 Jun 2021 11:24:57 +0200 Subject: [PATCH 25/86] run crypto/ab_tests separately --- Sanity/testsuite/runtest.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh index 0d54a15..b67041d 100755 --- a/Sanity/testsuite/runtest.sh +++ b/Sanity/testsuite/runtest.sh @@ -99,10 +99,17 @@ rlJournalStart export PKCS11_USER_PIN=01234567 export PKCS11_SO_PIN=76543210 pushd $TESTDIR/crypto + + RUN_SEPARATELY="ab_tests" # do not report results the usual way + for TEST in *_tests; do # skip test if it is on TODO list in README if grep -A 1 $TEST README | grep -q TODO; then rlLogWarning "Skipping $TEST since it is on TODO list in README" + elif echo $RUN_SEPARATELY | grep -q $TEST; then + ID=`get_test_id` + rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error else ID=`get_test_id` rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" From d9cd09afe3b8b4cb6391f3c3c55e0db533d0a6f1 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 22 Jun 2021 15:57:25 +0200 Subject: [PATCH 26/86] update fmf flags --- .../p11sak-key-management-tool-basic-functionality/main.fmf | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf index a2cdf1c..f343e72 100644 --- a/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf +++ b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf @@ -19,12 +19,8 @@ duration: 5m enabled: true tag: - CI-Tier-1 -- NoRHEL4 -- NoRHEL5 -- NoRHEL6 -- NoRHEL7 -- TIPfail_Security - Tier1 +- customer_scenario tier: '1' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 From 560d35ef65fbf38f8cfad97be67ae16bc21cd91c Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Wed, 30 Jun 2021 14:07:40 +0200 Subject: [PATCH 27/86] added new test Sanity/PID-file-location --- Sanity/PID-file-location/main.fmf | 28 ++++++++++++++ Sanity/PID-file-location/runtest.sh | 58 +++++++++++++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100644 Sanity/PID-file-location/main.fmf create mode 100755 Sanity/PID-file-location/runtest.sh diff --git a/Sanity/PID-file-location/main.fmf b/Sanity/PID-file-location/main.fmf new file mode 100644 index 0000000..0f13c86 --- /dev/null +++ b/Sanity/PID-file-location/main.fmf @@ -0,0 +1,28 @@ +summary: Test for BZ#1974693 (pkcsslotd PIDfile below legacy directory /var/run/) +description: | + Bug summary: pkcsslotd PIDfile below legacy directory /var/run/ + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1974693 +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-icsftok +- opencryptoki-icatok +- opencryptoki-ccatok +duration: 2m +enabled: true +tag: +- Tier1 +- CI-Tier-1 +adjust: +- enabled: false + when: distro == rhel-7, rhel-8 + continue: false +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974693 +extra-nitrate: TC#0611070 diff --git a/Sanity/PID-file-location/runtest.sh b/Sanity/PID-file-location/runtest.sh new file mode 100755 index 0000000..2f1a336 --- /dev/null +++ b/Sanity/PID-file-location/runtest.sh @@ -0,0 +1,58 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Test for BZ#1974693 (pkcsslotd PIDfile below legacy directory /var/run/) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +UNITFILE="/usr/lib/systemd/system/pkcsslotd.service" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlAssertExists $UNITFILE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStop pkcsslotd + rlPhaseEnd + + rlPhaseStartTest + rlAssertGrep "PIDFile=/run/pkcsslotd.pid" $UNITFILE + rlServiceStart pkcsslotd + rlRun -s "journalctl -u pkcsslotd -S '-10s'" + rlAssertGrep "PID File created" $rlRun_LOG + rlAssertGrep "Started Daemon" $rlRun_LOG + rlAssertNotGrep "PIDFile= references a path below legacy directory" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 0bfe651ec8322ca39318b564eef8a8e7ea279720 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 8 Jul 2021 08:43:52 +0200 Subject: [PATCH 28/86] check for the actual PID file instead --- Sanity/PID-file-location/runtest.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Sanity/PID-file-location/runtest.sh b/Sanity/PID-file-location/runtest.sh index 2f1a336..70fe5a9 100755 --- a/Sanity/PID-file-location/runtest.sh +++ b/Sanity/PID-file-location/runtest.sh @@ -44,9 +44,10 @@ rlJournalStart rlAssertGrep "PIDFile=/run/pkcsslotd.pid" $UNITFILE rlServiceStart pkcsslotd rlRun -s "journalctl -u pkcsslotd -S '-10s'" - rlAssertGrep "PID File created" $rlRun_LOG + #rlAssertGrep "PID File created" $rlRun_LOG rlAssertGrep "Started Daemon" $rlRun_LOG rlAssertNotGrep "PIDFile= references a path below legacy directory" $rlRun_LOG + rlAssertExists /run/pkcsslotd.pid rlPhaseEnd rlPhaseStartCleanup From 4ae31702719b28b2303e0307a8af0f166333a2d3 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Wed, 14 Jul 2021 09:14:06 +0200 Subject: [PATCH 29/86] verify that running pkcsslotd is detected --- Sanity/openCryptoki-PIN-conversion-tool/runtest.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh index e42b49a..710dd77 100755 --- a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh +++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh @@ -52,13 +52,14 @@ rlJournalStart rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" rlAssertGrep "Public Key Object" $rlRun_LOG rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E - rlServiceStop pkcsslotd - sleep 5 rlPhaseEnd rlPhaseStartTest "Token migration" + rlRun -s "echo y | pkcstok_migrate -s $SLOT -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" 1 + rlAssertGrep "pkcstok_migrate: Please stop pkcsslotd before running this utility" $rlRun_LOG + rlServiceStop pkcsslotd + sleep 5 systemctl status pkcsslotd --no-pager - ps -ef rlRun -s "echo y | pkcstok_migrate -s $SLOT -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG grep -A 4 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf From eb5713998c0547800918cd05b5634f98cc9ff80c Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 20 Aug 2021 12:55:48 +0200 Subject: [PATCH 30/86] added reproducer for bug 1987256 and test for ICA token --- .../icatok.fmf | 7 ++++++ .../openCryptoki-PIN-conversion-tool/main.fmf | 4 +++- .../runtest.sh | 24 +++++++++++++------ .../swtok.fmf | 3 +++ 4 files changed, 30 insertions(+), 8 deletions(-) create mode 100644 Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf create mode 100644 Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf diff --git a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf new file mode 100644 index 0000000..a1767ba --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf @@ -0,0 +1,7 @@ +environment: + TOKEN: ica +adjust: +- enabled: false + when: arch != s390x + continue: false +extra-nitrate: TC#0611373 diff --git a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf index 2ecedbf..c34fddb 100644 --- a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf +++ b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf @@ -13,6 +13,7 @@ require: recommend: - opencryptoki - opencryptoki-swtok +- opencryptoki-icatok - openssl - gnutls-utils - opensc @@ -31,10 +32,11 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1853420 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1964304 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1995919 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1987256 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false -extra-nitrate: TC#0607912 extra-summary: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool extra-task: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh index 710dd77..c3b2698 100755 --- a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh +++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh @@ -31,6 +31,10 @@ PACKAGE="opencryptoki" +[ -n "$TOKEN" ] || TOKEN=sw +[ "$TOKEN" == "sw" ] && STORE=/var/lib/opencryptoki/swtok +[ "$TOKEN" == "ica" ] && STORE=/var/lib/opencryptoki/lite + rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE @@ -42,12 +46,18 @@ rlJournalStart rlRun "pkcsResetTokens" rlServiceStart pkcsslotd sleep 1 - rlRun "pkcsconf -t | grep 'Soft'" - SLOT=$( pkcsGetTokenSlot sw ) + rlRun "pkcsconf -t" + SLOT=$( pkcsGetTokenSlot $TOKEN ) + MODEL=$( pkcsconf -t -c $SLOT | awk '/Model:/ { print $2 }' ) rlRun "sed -i '/tokversion = 3.12/ d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present" + # add token description to reproduce bz#1987256 + TEXT='description = "My Token"\nmanufacturer = "MyCompany Inc."' + rlRun "sed -i 's/stdll = libpkcs11_$TOKEN.so/description = \\\"My Token\\\"\nmanufacturer = \\\"MyCompany Inc\\\"\nstdll = libpkcs11_$TOKEN.so/' /etc/opencryptoki/opencryptoki.conf" + rlServiceStart pkcsslotd + # initialize token rlRun "pkcsInitToken $SLOT" rlRun "pkcsconf -t" - rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:model=Soft;manufacturer=IBM' --label id_rsa.pub" + rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:model=${MODEL};manufacturer=IBM' --label id_rsa.pub" rlAssertExists id_rsa.pub rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" rlAssertGrep "Public Key Object" $rlRun_LOG @@ -55,15 +65,15 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "Token migration" - rlRun -s "echo y | pkcstok_migrate -s $SLOT -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" 1 + rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" 1 rlAssertGrep "pkcstok_migrate: Please stop pkcsslotd before running this utility" $rlRun_LOG rlServiceStop pkcsslotd sleep 5 systemctl status pkcsslotd --no-pager - rlRun -s "echo y | pkcstok_migrate -s $SLOT -d /var/lib/opencryptoki/swtok -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" + rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG - grep -A 4 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf - rlRun "grep -A 4 -i 'slot $SLOT' /etc/opencryptoki/opencryptoki.conf | grep 'tokversion = 3.12'" 0 "Verify that slot configuration has been updated with 'tokversion = 3.12'" + grep -A 5 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf + rlRun "grep -A 5 -i 'slot $SLOT' /etc/opencryptoki/opencryptoki.conf | grep 'tokversion = 3.12'" 0 "Verify that slot configuration has been updated with 'tokversion = 3.12'" rlServiceStart pkcsslotd sleep 1 rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" 0 "Verify I still can list imported RSA key" diff --git a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf new file mode 100644 index 0000000..248a1cd --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf @@ -0,0 +1,3 @@ +environment: + TOKEN: sw +extra-nitrate: TC#0607912 From c470f6efc19617dd7cee83bf5293db2083ee1d97 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 20 Aug 2021 13:02:13 +0200 Subject: [PATCH 31/86] updated test summary --- Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf | 2 ++ Sanity/openCryptoki-PIN-conversion-tool/main.fmf | 1 - Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf | 2 ++ 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf index a1767ba..2f7a713 100644 --- a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf +++ b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf @@ -1,3 +1,4 @@ +summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=ica environment: TOKEN: ica adjust: @@ -5,3 +6,4 @@ adjust: when: arch != s390x continue: false extra-nitrate: TC#0611373 +extra-summary: TOKEN=ICA /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf index c34fddb..c70fcf6 100644 --- a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf +++ b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf @@ -38,5 +38,4 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false -extra-summary: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool extra-task: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf index 248a1cd..1bee0ce 100644 --- a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf +++ b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf @@ -1,3 +1,5 @@ +summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=sw environment: TOKEN: sw extra-nitrate: TC#0607912 +extra-summary: TOKEN=sw /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool From 44e064525e1b4eb98baf7888f142bd1563dfa612 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 30 Aug 2021 07:59:22 +0200 Subject: [PATCH 32/86] update relevancy and summary and description --- .../main.fmf | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf index d195647..880e09a 100644 --- a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf +++ b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf @@ -1,8 +1,7 @@ -summary: Tests if overall performance of cryptographic operations degrades exponentially - with the number of objects per token or open sessions per process +summary: Opencryptoki-session-object-performance-degradation description: | - Test Case Relevancy: - arch = ia64: False + Tests if overall performance of cryptographic operations degrades exponentially + with the number of objects per token or open sessions per process contact: Karel Srot component: - openCryptoki @@ -30,6 +29,13 @@ tag: - rhel8-buildroot - rhel9-buildroot tier: '3' +adjust: +- enabled: false + when: distro != rhel-6, rhel-7, rhel-8 + continue: false +- enabled: false + when: arch == ia64 + continue: false link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=612274 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=627560 From 3264b9e8c7eac30fd89e0523af9e3f317cc7011d Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 30 Aug 2021 08:02:56 +0200 Subject: [PATCH 33/86] reenabling test, only removing trousers-devel requirement --- .../main.fmf | 4 ---- .../runtest.sh | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf index 880e09a..50485a3 100644 --- a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf +++ b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf @@ -15,7 +15,6 @@ recommend: - libtool - openssl-devel - expect -- trousers-devel - yum-utils - bzip2 - rpm-build @@ -30,9 +29,6 @@ tag: - rhel9-buildroot tier: '3' adjust: -- enabled: false - when: distro != rhel-6, rhel-7, rhel-8 - continue: false - enabled: false when: arch == ia64 continue: false diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh index b34ab63..391d4cc 100755 --- a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh +++ b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh @@ -30,7 +30,7 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="opencryptoki" -PACKAGES="gcc automake libtool openssl-devel expect trousers-devel" +PACKAGES="gcc automake libtool openssl-devel expect" TMPDIR=`mktemp -d` TMP=`mktemp` SRC="src.tbz" From 520c0ab1c329d3f40f2e0d746c17b20c110979f5 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 29 Nov 2021 12:39:54 +0100 Subject: [PATCH 34/86] added subtest with p11sak_defined_attrs.conf adjustment --- .../runtest.sh | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh index e0344f4..0c3773e 100755 --- a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh +++ b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh @@ -82,6 +82,22 @@ rlJournalStart rlAssertNotGrep "Label: rsa_key:pub" $rlRun_LOG rlPhaseEnd +if nvrTestPackage opencryptoki '>=' 3.17.0; then + rlPhaseStartTest "Test p11sak_defined_attrs.conf adjustment" + rlFileBackup /etc/opencryptoki/p11sak_defined_attrs.conf + rlRun "cat >> /etc/opencryptoki/p11sak_defined_attrs.conf <<_EOF +attribute { + name = CKA_PRIME_1 + id = 0x00000124 + type = CK_BYTE +} + +_EOF" + rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "CKA_PRIME_1: len=128 value:" $rlRun_LOG + rlPhaseEnd +fi + if nvrTestPackage opencryptoki '>=' 3.15.0; then rlPhaseStartTest "Test key removal" rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" From af961414ee1ef740ef1a1a76061e29fff3407bdf Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 29 Nov 2021 14:07:17 +0100 Subject: [PATCH 35/86] run p11sak_test.sh --- Sanity/testsuite/runtest.sh | 54 +++++++++++++++++++++---------------- 1 file changed, 31 insertions(+), 23 deletions(-) diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh index b67041d..cd083b7 100755 --- a/Sanity/testsuite/runtest.sh +++ b/Sanity/testsuite/runtest.sh @@ -129,34 +129,42 @@ rlJournalStart rlPhaseStartTest "misc_tests" if [ -d $TESTDIR/misc_tests ]; then - reset_tokens - pushd $TESTDIR/misc_tests + reset_tokens + pushd $TESTDIR/misc_tests - # obj_mgmt_tests - ID=`get_test_id` - rlRun "./obj_mgmt_tests $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + # obj_mgmt_tests + ID=`get_test_id` + rlRun "./obj_mgmt_tests $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - #spinlock_tests.sh - ID=`get_test_id` - rlRun "./spinlock_tests.sh -s 1 -p 10 -l 20 &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + #spinlock_tests.sh + ID=`get_test_id` + rlRun "./spinlock_tests.sh -s 1 -p 10 -l 20 &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - #fork - ID=`get_test_id` - rlRun "./fork -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID - rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID - - # events - added in 3.16.0-3.el9 - if nvrTestPackage opencryptoki '>=' 3.16.0; then - ID=`get_test_id` - rlRun "./events -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + #fork + ID=`get_test_id` + rlRun "./fork -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID - fi + + # events - added in 3.16.0-3.el9 + if nvrTestPackage opencryptoki '>=' 3.16.0; then + ID=`get_test_id` + rlRun "./events -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID + rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID + fi + + # p11sak_test.sh added in 3.17.0 + if nvrTestPackage opencryptoki '>=' 3.17.0; then + ID=`get_test_id` + rlRun "SLOT=$SLOT ./p11sak_test.sh &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertNotGrep 'TESTCASE.*FAIL' $TmpDir/testlog.$ID -E + fi popd else From c296265f43bb405259d1937f09aba5fb08640c95 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 2 Dec 2021 14:24:18 +0100 Subject: [PATCH 36/86] add CI configuration --- .packit.yaml | 9 +++++++++ plans/opencryptoki-tests-pagure-ci.fmf | 9 +++++++++ 2 files changed, 18 insertions(+) create mode 100644 .packit.yaml create mode 100644 plans/opencryptoki-tests-pagure-ci.fmf diff --git a/.packit.yaml b/.packit.yaml new file mode 100644 index 0000000..6d572aa --- /dev/null +++ b/.packit.yaml @@ -0,0 +1,9 @@ +jobs: +- job: tests + trigger: pull_request + metadata: + targets: + - fedora-all + - centos-stream-9-x86_64 + - centos-stream-8-x86_64 + skip_build: true diff --git a/plans/opencryptoki-tests-pagure-ci.fmf b/plans/opencryptoki-tests-pagure-ci.fmf new file mode 100644 index 0000000..79ef042 --- /dev/null +++ b/plans/opencryptoki-tests-pagure-ci.fmf @@ -0,0 +1,9 @@ +summary: + Run modified tests using Packit/TFT CI +discover: + how: fmf + modified-only: True +# filter: +# - tag: CI-Tier-1 +execute: + how: tmt From 2622a43b1b1853eb9f59ba9366ad06e1c9814934 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 2 Dec 2021 14:26:19 +0100 Subject: [PATCH 37/86] modified one test to test CI configuration --- Sanity/PID-file-location/runtest.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/Sanity/PID-file-location/runtest.sh b/Sanity/PID-file-location/runtest.sh index 70fe5a9..50a8a63 100755 --- a/Sanity/PID-file-location/runtest.sh +++ b/Sanity/PID-file-location/runtest.sh @@ -55,5 +55,6 @@ rlJournalStart rlRun "popd" rlRun "rm -r $TmpDir" 0 "Removing tmp directory" rlPhaseEnd + rlJournalPrintText rlJournalEnd From 0b68a3663a885e3ebad2527d213e3b3cc32a6d14 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 2 Dec 2021 14:31:58 +0100 Subject: [PATCH 38/86] added explicite reference to main braich in fmf plan --- plans/opencryptoki-tests-pagure-ci.fmf | 1 + 1 file changed, 1 insertion(+) diff --git a/plans/opencryptoki-tests-pagure-ci.fmf b/plans/opencryptoki-tests-pagure-ci.fmf index 79ef042..9a31f10 100644 --- a/plans/opencryptoki-tests-pagure-ci.fmf +++ b/plans/opencryptoki-tests-pagure-ci.fmf @@ -3,6 +3,7 @@ summary: discover: how: fmf modified-only: True + modified-ref: reference/main # filter: # - tag: CI-Tier-1 execute: From 22b333d4ab34af218823b7bc546fb72386651c60 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 2 Dec 2021 15:08:30 +0100 Subject: [PATCH 39/86] removed packit references --- .packit.yaml | 9 --------- ...ts-pagure-ci.fmf => opencryptoki-tests-fedora-ci.fmf} | 0 2 files changed, 9 deletions(-) delete mode 100644 .packit.yaml rename plans/{opencryptoki-tests-pagure-ci.fmf => opencryptoki-tests-fedora-ci.fmf} (100%) diff --git a/.packit.yaml b/.packit.yaml deleted file mode 100644 index 6d572aa..0000000 --- a/.packit.yaml +++ /dev/null @@ -1,9 +0,0 @@ -jobs: -- job: tests - trigger: pull_request - metadata: - targets: - - fedora-all - - centos-stream-9-x86_64 - - centos-stream-8-x86_64 - skip_build: true diff --git a/plans/opencryptoki-tests-pagure-ci.fmf b/plans/opencryptoki-tests-fedora-ci.fmf similarity index 100% rename from plans/opencryptoki-tests-pagure-ci.fmf rename to plans/opencryptoki-tests-fedora-ci.fmf From ad48cfd624a7449a9ea0b24f0780cd60bfb65980 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 2 Dec 2021 15:20:07 +0100 Subject: [PATCH 40/86] added repo URL to the fmf plan --- plans/opencryptoki-tests-fedora-ci.fmf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/plans/opencryptoki-tests-fedora-ci.fmf b/plans/opencryptoki-tests-fedora-ci.fmf index 9a31f10..301aae8 100644 --- a/plans/opencryptoki-tests-fedora-ci.fmf +++ b/plans/opencryptoki-tests-fedora-ci.fmf @@ -1,8 +1,9 @@ summary: - Run modified tests using Packit/TFT CI + Run modified tests using Fedora CI discover: how: fmf modified-only: True + modified-url: https://src.fedoraproject.org/tests/opencryptoki.git modified-ref: reference/main # filter: # - tag: CI-Tier-1 From 28294f0629064f8f12420308675250d2c27e48a2 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 11 Mar 2022 13:31:19 +0100 Subject: [PATCH 41/86] added test verify-all-HW-tokens-are-available --- .../main.fmf | 29 ++++++++++ .../runtest.sh | 54 +++++++++++++++++++ 2 files changed, 83 insertions(+) create mode 100644 Sanity/verify-all-HW-tokens-are-available/main.fmf create mode 100755 Sanity/verify-all-HW-tokens-are-available/runtest.sh diff --git a/Sanity/verify-all-HW-tokens-are-available/main.fmf b/Sanity/verify-all-HW-tokens-are-available/main.fmf new file mode 100644 index 0000000..32a8c50 --- /dev/null +++ b/Sanity/verify-all-HW-tokens-are-available/main.fmf @@ -0,0 +1,29 @@ +summary: Verify that all tokens are available +description: | + Verify on s390x system that ICA and SWTPM tokens are available +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +require: +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-icatok +duration: 5m +enabled: true +tag: +- Tier1 +tier: '1' +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +- enabled: false + when: arch != s390x + continue: false + +extra-nitrate: TC#577597 +extra-summary: Verify that all tokens are available +extra-hardware: hostrequire = diff --git a/Sanity/verify-all-HW-tokens-are-available/runtest.sh b/Sanity/verify-all-HW-tokens-are-available/runtest.sh new file mode 100755 index 0000000..1158b06 --- /dev/null +++ b/Sanity/verify-all-HW-tokens-are-available/runtest.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Test for BZ#1122505 (opencryptoki sw token no longer found after rebase) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +TESTDIR=`pwd` + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStart pkcsslotd + rlPhaseEnd + + rlPhaseStartTest "listing available tokens" + rlRun -s "pkcsconf -t" + rlAssertGrep "Model: ICA" $rlRun_LOG + rlAssertGrep "Model: Soft" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlServiceRestore pkcsslotd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From c20bb3f339b18ef1f521f7bc4bf27d8668218f7e Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 11 Mar 2022 13:46:13 +0100 Subject: [PATCH 42/86] Enable verify-all-HW-tokens-are-available in CI-Tier-1 --- Sanity/verify-all-HW-tokens-are-available/main.fmf | 1 + 1 file changed, 1 insertion(+) diff --git a/Sanity/verify-all-HW-tokens-are-available/main.fmf b/Sanity/verify-all-HW-tokens-are-available/main.fmf index 32a8c50..59928c9 100644 --- a/Sanity/verify-all-HW-tokens-are-available/main.fmf +++ b/Sanity/verify-all-HW-tokens-are-available/main.fmf @@ -14,6 +14,7 @@ recommend: duration: 5m enabled: true tag: +- CI-Tier-1 - Tier1 tier: '1' adjust: From ec797adf7249b3e7cc7b4e6ecad8ee630c155a6e Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 14 Mar 2022 11:48:37 +0100 Subject: [PATCH 43/86] skip ./sess_opstate test with swtok --- Sanity/testsuite/runtest.sh | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh index cd083b7..b2e909a 100755 --- a/Sanity/testsuite/runtest.sh +++ b/Sanity/testsuite/runtest.sh @@ -187,12 +187,17 @@ rlJournalStart [ $RESULT -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID done - # now run additiona tests with specific + # now run additional tests with specific output + #sess_opstate + # skip if using swtok since the test is being skipped with + # TESTCASE sess_opstate_funcs SKIP Get/SetOperationState digest test: state unsavable ID=`get_test_id` - rlRun "./sess_opstate -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - rlAssertGrep "TESTCASE sess_opstate_funcs PASS" $TmpDir/testlog.$ID + if [ "$SLOT" != "3" ]; then + rlRun "./sess_opstate -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep "TESTCASE sess_opstate_funcs PASS" $TmpDir/testlog.$ID + fi #getobjectsize ID=`get_test_id` From b29894293995829bbdf9e6cebd3476c933c4d7c7 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 22 Apr 2022 17:00:43 +0200 Subject: [PATCH 44/86] Added namespace parameter to pkcsResetTokens --- Library/token-manipulation/lib.sh | 4 +++- Sanity/testsuite/runtest.sh | 6 +++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/Library/token-manipulation/lib.sh b/Library/token-manipulation/lib.sh index ff3cc86..f6b37ec 100644 --- a/Library/token-manipulation/lib.sh +++ b/Library/token-manipulation/lib.sh @@ -256,7 +256,9 @@ Returns 0 if the backup and removal passed, non-zero otherwise. pkcsResetTokens() { - rlFileBackup --clean --namespace pkcslib /var/lib/opencryptoki && \ + local NAMESPACE=pkcslib + [ -n "$1" ] && NAMESPACE="$1" + rlFileBackup --clean --namespace ${NAMESPACE} /var/lib/opencryptoki && \ find /var/lib/opencryptoki/ -type f -exec rm {} \; && \ rm -f /dev/shm/var.lib.opencryptoki.* } diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh index b2e909a..0e5fa02 100755 --- a/Sanity/testsuite/runtest.sh +++ b/Sanity/testsuite/runtest.sh @@ -44,7 +44,7 @@ LOGDIR=`mktemp -d` function reset_tokens() { rlLogInfo "Reseting tokens..." rlServiceStop pkcsslotd - rlRun "pkcsResetTokens" + rlRun "pkcsResetTokens randomNamespace" # using different namespace not to overwrite previous backup rlServiceStart pkcsslotd rlLogInfo "Initializing tokens..." rlRun "pkcsInitToken $SLOT" @@ -75,6 +75,10 @@ rlJournalStart tail build.log TESTDIR=`ls -d ~/rpmbuild/BUILD/opencryptoki*/testcases` + rlServiceStop pkcsslotd + sleep 3 + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd rlLogInfo "Available tokens" pkcsconf -t From d11456a95802ada70f93113d1d3711d5a93278fd Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 10 May 2022 09:27:03 +0200 Subject: [PATCH 45/86] Removed execution of modified tests only --- plans/opencryptoki-tests-fedora-ci.fmf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plans/opencryptoki-tests-fedora-ci.fmf b/plans/opencryptoki-tests-fedora-ci.fmf index 301aae8..9cfd67a 100644 --- a/plans/opencryptoki-tests-fedora-ci.fmf +++ b/plans/opencryptoki-tests-fedora-ci.fmf @@ -2,9 +2,9 @@ summary: Run modified tests using Fedora CI discover: how: fmf - modified-only: True - modified-url: https://src.fedoraproject.org/tests/opencryptoki.git - modified-ref: reference/main +# modified-only: True +# modified-url: https://src.fedoraproject.org/tests/opencryptoki.git +# modified-ref: reference/main # filter: # - tag: CI-Tier-1 execute: From 64bb7542f4398dd4be01e6a2aabef691423e4aac Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 10 May 2022 10:58:04 +0200 Subject: [PATCH 46/86] Reset tokens before doing the initialization --- Sanity/openCryptoki-PIN-conversion-tool/runtest.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh index c3b2698..b709758 100755 --- a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh +++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh @@ -42,6 +42,7 @@ rlJournalStart rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlFileBackup /etc/opencryptoki/opencryptoki.conf + [ -f /etc/opencryptoki/opencryptoki.conf_BAK ] && rlFileBackup /etc/opencryptoki/opencryptoki.conf_BAK && rlRun "rm -f /etc/opencryptoki/opencryptoki.conf_BAK" rlServiceStop pkcsslotd rlRun "pkcsResetTokens" rlServiceStart pkcsslotd @@ -49,6 +50,8 @@ rlJournalStart rlRun "pkcsconf -t" SLOT=$( pkcsGetTokenSlot $TOKEN ) MODEL=$( pkcsconf -t -c $SLOT | awk '/Model:/ { print $2 }' ) + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" rlRun "sed -i '/tokversion = 3.12/ d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present" # add token description to reproduce bz#1987256 TEXT='description = "My Token"\nmanufacturer = "MyCompany Inc."' From c6ad60d8e3733fd19c38ed7c91a7496d90ac42af Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 10 May 2022 11:42:49 +0200 Subject: [PATCH 47/86] Remove extra space in sed expr --- Sanity/openCryptoki-PIN-conversion-tool/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh index b709758..8f27406 100755 --- a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh +++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh @@ -52,7 +52,7 @@ rlJournalStart MODEL=$( pkcsconf -t -c $SLOT | awk '/Model:/ { print $2 }' ) rlServiceStop pkcsslotd rlRun "pkcsResetTokens" - rlRun "sed -i '/tokversion = 3.12/ d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present" + rlRun "sed -i '/tokversion = 3.12/d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present" # add token description to reproduce bz#1987256 TEXT='description = "My Token"\nmanufacturer = "MyCompany Inc."' rlRun "sed -i 's/stdll = libpkcs11_$TOKEN.so/description = \\\"My Token\\\"\nmanufacturer = \\\"MyCompany Inc\\\"\nstdll = libpkcs11_$TOKEN.so/' /etc/opencryptoki/opencryptoki.conf" From 1271a83b0632ba9b225629ef24fcfa73c6c97274 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 27 May 2022 09:57:21 +0200 Subject: [PATCH 48/86] Confirm that user has been added to pkcs11 group --- Sanity/init-token-as-a-nonroot-user/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Sanity/init-token-as-a-nonroot-user/runtest.sh b/Sanity/init-token-as-a-nonroot-user/runtest.sh index e0e0d80..3f69d25 100755 --- a/Sanity/init-token-as-a-nonroot-user/runtest.sh +++ b/Sanity/init-token-as-a-nonroot-user/runtest.sh @@ -45,6 +45,8 @@ rlJournalStart rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "useradd -m $USER -G pkcs11" + rlRun -s "su $USER -c 'id'" + rlAssertGrep "pkcs11" $rlRun_LOG rlServiceStop pkcsslotd rlRun "pkcsResetTokens" rlServiceStart pkcsslotd From 5a2484de86694e0e97afb6893ae86c9aab381033 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 3 Jun 2022 15:26:28 +0200 Subject: [PATCH 49/86] Add pkcsstats-basic-functionality --- Sanity/pkcsstats-basic-functionality/main.fmf | 30 +++++ .../pkcsstats-basic-functionality/runtest.sh | 126 ++++++++++++++++++ 2 files changed, 156 insertions(+) create mode 100644 Sanity/pkcsstats-basic-functionality/main.fmf create mode 100755 Sanity/pkcsstats-basic-functionality/runtest.sh diff --git a/Sanity/pkcsstats-basic-functionality/main.fmf b/Sanity/pkcsstats-basic-functionality/main.fmf new file mode 100644 index 0000000..e4f0445 --- /dev/null +++ b/Sanity/pkcsstats-basic-functionality/main.fmf @@ -0,0 +1,30 @@ +summary: Tests basic functionality of the pkcsstats command +description: | + Bug summary: openCryptoki: add crypto counters + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=2043854 + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=2044180 +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +require: +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- Tier1 +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=2043854 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=2044180 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false diff --git a/Sanity/pkcsstats-basic-functionality/runtest.sh b/Sanity/pkcsstats-basic-functionality/runtest.sh new file mode 100755 index 0000000..5c88f21 --- /dev/null +++ b/Sanity/pkcsstats-basic-functionality/runtest.sh @@ -0,0 +1,126 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +[ -n "$SLOT" ] || SLOT=sw +USER="user$RANDOM" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "useradd -m $USER -G pkcs11" + rlRun -s "su $USER -c 'id'" + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t | grep 'Soft'" + SLOT=$( pkcsGetTokenSlot $SLOT ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + rlRun "pkcsstats -R" + rlPhaseEnd + + rlPhaseStartTest "Generate aes key as root and verify stats" + rlRun -s "pkcsstats -s $SLOT -U root" + rlAssertGrep "[no mechanisms were used]" $rlRun_LOG + rlRun "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" + rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "AES 128 | aes_key" $rlRun_LOG + rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" + rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" + rlRun -s "pkcsstats -s $SLOT -U root" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E + rlAssertGrep "CKM_EC_KEY_PAIR_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Generate aes key as $USER and verify stats" + rlRun -s "pkcsstats -s $SLOT -U $USER" 0,1 + rlAssertGrep "(no mechanisms were used|No statistics are available for user '$USER')" $rlRun_LOG -E + rlRun "su - $USER -c 'p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED'" + rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "AES 128 | aes_key" $rlRun_LOG + rlRun -s "pkcsstats -s $SLOT -U $USER" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Print acummulated stats for all users" + rlRun -s "pkcsstats -s $SLOT -S" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *2 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Print --all-mechs stats for $USER" + rlRun -s "pkcsstats -s $SLOT --all-mechs -U $USER" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E + rlAssertGrep "CKM_EC_KEY_PAIR_GEN *\| *0 *0 *0 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Reset stats for $USER" + rlRun -s "pkcsstats -r -U $USER" + rlRun -s "pkcsstats -s $SLOT -U $USER" + rlAssertGrep "no mechanisms were used" $rlRun_LOG + rlRun -s "pkcsstats -s $SLOT -U $USER -a" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *0 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Delete stats for $USER" + rlRun -s "pkcsstats -d -U $USER" + rlRun -s "pkcsstats -s $SLOT -U $USER -a" 1 + rlAssertGrep "No statistics are available for user '$USER'" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Print user stats in JSON" + rlRun -s "pkcsstats -s $SLOT -j" + rlAssertGrep '"user": "root",' $rlRun_LOG + rlAssertGrep '"mechanism": "CKM_AES_KEY_GEN",' $rlRun_LOG + rlAssertGrep '"strength-128": 1,' $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "Print help" + rlRun -s "pkcsstats -h" + rlAssertGrep "Usage: pkcsstats \[OPTIONS\]" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlLog "Waiting 12 for systemd --user process to exit..." + sleep 15 + rlRun "userdel -r $USER" || ps -ef + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 478b84c2ee62df0f09a25066f42fd5ec13265cf0 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 3 Jun 2022 15:41:30 +0200 Subject: [PATCH 50/86] Exported to Nitrate --- Sanity/pkcsstats-basic-functionality/main.fmf | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/Sanity/pkcsstats-basic-functionality/main.fmf b/Sanity/pkcsstats-basic-functionality/main.fmf index e4f0445..bf78e2e 100644 --- a/Sanity/pkcsstats-basic-functionality/main.fmf +++ b/Sanity/pkcsstats-basic-functionality/main.fmf @@ -5,26 +5,27 @@ description: | Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=2044180 contact: Karel Srot component: -- opencryptoki + - opencryptoki test: ./runtest.sh framework: beakerlib require: -- url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation + - url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation recommend: -- opencryptoki -- opencryptoki-swtok -- expect + - opencryptoki + - opencryptoki-swtok + - expect duration: 5m enabled: true tag: -- CI-Tier-1 -- Tier1 + - CI-Tier-1 + - Tier1 tier: '1' link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=2043854 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=2044180 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2043854 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2044180 adjust: -- enabled: false + - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false +extra-nitrate: TC#0613736 From ed2b40bd63f03a47df5aa4ceb53c8875147dda7d Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Wed, 3 Aug 2022 21:21:09 +0200 Subject: [PATCH 51/86] adjusted relevancy --- Sanity/pkcsstats-basic-functionality/main.fmf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Sanity/pkcsstats-basic-functionality/main.fmf b/Sanity/pkcsstats-basic-functionality/main.fmf index bf78e2e..31bd8ae 100644 --- a/Sanity/pkcsstats-basic-functionality/main.fmf +++ b/Sanity/pkcsstats-basic-functionality/main.fmf @@ -27,5 +27,7 @@ link: adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false + - enabled: false + when: distro < rhel-8.7 or distro < rhel-9.1 + because: feature has been introduced in 8.7 and 9.1 extra-nitrate: TC#0613736 From ee01e764439ced96ae44e1ae868f5c2e2e1acc72 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 24 Oct 2022 14:58:31 +0200 Subject: [PATCH 52/86] Add sleep before running p11sak --- Sanity/pkcsstats-basic-functionality/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/pkcsstats-basic-functionality/runtest.sh b/Sanity/pkcsstats-basic-functionality/runtest.sh index 5c88f21..e0f071c 100755 --- a/Sanity/pkcsstats-basic-functionality/runtest.sh +++ b/Sanity/pkcsstats-basic-functionality/runtest.sh @@ -67,7 +67,7 @@ rlJournalStart rlPhaseStartTest "Generate aes key as $USER and verify stats" rlRun -s "pkcsstats -s $SLOT -U $USER" 0,1 rlAssertGrep "(no mechanisms were used|No statistics are available for user '$USER')" $rlRun_LOG -E - rlRun "su - $USER -c 'p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED'" + rlRun "su - $USER -c 'sleep 3 && p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED'" rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep "AES 128 | aes_key" $rlRun_LOG rlRun -s "pkcsstats -s $SLOT -U $USER" From 8375ea1253f2f684adaf10f5e5547cfada1a6c7e Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 27 Oct 2022 14:20:38 +0200 Subject: [PATCH 53/86] added regression tmt plan --- plans/regression.fmf | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 plans/regression.fmf diff --git a/plans/regression.fmf b/plans/regression.fmf new file mode 100644 index 0000000..ac7c1f5 --- /dev/null +++ b/plans/regression.fmf @@ -0,0 +1,10 @@ +summary: Runs all tests + +discover: + how: fmf + test: + - /Sanity/* + - /Regression/* + +execute: + how: tmt From a271211a46515cc5512cc3a70dad5cec98626ccf Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 31 Oct 2022 10:33:48 +0100 Subject: [PATCH 54/86] Adjust for opencryptoki v3.19.0 --- .../runtest.sh | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh index 0c3773e..bfe3cbe 100755 --- a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh +++ b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh @@ -52,34 +52,34 @@ rlJournalStart rlPhaseStartTest "Test key generation and listing" rlRun -s "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" - rlAssertGrep "Generate symmetric key AES with keylen=128 and label=\[aes_key\]" $rlRun_LOG + rlAssertGrep 'Generate symmetric key AES with keylen=128 and label="?\[aes_key\]"?' $rlRun_LOG -E rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "AES 128 | aes_key" $rlRun_LOG + rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E rlRun -s "p11sak gen-key 3des --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" - rlAssertGrep "Generate symmetric key 3DES with keylen=192 and label=\[3des_key\]" $rlRun_LOG + rlAssertGrep 'Generate symmetric key 3DES with keylen=192 and label="?\[3des_key\]"?' $rlRun_LOG -E rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "3DES | 3des_key" $rlRun_LOG + rlAssertGrep '3DES | "?3des_key"?' $rlRun_LOG -E rlRun -s "p11sak gen-key rsa 2048 --exponent 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "public RSA | rsa_key:pub" $rlRun_LOG - rlAssertGrep "private RSA | rsa_key:prv" $rlRun_LOG + rlAssertGrep 'public RSA | "?rsa_key:pub"?' $rlRun_LOG -E + rlAssertGrep 'private RSA | "?rsa_key:prv"?' $rlRun_LOG -E rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "Label: aes_key" $rlRun_LOG - rlAssertGrep "Label: 3des_key" $rlRun_LOG - rlAssertNotGrep "Label: rsa_key" $rlRun_LOG + rlAssertGrep 'Label: "?aes_key"?' $rlRun_LOG -E + rlAssertGrep 'Label: "?3des_key"?' $rlRun_LOG -E + rlAssertNotGrep 'Label: "?rsa_key"?' $rlRun_LOG -E rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "Label: rsa_key:prv" $rlRun_LOG - rlAssertNotGrep "Label: rsa_key:pub" $rlRun_LOG + rlAssertGrep 'Label: "?rsa_key:prv"?' $rlRun_LOG -E + rlAssertNotGrep 'Label: "?rsa_key:pub"?' $rlRun_LOG -E rlPhaseEnd if nvrTestPackage opencryptoki '>=' 3.17.0; then From b22e3e4407347c12fee661350435a5aac780b807 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 31 Oct 2022 10:36:56 +0100 Subject: [PATCH 55/86] Adjust for opencryptoki v3.19.0 step2 --- Sanity/pkcsstats-basic-functionality/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Sanity/pkcsstats-basic-functionality/runtest.sh b/Sanity/pkcsstats-basic-functionality/runtest.sh index e0f071c..eea03d4 100755 --- a/Sanity/pkcsstats-basic-functionality/runtest.sh +++ b/Sanity/pkcsstats-basic-functionality/runtest.sh @@ -56,7 +56,7 @@ rlJournalStart rlAssertGrep "[no mechanisms were used]" $rlRun_LOG rlRun "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "AES 128 | aes_key" $rlRun_LOG + rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" rlRun -s "pkcsstats -s $SLOT -U root" @@ -69,7 +69,7 @@ rlJournalStart rlAssertGrep "(no mechanisms were used|No statistics are available for user '$USER')" $rlRun_LOG -E rlRun "su - $USER -c 'sleep 3 && p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED'" rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "AES 128 | aes_key" $rlRun_LOG + rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E rlRun -s "pkcsstats -s $SLOT -U $USER" rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E rlPhaseEnd From c68268bb5af26d6ce1b49ddf92d297cc6749dab2 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 31 Oct 2022 10:47:54 +0100 Subject: [PATCH 56/86] Adjust for opencryptoki v3.19.0 step34 --- .../runtest.sh | 2 +- .../main.fmf | 27 ++++++++++--------- 2 files changed, 15 insertions(+), 14 deletions(-) diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh index e26f26f..086e463 100755 --- a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh +++ b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh @@ -53,7 +53,7 @@ rlJournalStart rlPhaseStartTest rlRun "./pkcsconf.exp $PKCSCONF 2>&1 | tee $TMP" - rlAssertGrep "New PINs do not match." $TMP + rlAssertGrep "Invalid new user pin|New PINs do not match." $TMP -E rlPhaseEnd rlPhaseStartCleanup diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf index f343e72..9105e0d 100644 --- a/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf +++ b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf @@ -4,31 +4,32 @@ description: | Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 contact: Karel Srot component: -- openCryptoki + - openCryptoki test: ./runtest.sh framework: beakerlib require: -- library(nvr/nvr) -- url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation + - library(nvr/nvr) + - url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation recommend: -- opencryptoki -- opencryptoki-swtok -- expect + - opencryptoki + - opencryptoki-swtok + - expect duration: 5m enabled: true tag: -- CI-Tier-1 -- Tier1 -- customer_scenario + - CI-Tier-1 + - Tier1 + - customer_scenario tier: '1' link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851109 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851109 adjust: -- enabled: false + - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false extra-nitrate: TC#0607944 extra-summary: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality extra-task: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality +id: 065dda66-85f0-4142-83d3-b4104d359d41 From 04408e0f1b1566f0bb651bbdbf3802af8833e197 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 3 Nov 2022 15:55:16 +0100 Subject: [PATCH 57/86] fix rhts-reboot call --- .../lock-files-are-persistent-across-system-reboot/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh b/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh index 1b1fafa..d419ad2 100755 --- a/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh +++ b/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh @@ -55,7 +55,7 @@ rlJournalStart rlAssertExists /var/lock/opencryptoki/LCK..APIlock if [ ! -f /bz1054442-rebooted ]; then touch /bz1054442-rebooted - rlRun "/usr/bin/rhts-reboot" + rlRun "rhts-reboot" else rlRun "rm /bz1054442-rebooted" fi From c15878671465ebaf41d45c00a4cf53e34bf00f8f Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 14 Nov 2022 07:45:15 +0100 Subject: [PATCH 58/86] Accept exit code 6 --- Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh b/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh index 7d90bf3..84ce1bc 100755 --- a/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh +++ b/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh @@ -41,7 +41,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest - rlRun -s "su - bz1063763user -c 'pkcsconf -t'" 144 + rlRun -s "su - bz1063763user -c 'pkcsconf -t'" 144,6 rlAssertGrep "Error initializing the PKCS11 library" $rlRun_LOG rlAssertGrep "Note: all non-root users that require access to PKCS#11 tokens using opencryptoki must be assigned to the pkcs11 group to be able to communicate with the pkcsslotd daemon." $rlRun_LOG rlPhaseEnd From d70b1c804dee25e428c4cfa5a26eda17582148f1 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 13 Mar 2023 13:30:28 +0100 Subject: [PATCH 59/86] Set envvar GIT_SSL_NO_VERIFY --- Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf | 2 +- Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf | 2 +- main.fmf | 2 ++ 3 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 main.fmf diff --git a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf index 2f7a713..d94ffd8 100644 --- a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf +++ b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf @@ -1,5 +1,5 @@ summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=ica -environment: +environment+: TOKEN: ica adjust: - enabled: false diff --git a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf index 1bee0ce..d8d06f6 100644 --- a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf +++ b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf @@ -1,5 +1,5 @@ summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=sw -environment: +environment+: TOKEN: sw extra-nitrate: TC#0607912 extra-summary: TOKEN=sw /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/main.fmf b/main.fmf new file mode 100644 index 0000000..7ba77d5 --- /dev/null +++ b/main.fmf @@ -0,0 +1,2 @@ +environment: + GIT_SSL_NO_VERIFY: 'true' From ad2586c68869b2f044b1ed376cd253a5808e1d1f Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 13 Mar 2023 13:32:22 +0100 Subject: [PATCH 60/86] Revert "Set envvar GIT_SSL_NO_VERIFY" This reverts commit d70b1c804dee25e428c4cfa5a26eda17582148f1. --- Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf | 2 +- Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf | 2 +- main.fmf | 2 -- 3 files changed, 2 insertions(+), 4 deletions(-) delete mode 100644 main.fmf diff --git a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf index d94ffd8..2f7a713 100644 --- a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf +++ b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf @@ -1,5 +1,5 @@ summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=ica -environment+: +environment: TOKEN: ica adjust: - enabled: false diff --git a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf index d8d06f6..1bee0ce 100644 --- a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf +++ b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf @@ -1,5 +1,5 @@ summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=sw -environment+: +environment: TOKEN: sw extra-nitrate: TC#0607912 extra-summary: TOKEN=sw /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/main.fmf b/main.fmf deleted file mode 100644 index 7ba77d5..0000000 --- a/main.fmf +++ /dev/null @@ -1,2 +0,0 @@ -environment: - GIT_SSL_NO_VERIFY: 'true' From 01f79ef854d5742d72052350e1ce92c2feccdbf2 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 18 May 2023 09:27:09 +0200 Subject: [PATCH 61/86] Update test to work with v3.21.0 --- .../runtest.sh | 30 +++++++++++-------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh index 1c77c05..b803b51 100755 --- a/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh @@ -45,34 +45,38 @@ rlJournalStart rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library" # need library path so we can import it as a test user LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'` - echo "LIBPATH=$LIBPATH" + echo "LIBPATH=$LIBPATH" rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" - rlServiceStop pkcsslotd + rlServiceStop pkcsslotd + pkcsResetTokens rlFileBackup --clean /var/lib/opencryptoki /var/log/opencryptoki $LOCKDIR/opencryptoki # avoid using /var/lock symlink to properly test bug 1373833 - if [ "$LOCKDIR" == "/run/lock" ]; then - [ -L /var/lock ] && rlFileBackup /var/lock && rlRun "rm -f /var/lock" - fi + if [ "$LOCKDIR" == "/run/lock" ]; then + [ -L /var/lock ] && rlFileBackup /var/lock && rlRun "rm -f /var/lock" + fi rlRun "useradd -m $USER -G pkcs11" rlPhaseEnd + # skip this one for opencryptoki 3.21.0 as since then the service is running as a regular user + if nvrTestPackage opencryptoki '<' 3.21.0; then rlPhaseStartTest "testing directory creation during pkcsslotd start" - rlRun "rm -rf /var/log/opencryptoki $LOCKDIR/opencryptoki" - rlRun "pkcsResetTokens" + rlRun "rm -rf /var/log/opencryptoki $LOCKDIR/opencryptoki" + rlRun "pkcsResetTokens" rlServiceStart pkcsslotd - rlAssertExists /var/log/opencryptoki - rlAssertExists $LOCKDIR/opencryptoki - rlRun "matchpathcon /var/log/opencryptoki" - rlRun "matchpathcon $LOCKDIR/opencryptoki" - rlRun "su $USER -c 'pkcsconf -t' &> query1.log" + rlAssertExists /var/log/opencryptoki + rlAssertExists $LOCKDIR/opencryptoki + rlRun "matchpathcon /var/log/opencryptoki" + rlRun "matchpathcon $LOCKDIR/opencryptoki" + rlRun "su $USER -c 'pkcsconf -t' &> query1.log" cat query1.log if nvrTestPackage opencryptoki '<' 3.14.0; then - rlAssertGrep "Model: IBM SoftTok" query1.log + rlAssertGrep "Model: IBM SoftTok" query1.log else rlAssertGrep "Model: Soft " query1.log fi rlPhaseEnd + fi # initialize every token available for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do From 5dbe066eb36e691884faa9df2862cbbd6b794ef2 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 18 May 2023 09:39:16 +0200 Subject: [PATCH 62/86] Update testsuite test to work with v3.21.0 --- Sanity/testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh index 0e5fa02..e78a0fa 100755 --- a/Sanity/testsuite/runtest.sh +++ b/Sanity/testsuite/runtest.sh @@ -213,7 +213,7 @@ rlJournalStart ID=`get_test_id` rlRun "./hw_fn -slot $SLOT &> $TmpDir/testlog.$ID" [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - rlAssertGrep "Hardware Feature tests succeeded." $TmpDir/testlog.$ID + rlAssertGrep "(Hardware Feature tests succeeded.|do_HW_Feature_Search passed)" $TmpDir/testlog.$ID -E popd From c2ba47eaa9f60c76c07827187af0b096c1722502 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 18 May 2023 10:29:37 +0200 Subject: [PATCH 63/86] Update p11sak-key-management-tool-basic-functionality for v3.21.0 --- .../runtest.sh | 85 +++++++++++++++---- 1 file changed, 67 insertions(+), 18 deletions(-) diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh index bfe3cbe..490899d 100755 --- a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh +++ b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh @@ -52,26 +52,43 @@ rlJournalStart rlPhaseStartTest "Test key generation and listing" rlRun -s "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" - rlAssertGrep 'Generate symmetric key AES with keylen=128 and label="?\[aes_key\]"?' $rlRun_LOG -E - rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep 'Generate symmetric key AES with keylen=128 and label="?\[aes_key\]"?' $rlRun_LOG -E + rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + else + rlAssertGrep 'Successfully generated a AES key with label "aes_key".' $rlRun_LOG + fi rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E rlRun -s "p11sak gen-key 3des --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" - rlAssertGrep 'Generate symmetric key 3DES with keylen=192 and label="?\[3des_key\]"?' $rlRun_LOG -E - rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep 'Generate symmetric key 3DES with keylen=192 and label="?\[3des_key\]"?' $rlRun_LOG -E + rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + else + rlAssertGrep 'Successfully generated a 3DES key with label "3des_key".' $rlRun_LOG + fi rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep '3DES | "?3des_key"?' $rlRun_LOG -E - rlRun -s "p11sak gen-key rsa 2048 --exponent 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" - rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG - rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlRun -s "p11sak gen-key rsa 2048 --exponent 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" + rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG + rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG + else + rlRun -s "p11sak gen-key rsa 2048 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" + rlAssertGrep 'Successfully generated a RSA key pair with labels "rsa_key:pub":"rsa_key:prv".' $rlRun_LOG + fi rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep 'public RSA | "?rsa_key:pub"?' $rlRun_LOG -E rlAssertGrep 'private RSA | "?rsa_key:prv"?' $rlRun_LOG -E rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" - rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG + else + rlAssertGrep 'Successfully generated a EC key pair with labels "ec_key:pub":"ec_key:prv".' $rlRun_LOG + fi rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep 'Label: "?aes_key"?' $rlRun_LOG -E rlAssertGrep 'Label: "?3des_key"?' $rlRun_LOG -E @@ -94,34 +111,66 @@ attribute { _EOF" rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "CKA_PRIME_1: len=128 value:" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "CKA_PRIME_1: len=128 value:" $rlRun_LOG + else + rlAssertGrep "CKA_PRIME_1: \[sensitive\]" $rlRun_LOG + fi rlPhaseEnd fi if nvrTestPackage opencryptoki '>=' 3.15.0; then rlPhaseStartTest "Test key removal" - rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" - rlAssertGrep "Skip deleting Key. User input CKR_CANCEL" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + else + rlFail "failing here so we won't forget to remove the workaround" + rlRun -s "echo 'n' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + fi + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Skip deleting Key. User input CKR_CANCEL" $rlRun_LOG + else + rlAssertGrep "1 key object(s) skipped." $rlRun_LOG + fi rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep "aes_key" $rlRun_LOG rlRun -s "echo n | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" - rlAssertGrep "Skip deleting Key" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Skip deleting Key" $rlRun_LOG + else + rlAssertGrep "1 key object(s) skipped." $rlRun_LOG + fi rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" rlAssertGrep "aes_key" $rlRun_LOG rlRun -s "echo y | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" - rlAssertGrep "Object with Label: aes_key found and destroyed" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Object with Label: aes_key found and destroyed" $rlRun_LOG + else + rlAssertGrep 'Successfully removed AES 128 key object "aes_key".' $rlRun_LOG + rlAssertGrep "1 key object(s) removed." $rlRun_LOG + fi rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" rlAssertNotGrep "aes_key" $rlRun_LOG rlRun -s "p11sak rm-key 3des --force --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" - rlAssertGrep "Object with Label: 3des_key found and destroyed" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Object with Label: 3des_key found and destroyed" $rlRun_LOG + else + rlAssertGrep 'Successfully removed 3DES key object "3des_key".' $rlRun_LOG + rlAssertGrep "1 key object(s) removed." $rlRun_LOG + fi rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" rlAssertNotGrep "3des_key" $rlRun_LOG rlRun -s "p11sak rm rsa --force --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key:pub" - rlAssertGrep "Object with Label: rsa_key:pub found and destroyed" $rlRun_LOG + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Object with Label: rsa_key:pub found and destroyed" $rlRun_LOG + else + rlAssertGrep 'Successfully removed public RSA 2048 key object "rsa_key:pub".' $rlRun_LOG + rlAssertGrep "1 key object(s) removed." $rlRun_LOG + fi rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" rlAssertNotGrep "rsa_key:pub" $rlRun_LOG rlPhaseEnd @@ -131,15 +180,15 @@ fi rlRun -s "p11sak --help" rlAssertGrep "Usage: p11sak COMMAND \[ARGS\] \[OPTIONS\]" $rlRun_LOG - rlRun -s "p11sak generate-key --help" 7 + rlRun -s "p11sak generate-key --help" 0,7 rlAssertGrep "Usage: p11sak generate-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG - rlRun -s "p11sak list-key --help" 7 + rlRun -s "p11sak list-key --help" 0,7 rlAssertGrep "Usage: p11sak list-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG if nvrTestPackage opencryptoki '>=' 3.15.0; then - rlRun -s "p11sak remove-key --help" 7 + rlRun -s "p11sak remove-key --help" 0,7 rlAssertGrep "Usage: p11sak remove-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG fi rlPhaseEnd From 72af3e3f4345f5d0471d45233eaa6dde540dcc42 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 19 May 2023 11:27:53 +0200 Subject: [PATCH 64/86] Update for opencryptoki-3.21 --- Sanity/PID-file-location/main.fmf | 4 +++- Sanity/PID-file-location/runtest.sh | 8 ++++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/Sanity/PID-file-location/main.fmf b/Sanity/PID-file-location/main.fmf index 0f13c86..3036ec6 100644 --- a/Sanity/PID-file-location/main.fmf +++ b/Sanity/PID-file-location/main.fmf @@ -7,6 +7,8 @@ component: - opencryptoki test: ./runtest.sh framework: beakerlib +require: + - library(nvr/nvr) recommend: - opencryptoki - opencryptoki-swtok @@ -21,7 +23,7 @@ tag: - CI-Tier-1 adjust: - enabled: false - when: distro == rhel-7, rhel-8 + when: "distro == rhel-7 or distro < rhel-8.9" continue: false link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974693 diff --git a/Sanity/PID-file-location/runtest.sh b/Sanity/PID-file-location/runtest.sh index 50a8a63..42b5d16 100755 --- a/Sanity/PID-file-location/runtest.sh +++ b/Sanity/PID-file-location/runtest.sh @@ -33,6 +33,7 @@ UNITFILE="/usr/lib/systemd/system/pkcsslotd.service" rlJournalStart rlPhaseStartSetup + rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" rlAssertRpm $PACKAGE rlAssertExists $UNITFILE rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" @@ -41,13 +42,16 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest - rlAssertGrep "PIDFile=/run/pkcsslotd.pid" $UNITFILE + PIDFILE=/run/opencryptoki/pkcsslotd.pid + nvrTestPackage opencryptoki '<' 3.21.0 && PIDFILE=/run/pkcsslotd.pid + + rlAssertGrep "PIDFile=$PIDFILE" $UNITFILE rlServiceStart pkcsslotd rlRun -s "journalctl -u pkcsslotd -S '-10s'" #rlAssertGrep "PID File created" $rlRun_LOG rlAssertGrep "Started Daemon" $rlRun_LOG rlAssertNotGrep "PIDFile= references a path below legacy directory" $rlRun_LOG - rlAssertExists /run/pkcsslotd.pid + rlAssertExists $PIDFILE rlPhaseEnd rlPhaseStartCleanup From 1973846d231ecd9d53c5bba2eb9529ce1bbfeb0e Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 22 May 2023 17:59:00 +0200 Subject: [PATCH 65/86] Removing the workaround as the bug had been fixed --- .../runtest.sh | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh index 490899d..d54f273 100755 --- a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh +++ b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh @@ -121,12 +121,7 @@ fi if nvrTestPackage opencryptoki '>=' 3.15.0; then rlPhaseStartTest "Test key removal" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" - else - rlFail "failing here so we won't forget to remove the workaround" - rlRun -s "echo 'n' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" - fi + rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" if nvrTestPackage opencryptoki '<' 3.21.0; then rlAssertGrep "Skip deleting Key. User input CKR_CANCEL" $rlRun_LOG else From 81b9c1a733682b9cccc6aaa3d6aa28eb8d613b69 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 23 May 2023 12:54:49 +0200 Subject: [PATCH 66/86] Add GIT_SSL_NO_VERIFY=false to main.fmf --- main.fmf | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 main.fmf diff --git a/main.fmf b/main.fmf new file mode 100644 index 0000000..ff4a95a --- /dev/null +++ b/main.fmf @@ -0,0 +1,2 @@ +environment: + GIT_SSL_NO_VERIFY: "false" From 27fcd1989c1ef2410de39fabedb8f08329c812f4 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 23 May 2023 12:55:49 +0200 Subject: [PATCH 67/86] fix GIT_SSL_NO_VERIFY value --- main.fmf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/main.fmf b/main.fmf index ff4a95a..e46882f 100644 --- a/main.fmf +++ b/main.fmf @@ -1,2 +1,2 @@ environment: - GIT_SSL_NO_VERIFY: "false" + GIT_SSL_NO_VERIFY: "true" From 2f37b3b54820737088271778ef81d48bb728a495 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 18 Jul 2023 13:38:54 +0200 Subject: [PATCH 68/86] Added tests for token update --- Update/initialized-ica-token/main.fmf | 30 ++++++ Update/initialized-ica-token/runtest.sh | 121 +++++++++++++++++++++++ Update/initialized-sw-token/main.fmf | 29 ++++++ Update/initialized-sw-token/runtest.sh | 122 ++++++++++++++++++++++++ 4 files changed, 302 insertions(+) create mode 100644 Update/initialized-ica-token/main.fmf create mode 100755 Update/initialized-ica-token/runtest.sh create mode 100644 Update/initialized-sw-token/main.fmf create mode 100755 Update/initialized-sw-token/runtest.sh diff --git a/Update/initialized-ica-token/main.fmf b/Update/initialized-ica-token/main.fmf new file mode 100644 index 0000000..59dcfe9 --- /dev/null +++ b/Update/initialized-ica-token/main.fmf @@ -0,0 +1,30 @@ +summary: initialize ICA token and test it still works after an update +description: '' +contact: Karel Srot +component: + - opencryptoki +test: ./runtest.sh +framework: beakerlib +require: + - url: https://src.fedoraproject.org/tests/opencryptoki + name: /Library/token-manipulation +recommend: + - opencryptoki + - opencryptoki-icatok + - libica + - gnutls-utils + - opensc + - expect +duration: 5m + +/all: + environment: + PHASES: all + +/setup: + environment: + PHASES: "setup,test" + +/test: + environment: + PHASES: test diff --git a/Update/initialized-ica-token/runtest.sh b/Update/initialized-ica-token/runtest.sh new file mode 100755 index 0000000..d3858bf --- /dev/null +++ b/Update/initialized-ica-token/runtest.sh @@ -0,0 +1,121 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Upgrade/initialized-ica-token +# Description: initialize ICA token and test it still works after an update +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +function phaseSetup() { + rlPhaseStartTest + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlRun "systemctl enable pkcsslotd" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t" + SLOT=$( pkcsGetTokenSlot ica ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + if rlIsRHEL '<8'; then + rlRun "GNUTLS_PIN=$pkcsUSER_PIN p11tool --generate-rsa --login --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" + else + rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" + fi + rlAssertExists id_rsa.pub + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlPhaseEnd +} + + +function phaseTest() { + rlPhaseStartTest + rlRun "pkcsconf -t" + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" 0 "Verify I still can list imported RSA key" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlLog "Exporting stored RSA key" + rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" + rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" + rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" + rlPhaseEnd +} + + +function phaseCleanup() { + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +} + + +rlJournalStart + + rlPhaseStartSetup "init" + rlAssertRpm $PACKAGE + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=/var/tmp/opencryptoki-tests-runtime-files" + [ -d $TmpDir ] || rlRun "mkdir -p $TmpDir" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + if rlIsRHEL '<8'; then + rlRun "TokenSpec='model=IBM%20ICA'" + else + rlRun "TokenSpec='model=ICA;manufacturer=IBM'" + fi + rlPhaseEnd + + # clear $PHASES if IN_PLACE_UPGRADE is specified + [ -n "$IN_PLACE_UPGRADE" ] && PHASES="" + echo IN_PLACE_UPGRADE=$IN_PLACE_UPGRADE + echo PHASES=$PHASES + + # run setup, except when running post-upgrade phase + if [ -n "$IN_PLACE_UPGRADE" -a "$IN_PLACE_UPGRADE" != "new" ] || echo ${PHASES} | egrep -qi '(setup|all)'; then + phaseSetup + fi + + # run test by default + if [ -z "${PHASES}" ] || echo ${PHASES} | egrep -qi '(test|all)'; then + phaseTest + fi + + popd + # run cleanup only when run as a standalone test + if [ -z "$IN_PLACE_UPGRADE" ] && echo ${PHASES} | egrep -qi '(cleanup|all)'; then + phaseCleanup + fi + +rlJournalPrintText +rlJournalEnd diff --git a/Update/initialized-sw-token/main.fmf b/Update/initialized-sw-token/main.fmf new file mode 100644 index 0000000..71f1582 --- /dev/null +++ b/Update/initialized-sw-token/main.fmf @@ -0,0 +1,29 @@ +summary: initialize sw token and test it still works after an update +description: '' +contact: Karel Srot +component: + - opencryptoki +test: ./runtest.sh +framework: beakerlib +require: + - url: https://src.fedoraproject.org/tests/opencryptoki + name: /Library/token-manipulation +recommend: + - opencryptoki + - opencryptoki-swtok + - gnutls-utils + - opensc + - expect +duration: 5m + +/all: + environment: + PHASES: all + +/setup: + environment: + PHASES: "setup,test" + +/test: + environment: + PHASES: test diff --git a/Update/initialized-sw-token/runtest.sh b/Update/initialized-sw-token/runtest.sh new file mode 100755 index 0000000..78e7e40 --- /dev/null +++ b/Update/initialized-sw-token/runtest.sh @@ -0,0 +1,122 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Upgrade/initialized-sw-token +# Description: initialize sw token and test it still works after an update +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +function phaseSetup() { + rlPhaseStartSetup + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlRun "systemctl enable pkcsslotd" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t | grep 'Soft'" + SLOT=$( pkcsGetTokenSlot sw ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + if rlIsRHEL '<8'; then + rlRun "GNUTLS_PIN=$pkcsUSER_PIN p11tool --generate-rsa --login --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" + else + rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" + fi + rlAssertExists id_rsa.pub + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlPhaseEnd +} + + +function phaseTest() { + rlPhaseStartTest + rlRun "pkcsconf -t" + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" 0 "Verify I still can list imported RSA key" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlLog "Exporting stored RSA key" + rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" + rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" + rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" + rlRun "popd" + rlPhaseEnd +} + + +function phaseCleanup() { + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +} + + +rlJournalStart + + rlPhaseStartSetup "init" + rlAssertRpm $PACKAGE + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=/var/tmp/opencryptoki-tests-runtime-files" + [ -d $TmpDir ] || rlRun "mkdir -p $TmpDir" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + if rlIsRHEL '<8'; then + rlRun "TokenSpec='model=IBM%20SoftTok'" + else + rlRun "TokenSpec='model=Soft;manufacturer=IBM'" + fi + rlPhaseEnd + + # clear $PHASES if IN_PLACE_UPGRADE is specified + [ -n "$IN_PLACE_UPGRADE" ] && PHASES="" + echo IN_PLACE_UPGRADE=$IN_PLACE_UPGRADE + echo PHASES=$PHASES + + # run setup, except when running post-upgrade phase + if [ -n "$IN_PLACE_UPGRADE" -a "$IN_PLACE_UPGRADE" != "new" ] || echo ${PHASES} | egrep -qi '(setup|all)'; then + phaseSetup + fi + + # run test by default + if [ -z "${PHASES}" ] || echo ${PHASES} | egrep -qi '(test|all)'; then + phaseTest + fi + + popd + # run cleanup only when run as a standalone test + if [ -z "$IN_PLACE_UPGRADE" ] && echo ${PHASES} | egrep -qi '(cleanup|all)'; then + phaseCleanup + fi + +rlJournalPrintText +rlJournalEnd From a4984eff6998506101d4dd1eb8699738da94288d Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 18 Jul 2023 14:07:00 +0200 Subject: [PATCH 69/86] Added /Update/dnf-update-opencryptoki --- Update/dnf-update-opencryptoki/main.fmf | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 Update/dnf-update-opencryptoki/main.fmf diff --git a/Update/dnf-update-opencryptoki/main.fmf b/Update/dnf-update-opencryptoki/main.fmf new file mode 100644 index 0000000..77b47d9 --- /dev/null +++ b/Update/dnf-update-opencryptoki/main.fmf @@ -0,0 +1,8 @@ +summary: Update opencryptoki package with dnf +contact: Karel Srot +tag: + - setup +framework: shell +duration: 10m +enabled: true +test: "dnf -y update 'opencryptoki*'" From 5a1a94b8d1d982955de4d47f8248fb3991d896f4 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 12 Apr 2024 13:41:41 +0200 Subject: [PATCH 70/86] Update grep pattern due to a new message format --- Sanity/PID-file-location/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/PID-file-location/runtest.sh b/Sanity/PID-file-location/runtest.sh index 42b5d16..c0facf6 100755 --- a/Sanity/PID-file-location/runtest.sh +++ b/Sanity/PID-file-location/runtest.sh @@ -49,7 +49,7 @@ rlJournalStart rlServiceStart pkcsslotd rlRun -s "journalctl -u pkcsslotd -S '-10s'" #rlAssertGrep "PID File created" $rlRun_LOG - rlAssertGrep "Started Daemon" $rlRun_LOG + rlAssertGrep "Started (pkcsslotd.service)?.* Daemon" $rlRun_LOG -E rlAssertNotGrep "PIDFile= references a path below legacy directory" $rlRun_LOG rlAssertExists $PIDFILE rlPhaseEnd From e2c039c1b39222fd8ac951ad1f2e8716f2c86f6c Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 12 Apr 2024 13:42:41 +0200 Subject: [PATCH 71/86] fixed grep pattern --- Sanity/PID-file-location/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/PID-file-location/runtest.sh b/Sanity/PID-file-location/runtest.sh index c0facf6..a6544b8 100755 --- a/Sanity/PID-file-location/runtest.sh +++ b/Sanity/PID-file-location/runtest.sh @@ -49,7 +49,7 @@ rlJournalStart rlServiceStart pkcsslotd rlRun -s "journalctl -u pkcsslotd -S '-10s'" #rlAssertGrep "PID File created" $rlRun_LOG - rlAssertGrep "Started (pkcsslotd.service)?.* Daemon" $rlRun_LOG -E + rlAssertGrep "Started (pkcsslotd.service)?.*Daemon" $rlRun_LOG -E rlAssertNotGrep "PIDFile= references a path below legacy directory" $rlRun_LOG rlAssertExists $PIDFILE rlPhaseEnd From 73e33a664aed4fc4c38c968cbacb8217e13473f0 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 18 Jul 2024 10:47:39 +0200 Subject: [PATCH 72/86] Do not check for subdirs under /var/lock/opencryptoki --- .../lock-files-are-persistent-across-system-reboot/runtest.sh | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh b/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh index d419ad2..b5b691c 100755 --- a/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh +++ b/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh @@ -49,9 +49,7 @@ rlJournalStart for DIR in $SUBDIRS; do rlAssertExists /var/lib/opencryptoki/$DIR done - for DIR in $SUBDIRS; do - rlAssertExists /var/lock/opencryptoki/$DIR - done + rlAssertExists /var/lock/opencryptoki rlAssertExists /var/lock/opencryptoki/LCK..APIlock if [ ! -f /bz1054442-rebooted ]; then touch /bz1054442-rebooted From 0c0228b2e77fea50f22bc7610bb88cf7d07ae2cf Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 27 Sep 2024 10:24:14 +0200 Subject: [PATCH 73/86] Check for EP11 token if SLOT=4 --- Sanity/verify-all-HW-tokens-are-available/runtest.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/Sanity/verify-all-HW-tokens-are-available/runtest.sh b/Sanity/verify-all-HW-tokens-are-available/runtest.sh index 1158b06..2750bb2 100755 --- a/Sanity/verify-all-HW-tokens-are-available/runtest.sh +++ b/Sanity/verify-all-HW-tokens-are-available/runtest.sh @@ -43,6 +43,7 @@ rlJournalStart rlRun -s "pkcsconf -t" rlAssertGrep "Model: ICA" $rlRun_LOG rlAssertGrep "Model: Soft" $rlRun_LOG + [ "$SLOT" == "4" ] && rlAssertGrep "Model: EP11" $rlRun_LOG rlPhaseEnd rlPhaseStartCleanup From dd6786ef507fbf972d788b3675e51690c8f5bd06 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 27 Sep 2024 10:30:36 +0200 Subject: [PATCH 74/86] Check for ep11-host RPM presence instead --- Sanity/verify-all-HW-tokens-are-available/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/verify-all-HW-tokens-are-available/runtest.sh b/Sanity/verify-all-HW-tokens-are-available/runtest.sh index 2750bb2..1f47bd4 100755 --- a/Sanity/verify-all-HW-tokens-are-available/runtest.sh +++ b/Sanity/verify-all-HW-tokens-are-available/runtest.sh @@ -43,7 +43,7 @@ rlJournalStart rlRun -s "pkcsconf -t" rlAssertGrep "Model: ICA" $rlRun_LOG rlAssertGrep "Model: Soft" $rlRun_LOG - [ "$SLOT" == "4" ] && rlAssertGrep "Model: EP11" $rlRun_LOG + rpm -q ep11-host &>/dev/null && rlAssertGrep "Model: EP11" $rlRun_LOG rlPhaseEnd rlPhaseStartCleanup From be6296bd39b15d6b30af7670e7f05b1f8a6fc96a Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Fri, 27 Sep 2024 11:11:35 +0200 Subject: [PATCH 75/86] Read SLOT numeric value --- Sanity/testsuite/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh index e78a0fa..6f815fd 100755 --- a/Sanity/testsuite/runtest.sh +++ b/Sanity/testsuite/runtest.sh @@ -39,7 +39,7 @@ PACKAGE="opencryptoki" LOGDIR=`mktemp -d` - +[ -z "$SLOT" ] && SLOT=sw function reset_tokens() { rlLogInfo "Reseting tokens..." @@ -84,7 +84,7 @@ rlJournalStart pkcsconf -t # allow to pass SLOT number as a parameter # or take the first available slot (Token) - [ -z "$SLOT" ] && SLOT=`pkcsconf -t | sed -n 's/^Token #\([0-9]\).*/\1/gp' | head -n 1` + SLOT=$( pkcsGetTokenSlot $SLOT ) rlLogInfo "Token under a test" pkcsconf -t -c $SLOT From d337354d3f14ca97894bcb2474cbb777d6e10651 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 21 Oct 2024 16:58:13 +0200 Subject: [PATCH 76/86] Print opencryptoki.conf when pkcsGetTokenSlot fails --- Library/token-manipulation/lib.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Library/token-manipulation/lib.sh b/Library/token-manipulation/lib.sh index f6b37ec..b9647a1 100644 --- a/Library/token-manipulation/lib.sh +++ b/Library/token-manipulation/lib.sh @@ -122,6 +122,9 @@ pkcsGetTokenSlot() { echo $SLOT else echo "Error: pkcsGetTokenSlot: could not find type $TYPE in $CONF" + echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" + cat $CONF + echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" return 1 fi } From 2bde0885ef0412ba61839520c3c6bed1e1c354cf Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 21 Oct 2024 17:03:39 +0200 Subject: [PATCH 77/86] Fix opencryptoki.conf parsing in pkcsGetTokenSlot --- Library/token-manipulation/lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Library/token-manipulation/lib.sh b/Library/token-manipulation/lib.sh index b9647a1..04a4a28 100644 --- a/Library/token-manipulation/lib.sh +++ b/Library/token-manipulation/lib.sh @@ -118,7 +118,7 @@ pkcsGetTokenSlot() { local SLOT [ -z "$TYPE" ] && echo "Error: pkcsGetTokenSlot: no token type specified" && return 1 if grep -q "^stdll = libpkcs11_$TYPE.so" $CONF; then - SLOT=$( egrep "^(slot|stdll = libpkcs11_$TYPE.so)" $CONF | grep -B 1 "libpkcs11" | sed -n -e '1,1 s/slot //' -e '1,1 p' ) + SLOT=$( egrep "(^slot|stdll = libpkcs11_$TYPE.so)" $CONF | grep -B 1 "libpkcs11" | sed -n -e '1,1 s/slot //' -e '1,1 p' ) echo $SLOT else echo "Error: pkcsGetTokenSlot: could not find type $TYPE in $CONF" From 0cc49a3deab21d3fb3e276652dc3017e4852c238 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 21 Oct 2024 17:08:42 +0200 Subject: [PATCH 78/86] Print error to stderr --- Library/token-manipulation/lib.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Library/token-manipulation/lib.sh b/Library/token-manipulation/lib.sh index 04a4a28..f0d7d16 100644 --- a/Library/token-manipulation/lib.sh +++ b/Library/token-manipulation/lib.sh @@ -121,10 +121,10 @@ pkcsGetTokenSlot() { SLOT=$( egrep "(^slot|stdll = libpkcs11_$TYPE.so)" $CONF | grep -B 1 "libpkcs11" | sed -n -e '1,1 s/slot //' -e '1,1 p' ) echo $SLOT else - echo "Error: pkcsGetTokenSlot: could not find type $TYPE in $CONF" - echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" - cat $CONF - echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" + echo "Error: pkcsGetTokenSlot: could not find type $TYPE in $CONF" >&2 + echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" >&2 + cat $CONF >&2 + echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" >&2 return 1 fi } From 6d5950e8607b420cb05022b542bd87d7899ef0ce Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Mon, 21 Oct 2024 17:10:53 +0200 Subject: [PATCH 79/86] Fix condition in pkcsGetTokenSlot --- Library/token-manipulation/lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Library/token-manipulation/lib.sh b/Library/token-manipulation/lib.sh index f0d7d16..4bba22c 100644 --- a/Library/token-manipulation/lib.sh +++ b/Library/token-manipulation/lib.sh @@ -117,7 +117,7 @@ pkcsGetTokenSlot() { local CONF=/etc/opencryptoki/opencryptoki.conf local SLOT [ -z "$TYPE" ] && echo "Error: pkcsGetTokenSlot: no token type specified" && return 1 - if grep -q "^stdll = libpkcs11_$TYPE.so" $CONF; then + if grep -q "stdll = libpkcs11_$TYPE.so" $CONF; then SLOT=$( egrep "(^slot|stdll = libpkcs11_$TYPE.so)" $CONF | grep -B 1 "libpkcs11" | sed -n -e '1,1 s/slot //' -e '1,1 p' ) echo $SLOT else From c1c7d75de4512983c1c519043920e9549cc0d4dc Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Wed, 5 Feb 2025 08:26:33 +0100 Subject: [PATCH 80/86] Added Sanity/opencryptoki-files-ownership --- Sanity/opencryptoki-files-ownership/main.fmf | 24 ++++++ .../opencryptoki-files-ownership/runtest.sh | 81 +++++++++++++++++++ 2 files changed, 105 insertions(+) create mode 100644 Sanity/opencryptoki-files-ownership/main.fmf create mode 100755 Sanity/opencryptoki-files-ownership/runtest.sh diff --git a/Sanity/opencryptoki-files-ownership/main.fmf b/Sanity/opencryptoki-files-ownership/main.fmf new file mode 100644 index 0000000..8c81122 --- /dev/null +++ b/Sanity/opencryptoki-files-ownership/main.fmf @@ -0,0 +1,24 @@ +summary: verify correct file ownership +description: verifies if important opencryptoki files have correct ownership +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-ccatok +- opencryptoki-icsftok +- opencryptoki-icatok +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- Tier1 +tier: '1' +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false diff --git a/Sanity/opencryptoki-files-ownership/runtest.sh b/Sanity/opencryptoki-files-ownership/runtest.sh new file mode 100755 index 0000000..4ed8415 --- /dev/null +++ b/Sanity/opencryptoki-files-ownership/runtest.sh @@ -0,0 +1,81 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +TESTDIR=`pwd` + +function checkFile() { + MUSTEXIST=false + if [ "$1" == "-e" ]; then + MUSTEXIST=true + shift + fi + FILEPATH=$1 + OWNER=$2 + GROUP=$3 + if "$MUSTEXIST" || [ -e "$FILEPATH" ]; then + rlRun "ls -ld $FILEPATH | grep -qE '$OWNER[ ]*$GROUP'" + fi +} + +rlJournalStart + rlPhaseStartTest + rlServiceStart pkcsslotd + rlRun "systemctl status pkcsslotd" 0 "Confirm that pkcsslotd is running" + # verify user account + rlRun -s "id pkcsslotd" + rlRun "grep -E 'groups=.*pkcs11' $rlRun_LOG" + # check /etc/opencryptoki + checkFile -e /etc/opencryptoki/opencryptoki.conf root root + checkFile /etc/opencryptoki/p11sak_defined_attrs.conf root pkcs11 + checkFile /etc/opencryptoki/strength.conf root pkcs11 + # check /run files + checkFile -e /run/lock/opencryptoki/LCK..APIlock pkcsslotd pkcs11 + checkFile -e /run/opencryptoki/pkcsslotd.pid pkcsslotd pkcs11 + checkFile -e /run/opencryptoki/pkcsslotd.socket pkcsslotd pkcs11 + checkFile -e /run/opencryptoki/pkcsslotd.admin.socket pkcsslotd pkcs11 + # check /var/lib/opencryptoki + checkFile -e /var/lib/opencryptoki/HSM_MK_CHANGE root pkcs11 + checkFile -e /var/lib/opencryptoki/swtok root pkcs11 + checkFile -e /var/lib/opencryptoki/swtok/TOK_OBJ root pkcs11 + if rpm -q opencryptoki-ep11tok; then + checkFile -e /var/lib/opencryptoki/ep11tok root pkcs11 + checkFile -e /var/lib/opencryptoki/ep11tok/TOK_OBJ root pkcs11 + fi + if rpm -q opencryptoki-icatok; then + checkFile -e /var/lib/opencryptoki/icatok root pkcs11 + checkFile -e /var/lib/opencryptoki/icatok/TOK_OBJ root pkcs11 + fi + if rpm -q opencryptoki-ccatok; then + checkFile -e /var/lib/opencryptoki/ccatok root pkcs11 + checkFile -e /var/lib/opencryptoki/ccatok/TOK_OBJ root pkcs11 + fi + rlServiceStop pkcsslotd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 5bbd1d2c482e9896d64ea14778145c2f21acb2f4 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Wed, 5 Feb 2025 10:23:11 +0100 Subject: [PATCH 81/86] fix path for icatok --- Sanity/opencryptoki-files-ownership/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Sanity/opencryptoki-files-ownership/runtest.sh b/Sanity/opencryptoki-files-ownership/runtest.sh index 4ed8415..6536fd1 100755 --- a/Sanity/opencryptoki-files-ownership/runtest.sh +++ b/Sanity/opencryptoki-files-ownership/runtest.sh @@ -68,8 +68,8 @@ rlJournalStart checkFile -e /var/lib/opencryptoki/ep11tok/TOK_OBJ root pkcs11 fi if rpm -q opencryptoki-icatok; then - checkFile -e /var/lib/opencryptoki/icatok root pkcs11 - checkFile -e /var/lib/opencryptoki/icatok/TOK_OBJ root pkcs11 + checkFile -e /var/lib/opencryptoki/lite root pkcs11 + checkFile -e /var/lib/opencryptoki/lite/TOK_OBJ root pkcs11 fi if rpm -q opencryptoki-ccatok; then checkFile -e /var/lib/opencryptoki/ccatok root pkcs11 From db4ee0416725deffcbe74f8be94e4c7e5bde7be7 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Tue, 25 Feb 2025 14:05:15 +0100 Subject: [PATCH 82/86] add setup/reboot test --- setup/reboot/main.fmf | 6 +++++ setup/reboot/runtest.sh | 52 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 setup/reboot/main.fmf create mode 100755 setup/reboot/runtest.sh diff --git a/setup/reboot/main.fmf b/setup/reboot/main.fmf new file mode 100644 index 0000000..739c0ea --- /dev/null +++ b/setup/reboot/main.fmf @@ -0,0 +1,6 @@ +summary: reboot test system +description: '' +contact: Karel Srot +test: ./runtest.sh +framework: beakerlib +duration: 15m diff --git a/setup/reboot/runtest.sh b/setup/reboot/runtest.sh new file mode 100755 index 0000000..9b71a29 --- /dev/null +++ b/setup/reboot/runtest.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: reboot test system +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +COOKIE=/var/tmp/opencryptoki-setup-system-rebooted + +rlJournalStart + + if [ ! -e $COOKIE ]; then + rlPhaseStartSetup "pre-reboot phase" + rlRun "uname -a" + rlRun "cat /proc/cmdline" + rlRun "touch $COOKIE" + rlLogInfo "going to reboot now..." + rlPhaseEnd + rhts-reboot + else + rlPhaseStartTest "post-reboot phase" + rlRun "uname -a" + rlRun "cat /proc/cmdline" + rlRun "uptime" + rlRun "rm -f $COOKIE" + rlPhaseEnd + fi + +rlJournalPrintText +rlJournalEnd From 500d1baba8854d246c30e14cc3c7cf1ff6df56bf Mon Sep 17 00:00:00 2001 From: Jakub Heger Date: Thu, 13 Mar 2025 20:30:18 +0000 Subject: [PATCH 83/86] Regression/bz612274: add dependency --- .../main.fmf | 1 + 1 file changed, 1 insertion(+) diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf index 50485a3..cff46b3 100644 --- a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf +++ b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf @@ -19,6 +19,7 @@ recommend: - bzip2 - rpm-build - libica-devel +- systemd-devel duration: 20m enabled: true tag: From ca3e6556cff4835b09e7628ef406adce50831894 Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 20 Mar 2025 13:46:41 +0100 Subject: [PATCH 84/86] Pass --slot attribute to pkcs11-tool --- Update/initialized-ica-token/runtest.sh | 6 +++--- Update/initialized-sw-token/runtest.sh | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Update/initialized-ica-token/runtest.sh b/Update/initialized-ica-token/runtest.sh index d3858bf..35d83e0 100755 --- a/Update/initialized-ica-token/runtest.sh +++ b/Update/initialized-ica-token/runtest.sh @@ -49,7 +49,7 @@ function phaseSetup() { rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" fi rlAssertExists id_rsa.pub - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" rlAssertGrep "Public Key Object" $rlRun_LOG rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E rlPhaseEnd @@ -59,11 +59,11 @@ function phaseSetup() { function phaseTest() { rlPhaseStartTest rlRun "pkcsconf -t" - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" 0 "Verify I still can list imported RSA key" + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" 0 "Verify I still can list imported RSA key" rlAssertGrep "Public Key Object" $rlRun_LOG rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E rlLog "Exporting stored RSA key" - rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" + rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" rlPhaseEnd diff --git a/Update/initialized-sw-token/runtest.sh b/Update/initialized-sw-token/runtest.sh index 78e7e40..494d740 100755 --- a/Update/initialized-sw-token/runtest.sh +++ b/Update/initialized-sw-token/runtest.sh @@ -49,7 +49,7 @@ function phaseSetup() { rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" fi rlAssertExists id_rsa.pub - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" rlAssertGrep "Public Key Object" $rlRun_LOG rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E rlPhaseEnd @@ -59,11 +59,11 @@ function phaseSetup() { function phaseTest() { rlPhaseStartTest rlRun "pkcsconf -t" - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" 0 "Verify I still can list imported RSA key" + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" 0 "Verify I still can list imported RSA key" rlAssertGrep "Public Key Object" $rlRun_LOG rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E rlLog "Exporting stored RSA key" - rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" + rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" rlRun "popd" From 02660ac857ed2ba5cd49afad5419672f1a1c4c5d Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Thu, 20 Mar 2025 15:00:09 +0100 Subject: [PATCH 85/86] added missing SLOT var initialization --- Update/initialized-ica-token/runtest.sh | 1 + Update/initialized-sw-token/runtest.sh | 1 + 2 files changed, 2 insertions(+) diff --git a/Update/initialized-ica-token/runtest.sh b/Update/initialized-ica-token/runtest.sh index 35d83e0..29a992a 100755 --- a/Update/initialized-ica-token/runtest.sh +++ b/Update/initialized-ica-token/runtest.sh @@ -58,6 +58,7 @@ function phaseSetup() { function phaseTest() { rlPhaseStartTest + SLOT=$( pkcsGetTokenSlot ica ) rlRun "pkcsconf -t" rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" 0 "Verify I still can list imported RSA key" rlAssertGrep "Public Key Object" $rlRun_LOG diff --git a/Update/initialized-sw-token/runtest.sh b/Update/initialized-sw-token/runtest.sh index 494d740..397bb0f 100755 --- a/Update/initialized-sw-token/runtest.sh +++ b/Update/initialized-sw-token/runtest.sh @@ -58,6 +58,7 @@ function phaseSetup() { function phaseTest() { rlPhaseStartTest + SLOT=$( pkcsGetTokenSlot sw ) rlRun "pkcsconf -t" rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" 0 "Verify I still can list imported RSA key" rlAssertGrep "Public Key Object" $rlRun_LOG From 7c698747a6ad3b923642390944c2f654111d6c1d Mon Sep 17 00:00:00 2001 From: Karel Srot Date: Wed, 9 Apr 2025 10:49:35 +0200 Subject: [PATCH 86/86] remove migrated tests --- LICENSE | 339 ----------------- Library/token-manipulation/lib.sh | 348 ------------------ Library/token-manipulation/main.fmf | 19 - Library/token-manipulation/runtest.sh | 62 ---- README.md | 5 +- .../main.fmf | 24 -- .../runtest.sh | 54 --- .../main.fmf | 26 -- .../pkcsconf.exp | 46 --- .../runtest.sh | 65 ---- .../main.fmf | 41 --- .../runtest.sh | 88 ----- .../main.fmf | 28 -- .../runtest.sh | 58 --- Sanity/PID-file-location/main.fmf | 30 -- Sanity/PID-file-location/runtest.sh | 64 ---- Sanity/init-token-as-a-nonroot-user/main.fmf | 36 -- .../init-token-as-a-nonroot-user/runtest.sh | 88 ----- Sanity/init-tokens-as-root/main.fmf | 39 -- Sanity/init-tokens-as-root/runtest.sh | 77 ---- .../main.fmf | 28 -- .../runtest.sh | 68 ---- .../icatok.fmf | 9 - .../openCryptoki-PIN-conversion-tool/main.fmf | 41 --- .../runtest.sh | 100 ----- .../swtok.fmf | 5 - Sanity/opencryptoki-files-ownership/main.fmf | 24 -- .../opencryptoki-files-ownership/runtest.sh | 81 ---- .../main.fmf | 35 -- .../runtest.sh | 200 ---------- .../main.fmf | 46 --- .../runtest.sh | 115 ------ Sanity/pkcsstats-basic-functionality/main.fmf | 33 -- .../pkcsstats-basic-functionality/runtest.sh | 126 ------- .../main.fmf | 32 -- .../runtest.sh | 149 -------- Sanity/testsuite/main.fmf | 38 -- Sanity/testsuite/runtest.sh | 237 ------------ .../main.fmf | 31 -- .../runtest.sh | 57 --- .../main.fmf | 30 -- .../runtest.sh | 55 --- Update/dnf-update-opencryptoki/main.fmf | 8 - Update/initialized-ica-token/main.fmf | 30 -- Update/initialized-ica-token/runtest.sh | 122 ------ Update/initialized-sw-token/main.fmf | 29 -- Update/initialized-sw-token/runtest.sh | 123 ------- main.fmf | 2 - plans/opencryptoki-tests-fedora-ci.fmf | 11 - plans/regression.fmf | 10 - setup/reboot/main.fmf | 6 - setup/reboot/runtest.sh | 52 --- 52 files changed, 2 insertions(+), 3468 deletions(-) delete mode 100644 LICENSE delete mode 100644 Library/token-manipulation/lib.sh delete mode 100644 Library/token-manipulation/main.fmf delete mode 100755 Library/token-manipulation/runtest.sh delete mode 100644 Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf delete mode 100755 Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh delete mode 100644 Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf delete mode 100755 Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp delete mode 100755 Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh delete mode 100644 Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf delete mode 100755 Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh delete mode 100644 Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf delete mode 100755 Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh delete mode 100644 Sanity/PID-file-location/main.fmf delete mode 100755 Sanity/PID-file-location/runtest.sh delete mode 100644 Sanity/init-token-as-a-nonroot-user/main.fmf delete mode 100755 Sanity/init-token-as-a-nonroot-user/runtest.sh delete mode 100644 Sanity/init-tokens-as-root/main.fmf delete mode 100755 Sanity/init-tokens-as-root/runtest.sh delete mode 100644 Sanity/lock-files-are-persistent-across-system-reboot/main.fmf delete mode 100755 Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh delete mode 100644 Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf delete mode 100644 Sanity/openCryptoki-PIN-conversion-tool/main.fmf delete mode 100755 Sanity/openCryptoki-PIN-conversion-tool/runtest.sh delete mode 100644 Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf delete mode 100644 Sanity/opencryptoki-files-ownership/main.fmf delete mode 100755 Sanity/opencryptoki-files-ownership/runtest.sh delete mode 100644 Sanity/p11sak-key-management-tool-basic-functionality/main.fmf delete mode 100755 Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh delete mode 100644 Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf delete mode 100755 Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh delete mode 100644 Sanity/pkcsstats-basic-functionality/main.fmf delete mode 100755 Sanity/pkcsstats-basic-functionality/runtest.sh delete mode 100644 Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf delete mode 100755 Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh delete mode 100644 Sanity/testsuite/main.fmf delete mode 100755 Sanity/testsuite/runtest.sh delete mode 100644 Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf delete mode 100755 Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh delete mode 100644 Sanity/verify-all-HW-tokens-are-available/main.fmf delete mode 100755 Sanity/verify-all-HW-tokens-are-available/runtest.sh delete mode 100644 Update/dnf-update-opencryptoki/main.fmf delete mode 100644 Update/initialized-ica-token/main.fmf delete mode 100755 Update/initialized-ica-token/runtest.sh delete mode 100644 Update/initialized-sw-token/main.fmf delete mode 100755 Update/initialized-sw-token/runtest.sh delete mode 100644 main.fmf delete mode 100644 plans/opencryptoki-tests-fedora-ci.fmf delete mode 100644 plans/regression.fmf delete mode 100644 setup/reboot/main.fmf delete mode 100755 setup/reboot/runtest.sh diff --git a/LICENSE b/LICENSE deleted file mode 100644 index d159169..0000000 --- a/LICENSE +++ /dev/null @@ -1,339 +0,0 @@ - GNU GENERAL PUBLIC LICENSE - Version 2, June 1991 - - Copyright (C) 1989, 1991 Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -License is intended to guarantee your freedom to share and change free -software--to make sure the software is free for all its users. This -General Public License applies to most of the Free Software -Foundation's software and to any other program whose authors commit to -using it. (Some other Free Software Foundation software is covered by -the GNU Lesser General Public License instead.) You can apply it to -your programs, too. - - When we speak of free software, we are referring to freedom, not -price. Our General Public Licenses are designed to make sure that you -have the freedom to distribute copies of free software (and charge for -this service if you wish), that you receive source code or can get it -if you want it, that you can change the software or use pieces of it -in new free programs; and that you know you can do these things. - - To protect your rights, we need to make restrictions that forbid -anyone to deny you these rights or to ask you to surrender the rights. -These restrictions translate to certain responsibilities for you if you -distribute copies of the software, or if you modify it. - - For example, if you distribute copies of such a program, whether -gratis or for a fee, you must give the recipients all the rights that -you have. You must make sure that they, too, receive or can get the -source code. And you must show them these terms so they know their -rights. - - We protect your rights with two steps: (1) copyright the software, and -(2) offer you this license which gives you legal permission to copy, -distribute and/or modify the software. - - Also, for each author's protection and ours, we want to make certain -that everyone understands that there is no warranty for this free -software. If the software is modified by someone else and passed on, we -want its recipients to know that what they have is not the original, so -that any problems introduced by others will not reflect on the original -authors' reputations. - - Finally, any free program is threatened constantly by software -patents. We wish to avoid the danger that redistributors of a free -program will individually obtain patent licenses, in effect making the -program proprietary. To prevent this, we have made it clear that any -patent must be licensed for everyone's free use or not licensed at all. - - The precise terms and conditions for copying, distribution and -modification follow. - - GNU GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License applies to any program or other work which contains -a notice placed by the copyright holder saying it may be distributed -under the terms of this General Public License. The "Program", below, -refers to any such program or work, and a "work based on the Program" -means either the Program or any derivative work under copyright law: -that is to say, a work containing the Program or a portion of it, -either verbatim or with modifications and/or translated into another -language. (Hereinafter, translation is included without limitation in -the term "modification".) Each licensee is addressed as "you". - -Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running the Program is not restricted, and the output from the Program -is covered only if its contents constitute a work based on the -Program (independent of having been made by running the Program). -Whether that is true depends on what the Program does. - - 1. You may copy and distribute verbatim copies of the Program's -source code as you receive it, in any medium, provided that you -conspicuously and appropriately publish on each copy an appropriate -copyright notice and disclaimer of warranty; keep intact all the -notices that refer to this License and to the absence of any warranty; -and give any other recipients of the Program a copy of this License -along with the Program. - -You may charge a fee for the physical act of transferring a copy, and -you may at your option offer warranty protection in exchange for a fee. - - 2. You may modify your copy or copies of the Program or any portion -of it, thus forming a work based on the Program, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) You must cause the modified files to carry prominent notices - stating that you changed the files and the date of any change. - - b) You must cause any work that you distribute or publish, that in - whole or in part contains or is derived from the Program or any - part thereof, to be licensed as a whole at no charge to all third - parties under the terms of this License. - - c) If the modified program normally reads commands interactively - when run, you must cause it, when started running for such - interactive use in the most ordinary way, to print or display an - announcement including an appropriate copyright notice and a - notice that there is no warranty (or else, saying that you provide - a warranty) and that users may redistribute the program under - these conditions, and telling the user how to view a copy of this - License. (Exception: if the Program itself is interactive but - does not normally print such an announcement, your work based on - the Program is not required to print an announcement.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Program, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Program, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Program. - -In addition, mere aggregation of another work not based on the Program -with the Program (or with a work based on the Program) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may copy and distribute the Program (or a work based on it, -under Section 2) in object code or executable form under the terms of -Sections 1 and 2 above provided that you also do one of the following: - - a) Accompany it with the complete corresponding machine-readable - source code, which must be distributed under the terms of Sections - 1 and 2 above on a medium customarily used for software interchange; or, - - b) Accompany it with a written offer, valid for at least three - years, to give any third party, for a charge no more than your - cost of physically performing source distribution, a complete - machine-readable copy of the corresponding source code, to be - distributed under the terms of Sections 1 and 2 above on a medium - customarily used for software interchange; or, - - c) Accompany it with the information you received as to the offer - to distribute corresponding source code. (This alternative is - allowed only for noncommercial distribution and only if you - received the program in object code or executable form with such - an offer, in accord with Subsection b above.) - -The source code for a work means the preferred form of the work for -making modifications to it. For an executable work, complete source -code means all the source code for all modules it contains, plus any -associated interface definition files, plus the scripts used to -control compilation and installation of the executable. However, as a -special exception, the source code distributed need not include -anything that is normally distributed (in either source or binary -form) with the major components (compiler, kernel, and so on) of the -operating system on which the executable runs, unless that component -itself accompanies the executable. - -If distribution of executable or object code is made by offering -access to copy from a designated place, then offering equivalent -access to copy the source code from the same place counts as -distribution of the source code, even though third parties are not -compelled to copy the source along with the object code. - - 4. You may not copy, modify, sublicense, or distribute the Program -except as expressly provided under this License. Any attempt -otherwise to copy, modify, sublicense or distribute the Program is -void, and will automatically terminate your rights under this License. -However, parties who have received copies, or rights, from you under -this License will not have their licenses terminated so long as such -parties remain in full compliance. - - 5. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Program or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Program (or any work based on the -Program), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Program or works based on it. - - 6. Each time you redistribute the Program (or any work based on the -Program), the recipient automatically receives a license from the -original licensor to copy, distribute or modify the Program subject to -these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties to -this License. - - 7. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Program at all. For example, if a patent -license would not permit royalty-free redistribution of the Program by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Program. - -If any portion of this section is held invalid or unenforceable under -any particular circumstance, the balance of the section is intended to -apply and the section as a whole is intended to apply in other -circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system, which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 8. If the distribution and/or use of the Program is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Program under this License -may add an explicit geographical distribution limitation excluding -those countries, so that distribution is permitted only in or among -countries not thus excluded. In such case, this License incorporates -the limitation as if written in the body of this License. - - 9. The Free Software Foundation may publish revised and/or new versions -of the General Public License from time to time. Such new versions will -be similar in spirit to the present version, but may differ in detail to -address new problems or concerns. - -Each version is given a distinguishing version number. If the Program -specifies a version number of this License which applies to it and "any -later version", you have the option of following the terms and conditions -either of that version or of any later version published by the Free -Software Foundation. If the Program does not specify a version number of -this License, you may choose any version ever published by the Free Software -Foundation. - - 10. If you wish to incorporate parts of the Program into other free -programs whose distribution conditions are different, write to the author -to ask for permission. For software which is copyrighted by the Free -Software Foundation, write to the Free Software Foundation; we sometimes -make exceptions for this. Our decision will be guided by the two goals -of preserving the free status of all derivatives of our free software and -of promoting the sharing and reuse of software generally. - - NO WARRANTY - - 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY -FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN -OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES -PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED -OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF -MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS -TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE -PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, -REPAIR OR CORRECTION. - - 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING -WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR -REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, -INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING -OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED -TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY -YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER -PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE -POSSIBILITY OF SUCH DAMAGES. - - END OF TERMS AND CONDITIONS - - How to Apply These Terms to Your New Programs - - If you develop a new program, and you want it to be of the greatest -possible use to the public, the best way to achieve this is to make it -free software which everyone can redistribute and change under these terms. - - To do so, attach the following notices to the program. It is safest -to attach them to the start of each source file to most effectively -convey the exclusion of warranty; and each file should have at least -the "copyright" line and a pointer to where the full notice is found. - - - Copyright (C) - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License along - with this program; if not, write to the Free Software Foundation, Inc., - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. - -Also add information on how to contact you by electronic and paper mail. - -If the program is interactive, make it output a short notice like this -when it starts in an interactive mode: - - Gnomovision version 69, Copyright (C) year name of author - Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. - This is free software, and you are welcome to redistribute it - under certain conditions; type `show c' for details. - -The hypothetical commands `show w' and `show c' should show the appropriate -parts of the General Public License. Of course, the commands you use may -be called something other than `show w' and `show c'; they could even be -mouse-clicks or menu items--whatever suits your program. - -You should also get your employer (if you work as a programmer) or your -school, if any, to sign a "copyright disclaimer" for the program, if -necessary. Here is a sample; alter the names: - - Yoyodyne, Inc., hereby disclaims all copyright interest in the program - `Gnomovision' (which makes passes at compilers) written by James Hacker. - - , 1 April 1989 - Ty Coon, President of Vice - -This General Public License does not permit incorporating your program into -proprietary programs. If your program is a subroutine library, you may -consider it more useful to permit linking proprietary applications with the -library. If this is what you want to do, use the GNU Lesser General -Public License instead of this License. diff --git a/Library/token-manipulation/lib.sh b/Library/token-manipulation/lib.sh deleted file mode 100644 index 4bba22c..0000000 --- a/Library/token-manipulation/lib.sh +++ /dev/null @@ -1,348 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# lib.sh of /CoreOS/opencryptoki/Library/token-manipulation -# Description: provides basic function for token manipulation -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# library-prefix = pkcs -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -true <<'=cut' -=pod - -=head1 NAME - -opencryptoki/token-manipulation - provides basic function for token manipulation - -=head1 DESCRIPTION - -The library provides basic function for manipulation with -opencryptoki tokens, like initialization, cleanup etc. - -=cut - -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# Variables -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -true <<'=cut' -=pod - -=head1 VARIABLES - -Below is the list of global variables. When writing a new library, -please make sure that all global variables start with the library -prefix to prevent collisions with other libraries. - -=over - -=item pkcsUSER_PIN - -USER PIN to be used when initializing a token. By default 01234567. - -=item pkcsSO_PIN - -SO PIN to be used when initializing a token. By default 76543210. - -=item pkcsFACTORY_SO_PIN - -Default (factory) SO PIN of a token. Initialized as 87654321. - -=back - -=cut - -export pkcsUSER_PIN -[ -n "$pkcsUSER_PIN" ] || pkcsUSER_PIN="01234567" - -export pkcsSO_PIN -[ -n "$pkcsSO_PIN" ] || pkcsSO_PIN="76543210" - -export pkcsFACTORY_SO_PIN -[ -n "$pkcsFACTORY_SO_PIN" ] || pkcsFACTORY_SO_PIN="87654321" - -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# Functions -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -true <<'=cut' -=pod - -=head1 FUNCTIONS - -=head2 pkcsGetTokenSlot - -Return slot number for a token with specified type. - - pkcsGetTokenSlot type - -=over - -=item type - -Token type to be used. Available options are matching -dynamic library suffixes from /etc/opencryptoki/opencryptoki.conf, -in particular : sw, tpm, ica, cca, ep11 - -=back - -Returns 0 when the initialization was successfull, non-zero otherwise. - -=cut - - -pkcsGetTokenSlot() { - local TYPE=$1 - local CONF=/etc/opencryptoki/opencryptoki.conf - local SLOT - [ -z "$TYPE" ] && echo "Error: pkcsGetTokenSlot: no token type specified" && return 1 - if grep -q "stdll = libpkcs11_$TYPE.so" $CONF; then - SLOT=$( egrep "(^slot|stdll = libpkcs11_$TYPE.so)" $CONF | grep -B 1 "libpkcs11" | sed -n -e '1,1 s/slot //' -e '1,1 p' ) - echo $SLOT - else - echo "Error: pkcsGetTokenSlot: could not find type $TYPE in $CONF" >&2 - echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" >&2 - cat $CONF >&2 - echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" >&2 - return 1 - fi -} - -true <<'=cut' -=pod - -=head2 pkcsInitToken - -Initialize token specified using slot number and sets up -new SO PIN and USER PIN. - - pkcsInitToken type|slot [CURRENT_SO_PIN] - -=over - -=item type - -Token specification using the token type. -Available options are: sw, tpm, ica, cca, ep11. - -=item slot - -Token specification using the slot number. - - -=back - -Returns 0 when the initialization was successfull, non-zero otherwise. - -=cut - -pkcsInitToken() { - - local SLOT - local LABEL="$2" - [ -z $1 ] && echo "Error: pkcsInitToken: No token type specified" - # if token specified using slot number - if echo "$1" | grep -qE '^[0-9]+$'; then - SLOT=$1 - else # specified using token type - SLOT=$( pkcsGetTokenSlot $1 ) || return 1 - fi - echo SLOT: $SLOT - # if label not specified, use the current value - [ -z "$LABEL" ] && LABEL=`pkcsconf -t -c $SLOT | grep 'Label:' | sed 's/^.*Label: //'` - echo LABEL: $LABEL - local SOPIN=$2 - [ -z $SOPIN ] && SOPIN=$pkcsFACTORY_SO_PIN - - echo "pkcsInitToken: Initialize token" - cat < - -=back - -=cut diff --git a/Library/token-manipulation/main.fmf b/Library/token-manipulation/main.fmf deleted file mode 100644 index bc721e6..0000000 --- a/Library/token-manipulation/main.fmf +++ /dev/null @@ -1,19 +0,0 @@ -summary: provides basic function for token manipulation -description: '' -contact: Karel Srot -component: [] -test: ./runtest.sh -framework: beakerlib -recommend: -- opencryptoki -- opencryptoki-swtok -- expect -duration: 5m -enabled: true -adjust: -- enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0607908 -extra-summary: '[pkcs] provides basic function for token manipulation (opencryptoki/token-manipulation)' -extra-task: /CoreOS/opencryptoki/Library/token-manipulation diff --git a/Library/token-manipulation/runtest.sh b/Library/token-manipulation/runtest.sh deleted file mode 100755 index 499e80c..0000000 --- a/Library/token-manipulation/runtest.sh +++ /dev/null @@ -1,62 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/opencryptoki/Library/token-manipulation -# Description: provides basic function for token manipulation -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -PHASE=${PHASE:-Test} - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport ./token-manipulation" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlPhaseEnd - - # Self test - if [[ "$PHASE" =~ "Test" ]]; then - rlPhaseStartTest "Test sw token initialization" - rlServiceStop pkcsslotd - pkcsResetTokens - rlServiceStart pkcsslotd - pkcsInitToken sw - rlRun -s "pkcsconf -t" - rlAssertGrep "USER_PIN_INITIALIZED" $rlRun_LOG - rlServiceStop pkcsslotd - pkcsRestoreTokens - rlServiceRestore pkcsslotd - rlPhaseEnd - fi - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/README.md b/README.md index 5890e7d..3a3dc4f 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,2 @@ -# opencryptoki - -tests for the opencryptoki package \ No newline at end of file +Tests have been moved to a RH internal GitLab CEE instance +/rhel-tests/opencryptoki diff --git a/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf deleted file mode 100644 index 2ca6f1d..0000000 --- a/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf +++ /dev/null @@ -1,24 +0,0 @@ -summary: Test for BZ#1154647 (opencryptoki-libs should Requires(pre)) -description: | - Bug summary: opencryptoki-libs should Requires(pre) shadow-utils - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1154647 -contact: Karel Srot -component: -- opencryptoki -test: ./runtest.sh -framework: beakerlib -recommend: -- opencryptoki -- opencryptoki-libs -duration: 3m -enabled: true -tag: -- TIPpass_Security -- Tier3 -- Tier3security -tier: '3' -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1154647 -extra-nitrate: TC#0430383 -extra-summary: /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre -extra-task: /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre diff --git a/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh deleted file mode 100755 index c919416..0000000 --- a/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh +++ /dev/null @@ -1,54 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre -# Description: Test for BZ#1154647 (opencryptoki-libs should Requires(pre)) -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2014 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlPhaseEnd - - rlPhaseStartTest - if rpm -q --scripts opencryptoki-libs | grep groupadd; then - rlPass "Just check that opencryptoki-libs are calling groupadd" - rlRun -s "rpm -qv --requires opencryptoki-libs" - rlAssertGrep 'pre: shadow-utils' $rlRun_LOG - rm $rlRun_LOG - else - rlLogInfo "This test is not relevant for opencryptoki-libs which does not call grupadd in scripts" - fi - - rlPhaseEnd - - rlPhaseStartCleanup - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf deleted file mode 100644 index 5ad3734..0000000 --- a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf +++ /dev/null @@ -1,26 +0,0 @@ -summary: Tests if validation PIN is actually checked for correctness -description: '' -contact: Karel Srot -component: -- opencryptoki -test: ./runtest.sh -framework: beakerlib -recommend: -- opencryptoki -- opencryptoki-swtok -- opencryptoki-libs -- expect -duration: 5m -enabled: true -tag: -- CI-Tier-1 -- TIPpass_Security -- Tier2 -- Tier2security -- TierCandidatesPASS -tier: '2' -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=415971 -extra-nitrate: TC#0067826 -extra-summary: /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong -extra-task: /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp deleted file mode 100755 index 1752178..0000000 --- a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp +++ /dev/null @@ -1,46 +0,0 @@ -#!/usr/bin/expect -set cmd [lrange $argv 0 0] - -log_user 1 -spawn $cmd -I -c 0 -expect "Enter the SO PIN: " -sleep .1 -send "87654321\r" -sleep .1 -expect "label: " -sleep .1 -send "cryptotest\r" -sleep .1 -expect eof - -spawn $cmd -u -c 0 -expect "Enter the SO PIN: " -sleep .1 -send "87654321\r" -sleep .1 -expect "Enter the new user PIN: " -sleep .1 -send "test\r" -sleep .1 -expect "Re-enter the new user PIN: " -sleep .1 -send "test\r" -sleep .1 -expect eof - -spawn $cmd -p -c 0 -expect "Enter user PIN: " -sleep .1 -send "test\r" -sleep .1 -expect "Enter the new user PIN: " -sleep .1 -send "text\r" -sleep .1 -expect "Re-enter the new user PIN: " -sleep .1 -send "text1\r" -sleep .1 -expect eof - - diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh deleted file mode 100755 index 086e463..0000000 --- a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh +++ /dev/null @@ -1,65 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong -# Description: Tests if validation PIN is actually checked for correctness -# Author: Miroslav Vadkerti -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -PKCSCONF="pkcsconf" - -TMP=`mktemp` - -function reset_tokens() { - rlLogInfo "Reseting tokens..." - rlServiceStop pkcsslotd - rlRun "find /var/lib/opencryptoki/ -type f -exec rm {} \\;" - rlServiceStart pkcsslotd - rlLogInfo "--- reset finished ---" -} - - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlFileBackup --clean /var/lib/opencryptoki - [ -d /etc/opencryptoki ] && rlFileBackup --clean /etc/opencryptoki - reset_tokens - rlPhaseEnd - - rlPhaseStartTest - rlRun "./pkcsconf.exp $PKCSCONF 2>&1 | tee $TMP" - rlAssertGrep "Invalid new user pin|New PINs do not match." $TMP -E - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf $TMP" - rlFileRestore - rlServiceRestore pkcsslotd - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf deleted file mode 100644 index cff46b3..0000000 --- a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf +++ /dev/null @@ -1,41 +0,0 @@ -summary: Opencryptoki-session-object-performance-degradation -description: | - Tests if overall performance of cryptographic operations degrades exponentially - with the number of objects per token or open sessions per process -contact: Karel Srot -component: -- openCryptoki -test: ./runtest.sh -framework: beakerlib -recommend: -- opencryptoki -- opencryptoki-swtok -- gcc -- automake -- libtool -- openssl-devel -- expect -- yum-utils -- bzip2 -- rpm-build -- libica-devel -- systemd-devel -duration: 20m -enabled: true -tag: -- TIPpass_Security -- Tier3 -- Tier3security -- rhel8-buildroot -- rhel9-buildroot -tier: '3' -adjust: -- enabled: false - when: arch == ia64 - continue: false -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=612274 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=627560 -extra-nitrate: TC#0075518 -extra-summary: /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation -extra-task: /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh deleted file mode 100755 index 391d4cc..0000000 --- a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh +++ /dev/null @@ -1,88 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation -# Description: Tests if overall performance of cryptographic operations degrades exponentially with the number of objects per token or open sessions per process -# Author: Miroslav Vadkerti -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2010 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -PACKAGES="gcc automake libtool openssl-devel expect" -TMPDIR=`mktemp -d` -TMP=`mktemp` -SRC="src.tbz" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - for PKG in $PACKAGES; do - rlAssertRpm $PKG - done - PKGVER=`rpm -q --qf '%{VERSION}' opencryptoki` - rlServiceStart "pkcsslotd" - # use always software slot - # SLOT=$(($(pkcsconf -s | grep -B1 Soft | grep -o '#[0-9]' | tr -d '#')-1)) - SLOT=$(pkcsconf -s | egrep -B1 '(Soft|Linux)' | grep -o '#[0-9]' | tr -d '#') - rlLog "Using slot $SLOT" - rlRun "pushd ." - rlRun "cd $TMPDIR" - rlFetchSrcForInstalled opencryptoki - rlRun "yum-builddep -y opencryptoki*src.rpm" - rlRun "rpm -i opencryptoki*src.rpm" - - # opencryptoki version >= 3.11.0 needs to enable building test cases during the pkg build - rlRun "sed -i 's/^%configure /%configure --enable-testcases /' ~/rpmbuild/SPECS/opencryptoki.spec" - rlRun "rpmbuild -bp ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Preparing builddir" - TESTDIR=`ls -d ~/rpmbuild/BUILD/opencryptoki*/testcases` - rlRun "pushd . && cd $TESTDIR" - rlRun "sed -i 's/50000/10000/g' pkcs11/sess_perf.c" 0 "Adjusting testcase" - rlRun "rpmbuild -bc --short-circuit ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Building opencryptoki files" - popd - rlPhaseEnd - - rlPhaseStartTest - cd $TESTDIR - if [ -d driver ]; then - rlRun "cd driver" - rlRun "./sess_perf_tests -slot $SLOT | tee $TMP" - else - rlRun "cd pkcs11" - rlRun "./sess_bench -slot $SLOT | tee $TMP" - fi - rlRun "cat $TMP | grep CKR" 1 "Checking for errors" - # Count the number occurrences when performance test time exceeds >10ms - # In buggy version this will happen a lot and the performance will degrade. - # The count (3) currently tested may need more adjustment. - COUNT=$(cat $TMP | grep Time | egrep -c '[0-9][0-9]+') - rlAssertGreater "Checking performance" 3 $COUNT - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -rf $TMPDIR $TMP" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf b/Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf deleted file mode 100644 index 40b6ccc..0000000 --- a/Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf +++ /dev/null @@ -1,28 +0,0 @@ -summary: Checks if root is not added to the pkcs11 group -description: -contact: Karel Srot -component: -- opencryptoki -test: ./runtest.sh -framework: beakerlib -recommend: -- opencryptoki -environment: - AVC_ERROR: +no_avc_check -duration: 15m -enabled: true -tag: -- TIPpass_Security -- Tier3 -- Tier3security -tier: '3' -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=732756 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=833828 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1054442 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1013017 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=833818 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1058814 -extra-nitrate: TC#0111303 -extra-summary: /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group -extra-task: /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group diff --git a/Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh b/Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh deleted file mode 100755 index a339076..0000000 --- a/Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh +++ /dev/null @@ -1,58 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group -# Description: Checks if root is not added to the pkcs11 group and opencryptoki works well in this case -# Author: Miroslav Vadkerti -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -ROOT=$(mktemp -d) - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - if rlIsFedora '>=22'; then - # dnf is not able to use system relesever when changing installroot (#1173107) - RELEASEVER=$(. /etc/os-release; echo $VERSION_ID) - rlRun -s "dnf -y install --nogpg --releasever=$RELEASEVER --installroot=$ROOT opencryptoki opencryptoki-swtok 2>&1" - rlAssertNotGrep "group pkcs11 does not exist" $rlRun_LOG - else - rlRun -s "yum -y install --nogpg --installroot=$ROOT opencryptoki opencryptoki-swtok 2>&1" - rlAssertNotGrep "group pkcs11 does not exist" $rlRun_LOG - fi - rlPhaseEnd - - rlPhaseStartTest "pkcs11 group should exist but root should not be a member" - rlAssertGrep "^pkcs11" "$ROOT/etc/group" -E - rlAssertNotGrep "^pkcs11.*root" "$ROOT/etc/group" -E - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -rf $ROOT" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/PID-file-location/main.fmf b/Sanity/PID-file-location/main.fmf deleted file mode 100644 index 3036ec6..0000000 --- a/Sanity/PID-file-location/main.fmf +++ /dev/null @@ -1,30 +0,0 @@ -summary: Test for BZ#1974693 (pkcsslotd PIDfile below legacy directory /var/run/) -description: | - Bug summary: pkcsslotd PIDfile below legacy directory /var/run/ - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1974693 -contact: Karel Srot -component: -- opencryptoki -test: ./runtest.sh -framework: beakerlib -require: - - library(nvr/nvr) -recommend: -- opencryptoki -- opencryptoki-swtok -- opencryptoki-tpmtok -- opencryptoki-icsftok -- opencryptoki-icatok -- opencryptoki-ccatok -duration: 2m -enabled: true -tag: -- Tier1 -- CI-Tier-1 -adjust: -- enabled: false - when: "distro == rhel-7 or distro < rhel-8.9" - continue: false -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974693 -extra-nitrate: TC#0611070 diff --git a/Sanity/PID-file-location/runtest.sh b/Sanity/PID-file-location/runtest.sh deleted file mode 100755 index a6544b8..0000000 --- a/Sanity/PID-file-location/runtest.sh +++ /dev/null @@ -1,64 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Description: Test for BZ#1974693 (pkcsslotd PIDfile below legacy directory /var/run/) -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2014 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -UNITFILE="/usr/lib/systemd/system/pkcsslotd.service" - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" - rlAssertRpm $PACKAGE - rlAssertExists $UNITFILE - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlServiceStop pkcsslotd - rlPhaseEnd - - rlPhaseStartTest - PIDFILE=/run/opencryptoki/pkcsslotd.pid - nvrTestPackage opencryptoki '<' 3.21.0 && PIDFILE=/run/pkcsslotd.pid - - rlAssertGrep "PIDFile=$PIDFILE" $UNITFILE - rlServiceStart pkcsslotd - rlRun -s "journalctl -u pkcsslotd -S '-10s'" - #rlAssertGrep "PID File created" $rlRun_LOG - rlAssertGrep "Started (pkcsslotd.service)?.*Daemon" $rlRun_LOG -E - rlAssertNotGrep "PIDFile= references a path below legacy directory" $rlRun_LOG - rlAssertExists $PIDFILE - rlPhaseEnd - - rlPhaseStartCleanup - rlServiceRestore pkcsslotd - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd - -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/init-token-as-a-nonroot-user/main.fmf b/Sanity/init-token-as-a-nonroot-user/main.fmf deleted file mode 100644 index d4a9e28..0000000 --- a/Sanity/init-token-as-a-nonroot-user/main.fmf +++ /dev/null @@ -1,36 +0,0 @@ -summary: basic token initialization as a nonroot user -description: basic token initialization as a nonroot user -contact: Karel Srot -component: -- openCryptoki -test: ./runtest.sh -framework: beakerlib -require: -- library(nvr/nvr) -- url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation -recommend: -- opencryptoki -- opencryptoki-swtok -- opencryptoki-tpmtok -- opencryptoki-ccatok -- opencryptoki-icsftok -- opencryptoki-icatok -- expect -duration: 5m -enabled: true -tag: -- CI-Tier-1 -- NoRHEL4 -- NoRHEL5 -- TIPpass_Security -- Tier1 -- Tier1security -tier: '1' -adjust: -- enabled: false - when: distro == rhel-4, rhel-5 - continue: false -extra-nitrate: TC#0342770 -extra-summary: /CoreOS/openCryptoki/Sanity/bz1054661-init-token-as-a-nonroot-user -extra-task: /CoreOS/openCryptoki/Sanity/bz1054661-init-token-as-a-nonroot-user diff --git a/Sanity/init-token-as-a-nonroot-user/runtest.sh b/Sanity/init-token-as-a-nonroot-user/runtest.sh deleted file mode 100755 index 3f69d25..0000000 --- a/Sanity/init-token-as-a-nonroot-user/runtest.sh +++ /dev/null @@ -1,88 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/openCryptoki/Sanity/bz1054661-init-token-as-a-nonroot-user -# Description: basic token initialization as a nonroot user -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2014 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -USER="user$RANDOM" - -TESTDIR=`pwd` - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library" - # need to find out the library path so a user can import it too - rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library" - LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'` - echo "LIBPATH=$LIBPATH" - rlAssertRpm $PACKAGE - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlRun "useradd -m $USER -G pkcs11" - rlRun -s "su $USER -c 'id'" - rlAssertGrep "pkcs11" $rlRun_LOG - rlServiceStop pkcsslotd - rlRun "pkcsResetTokens" - rlServiceStart pkcsslotd - rlPhaseEnd - - rlPhaseStartTest "listing available tokens as a testuser" - rlRun "su $USER -c 'pkcsconf -t' &> query1.log" - cat query1.log - if nvrTestPackage opencryptoki '<' 3.14.0; then - rlAssertGrep "Model: IBM SoftTok" query1.log - else - rlAssertGrep "Model: Soft " query1.log - fi - rlPhaseEnd - - # initialize every token available - for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do - - rlPhaseStartTest "initialize token #$SLOT" - rlRun "su $USER -c 'source $LIBPATH && pkcsInitToken $SLOT'" - rlRun "su $USER -c 'pkcsconf -t -c $SLOT' &> query2.log" - cat query2.log - rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E - rlPhaseEnd - - done - - rlPhaseStartCleanup - rlServiceStop pkcsslotd - rlRun "pkcsRestoreTokens" - rlServiceRestore pkcsslotd - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlLog "Waiting 12 for systemd --user process to exit..." - sleep 15 - rlRun "userdel -r $USER" || ps -ef - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/init-tokens-as-root/main.fmf b/Sanity/init-tokens-as-root/main.fmf deleted file mode 100644 index 55d6cd1..0000000 --- a/Sanity/init-tokens-as-root/main.fmf +++ /dev/null @@ -1,39 +0,0 @@ -summary: Initialize all available tokens as a root user -description: | - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1122505 -contact: Karel Srot -component: -- openCryptoki -test: ./runtest.sh -framework: beakerlib -require: -- library(nvr/nvr) -- url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation -recommend: -- opencryptoki -- opencryptoki-swtok -- opencryptoki-tpmtok -- opencryptoki-ccatok -- opencryptoki-icsftok -- opencryptoki-icatok -- expect -duration: 5m -enabled: true -tag: -- CI-Tier-1 -- NoRHEL4 -- NoRHEL5 -- TIPpass_FIPS -- TIPpass_Security -- Tier1 -- Tier1security -- TierCandidatesPASS -tier: '1' -adjust: -- enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0470488 -extra-summary: /CoreOS/opencryptoki/Sanity/init-tokens-as-root -extra-task: /CoreOS/opencryptoki/Sanity/init-tokens-as-root diff --git a/Sanity/init-tokens-as-root/runtest.sh b/Sanity/init-tokens-as-root/runtest.sh deleted file mode 100755 index e57e47f..0000000 --- a/Sanity/init-tokens-as-root/runtest.sh +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/opencryptoki/Sanity/init-tokens-as-root -# Description: Test for BZ#1122505 (opencryptoki sw token no longer found after rebase) -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2015 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -TESTDIR=`pwd` - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library" - rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" - rlAssertRpm $PACKAGE - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlServiceStop pkcsslotd - rlRun "pkcsResetTokens" - rlRun "id root | grep pkcs11" 1 "Verify that root is not in pkcs11 group" - rlServiceStart pkcsslotd - rlPhaseEnd - - rlPhaseStartTest "listing available tokens as root" - rlRun "pkcsconf -t &> query1.log" - cat query1.log - if nvrTestPackage opencryptoki '<' 3.14.0; then - rlAssertGrep "Model: IBM SoftTok" query1.log - else - rlAssertGrep "Model: Soft " query1.log - fi - rlPhaseEnd - - # initialize every token available - for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do - - rlPhaseStartTest "initialize token #$SLOT as root" - rlRun "pkcsInitToken $SLOT" - rlRun "pkcsconf -t -c $SLOT &> query2.log" - cat query2.log - rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E - rlPhaseEnd - done - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlServiceStop pkcsslotd - rlRun "pkcsRestoreTokens" - rlServiceRestore pkcsslotd - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/lock-files-are-persistent-across-system-reboot/main.fmf b/Sanity/lock-files-are-persistent-across-system-reboot/main.fmf deleted file mode 100644 index e957fbb..0000000 --- a/Sanity/lock-files-are-persistent-across-system-reboot/main.fmf +++ /dev/null @@ -1,28 +0,0 @@ -summary: Test for BZ#1054442 (lock files are not persistent after system reboot) -description: | - Bug summary: lock files are not persistent after system reboot even though the lock files are entered in tmpfiles.d (opencryptoki) - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1054442 -contact: Karel Srot -component: -- opencryptoki -test: ./runtest.sh -framework: beakerlib -recommend: -- opencryptoki -- opencryptoki-swtok -- opencryptoki-tpmtok -- opencryptoki-icsftok -- opencryptoki-icatok -- opencryptoki-ccatok -duration: 15m -enabled: true -tag: -- TIPpass_FIPS -- TIPpass_Security -- TierCandidatesPASS -- notier -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1054442 -extra-nitrate: TC#0336748 -extra-summary: /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot -extra-task: /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot diff --git a/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh b/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh deleted file mode 100755 index b5b691c..0000000 --- a/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot -# Description: Test for BZ#1054442 (lock files are not persistent after system reboot) -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2014 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlServiceStart pkcsslotd - rlPhaseEnd - - rlPhaseStartTest - if arch | grep s390; then - SUBDIRS="ccatok icsf lite swtok" - else - SUBDIRS="icsf swtok" - fi - rlIsRHEL '<=8' && SUBDIRS="$SUBDIRS tpm" - for DIR in $SUBDIRS; do - rlAssertExists /var/lib/opencryptoki/$DIR - done - rlAssertExists /var/lock/opencryptoki - rlAssertExists /var/lock/opencryptoki/LCK..APIlock - if [ ! -f /bz1054442-rebooted ]; then - touch /bz1054442-rebooted - rlRun "rhts-reboot" - else - rlRun "rm /bz1054442-rebooted" - fi - rlPhaseEnd - - rlPhaseStartCleanup - rlServiceRestore pkcsslotd - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf deleted file mode 100644 index 2f7a713..0000000 --- a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf +++ /dev/null @@ -1,9 +0,0 @@ -summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=ica -environment: - TOKEN: ica -adjust: -- enabled: false - when: arch != s390x - continue: false -extra-nitrate: TC#0611373 -extra-summary: TOKEN=ICA /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf deleted file mode 100644 index c70fcf6..0000000 --- a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf +++ /dev/null @@ -1,41 +0,0 @@ -summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) -description: | - Bug summary: [IBM 8.3 FEAT] openCryptoki: PIN conversion tool - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 -contact: Karel Srot -component: -- openCryptoki -test: ./runtest.sh -framework: beakerlib -require: -- url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation -recommend: -- opencryptoki -- opencryptoki-swtok -- opencryptoki-icatok -- openssl -- gnutls-utils -- opensc -- expect -duration: 5m -enabled: true -tag: -- CI-Tier-1 -- NoRHEL4 -- NoRHEL5 -- NoRHEL6 -- NoRHEL7 -- Tier1 -tier: '1' -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1853420 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1964304 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1995919 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1987256 -adjust: -- enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-task: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh deleted file mode 100755 index 8f27406..0000000 --- a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh +++ /dev/null @@ -1,100 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool -# Description: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" - -[ -n "$TOKEN" ] || TOKEN=sw -[ "$TOKEN" == "sw" ] && STORE=/var/lib/opencryptoki/swtok -[ "$TOKEN" == "ica" ] && STORE=/var/lib/opencryptoki/lite - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlFileBackup /etc/opencryptoki/opencryptoki.conf - [ -f /etc/opencryptoki/opencryptoki.conf_BAK ] && rlFileBackup /etc/opencryptoki/opencryptoki.conf_BAK && rlRun "rm -f /etc/opencryptoki/opencryptoki.conf_BAK" - rlServiceStop pkcsslotd - rlRun "pkcsResetTokens" - rlServiceStart pkcsslotd - sleep 1 - rlRun "pkcsconf -t" - SLOT=$( pkcsGetTokenSlot $TOKEN ) - MODEL=$( pkcsconf -t -c $SLOT | awk '/Model:/ { print $2 }' ) - rlServiceStop pkcsslotd - rlRun "pkcsResetTokens" - rlRun "sed -i '/tokversion = 3.12/d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present" - # add token description to reproduce bz#1987256 - TEXT='description = "My Token"\nmanufacturer = "MyCompany Inc."' - rlRun "sed -i 's/stdll = libpkcs11_$TOKEN.so/description = \\\"My Token\\\"\nmanufacturer = \\\"MyCompany Inc\\\"\nstdll = libpkcs11_$TOKEN.so/' /etc/opencryptoki/opencryptoki.conf" - rlServiceStart pkcsslotd - # initialize token - rlRun "pkcsInitToken $SLOT" - rlRun "pkcsconf -t" - rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:model=${MODEL};manufacturer=IBM' --label id_rsa.pub" - rlAssertExists id_rsa.pub - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" - rlAssertGrep "Public Key Object" $rlRun_LOG - rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E - rlPhaseEnd - - rlPhaseStartTest "Token migration" - rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" 1 - rlAssertGrep "pkcstok_migrate: Please stop pkcsslotd before running this utility" $rlRun_LOG - rlServiceStop pkcsslotd - sleep 5 - systemctl status pkcsslotd --no-pager - rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" - rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG - grep -A 5 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf - rlRun "grep -A 5 -i 'slot $SLOT' /etc/opencryptoki/opencryptoki.conf | grep 'tokversion = 3.12'" 0 "Verify that slot configuration has been updated with 'tokversion = 3.12'" - rlServiceStart pkcsslotd - sleep 1 - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" 0 "Verify I still can list imported RSA key" - rlAssertGrep "Public Key Object" $rlRun_LOG - rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E - rlLog "Exporting stored RSA key" - rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der --slot 0x$SLOT" - rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" - rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" - rlPhaseEnd - - rlPhaseStartCleanup - rlServiceStop pkcsslotd - rlRun "pkcsRestoreTokens" - rlFileRestore - rlServiceRestore pkcsslotd - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf deleted file mode 100644 index 1bee0ce..0000000 --- a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf +++ /dev/null @@ -1,5 +0,0 @@ -summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=sw -environment: - TOKEN: sw -extra-nitrate: TC#0607912 -extra-summary: TOKEN=sw /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/opencryptoki-files-ownership/main.fmf b/Sanity/opencryptoki-files-ownership/main.fmf deleted file mode 100644 index 8c81122..0000000 --- a/Sanity/opencryptoki-files-ownership/main.fmf +++ /dev/null @@ -1,24 +0,0 @@ -summary: verify correct file ownership -description: verifies if important opencryptoki files have correct ownership -contact: Karel Srot -component: -- opencryptoki -test: ./runtest.sh -framework: beakerlib -recommend: -- opencryptoki -- opencryptoki-swtok -- opencryptoki-tpmtok -- opencryptoki-ccatok -- opencryptoki-icsftok -- opencryptoki-icatok -duration: 5m -enabled: true -tag: -- CI-Tier-1 -- Tier1 -tier: '1' -adjust: -- enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 - continue: false diff --git a/Sanity/opencryptoki-files-ownership/runtest.sh b/Sanity/opencryptoki-files-ownership/runtest.sh deleted file mode 100755 index 6536fd1..0000000 --- a/Sanity/opencryptoki-files-ownership/runtest.sh +++ /dev/null @@ -1,81 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2025 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -TESTDIR=`pwd` - -function checkFile() { - MUSTEXIST=false - if [ "$1" == "-e" ]; then - MUSTEXIST=true - shift - fi - FILEPATH=$1 - OWNER=$2 - GROUP=$3 - if "$MUSTEXIST" || [ -e "$FILEPATH" ]; then - rlRun "ls -ld $FILEPATH | grep -qE '$OWNER[ ]*$GROUP'" - fi -} - -rlJournalStart - rlPhaseStartTest - rlServiceStart pkcsslotd - rlRun "systemctl status pkcsslotd" 0 "Confirm that pkcsslotd is running" - # verify user account - rlRun -s "id pkcsslotd" - rlRun "grep -E 'groups=.*pkcs11' $rlRun_LOG" - # check /etc/opencryptoki - checkFile -e /etc/opencryptoki/opencryptoki.conf root root - checkFile /etc/opencryptoki/p11sak_defined_attrs.conf root pkcs11 - checkFile /etc/opencryptoki/strength.conf root pkcs11 - # check /run files - checkFile -e /run/lock/opencryptoki/LCK..APIlock pkcsslotd pkcs11 - checkFile -e /run/opencryptoki/pkcsslotd.pid pkcsslotd pkcs11 - checkFile -e /run/opencryptoki/pkcsslotd.socket pkcsslotd pkcs11 - checkFile -e /run/opencryptoki/pkcsslotd.admin.socket pkcsslotd pkcs11 - # check /var/lib/opencryptoki - checkFile -e /var/lib/opencryptoki/HSM_MK_CHANGE root pkcs11 - checkFile -e /var/lib/opencryptoki/swtok root pkcs11 - checkFile -e /var/lib/opencryptoki/swtok/TOK_OBJ root pkcs11 - if rpm -q opencryptoki-ep11tok; then - checkFile -e /var/lib/opencryptoki/ep11tok root pkcs11 - checkFile -e /var/lib/opencryptoki/ep11tok/TOK_OBJ root pkcs11 - fi - if rpm -q opencryptoki-icatok; then - checkFile -e /var/lib/opencryptoki/lite root pkcs11 - checkFile -e /var/lib/opencryptoki/lite/TOK_OBJ root pkcs11 - fi - if rpm -q opencryptoki-ccatok; then - checkFile -e /var/lib/opencryptoki/ccatok root pkcs11 - checkFile -e /var/lib/opencryptoki/ccatok/TOK_OBJ root pkcs11 - fi - rlServiceStop pkcsslotd - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf deleted file mode 100644 index 9105e0d..0000000 --- a/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf +++ /dev/null @@ -1,35 +0,0 @@ -summary: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool) -description: | - Bug summary: [IBM 8.3 FEAT] openCryptoki key management tool: list keys function - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 -contact: Karel Srot -component: - - openCryptoki -test: ./runtest.sh -framework: beakerlib -require: - - library(nvr/nvr) - - url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation -recommend: - - opencryptoki - - opencryptoki-swtok - - expect -duration: 5m -enabled: true -tag: - - CI-Tier-1 - - Tier1 - - customer_scenario -tier: '1' -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851109 -adjust: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false -extra-nitrate: TC#0607944 -extra-summary: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality -extra-task: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality -id: 065dda66-85f0-4142-83d3-b4104d359d41 diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh deleted file mode 100755 index d54f273..0000000 --- a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh +++ /dev/null @@ -1,200 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality -# Description: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool) -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -[ -n "$SLOT" ] || SLOT=sw - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" - rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlFileBackup /etc/opencryptoki/opencryptoki.conf - rlServiceStop pkcsslotd - rlRun "pkcsResetTokens" - rlServiceStart pkcsslotd - sleep 1 - rlRun "pkcsconf -t | grep 'Soft'" - SLOT=$( pkcsGetTokenSlot $SLOT ) - rlRun "pkcsInitToken $SLOT" - rlRun "pkcsconf -t" - rlPhaseEnd - - rlPhaseStartTest "Test key generation and listing" - rlRun -s "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlAssertGrep 'Generate symmetric key AES with keylen=128 and label="?\[aes_key\]"?' $rlRun_LOG -E - rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG - else - rlAssertGrep 'Successfully generated a AES key with label "aes_key".' $rlRun_LOG - fi - rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E - - rlRun -s "p11sak gen-key 3des --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlAssertGrep 'Generate symmetric key 3DES with keylen=192 and label="?\[3des_key\]"?' $rlRun_LOG -E - rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG - else - rlAssertGrep 'Successfully generated a 3DES key with label "3des_key".' $rlRun_LOG - fi - rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep '3DES | "?3des_key"?' $rlRun_LOG -E - - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlRun -s "p11sak gen-key rsa 2048 --exponent 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" - rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG - rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG - else - rlRun -s "p11sak gen-key rsa 2048 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" - rlAssertGrep 'Successfully generated a RSA key pair with labels "rsa_key:pub":"rsa_key:prv".' $rlRun_LOG - fi - rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep 'public RSA | "?rsa_key:pub"?' $rlRun_LOG -E - rlAssertGrep 'private RSA | "?rsa_key:prv"?' $rlRun_LOG -E - - rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG - else - rlAssertGrep 'Successfully generated a EC key pair with labels "ec_key:pub":"ec_key:prv".' $rlRun_LOG - fi - rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep 'Label: "?aes_key"?' $rlRun_LOG -E - rlAssertGrep 'Label: "?3des_key"?' $rlRun_LOG -E - rlAssertNotGrep 'Label: "?rsa_key"?' $rlRun_LOG -E - - rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep 'Label: "?rsa_key:prv"?' $rlRun_LOG -E - rlAssertNotGrep 'Label: "?rsa_key:pub"?' $rlRun_LOG -E - rlPhaseEnd - -if nvrTestPackage opencryptoki '>=' 3.17.0; then - rlPhaseStartTest "Test p11sak_defined_attrs.conf adjustment" - rlFileBackup /etc/opencryptoki/p11sak_defined_attrs.conf - rlRun "cat >> /etc/opencryptoki/p11sak_defined_attrs.conf <<_EOF -attribute { - name = CKA_PRIME_1 - id = 0x00000124 - type = CK_BYTE -} - -_EOF" - rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlAssertGrep "CKA_PRIME_1: len=128 value:" $rlRun_LOG - else - rlAssertGrep "CKA_PRIME_1: \[sensitive\]" $rlRun_LOG - fi - rlPhaseEnd -fi - -if nvrTestPackage opencryptoki '>=' 3.15.0; then - rlPhaseStartTest "Test key removal" - rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlAssertGrep "Skip deleting Key. User input CKR_CANCEL" $rlRun_LOG - else - rlAssertGrep "1 key object(s) skipped." $rlRun_LOG - fi - rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "aes_key" $rlRun_LOG - - rlRun -s "echo n | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlAssertGrep "Skip deleting Key" $rlRun_LOG - else - rlAssertGrep "1 key object(s) skipped." $rlRun_LOG - fi - rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep "aes_key" $rlRun_LOG - - rlRun -s "echo y | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlAssertGrep "Object with Label: aes_key found and destroyed" $rlRun_LOG - else - rlAssertGrep 'Successfully removed AES 128 key object "aes_key".' $rlRun_LOG - rlAssertGrep "1 key object(s) removed." $rlRun_LOG - fi - rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertNotGrep "aes_key" $rlRun_LOG - - rlRun -s "p11sak rm-key 3des --force --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlAssertGrep "Object with Label: 3des_key found and destroyed" $rlRun_LOG - else - rlAssertGrep 'Successfully removed 3DES key object "3des_key".' $rlRun_LOG - rlAssertGrep "1 key object(s) removed." $rlRun_LOG - fi - rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertNotGrep "3des_key" $rlRun_LOG - - rlRun -s "p11sak rm rsa --force --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key:pub" - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlAssertGrep "Object with Label: rsa_key:pub found and destroyed" $rlRun_LOG - else - rlAssertGrep 'Successfully removed public RSA 2048 key object "rsa_key:pub".' $rlRun_LOG - rlAssertGrep "1 key object(s) removed." $rlRun_LOG - fi - rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertNotGrep "rsa_key:pub" $rlRun_LOG - rlPhaseEnd -fi - - rlPhaseStartTest "Test help printing" - rlRun -s "p11sak --help" - rlAssertGrep "Usage: p11sak COMMAND \[ARGS\] \[OPTIONS\]" $rlRun_LOG - - rlRun -s "p11sak generate-key --help" 0,7 - rlAssertGrep "Usage: p11sak generate-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG - - rlRun -s "p11sak list-key --help" 0,7 - rlAssertGrep "Usage: p11sak list-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG - - -if nvrTestPackage opencryptoki '>=' 3.15.0; then - rlRun -s "p11sak remove-key --help" 0,7 - rlAssertGrep "Usage: p11sak remove-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG -fi - rlPhaseEnd - - rlPhaseStartCleanup - rlServiceStop pkcsslotd - rlRun "pkcsRestoreTokens" - rlFileRestore - rlServiceRestore pkcsslotd - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf deleted file mode 100644 index 13b45b4..0000000 --- a/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf +++ /dev/null @@ -1,46 +0,0 @@ -summary: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories) -description: | - Bug summary: RHEL7.3 - patch to create lock and log directories from opencryptoki - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1343671 -contact: Karel Srot -component: -- openCryptoki -test: ./runtest.sh -framework: beakerlib -require: -- library(nvr/nvr) -- url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation -recommend: -- opencryptoki -- opencryptoki-swtok -- opencryptoki-tpmtok -- opencryptoki-ccatok -- opencryptoki-icsftok -- opencryptoki-icatok -- expect -- libselinux-utils -- policycoreutils -duration: 5m -enabled: true -tag: -- CI-Tier-1 -- NoRHEL4 -- NoRHEL5 -- NoRHEL6 -- TIPpass_Security -- Tier1 -- Tier1security -- TierCandidatesPASS -tier: '1' -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1343671 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373833 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697489 -adjust: -- enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0532369 -extra-summary: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories -extra-task: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh deleted file mode 100755 index b803b51..0000000 --- a/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh +++ /dev/null @@ -1,115 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories -# Description: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories) -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2016 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" - -USER="bz1343671user" - -TESTDIR=`pwd` - -LOCKDIR=/run/lock # see bz#1373833 -rlIsRHEL '<7' && LOCKDIR=/var/lock - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" - rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library" - # need library path so we can import it as a test user - LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'` - echo "LIBPATH=$LIBPATH" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlServiceStop pkcsslotd - pkcsResetTokens - rlFileBackup --clean /var/lib/opencryptoki /var/log/opencryptoki $LOCKDIR/opencryptoki - # avoid using /var/lock symlink to properly test bug 1373833 - if [ "$LOCKDIR" == "/run/lock" ]; then - [ -L /var/lock ] && rlFileBackup /var/lock && rlRun "rm -f /var/lock" - fi - rlRun "useradd -m $USER -G pkcs11" - rlPhaseEnd - - # skip this one for opencryptoki 3.21.0 as since then the service is running as a regular user - if nvrTestPackage opencryptoki '<' 3.21.0; then - rlPhaseStartTest "testing directory creation during pkcsslotd start" - rlRun "rm -rf /var/log/opencryptoki $LOCKDIR/opencryptoki" - rlRun "pkcsResetTokens" - rlServiceStart pkcsslotd - rlAssertExists /var/log/opencryptoki - rlAssertExists $LOCKDIR/opencryptoki - rlRun "matchpathcon /var/log/opencryptoki" - rlRun "matchpathcon $LOCKDIR/opencryptoki" - rlRun "su $USER -c 'pkcsconf -t' &> query1.log" - cat query1.log - if nvrTestPackage opencryptoki '<' 3.14.0; then - rlAssertGrep "Model: IBM SoftTok" query1.log - else - rlAssertGrep "Model: Soft " query1.log - fi - rlPhaseEnd - fi - - # initialize every token available - for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do - - rlPhaseStartTest "initialize token #$SLOT" - rlRun "su $USER -c 'source $LIBPATH && pkcsInitToken $SLOT'" - rlRun "su $USER -c 'pkcsconf -t -c $SLOT' &> query2.log" - cat query2.log - rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E - rlPhaseEnd - - done - - if [ "$LOCKDIR" == "/run/lock" ]; then - rlPhaseStartTest "checking there is no /var/lock in filelist" - rlRun "rpm -ql $(rpm -qa | grep opencryptoki | tr '\n' ' ') | grep /var/lock" 1 - rlPhaseEnd - fi - - rlPhaseStartTest "checking $LOCKDIR/opencryptoki selinux contexts" - rlRun -s "restorecon -Rnv $LOCKDIR/opencryptoki" - rlAssertNotGrep "restorecon reset" $rlRun_LOG - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlFileRestore - rlRun "pkcsRestoreTokens" - rlServiceRestore pkcsslotd - rlLog "Waiting 12 sec for systemd --user process to exit..." - sleep 12 - rlRun "userdel -r $USER" || ps -ef - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/pkcsstats-basic-functionality/main.fmf b/Sanity/pkcsstats-basic-functionality/main.fmf deleted file mode 100644 index 31bd8ae..0000000 --- a/Sanity/pkcsstats-basic-functionality/main.fmf +++ /dev/null @@ -1,33 +0,0 @@ -summary: Tests basic functionality of the pkcsstats command -description: | - Bug summary: openCryptoki: add crypto counters - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=2043854 - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=2044180 -contact: Karel Srot -component: - - opencryptoki -test: ./runtest.sh -framework: beakerlib -require: - - url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation -recommend: - - opencryptoki - - opencryptoki-swtok - - expect -duration: 5m -enabled: true -tag: - - CI-Tier-1 - - Tier1 -tier: '1' -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2043854 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2044180 -adjust: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - - enabled: false - when: distro < rhel-8.7 or distro < rhel-9.1 - because: feature has been introduced in 8.7 and 9.1 -extra-nitrate: TC#0613736 diff --git a/Sanity/pkcsstats-basic-functionality/runtest.sh b/Sanity/pkcsstats-basic-functionality/runtest.sh deleted file mode 100755 index eea03d4..0000000 --- a/Sanity/pkcsstats-basic-functionality/runtest.sh +++ /dev/null @@ -1,126 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -[ -n "$SLOT" ] || SLOT=sw -USER="user$RANDOM" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlRun "useradd -m $USER -G pkcs11" - rlRun -s "su $USER -c 'id'" - rlFileBackup /etc/opencryptoki/opencryptoki.conf - rlServiceStop pkcsslotd - rlRun "pkcsResetTokens" - rlServiceStart pkcsslotd - sleep 1 - rlRun "pkcsconf -t | grep 'Soft'" - SLOT=$( pkcsGetTokenSlot $SLOT ) - rlRun "pkcsInitToken $SLOT" - rlRun "pkcsconf -t" - rlRun "pkcsstats -R" - rlPhaseEnd - - rlPhaseStartTest "Generate aes key as root and verify stats" - rlRun -s "pkcsstats -s $SLOT -U root" - rlAssertGrep "[no mechanisms were used]" $rlRun_LOG - rlRun "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" - rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E - rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" - rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" - rlRun -s "pkcsstats -s $SLOT -U root" - rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E - rlAssertGrep "CKM_EC_KEY_PAIR_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E - rlPhaseEnd - - rlPhaseStartTest "Generate aes key as $USER and verify stats" - rlRun -s "pkcsstats -s $SLOT -U $USER" 0,1 - rlAssertGrep "(no mechanisms were used|No statistics are available for user '$USER')" $rlRun_LOG -E - rlRun "su - $USER -c 'sleep 3 && p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED'" - rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" - rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E - rlRun -s "pkcsstats -s $SLOT -U $USER" - rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E - rlPhaseEnd - - rlPhaseStartTest "Print acummulated stats for all users" - rlRun -s "pkcsstats -s $SLOT -S" - rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *2 *0 *0" $rlRun_LOG -E - rlPhaseEnd - - rlPhaseStartTest "Print --all-mechs stats for $USER" - rlRun -s "pkcsstats -s $SLOT --all-mechs -U $USER" - rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E - rlAssertGrep "CKM_EC_KEY_PAIR_GEN *\| *0 *0 *0 *0 *0" $rlRun_LOG -E - rlPhaseEnd - - rlPhaseStartTest "Reset stats for $USER" - rlRun -s "pkcsstats -r -U $USER" - rlRun -s "pkcsstats -s $SLOT -U $USER" - rlAssertGrep "no mechanisms were used" $rlRun_LOG - rlRun -s "pkcsstats -s $SLOT -U $USER -a" - rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *0 *0 *0" $rlRun_LOG -E - rlPhaseEnd - - rlPhaseStartTest "Delete stats for $USER" - rlRun -s "pkcsstats -d -U $USER" - rlRun -s "pkcsstats -s $SLOT -U $USER -a" 1 - rlAssertGrep "No statistics are available for user '$USER'" $rlRun_LOG -E - rlPhaseEnd - - rlPhaseStartTest "Print user stats in JSON" - rlRun -s "pkcsstats -s $SLOT -j" - rlAssertGrep '"user": "root",' $rlRun_LOG - rlAssertGrep '"mechanism": "CKM_AES_KEY_GEN",' $rlRun_LOG - rlAssertGrep '"strength-128": 1,' $rlRun_LOG - rlPhaseEnd - - rlPhaseStartTest "Print help" - rlRun -s "pkcsstats -h" - rlAssertGrep "Usage: pkcsstats \[OPTIONS\]" $rlRun_LOG - rlPhaseEnd - - rlPhaseStartCleanup - rlServiceStop pkcsslotd - rlRun "pkcsRestoreTokens" - rlFileRestore - rlServiceRestore pkcsslotd - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlLog "Waiting 12 for systemd --user process to exit..." - sleep 15 - rlRun "userdel -r $USER" || ps -ef - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf b/Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf deleted file mode 100644 index 96dd4b1..0000000 --- a/Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf +++ /dev/null @@ -1,32 +0,0 @@ -summary: Tests if signing certificate via opencryptoki module in NSS works -description: -contact: Karel Srot -component: -- opencryptoki -test: ./runtest.sh -framework: beakerlib -require: -- url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation -recommend: -- opencryptoki -- opencryptoki-swtok -- expect -- nss-tools -- rng-utils -duration: 20m -enabled: true -tag: -- CI-Tier-1 -- TIPpass_Security -- Tier2 -- Tier2security -tier: '2' -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=654088 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1056036 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1059176 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600434 -extra-nitrate: TC#0102977 -extra-summary: /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS -extra-task: /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS diff --git a/Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh b/Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh deleted file mode 100755 index b2c57a2..0000000 --- a/Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh +++ /dev/null @@ -1,149 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS -# Description: Tests if signing certificate via opencryptoki module in NSS works -# Author: Miroslav Vadkerti -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2011 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -PASS="redhat" -PASSTOKEN="01234567" -PASSTOKEN2="87654321" -SERVICE="pkcsslotd" -[ -n "$SLOT" ] || SLOT=sw -NSSDB_D="nssdb" -PASSWORD_F="${NSSDB_D}/nsspassword" -NSSDB_PREFIX="sql:" -rlIsRHEL 3 4 5 && NSSDB_PREFIX="" -M=0 -CACERT_NAME="cacert" -USERCERT_NAME="mycert" -USERCERT_REQ_F="${USERCERT_NAME}.req" -USERCERT_DER_F="${USERCERT_NAME}.der" -USERCERT_PEM_F="${USERCERT_NAME}.pem" -LOG_F="${PACKAGE}.log" -CONF_F="/usr/share/p11-kit/modules/opencryptoki.module" -LIB_F=$( rpm -ql opencryptoki-libs | grep pkcs11/libopencryptoki.so | head -1 ) - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" - rlAssertRpm $PACKAGE - rlFileBackup /etc/opencryptoki/opencryptoki.conf - rlServiceStop $SERVICE - rlRun "pkcsResetTokens" - rlServiceStart $SERVICE - sleep 1 - rlRun "pkcsconf -t" - SLOT=$( pkcsGetTokenSlot $SLOT ) - rlRun "pkcsInitToken $SLOT" - rlRun "pkcsconf -t" - # prepar entropy generator - pidof rngd || ENTROPY=true - $ENTROPY && rngd -r /dev/urandom - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlRun "mkdir -p ${NSSDB_D}" 0 - rlRun "echo '${PASS}' > ${PASSWORD_F}" 0 - rlRun "certutil -N -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F}" - M=`expr ${M} + 1` - rlRun "while [ 1 -eq 1 ]; do dd if=/dev/urandom bs=1 count=1; echo; sleep 0.0${RANDOM}; done 2>/dev/null | certutil -S -n ${CACERT_NAME} -s 'cn=CAcert' -x -t 'C,C,C' -m ${M} -v 120 -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F}" 0 "Generating CA certificate" - rlRun "certutil -L -d ${NSSDB_PREFIX}${NSSDB_D}" 0 "Certificate listing" - rlPhaseEnd - - rlPhaseStartTest - rlLog "Adding opencryptoki as an external module to opencryptoki" - - if rlIsRHEL '<8'; then - if [ -r /usr/lib64/opencryptoki/PKCS11_API.so ]; then - rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -nocertdb -add opencryptoki -libfile /usr/lib64/opencryptoki/PKCS11_API.so" - else - rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -nocertdb -add opencryptoki -libfile /usr/lib/opencryptoki/PKCS11_API.so" - fi - rlLog "Setting opencryptoki as the default module for all mechanisms" - rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -default opencryptoki -mechanisms RSA:DSA:DH:RC2:RC4:RC5:AES:CAMELLIA:DES:MD2:MD5:SHA1:SHA256:SHA512:SSL:TLS:RANDOM" - rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -list" - export TOKPARAM="" - export PINPARAM="" - else - [ -f $CONF_F ] && rlFileBackup $CONF_F; - echo $LIB_F - rlRun "cat > $CONF_F < pin - export TOKPARAM="-h softtok" - export PINPARAM="-f pin" - fi - - rlRun "while [ 1 -eq 1 ]; do dd if=/dev/urandom bs=1 count=1; echo; sleep 0.0${RANDOM}; done 2>/dev/null | certutil -f ${PASSWORD_F} -R -s 'CN=John Smith, O=Netscape, L=Mountain View, ST=California, C=US' -p '650-555-8888' -o ${USERCERT_REQ_F} -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F} ${TOKPARAM} ${PINPARAM}" 0 "Generating user certificate" - rlAssertExists "${USERCERT_REQ_F}" - M=`expr ${M} + 1` - expect -c " -spawn certutil -C -m ${M} -i ${USERCERT_REQ_F} -o ${USERCERT_PEM_F} -c ${CACERT_NAME} -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F} ${TOKPARAM} -expect {L13} {send -- $PASSTOKEN\r} -expect { - {L13} {send -- \"$PASTOKEN2\r\"; exp_continue} - eof { exit 0 } -} -" - rlAssertExists "${USERCERT_PEM_F}" - [ "x$(stat -c '%s' ${USERCERT_PEM_F})" = "x0" ] && rlFail "${USERCERT_PEM_F} is empty" || rlPass "${USERCERT_DER_F} create OK" - M=`expr ${M} + 1` - expect -c " -spawn certutil -C -d ${NSSDB_PREFIX}${NSSDB_D} -c ${CACERT_NAME} -i ${USERCERT_REQ_F} -o ${USERCERT_DER_F} -m ${M} -v 48 -1 -f ${PASSWORD_F} -5 ${TOKPARAM} -expect {L13} {send -- $PASSTOKEN\r} -expect { - {L13} {send -- \"$PASSTOKEN2\"\r; exp_continue} - {>} {send -- 01234567\r} -} -expect {y/N} {send -- N\r} -expect {>} {send -- 01234567\r} -expect {y/N} {send -- N\r} -expect eof -" - rlAssertExists "${USERCERT_DER_F}" - [ "x$(stat -c '%s' ${USERCERT_DER_F})" = "x0" ] && rlFail "${USERCERT_DER_F} is empty" || rlPass "${USERCERT_DER_F} create OK" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rm -f $CONF_F" - rlServiceStop $SERVICE - rlRun "pkcsRestoreTokens" - rlFileRestore - $ENTROPY && killall rngd - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlServiceRestore $SERVICE - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/testsuite/main.fmf b/Sanity/testsuite/main.fmf deleted file mode 100644 index c306132..0000000 --- a/Sanity/testsuite/main.fmf +++ /dev/null @@ -1,38 +0,0 @@ -summary: Executes testsuite shipped with opencryptoki -description: | - it seems it should work with softoken on all architectures -contact: Karel Srot -component: -- opencryptoki -test: ./runtest.sh -framework: beakerlib -require: -- url: https://src.fedoraproject.org/tests/opencryptoki.git - name: /Library/token-manipulation -- library(nvr/nvr) -recommend: -- opencryptoki -- gcc -- yum-utils -- rpm-build -- opencryptoki-swtok -- opencryptoki-ccatok -- opencryptoki-icatok -duration: 100m -enabled: true -tag: -- TIPfail_Security -- noExpectedness -# test duration is big for tiers -- notier -- rhel8-buildroot -- rhel9-buildroot -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=644284 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1099175 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=904937 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=650482 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1099193 -extra-nitrate: TC#0063178 -extra-summary: /CoreOS/openCryptoki/Sanity/testsuite -extra-task: /CoreOS/openCryptoki/Sanity/testsuite diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh deleted file mode 100755 index 6f815fd..0000000 --- a/Sanity/testsuite/runtest.sh +++ /dev/null @@ -1,237 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/openCryptoki/Sanity/testsuite -# Description: Executes testsuite shipped with openCryptoki -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2009 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include rhts environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -# At the moment of creation of this test a lot of upstream tests -# were not fully functional. Please check README documents and -# try enable additional tests if possible -# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! - -# find out package name -PACKAGE="opencryptoki" - -LOGDIR=`mktemp -d` -[ -z "$SLOT" ] && SLOT=sw - -function reset_tokens() { - rlLogInfo "Reseting tokens..." - rlServiceStop pkcsslotd - rlRun "pkcsResetTokens randomNamespace" # using different namespace not to overwrite previous backup - rlServiceStart pkcsslotd - rlLogInfo "Initializing tokens..." - rlRun "pkcsInitToken $SLOT" -} - -function get_test_id() { - ID=`cat $TmpDir/testid` - ID=$(( $ID+1 )) - echo $ID > $TmpDir/testid - echo $ID -} - -rlJournalStart - rlPhaseStartSetup - rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" - rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library" - export PKCS11_USER_PIN=$pkcsUSER_PIN - export PKCS11_SO_PIN=$pkcsSO_PIN - rlAssertRpm $PACKAGE - TmpDir=`mktemp -d` - pushd $TmpDir - rlFetchSrcForInstalled $PACKAGE - rlRun "rpm -ivh $PACKAGE*.src.rpm" 0 "Installing $PACKAGE src rpm" - rlRun "yum-builddep -y ~/rpmbuild/SPECS/opencryptoki.spec" - # opencryptoki needs to enable building test cases during the pkg build - rlRun "sed -i 's/^%configure /%configure --enable-testcases /' ~/rpmbuild/SPECS/opencryptoki.spec" - rlRun "rpmbuild -bc ~/rpmbuild/SPECS/opencryptoki.spec &> build.log" 0 "Building opencryptoki files" - tail build.log - TESTDIR=`ls -d ~/rpmbuild/BUILD/opencryptoki*/testcases` - - rlServiceStop pkcsslotd - sleep 3 - rlRun "pkcsResetTokens" - - rlServiceStart pkcsslotd - rlLogInfo "Available tokens" - pkcsconf -t - # allow to pass SLOT number as a parameter - # or take the first available slot (Token) - SLOT=$( pkcsGetTokenSlot $SLOT ) - rlLogInfo "Token under a test" - pkcsconf -t -c $SLOT - - NOSKIP="" - # !!!!!!!!!!!!!!!!!!!!!!! - # tests doings writes are not skipped only for a softoken because they could descrease flash memory - # lifetime on real tokens - pkcsconf -t -c $SLOT | grep -qi 'soft' && NOSKIP="-noskip" - rlPhaseEnd - - echo 0 > $TmpDir/testid - - rlPhaseStartTest "crypto" - reset_tokens - if [ -d $TESTDIR/crypto ]; then - export PKCS11_USER_PIN=01234567 - export PKCS11_SO_PIN=76543210 - pushd $TESTDIR/crypto - - RUN_SEPARATELY="ab_tests" # do not report results the usual way - - for TEST in *_tests; do - # skip test if it is on TODO list in README - if grep -A 1 $TEST README | grep -q TODO; then - rlLogWarning "Skipping $TEST since it is on TODO list in README" - elif echo $RUN_SEPARATELY | grep -q $TEST; then - ID=`get_test_id` - rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - else - ID=`get_test_id` - rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" - RESULT=$? - grep Total $TmpDir/testlog.$ID - rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID - rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID - # print log in case of error - [ $RESULT -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID - fi - done - popd - else - rlFail "No crypto tests available!" - fi - rlPhaseEnd - - rlPhaseStartTest "misc_tests" - if [ -d $TESTDIR/misc_tests ]; then - reset_tokens - pushd $TESTDIR/misc_tests - - # obj_mgmt_tests - ID=`get_test_id` - rlRun "./obj_mgmt_tests $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - - #spinlock_tests.sh - ID=`get_test_id` - rlRun "./spinlock_tests.sh -s 1 -p 10 -l 20 &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - - #fork - ID=`get_test_id` - rlRun "./fork -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID - rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID - - # events - added in 3.16.0-3.el9 - if nvrTestPackage opencryptoki '>=' 3.16.0; then - ID=`get_test_id` - rlRun "./events -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID - rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID - fi - - # p11sak_test.sh added in 3.17.0 - if nvrTestPackage opencryptoki '>=' 3.17.0; then - ID=`get_test_id` - rlRun "SLOT=$SLOT ./p11sak_test.sh &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - rlAssertNotGrep 'TESTCASE.*FAIL' $TmpDir/testlog.$ID -E - fi - - popd - else - rlFail "No misc_tests test available!" - fi - rlPhaseEnd - - rlPhaseStartTest "pkcs11" - if [ -d $TESTDIR/pkcs11 ]; then - reset_tokens - pushd $TESTDIR/pkcs11 - for TEST in get_interface attribute copyobjects findobjects generate_keypair; do - ID=`get_test_id` - rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" - RESULT=$? - grep Total $TmpDir/testlog.$ID - rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID - rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID - # print log in case of error - [ $RESULT -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID - done - - # now run additional tests with specific output - - #sess_opstate - # skip if using swtok since the test is being skipped with - # TESTCASE sess_opstate_funcs SKIP Get/SetOperationState digest test: state unsavable - ID=`get_test_id` - if [ "$SLOT" != "3" ]; then - rlRun "./sess_opstate -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - rlAssertGrep "TESTCASE sess_opstate_funcs PASS" $TmpDir/testlog.$ID - fi - - #getobjectsize - ID=`get_test_id` - rlRun "./getobjectsize -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - rlAssertGrep "C_GetObjectSize test passed" $TmpDir/testlog.$ID - - #hw_fn - ID=`get_test_id` - rlRun "./hw_fn -slot $SLOT &> $TmpDir/testlog.$ID" - [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error - rlAssertGrep "(Hardware Feature tests succeeded.|do_HW_Feature_Search passed)" $TmpDir/testlog.$ID -E - - popd - - else - rlFail "No pkcs11_tests test available!" - fi - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlBundleLogs testlogs $TmpDir/testlog* build.log - #rlRun "rpmbuild --clean -bp ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Clean the BUILD root" - rlRun "rm -rf $TmpDir" - [ -d $TESTDIR ] && rlRun "rm -rf $TESTDIR" - rlFileRestore - rlRun "pkcsRestoreTokens" - rlServiceRestore pkcsslotd - rlPhaseEnd - -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf b/Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf deleted file mode 100644 index 17939f1..0000000 --- a/Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf +++ /dev/null @@ -1,31 +0,0 @@ -summary: tools should inform user about pkcs11 group -description: | - Bug summary: RFE opencryptoki tools should inform the user that he is not in pkcs11 group - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1063763 -contact: Karel Srot -component: -- openCryptoki -test: ./runtest.sh -framework: beakerlib -recommend: -- opencryptoki -duration: 5m -enabled: true -tag: -- NoRHEL4 -- NoRHEL5 -- NoRHEL6 -- TIPpass_Security -- Tier2 -- Tier2security -tier: '2' -link: -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1063763 -- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697494 -adjust: -- enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -extra-nitrate: TC#0598649 -extra-summary: /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that -extra-task: /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that diff --git a/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh b/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh deleted file mode 100755 index 84ce1bc..0000000 --- a/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh +++ /dev/null @@ -1,57 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that -# Description: Test for BZ#1063763 (RFE opencryptoki tools should inform the user that) -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2019 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlServiceStart pkcsslotd - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlRun "useradd -m bz1063763user" - rlPhaseEnd - - rlPhaseStartTest - rlRun -s "su - bz1063763user -c 'pkcsconf -t'" 144,6 - rlAssertGrep "Error initializing the PKCS11 library" $rlRun_LOG - rlAssertGrep "Note: all non-root users that require access to PKCS#11 tokens using opencryptoki must be assigned to the pkcs11 group to be able to communicate with the pkcsslotd daemon." $rlRun_LOG - rlPhaseEnd - - rlPhaseStartCleanup - rlLog "Waiting 12 sec for systemd --user process to exit..." && sleep 12 - rlRun "userdel -r bz1063763user" 0 - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlServiceRestore pkcsslotd - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Sanity/verify-all-HW-tokens-are-available/main.fmf b/Sanity/verify-all-HW-tokens-are-available/main.fmf deleted file mode 100644 index 59928c9..0000000 --- a/Sanity/verify-all-HW-tokens-are-available/main.fmf +++ /dev/null @@ -1,30 +0,0 @@ -summary: Verify that all tokens are available -description: | - Verify on s390x system that ICA and SWTPM tokens are available -contact: Karel Srot -component: -- opencryptoki -test: ./runtest.sh -framework: beakerlib -require: -recommend: -- opencryptoki -- opencryptoki-swtok -- opencryptoki-icatok -duration: 5m -enabled: true -tag: -- CI-Tier-1 -- Tier1 -tier: '1' -adjust: -- enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false -- enabled: false - when: arch != s390x - continue: false - -extra-nitrate: TC#577597 -extra-summary: Verify that all tokens are available -extra-hardware: hostrequire = diff --git a/Sanity/verify-all-HW-tokens-are-available/runtest.sh b/Sanity/verify-all-HW-tokens-are-available/runtest.sh deleted file mode 100755 index 1f47bd4..0000000 --- a/Sanity/verify-all-HW-tokens-are-available/runtest.sh +++ /dev/null @@ -1,55 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Description: Test for BZ#1122505 (opencryptoki sw token no longer found after rebase) -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2022 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" -TESTDIR=`pwd` - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm $PACKAGE - rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - rlServiceStart pkcsslotd - rlPhaseEnd - - rlPhaseStartTest "listing available tokens" - rlRun -s "pkcsconf -t" - rlAssertGrep "Model: ICA" $rlRun_LOG - rlAssertGrep "Model: Soft" $rlRun_LOG - rpm -q ep11-host &>/dev/null && rlAssertGrep "Model: EP11" $rlRun_LOG - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlServiceRestore pkcsslotd - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/Update/dnf-update-opencryptoki/main.fmf b/Update/dnf-update-opencryptoki/main.fmf deleted file mode 100644 index 77b47d9..0000000 --- a/Update/dnf-update-opencryptoki/main.fmf +++ /dev/null @@ -1,8 +0,0 @@ -summary: Update opencryptoki package with dnf -contact: Karel Srot -tag: - - setup -framework: shell -duration: 10m -enabled: true -test: "dnf -y update 'opencryptoki*'" diff --git a/Update/initialized-ica-token/main.fmf b/Update/initialized-ica-token/main.fmf deleted file mode 100644 index 59dcfe9..0000000 --- a/Update/initialized-ica-token/main.fmf +++ /dev/null @@ -1,30 +0,0 @@ -summary: initialize ICA token and test it still works after an update -description: '' -contact: Karel Srot -component: - - opencryptoki -test: ./runtest.sh -framework: beakerlib -require: - - url: https://src.fedoraproject.org/tests/opencryptoki - name: /Library/token-manipulation -recommend: - - opencryptoki - - opencryptoki-icatok - - libica - - gnutls-utils - - opensc - - expect -duration: 5m - -/all: - environment: - PHASES: all - -/setup: - environment: - PHASES: "setup,test" - -/test: - environment: - PHASES: test diff --git a/Update/initialized-ica-token/runtest.sh b/Update/initialized-ica-token/runtest.sh deleted file mode 100755 index 29a992a..0000000 --- a/Update/initialized-ica-token/runtest.sh +++ /dev/null @@ -1,122 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/openCryptoki/Upgrade/initialized-ica-token -# Description: initialize ICA token and test it still works after an update -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" - -function phaseSetup() { - rlPhaseStartTest - rlFileBackup /etc/opencryptoki/opencryptoki.conf - rlServiceStop pkcsslotd - rlRun "pkcsResetTokens" - rlRun "systemctl enable pkcsslotd" - rlServiceStart pkcsslotd - sleep 1 - rlRun "pkcsconf -t" - SLOT=$( pkcsGetTokenSlot ica ) - rlRun "pkcsInitToken $SLOT" - rlRun "pkcsconf -t" - if rlIsRHEL '<8'; then - rlRun "GNUTLS_PIN=$pkcsUSER_PIN p11tool --generate-rsa --login --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" - else - rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" - fi - rlAssertExists id_rsa.pub - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" - rlAssertGrep "Public Key Object" $rlRun_LOG - rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E - rlPhaseEnd -} - - -function phaseTest() { - rlPhaseStartTest - SLOT=$( pkcsGetTokenSlot ica ) - rlRun "pkcsconf -t" - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" 0 "Verify I still can list imported RSA key" - rlAssertGrep "Public Key Object" $rlRun_LOG - rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E - rlLog "Exporting stored RSA key" - rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" - rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" - rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" - rlPhaseEnd -} - - -function phaseCleanup() { - rlPhaseStartCleanup - rlServiceStop pkcsslotd - rlRun "pkcsRestoreTokens" - rlFileRestore - rlServiceRestore pkcsslotd - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -} - - -rlJournalStart - - rlPhaseStartSetup "init" - rlAssertRpm $PACKAGE - rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" - rlRun "TmpDir=/var/tmp/opencryptoki-tests-runtime-files" - [ -d $TmpDir ] || rlRun "mkdir -p $TmpDir" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - if rlIsRHEL '<8'; then - rlRun "TokenSpec='model=IBM%20ICA'" - else - rlRun "TokenSpec='model=ICA;manufacturer=IBM'" - fi - rlPhaseEnd - - # clear $PHASES if IN_PLACE_UPGRADE is specified - [ -n "$IN_PLACE_UPGRADE" ] && PHASES="" - echo IN_PLACE_UPGRADE=$IN_PLACE_UPGRADE - echo PHASES=$PHASES - - # run setup, except when running post-upgrade phase - if [ -n "$IN_PLACE_UPGRADE" -a "$IN_PLACE_UPGRADE" != "new" ] || echo ${PHASES} | egrep -qi '(setup|all)'; then - phaseSetup - fi - - # run test by default - if [ -z "${PHASES}" ] || echo ${PHASES} | egrep -qi '(test|all)'; then - phaseTest - fi - - popd - # run cleanup only when run as a standalone test - if [ -z "$IN_PLACE_UPGRADE" ] && echo ${PHASES} | egrep -qi '(cleanup|all)'; then - phaseCleanup - fi - -rlJournalPrintText -rlJournalEnd diff --git a/Update/initialized-sw-token/main.fmf b/Update/initialized-sw-token/main.fmf deleted file mode 100644 index 71f1582..0000000 --- a/Update/initialized-sw-token/main.fmf +++ /dev/null @@ -1,29 +0,0 @@ -summary: initialize sw token and test it still works after an update -description: '' -contact: Karel Srot -component: - - opencryptoki -test: ./runtest.sh -framework: beakerlib -require: - - url: https://src.fedoraproject.org/tests/opencryptoki - name: /Library/token-manipulation -recommend: - - opencryptoki - - opencryptoki-swtok - - gnutls-utils - - opensc - - expect -duration: 5m - -/all: - environment: - PHASES: all - -/setup: - environment: - PHASES: "setup,test" - -/test: - environment: - PHASES: test diff --git a/Update/initialized-sw-token/runtest.sh b/Update/initialized-sw-token/runtest.sh deleted file mode 100755 index 397bb0f..0000000 --- a/Update/initialized-sw-token/runtest.sh +++ /dev/null @@ -1,123 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/openCryptoki/Upgrade/initialized-sw-token -# Description: initialize sw token and test it still works after an update -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="opencryptoki" - -function phaseSetup() { - rlPhaseStartSetup - rlFileBackup /etc/opencryptoki/opencryptoki.conf - rlServiceStop pkcsslotd - rlRun "pkcsResetTokens" - rlRun "systemctl enable pkcsslotd" - rlServiceStart pkcsslotd - sleep 1 - rlRun "pkcsconf -t | grep 'Soft'" - SLOT=$( pkcsGetTokenSlot sw ) - rlRun "pkcsInitToken $SLOT" - rlRun "pkcsconf -t" - if rlIsRHEL '<8'; then - rlRun "GNUTLS_PIN=$pkcsUSER_PIN p11tool --generate-rsa --login --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" - else - rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" - fi - rlAssertExists id_rsa.pub - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" - rlAssertGrep "Public Key Object" $rlRun_LOG - rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E - rlPhaseEnd -} - - -function phaseTest() { - rlPhaseStartTest - SLOT=$( pkcsGetTokenSlot sw ) - rlRun "pkcsconf -t" - rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" 0 "Verify I still can list imported RSA key" - rlAssertGrep "Public Key Object" $rlRun_LOG - rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E - rlLog "Exporting stored RSA key" - rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" - rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" - rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" - rlRun "popd" - rlPhaseEnd -} - - -function phaseCleanup() { - rlPhaseStartCleanup - rlServiceStop pkcsslotd - rlRun "pkcsRestoreTokens" - rlFileRestore - rlServiceRestore pkcsslotd - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" - rlPhaseEnd -} - - -rlJournalStart - - rlPhaseStartSetup "init" - rlAssertRpm $PACKAGE - rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" - rlRun "TmpDir=/var/tmp/opencryptoki-tests-runtime-files" - [ -d $TmpDir ] || rlRun "mkdir -p $TmpDir" 0 "Creating tmp directory" - rlRun "pushd $TmpDir" - if rlIsRHEL '<8'; then - rlRun "TokenSpec='model=IBM%20SoftTok'" - else - rlRun "TokenSpec='model=Soft;manufacturer=IBM'" - fi - rlPhaseEnd - - # clear $PHASES if IN_PLACE_UPGRADE is specified - [ -n "$IN_PLACE_UPGRADE" ] && PHASES="" - echo IN_PLACE_UPGRADE=$IN_PLACE_UPGRADE - echo PHASES=$PHASES - - # run setup, except when running post-upgrade phase - if [ -n "$IN_PLACE_UPGRADE" -a "$IN_PLACE_UPGRADE" != "new" ] || echo ${PHASES} | egrep -qi '(setup|all)'; then - phaseSetup - fi - - # run test by default - if [ -z "${PHASES}" ] || echo ${PHASES} | egrep -qi '(test|all)'; then - phaseTest - fi - - popd - # run cleanup only when run as a standalone test - if [ -z "$IN_PLACE_UPGRADE" ] && echo ${PHASES} | egrep -qi '(cleanup|all)'; then - phaseCleanup - fi - -rlJournalPrintText -rlJournalEnd diff --git a/main.fmf b/main.fmf deleted file mode 100644 index e46882f..0000000 --- a/main.fmf +++ /dev/null @@ -1,2 +0,0 @@ -environment: - GIT_SSL_NO_VERIFY: "true" diff --git a/plans/opencryptoki-tests-fedora-ci.fmf b/plans/opencryptoki-tests-fedora-ci.fmf deleted file mode 100644 index 9cfd67a..0000000 --- a/plans/opencryptoki-tests-fedora-ci.fmf +++ /dev/null @@ -1,11 +0,0 @@ -summary: - Run modified tests using Fedora CI -discover: - how: fmf -# modified-only: True -# modified-url: https://src.fedoraproject.org/tests/opencryptoki.git -# modified-ref: reference/main -# filter: -# - tag: CI-Tier-1 -execute: - how: tmt diff --git a/plans/regression.fmf b/plans/regression.fmf deleted file mode 100644 index ac7c1f5..0000000 --- a/plans/regression.fmf +++ /dev/null @@ -1,10 +0,0 @@ -summary: Runs all tests - -discover: - how: fmf - test: - - /Sanity/* - - /Regression/* - -execute: - how: tmt diff --git a/setup/reboot/main.fmf b/setup/reboot/main.fmf deleted file mode 100644 index 739c0ea..0000000 --- a/setup/reboot/main.fmf +++ /dev/null @@ -1,6 +0,0 @@ -summary: reboot test system -description: '' -contact: Karel Srot -test: ./runtest.sh -framework: beakerlib -duration: 15m diff --git a/setup/reboot/runtest.sh b/setup/reboot/runtest.sh deleted file mode 100755 index 9b71a29..0000000 --- a/setup/reboot/runtest.sh +++ /dev/null @@ -1,52 +0,0 @@ -#!/bin/bash -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Description: reboot test system -# Author: Karel Srot -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2025 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -COOKIE=/var/tmp/opencryptoki-setup-system-rebooted - -rlJournalStart - - if [ ! -e $COOKIE ]; then - rlPhaseStartSetup "pre-reboot phase" - rlRun "uname -a" - rlRun "cat /proc/cmdline" - rlRun "touch $COOKIE" - rlLogInfo "going to reboot now..." - rlPhaseEnd - rhts-reboot - else - rlPhaseStartTest "post-reboot phase" - rlRun "uname -a" - rlRun "cat /proc/cmdline" - rlRun "uptime" - rlRun "rm -f $COOKIE" - rlPhaseEnd - fi - -rlJournalPrintText -rlJournalEnd