diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..d159169 --- /dev/null +++ b/LICENSE @@ -0,0 +1,339 @@ + GNU GENERAL PUBLIC LICENSE + Version 2, June 1991 + + Copyright (C) 1989, 1991 Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +License is intended to guarantee your freedom to share and change free +software--to make sure the software is free for all its users. This +General Public License applies to most of the Free Software +Foundation's software and to any other program whose authors commit to +using it. (Some other Free Software Foundation software is covered by +the GNU Lesser General Public License instead.) You can apply it to +your programs, too. + + When we speak of free software, we are referring to freedom, not +price. Our General Public Licenses are designed to make sure that you +have the freedom to distribute copies of free software (and charge for +this service if you wish), that you receive source code or can get it +if you want it, that you can change the software or use pieces of it +in new free programs; and that you know you can do these things. + + To protect your rights, we need to make restrictions that forbid +anyone to deny you these rights or to ask you to surrender the rights. +These restrictions translate to certain responsibilities for you if you +distribute copies of the software, or if you modify it. + + For example, if you distribute copies of such a program, whether +gratis or for a fee, you must give the recipients all the rights that +you have. You must make sure that they, too, receive or can get the +source code. And you must show them these terms so they know their +rights. + + We protect your rights with two steps: (1) copyright the software, and +(2) offer you this license which gives you legal permission to copy, +distribute and/or modify the software. + + Also, for each author's protection and ours, we want to make certain +that everyone understands that there is no warranty for this free +software. If the software is modified by someone else and passed on, we +want its recipients to know that what they have is not the original, so +that any problems introduced by others will not reflect on the original +authors' reputations. + + Finally, any free program is threatened constantly by software +patents. We wish to avoid the danger that redistributors of a free +program will individually obtain patent licenses, in effect making the +program proprietary. To prevent this, we have made it clear that any +patent must be licensed for everyone's free use or not licensed at all. + + The precise terms and conditions for copying, distribution and +modification follow. + + GNU GENERAL PUBLIC LICENSE + TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION + + 0. This License applies to any program or other work which contains +a notice placed by the copyright holder saying it may be distributed +under the terms of this General Public License. The "Program", below, +refers to any such program or work, and a "work based on the Program" +means either the Program or any derivative work under copyright law: +that is to say, a work containing the Program or a portion of it, +either verbatim or with modifications and/or translated into another +language. (Hereinafter, translation is included without limitation in +the term "modification".) Each licensee is addressed as "you". + +Activities other than copying, distribution and modification are not +covered by this License; they are outside its scope. The act of +running the Program is not restricted, and the output from the Program +is covered only if its contents constitute a work based on the +Program (independent of having been made by running the Program). +Whether that is true depends on what the Program does. + + 1. You may copy and distribute verbatim copies of the Program's +source code as you receive it, in any medium, provided that you +conspicuously and appropriately publish on each copy an appropriate +copyright notice and disclaimer of warranty; keep intact all the +notices that refer to this License and to the absence of any warranty; +and give any other recipients of the Program a copy of this License +along with the Program. + +You may charge a fee for the physical act of transferring a copy, and +you may at your option offer warranty protection in exchange for a fee. + + 2. You may modify your copy or copies of the Program or any portion +of it, thus forming a work based on the Program, and copy and +distribute such modifications or work under the terms of Section 1 +above, provided that you also meet all of these conditions: + + a) You must cause the modified files to carry prominent notices + stating that you changed the files and the date of any change. + + b) You must cause any work that you distribute or publish, that in + whole or in part contains or is derived from the Program or any + part thereof, to be licensed as a whole at no charge to all third + parties under the terms of this License. + + c) If the modified program normally reads commands interactively + when run, you must cause it, when started running for such + interactive use in the most ordinary way, to print or display an + announcement including an appropriate copyright notice and a + notice that there is no warranty (or else, saying that you provide + a warranty) and that users may redistribute the program under + these conditions, and telling the user how to view a copy of this + License. (Exception: if the Program itself is interactive but + does not normally print such an announcement, your work based on + the Program is not required to print an announcement.) + +These requirements apply to the modified work as a whole. If +identifiable sections of that work are not derived from the Program, +and can be reasonably considered independent and separate works in +themselves, then this License, and its terms, do not apply to those +sections when you distribute them as separate works. But when you +distribute the same sections as part of a whole which is a work based +on the Program, the distribution of the whole must be on the terms of +this License, whose permissions for other licensees extend to the +entire whole, and thus to each and every part regardless of who wrote it. + +Thus, it is not the intent of this section to claim rights or contest +your rights to work written entirely by you; rather, the intent is to +exercise the right to control the distribution of derivative or +collective works based on the Program. + +In addition, mere aggregation of another work not based on the Program +with the Program (or with a work based on the Program) on a volume of +a storage or distribution medium does not bring the other work under +the scope of this License. + + 3. You may copy and distribute the Program (or a work based on it, +under Section 2) in object code or executable form under the terms of +Sections 1 and 2 above provided that you also do one of the following: + + a) Accompany it with the complete corresponding machine-readable + source code, which must be distributed under the terms of Sections + 1 and 2 above on a medium customarily used for software interchange; or, + + b) Accompany it with a written offer, valid for at least three + years, to give any third party, for a charge no more than your + cost of physically performing source distribution, a complete + machine-readable copy of the corresponding source code, to be + distributed under the terms of Sections 1 and 2 above on a medium + customarily used for software interchange; or, + + c) Accompany it with the information you received as to the offer + to distribute corresponding source code. (This alternative is + allowed only for noncommercial distribution and only if you + received the program in object code or executable form with such + an offer, in accord with Subsection b above.) + +The source code for a work means the preferred form of the work for +making modifications to it. For an executable work, complete source +code means all the source code for all modules it contains, plus any +associated interface definition files, plus the scripts used to +control compilation and installation of the executable. However, as a +special exception, the source code distributed need not include +anything that is normally distributed (in either source or binary +form) with the major components (compiler, kernel, and so on) of the +operating system on which the executable runs, unless that component +itself accompanies the executable. + +If distribution of executable or object code is made by offering +access to copy from a designated place, then offering equivalent +access to copy the source code from the same place counts as +distribution of the source code, even though third parties are not +compelled to copy the source along with the object code. + + 4. You may not copy, modify, sublicense, or distribute the Program +except as expressly provided under this License. Any attempt +otherwise to copy, modify, sublicense or distribute the Program is +void, and will automatically terminate your rights under this License. +However, parties who have received copies, or rights, from you under +this License will not have their licenses terminated so long as such +parties remain in full compliance. + + 5. You are not required to accept this License, since you have not +signed it. However, nothing else grants you permission to modify or +distribute the Program or its derivative works. These actions are +prohibited by law if you do not accept this License. Therefore, by +modifying or distributing the Program (or any work based on the +Program), you indicate your acceptance of this License to do so, and +all its terms and conditions for copying, distributing or modifying +the Program or works based on it. + + 6. Each time you redistribute the Program (or any work based on the +Program), the recipient automatically receives a license from the +original licensor to copy, distribute or modify the Program subject to +these terms and conditions. You may not impose any further +restrictions on the recipients' exercise of the rights granted herein. +You are not responsible for enforcing compliance by third parties to +this License. + + 7. If, as a consequence of a court judgment or allegation of patent +infringement or for any other reason (not limited to patent issues), +conditions are imposed on you (whether by court order, agreement or +otherwise) that contradict the conditions of this License, they do not +excuse you from the conditions of this License. If you cannot +distribute so as to satisfy simultaneously your obligations under this +License and any other pertinent obligations, then as a consequence you +may not distribute the Program at all. For example, if a patent +license would not permit royalty-free redistribution of the Program by +all those who receive copies directly or indirectly through you, then +the only way you could satisfy both it and this License would be to +refrain entirely from distribution of the Program. + +If any portion of this section is held invalid or unenforceable under +any particular circumstance, the balance of the section is intended to +apply and the section as a whole is intended to apply in other +circumstances. + +It is not the purpose of this section to induce you to infringe any +patents or other property right claims or to contest validity of any +such claims; this section has the sole purpose of protecting the +integrity of the free software distribution system, which is +implemented by public license practices. Many people have made +generous contributions to the wide range of software distributed +through that system in reliance on consistent application of that +system; it is up to the author/donor to decide if he or she is willing +to distribute software through any other system and a licensee cannot +impose that choice. + +This section is intended to make thoroughly clear what is believed to +be a consequence of the rest of this License. + + 8. If the distribution and/or use of the Program is restricted in +certain countries either by patents or by copyrighted interfaces, the +original copyright holder who places the Program under this License +may add an explicit geographical distribution limitation excluding +those countries, so that distribution is permitted only in or among +countries not thus excluded. In such case, this License incorporates +the limitation as if written in the body of this License. + + 9. The Free Software Foundation may publish revised and/or new versions +of the General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to +address new problems or concerns. + +Each version is given a distinguishing version number. If the Program +specifies a version number of this License which applies to it and "any +later version", you have the option of following the terms and conditions +either of that version or of any later version published by the Free +Software Foundation. If the Program does not specify a version number of +this License, you may choose any version ever published by the Free Software +Foundation. + + 10. If you wish to incorporate parts of the Program into other free +programs whose distribution conditions are different, write to the author +to ask for permission. For software which is copyrighted by the Free +Software Foundation, write to the Free Software Foundation; we sometimes +make exceptions for this. Our decision will be guided by the two goals +of preserving the free status of all derivatives of our free software and +of promoting the sharing and reuse of software generally. + + NO WARRANTY + + 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY +FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN +OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES +PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED +OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS +TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE +PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, +REPAIR OR CORRECTION. + + 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING +WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR +REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, +INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING +OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED +TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY +YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER +PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE +POSSIBILITY OF SUCH DAMAGES. + + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Programs + + If you develop a new program, and you want it to be of the greatest +possible use to the public, the best way to achieve this is to make it +free software which everyone can redistribute and change under these terms. + + To do so, attach the following notices to the program. It is safest +to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least +the "copyright" line and a pointer to where the full notice is found. + + + Copyright (C) + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License along + with this program; if not, write to the Free Software Foundation, Inc., + 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + +Also add information on how to contact you by electronic and paper mail. + +If the program is interactive, make it output a short notice like this +when it starts in an interactive mode: + + Gnomovision version 69, Copyright (C) year name of author + Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. + This is free software, and you are welcome to redistribute it + under certain conditions; type `show c' for details. + +The hypothetical commands `show w' and `show c' should show the appropriate +parts of the General Public License. Of course, the commands you use may +be called something other than `show w' and `show c'; they could even be +mouse-clicks or menu items--whatever suits your program. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the program, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the program + `Gnomovision' (which makes passes at compilers) written by James Hacker. + + , 1 April 1989 + Ty Coon, President of Vice + +This General Public License does not permit incorporating your program into +proprietary programs. If your program is a subroutine library, you may +consider it more useful to permit linking proprietary applications with the +library. If this is what you want to do, use the GNU Lesser General +Public License instead of this License. diff --git a/Library/token-manipulation/lib.sh b/Library/token-manipulation/lib.sh new file mode 100644 index 0000000..f6b37ec --- /dev/null +++ b/Library/token-manipulation/lib.sh @@ -0,0 +1,345 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# lib.sh of /CoreOS/opencryptoki/Library/token-manipulation +# Description: provides basic function for token manipulation +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# library-prefix = pkcs +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +true <<'=cut' +=pod + +=head1 NAME + +opencryptoki/token-manipulation - provides basic function for token manipulation + +=head1 DESCRIPTION + +The library provides basic function for manipulation with +opencryptoki tokens, like initialization, cleanup etc. + +=cut + +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# Variables +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +true <<'=cut' +=pod + +=head1 VARIABLES + +Below is the list of global variables. When writing a new library, +please make sure that all global variables start with the library +prefix to prevent collisions with other libraries. + +=over + +=item pkcsUSER_PIN + +USER PIN to be used when initializing a token. By default 01234567. + +=item pkcsSO_PIN + +SO PIN to be used when initializing a token. By default 76543210. + +=item pkcsFACTORY_SO_PIN + +Default (factory) SO PIN of a token. Initialized as 87654321. + +=back + +=cut + +export pkcsUSER_PIN +[ -n "$pkcsUSER_PIN" ] || pkcsUSER_PIN="01234567" + +export pkcsSO_PIN +[ -n "$pkcsSO_PIN" ] || pkcsSO_PIN="76543210" + +export pkcsFACTORY_SO_PIN +[ -n "$pkcsFACTORY_SO_PIN" ] || pkcsFACTORY_SO_PIN="87654321" + +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# Functions +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +true <<'=cut' +=pod + +=head1 FUNCTIONS + +=head2 pkcsGetTokenSlot + +Return slot number for a token with specified type. + + pkcsGetTokenSlot type + +=over + +=item type + +Token type to be used. Available options are matching +dynamic library suffixes from /etc/opencryptoki/opencryptoki.conf, +in particular : sw, tpm, ica, cca, ep11 + +=back + +Returns 0 when the initialization was successfull, non-zero otherwise. + +=cut + + +pkcsGetTokenSlot() { + local TYPE=$1 + local CONF=/etc/opencryptoki/opencryptoki.conf + local SLOT + [ -z "$TYPE" ] && echo "Error: pkcsGetTokenSlot: no token type specified" && return 1 + if grep -q "^stdll = libpkcs11_$TYPE.so" $CONF; then + SLOT=$( egrep "^(slot|stdll = libpkcs11_$TYPE.so)" $CONF | grep -B 1 "libpkcs11" | sed -n -e '1,1 s/slot //' -e '1,1 p' ) + echo $SLOT + else + echo "Error: pkcsGetTokenSlot: could not find type $TYPE in $CONF" + return 1 + fi +} + +true <<'=cut' +=pod + +=head2 pkcsInitToken + +Initialize token specified using slot number and sets up +new SO PIN and USER PIN. + + pkcsInitToken type|slot [CURRENT_SO_PIN] + +=over + +=item type + +Token specification using the token type. +Available options are: sw, tpm, ica, cca, ep11. + +=item slot + +Token specification using the slot number. + + +=back + +Returns 0 when the initialization was successfull, non-zero otherwise. + +=cut + +pkcsInitToken() { + + local SLOT + local LABEL="$2" + [ -z $1 ] && echo "Error: pkcsInitToken: No token type specified" + # if token specified using slot number + if echo "$1" | grep -qE '^[0-9]+$'; then + SLOT=$1 + else # specified using token type + SLOT=$( pkcsGetTokenSlot $1 ) || return 1 + fi + echo SLOT: $SLOT + # if label not specified, use the current value + [ -z "$LABEL" ] && LABEL=`pkcsconf -t -c $SLOT | grep 'Label:' | sed 's/^.*Label: //'` + echo LABEL: $LABEL + local SOPIN=$2 + [ -z $SOPIN ] && SOPIN=$pkcsFACTORY_SO_PIN + + echo "pkcsInitToken: Initialize token" + cat < + +=back + +=cut diff --git a/Library/token-manipulation/main.fmf b/Library/token-manipulation/main.fmf new file mode 100644 index 0000000..bc721e6 --- /dev/null +++ b/Library/token-manipulation/main.fmf @@ -0,0 +1,19 @@ +summary: provides basic function for token manipulation +description: '' +contact: Karel Srot +component: [] +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-swtok +- expect +duration: 5m +enabled: true +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0607908 +extra-summary: '[pkcs] provides basic function for token manipulation (opencryptoki/token-manipulation)' +extra-task: /CoreOS/opencryptoki/Library/token-manipulation diff --git a/Library/token-manipulation/runtest.sh b/Library/token-manipulation/runtest.sh new file mode 100755 index 0000000..499e80c --- /dev/null +++ b/Library/token-manipulation/runtest.sh @@ -0,0 +1,62 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Library/token-manipulation +# Description: provides basic function for token manipulation +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +PHASE=${PHASE:-Test} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport ./token-manipulation" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + # Self test + if [[ "$PHASE" =~ "Test" ]]; then + rlPhaseStartTest "Test sw token initialization" + rlServiceStop pkcsslotd + pkcsResetTokens + rlServiceStart pkcsslotd + pkcsInitToken sw + rlRun -s "pkcsconf -t" + rlAssertGrep "USER_PIN_INITIALIZED" $rlRun_LOG + rlServiceStop pkcsslotd + pkcsRestoreTokens + rlServiceRestore pkcsslotd + rlPhaseEnd + fi + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/README.md b/README.md index 3a3dc4f..5890e7d 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,3 @@ -Tests have been moved to a RH internal GitLab CEE instance -/rhel-tests/opencryptoki +# opencryptoki + +tests for the opencryptoki package \ No newline at end of file diff --git a/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf new file mode 100644 index 0000000..2ca6f1d --- /dev/null +++ b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/main.fmf @@ -0,0 +1,24 @@ +summary: Test for BZ#1154647 (opencryptoki-libs should Requires(pre)) +description: | + Bug summary: opencryptoki-libs should Requires(pre) shadow-utils + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1154647 +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-libs +duration: 3m +enabled: true +tag: +- TIPpass_Security +- Tier3 +- Tier3security +tier: '3' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1154647 +extra-nitrate: TC#0430383 +extra-summary: /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre +extra-task: /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre diff --git a/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh new file mode 100755 index 0000000..c919416 --- /dev/null +++ b/Regression/bz1154647-opencryptoki-libs-should-Requires-pre/runtest.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Regression/bz1154647-opencryptoki-libs-should-Requires-pre +# Description: Test for BZ#1154647 (opencryptoki-libs should Requires(pre)) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlPhaseEnd + + rlPhaseStartTest + if rpm -q --scripts opencryptoki-libs | grep groupadd; then + rlPass "Just check that opencryptoki-libs are calling groupadd" + rlRun -s "rpm -qv --requires opencryptoki-libs" + rlAssertGrep 'pre: shadow-utils' $rlRun_LOG + rm $rlRun_LOG + else + rlLogInfo "This test is not relevant for opencryptoki-libs which does not call grupadd in scripts" + fi + + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf new file mode 100644 index 0000000..5ad3734 --- /dev/null +++ b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/main.fmf @@ -0,0 +1,26 @@ +summary: Tests if validation PIN is actually checked for correctness +description: '' +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-libs +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- TIPpass_Security +- Tier2 +- Tier2security +- TierCandidatesPASS +tier: '2' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=415971 +extra-nitrate: TC#0067826 +extra-summary: /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong +extra-task: /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp new file mode 100755 index 0000000..1752178 --- /dev/null +++ b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/pkcsconf.exp @@ -0,0 +1,46 @@ +#!/usr/bin/expect +set cmd [lrange $argv 0 0] + +log_user 1 +spawn $cmd -I -c 0 +expect "Enter the SO PIN: " +sleep .1 +send "87654321\r" +sleep .1 +expect "label: " +sleep .1 +send "cryptotest\r" +sleep .1 +expect eof + +spawn $cmd -u -c 0 +expect "Enter the SO PIN: " +sleep .1 +send "87654321\r" +sleep .1 +expect "Enter the new user PIN: " +sleep .1 +send "test\r" +sleep .1 +expect "Re-enter the new user PIN: " +sleep .1 +send "test\r" +sleep .1 +expect eof + +spawn $cmd -p -c 0 +expect "Enter user PIN: " +sleep .1 +send "test\r" +sleep .1 +expect "Enter the new user PIN: " +sleep .1 +send "text\r" +sleep .1 +expect "Re-enter the new user PIN: " +sleep .1 +send "text1\r" +sleep .1 +expect eof + + diff --git a/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh new file mode 100755 index 0000000..086e463 --- /dev/null +++ b/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong/runtest.sh @@ -0,0 +1,65 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Regression/bz415971-pkcsconf-validation-of-PIN-is-wrong +# Description: Tests if validation PIN is actually checked for correctness +# Author: Miroslav Vadkerti +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +PKCSCONF="pkcsconf" + +TMP=`mktemp` + +function reset_tokens() { + rlLogInfo "Reseting tokens..." + rlServiceStop pkcsslotd + rlRun "find /var/lib/opencryptoki/ -type f -exec rm {} \\;" + rlServiceStart pkcsslotd + rlLogInfo "--- reset finished ---" +} + + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlFileBackup --clean /var/lib/opencryptoki + [ -d /etc/opencryptoki ] && rlFileBackup --clean /etc/opencryptoki + reset_tokens + rlPhaseEnd + + rlPhaseStartTest + rlRun "./pkcsconf.exp $PKCSCONF 2>&1 | tee $TMP" + rlAssertGrep "Invalid new user pin|New PINs do not match." $TMP -E + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf $TMP" + rlFileRestore + rlServiceRestore pkcsslotd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf new file mode 100644 index 0000000..50485a3 --- /dev/null +++ b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/main.fmf @@ -0,0 +1,40 @@ +summary: Opencryptoki-session-object-performance-degradation +description: | + Tests if overall performance of cryptographic operations degrades exponentially + with the number of objects per token or open sessions per process +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-swtok +- gcc +- automake +- libtool +- openssl-devel +- expect +- yum-utils +- bzip2 +- rpm-build +- libica-devel +duration: 20m +enabled: true +tag: +- TIPpass_Security +- Tier3 +- Tier3security +- rhel8-buildroot +- rhel9-buildroot +tier: '3' +adjust: +- enabled: false + when: arch == ia64 + continue: false +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=612274 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=627560 +extra-nitrate: TC#0075518 +extra-summary: /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation +extra-task: /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation diff --git a/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh new file mode 100755 index 0000000..391d4cc --- /dev/null +++ b/Regression/bz612274-Opencryptoki-session-object-performance-degradation/runtest.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Regression/bz612274-Opencryptoki-session-object-performance-degradation +# Description: Tests if overall performance of cryptographic operations degrades exponentially with the number of objects per token or open sessions per process +# Author: Miroslav Vadkerti +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +PACKAGES="gcc automake libtool openssl-devel expect" +TMPDIR=`mktemp -d` +TMP=`mktemp` +SRC="src.tbz" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + for PKG in $PACKAGES; do + rlAssertRpm $PKG + done + PKGVER=`rpm -q --qf '%{VERSION}' opencryptoki` + rlServiceStart "pkcsslotd" + # use always software slot + # SLOT=$(($(pkcsconf -s | grep -B1 Soft | grep -o '#[0-9]' | tr -d '#')-1)) + SLOT=$(pkcsconf -s | egrep -B1 '(Soft|Linux)' | grep -o '#[0-9]' | tr -d '#') + rlLog "Using slot $SLOT" + rlRun "pushd ." + rlRun "cd $TMPDIR" + rlFetchSrcForInstalled opencryptoki + rlRun "yum-builddep -y opencryptoki*src.rpm" + rlRun "rpm -i opencryptoki*src.rpm" + + # opencryptoki version >= 3.11.0 needs to enable building test cases during the pkg build + rlRun "sed -i 's/^%configure /%configure --enable-testcases /' ~/rpmbuild/SPECS/opencryptoki.spec" + rlRun "rpmbuild -bp ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Preparing builddir" + TESTDIR=`ls -d ~/rpmbuild/BUILD/opencryptoki*/testcases` + rlRun "pushd . && cd $TESTDIR" + rlRun "sed -i 's/50000/10000/g' pkcs11/sess_perf.c" 0 "Adjusting testcase" + rlRun "rpmbuild -bc --short-circuit ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Building opencryptoki files" + popd + rlPhaseEnd + + rlPhaseStartTest + cd $TESTDIR + if [ -d driver ]; then + rlRun "cd driver" + rlRun "./sess_perf_tests -slot $SLOT | tee $TMP" + else + rlRun "cd pkcs11" + rlRun "./sess_bench -slot $SLOT | tee $TMP" + fi + rlRun "cat $TMP | grep CKR" 1 "Checking for errors" + # Count the number occurrences when performance test time exceeds >10ms + # In buggy version this will happen a lot and the performance will degrade. + # The count (3) currently tested may need more adjustment. + COUNT=$(cat $TMP | grep Time | egrep -c '[0-9][0-9]+') + rlAssertGreater "Checking performance" 3 $COUNT + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -rf $TMPDIR $TMP" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf b/Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf new file mode 100644 index 0000000..40b6ccc --- /dev/null +++ b/Regression/bz732756-do-not-add-root-to-pkcs11-group/main.fmf @@ -0,0 +1,28 @@ +summary: Checks if root is not added to the pkcs11 group +description: +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: +- TIPpass_Security +- Tier3 +- Tier3security +tier: '3' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=732756 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=833828 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1054442 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1013017 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=833818 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1058814 +extra-nitrate: TC#0111303 +extra-summary: /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group +extra-task: /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group diff --git a/Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh b/Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh new file mode 100755 index 0000000..a339076 --- /dev/null +++ b/Regression/bz732756-do-not-add-root-to-pkcs11-group/runtest.sh @@ -0,0 +1,58 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Regression/bz732756-do-not-add-root-to-pkcs11-group +# Description: Checks if root is not added to the pkcs11 group and opencryptoki works well in this case +# Author: Miroslav Vadkerti +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +ROOT=$(mktemp -d) + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + if rlIsFedora '>=22'; then + # dnf is not able to use system relesever when changing installroot (#1173107) + RELEASEVER=$(. /etc/os-release; echo $VERSION_ID) + rlRun -s "dnf -y install --nogpg --releasever=$RELEASEVER --installroot=$ROOT opencryptoki opencryptoki-swtok 2>&1" + rlAssertNotGrep "group pkcs11 does not exist" $rlRun_LOG + else + rlRun -s "yum -y install --nogpg --installroot=$ROOT opencryptoki opencryptoki-swtok 2>&1" + rlAssertNotGrep "group pkcs11 does not exist" $rlRun_LOG + fi + rlPhaseEnd + + rlPhaseStartTest "pkcs11 group should exist but root should not be a member" + rlAssertGrep "^pkcs11" "$ROOT/etc/group" -E + rlAssertNotGrep "^pkcs11.*root" "$ROOT/etc/group" -E + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf $ROOT" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/PID-file-location/main.fmf b/Sanity/PID-file-location/main.fmf new file mode 100644 index 0000000..3036ec6 --- /dev/null +++ b/Sanity/PID-file-location/main.fmf @@ -0,0 +1,30 @@ +summary: Test for BZ#1974693 (pkcsslotd PIDfile below legacy directory /var/run/) +description: | + Bug summary: pkcsslotd PIDfile below legacy directory /var/run/ + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1974693 +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +require: + - library(nvr/nvr) +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-icsftok +- opencryptoki-icatok +- opencryptoki-ccatok +duration: 2m +enabled: true +tag: +- Tier1 +- CI-Tier-1 +adjust: +- enabled: false + when: "distro == rhel-7 or distro < rhel-8.9" + continue: false +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974693 +extra-nitrate: TC#0611070 diff --git a/Sanity/PID-file-location/runtest.sh b/Sanity/PID-file-location/runtest.sh new file mode 100755 index 0000000..a6544b8 --- /dev/null +++ b/Sanity/PID-file-location/runtest.sh @@ -0,0 +1,64 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Test for BZ#1974693 (pkcsslotd PIDfile below legacy directory /var/run/) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +UNITFILE="/usr/lib/systemd/system/pkcsslotd.service" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" + rlAssertRpm $PACKAGE + rlAssertExists $UNITFILE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStop pkcsslotd + rlPhaseEnd + + rlPhaseStartTest + PIDFILE=/run/opencryptoki/pkcsslotd.pid + nvrTestPackage opencryptoki '<' 3.21.0 && PIDFILE=/run/pkcsslotd.pid + + rlAssertGrep "PIDFile=$PIDFILE" $UNITFILE + rlServiceStart pkcsslotd + rlRun -s "journalctl -u pkcsslotd -S '-10s'" + #rlAssertGrep "PID File created" $rlRun_LOG + rlAssertGrep "Started (pkcsslotd.service)?.*Daemon" $rlRun_LOG -E + rlAssertNotGrep "PIDFile= references a path below legacy directory" $rlRun_LOG + rlAssertExists $PIDFILE + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd + +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/init-token-as-a-nonroot-user/main.fmf b/Sanity/init-token-as-a-nonroot-user/main.fmf new file mode 100644 index 0000000..d4a9e28 --- /dev/null +++ b/Sanity/init-token-as-a-nonroot-user/main.fmf @@ -0,0 +1,36 @@ +summary: basic token initialization as a nonroot user +description: basic token initialization as a nonroot user +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +- library(nvr/nvr) +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-ccatok +- opencryptoki-icsftok +- opencryptoki-icatok +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- TIPpass_Security +- Tier1 +- Tier1security +tier: '1' +adjust: +- enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0342770 +extra-summary: /CoreOS/openCryptoki/Sanity/bz1054661-init-token-as-a-nonroot-user +extra-task: /CoreOS/openCryptoki/Sanity/bz1054661-init-token-as-a-nonroot-user diff --git a/Sanity/init-token-as-a-nonroot-user/runtest.sh b/Sanity/init-token-as-a-nonroot-user/runtest.sh new file mode 100755 index 0000000..3f69d25 --- /dev/null +++ b/Sanity/init-token-as-a-nonroot-user/runtest.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Sanity/bz1054661-init-token-as-a-nonroot-user +# Description: basic token initialization as a nonroot user +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +USER="user$RANDOM" + +TESTDIR=`pwd` + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library" + # need to find out the library path so a user can import it too + rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library" + LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'` + echo "LIBPATH=$LIBPATH" + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "useradd -m $USER -G pkcs11" + rlRun -s "su $USER -c 'id'" + rlAssertGrep "pkcs11" $rlRun_LOG + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + rlPhaseEnd + + rlPhaseStartTest "listing available tokens as a testuser" + rlRun "su $USER -c 'pkcsconf -t' &> query1.log" + cat query1.log + if nvrTestPackage opencryptoki '<' 3.14.0; then + rlAssertGrep "Model: IBM SoftTok" query1.log + else + rlAssertGrep "Model: Soft " query1.log + fi + rlPhaseEnd + + # initialize every token available + for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do + + rlPhaseStartTest "initialize token #$SLOT" + rlRun "su $USER -c 'source $LIBPATH && pkcsInitToken $SLOT'" + rlRun "su $USER -c 'pkcsconf -t -c $SLOT' &> query2.log" + cat query2.log + rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E + rlPhaseEnd + + done + + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlLog "Waiting 12 for systemd --user process to exit..." + sleep 15 + rlRun "userdel -r $USER" || ps -ef + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/init-tokens-as-root/main.fmf b/Sanity/init-tokens-as-root/main.fmf new file mode 100644 index 0000000..55d6cd1 --- /dev/null +++ b/Sanity/init-tokens-as-root/main.fmf @@ -0,0 +1,39 @@ +summary: Initialize all available tokens as a root user +description: | + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1122505 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +- library(nvr/nvr) +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-ccatok +- opencryptoki-icsftok +- opencryptoki-icatok +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- TIPpass_FIPS +- TIPpass_Security +- Tier1 +- Tier1security +- TierCandidatesPASS +tier: '1' +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0470488 +extra-summary: /CoreOS/opencryptoki/Sanity/init-tokens-as-root +extra-task: /CoreOS/opencryptoki/Sanity/init-tokens-as-root diff --git a/Sanity/init-tokens-as-root/runtest.sh b/Sanity/init-tokens-as-root/runtest.sh new file mode 100755 index 0000000..e57e47f --- /dev/null +++ b/Sanity/init-tokens-as-root/runtest.sh @@ -0,0 +1,77 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/init-tokens-as-root +# Description: Test for BZ#1122505 (opencryptoki sw token no longer found after rebase) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2015 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +TESTDIR=`pwd` + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library" + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlRun "id root | grep pkcs11" 1 "Verify that root is not in pkcs11 group" + rlServiceStart pkcsslotd + rlPhaseEnd + + rlPhaseStartTest "listing available tokens as root" + rlRun "pkcsconf -t &> query1.log" + cat query1.log + if nvrTestPackage opencryptoki '<' 3.14.0; then + rlAssertGrep "Model: IBM SoftTok" query1.log + else + rlAssertGrep "Model: Soft " query1.log + fi + rlPhaseEnd + + # initialize every token available + for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do + + rlPhaseStartTest "initialize token #$SLOT as root" + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t -c $SLOT &> query2.log" + cat query2.log + rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E + rlPhaseEnd + done + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlServiceRestore pkcsslotd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/lock-files-are-persistent-across-system-reboot/main.fmf b/Sanity/lock-files-are-persistent-across-system-reboot/main.fmf new file mode 100644 index 0000000..e957fbb --- /dev/null +++ b/Sanity/lock-files-are-persistent-across-system-reboot/main.fmf @@ -0,0 +1,28 @@ +summary: Test for BZ#1054442 (lock files are not persistent after system reboot) +description: | + Bug summary: lock files are not persistent after system reboot even though the lock files are entered in tmpfiles.d (opencryptoki) + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1054442 +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-icsftok +- opencryptoki-icatok +- opencryptoki-ccatok +duration: 15m +enabled: true +tag: +- TIPpass_FIPS +- TIPpass_Security +- TierCandidatesPASS +- notier +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1054442 +extra-nitrate: TC#0336748 +extra-summary: /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot +extra-task: /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot diff --git a/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh b/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh new file mode 100755 index 0000000..b5b691c --- /dev/null +++ b/Sanity/lock-files-are-persistent-across-system-reboot/runtest.sh @@ -0,0 +1,68 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Regression/bz1054442-lock-files-are-not-persistent-after-system-reboot +# Description: Test for BZ#1054442 (lock files are not persistent after system reboot) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStart pkcsslotd + rlPhaseEnd + + rlPhaseStartTest + if arch | grep s390; then + SUBDIRS="ccatok icsf lite swtok" + else + SUBDIRS="icsf swtok" + fi + rlIsRHEL '<=8' && SUBDIRS="$SUBDIRS tpm" + for DIR in $SUBDIRS; do + rlAssertExists /var/lib/opencryptoki/$DIR + done + rlAssertExists /var/lock/opencryptoki + rlAssertExists /var/lock/opencryptoki/LCK..APIlock + if [ ! -f /bz1054442-rebooted ]; then + touch /bz1054442-rebooted + rlRun "rhts-reboot" + else + rlRun "rm /bz1054442-rebooted" + fi + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf new file mode 100644 index 0000000..2f7a713 --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/icatok.fmf @@ -0,0 +1,9 @@ +summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=ica +environment: + TOKEN: ica +adjust: +- enabled: false + when: arch != s390x + continue: false +extra-nitrate: TC#0611373 +extra-summary: TOKEN=ICA /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/openCryptoki-PIN-conversion-tool/main.fmf b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf new file mode 100644 index 0000000..c70fcf6 --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/main.fmf @@ -0,0 +1,41 @@ +summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) +description: | + Bug summary: [IBM 8.3 FEAT] openCryptoki: PIN conversion tool + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-icatok +- openssl +- gnutls-utils +- opensc +- expect +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- NoRHEL7 +- Tier1 +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1780294 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1853420 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1964304 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1995919 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1987256 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-task: /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh new file mode 100755 index 0000000..8f27406 --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/runtest.sh @@ -0,0 +1,100 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool +# Description: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +[ -n "$TOKEN" ] || TOKEN=sw +[ "$TOKEN" == "sw" ] && STORE=/var/lib/opencryptoki/swtok +[ "$TOKEN" == "ica" ] && STORE=/var/lib/opencryptoki/lite + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlFileBackup /etc/opencryptoki/opencryptoki.conf + [ -f /etc/opencryptoki/opencryptoki.conf_BAK ] && rlFileBackup /etc/opencryptoki/opencryptoki.conf_BAK && rlRun "rm -f /etc/opencryptoki/opencryptoki.conf_BAK" + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t" + SLOT=$( pkcsGetTokenSlot $TOKEN ) + MODEL=$( pkcsconf -t -c $SLOT | awk '/Model:/ { print $2 }' ) + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlRun "sed -i '/tokversion = 3.12/d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present" + # add token description to reproduce bz#1987256 + TEXT='description = "My Token"\nmanufacturer = "MyCompany Inc."' + rlRun "sed -i 's/stdll = libpkcs11_$TOKEN.so/description = \\\"My Token\\\"\nmanufacturer = \\\"MyCompany Inc\\\"\nstdll = libpkcs11_$TOKEN.so/' /etc/opencryptoki/opencryptoki.conf" + rlServiceStart pkcsslotd + # initialize token + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:model=${MODEL};manufacturer=IBM' --label id_rsa.pub" + rlAssertExists id_rsa.pub + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Token migration" + rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" 1 + rlAssertGrep "pkcstok_migrate: Please stop pkcsslotd before running this utility" $rlRun_LOG + rlServiceStop pkcsslotd + sleep 5 + systemctl status pkcsslotd --no-pager + rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" + rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG + grep -A 5 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf + rlRun "grep -A 5 -i 'slot $SLOT' /etc/opencryptoki/opencryptoki.conf | grep 'tokversion = 3.12'" 0 "Verify that slot configuration has been updated with 'tokversion = 3.12'" + rlServiceStart pkcsslotd + sleep 1 + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" 0 "Verify I still can list imported RSA key" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlLog "Exporting stored RSA key" + rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der --slot 0x$SLOT" + rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" + rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf new file mode 100644 index 0000000..1bee0ce --- /dev/null +++ b/Sanity/openCryptoki-PIN-conversion-tool/swtok.fmf @@ -0,0 +1,5 @@ +summary: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool) TOKEN=sw +environment: + TOKEN: sw +extra-nitrate: TC#0607912 +extra-summary: TOKEN=sw /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf new file mode 100644 index 0000000..9105e0d --- /dev/null +++ b/Sanity/p11sak-key-management-tool-basic-functionality/main.fmf @@ -0,0 +1,35 @@ +summary: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool) +description: | + Bug summary: [IBM 8.3 FEAT] openCryptoki key management tool: list keys function + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 +contact: Karel Srot +component: + - openCryptoki +test: ./runtest.sh +framework: beakerlib +require: + - library(nvr/nvr) + - url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: + - opencryptoki + - opencryptoki-swtok + - expect +duration: 5m +enabled: true +tag: + - CI-Tier-1 + - Tier1 + - customer_scenario +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1800549 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851109 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0607944 +extra-summary: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality +extra-task: /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality +id: 065dda66-85f0-4142-83d3-b4104d359d41 diff --git a/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh new file mode 100755 index 0000000..d54f273 --- /dev/null +++ b/Sanity/p11sak-key-management-tool-basic-functionality/runtest.sh @@ -0,0 +1,200 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality +# Description: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +[ -n "$SLOT" ] || SLOT=sw + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t | grep 'Soft'" + SLOT=$( pkcsGetTokenSlot $SLOT ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + rlPhaseEnd + + rlPhaseStartTest "Test key generation and listing" + rlRun -s "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep 'Generate symmetric key AES with keylen=128 and label="?\[aes_key\]"?' $rlRun_LOG -E + rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + else + rlAssertGrep 'Successfully generated a AES key with label "aes_key".' $rlRun_LOG + fi + rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E + + rlRun -s "p11sak gen-key 3des --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep 'Generate symmetric key 3DES with keylen=192 and label="?\[3des_key\]"?' $rlRun_LOG -E + rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG + else + rlAssertGrep 'Successfully generated a 3DES key with label "3des_key".' $rlRun_LOG + fi + rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep '3DES | "?3des_key"?' $rlRun_LOG -E + + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlRun -s "p11sak gen-key rsa 2048 --exponent 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" + rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG + rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG + else + rlRun -s "p11sak gen-key rsa 2048 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key" + rlAssertGrep 'Successfully generated a RSA key pair with labels "rsa_key:pub":"rsa_key:prv".' $rlRun_LOG + fi + rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep 'public RSA | "?rsa_key:pub"?' $rlRun_LOG -E + rlAssertGrep 'private RSA | "?rsa_key:prv"?' $rlRun_LOG -E + + rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG + else + rlAssertGrep 'Successfully generated a EC key pair with labels "ec_key:pub":"ec_key:prv".' $rlRun_LOG + fi + rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep 'Label: "?aes_key"?' $rlRun_LOG -E + rlAssertGrep 'Label: "?3des_key"?' $rlRun_LOG -E + rlAssertNotGrep 'Label: "?rsa_key"?' $rlRun_LOG -E + + rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep 'Label: "?rsa_key:prv"?' $rlRun_LOG -E + rlAssertNotGrep 'Label: "?rsa_key:pub"?' $rlRun_LOG -E + rlPhaseEnd + +if nvrTestPackage opencryptoki '>=' 3.17.0; then + rlPhaseStartTest "Test p11sak_defined_attrs.conf adjustment" + rlFileBackup /etc/opencryptoki/p11sak_defined_attrs.conf + rlRun "cat >> /etc/opencryptoki/p11sak_defined_attrs.conf <<_EOF +attribute { + name = CKA_PRIME_1 + id = 0x00000124 + type = CK_BYTE +} + +_EOF" + rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN" + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "CKA_PRIME_1: len=128 value:" $rlRun_LOG + else + rlAssertGrep "CKA_PRIME_1: \[sensitive\]" $rlRun_LOG + fi + rlPhaseEnd +fi + +if nvrTestPackage opencryptoki '>=' 3.15.0; then + rlPhaseStartTest "Test key removal" + rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Skip deleting Key. User input CKR_CANCEL" $rlRun_LOG + else + rlAssertGrep "1 key object(s) skipped." $rlRun_LOG + fi + rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "aes_key" $rlRun_LOG + + rlRun -s "echo n | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Skip deleting Key" $rlRun_LOG + else + rlAssertGrep "1 key object(s) skipped." $rlRun_LOG + fi + rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep "aes_key" $rlRun_LOG + + rlRun -s "echo y | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key" + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Object with Label: aes_key found and destroyed" $rlRun_LOG + else + rlAssertGrep 'Successfully removed AES 128 key object "aes_key".' $rlRun_LOG + rlAssertGrep "1 key object(s) removed." $rlRun_LOG + fi + rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertNotGrep "aes_key" $rlRun_LOG + + rlRun -s "p11sak rm-key 3des --force --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key" + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Object with Label: 3des_key found and destroyed" $rlRun_LOG + else + rlAssertGrep 'Successfully removed 3DES key object "3des_key".' $rlRun_LOG + rlAssertGrep "1 key object(s) removed." $rlRun_LOG + fi + rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertNotGrep "3des_key" $rlRun_LOG + + rlRun -s "p11sak rm rsa --force --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key:pub" + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlAssertGrep "Object with Label: rsa_key:pub found and destroyed" $rlRun_LOG + else + rlAssertGrep 'Successfully removed public RSA 2048 key object "rsa_key:pub".' $rlRun_LOG + rlAssertGrep "1 key object(s) removed." $rlRun_LOG + fi + rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertNotGrep "rsa_key:pub" $rlRun_LOG + rlPhaseEnd +fi + + rlPhaseStartTest "Test help printing" + rlRun -s "p11sak --help" + rlAssertGrep "Usage: p11sak COMMAND \[ARGS\] \[OPTIONS\]" $rlRun_LOG + + rlRun -s "p11sak generate-key --help" 0,7 + rlAssertGrep "Usage: p11sak generate-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG + + rlRun -s "p11sak list-key --help" 0,7 + rlAssertGrep "Usage: p11sak list-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG + + +if nvrTestPackage opencryptoki '>=' 3.15.0; then + rlRun -s "p11sak remove-key --help" 0,7 + rlAssertGrep "Usage: p11sak remove-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG +fi + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf new file mode 100644 index 0000000..13b45b4 --- /dev/null +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/main.fmf @@ -0,0 +1,46 @@ +summary: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories) +description: | + Bug summary: RHEL7.3 - patch to create lock and log directories from opencryptoki + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1343671 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +require: +- library(nvr/nvr) +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-tpmtok +- opencryptoki-ccatok +- opencryptoki-icsftok +- opencryptoki-icatok +- expect +- libselinux-utils +- policycoreutils +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- TIPpass_Security +- Tier1 +- Tier1security +- TierCandidatesPASS +tier: '1' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1343671 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373833 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697489 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0532369 +extra-summary: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories +extra-task: /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories diff --git a/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh new file mode 100755 index 0000000..b803b51 --- /dev/null +++ b/Sanity/pkcsslotd-to-create-lock-and-log-directories/runtest.sh @@ -0,0 +1,115 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/pkcsslotd-to-create-lock-and-log-directories +# Description: Test for BZ#1343671 (RHEL7.3 - patch to create lock and log directories) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +USER="bz1343671user" + +TESTDIR=`pwd` + +LOCKDIR=/run/lock # see bz#1373833 +rlIsRHEL '<7' && LOCKDIR=/var/lock + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library" + rlRun "rlImport opencryptoki/token-manipulation" 2> import.log || rlDie "Could not import opencryptoki/token-manipulation library" + # need library path so we can import it as a test user + LIBPATH=`grep 'Will try to import opencryptoki\/token-manipulation from' import.log | sed 's/^.*token-manipulation from//'` + echo "LIBPATH=$LIBPATH" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStop pkcsslotd + pkcsResetTokens + rlFileBackup --clean /var/lib/opencryptoki /var/log/opencryptoki $LOCKDIR/opencryptoki + # avoid using /var/lock symlink to properly test bug 1373833 + if [ "$LOCKDIR" == "/run/lock" ]; then + [ -L /var/lock ] && rlFileBackup /var/lock && rlRun "rm -f /var/lock" + fi + rlRun "useradd -m $USER -G pkcs11" + rlPhaseEnd + + # skip this one for opencryptoki 3.21.0 as since then the service is running as a regular user + if nvrTestPackage opencryptoki '<' 3.21.0; then + rlPhaseStartTest "testing directory creation during pkcsslotd start" + rlRun "rm -rf /var/log/opencryptoki $LOCKDIR/opencryptoki" + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + rlAssertExists /var/log/opencryptoki + rlAssertExists $LOCKDIR/opencryptoki + rlRun "matchpathcon /var/log/opencryptoki" + rlRun "matchpathcon $LOCKDIR/opencryptoki" + rlRun "su $USER -c 'pkcsconf -t' &> query1.log" + cat query1.log + if nvrTestPackage opencryptoki '<' 3.14.0; then + rlAssertGrep "Model: IBM SoftTok" query1.log + else + rlAssertGrep "Model: Soft " query1.log + fi + rlPhaseEnd + fi + + # initialize every token available + for SLOT in `sed -n 's/^Token #\([0-9]\).*/\1/gp' query1.log`; do + + rlPhaseStartTest "initialize token #$SLOT" + rlRun "su $USER -c 'source $LIBPATH && pkcsInitToken $SLOT'" + rlRun "su $USER -c 'pkcsconf -t -c $SLOT' &> query2.log" + cat query2.log + rlAssertGrep 'Flags:.*LOGIN_REQUIRED.*USER_PIN_INITIALIZED.*TOKEN_INITIALIZED' query2.log -E + rlPhaseEnd + + done + + if [ "$LOCKDIR" == "/run/lock" ]; then + rlPhaseStartTest "checking there is no /var/lock in filelist" + rlRun "rpm -ql $(rpm -qa | grep opencryptoki | tr '\n' ' ') | grep /var/lock" 1 + rlPhaseEnd + fi + + rlPhaseStartTest "checking $LOCKDIR/opencryptoki selinux contexts" + rlRun -s "restorecon -Rnv $LOCKDIR/opencryptoki" + rlAssertNotGrep "restorecon reset" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlFileRestore + rlRun "pkcsRestoreTokens" + rlServiceRestore pkcsslotd + rlLog "Waiting 12 sec for systemd --user process to exit..." + sleep 12 + rlRun "userdel -r $USER" || ps -ef + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/pkcsstats-basic-functionality/main.fmf b/Sanity/pkcsstats-basic-functionality/main.fmf new file mode 100644 index 0000000..31bd8ae --- /dev/null +++ b/Sanity/pkcsstats-basic-functionality/main.fmf @@ -0,0 +1,33 @@ +summary: Tests basic functionality of the pkcsstats command +description: | + Bug summary: openCryptoki: add crypto counters + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=2043854 + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=2044180 +contact: Karel Srot +component: + - opencryptoki +test: ./runtest.sh +framework: beakerlib +require: + - url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: + - opencryptoki + - opencryptoki-swtok + - expect +duration: 5m +enabled: true +tag: + - CI-Tier-1 + - Tier1 +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2043854 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2044180 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + - enabled: false + when: distro < rhel-8.7 or distro < rhel-9.1 + because: feature has been introduced in 8.7 and 9.1 +extra-nitrate: TC#0613736 diff --git a/Sanity/pkcsstats-basic-functionality/runtest.sh b/Sanity/pkcsstats-basic-functionality/runtest.sh new file mode 100755 index 0000000..eea03d4 --- /dev/null +++ b/Sanity/pkcsstats-basic-functionality/runtest.sh @@ -0,0 +1,126 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +[ -n "$SLOT" ] || SLOT=sw +USER="user$RANDOM" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "useradd -m $USER -G pkcs11" + rlRun -s "su $USER -c 'id'" + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t | grep 'Soft'" + SLOT=$( pkcsGetTokenSlot $SLOT ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + rlRun "pkcsstats -R" + rlPhaseEnd + + rlPhaseStartTest "Generate aes key as root and verify stats" + rlRun -s "pkcsstats -s $SLOT -U root" + rlAssertGrep "[no mechanisms were used]" $rlRun_LOG + rlRun "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED" + rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E + rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key" + rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN" + rlRun -s "pkcsstats -s $SLOT -U root" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E + rlAssertGrep "CKM_EC_KEY_PAIR_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Generate aes key as $USER and verify stats" + rlRun -s "pkcsstats -s $SLOT -U $USER" 0,1 + rlAssertGrep "(no mechanisms were used|No statistics are available for user '$USER')" $rlRun_LOG -E + rlRun "su - $USER -c 'sleep 3 && p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED'" + rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN" + rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E + rlRun -s "pkcsstats -s $SLOT -U $USER" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Print acummulated stats for all users" + rlRun -s "pkcsstats -s $SLOT -S" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *2 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Print --all-mechs stats for $USER" + rlRun -s "pkcsstats -s $SLOT --all-mechs -U $USER" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *1 *0 *0" $rlRun_LOG -E + rlAssertGrep "CKM_EC_KEY_PAIR_GEN *\| *0 *0 *0 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Reset stats for $USER" + rlRun -s "pkcsstats -r -U $USER" + rlRun -s "pkcsstats -s $SLOT -U $USER" + rlAssertGrep "no mechanisms were used" $rlRun_LOG + rlRun -s "pkcsstats -s $SLOT -U $USER -a" + rlAssertGrep "CKM_AES_KEY_GEN *\| *0 *0 *0 *0 *0" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Delete stats for $USER" + rlRun -s "pkcsstats -d -U $USER" + rlRun -s "pkcsstats -s $SLOT -U $USER -a" 1 + rlAssertGrep "No statistics are available for user '$USER'" $rlRun_LOG -E + rlPhaseEnd + + rlPhaseStartTest "Print user stats in JSON" + rlRun -s "pkcsstats -s $SLOT -j" + rlAssertGrep '"user": "root",' $rlRun_LOG + rlAssertGrep '"mechanism": "CKM_AES_KEY_GEN",' $rlRun_LOG + rlAssertGrep '"strength-128": 1,' $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "Print help" + rlRun -s "pkcsstats -h" + rlAssertGrep "Usage: pkcsstats \[OPTIONS\]" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlLog "Waiting 12 for systemd --user process to exit..." + sleep 15 + rlRun "userdel -r $USER" || ps -ef + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf b/Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf new file mode 100644 index 0000000..96dd4b1 --- /dev/null +++ b/Sanity/sign-opencryptoki-certificate-for-NSS/main.fmf @@ -0,0 +1,32 @@ +summary: Tests if signing certificate via opencryptoki module in NSS works +description: +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +require: +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +recommend: +- opencryptoki +- opencryptoki-swtok +- expect +- nss-tools +- rng-utils +duration: 20m +enabled: true +tag: +- CI-Tier-1 +- TIPpass_Security +- Tier2 +- Tier2security +tier: '2' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=654088 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1056036 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1059176 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600434 +extra-nitrate: TC#0102977 +extra-summary: /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS +extra-task: /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS diff --git a/Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh b/Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh new file mode 100755 index 0000000..b2c57a2 --- /dev/null +++ b/Sanity/sign-opencryptoki-certificate-for-NSS/runtest.sh @@ -0,0 +1,149 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Regression/bz654088-Get-CKR_FUNCTION_FAILED-when-trying-to-sign-a-opencryptoki-certificate-for-NSS +# Description: Tests if signing certificate via opencryptoki module in NSS works +# Author: Miroslav Vadkerti +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +PASS="redhat" +PASSTOKEN="01234567" +PASSTOKEN2="87654321" +SERVICE="pkcsslotd" +[ -n "$SLOT" ] || SLOT=sw +NSSDB_D="nssdb" +PASSWORD_F="${NSSDB_D}/nsspassword" +NSSDB_PREFIX="sql:" +rlIsRHEL 3 4 5 && NSSDB_PREFIX="" +M=0 +CACERT_NAME="cacert" +USERCERT_NAME="mycert" +USERCERT_REQ_F="${USERCERT_NAME}.req" +USERCERT_DER_F="${USERCERT_NAME}.der" +USERCERT_PEM_F="${USERCERT_NAME}.pem" +LOG_F="${PACKAGE}.log" +CONF_F="/usr/share/p11-kit/modules/opencryptoki.module" +LIB_F=$( rpm -ql opencryptoki-libs | grep pkcs11/libopencryptoki.so | head -1 ) + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlAssertRpm $PACKAGE + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop $SERVICE + rlRun "pkcsResetTokens" + rlServiceStart $SERVICE + sleep 1 + rlRun "pkcsconf -t" + SLOT=$( pkcsGetTokenSlot $SLOT ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + # prepar entropy generator + pidof rngd || ENTROPY=true + $ENTROPY && rngd -r /dev/urandom + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "mkdir -p ${NSSDB_D}" 0 + rlRun "echo '${PASS}' > ${PASSWORD_F}" 0 + rlRun "certutil -N -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F}" + M=`expr ${M} + 1` + rlRun "while [ 1 -eq 1 ]; do dd if=/dev/urandom bs=1 count=1; echo; sleep 0.0${RANDOM}; done 2>/dev/null | certutil -S -n ${CACERT_NAME} -s 'cn=CAcert' -x -t 'C,C,C' -m ${M} -v 120 -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F}" 0 "Generating CA certificate" + rlRun "certutil -L -d ${NSSDB_PREFIX}${NSSDB_D}" 0 "Certificate listing" + rlPhaseEnd + + rlPhaseStartTest + rlLog "Adding opencryptoki as an external module to opencryptoki" + + if rlIsRHEL '<8'; then + if [ -r /usr/lib64/opencryptoki/PKCS11_API.so ]; then + rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -nocertdb -add opencryptoki -libfile /usr/lib64/opencryptoki/PKCS11_API.so" + else + rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -nocertdb -add opencryptoki -libfile /usr/lib/opencryptoki/PKCS11_API.so" + fi + rlLog "Setting opencryptoki as the default module for all mechanisms" + rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -default opencryptoki -mechanisms RSA:DSA:DH:RC2:RC4:RC5:AES:CAMELLIA:DES:MD2:MD5:SHA1:SHA256:SHA512:SSL:TLS:RANDOM" + rlRun "modutil -force -dbdir ${NSSDB_PREFIX}${NSSDB_D} -list" + export TOKPARAM="" + export PINPARAM="" + else + [ -f $CONF_F ] && rlFileBackup $CONF_F; + echo $LIB_F + rlRun "cat > $CONF_F < pin + export TOKPARAM="-h softtok" + export PINPARAM="-f pin" + fi + + rlRun "while [ 1 -eq 1 ]; do dd if=/dev/urandom bs=1 count=1; echo; sleep 0.0${RANDOM}; done 2>/dev/null | certutil -f ${PASSWORD_F} -R -s 'CN=John Smith, O=Netscape, L=Mountain View, ST=California, C=US' -p '650-555-8888' -o ${USERCERT_REQ_F} -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F} ${TOKPARAM} ${PINPARAM}" 0 "Generating user certificate" + rlAssertExists "${USERCERT_REQ_F}" + M=`expr ${M} + 1` + expect -c " +spawn certutil -C -m ${M} -i ${USERCERT_REQ_F} -o ${USERCERT_PEM_F} -c ${CACERT_NAME} -d ${NSSDB_PREFIX}${NSSDB_D} -f ${PASSWORD_F} ${TOKPARAM} +expect {L13} {send -- $PASSTOKEN\r} +expect { + {L13} {send -- \"$PASTOKEN2\r\"; exp_continue} + eof { exit 0 } +} +" + rlAssertExists "${USERCERT_PEM_F}" + [ "x$(stat -c '%s' ${USERCERT_PEM_F})" = "x0" ] && rlFail "${USERCERT_PEM_F} is empty" || rlPass "${USERCERT_DER_F} create OK" + M=`expr ${M} + 1` + expect -c " +spawn certutil -C -d ${NSSDB_PREFIX}${NSSDB_D} -c ${CACERT_NAME} -i ${USERCERT_REQ_F} -o ${USERCERT_DER_F} -m ${M} -v 48 -1 -f ${PASSWORD_F} -5 ${TOKPARAM} +expect {L13} {send -- $PASSTOKEN\r} +expect { + {L13} {send -- \"$PASSTOKEN2\"\r; exp_continue} + {>} {send -- 01234567\r} +} +expect {y/N} {send -- N\r} +expect {>} {send -- 01234567\r} +expect {y/N} {send -- N\r} +expect eof +" + rlAssertExists "${USERCERT_DER_F}" + [ "x$(stat -c '%s' ${USERCERT_DER_F})" = "x0" ] && rlFail "${USERCERT_DER_F} is empty" || rlPass "${USERCERT_DER_F} create OK" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $CONF_F" + rlServiceStop $SERVICE + rlRun "pkcsRestoreTokens" + rlFileRestore + $ENTROPY && killall rngd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlServiceRestore $SERVICE + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/testsuite/main.fmf b/Sanity/testsuite/main.fmf new file mode 100644 index 0000000..c306132 --- /dev/null +++ b/Sanity/testsuite/main.fmf @@ -0,0 +1,38 @@ +summary: Executes testsuite shipped with opencryptoki +description: | + it seems it should work with softoken on all architectures +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +require: +- url: https://src.fedoraproject.org/tests/opencryptoki.git + name: /Library/token-manipulation +- library(nvr/nvr) +recommend: +- opencryptoki +- gcc +- yum-utils +- rpm-build +- opencryptoki-swtok +- opencryptoki-ccatok +- opencryptoki-icatok +duration: 100m +enabled: true +tag: +- TIPfail_Security +- noExpectedness +# test duration is big for tiers +- notier +- rhel8-buildroot +- rhel9-buildroot +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=644284 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1099175 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=904937 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=650482 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1099193 +extra-nitrate: TC#0063178 +extra-summary: /CoreOS/openCryptoki/Sanity/testsuite +extra-task: /CoreOS/openCryptoki/Sanity/testsuite diff --git a/Sanity/testsuite/runtest.sh b/Sanity/testsuite/runtest.sh new file mode 100755 index 0000000..e78a0fa --- /dev/null +++ b/Sanity/testsuite/runtest.sh @@ -0,0 +1,237 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Sanity/testsuite +# Description: Executes testsuite shipped with openCryptoki +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +# At the moment of creation of this test a lot of upstream tests +# were not fully functional. Please check README documents and +# try enable additional tests if possible +# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + +# find out package name +PACKAGE="opencryptoki" + +LOGDIR=`mktemp -d` + + +function reset_tokens() { + rlLogInfo "Reseting tokens..." + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens randomNamespace" # using different namespace not to overwrite previous backup + rlServiceStart pkcsslotd + rlLogInfo "Initializing tokens..." + rlRun "pkcsInitToken $SLOT" +} + +function get_test_id() { + ID=`cat $TmpDir/testid` + ID=$(( $ID+1 )) + echo $ID > $TmpDir/testid + echo $ID +} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "rlImport nvr/nvr" || rlDie "cannot import distribution/nvr library" + export PKCS11_USER_PIN=$pkcsUSER_PIN + export PKCS11_SO_PIN=$pkcsSO_PIN + rlAssertRpm $PACKAGE + TmpDir=`mktemp -d` + pushd $TmpDir + rlFetchSrcForInstalled $PACKAGE + rlRun "rpm -ivh $PACKAGE*.src.rpm" 0 "Installing $PACKAGE src rpm" + rlRun "yum-builddep -y ~/rpmbuild/SPECS/opencryptoki.spec" + # opencryptoki needs to enable building test cases during the pkg build + rlRun "sed -i 's/^%configure /%configure --enable-testcases /' ~/rpmbuild/SPECS/opencryptoki.spec" + rlRun "rpmbuild -bc ~/rpmbuild/SPECS/opencryptoki.spec &> build.log" 0 "Building opencryptoki files" + tail build.log + TESTDIR=`ls -d ~/rpmbuild/BUILD/opencryptoki*/testcases` + + rlServiceStop pkcsslotd + sleep 3 + rlRun "pkcsResetTokens" + + rlServiceStart pkcsslotd + rlLogInfo "Available tokens" + pkcsconf -t + # allow to pass SLOT number as a parameter + # or take the first available slot (Token) + [ -z "$SLOT" ] && SLOT=`pkcsconf -t | sed -n 's/^Token #\([0-9]\).*/\1/gp' | head -n 1` + rlLogInfo "Token under a test" + pkcsconf -t -c $SLOT + + NOSKIP="" + # !!!!!!!!!!!!!!!!!!!!!!! + # tests doings writes are not skipped only for a softoken because they could descrease flash memory + # lifetime on real tokens + pkcsconf -t -c $SLOT | grep -qi 'soft' && NOSKIP="-noskip" + rlPhaseEnd + + echo 0 > $TmpDir/testid + + rlPhaseStartTest "crypto" + reset_tokens + if [ -d $TESTDIR/crypto ]; then + export PKCS11_USER_PIN=01234567 + export PKCS11_SO_PIN=76543210 + pushd $TESTDIR/crypto + + RUN_SEPARATELY="ab_tests" # do not report results the usual way + + for TEST in *_tests; do + # skip test if it is on TODO list in README + if grep -A 1 $TEST README | grep -q TODO; then + rlLogWarning "Skipping $TEST since it is on TODO list in README" + elif echo $RUN_SEPARATELY | grep -q $TEST; then + ID=`get_test_id` + rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + else + ID=`get_test_id` + rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" + RESULT=$? + grep Total $TmpDir/testlog.$ID + rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID + rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID + # print log in case of error + [ $RESULT -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID + fi + done + popd + else + rlFail "No crypto tests available!" + fi + rlPhaseEnd + + rlPhaseStartTest "misc_tests" + if [ -d $TESTDIR/misc_tests ]; then + reset_tokens + pushd $TESTDIR/misc_tests + + # obj_mgmt_tests + ID=`get_test_id` + rlRun "./obj_mgmt_tests $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + + #spinlock_tests.sh + ID=`get_test_id` + rlRun "./spinlock_tests.sh -s 1 -p 10 -l 20 &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + + #fork + ID=`get_test_id` + rlRun "./fork -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID + rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID + + # events - added in 3.16.0-3.el9 + if nvrTestPackage opencryptoki '>=' 3.16.0; then + ID=`get_test_id` + rlRun "./events -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID + rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID + fi + + # p11sak_test.sh added in 3.17.0 + if nvrTestPackage opencryptoki '>=' 3.17.0; then + ID=`get_test_id` + rlRun "SLOT=$SLOT ./p11sak_test.sh &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertNotGrep 'TESTCASE.*FAIL' $TmpDir/testlog.$ID -E + fi + + popd + else + rlFail "No misc_tests test available!" + fi + rlPhaseEnd + + rlPhaseStartTest "pkcs11" + if [ -d $TESTDIR/pkcs11 ]; then + reset_tokens + pushd $TESTDIR/pkcs11 + for TEST in get_interface attribute copyobjects findobjects generate_keypair; do + ID=`get_test_id` + rlRun "./$TEST $NOSKIP -slot $SLOT &> $TmpDir/testlog.$ID" + RESULT=$? + grep Total $TmpDir/testlog.$ID + rlAssertGrep 'Errors=0' $TmpDir/testlog.$ID + rlAssertGrep 'Failed=0' $TmpDir/testlog.$ID + # print log in case of error + [ $RESULT -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID + done + + # now run additional tests with specific output + + #sess_opstate + # skip if using swtok since the test is being skipped with + # TESTCASE sess_opstate_funcs SKIP Get/SetOperationState digest test: state unsavable + ID=`get_test_id` + if [ "$SLOT" != "3" ]; then + rlRun "./sess_opstate -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep "TESTCASE sess_opstate_funcs PASS" $TmpDir/testlog.$ID + fi + + #getobjectsize + ID=`get_test_id` + rlRun "./getobjectsize -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep "C_GetObjectSize test passed" $TmpDir/testlog.$ID + + #hw_fn + ID=`get_test_id` + rlRun "./hw_fn -slot $SLOT &> $TmpDir/testlog.$ID" + [ $? -gt 0 ] && echo -e "Test log:\n" && cat $TmpDir/testlog.$ID # print log in case of error + rlAssertGrep "(Hardware Feature tests succeeded.|do_HW_Feature_Search passed)" $TmpDir/testlog.$ID -E + + popd + + else + rlFail "No pkcs11_tests test available!" + fi + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlBundleLogs testlogs $TmpDir/testlog* build.log + #rlRun "rpmbuild --clean -bp ~/rpmbuild/SPECS/opencryptoki.spec" 0 "Clean the BUILD root" + rlRun "rm -rf $TmpDir" + [ -d $TESTDIR ] && rlRun "rm -rf $TESTDIR" + rlFileRestore + rlRun "pkcsRestoreTokens" + rlServiceRestore pkcsslotd + rlPhaseEnd + +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf b/Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf new file mode 100644 index 0000000..17939f1 --- /dev/null +++ b/Sanity/tools-should-inform-user-about-pkcs11-group/main.fmf @@ -0,0 +1,31 @@ +summary: tools should inform user about pkcs11 group +description: | + Bug summary: RFE opencryptoki tools should inform the user that he is not in pkcs11 group + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1063763 +contact: Karel Srot +component: +- openCryptoki +test: ./runtest.sh +framework: beakerlib +recommend: +- opencryptoki +duration: 5m +enabled: true +tag: +- NoRHEL4 +- NoRHEL5 +- NoRHEL6 +- TIPpass_Security +- Tier2 +- Tier2security +tier: '2' +link: +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1063763 +- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697494 +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0598649 +extra-summary: /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that +extra-task: /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that diff --git a/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh b/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh new file mode 100755 index 0000000..84ce1bc --- /dev/null +++ b/Sanity/tools-should-inform-user-about-pkcs11-group/runtest.sh @@ -0,0 +1,57 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1063763-RFE-opencryptoki-tools-should-inform-the-user-that +# Description: Test for BZ#1063763 (RFE opencryptoki tools should inform the user that) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlServiceStart pkcsslotd + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "useradd -m bz1063763user" + rlPhaseEnd + + rlPhaseStartTest + rlRun -s "su - bz1063763user -c 'pkcsconf -t'" 144,6 + rlAssertGrep "Error initializing the PKCS11 library" $rlRun_LOG + rlAssertGrep "Note: all non-root users that require access to PKCS#11 tokens using opencryptoki must be assigned to the pkcs11 group to be able to communicate with the pkcsslotd daemon." $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlLog "Waiting 12 sec for systemd --user process to exit..." && sleep 12 + rlRun "userdel -r bz1063763user" 0 + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlServiceRestore pkcsslotd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Sanity/verify-all-HW-tokens-are-available/main.fmf b/Sanity/verify-all-HW-tokens-are-available/main.fmf new file mode 100644 index 0000000..59928c9 --- /dev/null +++ b/Sanity/verify-all-HW-tokens-are-available/main.fmf @@ -0,0 +1,30 @@ +summary: Verify that all tokens are available +description: | + Verify on s390x system that ICA and SWTPM tokens are available +contact: Karel Srot +component: +- opencryptoki +test: ./runtest.sh +framework: beakerlib +require: +recommend: +- opencryptoki +- opencryptoki-swtok +- opencryptoki-icatok +duration: 5m +enabled: true +tag: +- CI-Tier-1 +- Tier1 +tier: '1' +adjust: +- enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +- enabled: false + when: arch != s390x + continue: false + +extra-nitrate: TC#577597 +extra-summary: Verify that all tokens are available +extra-hardware: hostrequire = diff --git a/Sanity/verify-all-HW-tokens-are-available/runtest.sh b/Sanity/verify-all-HW-tokens-are-available/runtest.sh new file mode 100755 index 0000000..1158b06 --- /dev/null +++ b/Sanity/verify-all-HW-tokens-are-available/runtest.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Test for BZ#1122505 (opencryptoki sw token no longer found after rebase) +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" +TESTDIR=`pwd` + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlServiceStart pkcsslotd + rlPhaseEnd + + rlPhaseStartTest "listing available tokens" + rlRun -s "pkcsconf -t" + rlAssertGrep "Model: ICA" $rlRun_LOG + rlAssertGrep "Model: Soft" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlServiceRestore pkcsslotd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/Update/dnf-update-opencryptoki/main.fmf b/Update/dnf-update-opencryptoki/main.fmf new file mode 100644 index 0000000..77b47d9 --- /dev/null +++ b/Update/dnf-update-opencryptoki/main.fmf @@ -0,0 +1,8 @@ +summary: Update opencryptoki package with dnf +contact: Karel Srot +tag: + - setup +framework: shell +duration: 10m +enabled: true +test: "dnf -y update 'opencryptoki*'" diff --git a/Update/initialized-ica-token/main.fmf b/Update/initialized-ica-token/main.fmf new file mode 100644 index 0000000..59dcfe9 --- /dev/null +++ b/Update/initialized-ica-token/main.fmf @@ -0,0 +1,30 @@ +summary: initialize ICA token and test it still works after an update +description: '' +contact: Karel Srot +component: + - opencryptoki +test: ./runtest.sh +framework: beakerlib +require: + - url: https://src.fedoraproject.org/tests/opencryptoki + name: /Library/token-manipulation +recommend: + - opencryptoki + - opencryptoki-icatok + - libica + - gnutls-utils + - opensc + - expect +duration: 5m + +/all: + environment: + PHASES: all + +/setup: + environment: + PHASES: "setup,test" + +/test: + environment: + PHASES: test diff --git a/Update/initialized-ica-token/runtest.sh b/Update/initialized-ica-token/runtest.sh new file mode 100755 index 0000000..d3858bf --- /dev/null +++ b/Update/initialized-ica-token/runtest.sh @@ -0,0 +1,121 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Upgrade/initialized-ica-token +# Description: initialize ICA token and test it still works after an update +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +function phaseSetup() { + rlPhaseStartTest + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlRun "systemctl enable pkcsslotd" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t" + SLOT=$( pkcsGetTokenSlot ica ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + if rlIsRHEL '<8'; then + rlRun "GNUTLS_PIN=$pkcsUSER_PIN p11tool --generate-rsa --login --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" + else + rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" + fi + rlAssertExists id_rsa.pub + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlPhaseEnd +} + + +function phaseTest() { + rlPhaseStartTest + rlRun "pkcsconf -t" + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" 0 "Verify I still can list imported RSA key" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlLog "Exporting stored RSA key" + rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" + rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" + rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" + rlPhaseEnd +} + + +function phaseCleanup() { + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +} + + +rlJournalStart + + rlPhaseStartSetup "init" + rlAssertRpm $PACKAGE + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=/var/tmp/opencryptoki-tests-runtime-files" + [ -d $TmpDir ] || rlRun "mkdir -p $TmpDir" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + if rlIsRHEL '<8'; then + rlRun "TokenSpec='model=IBM%20ICA'" + else + rlRun "TokenSpec='model=ICA;manufacturer=IBM'" + fi + rlPhaseEnd + + # clear $PHASES if IN_PLACE_UPGRADE is specified + [ -n "$IN_PLACE_UPGRADE" ] && PHASES="" + echo IN_PLACE_UPGRADE=$IN_PLACE_UPGRADE + echo PHASES=$PHASES + + # run setup, except when running post-upgrade phase + if [ -n "$IN_PLACE_UPGRADE" -a "$IN_PLACE_UPGRADE" != "new" ] || echo ${PHASES} | egrep -qi '(setup|all)'; then + phaseSetup + fi + + # run test by default + if [ -z "${PHASES}" ] || echo ${PHASES} | egrep -qi '(test|all)'; then + phaseTest + fi + + popd + # run cleanup only when run as a standalone test + if [ -z "$IN_PLACE_UPGRADE" ] && echo ${PHASES} | egrep -qi '(cleanup|all)'; then + phaseCleanup + fi + +rlJournalPrintText +rlJournalEnd diff --git a/Update/initialized-sw-token/main.fmf b/Update/initialized-sw-token/main.fmf new file mode 100644 index 0000000..71f1582 --- /dev/null +++ b/Update/initialized-sw-token/main.fmf @@ -0,0 +1,29 @@ +summary: initialize sw token and test it still works after an update +description: '' +contact: Karel Srot +component: + - opencryptoki +test: ./runtest.sh +framework: beakerlib +require: + - url: https://src.fedoraproject.org/tests/opencryptoki + name: /Library/token-manipulation +recommend: + - opencryptoki + - opencryptoki-swtok + - gnutls-utils + - opensc + - expect +duration: 5m + +/all: + environment: + PHASES: all + +/setup: + environment: + PHASES: "setup,test" + +/test: + environment: + PHASES: test diff --git a/Update/initialized-sw-token/runtest.sh b/Update/initialized-sw-token/runtest.sh new file mode 100755 index 0000000..78e7e40 --- /dev/null +++ b/Update/initialized-sw-token/runtest.sh @@ -0,0 +1,122 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/openCryptoki/Upgrade/initialized-sw-token +# Description: initialize sw token and test it still works after an update +# Author: Karel Srot +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="opencryptoki" + +function phaseSetup() { + rlPhaseStartSetup + rlFileBackup /etc/opencryptoki/opencryptoki.conf + rlServiceStop pkcsslotd + rlRun "pkcsResetTokens" + rlRun "systemctl enable pkcsslotd" + rlServiceStart pkcsslotd + sleep 1 + rlRun "pkcsconf -t | grep 'Soft'" + SLOT=$( pkcsGetTokenSlot sw ) + rlRun "pkcsInitToken $SLOT" + rlRun "pkcsconf -t" + if rlIsRHEL '<8'; then + rlRun "GNUTLS_PIN=$pkcsUSER_PIN p11tool --generate-rsa --login --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" + else + rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub" + fi + rlAssertExists id_rsa.pub + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlPhaseEnd +} + + +function phaseTest() { + rlPhaseStartTest + rlRun "pkcsconf -t" + rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects" 0 "Verify I still can list imported RSA key" + rlAssertGrep "Public Key Object" $rlRun_LOG + rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E + rlLog "Exporting stored RSA key" + rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der" + rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format" + rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key" + rlRun "popd" + rlPhaseEnd +} + + +function phaseCleanup() { + rlPhaseStartCleanup + rlServiceStop pkcsslotd + rlRun "pkcsRestoreTokens" + rlFileRestore + rlServiceRestore pkcsslotd + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +} + + +rlJournalStart + + rlPhaseStartSetup "init" + rlAssertRpm $PACKAGE + rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library" + rlRun "TmpDir=/var/tmp/opencryptoki-tests-runtime-files" + [ -d $TmpDir ] || rlRun "mkdir -p $TmpDir" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + if rlIsRHEL '<8'; then + rlRun "TokenSpec='model=IBM%20SoftTok'" + else + rlRun "TokenSpec='model=Soft;manufacturer=IBM'" + fi + rlPhaseEnd + + # clear $PHASES if IN_PLACE_UPGRADE is specified + [ -n "$IN_PLACE_UPGRADE" ] && PHASES="" + echo IN_PLACE_UPGRADE=$IN_PLACE_UPGRADE + echo PHASES=$PHASES + + # run setup, except when running post-upgrade phase + if [ -n "$IN_PLACE_UPGRADE" -a "$IN_PLACE_UPGRADE" != "new" ] || echo ${PHASES} | egrep -qi '(setup|all)'; then + phaseSetup + fi + + # run test by default + if [ -z "${PHASES}" ] || echo ${PHASES} | egrep -qi '(test|all)'; then + phaseTest + fi + + popd + # run cleanup only when run as a standalone test + if [ -z "$IN_PLACE_UPGRADE" ] && echo ${PHASES} | egrep -qi '(cleanup|all)'; then + phaseCleanup + fi + +rlJournalPrintText +rlJournalEnd diff --git a/main.fmf b/main.fmf new file mode 100644 index 0000000..e46882f --- /dev/null +++ b/main.fmf @@ -0,0 +1,2 @@ +environment: + GIT_SSL_NO_VERIFY: "true" diff --git a/plans/opencryptoki-tests-fedora-ci.fmf b/plans/opencryptoki-tests-fedora-ci.fmf new file mode 100644 index 0000000..9cfd67a --- /dev/null +++ b/plans/opencryptoki-tests-fedora-ci.fmf @@ -0,0 +1,11 @@ +summary: + Run modified tests using Fedora CI +discover: + how: fmf +# modified-only: True +# modified-url: https://src.fedoraproject.org/tests/opencryptoki.git +# modified-ref: reference/main +# filter: +# - tag: CI-Tier-1 +execute: + how: tmt diff --git a/plans/regression.fmf b/plans/regression.fmf new file mode 100644 index 0000000..ac7c1f5 --- /dev/null +++ b/plans/regression.fmf @@ -0,0 +1,10 @@ +summary: Runs all tests + +discover: + how: fmf + test: + - /Sanity/* + - /Regression/* + +execute: + how: tmt