100 lines
5.1 KiB
Bash
Executable file
100 lines
5.1 KiB
Bash
Executable file
#!/bin/bash
|
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
#
|
|
# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1780294-openCryptoki-PIN-conversion-tool
|
|
# Description: Test for BZ#1780294 ([IBM 8.3 FEAT] openCryptoki PIN conversion tool)
|
|
# Author: Karel Srot <ksrot@redhat.com>
|
|
#
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
#
|
|
# Copyright (c) 2020 Red Hat, Inc.
|
|
#
|
|
# This copyrighted material is made available to anyone wishing
|
|
# to use, modify, copy, or redistribute it subject to the terms
|
|
# and conditions of the GNU General Public License version 2.
|
|
#
|
|
# This program is distributed in the hope that it will be
|
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
# PURPOSE. See the GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public
|
|
# License along with this program; if not, write to the Free
|
|
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
|
# Boston, MA 02110-1301, USA.
|
|
#
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
# Include Beaker environment
|
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
|
|
|
PACKAGE="opencryptoki"
|
|
|
|
[ -n "$TOKEN" ] || TOKEN=sw
|
|
[ "$TOKEN" == "sw" ] && STORE=/var/lib/opencryptoki/swtok
|
|
[ "$TOKEN" == "ica" ] && STORE=/var/lib/opencryptoki/lite
|
|
|
|
rlJournalStart
|
|
rlPhaseStartSetup
|
|
rlAssertRpm $PACKAGE
|
|
rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
|
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
|
rlRun "pushd $TmpDir"
|
|
rlFileBackup /etc/opencryptoki/opencryptoki.conf
|
|
[ -f /etc/opencryptoki/opencryptoki.conf_BAK ] && rlFileBackup /etc/opencryptoki/opencryptoki.conf_BAK && rlRun "rm -f /etc/opencryptoki/opencryptoki.conf_BAK"
|
|
rlServiceStop pkcsslotd
|
|
rlRun "pkcsResetTokens"
|
|
rlServiceStart pkcsslotd
|
|
sleep 1
|
|
rlRun "pkcsconf -t"
|
|
SLOT=$( pkcsGetTokenSlot $TOKEN )
|
|
MODEL=$( pkcsconf -t -c $SLOT | awk '/Model:/ { print $2 }' )
|
|
rlServiceStop pkcsslotd
|
|
rlRun "pkcsResetTokens"
|
|
rlRun "sed -i '/tokversion = 3.12/d' /etc/opencryptoki/opencryptoki.conf" 0 "Remove tokversion = 3.12 from opencryptoki.conf if present"
|
|
# add token description to reproduce bz#1987256
|
|
TEXT='description = "My Token"\nmanufacturer = "MyCompany Inc."'
|
|
rlRun "sed -i 's/stdll = libpkcs11_$TOKEN.so/description = \\\"My Token\\\"\nmanufacturer = \\\"MyCompany Inc\\\"\nstdll = libpkcs11_$TOKEN.so/' /etc/opencryptoki/opencryptoki.conf"
|
|
rlServiceStart pkcsslotd
|
|
# initialize token
|
|
rlRun "pkcsInitToken $SLOT"
|
|
rlRun "pkcsconf -t"
|
|
rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:model=${MODEL};manufacturer=IBM' --label id_rsa.pub"
|
|
rlAssertExists id_rsa.pub
|
|
rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT"
|
|
rlAssertGrep "Public Key Object" $rlRun_LOG
|
|
rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
|
|
rlPhaseEnd
|
|
|
|
rlPhaseStartTest "Token migration"
|
|
rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN" 1
|
|
rlAssertGrep "pkcstok_migrate: Please stop pkcsslotd before running this utility" $rlRun_LOG
|
|
rlServiceStop pkcsslotd
|
|
sleep 5
|
|
systemctl status pkcsslotd --no-pager
|
|
rlRun -s "echo y | pkcstok_migrate -s $SLOT -d $STORE -c /etc/opencryptoki/ -p $pkcsSO_PIN -u $pkcsUSER_PIN"
|
|
rlAssertGrep "pkcstok_migrate finished successfully" $rlRun_LOG
|
|
grep -A 5 -i "slot $SLOT" /etc/opencryptoki/opencryptoki.conf
|
|
rlRun "grep -A 5 -i 'slot $SLOT' /etc/opencryptoki/opencryptoki.conf | grep 'tokversion = 3.12'" 0 "Verify that slot configuration has been updated with 'tokversion = 3.12'"
|
|
rlServiceStart pkcsslotd
|
|
sleep 1
|
|
rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --list-objects --slot 0x$SLOT" 0 "Verify I still can list imported RSA key"
|
|
rlAssertGrep "Public Key Object" $rlRun_LOG
|
|
rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
|
|
rlLog "Exporting stored RSA key"
|
|
rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der --slot 0x$SLOT"
|
|
rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format"
|
|
rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key"
|
|
rlPhaseEnd
|
|
|
|
rlPhaseStartCleanup
|
|
rlServiceStop pkcsslotd
|
|
rlRun "pkcsRestoreTokens"
|
|
rlFileRestore
|
|
rlServiceRestore pkcsslotd
|
|
rlRun "popd"
|
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
|
rlPhaseEnd
|
|
rlJournalPrintText
|
|
rlJournalEnd
|