200 lines
8.7 KiB
Bash
Executable file
200 lines
8.7 KiB
Bash
Executable file
#!/bin/bash
|
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
#
|
|
# runtest.sh of /CoreOS/opencryptoki/Sanity/bz1800549-p11sak-key-management-tool-basic-functionality
|
|
# Description: Test for BZ#1800549 ([IBM 8.3 FEAT] openCryptoki key management tool)
|
|
# Author: Karel Srot <ksrot@redhat.com>
|
|
#
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
#
|
|
# Copyright (c) 2020 Red Hat, Inc.
|
|
#
|
|
# This copyrighted material is made available to anyone wishing
|
|
# to use, modify, copy, or redistribute it subject to the terms
|
|
# and conditions of the GNU General Public License version 2.
|
|
#
|
|
# This program is distributed in the hope that it will be
|
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
# PURPOSE. See the GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public
|
|
# License along with this program; if not, write to the Free
|
|
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
|
# Boston, MA 02110-1301, USA.
|
|
#
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
# Include Beaker environment
|
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
|
|
|
PACKAGE="opencryptoki"
|
|
[ -n "$SLOT" ] || SLOT=sw
|
|
|
|
rlJournalStart
|
|
rlPhaseStartSetup
|
|
rlAssertRpm $PACKAGE
|
|
rlRun "rlImport nvr/nvr" || rlDie "cannot import nvr library"
|
|
rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
|
|
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
|
rlRun "pushd $TmpDir"
|
|
rlFileBackup /etc/opencryptoki/opencryptoki.conf
|
|
rlServiceStop pkcsslotd
|
|
rlRun "pkcsResetTokens"
|
|
rlServiceStart pkcsslotd
|
|
sleep 1
|
|
rlRun "pkcsconf -t | grep 'Soft'"
|
|
SLOT=$( pkcsGetTokenSlot $SLOT )
|
|
rlRun "pkcsInitToken $SLOT"
|
|
rlRun "pkcsconf -t"
|
|
rlPhaseEnd
|
|
|
|
rlPhaseStartTest "Test key generation and listing"
|
|
rlRun -s "p11sak generate-key aes 128 --slot $SLOT --pin $pkcsUSER_PIN --label aes_key --attr ED"
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlAssertGrep 'Generate symmetric key AES with keylen=128 and label="?\[aes_key\]"?' $rlRun_LOG -E
|
|
rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG
|
|
else
|
|
rlAssertGrep 'Successfully generated a AES key with label "aes_key".' $rlRun_LOG
|
|
fi
|
|
rlRun -s "p11sak list-key aes --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertGrep 'AES 128 | "?aes_key"?' $rlRun_LOG -E
|
|
|
|
rlRun -s "p11sak gen-key 3des --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key"
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlAssertGrep 'Generate symmetric key 3DES with keylen=192 and label="?\[3des_key\]"?' $rlRun_LOG -E
|
|
rlAssertGrep "Symmetric key generation successful!" $rlRun_LOG
|
|
else
|
|
rlAssertGrep 'Successfully generated a 3DES key with label "3des_key".' $rlRun_LOG
|
|
fi
|
|
rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertGrep '3DES | "?3des_key"?' $rlRun_LOG -E
|
|
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlRun -s "p11sak gen-key rsa 2048 --exponent 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key"
|
|
rlAssertGrep "Generate asymmetric key: RSA_PKCS" $rlRun_LOG
|
|
rlAssertGrep "Asymmetric key pair generation successful!" $rlRun_LOG
|
|
else
|
|
rlRun -s "p11sak gen-key rsa 2048 65537 --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key"
|
|
rlAssertGrep 'Successfully generated a RSA key pair with labels "rsa_key:pub":"rsa_key:prv".' $rlRun_LOG
|
|
fi
|
|
rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertGrep 'public RSA | "?rsa_key:pub"?' $rlRun_LOG -E
|
|
rlAssertGrep 'private RSA | "?rsa_key:prv"?' $rlRun_LOG -E
|
|
|
|
rlRun -s "p11sak gen-key ec prime256v1 --slot $SLOT --pin $pkcsUSER_PIN --label ec_key"
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlAssertGrep "Generate asymmetric key: EC" $rlRun_LOG
|
|
else
|
|
rlAssertGrep 'Successfully generated a EC key pair with labels "ec_key:pub":"ec_key:prv".' $rlRun_LOG
|
|
fi
|
|
rlRun -s "p11sak ls secret --long --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertGrep 'Label: "?aes_key"?' $rlRun_LOG -E
|
|
rlAssertGrep 'Label: "?3des_key"?' $rlRun_LOG -E
|
|
rlAssertNotGrep 'Label: "?rsa_key"?' $rlRun_LOG -E
|
|
|
|
rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertGrep 'Label: "?rsa_key:prv"?' $rlRun_LOG -E
|
|
rlAssertNotGrep 'Label: "?rsa_key:pub"?' $rlRun_LOG -E
|
|
rlPhaseEnd
|
|
|
|
if nvrTestPackage opencryptoki '>=' 3.17.0; then
|
|
rlPhaseStartTest "Test p11sak_defined_attrs.conf adjustment"
|
|
rlFileBackup /etc/opencryptoki/p11sak_defined_attrs.conf
|
|
rlRun "cat >> /etc/opencryptoki/p11sak_defined_attrs.conf <<_EOF
|
|
attribute {
|
|
name = CKA_PRIME_1
|
|
id = 0x00000124
|
|
type = CK_BYTE
|
|
}
|
|
|
|
_EOF"
|
|
rlRun -s "p11sak ls private --long --slot $SLOT --pin $pkcsUSER_PIN"
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlAssertGrep "CKA_PRIME_1: len=128 value:" $rlRun_LOG
|
|
else
|
|
rlAssertGrep "CKA_PRIME_1: \[sensitive\]" $rlRun_LOG
|
|
fi
|
|
rlPhaseEnd
|
|
fi
|
|
|
|
if nvrTestPackage opencryptoki '>=' 3.15.0; then
|
|
rlPhaseStartTest "Test key removal"
|
|
rlRun -s "echo '' | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key"
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlAssertGrep "Skip deleting Key. User input CKR_CANCEL" $rlRun_LOG
|
|
else
|
|
rlAssertGrep "1 key object(s) skipped." $rlRun_LOG
|
|
fi
|
|
rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertGrep "aes_key" $rlRun_LOG
|
|
|
|
rlRun -s "echo n | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key"
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlAssertGrep "Skip deleting Key" $rlRun_LOG
|
|
else
|
|
rlAssertGrep "1 key object(s) skipped." $rlRun_LOG
|
|
fi
|
|
rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertGrep "aes_key" $rlRun_LOG
|
|
|
|
rlRun -s "echo y | p11sak remove-key aes --slot $SLOT --pin $pkcsUSER_PIN --label aes_key"
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlAssertGrep "Object with Label: aes_key found and destroyed" $rlRun_LOG
|
|
else
|
|
rlAssertGrep 'Successfully removed AES 128 key object "aes_key".' $rlRun_LOG
|
|
rlAssertGrep "1 key object(s) removed." $rlRun_LOG
|
|
fi
|
|
rlRun -s "p11sak ls-key aes --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertNotGrep "aes_key" $rlRun_LOG
|
|
|
|
rlRun -s "p11sak rm-key 3des --force --slot $SLOT --pin $pkcsUSER_PIN --label 3des_key"
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlAssertGrep "Object with Label: 3des_key found and destroyed" $rlRun_LOG
|
|
else
|
|
rlAssertGrep 'Successfully removed 3DES key object "3des_key".' $rlRun_LOG
|
|
rlAssertGrep "1 key object(s) removed." $rlRun_LOG
|
|
fi
|
|
rlRun -s "p11sak ls-key 3des --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertNotGrep "3des_key" $rlRun_LOG
|
|
|
|
rlRun -s "p11sak rm rsa --force --slot $SLOT --pin $pkcsUSER_PIN --label rsa_key:pub"
|
|
if nvrTestPackage opencryptoki '<' 3.21.0; then
|
|
rlAssertGrep "Object with Label: rsa_key:pub found and destroyed" $rlRun_LOG
|
|
else
|
|
rlAssertGrep 'Successfully removed public RSA 2048 key object "rsa_key:pub".' $rlRun_LOG
|
|
rlAssertGrep "1 key object(s) removed." $rlRun_LOG
|
|
fi
|
|
rlRun -s "p11sak ls-key rsa --slot $SLOT --pin $pkcsUSER_PIN"
|
|
rlAssertNotGrep "rsa_key:pub" $rlRun_LOG
|
|
rlPhaseEnd
|
|
fi
|
|
|
|
rlPhaseStartTest "Test help printing"
|
|
rlRun -s "p11sak --help"
|
|
rlAssertGrep "Usage: p11sak COMMAND \[ARGS\] \[OPTIONS\]" $rlRun_LOG
|
|
|
|
rlRun -s "p11sak generate-key --help" 0,7
|
|
rlAssertGrep "Usage: p11sak generate-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG
|
|
|
|
rlRun -s "p11sak list-key --help" 0,7
|
|
rlAssertGrep "Usage: p11sak list-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG
|
|
|
|
|
|
if nvrTestPackage opencryptoki '>=' 3.15.0; then
|
|
rlRun -s "p11sak remove-key --help" 0,7
|
|
rlAssertGrep "Usage: p11sak remove-key \[ARGS\] \[OPTIONS\]" $rlRun_LOG
|
|
fi
|
|
rlPhaseEnd
|
|
|
|
rlPhaseStartCleanup
|
|
rlServiceStop pkcsslotd
|
|
rlRun "pkcsRestoreTokens"
|
|
rlFileRestore
|
|
rlServiceRestore pkcsslotd
|
|
rlRun "popd"
|
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
|
rlPhaseEnd
|
|
rlJournalPrintText
|
|
rlJournalEnd
|