123 lines
4.5 KiB
Bash
Executable file
123 lines
4.5 KiB
Bash
Executable file
#!/bin/bash
|
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
#
|
|
# runtest.sh of /CoreOS/openCryptoki/Upgrade/initialized-sw-token
|
|
# Description: initialize sw token and test it still works after an update
|
|
# Author: Karel Srot <ksrot@redhat.com>
|
|
#
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
#
|
|
# Copyright (c) 2020 Red Hat, Inc.
|
|
#
|
|
# This copyrighted material is made available to anyone wishing
|
|
# to use, modify, copy, or redistribute it subject to the terms
|
|
# and conditions of the GNU General Public License version 2.
|
|
#
|
|
# This program is distributed in the hope that it will be
|
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
# PURPOSE. See the GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public
|
|
# License along with this program; if not, write to the Free
|
|
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
|
# Boston, MA 02110-1301, USA.
|
|
#
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
# Include Beaker environment
|
|
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
|
|
|
PACKAGE="opencryptoki"
|
|
|
|
function phaseSetup() {
|
|
rlPhaseStartSetup
|
|
rlFileBackup /etc/opencryptoki/opencryptoki.conf
|
|
rlServiceStop pkcsslotd
|
|
rlRun "pkcsResetTokens"
|
|
rlRun "systemctl enable pkcsslotd"
|
|
rlServiceStart pkcsslotd
|
|
sleep 1
|
|
rlRun "pkcsconf -t | grep 'Soft'"
|
|
SLOT=$( pkcsGetTokenSlot sw )
|
|
rlRun "pkcsInitToken $SLOT"
|
|
rlRun "pkcsconf -t"
|
|
if rlIsRHEL '<8'; then
|
|
rlRun "GNUTLS_PIN=$pkcsUSER_PIN p11tool --generate-rsa --login --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub"
|
|
else
|
|
rlRun "p11tool --generate-rsa --login --set-pin $pkcsUSER_PIN --provider=/usr/lib64/pkcs11/libopencryptoki.so --outfile id_rsa.pub 'pkcs11:$TokenSpec' --label id_rsa.pub"
|
|
fi
|
|
rlAssertExists id_rsa.pub
|
|
rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects"
|
|
rlAssertGrep "Public Key Object" $rlRun_LOG
|
|
rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
|
|
rlPhaseEnd
|
|
}
|
|
|
|
|
|
function phaseTest() {
|
|
rlPhaseStartTest
|
|
SLOT=$( pkcsGetTokenSlot sw )
|
|
rlRun "pkcsconf -t"
|
|
rlRun -s "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --list-objects" 0 "Verify I still can list imported RSA key"
|
|
rlAssertGrep "Public Key Object" $rlRun_LOG
|
|
rlAssertGrep "label: *id_rsa.pub" $rlRun_LOG -E
|
|
rlLog "Exporting stored RSA key"
|
|
rlRun "pkcs11-tool -v --module /usr/lib64/opencryptoki/libopencryptoki.so --slot 0x$SLOT --read-object --type pubkey --label id_rsa.pub --output-file exported_key.der"
|
|
rlRun "openssl rsa -pubin -inform DER -in exported_key.der -out exported_key.pub" 0 "Converting from DER format"
|
|
rlRun "diff exported_key.pub id_rsa.pub" 0 "There should be no difference when compared with the original key"
|
|
rlRun "popd"
|
|
rlPhaseEnd
|
|
}
|
|
|
|
|
|
function phaseCleanup() {
|
|
rlPhaseStartCleanup
|
|
rlServiceStop pkcsslotd
|
|
rlRun "pkcsRestoreTokens"
|
|
rlFileRestore
|
|
rlServiceRestore pkcsslotd
|
|
rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
|
|
rlPhaseEnd
|
|
}
|
|
|
|
|
|
rlJournalStart
|
|
|
|
rlPhaseStartSetup "init"
|
|
rlAssertRpm $PACKAGE
|
|
rlRun "rlImport opencryptoki/token-manipulation" || rlDie "Could not import opencryptoki/token-manipulation library"
|
|
rlRun "TmpDir=/var/tmp/opencryptoki-tests-runtime-files"
|
|
[ -d $TmpDir ] || rlRun "mkdir -p $TmpDir" 0 "Creating tmp directory"
|
|
rlRun "pushd $TmpDir"
|
|
if rlIsRHEL '<8'; then
|
|
rlRun "TokenSpec='model=IBM%20SoftTok'"
|
|
else
|
|
rlRun "TokenSpec='model=Soft;manufacturer=IBM'"
|
|
fi
|
|
rlPhaseEnd
|
|
|
|
# clear $PHASES if IN_PLACE_UPGRADE is specified
|
|
[ -n "$IN_PLACE_UPGRADE" ] && PHASES=""
|
|
echo IN_PLACE_UPGRADE=$IN_PLACE_UPGRADE
|
|
echo PHASES=$PHASES
|
|
|
|
# run setup, except when running post-upgrade phase
|
|
if [ -n "$IN_PLACE_UPGRADE" -a "$IN_PLACE_UPGRADE" != "new" ] || echo ${PHASES} | egrep -qi '(setup|all)'; then
|
|
phaseSetup
|
|
fi
|
|
|
|
# run test by default
|
|
if [ -z "${PHASES}" ] || echo ${PHASES} | egrep -qi '(test|all)'; then
|
|
phaseTest
|
|
fi
|
|
|
|
popd
|
|
# run cleanup only when run as a standalone test
|
|
if [ -z "$IN_PLACE_UPGRADE" ] && echo ${PHASES} | egrep -qi '(cleanup|all)'; then
|
|
phaseCleanup
|
|
fi
|
|
|
|
rlJournalPrintText
|
|
rlJournalEnd
|