345 lines
7.9 KiB
Bash
345 lines
7.9 KiB
Bash
#!/bin/bash
|
|
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
#
|
|
# lib.sh of /CoreOS/opencryptoki/Library/token-manipulation
|
|
# Description: provides basic function for token manipulation
|
|
# Author: Karel Srot <ksrot@redhat.com>
|
|
#
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
#
|
|
# Copyright (c) 2020 Red Hat, Inc.
|
|
#
|
|
# This copyrighted material is made available to anyone wishing
|
|
# to use, modify, copy, or redistribute it subject to the terms
|
|
# and conditions of the GNU General Public License version 2.
|
|
#
|
|
# This program is distributed in the hope that it will be
|
|
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
|
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
# PURPOSE. See the GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public
|
|
# License along with this program; if not, write to the Free
|
|
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
|
|
# Boston, MA 02110-1301, USA.
|
|
#
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
# library-prefix = pkcs
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
true <<'=cut'
|
|
=pod
|
|
|
|
=head1 NAME
|
|
|
|
opencryptoki/token-manipulation - provides basic function for token manipulation
|
|
|
|
=head1 DESCRIPTION
|
|
|
|
The library provides basic function for manipulation with
|
|
opencryptoki tokens, like initialization, cleanup etc.
|
|
|
|
=cut
|
|
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
# Variables
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
true <<'=cut'
|
|
=pod
|
|
|
|
=head1 VARIABLES
|
|
|
|
Below is the list of global variables. When writing a new library,
|
|
please make sure that all global variables start with the library
|
|
prefix to prevent collisions with other libraries.
|
|
|
|
=over
|
|
|
|
=item pkcsUSER_PIN
|
|
|
|
USER PIN to be used when initializing a token. By default 01234567.
|
|
|
|
=item pkcsSO_PIN
|
|
|
|
SO PIN to be used when initializing a token. By default 76543210.
|
|
|
|
=item pkcsFACTORY_SO_PIN
|
|
|
|
Default (factory) SO PIN of a token. Initialized as 87654321.
|
|
|
|
=back
|
|
|
|
=cut
|
|
|
|
export pkcsUSER_PIN
|
|
[ -n "$pkcsUSER_PIN" ] || pkcsUSER_PIN="01234567"
|
|
|
|
export pkcsSO_PIN
|
|
[ -n "$pkcsSO_PIN" ] || pkcsSO_PIN="76543210"
|
|
|
|
export pkcsFACTORY_SO_PIN
|
|
[ -n "$pkcsFACTORY_SO_PIN" ] || pkcsFACTORY_SO_PIN="87654321"
|
|
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
# Functions
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
true <<'=cut'
|
|
=pod
|
|
|
|
=head1 FUNCTIONS
|
|
|
|
=head2 pkcsGetTokenSlot
|
|
|
|
Return slot number for a token with specified type.
|
|
|
|
pkcsGetTokenSlot type
|
|
|
|
=over
|
|
|
|
=item type
|
|
|
|
Token type to be used. Available options are matching
|
|
dynamic library suffixes from /etc/opencryptoki/opencryptoki.conf,
|
|
in particular : sw, tpm, ica, cca, ep11
|
|
|
|
=back
|
|
|
|
Returns 0 when the initialization was successfull, non-zero otherwise.
|
|
|
|
=cut
|
|
|
|
|
|
pkcsGetTokenSlot() {
|
|
local TYPE=$1
|
|
local CONF=/etc/opencryptoki/opencryptoki.conf
|
|
local SLOT
|
|
[ -z "$TYPE" ] && echo "Error: pkcsGetTokenSlot: no token type specified" && return 1
|
|
if grep -q "^stdll = libpkcs11_$TYPE.so" $CONF; then
|
|
SLOT=$( egrep "^(slot|stdll = libpkcs11_$TYPE.so)" $CONF | grep -B 1 "libpkcs11" | sed -n -e '1,1 s/slot //' -e '1,1 p' )
|
|
echo $SLOT
|
|
else
|
|
echo "Error: pkcsGetTokenSlot: could not find type $TYPE in $CONF"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
true <<'=cut'
|
|
=pod
|
|
|
|
=head2 pkcsInitToken
|
|
|
|
Initialize token specified using slot number and sets up
|
|
new SO PIN and USER PIN.
|
|
|
|
pkcsInitToken type|slot [CURRENT_SO_PIN]
|
|
|
|
=over
|
|
|
|
=item type
|
|
|
|
Token specification using the token type.
|
|
Available options are: sw, tpm, ica, cca, ep11.
|
|
|
|
=item slot
|
|
|
|
Token specification using the slot number.
|
|
|
|
|
|
=back
|
|
|
|
Returns 0 when the initialization was successfull, non-zero otherwise.
|
|
|
|
=cut
|
|
|
|
pkcsInitToken() {
|
|
|
|
local SLOT
|
|
local LABEL="$2"
|
|
[ -z $1 ] && echo "Error: pkcsInitToken: No token type specified"
|
|
# if token specified using slot number
|
|
if echo "$1" | grep -qE '^[0-9]+$'; then
|
|
SLOT=$1
|
|
else # specified using token type
|
|
SLOT=$( pkcsGetTokenSlot $1 ) || return 1
|
|
fi
|
|
echo SLOT: $SLOT
|
|
# if label not specified, use the current value
|
|
[ -z "$LABEL" ] && LABEL=`pkcsconf -t -c $SLOT | grep 'Label:' | sed 's/^.*Label: //'`
|
|
echo LABEL: $LABEL
|
|
local SOPIN=$2
|
|
[ -z $SOPIN ] && SOPIN=$pkcsFACTORY_SO_PIN
|
|
|
|
echo "pkcsInitToken: Initialize token"
|
|
cat <<EOF | expect
|
|
spawn /usr/sbin/pkcsconf -c $SLOT -I
|
|
expect "Enter the SO PIN: "
|
|
sleep .1
|
|
send "${SOPIN}\r"
|
|
sleep .1
|
|
expect "label: "
|
|
sleep .1
|
|
send "${LABEL}\r"
|
|
sleep .1
|
|
expect eof {} \
|
|
"Incorrect PIN Entered." {exit 1}
|
|
exit 0
|
|
EOF
|
|
|
|
echo "pkcsInitToken: Changing SO PIN"
|
|
cat <<EOF | expect
|
|
spawn /usr/sbin/pkcsconf -c $SLOT -P
|
|
expect "Enter the SO PIN: "
|
|
sleep .1
|
|
send "${SOPIN}\r"
|
|
sleep .1
|
|
expect "Enter the new SO PIN: "
|
|
sleep .1
|
|
send "$pkcsSO_PIN\r"
|
|
sleep .1
|
|
expect "Re-enter the new SO PIN: "
|
|
sleep .1
|
|
send "$pkcsSO_PIN\r"
|
|
sleep .1
|
|
expect " " {exit 1}
|
|
exit 0
|
|
EOF
|
|
if [ $? -eq 0 ]; then
|
|
echo "pkcsInitToken: Succesfully changed SO PIN to $pkcsSO_PIN"
|
|
else
|
|
echo "Error: pkcsInitToken: Failed to change SO PIN"
|
|
return 1
|
|
fi
|
|
|
|
echo "pkcsInitToken: Changing USER PIN"
|
|
cat <<EOF | expect
|
|
spawn /usr/sbin/pkcsconf -c $SLOT -u
|
|
expect "Enter the SO PIN: "
|
|
sleep .1
|
|
send "$pkcsSO_PIN\r"
|
|
sleep .1
|
|
expect "Enter the new user PIN: "
|
|
sleep .1
|
|
send "$pkcsUSER_PIN\r"
|
|
sleep .1
|
|
expect "Re-enter the new user PIN: "
|
|
sleep .1
|
|
send "$pkcsUSER_PIN\r"
|
|
sleep .1
|
|
expect " " {exit 1}
|
|
exit 0
|
|
EOF
|
|
if [ $? -eq 0 ]; then
|
|
echo "pkcsInitToken: Succesfully changed USER PIN to $pkcsUSER_PIN"
|
|
else
|
|
echo "Error: pkcsInitToken: Failed to change USER PIN"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
true <<'=cut'
|
|
=pod
|
|
|
|
=head2 pkcsResetTokens
|
|
|
|
Makes a backup of /var/lib/opencryptoki and resets all tokens
|
|
by removing all files from /var/lib/opencryptoki and shared
|
|
memory files from /dev/shm.
|
|
|
|
=back
|
|
|
|
Returns 0 if the backup and removal passed, non-zero otherwise.
|
|
|
|
=cut
|
|
|
|
|
|
pkcsResetTokens() {
|
|
local NAMESPACE=pkcslib
|
|
[ -n "$1" ] && NAMESPACE="$1"
|
|
rlFileBackup --clean --namespace ${NAMESPACE} /var/lib/opencryptoki && \
|
|
find /var/lib/opencryptoki/ -type f -exec rm {} \; && \
|
|
rm -f /dev/shm/var.lib.opencryptoki.*
|
|
}
|
|
|
|
true <<'=cut'
|
|
=pod
|
|
|
|
=head2 pkcsRestoreTokens
|
|
|
|
Restores a backup of /var/lib/opencryptoki created in pkcsResetTokens().
|
|
|
|
=back
|
|
|
|
Returns 0 if the backup restore passed.
|
|
|
|
=cut
|
|
|
|
|
|
pkcsRestoreTokens() {
|
|
rlFileRestore --namespace pkcslib
|
|
}
|
|
|
|
true <<'=cut'
|
|
=pod
|
|
|
|
=head1 EXECUTION
|
|
|
|
This library supports direct execution. When run as a task, phases
|
|
provided in the PHASE environment variable will be executed.
|
|
Supported phases are:
|
|
|
|
=over
|
|
|
|
=item Create
|
|
|
|
Create a new empty file. Use FILENAME to provide the desired file
|
|
name. By default 'foo' is created in the current directory.
|
|
|
|
=item Test
|
|
|
|
Run the self test suite.
|
|
|
|
=back
|
|
|
|
=cut
|
|
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
# Verification
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
#
|
|
# This is a verification callback which will be called by
|
|
# rlImport after sourcing the library to make sure everything is
|
|
# all right. It makes sense to perform a basic sanity test and
|
|
# check that all required packages are installed. The function
|
|
# should return 0 only when the library is ready to serve.
|
|
|
|
pkcsLibraryLoaded() {
|
|
if rpm=$(rpm -q opencryptoki); then
|
|
rlLogDebug "Librar opencryptoki/token-manipulation running with $rpm"
|
|
return 0
|
|
else
|
|
rlLogError "Package opencryptoki not installed"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
# Authors
|
|
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
true <<'=cut'
|
|
=pod
|
|
|
|
=head1 AUTHORS
|
|
|
|
=over
|
|
|
|
=item *
|
|
|
|
Karel Srot <ksrot@redhat.com>
|
|
|
|
=back
|
|
|
|
=cut
|