Skip to content

Commit

Permalink
tests: Turn tests using SoftHSM into installed-tests
Browse files Browse the repository at this point in the history
This makes the unit tests self-contained so all possible code paths
are exercised without optional packages installed.  The integration
tests against SoftHSM can still run after installation, through "make
installcheck" or running the scripts manually.

Signed-off-by: Daiki Ueno <[email protected]>
  • Loading branch information
ueno committed Oct 27, 2023
1 parent cdc4720 commit 5725563
Show file tree
Hide file tree
Showing 10 changed files with 481 additions and 137 deletions.
9 changes: 9 additions & 0 deletions .github/actions/basic-meson/action.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -35,3 +35,12 @@ runs:
- name: Install
run: ninja -C $GITHUB_WORKSPACE/$BUILDDIR install
shell: bash

- name: Post-install Test
run: |
for t in p11-kit/test-softhsm2.sh trust/test-extract.sh trust/test-trust.sh; do
abs_top_builddir=$GITHUB_WORKSPACE/$BUILDDIR abs_top_srcdir=$GITHUB_WORKSPACE P11_MODULE_PATH=$GITHUB_WORKSPACE/$BUILDDIR $t
ret=$?
test $ret -eq 0 || exit $ret
done
shell: bash
2 changes: 2 additions & 0 deletions Makefile.am
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,8 @@ DISTCHECK_CONFIGURE_FLAGS = \
AM_TESTS_ENVIRONMENT = \
abs_top_builddir="$(abs_top_builddir)"; \
export abs_top_builddir; \
abs_top_srcdir="$(abs_top_srcdir)"; \
export abs_top_srcdir; \
P11_MODULE_PATH="$(abs_top_builddir)/.libs"; \
export P11_MODULE_PATH;
AM_TESTS_FD_REDIRECT = 9>&2;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@

module: libsofthsm2.so
module: mock-fourteen.so
managed: yes
enable-in: p11-kit-testable
4 changes: 3 additions & 1 deletion p11-kit/meson.build
Original file line number Diff line number Diff line change
Expand Up @@ -386,6 +386,7 @@ if get_option('test')

p11_kit_tests_env = environment()
p11_kit_tests_env.set('abs_top_builddir', top_build_dir)
p11_kit_tests_env.set('abs_top_srcdir', top_source_dir)
p11_kit_tests_env.set('P11_MODULE_PATH', meson.current_build_dir())

if host_system != 'windows'
Expand Down Expand Up @@ -447,7 +448,8 @@ if get_option('test')
'mock-ten': ['mock-module-ep8.c'],
'mock-eleven': ['mock-module-ep9.c'],
'mock-twelve': ['mock-module-ep10.c'],
'mock-thirteen': ['mock-module-ep11.c']
'mock-thirteen': ['mock-module-ep11.c'],
'mock-fourteen': ['mock-module-ep12.c']
}

if host_system != 'windows'
Expand Down
203 changes: 203 additions & 0 deletions p11-kit/mock-module-ep12.c
Original file line number Diff line number Diff line change
@@ -0,0 +1,203 @@
/*
* Copyright (c) 2023, Red Hat Inc.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* * Redistributions of source code must retain the above
* copyright notice, this list of conditions and the
* following disclaimer.
* * Redistributions in binary form must reproduce the
* above copyright notice, this list of conditions and
* the following disclaimer in the documentation and/or
* other materials provided with the distribution.
* * The names of contributors to this software may not be
* used to endorse or promote products derived from this
* software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
* THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
* DAMAGE.
*
* Author: Zoltan Fridrich <[email protected]>, Daiki Ueno
*/

#include "config.h"

#define CRYPTOKI_EXPORTS 1
#include "pkcs11.h"

#include "attrs.h"
#include "debug.h"
#include "mock.h"

#ifdef WITH_ASN1
#include "persist.h"
#endif

#include <stdio.h>
#include <string.h>

static const CK_TOKEN_INFO MOCK_TOKEN_INFO = {
"PERSIST LABEL ONE ",
"PERSIST MANUFACTURER ",
"PERSIST MODEL ",
"PERSIST SERIAL ",
CKF_LOGIN_REQUIRED | CKF_USER_PIN_INITIALIZED | CKF_CLOCK_ON_TOKEN | CKF_TOKEN_INITIALIZED,
1,
2,
3,
4,
5,
6,
7,
8,
9,
10,
{ 75, 175 },
{ 85, 185 },
{ '1', '9', '9', '9', '0', '5', '2', '5', '0', '9', '1', '9', '5', '9', '0', '0' }
};

static CK_RV
override_C_GetTokenInfo (CK_SLOT_ID slot_id,
CK_TOKEN_INFO_PTR info)
{
return_val_if_fail (info != NULL, CKR_ARGUMENTS_BAD);

switch (slot_id) {
case MOCK_SLOT_ONE_ID:
memcpy (info, &MOCK_TOKEN_INFO, sizeof (*info));
return CKR_OK;
case MOCK_SLOT_TWO_ID:
return CKR_TOKEN_NOT_PRESENT;
default:
return CKR_SLOT_ID_INVALID;
}
}

#ifdef WITH_ASN1
static CK_RV
override_C_Initialize (CK_VOID_PTR init_args)
{
bool ok;
size_t i, size = 0;
void *data = NULL;
const char *filename = "test-persist.p11-kit";
p11_mmap *map = NULL;
p11_persist *persist = NULL;
p11_array *objects = NULL;
CK_ATTRIBUTE *attrs = NULL;
CK_RV rv;

map = p11_mmap_open (filename, NULL, &data, &size);
if (map == NULL)
return mock_C_Initialize (init_args);

ok = p11_persist_magic (data, size);
return_val_if_fail (ok, CKR_GENERAL_ERROR);

persist = p11_persist_new ();
return_val_if_fail (persist != NULL, CKR_HOST_MEMORY);

objects = p11_array_new (NULL);
return_val_if_fail (objects != NULL, CKR_HOST_MEMORY);

ok = p11_persist_read (persist, filename, (const unsigned char *)data, size, objects);
return_val_if_fail (ok, CKR_GENERAL_ERROR);

rv = mock_C_Initialize (init_args);
for (i = 0; i < objects->num; ++i) {
attrs = p11_attrs_build (objects->elem[i], NULL);
mock_module_add_object (MOCK_SLOT_ONE_ID, attrs);
p11_attrs_free (attrs);
}

p11_array_free (objects);
p11_persist_free (persist);
p11_mmap_close (map);
return rv;
}

struct WriteData {
p11_persist *persist;
p11_buffer buf;
};

static bool
persist_enumerator (CK_OBJECT_HANDLE handle,
CK_ATTRIBUTE *attrs,
void *user_data)
{
struct WriteData *data = user_data;

p11_persist_write (data->persist, attrs, &data->buf);

return true;
}

static CK_RV
override_C_Finalize (CK_VOID_PTR reserved)
{
bool ok;
FILE *f = NULL;
const char *filename = "test-persist.p11-kit";
CK_SESSION_HANDLE session = 0;
struct WriteData data;
CK_RV rv;

ok = p11_buffer_init (&data.buf, 0);
return_val_if_fail (ok, CKR_HOST_MEMORY);

data.persist = p11_persist_new ();
return_val_if_fail (data.persist != NULL, CKR_HOST_MEMORY);

rv = mock_C_OpenSession (MOCK_SLOT_ONE_ID, CKF_SERIAL_SESSION, NULL, NULL, &session);
return_val_if_fail (rv == CKR_OK, CKR_GENERAL_ERROR);

mock_module_enumerate_objects (session,
persist_enumerator,
&data);

rv = mock_C_CloseSession (session);
return_val_if_fail (rv == CKR_OK, CKR_GENERAL_ERROR);

f = fopen (filename, "wb");
return_val_if_fail (f != NULL, CKR_HOST_MEMORY);
fwrite (data.buf.data, 1, data.buf.len, f);
fclose (f);

p11_persist_free (data.persist);
p11_buffer_uninit (&data.buf);
return mock_C_Finalize (reserved);
}
#endif /* WITH_ASN1 */

#ifdef OS_WIN32
__declspec(dllexport)
#endif
CK_RV
C_GetFunctionList (CK_FUNCTION_LIST_PTR_PTR list)
{
mock_module_init ();
#ifdef WITH_ASN1
mock_module.C_Initialize = override_C_Initialize;
mock_module.C_Finalize = override_C_Finalize;
#endif
mock_module.C_GetFunctionList = C_GetFunctionList;
mock_module.C_GetTokenInfo = override_C_GetTokenInfo;
if (list == NULL)
return CKR_ARGUMENTS_BAD;
*list = &mock_module;
return CKR_OK;
}
77 changes: 27 additions & 50 deletions p11-kit/test-generate-keypair.sh
Original file line number Diff line number Diff line change
Expand Up @@ -10,83 +10,60 @@ test "${abs_top_builddir+set}" = set || {
: ${P11_MODULE_PATH="$abs_top_builddir"/.libs}

setup() {
testdir=$PWD/test-objects-$$
testdir=$PWD/test-genkey-$$
test -d "$testdir" || mkdir "$testdir"
cd "$testdir"
mkdir tokens
cat > softhsm2.conf <<EOF
directories.tokendir = $PWD/tokens/
EOF
export SOFTHSM2_CONF=$PWD/softhsm2.conf

: ${SOFTHSM2_UTIL=softhsm2-util}
if ! "$SOFTHSM2_UTIL" --version >/dev/null; then
skip "softhsm2-util not found"
return
fi
softhsm2-util --init-token --free --label test-genkey --so-pin 12345 --pin 12345

: ${PKG_CONFIG=pkg-config}
if ! "$PKG_CONFIG" p11-kit-1 --exists; then
skip "pkgconfig(p11-kit-1) not found"
return
fi

module_path=$("$PKG_CONFIG" p11-kit-1 --variable=p11_module_path)
if ! test -e "$module_path/libsofthsm2.so"; then
skip "unable to resolve libsofthsm2.so"
return
fi

ln -sf "$module_path"/libsofthsm2.so "$P11_MODULE_PATH"
}

teardown() {
unset SOFTHSM2_CONF
rm -rf "$testdir"
}

test_generate_keypair_mock() {
if ! "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label=mock --type=mock "pkcs11:token=PUBKEY%20LABEL?pin-value=booo"; then
assert_fail "unable to run p11-kit generate-keypair"
fi
}

test_generate_keypair_rsa() {
if ! "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label=rsa --type=rsa --bits=2048 "pkcs11:token=test-genkey?pin-value=12345"; then
assert_fail "unable to run: p11-kit generate-keypair"
if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label=rsa --type=rsa --bits=2048 "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then
assert_fail "expected to fail: p11-kit generate-keypair"
fi
assert_contains err.out "key-pair generation failed: The crypto mechanism is invalid or unrecognized"

if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label=rsa --type=rsa "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then
assert_fail "expected to fail: p11-kit generate-keypair"
fi
assert_contains err.out "no bits specified"
}

test_generate_keypair_ecdsa() {
for curve in secp256r1 secp384r1 secp521r1; do
if ! "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="ecdsa-$curve" --type=ecdsa --curve="$curve" "pkcs11:token=test-genkey?pin-value=12345"; then
assert_fail "unable to run: p11-kit generate-keypair"
if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="ecdsa-$curve" --type=ecdsa --curve="$curve" "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then
assert_fail "expected to fail: p11-kit generate-keypair"
fi
done
assert_contains err.out "key-pair generation failed: The crypto mechanism is invalid or unrecognized"

if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="ecdsa-unknown" --type=ecdsa --curve=unknown "pkcs11:token=test-genkey?pin-value=12345"; then
if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="ecdsa-unknown" --type=ecdsa --curve=unknown "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then
assert_fail "p11-kit generate-keypair succeeded for unknown ecdsa curve"
fi
assert_contains err.out "unknown curve name: unknown"
}

test_generate_keypair_eddsa() {
curves=
mech=$("$abs_top_builddir"/p11-kit/p11-kit-testable list-mechanisms "pkcs11:token=test-genkey" | sed -n '/CKM_EDDSA/p')
if test -z "$mech"; then
skip "no support for EdDSA"
return
fi
if expr "$mech" : ".*key-size=256-" > /dev/null; then
curve="$curve ed25519"
fi
if expr "$mech" : ".*key-size=.*-456" > /dev/null; then
curve="$curve ed448"
fi
for curve in $curves; do
if ! "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="eddsa-$curve" --type=eddsa --curve="$curve" "pkcs11:token=test-genkey?pin-value=12345"; then
for curve in ed25519 ed448; do
if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="eddsa-$curve" --type=eddsa --curve="$curve" "pkcs11:token=PUBKEY%20LABEL?pin-value=booo" 2> err.out; then
assert_fail "unable to run: p11-kit generate-keypair"
fi
done
assert_contains err.out "key-pair generation failed: The crypto mechanism is invalid or unrecognized"

if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="eddsa-unknown" --type=eddsa --curve=unknown "pkcs11:token=test-genkey?pin-value=12345"; then
if "$abs_top_builddir"/p11-kit/p11-kit-testable generate-keypair --login --label="eddsa-unknown" --type=eddsa --curve=unknown "pkcs11:token=PUBKEY%20LABEL?pin-value=booo"; then
assert_fail "p11-kit generate-keypair succeeded for unknown eddsa curve"
fi
assert_contains err.out "unknown curve name: unknown"
}

run test_generate_keypair_rsa test_generate_keypair_ecdsa \
test_generate_keypair_ecdsa
run test_generate_keypair_mock test_generate_keypair_rsa \
test_generate_keypair_ecdsa test_generate_keypair_ecdsa
Loading

0 comments on commit 5725563

Please sign in to comment.