Skip to content

Commit 82e94bf

Browse files
bukkabukka
committed
Add kryoptic multislot testing setup with defaultslot test
1 parent f39ea04 commit 82e94bf

9 files changed

Lines changed: 361 additions & 25 deletions

File tree

‎tests/helpers.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,9 @@ ptool() {
104104
if [ -n "$P11DEFLOGIN" ]; then
105105
CMDOPTS+=("${P11DEFLOGIN[@]}")
106106
fi
107+
if [ -n "$SLOTID" ]; then
108+
CMDOPTS+=("--slot=${SLOTID}")
109+
fi
107110
CMDOPTS+=("$@")
108111
$CHECKER pkcs11-tool "${CMDOPTS[@]}"
109112
}

‎tests/kryoptic-init.sh‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,12 @@ find_kryoptic \
2626

2727
title LINE "Creating Kyroptic database"
2828

29+
SLOTID=${SLOTID:-0}
30+
2931
# Kryoptic configuration
3032
cat << EOF > "$TOKDIR/kryoptic.conf"
3133
[[slots]]
32-
slot = 0
34+
slot = $SLOTID
3335
dbtype = "sqlite"
3436
dbargs = "$TOKDIR/kryoptic.sql"
3537
#mechanisms
@@ -40,10 +42,10 @@ export TOKENLABEL="${TOKENLABEL:-Kryoptic Token}"
4042
export TOKENLABELURI="${TOKENLABELURI:-Kryoptic%20Token}"
4143

4244
# init token
43-
pkcs11-tool --module "${P11LIB}" --init-token \
45+
pkcs11-tool --module "${P11LIB}" --init-token --slot $SLOTID \
4446
--label "${TOKENLABEL}" --so-pin "${PINVALUE}" 2>&1
4547
# set user pin
46-
pkcs11-tool --module "${P11LIB}" --so-pin "${PINVALUE}" \
48+
pkcs11-tool --module "${P11LIB}" --so-pin "${PINVALUE}" --slot $SLOTID \
4749
--login --login-type so --init-pin --pin "${PINVALUE}" 2>&1
4850

4951
export TOKENCONFIGVARS="export KRYOPTIC_CONF=$TOKDIR/kryoptic.conf"

‎tests/kryoptic.multislot-init.sh‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
#!/bin/bash -ex
2+
# Copyright (C) 2024 Jakub Zelenka <jakub.openssl@gmail.com>
3+
# SPDX-License-Identifier: Apache-2.0
4+
#
5+
6+
export SLOTID=42
7+
export SLOT2ID=52
8+
export TOKEN2LABEL="${TOKENLABEL:-Kryoptic Token 2}"
9+
export TOKEN2LABELURI="${TOKENLABELURI:-Kryoptic%20Token%202}"
10+
export PIN2VALUE=11111111
11+
12+
export KRYOPTIC_CONF="${TMPPDIR}/kryoptic.conf"
13+
cat >"${KRYOPTIC_CONF}" <<_EOF
14+
[[slots]]
15+
slot = $SLOTID
16+
dbtype = "sqlite"
17+
dbargs = "$TOKDIR/kryoptic.sql"
18+
#mechanisms
19+
[[slots]]
20+
slot = $SLOT2ID
21+
dbtype = "sqlite"
22+
dbargs = "${TOKDIR}/kryoptic2.sql"
23+
description = "Kryoptic Token 2"
24+
_EOF
25+
26+
# this overrides what we define in the generic init
27+
export TOKENLABEL="Kryoptic Soft Token"
28+
export TOKENLABELURI="Kryoptic%20Soft%20Token"
29+
30+
# the rest is the same
31+
source "${TESTSSRCDIR}/kryoptic-init.sh"
32+
33+
# init token 2
34+
pkcs11-tool --module "${P11LIB}" --init-token --slot "${SLOT2ID}" \
35+
--label "${TOKEN2LABEL}" --so-pin "${PIN2VALUE}" 2>&1
36+
# set user pin 2
37+
pkcs11-tool --module "${P11LIB}" --so-pin "${PIN2VALUE}" --slot "${SLOT2ID}" \
38+
--login --login-type so --init-pin --pin "${PIN2VALUE}" 2>&1
39+
40+
export TOKENCONFIGVARS="export KRYOPTIC_CONF=${TMPPDIR}/kryoptic.conf"
41+
export TESTPORT="29000"
42+
43+
# generate RSA key
44+
KEYID='0201'
45+
URIKEYID="%02%01"
46+
47+
pkcs11-tool --module "${P11LIB}" --slot "${SLOT2ID}" --pin "${PIN2VALUE}" \
48+
--keypairgen --key-type="RSA:2048" --id="$KEYID" \
49+
--label="testKey" 2>&1
50+
51+
export BASEURI2WITHPINVALUE="pkcs11:id=${URIKEYID}?pin-value=${PINVALUE}"
52+
export BASEURI2="pkcs11:id=${URIKEYID}"
53+
export PUBURI2="pkcs11:type=public;id=${URIKEYID}"
54+
export PRIURI2="pkcs11:type=private;id=${URIKEYID}"
55+
56+
title LINE "RSA PKCS11 URIS"
57+
echo "${BASEURI2WITHPINVALUE}"
58+
echo "${BASEURI2}"
59+
echo "${PUBURI2}"
60+
echo "${PRIURI2}"
61+
echo ""
62+
63+
# While this works with the default DB, the NSS DB does not support this
64+
# attribute
65+
export SUPPORT_ALLOWED_MECHANISMS=0

‎tests/kryoptic.nss-init.sh‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,13 @@
33
# SPDX-License-Identifier: Apache-2.0
44
#
55

6+
export SLOTID=42
7+
export SLOTSCOUNT=1
8+
69
export KRYOPTIC_CONF="${TMPPDIR}/kryoptic.conf"
710
cat >"${KRYOPTIC_CONF}" <<_EOF
811
[[slots]]
9-
slot = 42
12+
slot = ${SLOTID}
1013
dbtype = "nssdb"
1114
dbargs = "configDir='${TOKDIR}' flags='passwordRequired'"
1215
description = "Kryoptic Soft Token"

‎tests/meson.build‎

Lines changed: 25 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ test_programs = {
111111
'treadkeys': ['treadkeys.c'],
112112
'tcmpkeys': ['tcmpkeys.c', 'util.c'],
113113
'tfork': ['tfork.c', 'util.c'],
114+
'trefresh': ['trefresh.c', 'util.c'],
114115
'tpkey': ['tpkey.c', 'util.c'],
115116
'pincache': ['pincache.c'],
116117
'ccerts': ['ccerts.c', 'util.c'],
@@ -127,7 +128,9 @@ foreach t, sources : test_programs
127128
endforeach
128129

129130
setup_script=find_program('setup.sh')
130-
all_suites=['softokn', 'softhsm', 'kryoptic', 'kryoptic.nss']
131+
multi_suites=['kryoptic.multislot']
132+
single_suites=['softokn', 'softhsm', 'kryoptic', 'kryoptic.nss']
133+
all_suites=single_suites + multi_suites
131134
foreach suite : all_suites
132135
test(
133136
'setup',
@@ -141,35 +144,36 @@ foreach suite : all_suites
141144
endforeach
142145

143146
tests = {
144-
'basic': {'suites': all_suites},
147+
'basic': {'suites': single_suites},
145148
'mldsa': {'suites': ['kryoptic']},
146-
'pubkey': {'suites': all_suites},
147-
'certs': {'suites': all_suites},
148-
'ecc': {'suites': all_suites},
149+
'pubkey': {'suites': single_suites},
150+
'certs': {'suites': single_suites},
151+
'ecc': {'suites': single_suites},
149152
'edwards': {'suites': ['softhsm', 'kryoptic', 'kryoptic.nss']},
150-
'ecdh': {'suites': all_suites},
151-
'democa': {'suites': all_suites, 'is_parallel': false},
152-
'digest': {'suites': all_suites},
153-
'fork': {'suites': all_suites},
153+
'ecdh': {'suites': single_suites},
154+
'democa': {'suites': single_suites, 'is_parallel': false},
155+
'digest': {'suites': single_suites},
156+
'fork': {'suites': single_suites},
154157
'oaepsha2': {'suites': ['softokn', 'kryoptic', 'kryoptic.nss']},
155158
'hkdf': {'suites': ['softokn', 'kryoptic', 'kryoptic.nss']},
156159
'imported' : {'suites': ['softokn', 'kryoptic', 'kryoptic.nss']},
157-
'pem_encoder': {'suites': all_suites},
158-
'rsa': {'suites': all_suites},
159-
'rsapss': {'suites': all_suites},
160+
'pem_encoder': {'suites': single_suites},
161+
'rsa': {'suites': single_suites},
162+
'rsapss': {'suites': single_suites},
160163
'rsapssam': {'suites': ['softhsm', 'kryoptic']},
161-
'genkey': {'suites': all_suites},
162-
'pkey': {'suites': all_suites},
163-
'session': {'suites': all_suites},
164-
'skey': {'suites': all_suites},
165-
'rand': {'suites': all_suites},
166-
'readkeys': {'suites': all_suites},
167-
'tls': {'suites': all_suites, 'is_parallel': false, 'timeout': 60},
168-
'tlsfuzzer': {'suites': all_suites, 'timeout': 90},
169-
'uri': {'suites': all_suites, 'timeout': 90},
164+
'genkey': {'suites': single_suites},
165+
'pkey': {'suites': single_suites},
166+
'session': {'suites': single_suites},
167+
'skey': {'suites': single_suites},
168+
'rand': {'suites': single_suites},
169+
'readkeys': {'suites': single_suites},
170+
'tls': {'suites': single_suites, 'is_parallel': false, 'timeout': 60},
171+
'tlsfuzzer': {'suites': single_suites, 'timeout': 90},
172+
'uri': {'suites': single_suites, 'timeout': 90},
170173
'ecxc': {'suites': ['softhsm', 'kryoptic', 'kryoptic.nss']},
171174
'cms': {'suites': ['softokn', 'kryoptic', 'kryoptic.nss']},
172175
'pinlock': {'suites': ['kryoptic']},
176+
'defaultslot': {'suites': ['kryoptic.multislot']},
173177
}
174178

175179
test_wrapper = find_program('test-wrapper')

‎tests/openssl.cnf.in‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ activate = 1
2323
[pkcs11_sect]
2424
module = @libtoollibs@/pkcs11@SHARED_EXT@
2525
pkcs11-module-token-pin = file:@PINFILE@
26+
#pkcs11-module-default-slot-id
2627
##TOKENOPTIONS
2728
#pkcs11-module-encode-provider-uri-to-pem
2829
#pkcs11-module-allow-export

‎tests/setup.sh‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,8 @@ elif [ "${TOKENTYPE}" == "kryoptic" ]; then
8282
source "${TESTSSRCDIR}/kryoptic-init.sh"
8383
elif [ "${TOKENTYPE}" == "kryoptic.nss" ]; then
8484
source "${TESTSSRCDIR}/kryoptic.nss-init.sh"
85+
elif [ "${TOKENTYPE}" == "kryoptic.multislot" ]; then
86+
source "${TESTSSRCDIR}/kryoptic.multislot-init.sh"
8587
else
8688
echo "Unknown token type: $1"
8789
exit 1
@@ -628,6 +630,17 @@ export RSAPSS2CRTURI="${RSAPSS2CRTURI}"
628630
DBGSCRIPT
629631
fi
630632

633+
if [ -n "${PRIURI2}" ]; then
634+
cat >> "${TMPPDIR}/testvars" <<DBGSCRIPT
635+
636+
export BASEURI2WITHPINVALUE="${BASEURI2WITHPINVALUE}"
637+
export BASEURI2="${BASEURI2}"
638+
export PUBURI2="${PUBURI2}"
639+
export PRIURI2="${PRIURI2}"
640+
DBGSCRIPT
641+
fi
642+
643+
631644
cat >> "${TMPPDIR}/testvars" <<DBGSCRIPT
632645
633646
# for listing the separate pkcs11 calls

‎tests/tdefaultslot‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash -e
2+
# Copyright (C) 2025 Jakub Zelenka <jakub.openssl@gmail.com>
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
source "${TESTSSRCDIR}/helpers.sh"
6+
7+
title PARA "Test PKCS11 SLOTS"
8+
ORIG_OPENSSL_CONF=${OPENSSL_CONF}
9+
sed -e "s/#pkcs11-module-default-slot-id/pkcs11-module-default-slot-id = 52/" \
10+
-e "s/^pkcs11-module-token-pin.*$/pkcs11-module-token-pin = 11111111/" \
11+
"${OPENSSL_CONF}" > "${OPENSSL_CONF}.defaultslot"
12+
export OPENSSL_CONF=${OPENSSL_CONF}.defaultslot
13+
14+
title PARA "Sign and Verify with provided Hash and RSA"
15+
ossl 'dgst -sha256 -binary -out ${TMPPDIR}/sha256.bin ${SEEDFILE}'
16+
ossl '
17+
pkeyutl -sign -inkey "${PRIURI2}"
18+
-in ${TMPPDIR}/sha256.bin
19+
-out ${TMPPDIR}/sha256-sig.bin
20+
-pkeyopt digest:sha256'
21+
22+
$CHECKER "${TESTBLDDIR}/trefresh" "${PUBURI2}" ${SEEDFILE} "${TMPPDIR}/sha256-sig.bin"
23+
24+
export OPENSSL_CONF=${ORIG_OPENSSL_CONF}

0 commit comments

Comments
 (0)