Skip to content

Commit bdadb88

Browse files
LinuxJediLinuxJedi
committed
WiP TPM storage tests
1 parent 2d9fad9 commit bdadb88

2 files changed

Lines changed: 206 additions & 1 deletion

File tree

‎.github/workflows/storage-upgrade-test-tpm.yml‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
name: wolfPKCS11 Storage Format Upgrade Test (TPM)
2+
3+
on:
4+
pull_request:
5+
branches: [ '*' ]
6+
7+
env:
8+
WOLFSSL_VERSION: v5.8.0-stable
9+
10+
jobs:
11+
storage-upgrade-test-tpm:
12+
runs-on: ubuntu-latest
13+
strategy:
14+
matrix:
15+
base-ref:
16+
- name: master
17+
ref: master
18+
branch-dir: master-branch
19+
- name: v1.3.0
20+
ref: v1.3.0-stable
21+
branch-dir: v1.3.0-stable-branch
22+
23+
steps:
24+
# Checkout the PR branch
25+
- name: Checkout PR branch
26+
uses: actions/checkout@v4
27+
with:
28+
path: pr-branch
29+
30+
# Checkout base branch/tag separately
31+
- name: Checkout ${{ matrix.base-ref.name }} branch
32+
uses: actions/checkout@v4
33+
with:
34+
ref: ${{ matrix.base-ref.ref }}
35+
path: ${{ matrix.base-ref.branch-dir }}
36+
37+
- name: Cache wolfSSL
38+
id: cache-wolfssl
39+
uses: actions/cache@v4
40+
with:
41+
path: wolfssl
42+
key: wolfssl-${{ env.WOLFSSL_VERSION }}
43+
44+
# Setup wolfssl (required dependency)
45+
- name: Checkout wolfssl
46+
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
47+
uses: actions/checkout@v4
48+
with:
49+
repository: wolfssl/wolfssl
50+
path: wolfssl
51+
ref: ${{ env.WOLFSSL_VERSION }}
52+
53+
- name: Build wolfssl
54+
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
55+
working-directory: ./wolfssl
56+
run: |
57+
./autogen.sh
58+
./configure --enable-cryptocb --enable-aescfb --enable-rsapss --enable-keygen --enable-pwdbased --enable-scrypt \
59+
C_EXTRA_FLAGS="-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT"
60+
make
61+
62+
- name: Install wolfssl
63+
working-directory: ./wolfssl
64+
run: |
65+
sudo make install
66+
sudo ldconfig
67+
68+
# Setup IBM Software TPM simulator
69+
- name: Setup IBM Software TPM
70+
run: |
71+
git clone https://github.com/kgoldman/ibmswtpm2.git
72+
cd ibmswtpm2/src
73+
make
74+
./tpm_server &
75+
sleep 2
76+
cd ../..
77+
78+
# Build and install wolfTPM (required for TPM operations)
79+
- name: Build and install wolfTPM
80+
run: |
81+
git clone https://github.com/wolfSSL/wolftpm.git
82+
cd wolftpm
83+
./autogen.sh
84+
./configure --enable-swtpm --enable-debug
85+
make -j$(nproc)
86+
sudo make install
87+
sudo ldconfig
88+
cd ..
89+
90+
# Phase 1: Build and test base branch/tag with TPM
91+
- name: Build wolfPKCS11 ${{ matrix.base-ref.name }} with TPM
92+
working-directory: ./${{ matrix.base-ref.branch-dir }}
93+
run: |
94+
echo "=== Building wolfPKCS11 ${{ matrix.base-ref.name }} branch with TPM support ==="
95+
./autogen.sh
96+
./configure --enable-singlethreaded --enable-wolftpm --disable-dh C_EXTRA_FLAGS="-DWOLFPKCS11_TPM_STORE"
97+
make
98+
99+
- name: Run TPM tests on ${{ matrix.base-ref.name }} to generate storage files
100+
working-directory: ./${{ matrix.base-ref.branch-dir }}
101+
run: |
102+
echo "=== Running TPM tests on ${{ matrix.base-ref.name }} branch ==="
103+
# Run specific TPM tests that generate storage files
104+
./tests/pkcs11test
105+
./tests/object_id_uniqueness_test
106+
echo "=== ${{ matrix.base-ref.name }} branch TPM test completed ==="
107+
108+
# Phase 2: Build PR branch with TPM and copy storage files from base
109+
- name: Build wolfPKCS11 PR branch with TPM
110+
working-directory: ./pr-branch
111+
run: |
112+
echo "=== Building wolfPKCS11 PR branch with TPM support ==="
113+
./autogen.sh
114+
./configure --enable-singlethreaded --enable-wolftpm --disable-dh C_EXTRA_FLAGS="-DWOLFPKCS11_TPM_STORE"
115+
make
116+
117+
- name: Copy TPM storage files from ${{ matrix.base-ref.name }} to PR
118+
run: |
119+
echo "=== Copying TPM storage files from ${{ matrix.base-ref.name }} to PR branch ==="
120+
121+
# Create directories if they don't exist
122+
mkdir -p pr-branch/tests
123+
mkdir -p pr-branch/store
124+
mkdir -p pr-branch/test_token_storage
125+
126+
# Copy test storage files (TPM-specific patterns)
127+
if [ -d "${{ matrix.base-ref.branch-dir }}/tests" ]; then
128+
cp -v ${{ matrix.base-ref.branch-dir }}/tests/wp* pr-branch/tests/ 2>/dev/null || echo "No wp* files in ${{ matrix.base-ref.branch-dir }}/tests/"
129+
cp -v ${{ matrix.base-ref.branch-dir }}/tests/tpm* pr-branch/tests/ 2>/dev/null || echo "No tpm* files in ${{ matrix.base-ref.branch-dir }}/tests/"
130+
fi
131+
132+
# Copy store files (including TPM NV storage references)
133+
if [ -d "${{ matrix.base-ref.branch-dir }}/store" ]; then
134+
cp -v ${{ matrix.base-ref.branch-dir }}/store/wp* pr-branch/store/ 2>/dev/null || echo "No wp* files in ${{ matrix.base-ref.branch-dir }}/store/"
135+
cp -v ${{ matrix.base-ref.branch-dir }}/store/tpm* pr-branch/store/ 2>/dev/null || echo "No tpm* files in ${{ matrix.base-ref.branch-dir }}/store/"
136+
fi
137+
138+
# Copy token storage files if they exist
139+
if [ -d "${{ matrix.base-ref.branch-dir }}/test_token_storage" ]; then
140+
cp -rv ${{ matrix.base-ref.branch-dir }}/test_token_storage/* pr-branch/test_token_storage/ 2>/dev/null || echo "No files in ${{ matrix.base-ref.branch-dir }}/test_token_storage/"
141+
fi
142+
143+
echo "=== TPM storage file copy completed ==="
144+
145+
- name: Test TPM storage format compatibility (${{ matrix.base-ref.name }} → PR)
146+
working-directory: ./pr-branch
147+
run: |
148+
echo "=== Testing TPM storage format compatibility with PR branch ==="
149+
echo "This tests that the PR can read TPM storage files created by ${{ matrix.base-ref.name }} branch"
150+
151+
# List the copied files for verification
152+
echo "Files in tests directory:"
153+
ls -la tests/wp* tests/tpm* 2>/dev/null || echo "No wp*/tpm* files in tests/"
154+
echo "Files in store directory:"
155+
ls -la store/wp* store/tpm* 2>/dev/null || echo "No wp*/tpm* files in store/"
156+
echo "Files in test_token_storage directory:"
157+
ls -la test_token_storage/ 2>/dev/null || echo "No files in test_token_storage/"
158+
159+
# Check TPM status before running tests
160+
echo "=== Checking TPM simulator status ==="
161+
ps aux | grep tpm_server || echo "TPM server may not be running"
162+
163+
# Run the TPM-specific tests with the copied storage files
164+
echo "=== Running TPM compatibility tests ==="
165+
./tests/pkcs11test
166+
./tests/object_id_uniqueness_test
167+
echo "=== TPM storage format upgrade test (${{ matrix.base-ref.name }} → PR) completed successfully ==="
168+
169+
# Upload artifacts for debugging if needed
170+
- name: Upload TPM storage test artifacts
171+
if: failure()
172+
uses: actions/upload-artifact@v4
173+
with:
174+
name: tpm-storage-upgrade-test-artifacts-${{ matrix.base-ref.name }}
175+
path: |
176+
pr-branch/test-suite.log
177+
pr-branch/config.log
178+
${{ matrix.base-ref.branch-dir }}/store/wp*
179+
${{ matrix.base-ref.branch-dir }}/store/tpm*
180+
${{ matrix.base-ref.branch-dir }}/tests/wp*
181+
${{ matrix.base-ref.branch-dir }}/tests/tpm*
182+
${{ matrix.base-ref.branch-dir }}/test_token_storage/
183+
${{ matrix.base-ref.branch-dir }}/test-suite.log
184+
${{ matrix.base-ref.branch-dir }}/config.log
185+
retention-days: 5
186+
187+
# Capture logs on failure with TPM-specific information
188+
- name: Upload TPM failure logs
189+
if: failure() || cancelled()
190+
uses: actions/upload-artifact@v4
191+
with:
192+
name: tpm-storage-upgrade-test-failure-logs-${{ matrix.base-ref.name }}
193+
path: |
194+
pr-branch/test-suite.log
195+
pr-branch/config.log
196+
${{ matrix.base-ref.branch-dir }}/test-suite.log
197+
${{ matrix.base-ref.branch-dir }}/config.log
198+
retention-days: 5
199+
200+
# Clean up TPM simulator on exit
201+
- name: Cleanup TPM simulator
202+
if: always()
203+
run: |
204+
echo "=== Cleaning up TPM simulator ==="
205+
pkill -f tpm_server || echo "TPM server was not running"

‎src/internal.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4159,7 +4159,7 @@ static int wp11_Token_Load(WP11_Slot* slot, int tokenId, WP11_Token* token)
41594159
}
41604160

41614161
/* If there is no pin, there is no login, so decode now */
4162-
if (WP11_Slot_Has_Empty_Pin(slot)) {
4162+
if (WP11_Slot_Has_Empty_Pin(slot) && (ret == 0)) {
41634163
#ifndef WOLFPKCS11_NO_STORE
41644164
object = token->object;
41654165
while (ret == 0 && object != NULL) {

0 commit comments

Comments
 (0)