Skip to content

Commit cfd433c

Browse files
LinuxJediLinuxJedi
committed
WiP TPM storage tests
1 parent 2d9fad9 commit cfd433c

2 files changed

Lines changed: 205 additions & 1 deletion

File tree

‎.github/workflows/storage-upgrade-test-tpm.yml‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
name: wolfPKCS11 Storage Format Upgrade Test (TPM)
2+
3+
on:
4+
pull_request:
5+
branches: [ '*' ]
6+
7+
env:
8+
WOLFSSL_VERSION: v5.8.0-stable
9+
10+
jobs:
11+
storage-upgrade-test-tpm:
12+
runs-on: ubuntu-latest
13+
strategy:
14+
matrix:
15+
base-ref:
16+
- name: master
17+
ref: master
18+
branch-dir: master-branch
19+
- name: v1.3.0
20+
ref: v1.3.0-stable
21+
branch-dir: v1.3.0-stable-branch
22+
23+
steps:
24+
# Checkout the PR branch
25+
- name: Checkout PR branch
26+
uses: actions/checkout@v4
27+
with:
28+
path: pr-branch
29+
30+
# Checkout base branch/tag separately
31+
- name: Checkout ${{ matrix.base-ref.name }} branch
32+
uses: actions/checkout@v4
33+
with:
34+
ref: ${{ matrix.base-ref.ref }}
35+
path: ${{ matrix.base-ref.branch-dir }}
36+
37+
- name: Cache wolfSSL
38+
id: cache-wolfssl
39+
uses: actions/cache@v4
40+
with:
41+
path: wolfssl
42+
key: wolfssl-${{ env.WOLFSSL_VERSION }}
43+
44+
# Setup wolfssl (required dependency)
45+
- name: Checkout wolfssl
46+
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
47+
uses: actions/checkout@v4
48+
with:
49+
repository: wolfssl/wolfssl
50+
path: wolfssl
51+
ref: ${{ env.WOLFSSL_VERSION }}
52+
53+
- name: Build wolfssl
54+
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
55+
working-directory: ./wolfssl
56+
run: |
57+
./autogen.sh
58+
./configure --enable-cryptocb --enable-aescfb --enable-rsapss --enable-keygen --enable-pwdbased --enable-scrypt \
59+
C_EXTRA_FLAGS="-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT"
60+
make
61+
62+
- name: Install wolfssl
63+
working-directory: ./wolfssl
64+
run: |
65+
sudo make install
66+
sudo ldconfig
67+
68+
# Setup IBM Software TPM simulator
69+
- name: Setup IBM Software TPM
70+
run: |
71+
git clone https://github.com/kgoldman/ibmswtpm2.git
72+
cd ibmswtpm2/src
73+
make
74+
./tpm_server &
75+
sleep 2
76+
cd ../..
77+
78+
# Build and install wolfTPM (required for TPM operations)
79+
- name: Build and install wolfTPM
80+
run: |
81+
git clone https://github.com/wolfSSL/wolftpm.git
82+
cd wolftpm
83+
./autogen.sh
84+
./configure --enable-swtpm --enable-debug
85+
make -j$(nproc)
86+
sudo make install
87+
sudo ldconfig
88+
cd ..
89+
90+
# Phase 1: Build and test base branch/tag with TPM
91+
- name: Build wolfPKCS11 ${{ matrix.base-ref.name }} with TPM
92+
working-directory: ./${{ matrix.base-ref.branch-dir }}
93+
run: |
94+
echo "=== Building wolfPKCS11 ${{ matrix.base-ref.name }} branch with TPM support ==="
95+
./autogen.sh
96+
./configure --enable-singlethreaded --enable-wolftpm --disable-dh C_EXTRA_FLAGS="-DWOLFPKCS11_TPM_STORE"
97+
make
98+
99+
- name: Run TPM tests on ${{ matrix.base-ref.name }} to generate storage files
100+
working-directory: ./${{ matrix.base-ref.branch-dir }}
101+
run: |
102+
echo "=== Running TPM tests on ${{ matrix.base-ref.name }} branch ==="
103+
# Run specific TPM tests that generate storage files
104+
./tests/pkcs11test
105+
echo "=== ${{ matrix.base-ref.name }} branch TPM test completed ==="
106+
107+
# Phase 2: Build PR branch with TPM and copy storage files from base
108+
- name: Build wolfPKCS11 PR branch with TPM
109+
working-directory: ./pr-branch
110+
run: |
111+
echo "=== Building wolfPKCS11 PR branch with TPM support ==="
112+
./autogen.sh
113+
./configure --enable-singlethreaded --enable-wolftpm --disable-dh C_EXTRA_FLAGS="-DWOLFPKCS11_TPM_STORE"
114+
make
115+
116+
- name: Copy TPM storage files from ${{ matrix.base-ref.name }} to PR
117+
run: |
118+
echo "=== Copying TPM storage files from ${{ matrix.base-ref.name }} to PR branch ==="
119+
120+
# Create directories if they don't exist
121+
mkdir -p pr-branch/tests
122+
mkdir -p pr-branch/store
123+
mkdir -p pr-branch/test_token_storage
124+
125+
# Copy test storage files (TPM-specific patterns)
126+
if [ -d "${{ matrix.base-ref.branch-dir }}/tests" ]; then
127+
cp -v ${{ matrix.base-ref.branch-dir }}/tests/wp* pr-branch/tests/ 2>/dev/null || echo "No wp* files in ${{ matrix.base-ref.branch-dir }}/tests/"
128+
cp -v ${{ matrix.base-ref.branch-dir }}/tests/tpm* pr-branch/tests/ 2>/dev/null || echo "No tpm* files in ${{ matrix.base-ref.branch-dir }}/tests/"
129+
fi
130+
131+
# Copy store files (including TPM NV storage references)
132+
if [ -d "${{ matrix.base-ref.branch-dir }}/store" ]; then
133+
cp -v ${{ matrix.base-ref.branch-dir }}/store/wp* pr-branch/store/ 2>/dev/null || echo "No wp* files in ${{ matrix.base-ref.branch-dir }}/store/"
134+
cp -v ${{ matrix.base-ref.branch-dir }}/store/tpm* pr-branch/store/ 2>/dev/null || echo "No tpm* files in ${{ matrix.base-ref.branch-dir }}/store/"
135+
fi
136+
137+
# Copy token storage files if they exist
138+
if [ -d "${{ matrix.base-ref.branch-dir }}/test_token_storage" ]; then
139+
cp -rv ${{ matrix.base-ref.branch-dir }}/test_token_storage/* pr-branch/test_token_storage/ 2>/dev/null || echo "No files in ${{ matrix.base-ref.branch-dir }}/test_token_storage/"
140+
fi
141+
142+
echo "=== TPM storage file copy completed ==="
143+
144+
- name: Test TPM storage format compatibility (${{ matrix.base-ref.name }} → PR)
145+
working-directory: ./pr-branch
146+
run: |
147+
echo "=== Testing TPM storage format compatibility with PR branch ==="
148+
echo "This tests that the PR can read TPM storage files created by ${{ matrix.base-ref.name }} branch"
149+
150+
# List the copied files for verification
151+
echo "Files in tests directory:"
152+
ls -la tests/wp* tests/tpm* 2>/dev/null || echo "No wp*/tpm* files in tests/"
153+
echo "Files in store directory:"
154+
ls -la store/wp* store/tpm* 2>/dev/null || echo "No wp*/tpm* files in store/"
155+
echo "Files in test_token_storage directory:"
156+
ls -la test_token_storage/ 2>/dev/null || echo "No files in test_token_storage/"
157+
158+
# Check TPM status before running tests
159+
echo "=== Checking TPM simulator status ==="
160+
ps aux | grep tpm_server || echo "TPM server may not be running"
161+
162+
# Run the TPM-specific tests with the copied storage files
163+
echo "=== Running TPM compatibility tests ==="
164+
./tests/pkcs11test
165+
./tests/object_id_uniqueness_test
166+
echo "=== TPM storage format upgrade test (${{ matrix.base-ref.name }} → PR) completed successfully ==="
167+
168+
# Upload artifacts for debugging if needed
169+
- name: Upload TPM storage test artifacts
170+
if: failure()
171+
uses: actions/upload-artifact@v4
172+
with:
173+
name: tpm-storage-upgrade-test-artifacts-${{ matrix.base-ref.name }}
174+
path: |
175+
pr-branch/test-suite.log
176+
pr-branch/config.log
177+
${{ matrix.base-ref.branch-dir }}/store/wp*
178+
${{ matrix.base-ref.branch-dir }}/store/tpm*
179+
${{ matrix.base-ref.branch-dir }}/tests/wp*
180+
${{ matrix.base-ref.branch-dir }}/tests/tpm*
181+
${{ matrix.base-ref.branch-dir }}/test_token_storage/
182+
${{ matrix.base-ref.branch-dir }}/test-suite.log
183+
${{ matrix.base-ref.branch-dir }}/config.log
184+
retention-days: 5
185+
186+
# Capture logs on failure with TPM-specific information
187+
- name: Upload TPM failure logs
188+
if: failure() || cancelled()
189+
uses: actions/upload-artifact@v4
190+
with:
191+
name: tpm-storage-upgrade-test-failure-logs-${{ matrix.base-ref.name }}
192+
path: |
193+
pr-branch/test-suite.log
194+
pr-branch/config.log
195+
${{ matrix.base-ref.branch-dir }}/test-suite.log
196+
${{ matrix.base-ref.branch-dir }}/config.log
197+
retention-days: 5
198+
199+
# Clean up TPM simulator on exit
200+
- name: Cleanup TPM simulator
201+
if: always()
202+
run: |
203+
echo "=== Cleaning up TPM simulator ==="
204+
pkill -f tpm_server || echo "TPM server was not running"

‎src/internal.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4159,7 +4159,7 @@ static int wp11_Token_Load(WP11_Slot* slot, int tokenId, WP11_Token* token)
41594159
}
41604160

41614161
/* If there is no pin, there is no login, so decode now */
4162-
if (WP11_Slot_Has_Empty_Pin(slot)) {
4162+
if (WP11_Slot_Has_Empty_Pin(slot) && (ret == 0)) {
41634163
#ifndef WOLFPKCS11_NO_STORE
41644164
object = token->object;
41654165
while (ret == 0 && object != NULL) {

0 commit comments

Comments
 (0)