Skip to content

Commit e0daea8

Browse files
polhenarejospolhenarejos
committed
Add PIV tests.
Signed-off-by: Pol Henarejos <[email protected]>
1 parent a9797ae commit e0daea8

12 files changed

+303
-6
lines changed

‎tests/docker/jammy/Dockerfile

+14
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,20 @@ RUN apt install -y libccid \
2222
cmake \
2323
vsmartcard-vpcd \
2424
libgcrypt-dev \
25+
libssl-dev \
26+
check \
27+
gengetopt \
2528
&& rm -rf /var/lib/apt/lists/*
2629
RUN pip3 install pytest pycvc cryptography pyscard
30+
RUN git clone https://github.com/Yubico/yubico-piv-tool
31+
WORKDIR /yubico-piv-tool
32+
RUN git checkout tags/yubico-piv-tool-2.5.1
33+
ADD tests/docker/jammy/yubico-piv-tool.patch /yubico-piv-tool/yubico-piv-tool.patch
34+
RUN git apply yubico-piv-tool.patch
35+
RUN mkdir build
36+
WORKDIR /yubico-piv-tool/build
37+
RUN cmake .. -DENABLE_HARDWARE_TESTS=1
38+
RUN make -j`nproc`
39+
RUN make install
2740
WORKDIR /
41+
RUN ldconfig

‎tests/docker/jammy/yubico-piv-tool.patch

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
diff --git a/lib/tests/api.c b/lib/tests/api.c
2+
index fb7c1a8..b569ec3 100644
3+
--- a/lib/tests/api.c
4+
+++ b/lib/tests/api.c
5+
@@ -515,7 +515,7 @@ START_TEST(test_pin_policy_always) {
6+
unsigned char rand[128] = {0};
7+
8+
size_t sig_len = sizeof(signature);
9+
- size_t padlen = 256;
10+
+ size_t padlen = 512;
11+
unsigned int enc_len;
12+
unsigned int data_len;
13+
14+
@@ -1009,8 +1009,8 @@ END_TEST
15+
START_TEST(test_pin_cache) {
16+
ykpiv_rc res;
17+
ykpiv_state *local_state;
18+
- unsigned char data[256] = {0};
19+
- unsigned char data_in[256] = {0};
20+
+ unsigned char data[512] = {0};
21+
+ unsigned char data_in[512] = {0};
22+
int len = sizeof(data);
23+
size_t len2 = sizeof(data);
24+
25+
@@ -1028,17 +1028,17 @@ START_TEST(test_pin_cache) {
26+
ck_assert_int_eq(res, YKPIV_OK);
27+
28+
// Verify decryption does not work without auth
29+
- res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA2048, 0x9a);
30+
+ res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA4096, 0x9a);
31+
ck_assert_int_eq(res, YKPIV_AUTHENTICATION_ERROR);
32+
33+
// Verify decryption does work when authed
34+
res = ykpiv_verify_select(g_state, "123456", 6, NULL, true);
35+
ck_assert_int_eq(res, YKPIV_OK);
36+
- res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA2048, 0x9a);
37+
+ res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA4096, 0x9a);
38+
ck_assert_int_eq(res, YKPIV_OK);
39+
40+
// Verify PIN policy allows continuing to decrypt without re-verifying
41+
- res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA2048, 0x9a);
42+
+ res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA4096, 0x9a);
43+
ck_assert_int_eq(res, YKPIV_OK);
44+
45+
// Create a new ykpiv state, connect, and close it.
46+
@@ -1059,7 +1059,7 @@ START_TEST(test_pin_cache) {
47+
//
48+
// Note that you can verify that this fails by rebuilding with
49+
// DISABLE_PIN_CACHE set to 1.
50+
- res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA2048, 0x9a);
51+
+ res = ykpiv_decipher_data(g_state, data_in, (size_t)len, data, &len2, YKPIV_ALGO_RSA4096, 0x9a);
52+
ck_assert_int_eq(res, YKPIV_OK);
53+
}
54+
END_TEST
55+
diff --git a/tools/confirm.sh b/tools/confirm.sh
56+
index 81c10ac..4ab15c5 100755
57+
--- a/tools/confirm.sh
58+
+++ b/tools/confirm.sh
59+
@@ -20,7 +20,8 @@ echo "WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WA
60+
echo "******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* *******" >&0
61+
echo >&0
62+
echo -n "Are you SURE you wish to proceed? If so, type 'CONFIRM': " >&0
63+
-
64+
+echo "0"
65+
+exit 0
66+
read CONFIRM
67+
if [[ "x$CONFIRM" != "xCONFIRM" ]]; then
68+
echo "1"

‎tests/docker_env.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@
4949
: ${MBEDTLS_DOCKER_GUEST:=jammy}
5050

5151

52-
DOCKER_IMAGE_TAG="pico-hsm-test:${MBEDTLS_DOCKER_GUEST}"
52+
DOCKER_IMAGE_TAG="pico-openpgp-test:${MBEDTLS_DOCKER_GUEST}"
5353

5454
# Make sure docker is available
5555
if ! which docker > /dev/null; then
@@ -79,7 +79,7 @@ ${DOCKER} image build \
7979
--cache-from=${DOCKER_IMAGE_TAG} \
8080
--network host \
8181
--build-arg MAKEFLAGS_PARALLEL="-j ${NUM_PROC}" \
82-
tests/docker/${MBEDTLS_DOCKER_GUEST}
82+
-f tests/docker/${MBEDTLS_DOCKER_GUEST}/Dockerfile .
8383

8484
run_in_docker()
8585
{

‎tests/scripts/attestation.sh

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
#!/bin/bash
2+
3+
source ./tests/scripts/func.sh
4+
5+
echo -n " Fetch attestation certificate... "
6+
piv read-cert -sf9 -o sf9.pem
7+
test $? -eq 0 && echo -e ".\t${OK}" || exit $?
8+
9+
algs=("RSA1024" "RSA2048" "ECCP256" "ECCP384")
10+
slots=("9a" "9c" "9d" "9e" "82" "83" "84" "85" "86" "87" "88" "89" "8a" "8b" "8c" "8d" "8e" "8f" "90" "91" "92" "93" "94" "95")
11+
for alg in ${algs[*]}; do
12+
for slot in ${slots[*]}; do
13+
echo " Test attestation with ${alg} in slot ${slot}"
14+
echo -n " Keygen... "
15+
gen_and_check $alg $slot && echo -e ".\t${OK}" || exit $?
16+
17+
echo -n " Fetch attesting certificate... "
18+
piv attest -s$slot -o attestation.pem
19+
test $? -eq 0 && echo -e ".\t${OK}" || exit $?
20+
21+
echo -n " OpenSSL verify attestation... "
22+
e=$(openssl verify -CAfile sf9.pem attestation.pem 2>&1)
23+
test $? -eq 0 && echo -n "." || exit $?
24+
grep -q ": OK" <<< $e && echo -e ".\t${OK}" || exit $?
25+
26+
echo -n " Key deletion... "
27+
delete_key $alg $slot && echo -e ".\t${OK}" || exit $?
28+
29+
done
30+
done
31+
32+
rm -rf cert.pem
33+
rm -rf sf9.pem

‎tests/scripts/cli-test.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/bash
2+
3+
chmod a+x tests/scripts/*.sh
4+
5+
echo "======== CLI Test suite ========"
6+
./tests/scripts/yubico-piv-tool.sh

‎tests/scripts/func.sh

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/bash
2+
3+
OK="\033[32mok\033[0m"
4+
FAIL="\033[31mfail\033[0m"
5+
6+
READER="u"
7+
8+
piv() {
9+
yubico-piv-tool -r${READER} -a$@
10+
}
11+
12+
gen_and_check() {
13+
e=$(piv generate -s$2 -A$1 -opublic.pem 2>&1)
14+
test $? -eq 0 && echo -n "." || exit $?
15+
grep -q "Successfully generated a new private key" <<< $e && echo -n "." || exit $?
16+
e=$(piv status 2>&1)
17+
e=${e//$'\t'/}
18+
e=${e//$'\n'/}
19+
test $? -eq 0 && echo -n "." || exit $?
20+
grep -q "Slot $2:Algorithm:$1" <<< $e && echo -n "." || exit $?
21+
}
22+
delete_key() {
23+
piv delete-key -s$2 > /dev/null 2>&1
24+
test $? -eq 0 && echo -n "." || exit $?
25+
piv delete-cert -s$2 > /dev/null 2>&1
26+
test $? -eq 0 && echo -n "." || exit $?
27+
e=$(piv status 2>&1)
28+
test $? -eq 0 && echo -n "." || exit $?
29+
q=$(grep -q "Slot $2: Algorithm: $1" <<< $e)
30+
test $? -eq 1 && echo -n "." || exit $?
31+
rm -rf public.pem
32+
}
33+
gen_and_delete() {
34+
gen_and_check $1 $2
35+
test $? -eq 0 && echo -n "." || exit $?
36+
delete_key $1 $2
37+
test $? -eq 0 && echo -n "." || exit $?
38+
}

‎tests/scripts/keygen.sh

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/bin/bash
2+
3+
source ./tests/scripts/func.sh
4+
5+
algs=("RSA1024" "RSA2048" "ECCP256" "ECCP384")
6+
slots=("9a" "9c" "9d" "9e" "82" "83" "84" "85" "86" "87" "88" "89" "8a" "8b" "8c" "8d" "8e" "8f" "90" "91" "92" "93" "94" "95")
7+
for alg in ${algs[*]}; do
8+
for slot in ${slots[*]}; do
9+
echo -n " Test ${alg} in slot ${slot}... "
10+
gen_and_delete ${alg} $slot && echo -e ".\t${OK}" || exit $?
11+
done
12+
done

‎tests/scripts/signatures.sh

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
#!/bin/bash
2+
3+
source ./tests/scripts/func.sh
4+
5+
algs=("RSA1024" "RSA2048" "ECCP256" "ECCP384")
6+
slots=("9a" "9c" "9d" "9e" "82" "83" "84" "85" "86" "87" "88" "89" "8a" "8b" "8c" "8d" "8e" "8f" "90" "91" "92" "93" "94" "95")
7+
for alg in ${algs[*]}; do
8+
for slot in ${slots[*]}; do
9+
echo " Test signature with ${alg} in slot ${slot}"
10+
echo -n " Keygen... "
11+
gen_and_check $alg $slot && echo -e ".\t${OK}" || exit $?
12+
13+
echo -n " Test request certificate... "
14+
e=$(piv verify -arequest -P123456 -s$slot -S'/CN=bar/OU=test/O=example.com/' -ipublic.pem -ocert.pem 2>&1)
15+
test $? -eq 0 && echo -n "." || exit $?
16+
grep -q "Successfully verified PIN" <<< $e && echo -n "." || exit $?
17+
grep -q "Successfully generated a certificate request" <<< $e && echo -e ".\t${OK}" || exit $?
18+
19+
echo -n " OpenSSL verify request... "
20+
e=$(openssl req -verify -in cert.pem 2>&1)
21+
test $? -eq 0 && echo -n "." || exit $?
22+
grep -q " OK" <<< $e && echo -e ".\t${OK}" || exit $?
23+
24+
echo -n " Test self-signed certificate... "
25+
e=$(piv verify -aselfsign -P123456 -s$slot -S'/CN=bar/OU=test/O=example.com/' -ipublic.pem -ocert.pem 2>&1)
26+
test $? -eq 0 && echo -n "." || exit $?
27+
grep -q "Successfully verified PIN" <<< $e && echo -n "." || exit $?
28+
grep -q "Successfully generated a new self signed certificate" <<< $e && echo -e ".\t${OK}" || exit $?
29+
30+
echo -n " Test signature... "
31+
e=$(piv verify-pin -atest-signature -s$slot -P123456 -icert.pem 2>&1)
32+
test $? -eq 0 && echo -n "." || exit $?
33+
grep -q "Successful" <<< $e && echo -e ".\t${OK}" || exit $?
34+
35+
echo -n " OpenSSL verify cert... "
36+
e=$(openssl verify -CAfile cert.pem cert.pem 2>&1)
37+
test $? -eq 0 && echo -n "." || exit $?
38+
grep -q ": OK" <<< $e && echo -e ".\t${OK}" || exit $?
39+
40+
echo -n " Key deletion... "
41+
delete_key $alg $slot && echo -e ".\t${OK}" || exit $?
42+
43+
done
44+
done
45+
46+
rm -rf cert.pem

‎tests/scripts/version.sh

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
3+
source ./tests/scripts/func.sh
4+
5+
# Get version
6+
echo -n " Test version... "
7+
e=$(piv version 2>&1)
8+
test $? -eq 0 && echo -n "." || exit $?
9+
grep -q "Application version" <<< $e && echo -n "." || exit $?
10+
grep -q " found" <<< $e && echo -e ".\t${OK}" || exit $?

‎tests/scripts/yubico-piv-test.sh

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
3+
source ./tests/scripts/func.sh
4+
reset
5+
test $? -eq 0 || exit $?
6+
7+
echo -n " Test PKCS11 tool..."
8+
gen_and_check rsa:2048
9+
test $? -eq 0 && echo -n "." || exit $?
10+
e=$(pkcs11-tool --test -l --pin 648219 2>&1)
11+
test $? -eq 0 && echo -n "." || exit $?
12+
grep -q "No errors" <<< $e && echo -n "." || exit $?
13+
pkcs11-tool -l --pin 648219 --delete-object --type privkey --id 1 > /dev/null 2>&1
14+
test $? -eq 0 && echo -e ".\t${OK}" || exit $?
15+
#e=$(pkcs11-tool --test-ec -l --pin 648219 --id 1 --key-type ec:secp256r1 2>&1)
16+
#test $? -eq 0 && echo -n "." || exit $?
17+
#grep -q "==> OK" <<< $e && echo -e ".\t${OK}" || exit $?

‎tests/scripts/yubico-piv-tool.sh

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/bin/bash
2+
3+
source ./tests/scripts/func.sh
4+
echo "==== Test version ===="
5+
./tests/scripts/version.sh
6+
test $? -eq 0 || {
7+
echo -e "\t${FAIL}"
8+
exit 1
9+
}
10+
11+
echo "==== Test asymmetric keygen ===="
12+
./tests/scripts/keygen.sh
13+
test $? -eq 0 || {
14+
echo -e "\t${FAIL}"
15+
exit 1
16+
}
17+
18+
echo "==== Test self-signed certificates ===="
19+
./tests/scripts/signatures.sh
20+
test $? -eq 0 || {
21+
echo -e "\t${FAIL}"
22+
exit 1
23+
}
24+
25+
echo "==== Test attestation ===="
26+
./tests/scripts/attestation.sh
27+
test $? -eq 0 || {
28+
echo -e "\t${FAIL}"
29+
exit 1
30+
}

‎tests/start-up-and-test.sh

+27-4
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,30 @@
1-
#!/bin/bash -eu
1+
#!/bin/bash
22

3+
OK="\t\033[32mok\033[0m"
4+
FAIL="\t\033[31mfail\033[0m"
5+
6+
fail() {
7+
echo -e "${FAIL}"
8+
exit 1
9+
}
10+
11+
echo -n "Start PCSC..."
312
/usr/sbin/pcscd &
4-
sleep 2
5-
rm -rf memory.flash
6-
./build_in_docker/pico_openpgp > /dev/null &
13+
test $? -eq 0 && echo -e "${OK}" || {
14+
echo -e "${FAIL}"
15+
exit 1
16+
}
17+
sleep 1
18+
rm -f memory.flash
19+
echo -n "Start Pico OpenPGP..."
20+
./build_in_docker/pico_openpgp > /dev/null 2>&1 &
21+
test $? -eq 0 && echo -n "." || fail
22+
sleep 1
23+
ATR="3b:da:18:ff:81:b1:fe:75:1f:03:00:31:f5:73:c0:01:60:00:90:00:1c"
24+
e=$(opensc-tool -an 2>&1)
25+
grep -q "${ATR}" <<< $e && echo -n "." || fail
26+
test $? -eq 0 && echo -e "${OK}" || fail
27+
728
pytest tests -W ignore::DeprecationWarning
29+
30+
./tests/scripts/cli-test.sh

0 commit comments

Comments
 (0)