tests: verify that public keys are properly written

Also disable parts of the suite that softhsm2 cannot properly work with,
to allow running parts of the suite even with broken softhsm.

2 files changed, 58 insertions, 3 deletions

diff --git a/tests/suite/testpkcs11 b/tests/suite/testpkcs11
index 53ae752041..6abacf336e 100755
--- a/tests/suite/testpkcs11
+++ b/tests/suite/testpkcs11
@@ -95,6 +95,32 @@ write_serv_privkey () {
 # $1: token
 # $2: PIN
 # $3: filename
+write_serv_pubkey () {
+	export GNUTLS_PIN="$2"
+	filename="$3"
+	token="$1"
+
+	echo -n "* Writing the server public key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label serv-pubkey --load-pubkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1
+	if test $? = 0; then
+		echo ok
+	else
+		echo failed
+		exit_error
+	fi
+
+	#verify it being written
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=serv-pubkey;type=public" >>"${TMPFILE}" 2>&1
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=serv-pubkey;type=public"|grep "Public key" >/dev/null 2>&1
+	if test $? != 0;then
+		echo "Cannot verify the existence of the written pubkey"
+		exit_error
+	fi
+}
+
+# $1: token
+# $2: PIN
+# $3: filename
 write_serv_cert () {
 	export GNUTLS_PIN="$2"
 	filename="$3"
@@ -323,10 +349,15 @@ write_certificate_test () {
 	fi
 	echo ok
 
+	if test -n "${BROKEN_SOFTHSM2}";then
+		return
+	fi
+
 	echo -n "* Writing certificate of client's CA... "
 	${P11TOOL} ${ADDITIONAL_PARAM} --login --mark-trusted --mark-ca --write --label gnutls-ca --load-certificate "${cacert}" "${token}" >>"${TMPFILE}" 2>&1
 	ret=$?
 	if test ${ret} != 0; then
+		echo "Failed with PIN, trying to write with so PIN" >>"${TMPFILE}"
 		${P11TOOL} ${ADDITIONAL_PARAM} --so-login --mark-ca --write --mark-trusted --label gnutls-ca --load-certificate "${cacert}" "${token}" >>"${TMPFILE}" 2>&1
 		ret=$?
 	fi
@@ -393,6 +424,27 @@ write_certificate_test () {
 	fi
 }
 
+test_sign () {
+	export GNUTLS_PIN="$2"
+	token="$1"
+
+	echo -n "* Testing signatures using the private key... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "failed. Cannot test signatures."
+		exit_error
+	fi
+	echo ok
+
+	echo -n "* Testing signatures using the private key (with ID)... "
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};id=%ac%1d%7a%39%cb%72%17%94%66%6c%74%44%73%40%91%44%c0%a0%43%7d" >>"${TMPFILE}" 2>&1
+	${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};id=%ac%1d%7a%39%cb%72%17%94%66%6c%74%44%73%40%91%44%c0%a0%43%7d" 2>&1|grep "Verifying against public key in the token..."|grep ok >>"${TMPFILE}" 2>&1
+	if test $? != 0; then
+		echo "failed. Cannot test signatures with ID."
+		exit_error
+	fi
+	echo ok
+}
 
 # $1: token
 # $2: PIN
@@ -491,10 +543,12 @@ export_pubkey_of_privkey "${TOKEN}" "${GNUTLS_PIN}"
 change_label_of_privkey "${TOKEN}" "${GNUTLS_PIN}"
 
 write_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" "${srcdir}/pkcs11-certs/ca.crt" tmp-client.pub
-
 write_serv_privkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/server.key"
 write_serv_cert "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/server.crt"
 
+write_serv_pubkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/server.crt"
+test_sign "${TOKEN}" "${GNUTLS_PIN}"
+
 use_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${TOKEN};object=serv-cert;object-type=cert" "${TOKEN};object=serv-key;object-type=private" "${srcdir}/pkcs11-certs/ca.crt" "full URLs"
 
 use_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${TOKEN};object=serv-cert" "${TOKEN};object=serv-key" "${srcdir}/pkcs11-certs/ca.crt" "abbrv URLs"
diff --git a/tests/suite/testpkcs11.softhsm b/tests/suite/testpkcs11.softhsm
index 9a1fc163c5..a349af6d6e 100755
--- a/tests/suite/testpkcs11.softhsm
+++ b/tests/suite/testpkcs11.softhsm
@@ -37,9 +37,10 @@ init_card () {
 	if test -x "/usr/bin/softhsm2-util"; then
 		export SOFTHSM2_CONF="softhsm-testpkcs11.config"
 		SOFTHSM_TOOL="/usr/bin/softhsm2-util"
-		${SOFTHSM_TOOL} --version|grep "2.0.0b1" >/dev/null 2>&1
+		${SOFTHSM_TOOL} --version|grep "2.0.0" >/dev/null 2>&1
 		if test $? = 0; then
-			echo "softhsm2-util 2.0.0b1 is broken"
+			echo "softhsm2-util 2.0.0 is broken"
+			export BROKEN_SOFTHSM2=1
 			exit 77
 		fi
 	fi