diff options
author | Nikos Mavrogiannopoulos <nmav@redhat.com> | 2018-03-19 18:29:23 +0100 |
---|---|---|
committer | Nikos Mavrogiannopoulos <nmav@gnutls.org> | 2018-03-19 19:54:29 +0100 |
commit | 100afec741777ee13b057577f36a685752ab5287 (patch) | |
tree | 6c4e47bbf8653b5fc6c689d1bcc650df02ec97ec /tests/suite | |
parent | 16e63cbd685b328b0602ac95494feb8711f4df8e (diff) | |
download | gnutls-100afec741777ee13b057577f36a685752ab5287.tar.gz |
tests: testpkcs11.sh was moved to the main tests
Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
Diffstat (limited to 'tests/suite')
-rw-r--r-- | tests/suite/Makefile.am | 9 | ||||
-rwxr-xr-x | tests/suite/certtool-pkcs11.sh | 193 | ||||
-rw-r--r-- | tests/suite/pkcs11-certs/ca-tmpl | 67 | ||||
-rw-r--r-- | tests/suite/pkcs11-certs/ca.crt | 15 | ||||
-rw-r--r-- | tests/suite/pkcs11-certs/ca.key | 94 | ||||
-rw-r--r-- | tests/suite/pkcs11-certs/client-tmpl | 67 | ||||
-rw-r--r-- | tests/suite/pkcs11-certs/client.crt | 16 | ||||
-rw-r--r-- | tests/suite/pkcs11-certs/client.key | 94 | ||||
-rw-r--r-- | tests/suite/pkcs11-certs/server-tmpl | 67 | ||||
-rw-r--r-- | tests/suite/pkcs11-certs/server.crt | 16 | ||||
-rw-r--r-- | tests/suite/pkcs11-certs/server.key | 94 | ||||
-rw-r--r-- | tests/suite/testpkcs11.pkcs15 | 45 | ||||
-rw-r--r-- | tests/suite/testpkcs11.sc-hsm | 50 | ||||
-rwxr-xr-x | tests/suite/testpkcs11.sh | 935 | ||||
-rwxr-xr-x | tests/suite/testpkcs11.softhsm | 77 |
15 files changed, 2 insertions, 1837 deletions
diff --git a/tests/suite/Makefile.am b/tests/suite/Makefile.am index 6e784fff8e..4b39da6f0f 100644 --- a/tests/suite/Makefile.am +++ b/tests/suite/Makefile.am @@ -85,17 +85,12 @@ nodist_libecore_la_SOURCES = ecore/src/lib/ecore_anim.c \ ecore/src/lib/eina_ustringshare.c ecore/src/lib/eina_value.c -EXTRA_DIST += testcompat-main-polarssl testcompat-main-openssl testcompat-common \ - testpkcs11.pkcs15 testpkcs11.softhsm testpkcs11.sc-hsm +EXTRA_DIST += testcompat-main-polarssl testcompat-main-openssl testcompat-common nodist_check_SCRIPTS = chain.sh invalid-cert.sh \ testrng.sh testcompat-polarssl.sh testcompat-openssl.sh \ - testrandom.sh certtool-pkcs11.sh tls-fuzzer/tls-fuzzer-nocert.sh \ + testrandom.sh tls-fuzzer/tls-fuzzer-nocert.sh \ tls-fuzzer/tls-fuzzer-cert.sh tls-fuzzer/tls-fuzzer-alpn.sh -if ENABLE_PKCS11 -nodist_check_SCRIPTS += testpkcs11.sh -endif - TESTS_ENVIRONMENT = EXEEXT=$(EXEEXT) \ LC_ALL="C" \ VALGRIND="$(VALGRIND)" \ diff --git a/tests/suite/certtool-pkcs11.sh b/tests/suite/certtool-pkcs11.sh deleted file mode 100755 index 39933cd0c3..0000000000 --- a/tests/suite/certtool-pkcs11.sh +++ /dev/null @@ -1,193 +0,0 @@ -#!/bin/sh - -# Copyright (C) 2016 Nikos Mavrogiannopoulos -# -# This file is part of GnuTLS. -# -# GnuTLS is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 3 of the License, or (at -# your option) any later version. -# -# GnuTLS is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with GnuTLS; if not, write to the Free Software Foundation, -# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - -srcdir="${srcdir:-.}" -P11TOOL="${P11TOOL:-../../src/p11tool${EXEEXT}}" -CERTTOOL="${CERTTOOL:-../../src/certtool${EXEEXT}}" -DIFF="${DIFF:-diff -b -B}" -SERV="${SERV:-../../src/gnutls-serv${EXEEXT}}" -CLI="${CLI:-../../src/gnutls-cli${EXEEXT}}" -RETCODE=0 - -if ! test -x "${P11TOOL}"; then - exit 77 -fi - -if ! test -x "${CERTTOOL}"; then - exit 77 -fi - -if ! test -x "${SERV}"; then - exit 77 -fi - -if ! test -x "${CLI}"; then - exit 77 -fi - -if ! test -z "${VALGRIND}"; then - VALGRIND="${LIBTOOL:-libtool} --mode=execute valgrind --leak-check=full" -fi - -TMPFILE="verify-pkcs11.debug" -CERTTOOL_PARAM="--stdout-info" - -if test "${WINDIR}" != ""; then - exit 77 -fi - -P11TOOL="${VALGRIND} ${P11TOOL} --batch" -SERV="${SERV} -q" - -. ${srcdir}/../scripts/common.sh - -rm -f "${TMPFILE}" - -exit_error () { - echo "check ${TMPFILE} for additional debugging information" - echo "" - echo "" - tail "${TMPFILE}" - exit 1 -} - -check_for_datefudge - -# $1: token -# $2: PIN -# $3: filename -# $4: label -write_ca_cert () { - export GNUTLS_PIN="$2" - filename="$3" - token="$1" - label="$4" - - echo -n "* Writing the CA certificate... " - ${P11TOOL} ${ADDITIONAL_PARAM} --mark-ca --mark-trusted --no-mark-private --so-login --write --label "$label" --load-certificate "${filename}" "${token}" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi - -} - -# $1: token -# $2: PIN -# $3: filename -write_ca_privkey () { - export GNUTLS_PIN="$2" - filename="$3" - token="$1" - - echo -n "* Writing the CA private key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label CA-key --load-privkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi -} - -# $1: URL -# $2: cert file to verify -verify_certificate_test() { - url=$1 - file=$2 - - echo -n "* Verifying a certificate... " - datefudge -s "2015-10-10" \ - $CERTTOOL ${ADDITIONAL_PARAM} --verify --load-ca-certificate "$url" --infile "$file" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo "failed $file with $url" - exit_error - fi -} - -generate_cert() { - url=$1 - - echo -n "* Generating a certificate... " - $CERTTOOL ${ADDITIONAL_PARAM} --generate-certificate --load-ca-certificate "$url" --load-ca-privkey "${srcdir}/pkcs11-certs/ca.key" --load-privkey "${srcdir}/pkcs11-certs/server.key" --template "${srcdir}/pkcs11-certs/server-tmpl" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo "failed generation with $url" - exit_error - fi -} - -generate_cert_with_key() { - ca_url=$1 - ca_key_url=$2 - - echo -n "* Generating a certificate (privkey in pkcs11)... " - $CERTTOOL ${ADDITIONAL_PARAM} --generate-certificate --load-ca-certificate "${ca_url}" --load-ca-privkey "${ca_key_url}" --load-privkey "${srcdir}/pkcs11-certs/server.key" --template "${srcdir}/pkcs11-certs/server-tmpl" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo "failed generation with $url" - exit_error - fi -} - -echo "Testing PKCS11 verification" - -# erase SC - -type="softhsm" - -. "${srcdir}/testpkcs11.${type}" - -export GNUTLS_PIN=12345678 -export GNUTLS_SO_PIN=00000000 - -init_card "${GNUTLS_PIN}" "${GNUTLS_SO_PIN}" - -# find token name -TOKEN=`${P11TOOL} ${ADDITIONAL_PARAM} --list-tokens pkcs11:token=Nikos|grep URL|grep token=GnuTLS-Test|sed 's/\s*URL\: //g'` - -echo "* Token: ${TOKEN}" -if test "x${TOKEN}" = x; then - echo "Could not find generated token" - exit_error -fi - -write_ca_cert "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.crt" "CA" - -verify_certificate_test "${TOKEN};object=CA;object-type=cert" "${srcdir}/pkcs11-certs/server.crt" -verify_certificate_test "${TOKEN};object=CA;object-type=cert" "${srcdir}/pkcs11-certs/client.crt" -generate_cert "${TOKEN};object=CA;object-type=cert" - -write_ca_privkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" - -generate_cert_with_key "${TOKEN};object=CA;object-type=cert" "${TOKEN};object=CA-key;object-type=private" - -if test ${RETCODE} = 0; then - echo "* All tests succeeded" -fi -rm -f "${TMPFILE}" - -exit 0 diff --git a/tests/suite/pkcs11-certs/ca-tmpl b/tests/suite/pkcs11-certs/ca-tmpl deleted file mode 100644 index 5bf462d1ef..0000000000 --- a/tests/suite/pkcs11-certs/ca-tmpl +++ /dev/null @@ -1,67 +0,0 @@ -# X.509 Certificate options -# -# DN options - -dn = "cn=CA,C=CZ" - -# The serial number of the certificate -serial = 1 - -# In how many days, counting from today, this certificate will expire. -expiration_days = 2590 - -# X.509 v3 extensions - -# A dnsname in case of a WWW server. -#dns_name = "localhost" -#dns_name = "www.morethanone.org" - -# An IP address in case of a server. -#ip_address = "192.168.1.1" - -#dns_name = "www.evenmorethanone.org" - -# An email in case of a person -email = "none@none.org" - -# An URL that has CRLs (certificate revocation lists) -# available. Needed in CA certificates. -crl_dist_points = "http://www.getcrl.crl/getcrl/" - -#email = "where@none.org" - -# Whether this is a CA certificate or not -ca - -# Whether this certificate will be used for a TLS client -#tls_www_client - -# Whether this certificate will be used for a TLS server -#tls_www_server - -# Whether this certificate will be used to sign data (needed -# in TLS DHE ciphersuites). -signing_key - -# Whether this certificate will be used to encrypt data (needed -# in TLS RSA ciphersuites). Note that it is preferred to use different -# keys for encryption and signing. -#encryption_key - -# Whether this key will be used to sign other certificates. -cert_signing_key - -# Whether this key will be used to sign CRLs. -crl_signing_key - -# Whether this key will be used to sign code. -#code_signing_key - -# Whether this key will be used to sign OCSP data. -ocsp_signing_key - -# Whether this key will be used for time stamping. -#time_stamping_key - -# Whether this key will be used for IPsec IKE operations. -#ipsec_ike_key diff --git a/tests/suite/pkcs11-certs/ca.crt b/tests/suite/pkcs11-certs/ca.crt deleted file mode 100644 index e39ee41f7a..0000000000 --- a/tests/suite/pkcs11-certs/ca.crt +++ /dev/null @@ -1,15 +0,0 @@ ------BEGIN CERTIFICATE----- -MIICUjCCAbugAwIBAgIBATANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQDEwJDQTEL -MAkGA1UEBhMCQ1owIhgPMjAxMzExMTAwODI0NTRaGA8yMDIwMTIxMzA4MjQ1NFow -GjELMAkGA1UEAxMCQ0ExCzAJBgNVBAYTAkNaMIGfMA0GCSqGSIb3DQEBAQUAA4GN -ADCBiQKBgQCoomr+kiRtx+/doF2FRSOxqBuuLbcpK5KwxtYk82L8MQzzJijfjS88 -4kCijlR6dqD0oDS70ngNogg2uIgn1SfLTTgXw/v6w/nMnMIYZ+ePrF5WD1qGeOAu -R+qts4Y4rfb9Yb8sXIPdui7HelqimJaVeMxAYJsqRBSixDSpYbkEhwIDAQABo4Gj -MIGgMA8GA1UdEwEB/wQFMAMBAf8wGAYDVR0RBBEwD4ENbm9uZUBub25lLm9yZzAT -BgNVHSUEDDAKBggrBgEFBQcDCTAPBgNVHQ8BAf8EBQMDBwYAMB0GA1UdDgQWBBQS -DtpREkBWrvQcbcyhsD0oYX4zATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vd3d3 -LmdldGNybC5jcmwvZ2V0Y3JsLzANBgkqhkiG9w0BAQsFAAOBgQBzRzkYVGhl0ltc -iVvXModMh9cb1TcUrc2nhfEh63u5ZF1/8MJPaMMLw3FZmGc5B8lNYOoWiSqK/Ark -iO9chPwqRKWY8n52USgGDcUNRxbwCa2vOQg9cdSWIcdt18W5mtJ3hz+CDaT8ZH8t -sVW/i5eG6O7o3rZGSwbcC1pgIWZqCw== ------END CERTIFICATE----- diff --git a/tests/suite/pkcs11-certs/ca.key b/tests/suite/pkcs11-certs/ca.key deleted file mode 100644 index 62f5bfae39..0000000000 --- a/tests/suite/pkcs11-certs/ca.key +++ /dev/null @@ -1,94 +0,0 @@ -Public Key Info: - Public Key Algorithm: RSA - Key Security Level: Weak (1024 bits) - -modulus: - 00:a8:a2:6a:fe:92:24:6d:c7:ef:dd:a0:5d:85:45: - 23:b1:a8:1b:ae:2d:b7:29:2b:92:b0:c6:d6:24:f3: - 62:fc:31:0c:f3:26:28:df:8d:2f:3c:e2:40:a2:8e: - 54:7a:76:a0:f4:a0:34:bb:d2:78:0d:a2:08:36:b8: - 88:27:d5:27:cb:4d:38:17:c3:fb:fa:c3:f9:cc:9c: - c2:18:67:e7:8f:ac:5e:56:0f:5a:86:78:e0:2e:47: - ea:ad:b3:86:38:ad:f6:fd:61:bf:2c:5c:83:dd:ba: - 2e:c7:7a:5a:a2:98:96:95:78:cc:40:60:9b:2a:44: - 14:a2:c4:34:a9:61:b9:04:87: - -public exponent: - 01:00:01: - -private exponent: - 08:f8:4a:b4:ab:d5:60:39:88:5a:c3:92:f5:e9:cd: - 92:3f:9c:e9:50:e9:33:39:6c:1e:17:15:80:f5:a9: - 48:3c:db:b1:7b:50:25:43:ff:45:3f:cb:ac:59:e1: - c8:79:d2:e9:f0:33:9d:e1:fe:1c:cb:87:a0:51:84: - 7c:89:ec:09:e0:3d:c9:df:ca:43:d9:c1:79:3c:47: - f7:8e:71:bf:a5:6e:11:87:0d:d9:2e:5a:5d:a0:d3: - ba:5b:9c:23:db:33:54:5f:a2:2f:db:28:05:9d:07: - a4:d4:76:0e:ef:d1:f9:c3:f9:21:01:ad:06:4c:9d: - 59:14:09:37:91:df:86:01: - -prime1: - 00:d6:e8:07:49:7f:a6:6a:d7:f3:76:84:4b:a9:cb: - 91:66:8a:c8:07:54:29:25:1d:e4:70:dd:2c:fd:ff: - dc:c6:0c:24:75:4f:a0:ca:82:e2:b6:3b:8b:f0:7b: - 37:c3:97:be:6c:b3:5f:91:a6:c0:56:48:aa:aa:3a: - d9:12:24:b7:81: - -prime2: - 00:c8:e1:50:40:9b:7e:34:9c:44:88:1e:16:4b:bf: - 04:0f:a6:b0:2b:9d:2f:a2:84:29:96:54:35:69:68: - 6f:a2:a7:2b:8a:de:e9:9e:0e:6f:b3:cf:d8:af:68: - 33:52:a6:e4:b5:d1:21:d0:6b:d2:d2:a6:af:97:62: - 44:fe:b8:00:07: - -coefficient: - 75:16:b8:48:0b:61:9a:a9:78:b1:72:93:94:51:54: - c1:07:69:b8:b1:dc:61:4a:f5:ef:b7:9c:f5:07:74: - 0d:8e:1a:a2:51:ea:00:91:ef:05:75:42:53:4d:6a: - e3:f5:de:07:a5:55:5f:8b:37:58:55:2b:43:ef:b2: - d0:38:a8:89: - -exp1: - 00:c9:b9:60:e5:b7:e1:b1:56:e5:dc:70:d0:49:20: - a1:6a:3c:89:08:80:12:63:19:cd:0d:b8:3e:fc:69: - 48:85:ca:6e:0a:83:e5:2d:52:70:96:98:0c:82:7e: - 56:d8:cd:3e:5c:f0:7e:9b:cc:87:ac:36:67:a4:84: - ba:af:92:31:81: - -exp2: - 65:0a:d8:78:36:fe:8b:6e:13:16:b8:b3:94:54:37: - b1:bb:b1:9f:ae:88:18:62:0c:1d:1e:ac:63:21:f2: - 0d:49:b3:20:3e:32:1a:9b:be:5a:1e:f1:2a:81:ea: - 56:e7:b5:e1:32:99:a4:a1:a7:c0:e7:b1:29:1f:77: - fe:fc:04:9f: - - -Public Key ID: 12:0E:DA:51:12:40:56:AE:F4:1C:6D:CC:A1:B0:3D:28:61:7E:33:01 -Public key's random art: -+--[ RSA 1024]----+ -|.E*++.o | -|oo *.B . | -|..++O * | -| o.*oB . | -| o + o S | -| . | -| | -| | -| | -+-----------------+ - ------BEGIN RSA PRIVATE KEY----- -MIICXAIBAAKBgQCoomr+kiRtx+/doF2FRSOxqBuuLbcpK5KwxtYk82L8MQzzJijf -jS884kCijlR6dqD0oDS70ngNogg2uIgn1SfLTTgXw/v6w/nMnMIYZ+ePrF5WD1qG -eOAuR+qts4Y4rfb9Yb8sXIPdui7HelqimJaVeMxAYJsqRBSixDSpYbkEhwIDAQAB -AoGACPhKtKvVYDmIWsOS9enNkj+c6VDpMzlsHhcVgPWpSDzbsXtQJUP/RT/LrFnh -yHnS6fAzneH+HMuHoFGEfInsCeA9yd/KQ9nBeTxH945xv6VuEYcN2S5aXaDTuluc -I9szVF+iL9soBZ0HpNR2Du/R+cP5IQGtBkydWRQJN5HfhgECQQDW6AdJf6Zq1/N2 -hEupy5FmisgHVCklHeRw3Sz9/9zGDCR1T6DKguK2O4vwezfDl75ss1+RpsBWSKqq -OtkSJLeBAkEAyOFQQJt+NJxEiB4WS78ED6awK50vooQpllQ1aWhvoqcrit7png5v -s8/Yr2gzUqbktdEh0GvS0qavl2JE/rgABwJBAMm5YOW34bFW5dxw0EkgoWo8iQiA -EmMZzQ24PvxpSIXKbgqD5S1ScJaYDIJ+VtjNPlzwfpvMh6w2Z6SEuq+SMYECQGUK -2Hg2/otuExa4s5RUN7G7sZ+uiBhiDB0erGMh8g1JsyA+Mhqbvloe8SqB6lbnteEy -maShp8DnsSkfd/78BJ8CQHUWuEgLYZqpeLFyk5RRVMEHabix3GFK9e+3nPUHdA2O -GqJR6gCR7wV1QlNNauP13gelVV+LN1hVK0PvstA4qIk= ------END RSA PRIVATE KEY----- diff --git a/tests/suite/pkcs11-certs/client-tmpl b/tests/suite/pkcs11-certs/client-tmpl deleted file mode 100644 index a22eef84ba..0000000000 --- a/tests/suite/pkcs11-certs/client-tmpl +++ /dev/null @@ -1,67 +0,0 @@ -# X.509 Certificate options -# -# DN options - -dn = "cn=Client,C=CZ" - -# The serial number of the certificate -serial = 3 - -# In how many days, counting from today, this certificate will expire. -expiration_days = 2590 - -# X.509 v3 extensions - -# A dnsname in case of a WWW server. -#dns_name = "localhost" -#dns_name = "www.morethanone.org" - -# An IP address in case of a server. -#ip_address = "192.168.1.1" - -#dns_name = "www.evenmorethanone.org" - -# An email in case of a person -email = "none@none.org" - -# An URL that has CRLs (certificate revocation lists) -# available. Needed in CA certificates. -#crl_dist_points = "http://www.getcrl.crl/getcrl/" - -#email = "where@none.org" - -# Whether this is a CA certificate or not -#ca - -# Whether this certificate will be used for a TLS client -tls_www_client - -# Whether this certificate will be used for a TLS server -#tls_www_server - -# Whether this certificate will be used to sign data (needed -# in TLS DHE ciphersuites). -signing_key - -# Whether this certificate will be used to encrypt data (needed -# in TLS RSA ciphersuites). Note that it is preferred to use different -# keys for encryption and signing. -#encryption_key - -# Whether this key will be used to sign other certificates. -#cert_signing_key - -# Whether this key will be used to sign CRLs. -#crl_signing_key - -# Whether this key will be used to sign code. -#code_signing_key - -# Whether this key will be used to sign OCSP data. -#ocsp_signing_key - -# Whether this key will be used for time stamping. -#time_stamping_key - -# Whether this key will be used for IPsec IKE operations. -#ipsec_ike_key diff --git a/tests/suite/pkcs11-certs/client.crt b/tests/suite/pkcs11-certs/client.crt deleted file mode 100644 index 6f75590d25..0000000000 --- a/tests/suite/pkcs11-certs/client.crt +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN CERTIFICATE----- -MIICdDCCAd2gAwIBAgIBAzANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQDEwJDQTEL -MAkGA1UEBhMCQ1owIhgPMjAxMzExMTAwODI1MjdaGA8yMDIwMTIxMzA4MjUyN1ow -HjEPMA0GA1UEAxMGQ2xpZW50MQswCQYDVQQGEwJDWjCBnzANBgkqhkiG9w0BAQEF -AAOBjQAwgYkCgYEAvQRIzvKyhr3tqmB4Pe+91DWSFayaNtcrDIT597bhxugVYW8o -jB206kx5aknAMA3PQGYcGqkLrt+nsJcmOIXDZsC6P4zeOSsF1PPhDAoX3bkUr2lF -MEt374eKdg1yvyhRxt4DOR6aD4gkC7fVtaYdgV6yXpJGMHV05LBIgQ7QtykCAwEA -AaOBwTCBvjAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMCMBgGA1Ud -EQQRMA+BDW5vbmVAbm9uZS5vcmcwDwYDVR0PAQH/BAUDAweAADAdBgNVHQ4EFgQU -Dbinh11GaaJcTyOpmxPYuttsiGowHwYDVR0jBBgwFoAUEg7aURJAVq70HG3MobA9 -KGF+MwEwLgYDVR0fBCcwJTAjoCGgH4YdaHR0cDovL3d3dy5nZXRjcmwuY3JsL2dl -dGNybC8wDQYJKoZIhvcNAQELBQADgYEAN/Henso+5zzuFQWTpJXlUsWtRQAFhRY3 -WVt3xtnyPs4pF/LKBp3Ov0GLGBkz5YlyJGFNESSyUviMsH7g7rJM8i7Bph6BQTE9 -XdqbZPc0opfms4EHjmlXj5HQ0f0yoxHnLk43CR+vmbn0JPuurnEKAwjznAJR8GxI -R2MRyMxdGqs= ------END CERTIFICATE----- diff --git a/tests/suite/pkcs11-certs/client.key b/tests/suite/pkcs11-certs/client.key deleted file mode 100644 index 9277bdfd8f..0000000000 --- a/tests/suite/pkcs11-certs/client.key +++ /dev/null @@ -1,94 +0,0 @@ -Public Key Info: - Public Key Algorithm: RSA - Key Security Level: Weak (1024 bits) - -modulus: - 00:bd:04:48:ce:f2:b2:86:bd:ed:aa:60:78:3d:ef: - bd:d4:35:92:15:ac:9a:36:d7:2b:0c:84:f9:f7:b6: - e1:c6:e8:15:61:6f:28:8c:1d:b4:ea:4c:79:6a:49: - c0:30:0d:cf:40:66:1c:1a:a9:0b:ae:df:a7:b0:97: - 26:38:85:c3:66:c0:ba:3f:8c:de:39:2b:05:d4:f3: - e1:0c:0a:17:dd:b9:14:af:69:45:30:4b:77:ef:87: - 8a:76:0d:72:bf:28:51:c6:de:03:39:1e:9a:0f:88: - 24:0b:b7:d5:b5:a6:1d:81:5e:b2:5e:92:46:30:75: - 74:e4:b0:48:81:0e:d0:b7:29: - -public exponent: - 01:00:01: - -private exponent: - 00:a5:eb:b1:e2:00:07:98:e1:f6:53:de:35:0e:e1: - 79:78:63:c2:25:c6:8a:e4:e3:02:46:0e:20:c3:43: - 45:73:ee:5c:7e:58:2e:76:b8:c9:0b:f7:2f:89:8e: - cd:e7:20:e8:32:36:b0:2a:f3:03:6f:71:a2:e9:0f: - f5:9c:1e:47:84:54:2b:67:12:e3:f4:20:80:7f:54: - 81:63:f4:41:4a:6f:8f:89:e8:83:24:64:87:b5:2b: - 5b:25:55:c5:b6:e8:1d:c9:a0:a9:68:0d:2d:1f:06: - ac:46:6a:96:93:96:16:24:fe:7f:e4:00:c7:bf:37: - fe:48:6f:3f:94:0b:36:9e:81: - -prime1: - 00:dd:8b:ef:a9:f3:e9:7a:97:6f:50:2f:d4:93:ff: - 0b:6d:52:b4:2c:64:d2:bb:6c:a7:ca:5d:5f:31:ba: - 2c:f6:59:09:34:57:5f:3c:cd:f5:2b:a0:c7:7a:ac: - e2:20:64:a8:58:24:a3:02:c3:7f:7b:c5:7b:31:4e: - de:81:6b:48:f9: - -prime2: - 00:da:69:4a:53:be:3d:36:07:58:a7:8e:58:4e:cd: - 90:cd:72:54:7c:40:89:ab:fd:3a:8b:6d:d0:9c:b0: - 00:7f:11:6a:b7:f2:4e:e0:81:8b:23:09:3f:c4:6f: - f7:6d:06:b1:c8:83:63:87:72:c7:43:01:24:5d:2d: - 88:7f:b9:1b:b1: - -coefficient: - 30:19:e0:d7:bd:0f:0d:96:b0:65:64:00:82:2a:9d: - 6c:52:a6:89:a6:db:89:e3:7f:10:c3:3b:5b:97:73: - ea:13:af:fc:4c:3e:72:5e:da:cb:b7:d4:b6:2c:d0: - 05:c3:58:bb:2d:59:2c:50:1f:08:6d:03:53:ba:ec: - 15:ec:b6:08: - -exp1: - 00:d0:6d:4e:54:3d:bc:72:30:f5:f0:22:8f:83:8c: - 76:5b:ab:6b:06:38:f4:68:8f:98:6b:b1:dc:55:14: - 2a:28:b9:2b:07:ab:0b:56:51:0d:4e:b6:3b:f5:15: - a0:c7:88:eb:37:c1:7f:fa:a1:a1:d5:f7:bc:26:6f: - 64:b5:ad:11:41: - -exp2: - 2a:a6:b1:0b:15:75:62:9d:a0:a4:67:d9:ba:d9:cd: - d3:30:e6:6a:b5:37:ad:4c:70:28:56:33:8c:c5:99: - f3:36:75:7e:a2:64:e0:d6:ab:53:16:35:4b:a9:09: - ca:52:aa:59:1b:bf:4d:ee:0e:17:79:9b:9e:4e:8b: - ff:55:28:a1: - - -Public Key ID: 0D:B8:A7:87:5D:46:69:A2:5C:4F:23:A9:9B:13:D8:BA:DB:6C:88:6A -Public key's random art: -+--[ RSA 1024]----+ -| | -| . . . | -| . * * | -| + = X . | -| . B S = | -| . O o | -| ...* o | -| E. .+.o | -|o. ooo | -+-----------------+ - ------BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQC9BEjO8rKGve2qYHg9773UNZIVrJo21ysMhPn3tuHG6BVhbyiM -HbTqTHlqScAwDc9AZhwaqQuu36ewlyY4hcNmwLo/jN45KwXU8+EMChfduRSvaUUw -S3fvh4p2DXK/KFHG3gM5HpoPiCQLt9W1ph2BXrJekkYwdXTksEiBDtC3KQIDAQAB -AoGBAKXrseIAB5jh9lPeNQ7heXhjwiXGiuTjAkYOIMNDRXPuXH5YLna4yQv3L4mO -zecg6DI2sCrzA29xoukP9ZweR4RUK2cS4/QggH9UgWP0QUpvj4nogyRkh7UrWyVV -xbboHcmgqWgNLR8GrEZqlpOWFiT+f+QAx783/khvP5QLNp6BAkEA3YvvqfPpepdv -UC/Uk/8LbVK0LGTSu2ynyl1fMbos9lkJNFdfPM31K6DHeqziIGSoWCSjAsN/e8V7 -MU7egWtI+QJBANppSlO+PTYHWKeOWE7NkM1yVHxAiav9Oott0JywAH8RarfyTuCB -iyMJP8Rv920GsciDY4dyx0MBJF0tiH+5G7ECQQDQbU5UPbxyMPXwIo+DjHZbq2sG -OPRoj5hrsdxVFCoouSsHqwtWUQ1Otjv1FaDHiOs3wX/6oaHV97wmb2S1rRFBAkAq -prELFXVinaCkZ9m62c3TMOZqtTetTHAoVjOMxZnzNnV+omTg1qtTFjVLqQnKUqpZ -G79N7g4XeZueTov/VSihAkAwGeDXvQ8NlrBlZACCKp1sUqaJptuJ438Qwztbl3Pq -E6/8TD5yXtrLt9S2LNAFw1i7LVksUB8IbQNTuuwV7LYI ------END RSA PRIVATE KEY----- diff --git a/tests/suite/pkcs11-certs/server-tmpl b/tests/suite/pkcs11-certs/server-tmpl deleted file mode 100644 index 23103b4a91..0000000000 --- a/tests/suite/pkcs11-certs/server-tmpl +++ /dev/null @@ -1,67 +0,0 @@ -# X.509 Certificate options -# -# DN options - -dn = "cn=Server,C=CZ" - -# The serial number of the certificate -serial = 2 - -# In how many days, counting from today, this certificate will expire. -expiration_days = 2590 - -# X.509 v3 extensions - -# A dnsname in case of a WWW server. -dns_name = "localhost" -#dns_name = "www.morethanone.org" - -# An IP address in case of a server. -ip_address = "127.0.0.1" - -#dns_name = "www.evenmorethanone.org" - -# An email in case of a person -email = "none@none.org" - -# An URL that has CRLs (certificate revocation lists) -# available. Needed in CA certificates. -#crl_dist_points = "http://www.getcrl.crl/getcrl/" - -#email = "where@none.org" - -# Whether this is a CA certificate or not -#ca - -# Whether this certificate will be used for a TLS client -#tls_www_client - -# Whether this certificate will be used for a TLS server -tls_www_server - -# Whether this certificate will be used to sign data (needed -# in TLS DHE ciphersuites). -signing_key - -# Whether this certificate will be used to encrypt data (needed -# in TLS RSA ciphersuites). Note that it is preferred to use different -# keys for encryption and signing. -encryption_key - -# Whether this key will be used to sign other certificates. -#cert_signing_key - -# Whether this key will be used to sign CRLs. -#crl_signing_key - -# Whether this key will be used to sign code. -#code_signing_key - -# Whether this key will be used to sign OCSP data. -#ocsp_signing_key - -# Whether this key will be used for time stamping. -#time_stamping_key - -# Whether this key will be used for IPsec IKE operations. -#ipsec_ike_key diff --git a/tests/suite/pkcs11-certs/server.crt b/tests/suite/pkcs11-certs/server.crt deleted file mode 100644 index 694a0101f7..0000000000 --- a/tests/suite/pkcs11-certs/server.crt +++ /dev/null @@ -1,16 +0,0 @@ ------BEGIN CERTIFICATE----- -MIICdjCCAd+gAwIBAgIBAjANBgkqhkiG9w0BAQsFADAaMQswCQYDVQQDEwJDQTEL -MAkGA1UEBhMCQ1owIhgPMjAxMzExMTAwODI1MDJaGA8yMDIwMTIxMzA4MjUwMlow -HjEPMA0GA1UEAxMGU2VydmVyMQswCQYDVQQGEwJDWjCBnzANBgkqhkiG9w0BAQEF -AAOBjQAwgYkCgYEApf9FBAZadRuU0AGrH4xgNh5V5tFDErTba2bF8b7USLRUzETm -+qBW87I6QXWDFsZlvyyzrpINmpbG3UNr3cVLgT7DLC2ct5nZFT4j25BYswcr0V5C -00BAz6NUcuTzY0e0iN+H80H/mUr3Xu5r9wJca1LGTspBF1NOTNoAunlSm3cCAwEA -AaOBwzCBwDAMBgNVHRMBAf8EAjAAMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAA -ATATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMDB6AAMB0GA1UdDgQW -BBSsHXo5y3IXlGZsdERzQJFEwKBDfTAfBgNVHSMEGDAWgBQSDtpREkBWrvQcbcyh -sD0oYX4zATAuBgNVHR8EJzAlMCOgIaAfhh1odHRwOi8vd3d3LmdldGNybC5jcmwv -Z2V0Y3JsLzANBgkqhkiG9w0BAQsFAAOBgQBG1omwPssQQPTLd4WeCQyuM/Yj1kOO -VwFOATVs2+XELAGg6GVrSS302+JKdW51j+11NpIMgJfgaeRdZkgBNR4uOi1okOQh -Asm8TC3ex3v1rxZdunp0wBQ/H/ox4zMM5Ds8ITtQNeUwXqUj3tPorTWFEsNegTnY -WmV1jslH8fZ4Fg== ------END CERTIFICATE----- diff --git a/tests/suite/pkcs11-certs/server.key b/tests/suite/pkcs11-certs/server.key deleted file mode 100644 index 56e48735a0..0000000000 --- a/tests/suite/pkcs11-certs/server.key +++ /dev/null @@ -1,94 +0,0 @@ -Public Key Info: - Public Key Algorithm: RSA - Key Security Level: Weak (1024 bits) - -modulus: - 00:a5:ff:45:04:06:5a:75:1b:94:d0:01:ab:1f:8c: - 60:36:1e:55:e6:d1:43:12:b4:db:6b:66:c5:f1:be: - d4:48:b4:54:cc:44:e6:fa:a0:56:f3:b2:3a:41:75: - 83:16:c6:65:bf:2c:b3:ae:92:0d:9a:96:c6:dd:43: - 6b:dd:c5:4b:81:3e:c3:2c:2d:9c:b7:99:d9:15:3e: - 23:db:90:58:b3:07:2b:d1:5e:42:d3:40:40:cf:a3: - 54:72:e4:f3:63:47:b4:88:df:87:f3:41:ff:99:4a: - f7:5e:ee:6b:f7:02:5c:6b:52:c6:4e:ca:41:17:53: - 4e:4c:da:00:ba:79:52:9b:77: - -public exponent: - 01:00:01: - -private exponent: - 55:76:38:45:1b:34:45:28:9f:13:fc:57:ea:d5:2d: - cf:8f:0c:b0:da:3a:0b:0e:7c:0d:2e:8b:68:ab:d3: - c5:5e:ba:6d:b4:67:aa:cf:14:15:41:44:46:e1:46: - 4d:5a:75:95:d8:60:e5:d6:a2:14:5d:de:22:9a:8c: - 95:4f:f7:4f:cd:eb:65:a0:29:35:b1:16:b7:c2:74: - f1:a4:45:43:6c:77:59:37:b3:cb:43:60:80:29:5e: - b6:99:60:9a:12:4d:2b:54:2e:c3:3a:76:96:7d:72: - b1:72:24:f1:2a:2d:ff:99:92:1e:bb:55:f1:58:6e: - 64:08:36:26:4b:b2:c6:99: - -prime1: - 00:c7:65:44:0f:4e:6b:51:cd:d4:0b:84:9c:a9:30: - 1b:7b:6d:9a:ca:f7:27:8d:8f:b5:05:81:b8:0d:d2: - a2:b3:e3:ab:bb:04:a1:8d:ec:dc:65:38:99:e9:e1: - 4f:70:47:79:8d:e6:3a:f0:9f:7b:3b:aa:bd:80:1d: - 4d:0d:2a:00:7d: - -prime2: - 00:d5:1e:d4:82:40:de:a6:ce:1a:59:93:b8:51:c6: - 55:15:7f:83:d0:11:ac:a1:44:0a:95:f0:e5:96:03: - 53:5e:2c:27:eb:63:5f:b7:1c:06:64:fb:35:c9:a3: - a1:1a:fb:f2:3c:31:a1:51:58:40:5e:24:28:dd:ba: - dc:c4:14:22:03: - -coefficient: - 00:9c:b5:66:d6:6d:93:93:da:0f:15:96:48:07:c6: - 4a:eb:ae:da:2a:fc:d8:b3:03:cb:5e:5e:10:9e:7f: - e8:49:96:db:70:6b:ef:d7:5a:4a:a4:f5:2a:da:89: - 39:b4:51:09:64:4c:75:92:57:ee:4f:9e:4d:55:f9: - d0:34:0e:6f:43: - -exp1: - 2a:3c:5f:10:46:f2:20:9f:d2:bc:a5:d8:71:56:09: - 5c:39:b9:42:28:dc:2d:f6:34:c7:f7:d4:3e:c9:51: - 41:7d:86:50:d5:08:4b:81:d2:a5:76:39:d3:fa:af: - d2:fe:b0:d6:c7:df:d0:3c:57:e4:29:a4:7e:50:b6: - 93:85:44:19: - -exp2: - 1a:1b:38:b4:eb:f5:5a:41:8d:00:c4:13:a4:10:c3: - 83:6a:a7:5e:e9:8b:58:05:d9:b6:1c:58:43:54:0c: - f6:50:3a:63:9f:3c:ae:55:84:83:02:32:c8:8c:7e: - c3:ab:71:34:e6:6f:78:63:73:1f:15:16:dc:72:73: - 70:a1:76:b9: - - -Public Key ID: AC:1D:7A:39:CB:72:17:94:66:6C:74:44:73:40:91:44:C0:A0:43:7D -Public key's random art: -+--[ RSA 1024]----+ -| ...o.BX+. | -| . .. E oo | -| o + o | -| o B | -| S= | -| + o. | -| o = . | -| .o.o. | -| oo. | -+-----------------+ - ------BEGIN RSA PRIVATE KEY----- -MIICXAIBAAKBgQCl/0UEBlp1G5TQAasfjGA2HlXm0UMStNtrZsXxvtRItFTMROb6 -oFbzsjpBdYMWxmW/LLOukg2alsbdQ2vdxUuBPsMsLZy3mdkVPiPbkFizByvRXkLT -QEDPo1Ry5PNjR7SI34fzQf+ZSvde7mv3AlxrUsZOykEXU05M2gC6eVKbdwIDAQAB -AoGAVXY4RRs0RSifE/xX6tUtz48MsNo6Cw58DS6LaKvTxV66bbRnqs8UFUFERuFG -TVp1ldhg5daiFF3eIpqMlU/3T83rZaApNbEWt8J08aRFQ2x3WTezy0NggCletplg -mhJNK1Quwzp2ln1ysXIk8Sot/5mSHrtV8VhuZAg2JkuyxpkCQQDHZUQPTmtRzdQL -hJypMBt7bZrK9yeNj7UFgbgN0qKz46u7BKGN7NxlOJnp4U9wR3mN5jrwn3s7qr2A -HU0NKgB9AkEA1R7UgkDeps4aWZO4UcZVFX+D0BGsoUQKlfDllgNTXiwn62NftxwG -ZPs1yaOhGvvyPDGhUVhAXiQo3brcxBQiAwJAKjxfEEbyIJ/SvKXYcVYJXDm5Qijc -LfY0x/fUPslRQX2GUNUIS4HSpXY50/qv0v6w1sff0DxX5CmkflC2k4VEGQJAGhs4 -tOv1WkGNAMQTpBDDg2qnXumLWAXZthxYQ1QM9lA6Y588rlWEgwIyyIx+w6txNOZv -eGNzHxUW3HJzcKF2uQJBAJy1ZtZtk5PaDxWWSAfGSuuu2ir82LMDy15eEJ5/6EmW -23Br79daSqT1KtqJObRRCWRMdZJX7k+eTVX50DQOb0M= ------END RSA PRIVATE KEY----- diff --git a/tests/suite/testpkcs11.pkcs15 b/tests/suite/testpkcs11.pkcs15 deleted file mode 100644 index 565282a312..0000000000 --- a/tests/suite/testpkcs11.pkcs15 +++ /dev/null @@ -1,45 +0,0 @@ -#!/bin/sh - -# Copyright (C) 2013 Nikos Mavrogiannopoulos -# -# This file is part of GnuTLS. -# -# GnuTLS is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 3 of the License, or (at -# your option) any later version. -# -# GnuTLS is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with GnuTLS; if not, write to the Free Software Foundation, -# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - - -init_card () { - PIN="$1" - PUK="$2" - - echo -n "* Erasing smart card... " - pkcs15-init -E >"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - cat "${TMPFILE}" - exit_error - fi - - echo -n "* Initializing smart card... " - pkcs15-init --create-pkcs15 --profile pkcs15+onepin --use-default-transport-key --so-pin "${PIN}" --pin "${PIN}" --puk "${PUK}" --label "GnuTLS-Test" >"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - cat "${TMPFILE}" - exit_error - fi -} diff --git a/tests/suite/testpkcs11.sc-hsm b/tests/suite/testpkcs11.sc-hsm deleted file mode 100644 index f3eab685fb..0000000000 --- a/tests/suite/testpkcs11.sc-hsm +++ /dev/null @@ -1,50 +0,0 @@ -#!/bin/sh - -# Copyright (C) 2013 Nikos Mavrogiannopoulos -# -# This file is part of GnuTLS. -# -# GnuTLS is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 3 of the License, or (at -# your option) any later version. -# -# GnuTLS is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with GnuTLS; if not, write to the Free Software Foundation, -# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - - -init_card () { - PIN="$1" - PUK=3537363231383830 - export GNUTLS_SO_PIN="${PUK}" - - echo -n "* Erasing smart card... " - sc-hsm-tool --initialize --so-pin "${PUK}" --pin "${PIN}" --label=GnuTLS-Test >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi - - echo -n "* Initializing smart card... " - TOKEN=`${P11TOOL} ${ADDITIONAL_PARAM} --list-tokens pkcs11:token=Nikos|grep URL|grep token=GnuTLS-Test|sed 's/\s*URL\: //g'` - if test -z "${TOKEN}"; then - echo "Could not find initialized card" - exit_error - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --initialize "${TOKEN}" --set-so-pin "${PUK}" --set-pin "${PIN}" --label "GnuTLS-Test" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi -} diff --git a/tests/suite/testpkcs11.sh b/tests/suite/testpkcs11.sh deleted file mode 100755 index 672ae791db..0000000000 --- a/tests/suite/testpkcs11.sh +++ /dev/null @@ -1,935 +0,0 @@ -#!/bin/sh - -# Copyright (C) 2013 Nikos Mavrogiannopoulos -# -# This file is part of GnuTLS. -# -# GnuTLS is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 3 of the License, or (at -# your option) any later version. -# -# GnuTLS is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with GnuTLS; if not, write to the Free Software Foundation, -# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - -srcdir="${srcdir:-.}" -P11TOOL="${P11TOOL:-../../src/p11tool${EXEEXT}}" -CERTTOOL="${CERTTOOL:-../../src/certtool${EXEEXT}}" -DIFF="${DIFF:-diff -b -B}" -SERV="${SERV:-../../src/gnutls-serv${EXEEXT}}" -CLI="${CLI:-../../src/gnutls-cli${EXEEXT}}" -RETCODE=0 - -if test "${GNUTLS_FORCE_FIPS_MODE}" = 1;then - echo "Cannot run in FIPS140-2 mode" - exit 77 -fi - -if ! test -x "${P11TOOL}"; then - exit 77 -fi - -if ! test -x "${CERTTOOL}"; then - exit 77 -fi - -if ! test -x "${SERV}"; then - exit 77 -fi - -if ! test -x "${CLI}"; then - exit 77 -fi - -if ! test -z "${VALGRIND}"; then - VALGRIND="${LIBTOOL:-libtool} --mode=execute valgrind --leak-check=full" -fi - -TMPFILE="testpkcs11.debug" -CERTTOOL_PARAM="--stdout-info" - -if test "${WINDIR}" != ""; then - exit 77 -fi - -P11TOOL="${VALGRIND} ${P11TOOL} --batch" -SERV="${SERV} -q" - -. ${srcdir}/../scripts/common.sh - -rm -f "${TMPFILE}" - -exit_error () { - echo "check ${TMPFILE} for additional debugging information" - echo "" - echo "" - tail "${TMPFILE}" - exit 1 -} - -# $1: token -# $2: PIN -# $3: filename -# ${srcdir}/pkcs11-certs/client.key -write_privkey () { - export GNUTLS_PIN="$2" - filename="$3" - token="$1" - - echo -n "* Writing a client private key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label gnutls-client2 --load-privkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi - - echo -n "* Checking whether object was marked private... " - ${P11TOOL} ${ADDITIONAL_PARAM} --list-privkeys "${token};object=gnutls-client2" 2>/dev/null | grep 'Label\:' >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo "private object was public" - exit_error - fi - echo ok - - echo -n "* Checking whether object was marked sensitive... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=gnutls-client2" | grep "CKA_SENSITIVE" >/dev/null 2>&1 - if test $? != 0; then - echo "private object was not sensitive" - exit_error - fi - echo ok -} - -# $1: token -# $2: PIN -# $3: filename -write_serv_privkey () { - export GNUTLS_PIN="$2" - filename="$3" - token="$1" - - echo -n "* Writing the server private key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label serv-key --load-privkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi - -} - -# $1: token -# $2: PIN -# $3: filename -write_serv_pubkey () { - export GNUTLS_PIN="$2" - filename="$3" - token="$1" - - echo -n "* Writing the server public key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label serv-pubkey --load-pubkey "${filename}" "${token}" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi - - #verify it being written - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=serv-pubkey;type=public" >>"${TMPFILE}" 2>&1 - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=serv-pubkey;type=public"|grep "Public key" >/dev/null 2>&1 - if test $? != 0;then - echo "Cannot verify the existence of the written pubkey" - exit_error - fi -} - -# $1: token -# $2: PIN -# $3: filename -write_serv_cert () { - export GNUTLS_PIN="$2" - filename="$3" - token="$1" - - echo -n "* Writing the server certificate... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --no-mark-private --label serv-cert --load-certificate "${filename}" "${token}" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi - -} - -# $1: token -# $2: PIN -test_delete_cert () { - export GNUTLS_PIN="$2" - filename="$3" - token="$1" - - echo -n "* Deleting the server certificate... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --delete "${token};object=serv-cert;object-type=cert" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi -} - -# $1: token -# $2: PIN -# $3: bits -generate_rsa_privkey () { - export GNUTLS_PIN="$2" - token="$1" - bits="$3" - - echo -n "* Generating RSA private key ("${bits}")... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --id 000102030405 --label gnutls-client --generate-rsa --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit 1 - fi - - echo -n "* Checking whether generated private key was marked private... " - ${P11TOOL} ${ADDITIONAL_PARAM} --list-privkeys "${token};object=gnutls-client" 2>/dev/null | grep 'Label\:' >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo "private object was public" - exit_error - fi - echo ok - - echo -n "* Checking whether private key was marked sensitive... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=gnutls-client" | grep "CKA_SENSITIVE" >/dev/null 2>&1 - if test $? != 0; then - echo "private object was not sensitive" - exit_error - fi - echo ok -} - -# $1: token -# $2: PIN -# $3: bits -generate_temp_rsa_privkey () { - export GNUTLS_PIN="$2" - token="$1" - bits="$3" - - echo -n "* Generating RSA private key ("${bits}")... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --label temp-rsa-"${bits}" --generate-rsa --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit 1 - fi - -# if test ${RETCODE} = 0; then -# echo -n "* Testing private key flags... " -# ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-keys "${token};object=gnutls-client2;object-type=private" >tmp-client-2.pub 2>>"${TMPFILE}" -# if test $? != 0; then -# echo failed -# exit_error -# fi -# -# grep CKA_WRAP tmp-client-2.pub >>"${TMPFILE}" 2>&1 -# if test $? != 0; then -# echo "failed (no CKA_WRAP)" -# exit_error -# else -# echo ok -# fi -# fi -} - -generate_temp_dsa_privkey () { - export GNUTLS_PIN="$2" - token="$1" - bits="$3" - - echo -n "* Generating DSA private key ("${bits}")... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --label temp-dsa-"${bits}" --generate-dsa --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit 1 - fi -} - -# $1: token -# $2: PIN -delete_temp_privkey () { - export GNUTLS_PIN="$2" - token="$1" - type="$3" - - test "${RETCODE}" = "0" || return - - echo -n "* Deleting private key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --delete "${token};object=temp-${type};object-type=private" >>"${TMPFILE}" 2>&1 - - if test $? != 0; then - echo failed - RETCODE=1 - return - fi - - RETCODE=0 - echo ok -} - -# $1: token -# $2: PIN -# $3: bits -export_pubkey_of_privkey () { - export GNUTLS_PIN="$2" - token="$1" - bits="$3" - - echo -n "* Exporting public key of generated private key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --export-pubkey "${token};object=gnutls-client;object-type=private" --outfile tmp-client-2.pub >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit 1 - fi - - ${DIFF} tmp-client.pub tmp-client-2.pub - if test $? != 0; then - echo keys differ - exit 1 - fi - - echo ok -} - -# $1: token -# $2: PIN -change_id_of_privkey () { - export GNUTLS_PIN="$2" - token="$1" - - echo -n "* Change the CKA_ID of generated private key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --set-id "01a1b103" "${token};object=gnutls-client;id=%00%01%02%03%04%05;object-type=private" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit_error - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=gnutls-client;object-type=private;id=%01%a1%b1%03" 2>&1 | grep 'ID: 01:a1:b1:03' >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "ID didn't change" - exit_error - fi - - echo ok -} - -# $1: token -# $2: PIN -change_label_of_privkey () { - export GNUTLS_PIN="$2" - token="$1" - - echo -n "* Change the CKA_LABEL of generated private key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --set-label "new-label" "${token};object=gnutls-client;object-type=private" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit_error - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-privkeys "${token};object=new-label;object-type=private" 2>&1 |grep 'Label: new-label' >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "label didn't change" - exit_error - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --login --set-label "gnutls-client" "${token};object=new-label;object-type=private" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit_error - fi - - echo ok -} - -# $1: token -# $2: PIN -# $3: bits -generate_temp_ecc_privkey () { - export GNUTLS_PIN="$2" - token="$1" - bits="$3" - - echo -n "* Generating ECC private key (${bits})... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --label "temp-ecc-${bits}" --generate-ecc --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit 1 - fi -} - -# $1: token -# $2: PIN -# $3: bits -# The same as generate_temp_ecc_privkey but no explicit login is performed. -# p11tool should detect that login is required for the operation. -generate_temp_ecc_privkey_no_login () { - export GNUTLS_PIN="$2" - token="$1" - bits="$3" - - echo -n "* Generating ECC private key without --login (${bits})... " - ${P11TOOL} ${ADDITIONAL_PARAM} --label "temp-ecc-no-${bits}" --generate-ecc --bits "${bits}" "${token}" --outfile tmp-client.pub >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit 1 - fi -} - -# $1: name -# $2: label prefix -# $3: generate option -# $4: token -# $5: PIN -# $6: bits -import_privkey () { - export GNUTLS_PIN="$5" - name="$1" - prefix="$2" - gen_option="$3" - token="$4" - bits="$6" - - outfile="tmp-${prefix}-${bits}.pem" - - echo -n "* Importing ${name} private key (${bits})... " - - "${CERTTOOL}" ${CERTTOOL_PARAM} --generate-privkey "${gen_option}" --pkcs8 --password= --outfile "${outfile}" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit 1 - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label "${prefix}-${bits}" --load-privkey "${outfile}" "${token}" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit 1 - fi -} - -import_temp_rsa_privkey () { - import_privkey RSA temp-rsa --rsa $@ -} - -import_temp_ecc_privkey () { - import_privkey ECC temp-ecc --ecc $@ -} - -import_temp_dsa_privkey () { - import_privkey DSA temp-dsa --dsa $@ -} - -# $1: token -# $2: PIN -# $3: cakey: ${srcdir}/pkcs11-certs/ca.key -# $4: cacert: ${srcdir}/pkcs11-certs/ca.crt -# -# Tests writing a certificate which corresponds to the given key, -# as well as the CA certificate, and tries to export them. -write_certificate_test () { - export GNUTLS_PIN="$2" - token="$1" - cakey="$3" - cacert="$4" - pubkey="$5" - - echo -n "* Generating client certificate... " - "${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM} --generate-certificate --load-ca-privkey "${cakey}" --load-ca-certificate "${cacert}" \ - --template ${srcdir}/pkcs11-certs/client-tmpl --load-privkey "${token};object=gnutls-client;object-type=private" \ - --load-pubkey "$pubkey" --outfile tmp-client.crt >>"${TMPFILE}" 2>&1 - - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi - - echo -n "* Writing client certificate... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --id "01a1b103" --label gnutls-client --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi - - echo -n "* Checking whether ID was correctly set... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=gnutls-client;object-type=private;id=%01%a1%b1%03" 2>&1 | grep 'ID: 01:a1:b1:03' >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "ID was not set on copy" - exit_error - fi - echo ok - - if test -n "${BROKEN_SOFTHSM2}";then - return - fi - - echo -n "* Checking whether object was public... " - ${P11TOOL} ${ADDITIONAL_PARAM} --list-all-certs "${token};object=gnutls-client;id=%01%a1%b1%03" 2>&1 | grep 'ID: 01:a1:b1:03' >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "certificate object was not public" - exit_error - fi - echo ok - - if test -n "${BROKEN_SOFTHSM2}";then - return - fi - - echo -n "* Writing certificate of client's CA... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --mark-trusted --mark-ca --write --label gnutls-ca --load-certificate "${cacert}" "${token}" >>"${TMPFILE}" 2>&1 - ret=$? - if test ${ret} != 0; then - echo "Failed with PIN, trying to write with so PIN" >>"${TMPFILE}" - ${P11TOOL} ${ADDITIONAL_PARAM} --so-login --mark-ca --write --mark-trusted --label gnutls-ca --load-certificate "${cacert}" "${token}" >>"${TMPFILE}" 2>&1 - ret=$? - fi - - if test ${ret} = 0; then - echo ok - else - echo failed - exit_error - fi - - echo -n "* Testing certificate flags... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all-certs "${token};object=gnutls-ca;object-type=cert" |grep Flags|head -n 1 >tmp-client-2.pub 2>>"${TMPFILE}" - if test $? != 0; then - echo failed - exit_error - fi - - grep CKA_TRUSTED tmp-client-2.pub >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "failed (no CKA_TRUSTED)" - #exit_error - fi - - grep "CKA_CERTIFICATE_CATEGORY=CA" tmp-client-2.pub >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "failed (no CKA_CERTIFICATE_CATEGORY=CA)" - #exit_error - fi - - echo ok - - - echo -n "* Trying to obtain back the cert... " - ${P11TOOL} ${ADDITIONAL_PARAM} --export "${token};object=gnutls-ca;object-type=cert" --outfile crt1.tmp >>"${TMPFILE}" 2>&1 - ${DIFF} crt1.tmp "${srcdir}/pkcs11-certs/ca.crt" - if test $? != 0; then - echo "failed. Exported certificate differs (crt1.tmp)!" - exit_error - fi - rm -f crt1.tmp - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi - - echo -n "* Trying to obtain the full chain... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --export-chain "${token};object=gnutls-client;object-type=cert"|"${CERTTOOL}" ${CERTTOOL_PARAM} -i --outfile crt1.tmp >>"${TMPFILE}" 2>&1 - - cat tmp-client.crt ${srcdir}/pkcs11-certs/ca.crt|"${CERTTOOL}" ${CERTTOOL_PARAM} -i >crt2.tmp - ${DIFF} crt1.tmp crt2.tmp - if test $? != 0; then - echo "failed. Exported certificate chain differs!" - exit_error - fi - rm -f crt1.tmp crt2.tmp - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi -} - -# $1: token -# $2: PIN -# $3: cakey: ${srcdir}/pkcs11-certs/ca.key -# $4: cacert: ${srcdir}/pkcs11-certs/ca.crt -# -# Tests writing a certificate which corresponds to the given key, -# and verifies whether the ID is the same. Should utilize the -# ID of the public key. -write_certificate_id_test_rsa () { - export GNUTLS_PIN="$2" - token="$1" - cakey="$3" - cacert="$4" - - echo -n "* Generating RSA private key on HSM... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --label xxx1-rsa --generate-rsa --bits 1024 "${token}" >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit 1 - fi - - echo -n "* Checking whether right ID is set on copy... " - "${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM} --generate-certificate --load-ca-privkey "${cakey}" --load-ca-certificate "${cacert}" \ - --template ${srcdir}/pkcs11-certs/client-tmpl --load-privkey "${token};object=xxx1-rsa;object-type=private" \ - --outfile tmp-client.crt >>"${TMPFILE}" 2>&1 - - if test $? != 0; then - echo failed - exit_error - fi - - id=$(${P11TOOL} ${ADDITIONAL_PARAM} --list-all "${token};object=xxx1-rsa;object-type=public" 2>&1 | grep 'ID: '|sed -e 's/ID://' -e 's/^[ \t]*//' -e 's/[ \t]*$//') - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label tmp-xxx1-rsa --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit_error - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=tmp-xxx1-rsa;object-type=cert" 2>&1 | grep "ID: ${id}" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "ID '$id' was not set on copy" - exit_error - fi - echo ok -} - -# $1: token -# $2: PIN -# $3: cakey: ${srcdir}/pkcs11-certs/ca.key -# $4: cacert: ${srcdir}/pkcs11-certs/ca.crt -# -# Tests writing a certificate which corresponds to the given key, -# and verifies whether the ID is the same. Should utilize the -# ID of the private key. -write_certificate_id_test_rsa2 () { - export GNUTLS_PIN="$2" - token="$1" - cakey="$3" - cacert="$4" - tmpkey="key.$$.tmp" - - echo -n "* Generating RSA private key... " - ${CERTTOOL} ${ADDITIONAL_PARAM} --generate-privkey --bits 1024 --outfile ${tmpkey} >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit 1 - fi - - echo -n "* Checking whether right ID is set on copy... " - "${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM} --generate-certificate --load-ca-privkey "${cakey}" --load-ca-certificate "${cacert}" \ - --template ${srcdir}/pkcs11-certs/client-tmpl --load-privkey ${tmpkey} \ - --outfile tmp-client.crt >>"${TMPFILE}" 2>&1 - - if test $? != 0; then - echo failed - exit_error - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label xxx2-rsa --load-privkey ${tmpkey} "${token}" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit_error - fi - - id=$(${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=xxx2-rsa;object-type=private" 2>&1 | grep 'ID: '|sed -e 's/ID://' -e 's/^[ \t]*//' -e 's/[ \t]*$//') - - rm -f ${tmpkey} - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label tmp-xxx2-rsa --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit_error - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=tmp-xxx2-rsa;object-type=cert" 2>&1 | grep "ID: ${id}" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "ID '$id' was not set on copy" - exit_error - fi - echo ok -} - -# $1: token -# $2: PIN -# $3: cakey: ${srcdir}/pkcs11-certs/ca.key -# $4: cacert: ${srcdir}/pkcs11-certs/ca.crt -# -# Tests writing a certificate which corresponds to the given key, -# and verifies whether the ID is the same. Should utilize the -# ID of the private key. -write_certificate_id_test_ecdsa () { - export GNUTLS_PIN="$2" - token="$1" - cakey="$3" - cacert="$4" - tmpkey="key.$$.tmp" - - echo -n "* Generating ECDSA private key... " - ${CERTTOOL} ${ADDITIONAL_PARAM} --generate-privkey --ecdsa --outfile ${tmpkey} >>"${TMPFILE}" 2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit 1 - fi - - echo -n "* Checking whether right ID is set on copy... " - "${CERTTOOL}" ${CERTTOOL_PARAM} ${ADDITIONAL_PARAM} --generate-certificate --load-ca-privkey "${cakey}" --load-ca-certificate "${cacert}" \ - --template ${srcdir}/pkcs11-certs/client-tmpl --load-privkey ${tmpkey} \ - --outfile tmp-client.crt >>"${TMPFILE}" 2>&1 - - if test $? != 0; then - echo failed - exit_error - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label xxx-ecdsa --load-privkey ${tmpkey} "${token}" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit_error - fi - - id=$(${P11TOOL} ${ADDITIONAL_PARAM} --login --list-all "${token};object=xxx-ecdsa;object-type=private" 2>&1 | grep 'ID: '|sed -e 's/ID://' -e 's/^[ \t]*//' -e 's/[ \t]*$//') - - rm -f ${tmpkey} - ${P11TOOL} ${ADDITIONAL_PARAM} --login --write --label tmp-xxx-ecdsa --load-certificate tmp-client.crt "${token}" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo failed - exit_error - fi - - ${P11TOOL} ${ADDITIONAL_PARAM} --login --list-certs "${token};object=tmp-xxx-ecdsa;object-type=cert" 2>&1 | grep "ID: ${id}" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "ID '$id' was not set on copy" - exit_error - fi - echo ok -} - -test_sign () { - export GNUTLS_PIN="$2" - token="$1" - - echo -n "* Testing signatures using the private key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "failed. Cannot test signatures." - exit_error - fi - echo ok - - echo -n "* Testing RSA-PSS signatures using the private key... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --sign-params rsa-pss --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1 - rc=$? - if test $rc != 0; then - if test $rc = 2; then - echo "failed. RSA-PSS not supported." - else - echo "failed. Cannot test signatures." - exit_error - fi - else - echo ok - fi - - echo -n "* Testing signatures using the private key (with ID)... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};id=%ac%1d%7a%39%cb%72%17%94%66%6c%74%44%73%40%91%44%c0%a0%43%7d" >>"${TMPFILE}" 2>&1 - ${P11TOOL} ${ADDITIONAL_PARAM} --login --test-sign "${token};id=%ac%1d%7a%39%cb%72%17%94%66%6c%74%44%73%40%91%44%c0%a0%43%7d" 2>&1|grep "Verifying against public key in the token..."|grep ok >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "failed. Cannot test signatures with ID." - exit_error - fi - echo ok -} - -# This tests the signing operation as well as the usage of --set-pin -test_sign_set_pin () { - pin="$2" - token="$1" - - unset GNUTLS_PIN - - echo -n "* Testing signatures using the private key and --set-pin... " - ${P11TOOL} ${ADDITIONAL_PARAM} --login --set-pin ${pin} --test-sign "${token};object=serv-key" >>"${TMPFILE}" 2>&1 - if test $? != 0; then - echo "failed. Cannot test signatures." - exit_error - fi - echo ok - - export GNUTLS_PIN=${pin} -} - -# $1: token -# $2: PIN -# $3: certfile -# $4: keyfile -# $5: cafile -# -# Tests using a certificate and key pair using gnutls-serv and gnutls-cli. -use_certificate_test () { - export GNUTLS_PIN="$2" - token="$1" - certfile="$3" - keyfile="$4" - cafile="$5" - txt="$6" - - echo -n "* Using PKCS #11 with gnutls-cli (${txt})... " - # start server - eval "${GETPORT}" - launch_pkcs11_server $$ "${ADDITIONAL_PARAM}" --echo --priority NORMAL --x509certfile="${certfile}" \ - --x509keyfile="$keyfile" --x509cafile="${cafile}" \ - --verify-client-cert --require-client-cert >>"${TMPFILE}" 2>&1 - - PID=$! - wait_server ${PID} - - # connect to server using SC - ${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509cafile="${cafile}" </dev/null >>"${TMPFILE}" 2>&1 && \ - fail ${PID} "Connection should have failed!" - - ${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${certfile}" \ - --x509keyfile="$keyfile" --x509cafile="${cafile}" </dev/null >>"${TMPFILE}" 2>&1 || \ - fail ${PID} "Connection (with files) should have succeeded!" - - ${VALGRIND} "${CLI}" ${ADDITIONAL_PARAM} -p "${PORT}" localhost --priority NORMAL --x509certfile="${token};object=gnutls-client;object-type=cert" \ - --x509keyfile="${token};object=gnutls-client;object-type=private" \ - --x509cafile="${cafile}" </dev/null >>"${TMPFILE}" 2>&1 || \ - fail ${PID} "Connection (with SC) should have succeeded!" - - kill ${PID} - wait - - echo ok -} - - - -echo "Testing PKCS11 support" - -# erase SC - -type="$1" - -if test -z "${type}"; then - echo "usage: $0: [pkcs15|softhsm|sc-hsm]" - if test -x "/usr/bin/softhsm" || test -x "/usr/bin/softhsm2-util"; then - echo "assuming 'softhsm'" - echo "" - type=softhsm - else - exit 1 - fi - -fi - -. "${srcdir}/testpkcs11.${type}" - -export GNUTLS_PIN=12345678 -export GNUTLS_SO_PIN=00000000 - -init_card "${GNUTLS_PIN}" "${GNUTLS_SO_PIN}" - -# find token name -TOKEN=`${P11TOOL} ${ADDITIONAL_PARAM} --list-tokens pkcs11:token=Nikos|grep URL|grep token=GnuTLS-Test|sed 's/\s*URL\: //g'` - -echo "* Token: ${TOKEN}" -if test "x${TOKEN}" = x; then - echo "Could not find generated token" - exit_error -fi - -#write a given privkey -write_privkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/client.key" - -generate_temp_ecc_privkey "${TOKEN}" "${GNUTLS_PIN}" 256 -delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-256 - -generate_temp_ecc_privkey_no_login "${TOKEN}" "${GNUTLS_PIN}" 256 -delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-no-256 - -generate_temp_ecc_privkey "${TOKEN}" "${GNUTLS_PIN}" 384 -delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-384 - -generate_temp_rsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 2048 -delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" rsa-2048 - -generate_temp_dsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 3072 -delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" dsa-3072 - -import_temp_rsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 1024 -delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" rsa-1024 -import_temp_ecc_privkey "${TOKEN}" "${GNUTLS_PIN}" 256 -delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" ecc-256 -import_temp_dsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 2048 -delete_temp_privkey "${TOKEN}" "${GNUTLS_PIN}" dsa-2048 - -generate_rsa_privkey "${TOKEN}" "${GNUTLS_PIN}" 1024 -change_id_of_privkey "${TOKEN}" "${GNUTLS_PIN}" -export_pubkey_of_privkey "${TOKEN}" "${GNUTLS_PIN}" -change_label_of_privkey "${TOKEN}" "${GNUTLS_PIN}" - -write_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" "${srcdir}/pkcs11-certs/ca.crt" tmp-client.pub -write_serv_privkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/server.key" -write_serv_cert "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/server.crt" - -write_serv_pubkey "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/server.crt" -test_sign "${TOKEN}" "${GNUTLS_PIN}" - -use_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${TOKEN};object=serv-cert;object-type=cert" "${TOKEN};object=serv-key;object-type=private" "${srcdir}/pkcs11-certs/ca.crt" "full URLs" - -use_certificate_test "${TOKEN}" "${GNUTLS_PIN}" "${TOKEN};object=serv-cert" "${TOKEN};object=serv-key" "${srcdir}/pkcs11-certs/ca.crt" "abbrv URLs" - -write_certificate_id_test_rsa "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" "${srcdir}/pkcs11-certs/ca.crt" -write_certificate_id_test_rsa2 "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" "${srcdir}/pkcs11-certs/ca.crt" -write_certificate_id_test_ecdsa "${TOKEN}" "${GNUTLS_PIN}" "${srcdir}/pkcs11-certs/ca.key" "${srcdir}/pkcs11-certs/ca.crt" - -test_delete_cert "${TOKEN}" "${GNUTLS_PIN}" - -test_sign_set_pin "${TOKEN}" "${GNUTLS_PIN}" - -if test ${RETCODE} = 0; then - echo "* All smart cards tests succeeded" -fi -rm -f tmp-client.crt tmp-client.pub tmp-client-2.pub "${TMPFILE}" - -exit 0 diff --git a/tests/suite/testpkcs11.softhsm b/tests/suite/testpkcs11.softhsm deleted file mode 100755 index d79a8528ec..0000000000 --- a/tests/suite/testpkcs11.softhsm +++ /dev/null @@ -1,77 +0,0 @@ -#!/bin/sh - -# Copyright (C) 2013 Nikos Mavrogiannopoulos -# -# This file is part of GnuTLS. -# -# GnuTLS is free software; you can redistribute it and/or modify it -# under the terms of the GNU General Public License as published by the -# Free Software Foundation; either version 3 of the License, or (at -# your option) any later version. -# -# GnuTLS is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# You should have received a copy of the GNU General Public License -# along with GnuTLS; if not, write to the Free Software Foundation, -# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - -for i in /usr/lib64/pkcs11 /usr/lib/softhsm /usr/lib/x86_64-linux-gnu/softhsm /usr/lib /usr/lib64/softhsm;do - if test -f "$i/libsofthsm2.so"; then - ADDITIONAL_PARAM="--provider $i/libsofthsm2.so" - break - else - if test -f "$i/libsofthsm.so";then - ADDITIONAL_PARAM="--provider $i/libsofthsm.so" - break - fi - fi -done - -init_card () { - PIN="$1" - PUK="$2" - - if test -x "/usr/bin/softhsm2-util"; then - export SOFTHSM2_CONF="softhsm-testpkcs11.$$.config.tmp" - SOFTHSM_TOOL="/usr/bin/softhsm2-util" - ${SOFTHSM_TOOL} --version|grep "2.0.0" >/dev/null 2>&1 - if test $? = 0; then - echo "softhsm2-util 2.0.0 is broken" - export BROKEN_SOFTHSM2=1 - fi - fi - - if test -x "/usr/bin/softhsm"; then - export SOFTHSM_CONF="softhsm-testpkcs11.$$.config.tmp" - SOFTHSM_TOOL="/usr/bin/softhsm" - fi - - if test -z "${SOFTHSM_TOOL}"; then - echo "Could not find softhsm(2) tool" - exit 77 - fi - - if test -z "${SOFTHSM_CONF}"; then - rm -rf ./softhsm-testpkcs11.$$.tmp - mkdir -p ./softhsm-testpkcs11.$$.tmp - echo "objectstore.backend = file" > "${SOFTHSM2_CONF}" - echo "directories.tokendir = ./softhsm-testpkcs11.$$.tmp" >> "${SOFTHSM2_CONF}" - - else - rm -rf ./softhsm-testpkcs11.$$.tmp - echo "0:./softhsm-testpkcs11.$$.tmp" > "${SOFTHSM_CONF}" - fi - - - echo -n "* Initializing smart card... " - ${SOFTHSM_TOOL} --init-token --slot 0 --label "GnuTLS-Test" --so-pin "${PUK}" --pin "${PIN}" >/dev/null #2>&1 - if test $? = 0; then - echo ok - else - echo failed - exit_error - fi -} |