We must provide a CKA_VALUE_LEN in the key template when unwrapping
AES keys using X.509 RSA mechanism, otherwise there is no way to tell
the size of the key being unwrapped.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
If we fail to create a session, invalidade the session
handler and check that when closing sessions.
Trying to C_CloseSession() on an invalid handle may
segfault the caller.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
On Wed, Nov 10, 2010 at 03:09:03PM -0200, Klaus Heinrich Kiwi wrote:
> OpenCryptoki is not correctly derivating CKA_MODULUS_BITS when
> creating an object with C_ObjectCreate(). This value must be
> derivated from CKA_MODULUS which is a required attribute for
> C_ObjectCreate() when dealing with RSA Public Keys.
>
> The most obvios symptom is a CKR_FUNCTION_FAILED for the
> C_VerifyRecover() function when using NSS to create a
> self-signed certificate (NSS tries to import the public
> key into a session object using C_ObjectCreate())
Looks good to me, Klaus. template_attribute_find will correctly
return 0 when the base template passed in is NULL, so that should be
safe.
I noticed that the rsa_keygen test tries that validate that
CKR_FUNCTION_FAILED is returned when an even RSA public exponent is
passed in. That test now fails, did that check change recently?
Attached is an updated rsa_keygen.c that tests the stuff in this
patch.
Acked-by: Kent Yoder <key@linux.vnet.ibm.com>
testsuite_notice() should be more appropriate in this case, but
this file needs refactoring anyway.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
The script loads synthethic RSA, AES and SYM keys in a CCA
card.
Warning: This *will* replace you card keys with insecure
version only aimed for testing!
Do NOT use those keys for production purposes.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
The header file for MD2 has disappeared in openssl-1.0, breaking the
build when it hits rsa_sign_test. It looks like MD2 is fairly
irrelevant -- all but 2 of the tokens define NOMD2 explicitly, the other
2 don't use it and should probably define NOMD2 themselves. This patch
just removes the MD2 portion of rsa_sign_test so that the test can
build.
Kent
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Klaus, attached is an addition to the misc_func.c driver testcase to
test extractable and sesitive secret keys. It shows that Matteo's patch
does fix the issue. Private keys will still need to be tested.
Kent
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Make pkcsconf errors non-fatal when querying the token type,
so that the testsuite can continue with the other tokens
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
Introduce testcase_[pass|fail|skip|error] macros to be used
across the testsuite and thus standardize testcases format and
output.
The macros will also try to time the operation execution, now
with microsecond resolution.
I've also provided testcase_*_f alternatives for cases where
we need to manually identify the test (instead of just using
__func__).
This patch also "converts" obj_mgmt.c tests to use the new
macros.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
Create a special category for 'benchmarks' test, and don't run
them by default unless we are told to.
Also some really minor cosmetic changes to the ock_test.sh script
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
Make the ock_tests.sh script more resilient by skipping tokens
which failed to initialize.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
This patch will look for the PKCS11_TEST_USER environemnt variable and if set, will run the testsuite as that user instead of root. If the env var is missing, the tests are run as root.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/Makefile.am | 6 +++++-
1 files changed, 5 insertions(+), 1 deletions(-)
Update digest_func.c to test SHA256 and SHA512 HMAC algorithms. The
patch also adds the p11_get_ckm() function to the new p11util.c file,
which converts a CK_ULONG mechanism into a string.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/digest_func.c | 3215 +++++++++++----------------------------
usr/lib/pkcs11/common/p11util.c | 194 +++
usr/lib/pkcs11/common/p11util.h | 5 +
3 files changed, 1055 insertions(+), 2359 deletions(-)
This patch makes 3 minor functional fixes:
testcases/common/common.c:
Print hexdumps to stderr instead of stdout, since most uses of hex dumps in the testcases are to show a mismatch when a test fails.
testcases/driver/des_func.c:
Fix a bad check on a return code
testcases/driver/md5.c:
add a real prototype to the Transform function
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Opencryptoki has a number of places which use misc pkcs#11 utility
functions.
This patch creates p11util.c which to start consolidating those
functions in one place.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/ssl3_func.c | 182 +++++++++++++++++++++---------------------
1 files changed, 92 insertions(+), 90 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/sess_perf.c | 23 ++++++++++++-----------
1 files changed, 12 insertions(+), 11 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/sess_mgmt.c | 414 +++++++++++++++++++++---------------------
1 files changed, 208 insertions(+), 206 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/rsa_func.c | 442 ++++++++++++++++++++++---------------------
1 files changed, 223 insertions(+), 219 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/rijndael_func.c | 194 +++++++++++++++++++-------------------
1 files changed, 98 insertions(+), 96 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/obj_mgmt.c | 440 ++++++++++++++++++++++---------------------
1 files changed, 226 insertions(+), 214 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/misc_func.c | 388 +++++++++++++++++++++---------------------
1 files changed, 195 insertions(+), 193 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/dsa_func.c | 96 +++++++++++++++++++++----------------------
1 files changed, 47 insertions(+), 49 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/digest_func.c | 959 ++++++++++++++++++++--------------------
1 files changed, 481 insertions(+), 478 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/dh_func.c | 103 ++++++++++++++++++++++---------------------
1 files changed, 53 insertions(+), 50 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/des_func.c | 474 ++++++++++++++++++++++---------------------
1 files changed, 238 insertions(+), 236 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/des3_func.c | 450 +++++++++++++++++++++---------------------
1 files changed, 226 insertions(+), 224 deletions(-)
- fix compile warnings generated by -Wall
- always return a non-zero error code to the command line on test error
- use a macro to send output to stderr when appropriate
- print file/line numbers for any failures
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/aes_func.c | 463 ++++++++++++++++++++++---------------------
1 files changed, 237 insertions(+), 226 deletions(-)
Add -Wall to the compile of the driver/ testcases.
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/driver/Makefile.am | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
This patch fixes a loop variable name, which prevented printing the name of the test being executed.
Thanks,
Kent
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
testcases/ock_tests.sh.in | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
Hopefully make ock_tests.sh more resilient.
Also introduces a init_tpmtoken.sh script that is used
to initialize the TPM token.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
This patch makes the show_error() function used by the testcases a macro, then adds printing of a file and line number wherever its called. This patch also changes the file descriptor these strings print to from stdout to stderr. This will make finding errors in automated test runs easier.
Thanks,
Kent
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
This patch modifies testcases/oc-digest/digest_test.sh as needed to run as part of the automated tests and adds it to the list of tests to run in ock_tests.sh.in.
Changes to digest_test.sh:
o respect the -nostop flag on the command line
o use the path to the oc-digest executable as needed by make installcheck
o couple of formatting chages (sorry)
Changes to ock_tests.sh.in:
o add oc-digest/digest_tests.sh to the list of test to run
o use 'ls -U' to preserve test ordering in the list
Thanks,
Kent
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
This patch adds testcases/oc-digest/digest_test.sh, which gives a flexible way to test new digests against opencryptoki. It also modifies testcases/oc-digest.c to return a non-zero return code to the command line when it fails. This enables the script to detect when opencryptoki doesn't support a specific digest on the slot being tested.
The script:
1. Checks that the algorithm is supported in the slot being tested
2. Generates (from /dev/urandom) a set of files to test based on the block size of the supported algorithm
3. Hashes those files using oc-digest and validates the output
4. Deletes the test files
This initial version of the script supports testing md5, sha1, sha256, sha384 and sha512.
Thanks,
Kent
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
This patch enables the make installcheck target to do an automated test run against opencryptoki. In order to make installcheck you must be root, and make will fail if the token is already initialized. To allow a test run to succeed for a $TOKEN, you need to first run rm -rf @localstatedir@/opencryptoki/$TOKEN/*. Requiring this ensures that a user cannot blow away an in-use token accidentally. make installcheck will kill a running pkcsslotd.
This patch modifies
- testcases/Makefile.am
o add the installcheck target
o pre-process init_token.sh.in
- testcases/init_token.sh -> testcases/init_token.sh.in
- testcases/init_token.sh.in
o have the build fill-in the full path to pkcsconf
o return an error code to the command line if pkcsconf fails
- testcases/ock_tests.sh.in:
o put a list of tests to run at the top
o process spaces in the output of $PKCONF parsing
o call init_token.sh for each slot we test and fail if it fails
Thanks,
Kent
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Hi Klaus,
While running sess_perf.c, I routinely got CKR_BUFFER_TOO_SMALL as the test
called encrypt_DATA during its run.
I believe this patch fixes the issue, which is that an uninitialized outlen
parameter was being passed into C_EncryptUpdate and C_EncryptFile. I also
added a return code value from main in this patch.
Please consider for inclusion in opencryptoki-next.
Thanks,
Kent
Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
This avoids interating through a list of objects attached to
some particular process every time the object is needed.
As previous commits did with session object, this commit applies to
object handles. This MAY cause segfaults if the caller application
passes invalid handles, but this is often caused by buggy applications.
Also remote tests with invalid object handlers from obj_mgmt.c
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
To avoid iterating through the API Session list Anchor->SessListBeg
every time we need a session reference, use the session's own
pointer as handle.
This change MAY introduce segfaults if the caller application
passes invalid session handlers that cannot be directly dereferenced,
but that usually only means that the application is buggy and needs
fixing.
Also removes tests with invalid session handlers from obj_mgmt.c
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
New testcase (derived from sess_obj.c) aimed at benchmarking
opencryptoki's performance under a high number of open sessions.
This test should be relatively long running (about 1 hour
each run). It measures the time it takes to perform two
encryption operations for various counts of currently open
sessions.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
This patch removes moves ock_tests.sh to ock_tests.sh.in in
order to have it processed at build time. Time allow us to
use the pathnames used by the overall build process.
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
ock_tests.sh is currently with always-on logging (due to a typo in
"if [ "$LOGGING"="1" ]".
Fix that behavior and also make every output either go to the log or to
the stdout (by enclosing the script with a function that can have it's
output redirected)
Signed-off-by: Klaus Heinrich Kiwi <klausk@linux.vnet.ibm.com>
