Running 'make ci-installcheck' (or 'make installcheck') produces several
log files that contain the detail testcase output. Let 'make ci-cleanup'
also remove these log files.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Running 'make ci-installcheck' (or also just 'make installcheck') runs
many tests, but does not set the exit code in case a test fails. This is
because the make target should continue to run further tests, even if one
fails. Setting the exit code on a single failure would stop the make target.
In the CI a post processor script scans the log files to determine if any
tests failed. The ci-check-results make target performs the same kind of
check. It can be used right after 'make ci-installcheck' or 'make
installcheck'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Spawn only up to MAX_JOBS concurrent jobs. Defer the remaining job until
others have finished. MAX_JOBS defaults to 16, but can be configured at
runtime.
While at it, make the jobs limit for tok2toktest.sh also configurable, with
a default of 16 concurrent jobs. Also use 'wait -n' instead of polling
for jobs to complete.
When configured with the address sanitizer active, limit the number of jobs
to 4 because with ASAN it needs more memory and might run into out-of-memory
situations with too many concurrent jobs.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The ciconfig.sh script creates a new opencryptoki.conf. Backup the existing
one as '.opencryptoki.conf.ci-backup' before overwriting it. If the backup
file already exists, don't overwrite it.
During 'make ci-cleanup' restore the original opencryptoki.conf, if the
backup file '.opencryptoki.conf.ci-backup' exists.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
When OCK_CI_REUSE_TOKENS is set to a non-empty value, the existing
opencryptoki.conf is left untouched and only uninitialized slots are
initialized. This lets callers reuse a previously configured token
setup instead of destroying it. By default (OCK_CI_REUSE_TOKENS
unset) the original behavior is preserved: ciconfig.sh regenerates
the full slot configuration from scratch.
Slot number and datastore used by the soft-token-based test scripts_
When OCK_CI_REUSE_TOKENS is set, callers may override these via
OCK_CI_SWTOK_SLOT (default: 30)
OCK_CI_SWTOK_DATASTORE (default: $(localstatedir)/lib/opencryptoki/sw0)
So to run it with the default token setup use:
OCK_CI_REUSE_TOKENS=1 OCK_CI_SWTOK_SLOT=3 \
OCK_CI_SWTOK_DATASTORE=/usr/local/var/lib/opencryptoki/swtok \
make ci-installcheck
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Discovers all available, initialized tokens and runs tok2tok_transport
for every combination of slots (including same-slot). When multiple
slots carry tokens of the same type/model, only the first one is used
to avoid redundant runs.
Each run is spawned as a background process. Its combined stdout and
stderr are redirected to log-tok2tok-slots_X_Y.txt where X and Y are
the two slot numbers used. Run only up to 4 concurrent jobs to not run
into out-of-memory situations.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
- Pass slot 30 to p11kmip_test.sh, don't rely on the default
- Run 'pkcsep11_session status' during ci-prepare and c-cleanup
- Run 'pkcshsm_mk_change list' before running the tests
- White-space updates
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
In case the token format is the pre-FIPS format (every other day) then
migrate the token data of the Soft token 'sw0' to the new FIPS format
using the pkcstok_migrate tool after all tests have been run.
Verify that all objects have been migrated successfully.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The 'su' command needs adjustments due to the strict syntax parsing change
introduced in util-linux 2.42, which is for example included in Fedora 44.
Previously, 'su' used loose POSIX argument permutation, meaning it would
look for options anywhere in the command string, even if placed after the
target user name. Starting with util-linux 2.42, 'su' explicitly stops
interpreting any flags or options placed after the target user name.
Instead, it treats everything trailing the user name as plain arguments
passed directly to that target user's default login shell.
Adjust the 'su' command invocation to place any flags before the user name.
Otherwise the -s and -c options would be passed to the user's default login
shell, where these flags don't work.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
If token initialization fails (e.g. due to a timeout in the 'expect' script),
fail the 'make ci-installcheck' entirely. Not failing here will leave the
tokens uninitialized, and subsequent tests running against the token will
each fail with CKR_USER_PIN_NOT_INITIALIZED, CKR_USER_NOT_LOGGED_IN, or
similar.
Also increase the 'expect' timeout from the default (10 seconds) to 30 seconds,
to give the pkcsconf tool more time to produce the expected output.
Furthermore, clearly show if a timeout has happen.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
This tool may be used to export AES secret keys from a PKCS#11 token repository to a KMIP
server by wrapping them under a shared RSA key pair. This tool may also import AES secret
keys from a KMIP server to a PKCS#11 token repository using the same method.
Signed-off-by: John Craig <john.craig@ibm.com>
These changes use AIX-specific utilities where available, and skip some that
have no AIX-equivalent (e.g. ldconfig). All of these changes are protected by
a platform-specific define, so they do not affect functioning on Linux.
None of the default Linux functionality has been altered; it will continue to
be built as before.
Because AIX does not have Linux's `killall` (or at least one that does the same
thing), this behaviour has also been wrapped into a variable whose value is
determined by the detected platform, passed down by autoconf. On AIX, it
resolves to a simpler shell script that recreates its behaviour, whereas on
Linux it resolves to the standard `killall` utility.
AIX does not have the luxury of the convenient library search path that Linux
enjoys with ldconfig. Any search path modification _must_ be done with changes
to `LIBPATH` envar, which is clunky and will not be accepted by customers.
So we do the next best thing possible - encode the library search paths
directly into the binary with the `-blibpath` linker flag. This ensures all
binaries can find their required libraries without needing any tweaks to the
`LIBPATH` variable at runtime.
The downside of this is that ANY third-party utility that makes use of
opencryptoki will need to use this flag during its compilation, otherwise
it will be unable to find the libraries it needs at runtime.
The libpath changes are all contained within their individual makefiles.
Signed-off-by: Akash Kulhalli <akash.kulhalli@ibm.com>
A new parameter -combined-extract is introduced for the testcases. If this
parameter is specified, the CKA_IBM_PROTKEY_EXTRACTABLE attribute is always
set to TRUE for new key objects. Note that testcases will fail if combined
extract is not supported in the test environment! In addition to this, a
new token setup is added to ciconfig.sh to enable combined extract tests
in the CI.
Signed-off-by: Joerg Schmidbauer <jschmidb@de.ibm.com>
With the '--so' option, p11sak opens a R/W SO session.
As per PKCS#11 standard, there is no R/O SO session, so always open
a R/W session if SO logs in.
Option '-p'/'--pin' must specify the SO pin, or if the '-p'/'--pin' option
is not specified, environment variable PKCS11_SO_PIN is used.
If PKCS11_SO_PIN is not set, then the user is prompted for the SO PIN.
SO can only access public token objects (CKA_PRIVATE=FALSE) as per PKCS#11
standard.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Allow to specify the pkcsslotd user and the pkcs11 group during
configuration.
Use '--with-pkcsslotd-user=USER' and/or '--with-pkcs-group=GROUP'
to specify the user and group name. The defaults are 'pkcsslotd'
and 'pkcs11'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Create the unix sockets and the PID file in /run/opencryptoki, and make
sure the /run/opencryptoki directory as well as the lock and log directories
are created during 'make install' as well as during system startup via
tmpfiles.d. Since the /run directory usually is within a tmpfs file system,
it won't exist after a system restart otherwise.
Also make the /run/opencryptoki directory be owned by the 'pkcsslotd' user
and the 'pkcs11' group, and only writable by the 'pkcsslotd' user.
That way, pkcsslotd can only be started by the 'pkcsslotd' user (or root).
Nevertheless, members of the 'pkcs11' group can still connect to the sockets,
and thus can still communicate with pkcsslotd.
The 'pkcsslotd' user is created (if not already existent) during 'make install'
and RPM installation, together with the 'pkcs11' group.
When the pkcsslotd is started as 'root', change its uid to 'pkcsslotd' to drop
privileges and capabilities. Any capabilities set on the executable file
are retained, regardless if started as root or as pkcsslotd user.
If started as root, pkcsslotd can create any missing base directories, otherwise
an error is reported. It is expected that the base directories have been created
during package installation and/or tmpfiles.d prior to starting pkcsslotd.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Add utility functions to serialize and de-serialize master key operation
state information, and allow to store and load them to/from files.
These functions will be used by the pkcshsm_mk_change tool, as well
as by tokens supporting concurrent master key changes.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The opencryptoki pkgconfig file opencryptoki.pc.in is similar to the other
files currently residing in the misc directory, such as the systemd service
unit file pkcsslotd.service.in, the init.d script pkcsslotd.in, and the
tmpfiles.d config file tmpfiles.conf.in. So lets move it there.
opencryptoki.pc is built from opencryptoki.pc.in via AC_CONFIG_FILES
in configure.ac, so no need to include it into DISTCLEANFILES explicitly,
it will be cleaned with 'make distclean' automatically.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Install opencryptoki.conf (which is built from misc/tmpfiles.conf.in)
right into /usr/lib/tmpfiles.d/.
Currently, misc/tmpfiles.conf is built from misc/tmpfiles.conf.in and is
then installed into /lib/systemd/system/ together with the systemd-service
unit file. Afterwards Makefile.am installs misc/tmpfiles.conf as
opencryptoki.conf into /usr/lib/tmpfiles.d/ and attempts to remove the
unnecessary copy from /lib/systemd/system/.
This is error prone, since there could have already been a file called
tmpfiles.conf (owned by another package) in /lib/systemd/system/ which
was now overwritten.
Use tmpfiles_DATA and tmpfilesdir in misc.mk instead to install it into
the right place right away, without possibly tampering any existing
files in /lib/systemd/system/.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Ensure the pkcs11 group exists before attempting to install files
that are supposed to be owned by the pkcs11 group.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Commit 0ff9791600 ("testcases: misc: add pkcsconf URI tests") introduced
the usage of bash-commands in ci-installcheck target. Replace these bash
commands and call both tests in the same shell context.
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
The maintainer-clean target should remove all files, which are generated
by autoconf/automake. Complete the list of files for removal.
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Configure one CCA token and one EP11 token with the expected
master/wrapping key verification patterns that are used in the CI.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
To allow the user to specify the expected CCA master key verification
patterns, a new CCA specific configuration file is introduced.
For backward compatibility, the configuration file is optional.
The name of the configuration file can be specified via keyword
'confname' in opencryptoki.conf for a CCA token. This can either be
an absolute path, or a relative file name. For a relative file name,
the configuration file must exist in opencryptoki's configuration
directory, i.e. /etc/opencryptoki/.
The CCA token configuration file looks like this:
version cca-0
EXPECTED_MKVPS
{
SYM = "<SYM mkvp as 8 bytes hex string>"
AES = "<AES mkvp as 8 bytes hex string>"
APKA = "<APKA mkvp as 8 bytes hex string>"
}
The specification of the EXPECTED_MKVPS structure is optional, also each
of the 3 master key verification patterns are optional. Each master key
verification pattern must be specified as an 16 character hex string
(8 bytes).
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
This is done to simplify the code and also prepare for any further code that
relies on strength definitions.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
These files will also be installed automatically via autotools into the
correct doc folder (typically /usr/share/doc/opencryptoki).
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Add a single source mechanism table to be used by policy and other code. This
should remove the various tables and switches over mechanisms in the code and
provide a common way to translate between numeric and string representation.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
When at least one test run by ock_tests.sh fails, exit with non-zero
return code to allow the caller to easily detect test failures.
That way travis will safely flag the check to be failed, if one or more
testcases fail.
For 'make [ci-]installcheck' we ignore the return code from ock_tests.sh
since there the error indication can be retrieved from the output.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Target ci-installcheck stopped the pkcsslotd, so restart it before
running cleanup_vhsm.exp and stop it afterwards.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Pass the user supplied user/SO pin and VHSM pin (if supplied) to init_token.sh
and init_vhsm.exp to setup the tokens with the user supplied pins.
If the user supplies no pins, the default testcase pins are used.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Allow to cleanup left over EP11 sessions for CI runs via
'make ci-cleanup'. This is to be called by the CI after
'make ci-installcheck'.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Initializing 12 tokens in parallel causes some random bugs in our CI. To
prevent these, initialize the tokens in sequence such that in the log output
the errors and commands can be identified without interleaving of other
commands and stray newline characters.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
With the addition of lots of slots to our CI the initialization of slots ran
into timeouts in the expect scripts. Unfortunately these errors were ignored
(expect standard action) which caused uninitialized slots to be tested.
Remove the 5 second timeout in preference of the default 10 seconds and treat
timeout errors in the expect script.
Also provide a cleanup target for the CI that correctly removes all token data
such that the next run starts from a clean state.
Do not attempt to reinitialize slot 42 if it is already initialized.
Switch slot 45 to use PKEYs since the default and disabled setting currently
cover the same code paths.
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
Change our CI code such that we test more paths. For every token we now test
multi tenant support by instantiating at least two tokens. New token naming
scheme for the CI is:
Token numbers: <typenum><count>
where <typename> is
ICA: 1
CCA: 2
SW: 3
EP11: 4
For all except EP11 we have as tokname the lowercase type followed by a
0-based count (similar to token numbers). For EP11 the token is called "ep"
followed by the 0-based count. Furthermore, for EP11 the token configuration
file differs between the tokens:
0: Default with only APQN_ANY
1: FORCE_SENSITIVE and APQN_ANY
2: STRICT_MODE, VHSM_MODE, and APQN_ANY
3: OPTIMIZE_SINGLE_OPERATIONS and APQN_ANY
4: DIGEST_LIBICA OFF and APQN_ANY
5: PKEY_MODE DISABLED and APQN_ANY
6: AQPN_WHITELIST selecting the latest CEXP as defined in testcaes/ciconfig.sh
variable LATESTCEXP
Note the count 6 for EP11 is only generated if a corresponding card is found
on the machine. Otherwise this slot will be skipped.
Preparation for the CI is built into the makefile. The current implementation
does not allow for parallel make since then preparation and the installcheck
would run in parallel. But this is not a problem since the installcheck
itself is already highly parallelized (one process per slot to test running in
parallel).
Signed-off-by: Juergen Christ <jchrist@linux.ibm.com>
