Spawn only up to MAX_JOBS concurrent jobs. Defer the remaining job until
others have finished. MAX_JOBS defaults to 16, but can be configured at
runtime.
While at it, make the jobs limit for tok2toktest.sh also configurable, with
a default of 16 concurrent jobs. Also use 'wait -n' instead of polling
for jobs to complete.
When configured with the address sanitizer active, limit the number of jobs
to 4 because with ASAN it needs more memory and might run into out-of-memory
situations with too many concurrent jobs.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The ICSF token does not support all attributes used in the object mgmt tests.
Skip the entire test if running against the ICSF token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The ICSF token does not support public sessions. Communicating to an ICSF
server always requires a login (SO or USER). Skip the --no-logon tests.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Discovers all available, initialized tokens and runs tok2tok_transport
for every combination of slots (including same-slot). When multiple
slots carry tokens of the same type/model, only the first one is used
to avoid redundant runs.
Each run is spawned as a background process. Its combined stdout and
stderr are redirected to log-tok2tok-slots_X_Y.txt where X and Y are
the two slot numbers used. Run only up to 4 concurrent jobs to not run
into out-of-memory situations.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
In case the token format is the pre-FIPS format (every other day) then
migrate the token data of the Soft token 'sw0' to the new FIPS format
using the pkcstok_migrate tool after all tests have been run.
Verify that all objects have been migrated successfully.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Enhance the cca_ep11_export_import_test test to also test exporting and
importing of Edwards and Montgomery key blobs for CCA and EP11.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Enhance the ibm_ml_kem as well as the tok2tok_transport test to also
perform the CKM_IBM_ML_KEM_WITH_ECDH mechanism.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Running tests with larger RSA sizes increase the run time dramatically.
Thus, the RSA 8192 bit tests are disabled by default, but can be enabled
by running the test with the '-rsa8k' option.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Also adjust the testcases to support larger RSA keys, i.e. for RSA 8192 bit
keys.
Running tests with larger RSA sizes increase the run time dramatically.
Thus, the RSA 8192 bit tests are disabled by default, but can be enabled
by running the test with the '-rsa8k' option.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Newer GCC versions report errors for string initialization where the
terminating NULL character does not fit into the target variable.
All the fixed places use non-zero-terminated strings, but add an additional
character to make the compiler happy.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Error CKR_PUBLIC_KEY_INVALID may even be returned for public key blob
import, so handle it there as well and skip the test.
Fixes: 04b8ebea77
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Fix the logic to re-get the login authorization ID from SKLM in case the
login token was expired. This can happen if another system concurrently
obtains a login authorization ID from the same server. This revokes all
previously login tokens.
Thus, in case an operation with SKLM returns message CTGKM6004E, a new
login token must be obtained, and the failed key setup step must be repeated
with the new login token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Fix the logic to re-get the login authorization ID from SKLM in case the
login token was expired. This can happen if another system concurrently
obtains a login authorization ID from the same server. This revokes all
previously login tokens.
Thus, in case an operation with SKLM returns message CTGKM6004E, a new
login token must be obtained, and the failed setup step must be repeated
with the new login token.
While at it, make sure that the retry loop terminates in case of unrecoverable
error situations and make sure RC is set in all such cases.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Output lines like '* TESTCASE p11kmip_test <test-name> PASS/FAIL <description>'
that can be processed by the CI's post processor.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The CCA token only supports to derive AES-256 keys. Skip all attempts to
derive different key sizes.
The EC testcase usually derives keys of type CKK_GENERIC_SECRET, to allow
various key sizes. It checks that the derived keys are usable and correct
by performing an HMAC operation with them (if supported by the token).
If the test runs against the CCA token, derive AES-256 keys instead, and
perform an AES encrypt operation with them to test the usability and
correctness.
Known answer tests (KAT) for ECDH are not possible with the CCA token, because
CCA only allows to perform ECDH with randomly generated EC keys, but not
with EC keys imported from clear. However, for KATs, we would need to use
imported keys.
Furthermore, ECC keys imported from clear can not have CKA_DERIVE=TRUE for
the CCA token. Make sure CKA_DERIVE is TRUE only for those cases where it
really is required.
The cca_export_import_test is changed to import an ECC private key blob
with CKA_DERIVE=TRUE. This is safe since it did generate the key blob just
before with the CCA token, so it should have everything that is needed to
support key derivation.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The soft token as well as the EP11 token supports wrapping of IBM Dilithium
keys. The CCA token does not offer a wrapping mechanism that can wrap IBM
Dilithium keys due to the size of the keys.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
When the tok2tok_transport testcase is used and both, the source slot and
the target slot are the same, then skip the C_Login of the target slot,
because it is already logged in.
PKCS#11 does not allow to login the same slot twice, this would result in
CKR_USER_ALREADY_LOGGED_IN. Logging in a session on a token changes the
global login state of that token, which affects all sessions of this
token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
The CCA and EP11 tokens do not support AES-XTS key to be wrapped.
Furthermore, AES-XTS keys require protected key support, which might not
be enabled in the token config files.
AES-XTS keys as wrapping keys are already skipped, because the CKM_AES_XTS
mechanism does not have the CKF_WRAP and CKF_UNWRAP flags set in case of
the CCA or EP11 token.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
