diff --git a/cmake/Modules/Findkryoptic.cmake b/cmake/Modules/Findkryoptic.cmake new file mode 100644 index 00000000..02615f4b --- /dev/null +++ b/cmake/Modules/Findkryoptic.cmake @@ -0,0 +1,38 @@ +# - Try to find kryoptic +# Once done this will define +# +# KRYOPTIC_FOUND - system has kryoptic +# KRYOPTIC_LIBRARIES - Link these to use kryoptic +# +#============================================================================= +# Copyright (c) 2026 Pavol Žáčik +# +# Distributed under the OSI-approved BSD License (the "License"); +# see accompanying file Copyright.txt for details. +# +# This software is distributed WITHOUT ANY WARRANTY; without even the +# implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. +# See the License for more information. +#============================================================================= +# + + +find_library(KRYOPTIC_LIBRARY + NAMES + kryoptic_pkcs11 + PATH_SUFFIXES + pkcs11 +) + +if (KRYOPTIC_LIBRARY) + set(KRYOPTIC_LIBRARIES + ${KRYOPTIC_LIBRARIES} + ${KRYOPTIC_LIBRARY} + ) +endif (KRYOPTIC_LIBRARY) + +include(FindPackageHandleStandardArgs) +find_package_handle_standard_args(kryoptic DEFAULT_MSG KRYOPTIC_LIBRARIES) + +# show the KRYOPTIC_LIBRARIES variable only in the advanced view +mark_as_advanced(KRYOPTIC_LIBRARIES) diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt index 3ee0a380..1b928bd5 100644 --- a/tests/CMakeLists.txt +++ b/tests/CMakeLists.txt @@ -282,17 +282,22 @@ find_program(SSHD_EXECUTABLE /usr/local/sbin) if (WITH_PKCS11_URI) + find_package(kryoptic) find_package(softhsm) - if (NOT SOFTHSM_FOUND) - message(SEND_ERROR "Could not find softhsm module!") - endif (NOT SOFTHSM_FOUND) + if (KRYOPTIC_FOUND) + set(SOFT_TOKEN_MODULE ${KRYOPTIC_LIBRARY}) + elseif(SOFTHSM_FOUND) + set(SOFT_TOKEN_MODULE ${SOFTHSM2_LIBRARY}) + else() + message(SEND_ERROR "Could not find any PKCS#11 soft token module!") + endif () find_library(PKCS11SPY NAMES pkcs11-spy.so ) #Copy the script to setup PKCS11 tokens - file(COPY pkcs11/setup-softhsm-tokens.sh DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/pkcs11 FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE) + file(COPY pkcs11/setup-soft-tokens.sh DESTINATION ${CMAKE_CURRENT_BINARY_DIR}/pkcs11 FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE) endif (WITH_PKCS11_URI) if (CLIENT_TESTING OR SERVER_TESTING) diff --git a/tests/pkcs11/setup-soft-tokens.sh b/tests/pkcs11/setup-soft-tokens.sh new file mode 100644 index 00000000..48d577e6 --- /dev/null +++ b/tests/pkcs11/setup-soft-tokens.sh @@ -0,0 +1,113 @@ +#!/bin/bash + +# The client keys are stored in a soft token. + +TESTDIR=$1 +PRIVKEY=$2 +OBJNAME=$3 +TOKENLABEL=$3 # yeah. The same as object label +LOADPUBLIC=$4 +SOFT_TOKEN_MODULE=$5 +shift 5 + +PUBKEY="$PRIVKEY.pub" + +echo "TESTDIR: $TESTDIR" +echo "PRIVKEY: $PRIVKEY" +echo "PUBKEY: $PUBKEY" +echo "OBJNAME: $OBJNAME" +echo "TOKENLABEL: $TOKENLABEL" +echo "LOADPUBLIC: $LOADPUBLIC" +echo "SOFT_TOKEN_MODULE: $SOFT_TOKEN_MODULE" + +if echo "$SOFT_TOKEN_MODULE" | grep -q "kryoptic"; then + export KRYOPTIC_CONF="$TESTDIR/kryoptic.conf" + if [ ! -f "$KRYOPTIC_CONF" ]; then + touch "$KRYOPTIC_CONF" + fi + # Kryoptic does not auto-create slots, so count existing ones in config to find the next free one + FREE_SLOT=$(grep -c '^\[\[slots\]\]' "$KRYOPTIC_CONF") + cat >>"$KRYOPTIC_CONF" <"$SOFTHSM2_CONF" </dev/null | awk '/Slot [0-9][0-9]*/{slot=$2} /uninitialized/{print slot; exit}') + cat "$SOFTHSM2_CONF" +else + echo "Unknown PKCS#11 soft token module: $SOFT_TOKEN_MODULE" + exit 1 +fi + +#init -- each object will have its own token +cmd="pkcs11-tool --module $SOFT_TOKEN_MODULE --init-token --slot-index $FREE_SLOT --label $TOKENLABEL --init-pin --pin 1234 --so-pin 1234" +eval echo "$cmd" +out=$(eval "$cmd") +ret=$? +if [ $ret -ne 0 ]; then + echo "Init token failed" + echo "$out" + exit 1 +fi + +#load private key +cmd="p11tool --provider $SOFT_TOKEN_MODULE --write --load-privkey $PRIVKEY --label $OBJNAME --login --set-pin=1234 \"pkcs11:token=$TOKENLABEL\"" +eval echo "$cmd" +out=$(eval "$cmd") +ret=$? +if [ $ret -ne 0 ]; then + echo "Loading privkey failed" + echo "$out" + exit 1 +fi + +cat "$PUBKEY" + +ls -l "$TESTDIR" + +if [ "$LOADPUBLIC" -ne 0 ]; then +#load public key + cmd="p11tool --provider $SOFT_TOKEN_MODULE --write --load-pubkey $PUBKEY --label $OBJNAME --login --set-pin=1234 \"pkcs11:token=$TOKENLABEL\"" + eval echo "$cmd" + out=$(eval "$cmd") + ret=$? + if [ $ret -ne 0 ]; then + echo "Loading pubkey failed" + echo "$out" + exit 1 + fi +fi + +cmd="p11tool --list-all --login \"pkcs11:token=$TOKENLABEL\" --set-pin=1234" +eval echo "$cmd" +out=$(eval "$cmd") +ret=$? +if [ $ret -ne 0 ]; then + echo "Logging in failed" + echo "$out" + exit 1 +fi +echo "$out" + +pkcs11-tool -M --login --pin=1234 --module="$SOFT_TOKEN_MODULE" --token-label="$TOKENLABEL" + +exit 0 diff --git a/tests/pkcs11/setup-softhsm-tokens.sh b/tests/pkcs11/setup-softhsm-tokens.sh deleted file mode 100755 index ddc684a0..00000000 --- a/tests/pkcs11/setup-softhsm-tokens.sh +++ /dev/null @@ -1,93 +0,0 @@ -#!/bin/bash - -# The client keys are stored in a SoftHSM device. - -TESTDIR=$1 -PRIVKEY=$2 -OBJNAME=$3 -TOKENLABEL=$3 # yeah. The same as object label -LOADPUBLIC=$4 -LIBSOFTHSM_PATH=$5 -shift 5 - -PUBKEY="$PRIVKEY.pub" - -echo "TESTDIR: $TESTDIR" -echo "PRIVKEY: $PRIVKEY" -echo "PUBKEY: $PUBKEY" -echo "OBJNAME: $OBJNAME" -echo "TOKENLABEL: $TOKENLABEL" -echo "LOADPUBLIC: $LOADPUBLIC" - -if [ ! -d "$TESTDIR/db" ]; then - # Create temporary directory for tokens - install -d -m 0755 "$TESTDIR/db" - - # Create SoftHSM configuration file - cat >"$TESTDIR/softhsm.conf" <>> pkcs11-spy not found\n"); @@ -1742,6 +1742,9 @@ void torture_setup_tokens(const char *temp_dir, } #endif /* WITH_PKCS11_PROVIDER */ + snprintf(conf_path, sizeof(conf_path), "%s/kryoptic.conf", temp_dir); + setenv("KRYOPTIC_CONF", conf_path, 1); + snprintf(conf_path, sizeof(conf_path), "%s/softhsm.conf", temp_dir); setenv("SOFTHSM2_CONF", conf_path, 1); } @@ -1749,6 +1752,7 @@ void torture_setup_tokens(const char *temp_dir, void torture_cleanup_tokens(const char *temp_dir) { unsetenv("SOFTHSM2_CONF"); + unsetenv("KRYOPTIC_CONF"); } #endif /* WITH_PKCS11_URI */