|
| 1 | +#!/bin/bash |
| 2 | + |
| 3 | +# Copyright © 2024 Mobi - Com Polska Sp. z o.o. |
| 4 | +# Author: Małgorzata Olszówka <[email protected]> |
| 5 | +# Copyright (C) 2013 Nikos Mavrogiannopoulos |
| 6 | +# Copyright (C) 2015 Red Hat, Inc. |
| 7 | +# |
| 8 | +# This is free software; you can redistribute it and/or modify it |
| 9 | +# under the terms of the GNU General Public License as published by the |
| 10 | +# Free Software Foundation; either version 3 of the License, or (at |
| 11 | +# your option) any later version. |
| 12 | +# |
| 13 | +# GnuTLS is distributed in the hope that it will be useful, but |
| 14 | +# WITHOUT ANY WARRANTY; without even the implied warranty of |
| 15 | +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| 16 | +# General Public License for more details. |
| 17 | +# |
| 18 | +# You should have received a copy of the GNU General Public License |
| 19 | +# along with GnuTLS; if not, write to the Free Software Foundation, |
| 20 | +# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. |
| 21 | + |
| 22 | +# Uncomment the following line to enable debugging with Valgrind |
| 23 | +# WRAPPER="valgrind -s --track-origins=yes --leak-check=full --show-leak-kinds=all --tool=memcheck --show-reachable=yes --keep-debuginfo=yes" |
| 24 | + |
| 25 | +echo "Current directory: $(pwd)" |
| 26 | +echo "Source directory: ${srcdir}" |
| 27 | +echo "Output directory: ${outdir}" |
| 28 | + |
| 29 | +mkdir -p ${outdir} |
| 30 | + |
| 31 | +for i in /usr/local/lib/softhsm /opt/local/lib/softhsm /usr/lib64/pkcs11 \ |
| 32 | + /usr/lib64/softhsm /usr/lib/x86_64-linux-gnu/softhsm /usr/lib/softhsm /usr/lib; do |
| 33 | + if [[ -f "$i/libsofthsm2.so" ]]; then |
| 34 | + MODULE="$i/libsofthsm2.so" |
| 35 | + break |
| 36 | + else |
| 37 | + if [[ -f "$i/libsofthsm.so" ]]; then |
| 38 | + MODULE="$i/libsofthsm.so" |
| 39 | + break |
| 40 | + fi |
| 41 | + fi |
| 42 | +done |
| 43 | + |
| 44 | +if [[ ! -x /usr/bin/pkcs11-tool && ! -x /usr/local/bin/pkcs11-tool ]]; then |
| 45 | + echo "Skipping test: 'pkcs11-tool' not found. Please install the tool to proceed." |
| 46 | + exit 77 |
| 47 | +fi |
| 48 | + |
| 49 | +# Load openssl settings |
| 50 | +TEMP_LD_LIBRARY_PATH=${LD_LIBRARY_PATH} |
| 51 | +. ${srcdir}/openssl-settings.sh |
| 52 | + |
| 53 | +OPENSSL_VERSION=$(./openssl_version | cut -d ' ' -f 2) |
| 54 | + |
| 55 | +# Restore settings |
| 56 | +export LD_LIBRARY_PATH=${TEMP_LD_LIBRARY_PATH} |
| 57 | + |
| 58 | +LIBCRYPTO_VER=$(ldd "${MODULE}" | grep 'libcrypto' | awk '{print $1}') |
| 59 | +if [[ "$OPENSSL_VERSION" =~ ^0.* || "$OPENSSL_VERSION" =~ ^1\.0.* ]] \ |
| 60 | + && [[ "$LIBCRYPTO_VER" == "libcrypto.so.3" ]]; then |
| 61 | + echo -n "Skipping test: Module '${MODULE}' built with '${LIBCRYPTO_VER}'" |
| 62 | + echo "is incompatible with OpenSSL version '${OPENSSL_VERSION}'." |
| 63 | + exit 77 |
| 64 | +fi |
| 65 | + |
| 66 | +echo "Detected system: ${OSTYPE}" |
| 67 | + |
| 68 | +if [[ ${OSTYPE} == darwin* ]]; then |
| 69 | + SHARED_EXT=.dylib |
| 70 | +else |
| 71 | + SHARED_EXT=.so |
| 72 | +fi |
| 73 | + |
| 74 | + |
| 75 | +sed -e "s|@MODULE_PATH@|${MODULE}|g" -e \ |
| 76 | + "s|@ENGINE_PATH@|../src/.libs/pkcs11${SHARED_EXT}|g" \ |
| 77 | + <"${srcdir}/engines.cnf.in" >"${outdir}/engines.cnf" |
| 78 | + |
| 79 | +# Force the use of the local built engine |
| 80 | +export OPENSSL_ENGINES="../src/.libs/" |
| 81 | +echo "OPENSSL_ENGINES=${OPENSSL_ENGINES}" |
| 82 | + |
| 83 | +# Set the used PIN and PUK |
| 84 | +PIN=1234 |
| 85 | +PUK=1234 |
| 86 | + |
| 87 | +# Set the default object ID for operations |
| 88 | +ID=01020304 |
| 89 | + |
| 90 | +# Initialize the SoftHSM DB |
| 91 | +init_db () { |
| 92 | + if [[ -x "/usr/bin/softhsm" ]]; then |
| 93 | + export SOFTHSM_CONF="$outdir/softhsm-testpkcs11.config" |
| 94 | + SOFTHSM_TOOL="/usr/bin/softhsm" |
| 95 | + SLOT="--slot 0" |
| 96 | + fi |
| 97 | + |
| 98 | + if [[ -x "/usr/local/bin/softhsm2-util" ]]; then |
| 99 | + export SOFTHSM2_CONF="$outdir/softhsm-testpkcs11.config" |
| 100 | + SOFTHSM_TOOL="/usr/local/bin/softhsm2-util" |
| 101 | + SLOT="--free " |
| 102 | + fi |
| 103 | + |
| 104 | + if [[ -x "/opt/local/bin/softhsm2-util" ]]; then |
| 105 | + export SOFTHSM2_CONF="$outdir/softhsm-testpkcs11.config" |
| 106 | + SOFTHSM_TOOL="/opt/local/bin/softhsm2-util" |
| 107 | + SLOT="--free " |
| 108 | + fi |
| 109 | + |
| 110 | + if [[ -x "/usr/bin/softhsm2-util" ]]; then |
| 111 | + export SOFTHSM2_CONF="$outdir/softhsm-testpkcs11.config" |
| 112 | + SOFTHSM_TOOL="/usr/bin/softhsm2-util" |
| 113 | + SLOT="--free " |
| 114 | + fi |
| 115 | + |
| 116 | + if [[ -z ${SOFTHSM_TOOL} ]]; then |
| 117 | + echo "Could not find softhsm(2) tool" |
| 118 | + exit 77 |
| 119 | + fi |
| 120 | + |
| 121 | + if [[ -n ${SOFTHSM2_CONF} ]]; then |
| 122 | + rm -rf $outdir/softhsm-testpkcs11.db |
| 123 | + mkdir -p $outdir/softhsm-testpkcs11.db |
| 124 | + echo "objectstore.backend = file" > "${SOFTHSM2_CONF}" |
| 125 | + echo "directories.tokendir = $outdir/softhsm-testpkcs11.db" >> \ |
| 126 | + ${SOFTHSM2_CONF} |
| 127 | + else |
| 128 | + rm -rf $outdir/softhsm-testpkcs11.db |
| 129 | + echo "0:$outdir/softhsm-testpkcs11.db" > ${SOFTHSM_CONF} |
| 130 | + fi |
| 131 | + echo "SOFTHSM2_CONF=${SOFTHSM2_CONF}" |
| 132 | +} |
| 133 | + |
| 134 | +# Initialize a token in the first available slot |
| 135 | +init_card () { |
| 136 | + local token_label="$1" |
| 137 | + |
| 138 | + echo "***************************************" |
| 139 | + echo -n "* Initializing token ${token_label} ... " |
| 140 | + ${SOFTHSM_TOOL} --init-token ${SLOT} --label ${token_label} \ |
| 141 | + --so-pin ${PUK} --pin ${PIN} >/dev/null |
| 142 | + if [[ $? -eq 0 ]]; then |
| 143 | + echo ok |
| 144 | + else |
| 145 | + echo failed |
| 146 | + exit 1 |
| 147 | + fi |
| 148 | +} |
| 149 | + |
| 150 | +# Delete the token at a given slot |
| 151 | +remove_card () { |
| 152 | + local token_label="$1" |
| 153 | + |
| 154 | + echo "* Removing token ${token_label}" |
| 155 | + ${SOFTHSM_TOOL} --delete-token --token ${token_label} |
| 156 | + if [[ $? -ne 0 ]]; then |
| 157 | + exit 1 |
| 158 | + fi |
| 159 | +} |
| 160 | + |
| 161 | +# Generate an RSA key pair on the token |
| 162 | +generate_rsa_key_pair () { |
| 163 | + local obj_label="$1" |
| 164 | + local token_label="$2" |
| 165 | + |
| 166 | + echo "* Generating an RSA key pair on the token ${token_label}" |
| 167 | + pkcs11-tool --login --pin ${PIN} --module ${MODULE} --id ${ID} \ |
| 168 | + --keypairgen --key-type "rsa:2048" \ |
| 169 | + --label ${obj_label} --token-label ${token_label} |
| 170 | + if [[ $? -ne 0 ]]; then |
| 171 | + exit 1 |
| 172 | + fi |
| 173 | +} |
| 174 | + |
| 175 | +# Do the token initialization |
| 176 | +init_token () { |
| 177 | + local key_type="$1" |
| 178 | + local num_devices="$2" |
| 179 | + local common_label="$3" |
| 180 | + local obj_id="$4" |
| 181 | + local obj_label="$5" |
| 182 | + local i=0 |
| 183 | + |
| 184 | + # Remove the first 5 parameters from the list of arguments |
| 185 | + shift 5 |
| 186 | + |
| 187 | + # Initialize SoftHSM DB |
| 188 | + init_db |
| 189 | + |
| 190 | + while [[ $i -lt ${num_devices} ]]; do |
| 191 | + # Initialize a new device |
| 192 | + init_card "${common_label}-$i" |
| 193 | + |
| 194 | + # Import objects with different labels |
| 195 | + import_objects ${key_type} "${common_label}-$i" ${obj_id} "${obj_label}-$i" "$@" |
| 196 | + |
| 197 | + # List the objects imported into the token |
| 198 | + list_objects "${common_label}-$i" |
| 199 | + |
| 200 | + i=$(($i + 1)) |
| 201 | + done |
| 202 | +} |
| 203 | + |
| 204 | +# Write an object (privkey, pubkey, cert) to the token |
| 205 | +import_objects () { |
| 206 | + local key_type="$1" |
| 207 | + local token_label="$2" |
| 208 | + local obj_id="$3" |
| 209 | + local obj_label="$4" |
| 210 | + |
| 211 | + # Remove the first 4 parameters from the list of arguments |
| 212 | + shift 4 |
| 213 | + |
| 214 | + # Import objects with different labels |
| 215 | + for param in "$@"; do |
| 216 | + if [[ -n "$param" ]]; then |
| 217 | + echo -n "* Importing the ${key_type^^} ${param} object id=${obj_id}" |
| 218 | + echo -n " into the token ${token_label} ... " |
| 219 | + pkcs11-tool --login --pin ${PIN} --module ${MODULE} \ |
| 220 | + --token-label "${token_label}"\ |
| 221 | + --write-object "${srcdir}/${key_type}-${param}.der" \ |
| 222 | + --type ${param} \ |
| 223 | + --id ${obj_id} --label "${obj_label}" >/dev/null |
| 224 | + if [[ $? -eq 0 ]]; then |
| 225 | + echo ok |
| 226 | + else |
| 227 | + echo failed |
| 228 | + exit 1 |
| 229 | + fi |
| 230 | + else |
| 231 | + echo "Skipping empty parameter" |
| 232 | + fi |
| 233 | + done |
| 234 | +} |
| 235 | + |
| 236 | +# Show objects on the token |
| 237 | +list_objects () { |
| 238 | + local token_label="$1" |
| 239 | + |
| 240 | + echo "***************************************" |
| 241 | + echo "* Listing objects on the token ${token_label}" |
| 242 | + echo "***************************************" |
| 243 | + pkcs11-tool --login --pin ${PIN} --module ${MODULE} \ |
| 244 | + --token-label "${token_label}" --list-objects |
| 245 | + if [[ $? -ne 0 ]]; then |
| 246 | + exit 1 |
| 247 | + fi |
| 248 | + echo "***************************************" |
| 249 | +} |
0 commit comments