Skip to content

Commit b025351

Browse files
olszomalmtrojnar
olszomal
authored and
mtrojnar
committed
Improved provider tests
1 parent b17c515 commit b025351

File tree

7 files changed

+257
-2
lines changed

7 files changed

+257
-2
lines changed

‎tests/Makefile.am‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ check_PROGRAMS = \
2626
store-cert \
2727
store-cert-prov \
2828
dup-key \
29-
dup-key-prov
29+
dup-key-prov \
30+
check-all-prov
3031
dist_check_SCRIPTS = \
3132
rsa-testpkcs11.softhsm \
3233
rsa-testfork.softhsm \
@@ -49,8 +50,10 @@ dist_check_SCRIPTS = \
4950
provider-rsa-pss-sign.softhsm \
5051
provider-rsa-oaep.softhsm \
5152
provider-rsa-check-privkey.softhsm \
53+
provider-rsa-check-all.softhsm \
5254
provider-ec-evp-sign.softhsm \
5355
provider-ec-check-privkey.softhsm \
56+
provider-ec-check-all.softhsm \
5457
provider-ec-cert-store.softhsm \
5558
provider-ec-copy.softhsm \
5659
provider-fork-change-slot.softhsm \
@@ -68,6 +71,7 @@ check_privkey_prov_SOURCES = check-privkey-prov.c helpers_prov.c
6871
rsa_pss_sign_prov_SOURCES = rsa-pss-sign-prov.c helpers_prov.c
6972
rsa_oaep_prov_SOURCES = rsa-oaep-prov.c helpers_prov.c
7073
store_cert_prov_SOURCES = store-cert-prov.c helpers_prov.c
74+
check_all_prov_SOURCES = check-all-prov.c helpers_prov.c
7175

7276
TESTS = $(dist_check_SCRIPTS)
7377

‎tests/check-all-prov.c‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
/*
2+
* Copyright © 2025 Mobi - Com Polska Sp. z o.o.
3+
* Author: Małgorzata Olszówka <[email protected]>
4+
* All rights reserved.
5+
*
6+
* PKCS#11 provider test
7+
*
8+
* Redistribution and use in source and binary forms, with or without
9+
* modification, are permitted provided that the following conditions
10+
* are met:
11+
* 1. Redistributions of source code must retain the above copyright
12+
* notice, this list of conditions and the following disclaimer.
13+
* 2. Redistributions in binary form must reproduce the above copyright
14+
* notice, this list of conditions and the following disclaimer in the
15+
* documentation and/or other materials provided with the distribution.
16+
*
17+
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18+
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19+
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20+
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21+
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22+
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23+
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24+
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25+
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26+
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27+
* SUCH DAMAGE.
28+
*/
29+
30+
#include "helpers_prov.h"
31+
32+
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
33+
34+
int main(int argc, char *argv[])
35+
{
36+
OBJ_SET *obj_set;
37+
int ret = EXIT_FAILURE;
38+
39+
if (argc < 1) {
40+
fprintf(stderr, "usage: %s [object URL]\n", argv[0]);
41+
return ret;
42+
}
43+
44+
obj_set = OPENSSL_zalloc(sizeof(OBJ_SET));
45+
if (!obj_set)
46+
return ret;
47+
48+
/* Load pkcs11prov and default providers */
49+
if (!providers_load()) {
50+
display_openssl_errors();
51+
return ret;
52+
}
53+
54+
/* Load private key, public key and certificate */
55+
load_objects(argv[1], NULL, obj_set);
56+
57+
if (!obj_set->private_key) {
58+
printf("Cannot load private key: %s\n", argv[1]);
59+
goto cleanup;
60+
}
61+
if (!obj_set->public_key) {
62+
printf("Cannot load public key: %s\n", argv[1]);
63+
goto cleanup;
64+
}
65+
if (!obj_set->cert) {
66+
printf("Cannot load certificate: %s\n", argv[1]);
67+
goto cleanup;
68+
}
69+
ret = X509_check_private_key(obj_set->cert, obj_set->private_key);
70+
if (!ret) {
71+
printf("Could not check private key.\n");
72+
display_openssl_errors();
73+
goto cleanup;
74+
}
75+
printf("Key and certificate matched.\n");
76+
ret = EXIT_SUCCESS;
77+
78+
cleanup:
79+
EVP_PKEY_free(obj_set->private_key);
80+
EVP_PKEY_free(obj_set->public_key);
81+
X509_free(obj_set->cert);
82+
OPENSSL_free(obj_set);
83+
providers_cleanup();
84+
printf("\n");
85+
return ret;
86+
}
87+
88+
#else
89+
90+
int main() {
91+
return 0;
92+
}
93+
94+
#endif /* OPENSSL_VERSION_NUMBER >= 0x30000000L */
95+
96+
/* vim: set noexpandtab: */

‎tests/check-privkey-prov.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ int main(int argc, char *argv[])
3838
int ret = EXIT_FAILURE;
3939

4040
if (argc < 2) {
41-
fprintf(stderr, "usage: %s [certificate (PEM or URL)] [private key URL]n", argv[0]);
41+
fprintf(stderr, "usage: %s [certificate (PEM or URL)] [private key URL]\n", argv[0]);
4242
return ret;
4343
}
4444

‎tests/helpers_prov.c‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,40 @@ void display_openssl_errors(void)
4949
}
5050
}
5151

52+
/* store_type == 0 means here multiple types of credentials are to be loaded */
53+
void load_objects(const char *uri, const UI_METHOD *ui_method, OBJ_SET *obj_set) {
54+
OSSL_STORE_CTX *store_ctx;
55+
int type;
56+
57+
store_ctx = OSSL_STORE_open(uri, ui_method, NULL, NULL, NULL);
58+
if (!store_ctx)
59+
return; /* FAILED */
60+
61+
while (!OSSL_STORE_eof(store_ctx)) {
62+
OSSL_STORE_INFO *object = OSSL_STORE_load(store_ctx);
63+
64+
if (!object)
65+
continue;
66+
67+
type = OSSL_STORE_INFO_get_type(object);
68+
switch (type) {
69+
case OSSL_STORE_INFO_PKEY:
70+
obj_set->private_key = OSSL_STORE_INFO_get1_PKEY(object);
71+
break;
72+
case OSSL_STORE_INFO_PUBKEY:
73+
obj_set->public_key = OSSL_STORE_INFO_get1_PUBKEY(object);
74+
break;
75+
case OSSL_STORE_INFO_CERT:
76+
obj_set->cert = OSSL_STORE_INFO_get1_CERT(object);
77+
break;
78+
default:
79+
break; /* skip any other type */
80+
}
81+
OSSL_STORE_INFO_free(object);
82+
}
83+
OSSL_STORE_close(store_ctx);
84+
}
85+
5286
EVP_PKEY *load_pkey(const char *uri, const UI_METHOD *ui_method)
5387
{
5488
EVP_PKEY *pkey = NULL;

‎tests/helpers_prov.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,14 @@
3838
#include <openssl/provider.h>
3939
#include <openssl/ui.h>
4040

41+
typedef struct {
42+
EVP_PKEY *private_key;
43+
EVP_PKEY *public_key;
44+
X509 *cert;
45+
} OBJ_SET;
46+
4147
void display_openssl_errors(void);
48+
void load_objects(const char *uri, const UI_METHOD *ui_method, OBJ_SET *set);
4249
EVP_PKEY *load_pkey(const char *uri, const UI_METHOD *ui_method);
4350
EVP_PKEY *load_pubkey(const char *uri);
4451
X509 *load_cert(const char *uri);

‎tests/provider-ec-check-all.softhsm‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/bin/bash
2+
3+
# Copyright © 2025 Mobi - Com Polska Sp. z o.o.
4+
# Author: Małgorzata Olszówka <[email protected]>
5+
#
6+
# This program is free software: you can redistribute it and/or modify
7+
# it under the terms of the GNU General Public License as published by
8+
# the Free Software Foundation, either version 3 of the License, or
9+
# (at your option) any later version.
10+
#
11+
# This program is distributed in the hope that it will be useful,
12+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
13+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14+
# GNU General Public License for more details.
15+
#
16+
# You should have received a copy of the GNU General Public License
17+
# along with this program. If not, see <http://www.gnu.org/licenses/>
18+
19+
outdir="output.$$"
20+
21+
# Load common test functions
22+
. ${srcdir}/common.sh
23+
24+
URL="pkcs11:token=libp11-0;id=%01%02%03%04;object=server-key-0;pin-value=${PIN}"
25+
26+
if [[ "${OPENSSL_VERSION}" =~ ^[012].* ]]; then
27+
echo "Skipping test with OpenSSL ${OPENSSL_VERSION}"
28+
exit 77
29+
fi
30+
31+
# Do the token initialization
32+
init_token "ec" "1" "libp11" ${ID} "server-key" "privkey" "pubkey" "cert"
33+
34+
# Ensure the use of the locally built provider; applies after running 'pkcs11-tool'
35+
unset OPENSSL_ENGINES
36+
export OPENSSL_MODULES="../src/.libs/"
37+
export PKCS11_MODULE_PATH=${MODULE}
38+
echo "OPENSSL_MODULES=${OPENSSL_MODULES}"
39+
echo "PKCS11_MODULE_PATH=${PKCS11_MODULE_PATH}"
40+
41+
# Load openssl settings
42+
TEMP_LD_LIBRARY_PATH=${LD_LIBRARY_PATH}
43+
. ${srcdir}/openssl-settings.sh
44+
45+
# Run the test
46+
${WRAPPER} ./check-all-prov ${URL}
47+
if [[ $? -ne 0 ]]; then
48+
echo "Provider get all objects test failed."
49+
exit 1
50+
fi
51+
52+
# Restore settings
53+
export LD_LIBRARY_PATH=${TEMP_LD_LIBRARY_PATH}
54+
55+
rm -rf "$outdir"
56+
57+
exit 0

‎tests/provider-rsa-check-all.softhsm‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/bin/bash
2+
3+
# Copyright © 2025 Mobi - Com Polska Sp. z o.o.
4+
# Author: Małgorzata Olszówka <[email protected]>
5+
#
6+
# This program is free software: you can redistribute it and/or modify
7+
# it under the terms of the GNU General Public License as published by
8+
# the Free Software Foundation, either version 3 of the License, or
9+
# (at your option) any later version.
10+
#
11+
# This program is distributed in the hope that it will be useful,
12+
# but WITHOUT ANY WARRANTY; without even the implied warranty of
13+
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14+
# GNU General Public License for more details.
15+
#
16+
# You should have received a copy of the GNU General Public License
17+
# along with this program. If not, see <http://www.gnu.org/licenses/>
18+
19+
outdir="output.$$"
20+
21+
# Load common test functions
22+
. ${srcdir}/common.sh
23+
24+
URL="pkcs11:token=libp11-0;id=%01%02%03%04;object=server-key-0;pin-value=${PIN}"
25+
26+
if [[ "${OPENSSL_VERSION}" =~ ^[012].* ]]; then
27+
echo "Skipping test with OpenSSL ${OPENSSL_VERSION}"
28+
exit 77
29+
fi
30+
31+
# Do the token initialization
32+
init_token "rsa" "1" "libp11" ${ID} "server-key" "privkey" "pubkey" "cert"
33+
34+
# Ensure the use of the locally built provider; applies after running 'pkcs11-tool'
35+
unset OPENSSL_ENGINES
36+
export OPENSSL_MODULES="../src/.libs/"
37+
export PKCS11_MODULE_PATH=${MODULE}
38+
echo "OPENSSL_MODULES=${OPENSSL_MODULES}"
39+
echo "PKCS11_MODULE_PATH=${PKCS11_MODULE_PATH}"
40+
41+
# Load openssl settings
42+
TEMP_LD_LIBRARY_PATH=${LD_LIBRARY_PATH}
43+
. ${srcdir}/openssl-settings.sh
44+
45+
# Run the test
46+
${WRAPPER} ./check-all-prov ${URL}
47+
if [[ $? -ne 0 ]]; then
48+
echo "Provider get all objects test failed."
49+
exit 1
50+
fi
51+
52+
# Restore settings
53+
export LD_LIBRARY_PATH=${TEMP_LD_LIBRARY_PATH}
54+
55+
rm -rf "$outdir"
56+
57+
exit 0

0 commit comments

Comments
 (0)