-
Notifications
You must be signed in to change notification settings - Fork 84
Add support for PKCS#11 3.2 validation objects #306
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
Jakuje
wants to merge
13
commits into
parallaxsecond:main
Choose a base branch
from
Jakuje:pkcs11-3.2-validation
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
13 commits
Select commit
Hold shift + click to select a range
493ca6b
Fix type for the CKV_ constants
Jakuje 61d8327
objects: Add support for validation attributes
Jakuje 40e4158
Add support to get session validation flags
Jakuje 65ee21c
tests: Test ValidationFlags
Jakuje be8f57d
tests: Use more complex pins to make Kryoptic FIPS module happy
Jakuje 4fc5d1d
tests: Generate larger keys for compatibility with FIPS Mode
Jakuje 5b59dfc
tests: Be less strict about error type when doing SetAttribute
Jakuje d8e8453
tests: Skip RSA PKCS#1 encryption with FIPS tokens
Jakuje def57c8
tests: Skip RSA PKCS#1 wrapping/unwrapping with FIPS tokens
Jakuje 7c43d9f
KBKDF: Use FIPS/OpenSSL compatible params
Jakuje 8c04992
tests: Use 16 byte IV for KBKDF for OpenSSL compatibility
Jakuje f095a90
tests: Add wrap/unwrap test with RSA-OAEP
Jakuje 90b7ad9
Add CI job with kryoptic FIPS module
Jakuje File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,137 @@ | ||
| --- | ||
| name: Test kryoptic FIPS module | ||
|
|
||
| on: [push, pull_request, workflow_dispatch] | ||
|
|
||
| jobs: | ||
| build: | ||
| name: Test kryoptic FIPS module | ||
| runs-on: ubuntu-22.04 | ||
| container: quay.io/fedora/fedora:latest | ||
| steps: | ||
| ################# | ||
| ### DNF cache ### | ||
| ################# | ||
| - name: Get Date for DNF cache entry | ||
| id: get-date | ||
| run: | | ||
| echo "date=$(/bin/date -u "+%Y%V")" >> $GITHUB_OUTPUT | ||
| shell: bash | ||
|
|
||
| - name: Restore DNF cache | ||
| uses: actions/cache/restore@v4 | ||
| id: cache-dnf | ||
| with: | ||
| path: "/var/cache/libdnf5" | ||
| key: fedora-dnf-${{ steps.get-date.outputs.date }} | ||
|
|
||
| - name: Install Dependencies | ||
| run: | | ||
| dnf -y install git cargo clang-devel openssl-devel sqlite-devel \ | ||
| 'perl(FindBin)' 'perl(lib)' 'perl(File::Compare)' \ | ||
| 'perl(File::Copy)' 'perl(bigint)' 'perl(Time::HiRes)' \ | ||
| 'perl(IPC::Cmd)' 'perl(Pod::Html)' 'perl(Digest::SHA)' \ | ||
| 'perl(Module::Load::Conditional)' 'perl(File::Temp)' \ | ||
| 'perl(Test::Harness)' 'perl(Test::More)' 'perl(Math::BigInt)' \ | ||
| 'perl(Time::Piece)' zlib-devel sed sqlite-devel | ||
| - name: DNF cache | ||
| if: ${{ steps.cache-dnf.outputs.cache-hit != 'true' }} | ||
| uses: actions/cache/save@v4 | ||
| with: | ||
| path: "/var/cache/libdnf5" | ||
| key: fedora-dnf-${{ steps.get-date.outputs.date }} | ||
|
|
||
| ##################### | ||
| ### OpenSSL build ### | ||
| ##################### | ||
| - name: Setup OpenSSL 3.5 | ||
| id: ossl-setup | ||
| run: | | ||
| OPENSSL_BRANCH="openssl-3.5" | ||
| cd .. | ||
| git clone https://github.com/openssl/openssl.git \ | ||
| --single-branch --branch $OPENSSL_BRANCH openssl | ||
| cd openssl | ||
| echo "KRYOPTIC_OPENSSL_SOURCES=$PWD" >> "$GITHUB_ENV" | ||
| echo "cacheid=${{ runner.os }}-ossl-$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" | ||
| - name: Restore OpenSSL build if cached | ||
| uses: actions/cache/restore@v4 | ||
| id: cache | ||
| with: | ||
| path: ${{ env.KRYOPTIC_OPENSSL_SOURCES }} | ||
| key: ${{ steps.ossl-setup.outputs.cacheid }} | ||
|
|
||
| - name: Build OpenSSL | ||
| if: ${{ steps.cache.outputs.cache-hit != 'true' }} | ||
| run: | | ||
| pushd ${{ env.KRYOPTIC_OPENSSL_SOURCES }} | ||
| ./Configure | ||
| make | ||
| - name: Cache OpenSSL 3.5 build | ||
| if: ${{ steps.cache.outputs.cache-hit != 'true' }} | ||
| uses: actions/cache/save@v4 | ||
| with: | ||
| path: ${{ env.KRYOPTIC_OPENSSL_SOURCES }} | ||
| key: ${{ steps.ossl-setup.outputs.cacheid }} | ||
|
|
||
| ###################### | ||
| ### kryoptic build ### | ||
| ###################### | ||
| - name: Setup kryoptic | ||
| run: | | ||
| KRYOPTIC_REVISION="v1.3.1" | ||
| cd .. | ||
| git clone https://github.com/latchset/kryoptic.git \ | ||
| --depth 1 --single-branch --revision $KRYOPTIC_REVISION kryoptic | ||
| - name: Generate lock file | ||
| run: | | ||
| cd ../kryoptic && | ||
| cargo generate-lockfile | ||
| - name: Cache Rust dependencies | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: | | ||
| ~/.cargo/bin/ | ||
| ~/.cargo/registry/index/ | ||
| ~/.cargo/registry/cache/ | ||
| ~/.cargo/git/db/ | ||
| ../kryoptic/target/ | ||
| key: fedora-cargo-${{ hashFiles('**/Cargo.lock') }} | ||
|
|
||
| - name: Build kryoptic | ||
| run: | | ||
| FEATURES="fips,pqc,dummy-integrity" | ||
| OPTS="--no-default-features" | ||
| cd ../kryoptic && | ||
| cargo build -vv $OPTS --features "$FEATURES" | ||
| - uses: actions/upload-artifact@v4 | ||
| if: failure() | ||
| with: | ||
| name: Build logs OpenSSL version 3.5 | ||
| path: | | ||
| target/debug/build/*/output | ||
| - name: Checkout rust-cryptoki | ||
| uses: actions/checkout@v4 | ||
|
|
||
| ################# | ||
| ### the tests ### | ||
| ################# | ||
| - name: Run test script | ||
| env: | ||
| KRYOPTIC_CONF: /tmp/kryoptic.sql | ||
| TEST_PKCS11_MODULE: /__w/rust-cryptoki/kryoptic/target/debug/libkryoptic_pkcs11.so | ||
| OUT_DIR: /__w/rust-cryptoki/kryoptic/target/debug/deps/ | ||
| run: | | ||
| RUST_BACKTRACE=1 cargo build --all-features && | ||
| RUST_BACKTRACE=1 cargo test | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shall I add it to the required workflow to pass for a PR?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think now this can be done using the "Check if all checks succeeded (pull_request)" job, thus, Jakub can adjust it himself.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am not sure if it would not need to be in the same workflow file to work though to be able to use in the "check if all checks succeeded". Given that how large this workflow is, I did not want to mess the main ci.yml with it for now.
I hope this job will be stable, but I would rather keep it for some time non-mandatory and add it to the required just after some time we will see it will work as expected to avoid working around some required jobs.