Skip to content

Commit d4a9e3e

Browse files
Bravo555Bravo555
authored
Merge pull request #3865 from Bravo555/refactor/tests-pkcs11
refactor: split private_key_storage.robot
2 parents fdfdc0e + 5e65cc6 commit d4a9e3e

File tree

3 files changed

+258
-183
lines changed

3 files changed

+258
-183
lines changed

‎tests/RobotFramework/tests/pkcs11/create_key.robot‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
*** Settings ***
2+
Documentation Tests for the `tedge cert create-key-hsm` command.
3+
4+
Resource pkcs11_common.resource
5+
6+
Suite Setup Custom Setup
7+
Suite Teardown Get Suite Logs
8+
9+
Test Tags adapter:docker theme:cryptoki
10+
11+
12+
*** Variables ***
13+
${KEY_URI} ${EMPTY}
14+
${TOKEN_URI} pkcs11:token=create-key-token
15+
16+
17+
*** Test Cases ***
18+
Can create a private key on the PKCS11 token
19+
Execute Command cmd=softhsm2-util --init-token --free --label create-key-token --pin=123456 --so-pin=123456
20+
21+
${output}= Execute Command
22+
... cmd=p11tool --login --set-pin=123456 --list-privkeys "${TOKEN_URI}"
23+
... exp_exit_code=!0
24+
... strip=True
25+
... stdout=False
26+
... stderr=True
27+
Should Be Equal ${output} No matching objects found
28+
29+
Create private key label=rsa-2048 type=rsa p11tool_keytype=RSA-2048
30+
Create private key
31+
... label=rsa-3072
32+
... type=rsa
33+
... bits=3072
34+
... p11tool_keytype=RSA-3072
35+
Create private key
36+
... label=rsa-4096
37+
... type=rsa
38+
... bits=4096
39+
... p11tool_keytype=RSA-4096
40+
41+
Create private key
42+
... label=ec-256
43+
... type=ecdsa
44+
... curve=p256
45+
... p11tool_keytype=EC/ECDSA-SECP256R1
46+
Create private key
47+
... label=ec-384
48+
... type=ecdsa
49+
... curve=p384
50+
... p11tool_keytype=EC/ECDSA-SECP384R1
51+
# ECDSA P521 not supported by rcgen
52+
53+
Shows connected initialized tokens when token argument is not provided
54+
# setup multiple tokens
55+
Execute Command cmd=softhsm2-util --init-token --free --label create-key-token1 --pin=123456 --so-pin=123456
56+
Execute Command cmd=softhsm2-util --init-token --free --label create-key-token2 --pin=123456 --so-pin=123456
57+
58+
# unset key_uri so there there's no hint where to generate the keypair
59+
Execute Command cmd=tedge config unset device.key_uri
60+
${stderr}= Execute Command
61+
... cmd=tedge cert create-key-hsm --type ecdsa --label my-key
62+
... strip=True
63+
... stdout=False
64+
... stderr=True
65+
... exp_exit_code=1
66+
Should Contain ${stderr} No token URL was provided for this operation; the available tokens are:
67+
Should Contain ${stderr} token=create-key-token1
68+
Should Contain ${stderr} token=create-key-token2
69+
70+
Can set key ID using --id flag
71+
${output}= Execute Command
72+
... cmd=tedge cert create-key-hsm --type ecdsa --label my-key --id 010203 "${TOKEN_URI}"
73+
... strip=True
74+
... stdout=False
75+
... stderr=True
76+
Should Contain ${output} id=%01%02%03
77+
78+
${output}= Execute Command
79+
... cmd=tedge cert create-key-hsm --type ecdsa --label my-key --id 010203 "${TOKEN_URI}"
80+
... strip=True
81+
... stdout=False
82+
... stderr=True
83+
... exp_exit_code=!0
84+
Should Contain ${output} Object with this id already exists on the token
85+
86+
Can provide PIN using --pin flag
87+
${output}= Execute Command
88+
... cmd=tedge cert create-key-hsm --label my-key --pin 000000 "${TOKEN_URI}"
89+
... strip=True
90+
... stdout=False
91+
... stderr=True
92+
... exp_exit_code=!0
93+
Should Contain ${output} The specified PIN is incorrect
94+
95+
Saves public key to file using --outfile-pubkey flag
96+
${output}= Execute Command
97+
... cmd=tedge cert create-key-hsm --label my-key --outfile-pubkey pubkey.pem "${TOKEN_URI}"
98+
... strip=True
99+
... stdout=False
100+
... stderr=True
101+
${pubkey}= Execute Command cat pubkey.pem strip=True
102+
Should Contain ${output} ${pubkey}
103+
104+
105+
*** Keywords ***
106+
Create private key
107+
[Arguments] ${type} ${label} ${bits}=${EMPTY} ${curve}=${EMPTY} ${p11tool_keytype}=${EMPTY}
108+
# create the private key on token and write CSR to device.csr_path
109+
VAR ${command}= tedge cert create-key-hsm --label ${label} --type ${type} "${TOKEN_URI}"
110+
IF $bits
111+
VAR ${command}= ${command} --bits ${bits}
112+
END
113+
IF $curve
114+
VAR ${command}= ${command} --curve ${curve}
115+
END
116+
${create_key_output}= Execute Command ${command} strip=True stderr=True stdout=False
117+
118+
# check if key is created
119+
${output}= Execute Command
120+
... cmd=p11tool --login --set-pin=123456 --list-privkeys "${TOKEN_URI}"
121+
IF $p11tool_keytype
122+
Should Contain ${output} Type: Private key (${p11tool_keytype})
123+
ELSE
124+
Should Contain ${output} Type: Private key
125+
END
126+
Should Contain ${output} Label: ${label}
127+
128+
${key_uri}= Execute Command tedge config get device.key_uri strip=True
129+
Should Contain ${create_key_output} ${key_uri}
130+
131+
Custom Setup
132+
${DEVICE_SN}= Setup register=${False}
133+
Set Suite Variable ${DEVICE_SN}
134+
135+
# Allow the tedge user to access softhsm
136+
Execute Command sudo usermod -a -G softhsm tedge
137+
Transfer To Device ${CURDIR}/data/init_softhsm.sh /usr/bin/
138+
139+
# initialize the soft hsm and create a certificate signing request
140+
Execute Command tedge config set device.cryptoki.pin 123456
141+
Execute Command tedge config set device.cryptoki.module_path /usr/lib/softhsm/libsofthsm2.so
142+
Execute Command sudo -u tedge /usr/bin/init_softhsm.sh --device-id "${DEVICE_SN}" --pin 123456
143+
144+
# configure tedge
145+
${domain}= Cumulocity.Get Domain
146+
Execute Command tedge config set c8y.url "${domain}"
147+
Execute Command tedge config set mqtt.bridge.built_in true
148+
Execute Command tedge config set device.cryptoki.mode socket
149+
150+
${csr_path}= Execute Command cmd=tedge config get device.csr_path strip=${True}
151+
ThinEdgeIO.Register Device With Cumulocity CA ${DEVICE_SN} csr_path=${csr_path}

‎tests/RobotFramework/tests/pkcs11/private_key_storage.robot‎

Lines changed: 5 additions & 183 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
*** Settings ***
22
Documentation Test thin-edge.io MQTT client authentication using a Hardware Security Module (HSM).
33
...
4-
... To do this, we install SoftHSM2 which allows us to create software-backed PKCS#11 (cryptoki)
5-
... cryptographic tokens that will be read by thin-edge. In real production environments a dedicated
6-
... hardware device would be used.
4+
... This suite focuses on testing selection and connecting to the cloud using different types of private
5+
... keys stored in PKCS#11 tokens.
6+
...
7+
... Uses SoftHSM2 to simulate a hardware security module for testing purposes. In real production
8+
... environments, a dedicated hardware device would be used.
79
810
# it would be good to explain here why we use the tedge-p11-server exclusively and not the module mode
911
Resource pkcs11_common.resource
@@ -160,188 +162,8 @@ Can pass PIN in the request using device.key_pin
160162

161163
[Teardown] Execute Command tedge config unset device.key_pin
162164

163-
Can create a private key on the PKCS11 token
164-
Execute Command cmd=softhsm2-util --init-token --free --label create-key-token --pin=123456 --so-pin=123456
165-
166-
${output}= Execute Command
167-
... cmd=p11tool --login --set-pin=123456 --list-privkeys "pkcs11:token=create-key-token"
168-
... exp_exit_code=!0
169-
... strip=True
170-
... stdout=False
171-
... stderr=True
172-
Should Be Equal ${output} No matching objects found
173-
174-
Set tedge-p11-server Uri value=pkcs11:token=create-key-token
175-
176-
Create private key label=rsa-2048 type=rsa p11tool_keytype=RSA-2048
177-
Create private key
178-
... label=rsa-3072
179-
... type=rsa
180-
... bits=3072
181-
... p11tool_keytype=RSA-3072
182-
Create private key
183-
... label=rsa-4096
184-
... type=rsa
185-
... bits=4096
186-
... p11tool_keytype=RSA-4096
187-
188-
Create private key
189-
... label=ec-256
190-
... type=ecdsa
191-
... curve=p256
192-
... p11tool_keytype=EC/ECDSA-SECP256R1
193-
Create private key
194-
... label=ec-384
195-
... type=ecdsa
196-
... curve=p384
197-
... p11tool_keytype=EC/ECDSA-SECP384R1
198-
# ECDSA P521 not supported by rcgen
199-
200-
[Teardown] Set tedge-p11-server Uri value=
201-
202-
tedge cert create-key-hsm should ask where to create keypair if multiple tokens available
203-
# setup multiple tokens
204-
Execute Command cmd=softhsm2-util --init-token --free --label create-key-token1 --pin=123456 --so-pin=123456
205-
Execute Command cmd=softhsm2-util --init-token --free --label create-key-token2 --pin=123456 --so-pin=123456
206-
207-
# unset key_uri so there there's no hint where to generate the keypair
208-
Execute Command cmd=tedge config unset device.key_uri
209-
${stderr}= Execute Command
210-
... cmd=tedge cert create-key-hsm --type ecdsa --label my-key
211-
... strip=True
212-
... stdout=False
213-
... stderr=True
214-
... exp_exit_code=1
215-
Should Contain ${stderr} No token URL was provided for this operation; the available tokens are:
216-
Should Contain ${stderr} token=create-key-token1
217-
Should Contain ${stderr} token=create-key-token2
218-
219-
tedge cert create-key-hsm can set chosen id and returns error if object with this id already exists
220-
${output}= Execute Command
221-
... cmd=tedge cert create-key-hsm --type ecdsa --label my-key --id 010203 "pkcs11:token=tedge"
222-
... strip=True
223-
... stdout=False
224-
... stderr=True
225-
Should Contain ${output} id=%01%02%03
226-
227-
${output}= Execute Command
228-
... cmd=tedge cert create-key-hsm --type ecdsa --label my-key --id 010203 "pkcs11:token=tedge"
229-
... strip=True
230-
... stdout=False
231-
... stderr=True
232-
... exp_exit_code=!0
233-
Should Contain ${output} Object with this id already exists on the token
234-
235-
tedge cert create-key-hsm can set pin per request
236-
${output}= Execute Command
237-
... cmd=tedge cert create-key-hsm --label my-key --pin 000000 "pkcs11:token=tedge"
238-
... strip=True
239-
... stdout=False
240-
... stderr=True
241-
... exp_exit_code=!0
242-
Should Contain ${output} The specified PIN is incorrect
243-
244-
tedge cert create-key-hsm can save public key to file
245-
${output}= Execute Command
246-
... cmd=tedge cert create-key-hsm --label my-key --outfile-pubkey pubkey.pem "pkcs11:token=tedge"
247-
... strip=True
248-
... stdout=False
249-
... stderr=True
250-
${pubkey}= Execute Command cat pubkey.pem strip=True
251-
Should Contain ${output} ${pubkey}
252-
253-
Ignore tedge.toml if missing
254-
Execute Command rm -f ./tedge.toml
255-
${stderr}= Execute Command tedge-p11-server --config-dir . --module-path xx.so exp_exit_code=!0
256-
# Don't log anything (this is normal behaviour as the user does not have to create a tedge.toml file)
257-
Should Not Contain ${stderr} Failed to read ./tedge.toml: No such file
258-
# And proceed
259-
Should Contain ${stderr} Using cryptoki configuration
260-
# Using default values
261-
Should Contain ${stderr} tedge-p11-server.sock
262-
263-
Ignore tedge.toml if empty
264-
Execute Command touch ./tedge.toml
265-
${stderr}= Execute Command tedge-p11-server --config-dir . --module-path xx.so exp_exit_code=!0
266-
# Don't log anything (this is normal behaviour, where the file is used for tedge and not tedge-p11-server)
267-
Should Not Contain ${stderr} Failed to parse ./tedge.toml: invalid TOML
268-
# And proceed
269-
Should Contain ${stderr} Using cryptoki configuration
270-
# Using default values
271-
Should Contain ${stderr} tedge-p11-server.sock
272-
273-
Ignore tedge.toml if incomplete
274-
Execute Command echo '[device]' >./tedge.toml
275-
${stderr}= Execute Command tedge-p11-server --config-dir . --module-path xx.so exp_exit_code=!0
276-
# Don't log anything (this is normal behaviour, where the file is used for tedge and not tedge-p11-server)
277-
Should Not Contain ${stderr} Failed to parse ./tedge.toml: invalid TOML
278-
Should Not Contain ${stderr} missing field `cryptoki`
279-
# And proceed
280-
Should Contain ${stderr} Using cryptoki configuration
281-
# Using default values
282-
Should Contain ${stderr} tedge-p11-server.sock
283-
284-
Do not warn the user if tedge.toml is incomplete but not used
285-
Execute Command rm -f ./tedge.toml
286-
${stderr}= Execute Command
287-
... tedge-p11-server --config-dir . --module-path xx.so --pin 11.pin --socket-path yy.sock --uri zz.uri
288-
... exp_exit_code=!0
289-
# Don't warn as all values are provided on the command line
290-
Should Not Contain ${stderr} Failed to read ./tedge.toml: No such file
291-
# And proceed
292-
Should Contain ${stderr} Using cryptoki configuration
293-
# Using the values provided on the command lin
294-
Should Contain ${stderr} xx.so
295-
Should Contain ${stderr} yy.sock
296-
Should Contain ${stderr} zz.uri
297-
298-
Warn the user if tedge.toml exists but cannot be read
299-
Execute Command echo '[device.cryptoki]' >./tedge.toml
300-
Execute Command chmod a-rw ./tedge.toml
301-
${stderr}= Execute Command
302-
... sudo -u tedge tedge-p11-server --config-dir . --module-path xx.so
303-
... exp_exit_code=!0
304-
# Warn the user
305-
Should Contain ${stderr} Failed to read ./tedge.toml: Permission denied
306-
# But proceed
307-
Should Contain ${stderr} Using cryptoki configuration
308-
309-
Warn the user if tedge.toml cannot be parsed
310-
Execute Command rm -f ./tedge.toml
311-
Execute Command echo '[corrupted toml ...' >./tedge.toml
312-
${stderr}= Execute Command tedge-p11-server --config-dir . --module-path xx.so exp_exit_code=!0
313-
# Warn the user
314-
Should Contain ${stderr} Failed to parse ./tedge.toml: invalid TOML
315-
# But proceed
316-
Should Contain ${stderr} Using cryptoki configuration
317-
318165

319166
*** Keywords ***
320-
Create private key
321-
[Arguments] ${type} ${label} ${bits}=${EMPTY} ${curve}=${EMPTY} ${p11tool_keytype}=${EMPTY}
322-
# create the private key on token and write CSR to device.csr_path
323-
VAR ${command}= tedge cert create-key-hsm --label ${label} --type ${type} "pkcs11:token=create-key-token"
324-
IF $bits
325-
VAR ${command}= ${command} --bits ${bits}
326-
END
327-
IF $curve
328-
VAR ${command}= ${command} --curve ${curve}
329-
END
330-
${create_key_output}= Execute Command ${command} strip=True stderr=True stdout=False
331-
332-
# check if key is created
333-
${output}= Execute Command
334-
... cmd=p11tool --login --set-pin=123456 --list-privkeys "pkcs11:token=create-key-token"
335-
IF $p11tool_keytype
336-
Should Contain ${output} Type: Private key (${p11tool_keytype})
337-
ELSE
338-
Should Contain ${output} Type: Private key
339-
END
340-
Should Contain ${output} Label: ${label}
341-
342-
${key_uri}= Execute Command tedge config get device.key_uri strip=True
343-
Should Contain ${create_key_output} ${key_uri}
344-
345167
Test tedge cert renew
346168
[Arguments] ${type} ${bits}=${EMPTY} ${curve}=${EMPTY}
347169

0 commit comments

Comments
 (0)