Skip to content

Commit 9fe950c

Browse files
dgarskedgarske
authored
Merge pull request #139 from LinuxJedi/fix-tests
Fix pk12util and add PBKDF2
2 parents 17adaaa + dbd3858 commit 9fe950c

File tree

11 files changed

+1961
-47
lines changed

11 files changed

+1961
-47
lines changed

‎.github/workflows/nss-pk12util-test.yml‎

Lines changed: 370 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,370 @@
1+
name: wolfPKCS11 NSS pk12util Test
2+
3+
on:
4+
push:
5+
branches: [ main, master, nss ]
6+
pull_request:
7+
branches: [ main, master, nss ]
8+
workflow_dispatch:
9+
10+
env:
11+
NSPR_VERSION: NSPR_4_36_BRANCH
12+
NSS_VERSION: NSS_3_112_RTM
13+
WOLFSSL_VERSION: v5.8.0-stable
14+
NSS_DEBUG_PKCS11_MODULE: wolfPKCS11
15+
NSPR_LOG_MODULES: all:5
16+
NSPR_LOG_FILE: /logs/nss.log
17+
NSS_OUTPUT_FILE: /logs/stats.log
18+
NSS_STRICT_NOFORK: 1
19+
NSS_DEBUG: all
20+
21+
jobs:
22+
nss-pk12util-test:
23+
runs-on: ubuntu-22.04
24+
25+
steps:
26+
- name: Checkout repository
27+
uses: actions/checkout@v4
28+
29+
- name: Install system dependencies
30+
run: |
31+
sudo apt-get update
32+
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
33+
mercurial \
34+
python3 \
35+
python-is-python3 \
36+
python3-pip \
37+
gyp \
38+
ninja-build \
39+
build-essential \
40+
automake \
41+
libtool \
42+
git \
43+
pkg-config \
44+
poppler-utils \
45+
wget \
46+
enscript \
47+
ghostscript \
48+
gdb \
49+
vim \
50+
hexedit \
51+
openssl \
52+
ca-certificates
53+
54+
- name: Cache NSPR
55+
id: cache-nspr
56+
uses: actions/cache@v4
57+
with:
58+
path: /tmp/src/nspr
59+
key: nspr-${{ env.NSPR_VERSION }}
60+
61+
- name: Clone and build NSPR
62+
if: steps.cache-nspr.outputs.cache-hit != 'true'
63+
run: |
64+
mkdir -p /tmp/src
65+
cd /tmp/src
66+
hg clone https://hg.mozilla.org/projects/nspr -r ${{ env.NSPR_VERSION }}
67+
68+
- name: Cache NSS source and patches
69+
id: cache-nss-source
70+
uses: actions/cache@v4
71+
with:
72+
path: |
73+
/tmp/src/nss
74+
/tmp/src/osp
75+
key: nss-source-${{ env.NSS_VERSION }}-latest
76+
77+
- name: Cache NSS build artifacts
78+
id: cache-nss-build
79+
uses: actions/cache@v4
80+
with:
81+
path: /tmp/src/dist
82+
key: nss-build-${{ env.NSS_VERSION }}-latest
83+
84+
- name: Clone NSS and apply wolfSSL patches
85+
if: steps.cache-nss-source.outputs.cache-hit != 'true'
86+
run: |
87+
mkdir -p /tmp/src
88+
cd /tmp/src
89+
90+
# Clone official Mozilla NSS with specific tag
91+
hg clone https://hg.mozilla.org/projects/nss -r ${{ env.NSS_VERSION }}
92+
93+
# Clone wolfSSL OSP repository for patches
94+
git clone https://github.com/wolfSSL/osp.git
95+
96+
cd nss
97+
98+
# Apply patches from wolfSSL/osp/nss directory
99+
echo "Applying wolfSSL NSS patches..."
100+
if [ -d "../osp/nss" ]; then
101+
for patch in ../osp/nss/*.patch; do
102+
if [ -f "$patch" ]; then
103+
echo "Applying patch: $(basename $patch)"
104+
patch -p1 < "$patch" || {
105+
echo "Warning: Patch $(basename $patch) failed to apply cleanly"
106+
echo "Attempting to apply with --reject-file option..."
107+
patch -p1 --reject-file=/tmp/$(basename $patch).rej < "$patch" || true
108+
}
109+
fi
110+
done
111+
else
112+
echo "No patches found in wolfSSL/osp/nss directory"
113+
fi
114+
115+
- name: Build NSS
116+
if: steps.cache-nss-build.outputs.cache-hit != 'true'
117+
run: |
118+
cd /tmp/src/nss
119+
120+
# Set NSS build environment
121+
export USE_64=1
122+
export NSS_ENABLE_WERROR=0
123+
export BUILD_OPT=0
124+
125+
# Build NSS with debug mode enabled
126+
./build.sh -v
127+
128+
- name: Copy NSS headers and libraries
129+
run: |
130+
# Create directories for headers
131+
sudo mkdir -p /usr/local/include/nss
132+
sudo mkdir -p /usr/local/include/nspr
133+
sudo mkdir -p /usr/local/lib
134+
135+
# Copy NSS headers from dist directory
136+
sudo cp -r /tmp/src/dist/public/nss/* /usr/local/include/nss/
137+
138+
# Copy NSS library and headers
139+
sudo cp -r /tmp/src/dist/Debug/* /usr/local/
140+
141+
# Copy NSS and NSPR libraries
142+
sudo find /tmp/src/nspr/Debug -name "*.so" -exec cp {} /usr/local/lib/ \;
143+
144+
# Update library cache
145+
sudo ldconfig
146+
147+
- name: Cache wolfSSL
148+
id: cache-wolfssl
149+
uses: actions/cache@v4
150+
with:
151+
path: /tmp/wolfssl
152+
key: wolfssl-${{ env.WOLFSSL_VERSION }}
153+
154+
- name: Clone and build wolfSSL
155+
if: steps.cache-wolfssl.outputs.cache-hit != 'true'
156+
run: |
157+
cd /tmp
158+
git clone https://github.com/wolfSSL/wolfssl.git --branch ${{ env.WOLFSSL_VERSION }} --depth 1
159+
cd wolfssl
160+
./autogen.sh
161+
./configure --enable-aescfb --enable-cryptocb --enable-rsapss --enable-keygen --enable-pwdbased --enable-scrypt --enable-cmac --enable-aesctr --enable-aesccm --enable-md5 C_EXTRA_FLAGS="-DWOLFSSL_PUBLIC_MP -DWC_RSA_DIRECT -DHAVE_AES_ECB -D_GNU_SOURCE"
162+
make
163+
164+
- name: Install wolfSSL
165+
run: |
166+
cd /tmp/wolfssl
167+
sudo make install
168+
sudo ldconfig
169+
170+
- name: Build wolfPKCS11
171+
run: |
172+
./autogen.sh
173+
./configure --enable-debug --enable-nss --enable-aesecb --enable-aesctr --enable-aesccm --enable-aescmac CFLAGS="-D_GNU_SOURCE"
174+
make
175+
sudo make install
176+
sudo ldconfig
177+
178+
- name: Configure NSS database
179+
run: |
180+
sudo mkdir -p /nss-test/nssdb
181+
sudo chmod -R 777 /nss-test
182+
sudo mkdir -p /logs
183+
184+
# Configure NSS to use wolfPKCS11
185+
cat > /nss-test/pkcs11.txt << 'EOF'
186+
library=/usr/local/lib/libwolfpkcs11.so
187+
name=wolfPKCS11
188+
NSS=Flags=internal,critical,fips cipherOrder=100 slotParams={0x00000001=[slotFlags=ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] }
189+
EOF
190+
191+
# Initialize NSS database
192+
certutil -N -d /nss-test/nssdb/ --empty-password
193+
194+
- name: Run NSS pk12util tests
195+
run: |
196+
cd /nss-test
197+
set -e
198+
199+
echo "=== NSS pk12util Test Script ==="
200+
echo "NSS Database location: /nss-test/nssdb"
201+
echo
202+
203+
# Create test data
204+
echo "1. Creating test data file:"
205+
echo "This is test data for CMS signing and encryption" > test-data.txt
206+
cat test-data.txt
207+
echo
208+
209+
# Generate a test certificate and key
210+
echo "2. Generating CA and user certificates:"
211+
212+
# Step 1: Create a CA certificate
213+
echo " Creating CA certificate..."
214+
cat > ca-openssl.conf << 'CAEOF'
215+
[req]
216+
distinguished_name = req_distinguished_name
217+
req_extensions = v3_ca
218+
prompt = no
219+
220+
[req_distinguished_name]
221+
CN = Test CA
222+
O = NSS Test CA
223+
C = US
224+
225+
[v3_ca]
226+
keyUsage = critical, keyCertSign, cRLSign
227+
basicConstraints = critical, CA:true
228+
subjectKeyIdentifier = hash
229+
authorityKeyIdentifier = keyid:always,issuer
230+
CAEOF
231+
232+
# Create CA certificate and key
233+
openssl req -x509 -newkey rsa:2048 -keyout ca-key.pem -out ca-cert.pem -days 365 -nodes \
234+
-config ca-openssl.conf -extensions v3_ca
235+
236+
# Import CA certificate into NSS database
237+
certutil -A -n "TestCA" -i ca-cert.pem -t "CT,C,C" -d /nss-test/nssdb
238+
239+
# Step 2: Create user certificate signed by CA
240+
echo " Creating user certificate signed by CA..."
241+
cat > user-openssl.conf << 'USEREOF'
242+
[req]
243+
distinguished_name = req_distinguished_name
244+
prompt = no
245+
246+
[req_distinguished_name]
247+
CN = Test User
248+
O = NSS Test
249+
C = US
250+
emailAddress = [email protected]
251+
252+
[v3_user]
253+
keyUsage = critical, digitalSignature, keyEncipherment
254+
extendedKeyUsage = critical, emailProtection
255+
basicConstraints = critical, CA:false
256+
subjectKeyIdentifier = hash
257+
subjectAltName = email:[email protected]
258+
USEREOF
259+
260+
# Create user certificate request (without authority key identifier)
261+
openssl req -new -newkey rsa:2048 -keyout user-key.pem -out user-req.pem -nodes \
262+
-config user-openssl.conf
263+
264+
# Create signing config with authority key identifier
265+
cat > signing.conf << 'SIGNEOF'
266+
[v3_user_sign]
267+
keyUsage = critical, digitalSignature, keyEncipherment
268+
extendedKeyUsage = critical, emailProtection
269+
basicConstraints = critical, CA:false
270+
subjectKeyIdentifier = hash
271+
authorityKeyIdentifier = keyid:always,issuer:always
272+
subjectAltName = email:[email protected]
273+
SIGNEOF
274+
275+
# Sign user certificate with CA
276+
openssl x509 -req -in user-req.pem -CA ca-cert.pem -CAkey ca-key.pem -CAcreateserial \
277+
-out user-cert.pem -days 365 -extensions v3_user_sign -extfile signing.conf
278+
279+
# Convert user certificate to PKCS#12 format
280+
openssl pkcs12 -export -in user-cert.pem -inkey user-key.pem -out user-cert.p12 \
281+
-name "testcert" -passout pass:
282+
283+
# Import user certificate into NSS database
284+
echo " Importing user certificate into NSS database..."
285+
pk12util -i user-cert.p12 -d /nss-test/nssdb -W ""
286+
287+
# Set proper trust attributes
288+
certutil -M -n "testcert" -t "u,u,u" -d /nss-test/nssdb
289+
290+
echo " ✓ CA and user certificates created successfully"
291+
292+
echo "3. Listing certificates in NSS database:"
293+
certutil -L -d /nss-test/nssdb
294+
echo
295+
echo "Private keys in NSS database:"
296+
certutil -K -d /nss-test/nssdb
297+
echo
298+
echo "Certificate details:"
299+
if certutil -L -n "testcert" -d /nss-test/nssdb >/dev/null 2>&1; then
300+
echo "User certificate 'testcert':"
301+
certutil -L -n "testcert" -d /nss-test/nssdb
302+
echo
303+
fi
304+
if certutil -L -n "TestCA" -d /nss-test/nssdb >/dev/null 2>&1; then
305+
echo "CA certificate 'TestCA':"
306+
certutil -L -n "TestCA" -d /nss-test/nssdb
307+
fi
308+
309+
echo "4. Testing CMS operations with cmsutil:"
310+
311+
# Test CMS signing with additional options to handle trust
312+
echo " a) Signing data with CMS:"
313+
cmsutil -S -N "testcert" -i test-data.txt -o signed-data.p7s -d /nss-test/nssdb -p "" -G
314+
315+
if [ -f signed-data.p7s ]; then
316+
echo " ✓ CMS signing successful - created signed-data.p7s"
317+
ls -la signed-data.p7s
318+
else
319+
echo " ✗ CMS signing failed"
320+
fi
321+
322+
# Test CMS verification
323+
echo " b) Verifying CMS signature:"
324+
openssl smime -verify -in signed-data.p7s -CAfile test-cert.pem -inform DER -noverify 2>/dev/null && echo " ✓ OpenSSL verification successful"
325+
326+
# Test CMS encryption (envelope)
327+
echo " c) Creating CMS encrypted envelope:"
328+
cmsutil -E -r "testcert" -i test-data.txt -o encrypted-data.p7e -d /nss-test/nssdb
329+
if [ -f encrypted-data.p7e ]; then
330+
echo " ✓ CMS encryption successful - created encrypted-data.p7e"
331+
ls -la encrypted-data.p7e
332+
else
333+
echo " ✗ CMS encryption failed"
334+
fi
335+
336+
# Test CMS decryption
337+
echo " d) Decrypting CMS envelope:"
338+
cmsutil -D -i encrypted-data.p7e -o decrypted-data.txt -d /nss-test/nssdb -p ""
339+
if [ -f decrypted-data.txt ]; then
340+
echo " ✓ CMS decryption successful"
341+
echo " Original data:"
342+
cat test-data.txt
343+
echo " Decrypted data:"
344+
cat decrypted-data.txt
345+
echo " Data match:" $(cmp -s test-data.txt decrypted-data.txt && echo "YES" || echo "NO")
346+
else
347+
echo " ✗ CMS decryption failed"
348+
fi
349+
350+
echo
351+
echo "=== pk12util Test Complete ==="
352+
echo "Files created:"
353+
ls -la *.p7s *.p7e *.txt *.pem *.p12 2>/dev/null || echo "No files found"
354+
355+
# Create tar archive with all test artifacts
356+
sudo mkdir -p /tmp/artifacts
357+
sudo cp -r /logs /tmp/artifacts/ 2>/dev/null || true
358+
sudo cp -r /nss-test /tmp/artifacts/ 2>/dev/null || true
359+
sudo tar -czf /tmp/nss-pk12util-test-artifacts.tar.gz -C /tmp/artifacts . 2>/dev/null || true
360+
361+
# Fix permissions for artifact upload
362+
sudo chown $USER:$USER /tmp/nss-pk12util-test-artifacts.tar.gz 2>/dev/null || true
363+
364+
- name: Upload test artifacts
365+
if: failure()
366+
uses: actions/upload-artifact@v4
367+
with:
368+
name: nss-pk12util-test-artifacts
369+
path: /tmp/nss-pk12util-test-artifacts.tar.gz
370+
retention-days: 5

‎.github/workflows/unit-test.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@ jobs:
8686
uses: ./.github/workflows/build-workflow.yml
8787
with:
8888
config: --enable-nss
89+
pbkdf2:
90+
uses: ./.github/workflows/build-workflow.yml
91+
with:
92+
config: --enable-pbkdf2 --with-pbkdf2-iterations=1000
8993

9094
debug:
9195
uses: ./.github/workflows/build-workflow.yml

0 commit comments

Comments
 (0)