Skip to content

Commit f9ac82a

Browse files
aidangarskeaidangarske
authored
Merge pull request #170 from padelsbach/wp_pam_pkcs11
2 parents 9d09b05 + 23d1b29 commit f9ac82a

File tree

2 files changed

+224
-0
lines changed

2 files changed

+224
-0
lines changed

‎.github/scripts/pam-pkcs11-test.sh‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
echo "[*] Setting up environment..."
5+
SCRIPT_PATH="$(cd "$(dirname "$0")" && pwd)/$(basename "$0")"
6+
REPO_ROOT=$(git -C "$(dirname "$SCRIPT_PATH")" rev-parse --show-toplevel)
7+
source $REPO_ROOT/scripts/env-setup || true
8+
9+
if [[ -z "${OPENSSL_MODULES:-}" ]]; then
10+
echo "Environment not set up: OPENSSL_MODULES is not defined or empty"
11+
exit 1
12+
elif [[ ! -d "$OPENSSL_MODULES" ]]; then
13+
echo "Could not find wolfProvider at $OPENSSL_MODULES"
14+
echo "Please build it first..."
15+
exit 1
16+
fi
17+
18+
echo "[*] Installing build dependencies..."
19+
apt-get update
20+
DEBIAN_FRONTEND=noninteractive apt-get install -y \
21+
git \
22+
build-essential \
23+
autotools-dev \
24+
autoconf \
25+
libtool \
26+
pkg-config \
27+
libpam0g-dev \
28+
libnss3-dev \
29+
libpcsclite-dev \
30+
opensc \
31+
softhsm2 \
32+
pcscd \
33+
pcsc-tools \
34+
sudo \
35+
systemd \
36+
ssh \
37+
vim \
38+
gnupg \
39+
wget \
40+
curl
41+
42+
echo "[*] Cloning pam_pkcs11..."
43+
cd /opt
44+
if [[ ! -d "pam_pkcs11" ]]; then
45+
git clone https://github.com/OpenSC/pam_pkcs11.git
46+
fi
47+
cd pam_pkcs11
48+
49+
echo "[*] Building pam_pkcs11 from source..."
50+
./bootstrap
51+
./configure --prefix=/usr --sysconfdir=/etc --with-pam-dir=/lib/security --disable-nls
52+
make -j"$(nproc)"
53+
make install
54+
55+
echo "[*] Creating test user..."
56+
if ! id -u testuser &>/dev/null; then
57+
useradd -m testuser
58+
echo 'testuser:testpass' | chpasswd
59+
echo "[*] Created user 'testuser'"
60+
else
61+
echo "[*] User 'testuser' already exists, skipping creation"
62+
fi
63+
64+
echo "[*] Configuring pam_pkcs11..."
65+
66+
# Generate dummy CA cert if missing
67+
if [ ! -f /test/certs/test-ca.crt ]; then
68+
echo "[*] Generating dummy test-ca.crt..."
69+
mkdir -p /test/certs
70+
openssl req -x509 -newkey rsa:2048 -nodes \
71+
-keyout /test/certs/test-ca.key \
72+
-out /test/certs/test-ca.crt \
73+
-days 365 -subj "/CN=Test CA/O=Example"
74+
fi
75+
76+
mkdir -p /etc/pam_pkcs11/cacerts
77+
cp /test/certs/test-ca.crt /etc/pam_pkcs11/cacerts/
78+
pkcs11_make_hash_link /etc/pam_pkcs11/cacerts/
79+
80+
# Generate test certificate and key if missing
81+
if [ ! -f /test/certs/test-cert.pem ]; then
82+
echo "[*] Generating test-cert.pem and key..."
83+
mkdir -p /test/certs
84+
openssl req -newkey rsa:2048 -nodes \
85+
-keyout /test/certs/test-key.pem \
86+
-x509 -days 365 -out /test/certs/test-cert.pem \
87+
-subj "/CN=Test User/OU=Testing/O=Example Corp/C=US"
88+
fi
89+
90+
# Extract cert subject in one-line format suitable for pam_pkcs11
91+
CERT_SUBJECT=$(openssl x509 -in /test/certs/test-cert.pem -noout -subject -nameopt oneline | sed 's/subject=//')
92+
93+
echo "[*] Writing pkcs11_mapper.map with subject: $CERT_SUBJECT"
94+
95+
echo "subject=$CERT_SUBJECT; uid=testuser" | tee /etc/pam_pkcs11/pkcs11_mapper.map > /dev/null
96+
97+
# Backup and modify PAM config
98+
cp /etc/pam.d/common-auth /etc/pam.d/common-auth.bak
99+
echo "auth sufficient pam_pkcs11.so debug" | tee /etc/pam.d/common-auth > /dev/null
100+
cat /etc/pam.d/common-auth.bak | tee -a /etc/pam.d/common-auth > /dev/null
101+
102+
echo "[*] Initializing SoftHSM (simulated smartcard)..."
103+
mkdir -p /var/lib/softhsm/tokens
104+
softhsm2-util --init-token --free --label "testtoken" --pin 1234 --so-pin 123456
105+
106+
echo "[*] Importing test certificate into SoftHSM..."
107+
pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so \
108+
--login --pin 1234 --write-object /test/certs/test-cert.pem --type cert --label "testcert"
109+
110+
echo "[*] Starting pcscd..."
111+
if ps aux | grep '[p]cscd' > /dev/null; then
112+
echo "pcscd is already running"
113+
else
114+
echo "pcscd is not running, starting it now..."
115+
pcscd &
116+
fi
117+
118+
echo "[*] Creating pam_pkcs11.conf..."
119+
if [ -f "./etc/pam_pkcs11.conf.example" ]; then
120+
cp ./etc/pam_pkcs11.conf.example /etc/pam_pkcs11/pam_pkcs11.conf
121+
else
122+
echo "ERROR: pam_pkcs11.conf.example not found in current directory"
123+
exit 1
124+
fi
125+
126+
echo "[*] Configuring pam_pkcs11.conf for SoftHSM module..."
127+
128+
# Set correct module usage line
129+
sed -i 's|^use_pkcs11_module.*|use_pkcs11_module = softhsm;|' /etc/pam_pkcs11/pam_pkcs11.conf
130+
131+
# Set the SoftHSM module path
132+
sed -i '/^pkcs11_module softhsm {/,/^}/ s|^\s*module\s*=.*| module = /usr/lib/softhsm/libsofthsm2.so;|' /etc/pam_pkcs11/pam_pkcs11.conf
133+
134+
echo "[*] Checking SoftHSM PKCS#11 module dependencies..."
135+
ldd /usr/lib/softhsm/libsofthsm2.so | tee /tmp/libsofthsm2.ldd
136+
if grep -q "not found" /tmp/libsofthsm2.ldd; then
137+
echo "ERROR: Missing dependencies for SoftHSM PKCS#11 module!"
138+
exit 1
139+
fi
140+
141+
echo "[*] Testing SoftHSM PKCS#11 module loadability with pkcs11-tool..."
142+
if ! pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so -L; then
143+
echo "ERROR: Failed to load SoftHSM PKCS#11 module"
144+
exit 1
145+
fi
146+
147+
echo "[*] Testing login via su..."
148+
su testuser -c 'echo "✅ Logged in as testuser"'
149+
150+
echo "[*] All done."

‎.github/workflows/pam_pkcs11.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: pam_pkcs11 Tests
2+
3+
# START OF COMMON SECTION
4+
on:
5+
push:
6+
branches: [ 'master', 'main', 'release/**' ]
7+
pull_request:
8+
branches: [ '*' ]
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
# END OF COMMON SECTION
14+
15+
jobs:
16+
build_wolfprovider:
17+
uses: ./.github/workflows/build-wolfprovider.yml
18+
with:
19+
wolfssl_ref: ${{ matrix.wolfssl_ref }}
20+
openssl_ref: ${{ matrix.openssl_ref }}
21+
strategy:
22+
matrix:
23+
wolfssl_ref: [ 'master', 'v5.8.0-stable' ]
24+
openssl_ref: [ 'openssl-3.5.0' ]
25+
26+
test_pam_pkcs11:
27+
runs-on: ubuntu-22.04
28+
needs: build_wolfprovider
29+
# This should be a safe limit for the tests to run.
30+
timeout-minutes: 20
31+
strategy:
32+
matrix:
33+
pam_pkcs11_ref: [ 'master', 'pam_pkcs11-0.6.12' ]
34+
wolfssl_ref: [ 'master', 'v5.8.0-stable' ]
35+
openssl_ref: [ 'openssl-3.5.0' ]
36+
force_fail: [ 'WOLFPROV_FORCE_FAIL=1', '' ]
37+
exclude:
38+
- curl_ref: 'master'
39+
force_fail: 'WOLFPROV_FORCE_FAIL=1'
40+
steps:
41+
# Checkout the source so we can run the check-workflow-result script
42+
- name: Checkout wolfProvider
43+
uses: actions/checkout@v4
44+
with:
45+
fetch-depth: 1
46+
47+
- name: Retrieving wolfSSL/wolfProvider from cache
48+
uses: actions/cache/restore@v4
49+
id: wolfprov-cache
50+
with:
51+
path: |
52+
wolfssl-install
53+
wolfprov-install
54+
openssl-install/lib64
55+
openssl-install/include
56+
openssl-install/bin
57+
58+
key: wolfprov-${{ matrix.wolfssl_ref }}-${{ matrix.openssl_ref }}-${{ github.sha }}
59+
fail-on-cache-miss: true
60+
61+
- name: Run pam_pkcs11 tests
62+
run: |
63+
# Setup environment variables
64+
source $GITHUB_WORKSPACE/scripts/env-setup
65+
66+
# Run tests
67+
if timeout 300 ${{ matrix.force_fail }} sudo bash -c $GITHUB_WORKSPACE/.github/scripts/pam-pkcs11-test.sh; then
68+
TEST_RESULT=0
69+
else
70+
TEST_RESULT=1
71+
fi
72+
73+
# Capture result
74+
$GITHUB_WORKSPACE/.github/scripts/check-workflow-result.sh $TEST_RESULT ${{ matrix.force_fail }} pam_pkcs11

0 commit comments

Comments
 (0)