summaryrefslogtreecommitdiff
path: root/tests/pkcs11
Commit message (Collapse)AuthorAgeFilesLines
* pkcs11-mock: updated license based on upstream project [ci skip]Nikos Mavrogiannopoulos2019-09-202-20/+31
| | | | | | | | | Based on the relicense of the original project: https://github.com/Pkcs11Interop/pkcs11-mock Applied in commit: 8751256956e414c1b0a30414831f5083afbf64bf Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pkcs11: ignore login error when traversing tokensDaiki Ueno2019-07-111-0/+150
| | | | | | | | | | | | | | | If a token is a general access device, it is expected that login attempt to that token returns error: https://github.com/p11-glue/p11-kit/blob/master/trust/module.c#L852 On the other hand, _pkcs11_traverse_tokens treats the error as fatal and stops iteration. This behavior prevents object search without token specifier if such tokens are registered in the system. Reported by Stanislav Zidek in https://bugzilla.redhat.com/show_bug.cgi?id=1705478 Signed-off-by: Daiki Ueno <dueno@redhat.com>
* server auth: disable TLS 1.3 if no signature algorithm is usableDaiki Ueno2019-05-201-0/+375
| | | | | | | | | | This is a server side counterpart of 005a4d04145707daad9588acedfdb5f6cd97c80c. Instead of signalling an error when no algorithm is usable in TLS 1.3, it downgrades the session to TLS 1.2 with a warning. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* tests: add mock PKCS#11 module disabling RSA-PSSDaiki Ueno2019-04-071-0/+108
| | | | | | | | | This adds libpkcs11mock2.so, which wraps SoftHSM but filters out the use of the CKM_RSA_PKCS_PSS mechanism. That way we can simulate the situation where the certificate is RSA while the private key cannot be used for RSA-PSS. Signed-off-by: Daiki Ueno <dueno@redhat.com>
* Use https:// for www.gnu.org and www.example.comTim Rühsen2019-03-1311-11/+11
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* Remove redundant resets of variables after free()Tim Rühsen2019-02-225-8/+0
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* tests: added further checks for gnutls_pkcs11_token_get_infotmp-fix-uninitialized2Nikos Mavrogiannopoulos2019-02-141-2/+9
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Fix uninitialized warning in pkcs11.cTim Rühsen2019-02-141-0/+30
| | | | Signed-off-by: Tim Rühsen <tim.ruehsen@gmx.de>
* gnutls_pkcs11_privkey_import_url: enable RSA-PSS only when an RSA key can signtmp-key-rsa-pssNikos Mavrogiannopoulos2019-01-221-0/+8
| | | | | | | | | | | | In gnutls_pkcs11_privkey_import_url() we only enabled RSA-PSS functionality to the key if the CKM_RSA_PKCS_PSS mechanism is available to the token. However, if the specific key is not marked for use with digital signatures (CKA_SIGN set), then we may have still ended-up using it and fail when using it. We now test whether CKA_SIGN is set prior to enabling such keys for PSS. Resolves: #667 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Added test about rsa decryption under pkcs11Nikos Mavrogiannopoulos2018-11-301-6/+22
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added TLS1.3 tests for PKCS#11 and external key typesNikos Mavrogiannopoulos2018-11-191-0/+53
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Add support for EDDSA/Ed25519 object support via PKCS#11Simo Sorce2018-11-192-3/+276
| | | | | | | | | Tested with softHSM 2.5.0 Resolves #417 Signed-off-by: Simo Sorce <simo@redhat.com> Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* Fix RSA-PSS tests to properly return skip valueSimo Sorce2018-11-191-2/+1
| | | | Signed-off-by: Simo Sorce <simo@redhat.com>
* pkcs11 uris: the URI scheme is case insensitivetmp-urisNikos Mavrogiannopoulos2018-10-121-2/+8
| | | | | | | | | | | Makes the comparisons of the URI scheme to use c_strcasecmp from gnulib. It also replaces various straw strcasecmp with the gnulib variant. This ensures that comparison will be reliable irrespective of the locale. Resolves #590 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* Fix two typos (overriden/guarranteed)Andreas Metzler2018-08-163-3/+3
| | | | Signed-off-by: Andreas Metzler <ametzler@bebt.de>
* Add gost certificates to chainverify testsDmitry Eremin-Solenikov2018-06-231-0/+6
| | | | Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
* gnutls_pkcs11_token_get_ptr, gnutls_pkcs11_obj_get_ptr: introducedNikos Mavrogiannopoulos2018-05-212-0/+326
| | | | | | | | | This allows an application to open a PKCS#11 token using a URI, and use it directly, bypassing gnutls. That is useful to take advantage of PKCS#11 functionality not wrapped by gnutls but still use PKCS#11 URIs to identify the token. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* pcert: added functionality to retrieve listsNikos Mavrogiannopoulos2018-05-122-0/+443
| | | | | | | | | That introduces gnutls_pcert_list_import_x509_file() and gnutls_x509_crt_list_import_url(). Resolves #373 Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* pkcs11: mark private key objects as sensitive by defaulttmp-pkcs11-sensitive-fixNikos Mavrogiannopoulos2018-05-031-0/+170
| | | | | | | That is, to prevent accidentally creating objects which can be exported. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* retrieve_pin: refuse to retrieve PIN from URI more than one timeNikos Mavrogiannopoulos2018-04-251-3/+26
| | | | | | | | | That is, prevent re-using a static PIN if it has already been known to be wrong. Introduced tests of that behavior. Resolves #425 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* signatures: distinguish RSA-PSS signatures with RSA PKCS#1 1.5 certificates ↵Nikos Mavrogiannopoulos2018-03-091-1/+1
| | | | | | | | | | | | | | | | | from "pure" This change enhances signature algorithms to have a private key algorithm parameter. That is, to allow signature algorithms operating with a private key of type X while the public key is of type Y. That is useful for the RSA-PSS signatures which are of two types; one which is seen from servers having PKCS#1 1.5 certificates, the other with RSA-PSS certificates, while both utilize RSA-PSS private keys. This is a draft-ietf-tls-tls13-23 change. Resolves #400 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: eliminated destructive teststmp-simplify-nettle-checkNikos Mavrogiannopoulos2018-03-021-3/+16
| | | | | | That adds a dependency to p11-kit 0.23.10 for the test suite. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: pkcs11/tls-neg-pkcs11-key: updated for softhsm with PKCS#11 supportNikos Mavrogiannopoulos2018-01-221-12/+19
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: p11-kit-load.sh: verify that all modules are loaded after a private ↵Nikos Mavrogiannopoulos2017-12-031-1/+9
| | | | | | key operation Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: enhanced pkcs11/list-tokensNikos Mavrogiannopoulos2017-12-031-4/+12
| | | | | | | | | This not only creates a trust list with the system certificates, but also attempts to verify a certificate, increasing the number of calls to PKCS#11 verification API (and thus ensuring there are no calls which may trigger the load of other modules). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: removed unnecessary assertNikos Mavrogiannopoulos2017-11-241-1/+0
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: list-tokens: not only list but also verify whether module is operationalNikos Mavrogiannopoulos2017-11-031-0/+15
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: enhanced PKCS#11 loading testNikos Mavrogiannopoulos2017-11-031-0/+6
| | | | | | | | Test whether implicit initialization in trusted module (e.g., via verification), would result to proper initialization of additional modules once a PCKS#11 function is called. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added PKCS#11 module loading testNikos Mavrogiannopoulos2017-11-031-0/+117
| | | | | | | | | | | | | | | | | | This checks: 1. Whether all modules are loaded from p11-kit when no explicit gnutls_pkcs11_init() is called and pkcs11 calls are accessed. 2. Whether only the trusted modules are loaded from p11-kit and no other PKCS#11 calls than PKCS#11 cert validation is performed. 3. Whether the trusted modules are loaded when gnutls_pkcs11_init() is called with manual flag. Resolves #315 Resolves #316 Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added TLS negotiation with various keys under PKCS#11Nikos Mavrogiannopoulos2017-08-041-0/+373
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added basic unit test of gnutls_pkcs11_token_check_mechanismNikos Mavrogiannopoulos2017-08-041-0/+12
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for RSA-PSS signing over PKCS#11Nikos Mavrogiannopoulos2017-08-031-0/+272
| | | | | | This requires a softhsm with support for RSA_PKCS_PSS mechanism. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: pkcs11-mock: reset state when requesting reauthNikos Mavrogiannopoulos2017-06-171-1/+4
| | | | | | | | That is, for the MOCK_FLAG_SAFENET_ALWAYS_AUTH flag we ensure that GetSessionInfo() will return the right state when authentication is required for the first time. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: added unit test for safenet protectserver HSM's PKCS#11 supporttmp-handle-safenet-hsmsNikos Mavrogiannopoulos2017-06-163-10/+219
| | | | | | | That is, detect whether the absence of C_Login will fallback to CKU_USER after CKU_CONTEXT_SPECIFIC is tried. Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: pkcs11-mock lib: check object session sanity prior to using itNikos Mavrogiannopoulos2017-03-131-34/+33
| | | | | | | This avoids crashes when the object is used after a fork but prior to the session being re-established. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit tests for gnutls_pkcs11_token_get_mechanismNikos Mavrogiannopoulos2017-03-131-0/+108
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: included unit test for gnutls_pkcs11_obj_exportNikos Mavrogiannopoulos2017-03-131-1/+11
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for gnutls_pkcs11_reinit()Nikos Mavrogiannopoulos2017-03-131-0/+167
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit tests for gnutls_pkcs11_obj_get_infoNikos Mavrogiannopoulos2017-03-131-0/+242
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added unit test for gnutls_pkcs11_get_pin_functionNikos Mavrogiannopoulos2017-03-131-0/+59
| | | | Signed-off-by: Nikos Mavrogiannopoulos <nmav@gnutls.org>
* tests: introduced check for parallel operation (signatures) in PKCS#11 modeNikos Mavrogiannopoulos2017-03-131-0/+195
| | | | | | | That is, verify that parallel signatures using a single gnutls_pkcs11_privkey_t context work. Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: pkcs11-import-with-pin: removed invalid conditional macroNikos Mavrogiannopoulos2017-02-221-4/+0
|
* tests: added PKCS#11 test for pin inputNikos Mavrogiannopoulos2017-02-221-0/+198
| | | | | | | This introduces a test on PIN input to retrieve an object using pin-value and pin-source (file). Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>
* tests: added pkcs11-privkey-exporttmp-pkcs11-tests-updateNikos Mavrogiannopoulos2016-10-201-0/+157
| | | | | This checks whether the public parts of RSA private and public keys can be properly extracted from a PKCS#11 module.
* Expose CKA_PUBLIC_EXPONENT and CKA_MODULUS for private keys tooJakub Jelen2016-10-201-2/+4
|
* tests/pkcs11: Return also CKA_CLASSJakub Jelen2016-10-201-0/+12
|
* tests/pkcs11: Expose SUBJECT for certificates, PUBLIC_EXPONENT and MODULUS ↵Jakub Jelen2016-10-201-0/+59
| | | | for public keys to widen compatibility
* tests: added test for CKA_ALWAYS_AUTHENTICATE handling in PKCS#11Nikos Mavrogiannopoulos2016-10-033-1/+241
| | | | | This checks whether GnuTLS properly calls login prior to any sign operations when the object is marked as CKA_ALWAYS_AUTHENTICATE.
* removed assert.h from files that wasn't used atNikos Mavrogiannopoulos2016-09-113-3/+0
|
* tests/tools: avoid non-null check before free()Nikos Mavrogiannopoulos2016-09-111-2/+1
|
View Lorry Controller Status