Factor SoftHSM configuration setup into _SetupSoftHsm(). Use it for tests testPkcs11SignedCapsuleGen(), testFitSignPKCS11Simple() and testFitSignPKCS11Object().
Signed-off-by: Lorenz Kofler <[email protected]> --- Changes in v2: - New patch: share SoftHSM setup between tests. tools/binman/ftest.py | 89 +++++++++++++++++++------------------------ 1 file changed, 39 insertions(+), 50 deletions(-) diff --git a/tools/binman/ftest.py b/tools/binman/ftest.py index 4002f6837f4..f5eb895475f 100644 --- a/tools/binman/ftest.py +++ b/tools/binman/ftest.py @@ -5937,6 +5937,38 @@ def testPreLoadEncryptedFit(self): self.assertEqual(PRE_LOAD_HDR_SIZE, data[8:8 + len(PRE_LOAD_HDR_SIZE)]) self.assertEqual(is_signed, True) + def _SetupSoftHsm(self, softhsm2_util, prefix, private_key, + token='U-Boot token', label='test_key', pin='1111'): + """Set up a SoftHSM token containing a private key + + Args: + softhsm2_util (Bintool): SoftHSM bintool to use for token setup + prefix (str): Prefix for the files created in the input directory + private_key (str): Filename of the private key to import + token (str): Token label + label (str): Private-key object label + pin (str): User PIN for the token + + Returns: + str: Filename of the SoftHSM configuration file + """ + data = tools.read_file(self.TestFile('fit/softhsm2.conf')) + softhsm2_tokens_dir = self._MakeInputDir(f'{prefix}softhsm2.tokens') + softhsm2_conf = self._MakeInputFile( + f'{prefix}softhsm2.conf', + data + f'directories.tokendir = {softhsm2_tokens_dir}\n'.encode()) + + with unittest.mock.patch.dict('os.environ', + {'SOFTHSM2_CONF': softhsm2_conf}): + softhsm2_util.run_cmd('--init-token', '--free', '--label', + token, '--pin', pin, + '--so-pin', '222222') + softhsm2_util.run_cmd('--import', private_key, + '--token', token, '--label', + label, '--id', '999999', '--pin', pin) + + return softhsm2_conf + def _CheckSafeUniqueNames(self, *images): """Check all entries of given images for unsafe unique names""" for image in images: @@ -7593,14 +7625,8 @@ def testPkcs11SignedCapsuleGen(self): pkcs11_tool = bintool.Bintool.create('pkcs11-tool') self._CheckBintool(pkcs11_tool) - prefix = "testPkcs11SignedCapsuleGen." - # Configure SoftHSMv2 - data = tools.read_file(self.TestFile('fit/softhsm2.conf')) - softhsm2_conf = self._MakeInputFile(f'{prefix}softhsm2.conf', data) - softhsm2_tokens_dir = self._MakeInputDir(f'{prefix}softhsm2.tokens') - - with open(softhsm2_conf, 'a') as f: - f.write(f'directories.tokendir = {softhsm2_tokens_dir}\n') + softhsm2_conf = self._SetupSoftHsm( + softhsm2_util, 'testPkcs11SignedCapsuleGen.', private_key) # Find the path to softhsm2 library p11_kit = bintool.Bintool.create('p11-kit') @@ -7616,16 +7642,10 @@ def testPkcs11SignedCapsuleGen(self): with unittest.mock.patch.dict('os.environ', {'SOFTHSM2_CONF': softhsm2_conf, 'PKCS11_MODULE_PATH': softhsm2_lib}): - softhsm2_util.run_cmd('--init-token', '--free', '--label', - 'U-Boot token', '--pin', '1111', - '--so-pin', '222222') pkcs11_tool.run_cmd('--module', softhsm2_lib, '--write-object', cert_file, '--pin', '1111', '--type', 'cert', '--id', '999999', '--label', 'test_cert', '--login') - softhsm2_util.run_cmd('--import', private_key, '--token', - 'U-Boot token', '--label', 'test_key', - '--id', '999999', '--pin', '1111') data = self._DoReadFile('capsule/signed_pkcs11.dts') self._CheckCapsule(data, signed_capsule=True) @@ -8359,26 +8379,10 @@ def testFitSignPKCS11Simple(self): self.skipTest('PKCS11 engine setup not functional, ' 'did you install libengine-pkcs11-openssl?') - prefix = "testFitSignPKCS11Simple." - # Configure SoftHSMv2 - data = tools.read_file(self.TestFile('fit/softhsm2.conf')) - softhsm2_conf = self._MakeInputFile(f'{prefix}softhsm2.conf', data) - softhsm2_tokens_dir = self._MakeInputDir(f'{prefix}softhsm2.tokens') - - with open(softhsm2_conf, 'a') as f: - f.write(f'directories.tokendir = {softhsm2_tokens_dir}\n') - # Generate pubkey DTB with random RSA4096 key _, _, private_key, pubkey_dtb = self._PrepareSignEnv() - - with unittest.mock.patch.dict('os.environ', - {'SOFTHSM2_CONF': softhsm2_conf}): - softhsm2_util.run_cmd('--init-token', '--free', '--label', - 'U-Boot token', '--pin', '1111', - '--so-pin', '222222') - softhsm2_util.run_cmd('--import', private_key, '--token', - 'U-Boot token', '--label', 'test_key', - '--id', '999999', '--pin', '1111') + softhsm2_conf = self._SetupSoftHsm( + softhsm2_util, 'testFitSignPKCS11Simple.', private_key) # Make sure the private key can only be accessed through the engine os.remove(private_key) @@ -8434,26 +8438,11 @@ def testFitSignPKCS11Object(self): self.skipTest('PKCS11 engine setup not functional, ' 'did you install libengine-pkcs11-openssl?') - prefix = "testFitSignPKCS11Object." - # Configure SoftHSMv2 - data = tools.read_file(self.TestFile('fit/softhsm2.conf')) - softhsm2_conf = self._MakeInputFile(f'{prefix}softhsm2.conf', data) - softhsm2_tokens_dir = self._MakeInputDir(f'{prefix}softhsm2.tokens') - - with open(softhsm2_conf, 'a') as f: - f.write(f'directories.tokendir = {softhsm2_tokens_dir}') - # Generate pubkey DTB with random RSA4096 key _, _, private_key, pubkey_dtb = self._PrepareSignEnv() - - with unittest.mock.patch.dict('os.environ', - {'SOFTHSM2_CONF': softhsm2_conf}): - softhsm2_util.run_cmd('--init-token', '--free', '--label', - 'U-Boot prod token', '--pin', '1234', - '--so-pin', '222222') - softhsm2_util.run_cmd('--import', private_key, '--token', - 'U-Boot prod token', '--label', 'prod', - '--id', '999999', '--pin', '1234') + softhsm2_conf = self._SetupSoftHsm( + softhsm2_util, 'testFitSignPKCS11Object.', private_key, + token='U-Boot prod token', label='prod', pin='1234') # Make sure the private key can only be accessed through the engine os.remove(private_key) -- 2.55.0
