Aktualizr
C++ SOTA Client
keymanager_test.cc
1 #include <gtest/gtest.h>
2 #include <memory>
3 
4 #include "json/json.h"
5 
6 #include "crypto/keymanager.h"
7 #include "libaktualizr/config.h"
8 #include "storage/sqlstorage.h"
9 #include "utilities/utils.h"
10 
11 #ifdef BUILD_P11
12 #ifndef TEST_PKCS11_MODULE_PATH
13 #define TEST_PKCS11_MODULE_PATH "/usr/local/softhsm/libsofthsm2.so"
14 #endif
15 #endif
16 
17 /* Sign TUF metadata with RSA2048. */
18 TEST(KeyManager, SignTuf) {
19  std::string private_key = Utils::readFile("tests/test_data/priv.key");
20  std::string public_key = Utils::readFile("tests/test_data/public.key");
21  Config config;
22  config.uptane.key_type = KeyType::kRSA2048;
23  TemporaryDirectory temp_dir;
24  config.storage.path = temp_dir.Path();
25  auto storage = INvStorage::newStorage(config.storage);
26  storage->storePrimaryKeys(public_key, private_key);
27  KeyManager keys(storage, config.keymanagerConfig());
28 
29  Json::Value tosign_json;
30  tosign_json["mykey"] = "value";
31  Json::Value signed_json = keys.signTuf(tosign_json);
32  EXPECT_EQ(signed_json["signed"]["mykey"].asString(), "value");
33  EXPECT_EQ(signed_json["signatures"][0]["keyid"].asString(),
34  "6a809c62b4f6c2ae11abfb260a6a9a57d205fc2887ab9c83bd6be0790293e187");
35  EXPECT_NE(signed_json["signatures"][0]["sig"].asString().size(), 0);
36  EXPECT_EQ(signed_json["signatures"][0]["method"].asString(), "rsassa-pss");
37 }
38 
39 /* Sign TUF metadata with ED25519. */
40 TEST(KeyManager, SignED25519Tuf) {
41  std::string private_key =
42  "BD0A7539BD0365D7A9A3050390AD7B7C2033C58E354C5E0F42B9B611273BBA38BB9FFA4DCF35A89F6F40C5FA67998DD38B64A8459598CF3D"
43  "A93853388FDAC760";
44  std::string public_key = "BB9FFA4DCF35A89F6F40C5FA67998DD38B64A8459598CF3DA93853388FDAC760";
45  Config config;
46  config.uptane.key_type = KeyType::kED25519;
47  TemporaryDirectory temp_dir;
48  config.storage.path = temp_dir.Path();
49  auto storage = INvStorage::newStorage(config.storage);
50 
51  storage->storePrimaryKeys(public_key, private_key);
52  KeyManager keys(storage, config.keymanagerConfig());
53  keys.loadKeys();
54 
55  Json::Value tosign_json;
56  tosign_json["mykey"] = "value";
57  Json::Value signed_json = keys.signTuf(tosign_json);
58  EXPECT_EQ(signed_json["signed"]["mykey"].asString(), "value");
59  EXPECT_EQ(signed_json["signatures"][0]["keyid"].asString(),
60  "a6d0f6b52ae833175dd7724899507709231723037845715c7677670e0195f850");
61  EXPECT_NE(signed_json["signatures"][0]["sig"].asString().size(), 0);
62  EXPECT_EQ(signed_json["signatures"][0]["method"].asString(), "ed25519");
63 }
64 
65 TEST(KeyManager, InitFileEmpty) {
66  Config config;
67  TemporaryDirectory temp_dir;
68  config.storage.path = temp_dir.Path();
69  std::shared_ptr<INvStorage> storage = INvStorage::newStorage(config.storage);
70  KeyManager keys(storage, config.keymanagerConfig());
71 
72  EXPECT_TRUE(keys.getCaFile().empty());
73  EXPECT_TRUE(keys.getPkeyFile().empty());
74  EXPECT_TRUE(keys.getCertFile().empty());
75  keys.loadKeys();
76  EXPECT_TRUE(keys.getCaFile().empty());
77  EXPECT_TRUE(keys.getPkeyFile().empty());
78  EXPECT_TRUE(keys.getCertFile().empty());
79 }
80 
81 TEST(KeyManager, InitFileValid) {
82  Config config;
83  TemporaryDirectory temp_dir;
84  config.storage.path = temp_dir.Path();
85  std::shared_ptr<INvStorage> storage = INvStorage::newStorage(config.storage);
86  std::string ca = Utils::readFile("tests/test_data/prov/root.crt");
87  std::string pkey = Utils::readFile("tests/test_data/prov/pkey.pem");
88  std::string cert = Utils::readFile("tests/test_data/prov/client.pem");
89  storage->storeTlsCa(ca);
90  storage->storeTlsPkey(pkey);
91  storage->storeTlsCert(cert);
92  KeyManager keys(storage, config.keymanagerConfig());
93 
94  EXPECT_TRUE(keys.getCaFile().empty());
95  EXPECT_TRUE(keys.getPkeyFile().empty());
96  EXPECT_TRUE(keys.getCertFile().empty());
97  keys.loadKeys();
98  std::string ca_file = keys.getCaFile();
99  std::string pkey_file = keys.getPkeyFile();
100  std::string cert_file = keys.getCertFile();
101 
102  EXPECT_TRUE(boost::filesystem::exists(ca_file));
103  EXPECT_TRUE(boost::filesystem::exists(pkey_file));
104  EXPECT_TRUE(boost::filesystem::exists(cert_file));
105  EXPECT_FALSE(boost::filesystem::is_empty(ca_file));
106  EXPECT_FALSE(boost::filesystem::is_empty(pkey_file));
107  EXPECT_FALSE(boost::filesystem::is_empty(cert_file));
108  EXPECT_EQ(ca, Utils::readFile(ca_file));
109  EXPECT_EQ(pkey, Utils::readFile(pkey_file));
110  EXPECT_EQ(cert, Utils::readFile(cert_file));
111 }
112 
113 #ifdef BUILD_P11
114 /* Sign and verify a file with RSA via PKCS#11. */
115 TEST(KeyManager, SignTufPkcs11) {
116  Json::Value tosign_json;
117  tosign_json["mykey"] = "value";
118 
119  P11Config p11_conf;
120  p11_conf.module = TEST_PKCS11_MODULE_PATH;
121  p11_conf.pass = "1234";
122  p11_conf.uptane_key_id = "03";
123  Config config;
124  config.p11 = p11_conf;
125  config.uptane.key_source = CryptoSource::kPkcs11;
126 
127  TemporaryDirectory temp_dir;
128  config.storage.path = temp_dir.Path();
129  std::shared_ptr<INvStorage> storage = INvStorage::newStorage(config.storage);
130  KeyManager keys(storage, config.keymanagerConfig());
131 
132  EXPECT_GT(keys.UptanePublicKey().Value().size(), 0);
133  Json::Value signed_json = keys.signTuf(tosign_json);
134  EXPECT_EQ(signed_json["signed"]["mykey"].asString(), "value");
135  EXPECT_EQ(signed_json["signatures"][0]["keyid"].asString(),
136  "6a809c62b4f6c2ae11abfb260a6a9a57d205fc2887ab9c83bd6be0790293e187");
137  EXPECT_NE(signed_json["signatures"][0]["sig"].asString().size(), 0);
138 }
139 
140 /* Generate Uptane keys, use them for signing, and verify them. */
141 TEST(KeyManager, GenSignTufPkcs11) {
142  Json::Value tosign_json;
143  tosign_json["mykey"] = "value";
144 
145  P11Config p11_conf;
146  p11_conf.module = TEST_PKCS11_MODULE_PATH;
147  p11_conf.pass = "1234";
148  p11_conf.uptane_key_id = "06";
149  Config config;
150  config.p11 = p11_conf;
151  config.uptane.key_source = CryptoSource::kPkcs11;
152 
153  TemporaryDirectory temp_dir;
154  config.storage.path = temp_dir.Path();
155  std::shared_ptr<INvStorage> storage = INvStorage::newStorage(config.storage);
156  KeyManager keys(storage, config.keymanagerConfig());
157 
158  P11EngineGuard p11(config.p11);
159  EXPECT_TRUE(p11->generateUptaneKeyPair());
160 
161  EXPECT_GT(keys.UptanePublicKey().Value().size(), 0);
162  Json::Value signed_json = keys.signTuf(tosign_json);
163  EXPECT_EQ(signed_json["signed"]["mykey"].asString(), "value");
164  EXPECT_NE(signed_json["signatures"][0]["sig"].asString().size(), 0);
165 }
166 
167 /* Generate RSA keypairs via PKCS#11. */
168 TEST(KeyManager, InitPkcs11Valid) {
169  Config config;
170  P11Config p11_conf;
171  p11_conf.module = TEST_PKCS11_MODULE_PATH;
172  p11_conf.pass = "1234";
173  p11_conf.tls_pkey_id = "02";
174  p11_conf.tls_clientcert_id = "01";
175  config.p11 = p11_conf;
176  config.tls.ca_source = CryptoSource::kFile;
177  config.tls.pkey_source = CryptoSource::kPkcs11;
178  config.tls.cert_source = CryptoSource::kPkcs11;
179 
180  TemporaryDirectory temp_dir;
181  config.storage.path = temp_dir.Path();
182  std::shared_ptr<INvStorage> storage = INvStorage::newStorage(config.storage);
183  // Getting the CA from the HSM is not currently supported.
184  std::string ca = Utils::readFile("tests/test_data/prov/root.crt");
185  storage->storeTlsCa(ca);
186  KeyManager keys(storage, config.keymanagerConfig());
187  EXPECT_TRUE(keys.getCaFile().empty());
188  EXPECT_FALSE(keys.getPkeyFile().empty());
189  EXPECT_FALSE(keys.getCertFile().empty());
190  keys.loadKeys();
191  EXPECT_FALSE(keys.getCaFile().empty());
192  EXPECT_FALSE(keys.getPkeyFile().empty());
193  EXPECT_FALSE(keys.getCertFile().empty());
194 }
195 #endif
196 
197 #ifndef __NO_MAIN__
198 int main(int argc, char** argv) {
199  ::testing::InitGoogleTest(&argc, argv);
200  return RUN_ALL_TESTS();
201 }
202 #endif
KeyManager
Definition: keymanager.h:13
Config
Configuration object for an aktualizr instance running on a Primary ECU.
Definition: config.h:208
P11Config
Definition: config.h:28
TemporaryDirectory
Definition: utils.h:82
P11EngineGuard
Definition: p11engine.h:81
Generated by   doxygen 1.8.17