Skip to content

Commit 3f86660

Browse files
nickysemenzanickysemenza
committed
run HSM tests in CI
Resolves #334
1 parent 22b7f94 commit 3f86660

File tree

8 files changed

+94
-44
lines changed

8 files changed

+94
-44
lines changed

‎.github/workflows/go.yml

+16-2
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,22 @@ jobs:
1919
go-version: ${{ matrix.go }}
2020
- run: go install github.com/ory/go-acc@latest
2121
- run: go-acc -o coverage.txt ./... -- -race -tags integration
22-
- name: Go Test
23-
run: make test-trust
22+
- run: make test-trust
23+
- uses: codecov/codecov-action@v3
24+
test-hsm:
25+
runs-on: ubuntu-latest
26+
steps:
27+
- uses: actions/checkout@v3
28+
- name: Set up Go
29+
uses: actions/setup-go@v4
30+
with:
31+
go-version: stable
32+
- run: sudo apt-get update && sudo apt-get install -y softhsm2
33+
- run: sudo cp -r tests/testdata/tokens/* /var/lib/softhsm/tokens
34+
- run: go install github.com/ory/go-acc@latest
35+
- run: go-acc -o coverage.txt ./... -- -race -tags pkcs11
36+
env:
37+
TEST_SOFT_HSM: true
2438
- uses: codecov/codecov-action@v3
2539
lint:
2640
runs-on: ubuntu-latest

‎.vscode/settings.json

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"go.buildTags": "pkcs11"
3+
}

‎Makefile

+2-2
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,8 @@ lint:
9696

9797
.PHONY: test
9898
test:
99-
GODEBUG=cgocheck=2 go test -tags pkcs11 -v -cover -race ./...
100-
GODEBUG=cgocheck=2 go test -tags pkcs11 -v -cover -race ./tests -args -softhsm2
99+
GODEBUG=cgocheck=2 go test -tags pkcs11 -v -coverprofile=coverage.txt -covermode=atomic -race ./...
100+
GODEBUG=cgocheck=2 go test -tags pkcs11 -v -coverprofile=coverage.txt -covermode=atomic -race ./tests -args -softhsm2
101101

102102
.PHONY: test-nohsm
103103
test-nohsm:

‎README.md

+7-9
Original file line numberDiff line numberDiff line change
@@ -225,17 +225,15 @@ Each option can optionally be overridden via environment variables or command-li
225225

226226
Unit tests and benchmarks have been implemented for various parts of Go Keyless via `go test`. Most of the tests run out of the box, but some setup is necessary to run the HSM-related tests:
227227

228-
1. Follow https://wiki.opendnssec.org/display/SoftHSMDOCS/SoftHSM+Documentation+v2 to install SoftHSM2
228+
1. Follow https://wiki.opendnssec.org/display/SoftHSMDOCS/SoftHSM+Documentation+v2 to install SoftHSM2. On MacOS, the easiest is `brew isntall softhsm`
229229
1. Copy the test tokens to the location of your SoftHSM2 token directory (commonly `/var/lib/softhsm/tokens`, but may vary):
230+
```
231+
cp -r tests/testdata/tokens/* /opt/homebrew/var/lib/softhsm/tokens/
232+
```
233+
1. The tests currently assume the SoftHSM2 library will be installed at `/usr/lib/softhsm/libsofthsm2.so`. If your system differs, `SOFTHSM_MODULE_DIR` env var can override that.
230234

231-
$ cp -r tests/testdata/tokens/* /path/to/token/directory/
232-
233-
1. The tests currently assume the SoftHSM2 library will be installed at `/usr/local/lib/softhsm/libsofthsm2.so`. If your system differs, you must create a symlink (sudo may be required):
234-
235-
$ mkdir -p /usr/local/lib/softhsm
236-
$ ln -s /path/to/libsofthsm2.so /usr/local/lib/softhsm/libsofthsm2.so
237-
238-
Then simply run `make test` to execute the test suite.
235+
e.g. on MacOS with softhsm from brew:
236+
`SOFTHSM_MODULE_DIR=/opt/homebrew/opt/softhsm/lib/softhsm/libsofthsm2.so make test`
239237

240238
Note that if you need to run the tests without first configuring SoftHSM2 for some reason, you can use the `test-nohsm` target.
241239

‎internal/rfc7512/rfc7512.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -205,12 +205,12 @@ func LoadPKCS11Signer(pk11uri *PKCS11URI) (crypto.Signer, error) {
205205

206206
context, err := crypto11.Configure(config)
207207
if err != nil {
208-
return nil, err
208+
return nil, fmt.Errorf("pkcs11 FindKeyPair: %w", err)
209209
}
210210

211211
signer, err := context.FindKeyPair(pk11uri.ID, pk11uri.Object)
212212
if err != nil {
213-
return nil, err
213+
return nil, fmt.Errorf("pkcs11 Configure: %w", err)
214214
} else if signer == nil {
215215
return nil, fmt.Errorf("not found")
216216
}

‎internal/test/params/params.go

+12-3
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"crypto"
66
"crypto/elliptic"
77
"crypto/rsa"
8+
"os"
89

910
"github.com/cloudflare/gokeyless/protocol"
1011
)
@@ -51,13 +52,21 @@ var (
5152
ECDSASHA512Params = ECDSASignParams{Opcode: protocol.OpECDSASignSHA512, Curve: elliptic.P521(), Opts: crypto.SHA512, PayloadSize: 64}
5253
)
5354

54-
const (
55+
func getSoftHSMModulePath() string {
56+
if override := os.Getenv("SOFTHSM_MODULE_DIR"); override != "" {
57+
return override
58+
}
59+
return "/usr/lib/softhsm/libsofthsm2.so"
60+
61+
}
62+
63+
var (
5564
// RSAURI and ECDSAURI are sample PKCS #11 URIs used for testing HSM
5665
// Compatibility. Before running tests, copy the contents of the
5766
// testdata/tokens/ directory to your SoftHSM2 token directory, usually
5867
// located at /var/lib/softhsm/tokens/, and run `make test-softhsm`
59-
RSAURI = "pkcs11:token=SoftHSM2%20Token;id=%03?module-path=/usr/local/lib/softhsm/libsofthsm2.so&pin-value=1234"
60-
ECDSAURI = "pkcs11:token=SoftHSM2%20Token;id=%02?module-path=/usr/local/lib/softhsm/libsofthsm2.so&pin-value=1234"
68+
RSAURI = "pkcs11:token=SoftHSM2%20Token;id=%03?module-path=" + getSoftHSMModulePath() + "&pin-value=1234"
69+
ECDSAURI = "pkcs11:token=SoftHSM2%20Token;id=%02?module-path=" + getSoftHSMModulePath() + "&pin-value=1234"
6170
)
6271

6372
// HSMSignParams represents a set of parameters to a HSM signing operation.

‎server/microbench_test.go

+50-24
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
//go:build pkcs11
12
// +build pkcs11
23

34
package server
@@ -24,6 +25,9 @@ var testSoftHSM bool
2425

2526
func init() {
2627
flag.BoolVar(&testSoftHSM, "softhsm2", false, "whether to test against SoftHSM2")
28+
if os.Getenv("TEST_SOFT_HSM") == "true" {
29+
testSoftHSM = true
30+
}
2731
}
2832

2933
func TestMain(m *testing.M) {
@@ -234,11 +238,13 @@ func BenchmarkSignRSAMD5SHA1Multi(b *testing.B) { benchSignRSA(b, params.RSAMD5S
234238
func BenchmarkSignRSAMD5SHA1NotPrecomputed(b *testing.B) {
235239
benchSignRSA(b, params.RSAMD5SHA1Params, 2, false)
236240
}
237-
func BenchmarkSignRSASHA1(b *testing.B) { benchSignRSA(b, params.RSASHA1Params, 2, true) }
238-
func BenchmarkSignRSASHA1Multi(b *testing.B) { benchSignRSA(b, params.RSASHA1Params, 3, true) }
239-
func BenchmarkSignRSASHA1NotPrecomputed(b *testing.B) { benchSignRSA(b, params.RSASHA1Params, 2, false) }
240-
func BenchmarkSignRSASHA224(b *testing.B) { benchSignRSA(b, params.RSASHA224Params, 2, true) }
241-
func BenchmarkSignRSASHA224Multi(b *testing.B) { benchSignRSA(b, params.RSASHA224Params, 3, true) }
241+
func BenchmarkSignRSASHA1(b *testing.B) { benchSignRSA(b, params.RSASHA1Params, 2, true) }
242+
func BenchmarkSignRSASHA1Multi(b *testing.B) { benchSignRSA(b, params.RSASHA1Params, 3, true) }
243+
func BenchmarkSignRSASHA1NotPrecomputed(b *testing.B) {
244+
benchSignRSA(b, params.RSASHA1Params, 2, false)
245+
}
246+
func BenchmarkSignRSASHA224(b *testing.B) { benchSignRSA(b, params.RSASHA224Params, 2, true) }
247+
func BenchmarkSignRSASHA224Multi(b *testing.B) { benchSignRSA(b, params.RSASHA224Params, 3, true) }
242248
func BenchmarkSignRSASHA224NotPrecomputed(b *testing.B) {
243249
benchSignRSA(b, params.RSASHA224Params, 2, false)
244250
}
@@ -257,18 +263,24 @@ func BenchmarkSignRSASHA512Multi(b *testing.B) { benchSignRSA(b, params.RSASHA51
257263
func BenchmarkSignRSASHA512NotPrecomputed(b *testing.B) {
258264
benchSignRSA(b, params.RSASHA512Params, 2, false)
259265
}
260-
func BenchmarkSignRSAPSSSHA256(b *testing.B) { benchSignRSA(b, params.RSAPSSSHA256Params, 2, true) }
261-
func BenchmarkSignRSAPSSSHA256Multi(b *testing.B) { benchSignRSA(b, params.RSAPSSSHA256Params, 3, true) }
266+
func BenchmarkSignRSAPSSSHA256(b *testing.B) { benchSignRSA(b, params.RSAPSSSHA256Params, 2, true) }
267+
func BenchmarkSignRSAPSSSHA256Multi(b *testing.B) {
268+
benchSignRSA(b, params.RSAPSSSHA256Params, 3, true)
269+
}
262270
func BenchmarkSignRSAPSSSHA256NotPrecomputed(b *testing.B) {
263271
benchSignRSA(b, params.RSAPSSSHA256Params, 2, false)
264272
}
265-
func BenchmarkSignRSAPSSSHA384(b *testing.B) { benchSignRSA(b, params.RSAPSSSHA384Params, 2, true) }
266-
func BenchmarkSignRSAPSSSHA384Multi(b *testing.B) { benchSignRSA(b, params.RSAPSSSHA384Params, 3, true) }
273+
func BenchmarkSignRSAPSSSHA384(b *testing.B) { benchSignRSA(b, params.RSAPSSSHA384Params, 2, true) }
274+
func BenchmarkSignRSAPSSSHA384Multi(b *testing.B) {
275+
benchSignRSA(b, params.RSAPSSSHA384Params, 3, true)
276+
}
267277
func BenchmarkSignRSAPSSSHA384NotPrecomputed(b *testing.B) {
268278
benchSignRSA(b, params.RSAPSSSHA384Params, 2, false)
269279
}
270-
func BenchmarkSignRSAPSSSHA512(b *testing.B) { benchSignRSA(b, params.RSAPSSSHA512Params, 2, true) }
271-
func BenchmarkSignRSAPSSSHA512Multi(b *testing.B) { benchSignRSA(b, params.RSAPSSSHA512Params, 3, true) }
280+
func BenchmarkSignRSAPSSSHA512(b *testing.B) { benchSignRSA(b, params.RSAPSSSHA512Params, 2, true) }
281+
func BenchmarkSignRSAPSSSHA512Multi(b *testing.B) {
282+
benchSignRSA(b, params.RSAPSSSHA512Params, 3, true)
283+
}
272284
func BenchmarkSignRSAPSSSHA512NotPrecomputed(b *testing.B) {
273285
benchSignRSA(b, params.RSAPSSSHA512Params, 2, false)
274286
}
@@ -306,19 +318,33 @@ func BenchmarkSignParallelECDSASHA512(b *testing.B) {
306318
benchSignParallelECDSA(b, params.ECDSASHA512Params)
307319
}
308320

309-
func BenchmarkRandForSignRSAMD5SHA1(b *testing.B) { benchRandForSignRSA(b, params.RSAMD5SHA1Params) }
310-
func BenchmarkRandForSignRSASHA1(b *testing.B) { benchRandForSignRSA(b, params.RSASHA1Params) }
311-
func BenchmarkRandForSignRSASHA224(b *testing.B) { benchRandForSignRSA(b, params.RSASHA224Params) }
312-
func BenchmarkRandForSignRSASHA256(b *testing.B) { benchRandForSignRSA(b, params.RSASHA256Params) }
313-
func BenchmarkRandForSignRSASHA384(b *testing.B) { benchRandForSignRSA(b, params.RSASHA384Params) }
314-
func BenchmarkRandForSignRSASHA512(b *testing.B) { benchRandForSignRSA(b, params.RSASHA512Params) }
315-
func BenchmarkRandForSignRSAPSSSHA256(b *testing.B) { benchRandForSignRSA(b, params.RSAPSSSHA256Params) }
316-
func BenchmarkRandForSignRSAPSSSHA384(b *testing.B) { benchRandForSignRSA(b, params.RSAPSSSHA384Params) }
317-
func BenchmarkRandForSignRSAPSSSHA512(b *testing.B) { benchRandForSignRSA(b, params.RSAPSSSHA512Params) }
318-
func BenchmarkRandForSignECDSASHA224(b *testing.B) { benchRandForSignECDSA(b, params.ECDSASHA224Params) }
319-
func BenchmarkRandForSignECDSASHA256(b *testing.B) { benchRandForSignECDSA(b, params.ECDSASHA256Params) }
320-
func BenchmarkRandForSignECDSASHA384(b *testing.B) { benchRandForSignECDSA(b, params.ECDSASHA384Params) }
321-
func BenchmarkRandForSignECDSASHA512(b *testing.B) { benchRandForSignECDSA(b, params.ECDSASHA512Params) }
321+
func BenchmarkRandForSignRSAMD5SHA1(b *testing.B) { benchRandForSignRSA(b, params.RSAMD5SHA1Params) }
322+
func BenchmarkRandForSignRSASHA1(b *testing.B) { benchRandForSignRSA(b, params.RSASHA1Params) }
323+
func BenchmarkRandForSignRSASHA224(b *testing.B) { benchRandForSignRSA(b, params.RSASHA224Params) }
324+
func BenchmarkRandForSignRSASHA256(b *testing.B) { benchRandForSignRSA(b, params.RSASHA256Params) }
325+
func BenchmarkRandForSignRSASHA384(b *testing.B) { benchRandForSignRSA(b, params.RSASHA384Params) }
326+
func BenchmarkRandForSignRSASHA512(b *testing.B) { benchRandForSignRSA(b, params.RSASHA512Params) }
327+
func BenchmarkRandForSignRSAPSSSHA256(b *testing.B) {
328+
benchRandForSignRSA(b, params.RSAPSSSHA256Params)
329+
}
330+
func BenchmarkRandForSignRSAPSSSHA384(b *testing.B) {
331+
benchRandForSignRSA(b, params.RSAPSSSHA384Params)
332+
}
333+
func BenchmarkRandForSignRSAPSSSHA512(b *testing.B) {
334+
benchRandForSignRSA(b, params.RSAPSSSHA512Params)
335+
}
336+
func BenchmarkRandForSignECDSASHA224(b *testing.B) {
337+
benchRandForSignECDSA(b, params.ECDSASHA224Params)
338+
}
339+
func BenchmarkRandForSignECDSASHA256(b *testing.B) {
340+
benchRandForSignECDSA(b, params.ECDSASHA256Params)
341+
}
342+
func BenchmarkRandForSignECDSASHA384(b *testing.B) {
343+
benchRandForSignECDSA(b, params.ECDSASHA384Params)
344+
}
345+
func BenchmarkRandForSignECDSASHA512(b *testing.B) {
346+
benchRandForSignECDSA(b, params.ECDSASHA512Params)
347+
}
322348

323349
func BenchmarkRandParallelForSignRSAMD5SHA1(b *testing.B) {
324350
benchRandParallelForSignRSA(b, params.RSAMD5SHA1Params)

‎server/pkcs11.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ func DefaultLoadURI(uri string) (crypto.Signer, error) {
1717
// as waiting for network to be up.
1818
pk11uri, err := rfc7512.ParsePKCS11URI(uri)
1919
if err != nil {
20-
return nil, fmt.Errorf("failed to parse pkcs11: %w", err)
20+
return nil, fmt.Errorf("failed to parse pkcs11 from %s: %w", uri, err)
2121
}
2222

2323
signer, err := rfc7512.LoadPKCS11Signer(pk11uri)
2424
if err != nil {
25-
return nil, fmt.Errorf("failed to load pkcs11: %w", err)
25+
return nil, fmt.Errorf("failed to load pkcs11 from %s: %w", uri, err)
2626
}
2727
return signer, nil
2828
}

0 commit comments

Comments
 (0)