mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-18 04:39:06 +02:00
73 lines
2.4 KiB
Go
73 lines
2.4 KiB
Go
//go:build pkcs11 && linux && (amd64 || arm64)
|
|
|
|
package pkcs11
|
|
|
|
import (
|
|
"crypto/x509"
|
|
"os"
|
|
"testing"
|
|
"unsafe"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestStructLayoutsMatchTheCABI(t *testing.T) {
|
|
assert.Equal(t, uintptr(24), unsafe.Sizeof(attribute{}), "CK_ATTRIBUTE")
|
|
assert.Equal(t, uintptr(24), unsafe.Sizeof(mechanism{}), "CK_MECHANISM")
|
|
assert.Equal(t, uintptr(24), unsafe.Sizeof(pssParams{}), "CK_RSA_PKCS_PSS_PARAMS")
|
|
assert.Equal(t, uintptr(208), unsafe.Sizeof(tokenInfo{}), "CK_TOKEN_INFO")
|
|
assert.Equal(t, uintptr(48), unsafe.Sizeof(initializeArgs{}), "CK_C_INITIALIZE_ARGS")
|
|
assert.Equal(t, uintptr(8), unsafe.Offsetof(functionList{}.fn), "entry points follow the padded CK_VERSION")
|
|
assert.Equal(t, uintptr(8+68*8), unsafe.Sizeof(functionList{}), "CK_FUNCTION_LIST v2.40")
|
|
}
|
|
|
|
// TestTrustModule_ListsSystemCertificates drives a real module through the binding:
|
|
// p11-kit's trust module exposes the system CA store as certificate objects with no login.
|
|
func TestTrustModule_ListsSystemCertificates(t *testing.T) {
|
|
module := loadFirst(t,
|
|
"/usr/lib/pkcs11/p11-kit-trust.so",
|
|
"/usr/lib/x86_64-linux-gnu/pkcs11/p11-kit-trust.so",
|
|
"/usr/lib/aarch64-linux-gnu/pkcs11/p11-kit-trust.so",
|
|
"/usr/lib64/pkcs11/p11-kit-trust.so",
|
|
)
|
|
|
|
tokens, err := module.Tokens()
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, tokens, "the trust module must present at least one token")
|
|
|
|
parsed := 0
|
|
for _, token := range tokens {
|
|
session, err := module.OpenSession(token.Label, nil)
|
|
require.NoError(t, err, token.Label)
|
|
objects, err := session.FindObjects(
|
|
Attribute{Type: AttrClass, Value: ULong(ClassCertificate)},
|
|
Attribute{Type: AttrCertificateType, Value: ULong(CertificateX509)},
|
|
)
|
|
require.NoError(t, err, token.Label)
|
|
for _, object := range objects {
|
|
der, err := session.Attribute(object, AttrValue)
|
|
require.NoError(t, err)
|
|
_, err = x509.ParseCertificate(der)
|
|
require.NoError(t, err, "CKA_VALUE must be a DER certificate")
|
|
parsed++
|
|
}
|
|
session.Close()
|
|
}
|
|
assert.Positive(t, parsed, "system trust anchors must be readable through the binding")
|
|
}
|
|
|
|
func loadFirst(t *testing.T, paths ...string) *Module {
|
|
t.Helper()
|
|
for _, path := range paths {
|
|
if _, err := os.Stat(path); err != nil {
|
|
continue
|
|
}
|
|
module, err := Load(path)
|
|
require.NoError(t, err, path)
|
|
return module
|
|
}
|
|
t.Skip("p11-kit trust module not installed")
|
|
return nil
|
|
}
|