From 393ab5e5f6718352fac32dff839d84a70f8fd5e6 Mon Sep 17 00:00:00 2001 From: "mek.kiatkrai" Date: Tue, 11 Aug 2020 11:47:29 +0700 Subject: [PATCH 1/3] Add FindAllCertificates method --- certificates.go | 55 ++++++++++++++++++++++++++++++++++++++++++++ certificates_test.go | 25 ++++++++++++++++++++ 2 files changed, 80 insertions(+) diff --git a/certificates.go b/certificates.go index e703847..eb4e61c 100644 --- a/certificates.go +++ b/certificates.go @@ -96,6 +96,61 @@ func (c *Context) FindCertificate(id []byte, label []byte, serial *big.Int) (*x5 return cert, err } +// FindAllCertificates retrieves all certificates or a nil slice if none can be found. +func (c *Context) FindAllCertificates() ([]*x509.Certificate, error) { + + if c.closed.Get() { + return nil, errClosed + } + + var certs []*x509.Certificate + err := c.withSession(func(session *pkcs11Session) (err error) { + + var template []*pkcs11.Attribute + template = append(template, pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_CERTIFICATE)) + + if err = session.ctx.FindObjectsInit(session.handle, template); err != nil { + return err + } + defer func() { + finalErr := session.ctx.FindObjectsFinal(session.handle) + if err == nil { + err = finalErr + } + }() + + handles, _, err := session.ctx.FindObjects(session.handle, maxHandlePerFind) + if err != nil { + return err + } + if len(handles) == 0 { + return nil + } + + for _, handle := range handles { + attributes := []*pkcs11.Attribute{ + pkcs11.NewAttribute(pkcs11.CKA_VALUE, 0), + } + + if attributes, err = session.ctx.GetAttributeValue(session.handle, handle, attributes); err != nil { + return err + } + + cert, err := x509.ParseCertificate(attributes[0].Value) + if err != nil { + return err + } + certs = append(certs, cert) + } + return nil + }) + + if err != nil { + return nil, err + } + return certs, err +} + // ImportCertificate imports a certificate onto the token. The id parameter is used to // set CKA_ID and must be non-nil. func (c *Context) ImportCertificate(id []byte, certificate *x509.Certificate) error { diff --git a/certificates_test.go b/certificates_test.go index cade98f..1879d26 100644 --- a/certificates_test.go +++ b/certificates_test.go @@ -35,6 +35,31 @@ import ( "github.com/stretchr/testify/require" ) +func TestFindAllCertificates(t *testing.T) { + skipTest(t, skipTestCert) + + ctx, err := ConfigureFromFile("config") + require.NoError(t, err) + + defer func() { + require.NoError(t, ctx.Close()) + }() + + for i := 0; i < 5; i++ { + id := randomBytes() + label := randomBytes() + + cert := generateRandomCert(t) + + err = ctx.ImportCertificateWithLabel(id, label, cert) + require.NoError(t, err) + } + + gotCerts, err := ctx.FindAllCertificates() + require.NoError(t, err) + require.True(t, len(gotCerts) > 5) +} + func TestCertificate(t *testing.T) { skipTest(t, skipTestCert) From 180115d314a55343616eeac591c0da757f6a3d51 Mon Sep 17 00:00:00 2001 From: "mek.kiatkrai" Date: Tue, 11 Aug 2020 12:27:23 +0700 Subject: [PATCH 2/3] Remove all certificates after complete each certificate test case --- certificates_test.go | 41 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/certificates_test.go b/certificates_test.go index 1879d26..506c916 100644 --- a/certificates_test.go +++ b/certificates_test.go @@ -27,6 +27,7 @@ import ( "crypto/x509" "crypto/x509/pkix" "encoding/asn1" + "github.com/miekg/pkcs11" "math/big" "testing" "time" @@ -57,7 +58,9 @@ func TestFindAllCertificates(t *testing.T) { gotCerts, err := ctx.FindAllCertificates() require.NoError(t, err) - require.True(t, len(gotCerts) > 5) + require.Len(t, gotCerts, 5) + + removeAllCertificates(t, ctx) } func TestCertificate(t *testing.T) { @@ -93,6 +96,8 @@ func TestCertificate(t *testing.T) { require.NotNil(t, cert2) assert.Equal(t, cert.Signature, cert2.Signature) + + removeAllCertificates(t, ctx) } // Test that provided attributes override default values @@ -129,6 +134,8 @@ func TestCertificateAttributes(t *testing.T) { // Find with new serial c, err = ctx.FindCertificate(nil, nil, ourSerial) assert.NotNil(t, c) + + removeAllCertificates(t, ctx) } func TestCertificateRequiredArgs(t *testing.T) { @@ -153,6 +160,8 @@ func TestCertificateRequiredArgs(t *testing.T) { err = ctx.ImportCertificateWithLabel(val, val, nil) require.Error(t, err) + + removeAllCertificates(t, ctx) } func generateRandomCert(t *testing.T) *x509.Certificate { @@ -183,3 +192,33 @@ func generateRandomCert(t *testing.T) *x509.Certificate { return cert } + +func removeAllCertificates(t *testing.T, c *Context) { + if c.closed.Get() { + t.Error(errClosed) + } + + err := c.withSession(func(session *pkcs11Session) (err error) { + + var template []*pkcs11.Attribute + template = append(template, pkcs11.NewAttribute(pkcs11.CKA_CLASS, pkcs11.CKO_CERTIFICATE)) + + if e := session.ctx.FindObjectsInit(session.handle, template); e != nil { + t.Fatalf("failed to init: %s\n", e) + } + objs, _, e := session.ctx.FindObjects(session.handle, maxHandlePerFind) + if e != nil || len(objs) == 0 { + t.Fatalf("failed to find objects") + } + if e := session.ctx.FindObjectsFinal(session.handle); e != nil { + t.Fatalf("failed to finalize: %s\n", e) + } + for _, obj := range objs { + if e := session.ctx.DestroyObject(session.handle, obj); e != nil { + t.Fatalf("DestroyObject failed: %s\n", e) + } + } + return nil + }) + require.NoError(t, err) +} From b9e00853729190818dde6aa148a88be3da450ef1 Mon Sep 17 00:00:00 2001 From: "mek.kiatkrai" Date: Tue, 11 Aug 2020 12:30:00 +0700 Subject: [PATCH 3/3] Remove error handling when certificate was not found --- certificates_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/certificates_test.go b/certificates_test.go index 506c916..9d95e5e 100644 --- a/certificates_test.go +++ b/certificates_test.go @@ -207,7 +207,7 @@ func removeAllCertificates(t *testing.T, c *Context) { t.Fatalf("failed to init: %s\n", e) } objs, _, e := session.ctx.FindObjects(session.handle, maxHandlePerFind) - if e != nil || len(objs) == 0 { + if e != nil { t.Fatalf("failed to find objects") } if e := session.ctx.FindObjectsFinal(session.handle); e != nil {