Skip to content

Commit 26cb3b7

Browse files
gowthamsk-armgowthamsk-arm
committed
ci: Add keys/certificate generation script
For TLS handshake tests, we need keys and certificates for the CA, server and the client. Running the script generates all these under a directory called "tls". Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com>
1 parent 49416e1 commit 26cb3b7

File tree

2 files changed

+162
-1
lines changed

2 files changed

+162
-1
lines changed

‎tests/ci.sh‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ if [ "$TEST" == "True" ]; then
9090
if [ "$CREATE_KEYS" == "True" ]; then
9191
parsec-tool create-rsa-key -s -b 2048 -k PARSEC_TEST_KEYNAME
9292
fi
93-
# Try loading the build parsec provider
93+
# Try loading the built parsec provider
9494
PROVIDER_LOAD_RESULT=$(openssl list -providers -provider-path ./target/debug/ -provider libparsec_openssl_provider_shared)
9595
echo $PROVIDER_LOAD_RESULT
9696

@@ -111,11 +111,17 @@ if [ "$TEST" == "True" ]; then
111111
cargo test
112112
popd
113113

114+
# Generate the certificates and keys needed for the TLS handshake tests
115+
pushd tests
116+
./setup_tls.sh
117+
popd
118+
114119
# The parsec-openssl-provider-shared/e2e_tests/src/lib.rs contains some unit tests from the generated
115120
# test bindings from bindgen. So run only the integration tests in the test crate.
116121
pushd parsec-openssl-provider-shared/e2e_tests/
117122
cargo test --test '*' -- --nocapture
118123
popd
124+
119125
fi
120126

121127
if [ "$STATIC_CHECKS" == "True" ]; then

‎tests/setup_tls.sh‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2024 Contributors to the Parsec project.
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
# This script generates the certificates and keys for CA, server
7+
# and the client required for TLS handshake.
8+
9+
10+
# Generate the CA key and self signed certificate
11+
# inputs:
12+
# certificate directory
13+
generate_ca_certs() {
14+
CA_DIRECTORY=$1
15+
CA_CERTIFICATE=${CA_DIRECTORY}/ca_cert.pem
16+
CA_PRIV_KEY=${CA_DIRECTORY}/ca_private_key.pem
17+
18+
# Generate a self signed certificate for the CA along with a key.
19+
if [ ! -f "${CA_CERTIFICATE}" ]; then
20+
mkdir -p "${CA_DIRECTORY}"
21+
chmod 700 "${CA_DIRECTORY}"
22+
23+
openssl req -x509 -nodes -newkey rsa:2048 \
24+
-keyout "${CA_PRIV_KEY}" \
25+
-out "${CA_CERTIFICATE}" \
26+
-subj "/C=UK/ST=Parsec /L=Parsec/O=Parsec/CN=parsec.com" > /dev/null 2>&1
27+
28+
if [ $? -ne 0 ]; then
29+
echo "FAILED"
30+
exit 1
31+
fi
32+
echo "SUCCESS"
33+
else
34+
echo "SKIPPED"
35+
fi
36+
}
37+
38+
# Generate the server key and certificate signed by CA
39+
# inputs:
40+
# server directory
41+
# certificate directory
42+
generate_server_certs() {
43+
SERVER_DIRECTORY=$1
44+
SERVER_CERTIFICATE=${SERVER_DIRECTORY}/server_cert.pem
45+
SERVER_CSR=${SERVER_DIRECTORY}/server_cert.csr
46+
SERVER_PRIV_KEY=${SERVER_DIRECTORY}/server_private_key.pem
47+
48+
CA_DIRECTORY=$2
49+
CA_CERTIFICATE=${CA_DIRECTORY}/ca_cert.pem
50+
CA_PRIV_KEY=${CA_DIRECTORY}/ca_private_key.pem
51+
52+
if [ ! -f "${SERVER_CSR}" ]; then
53+
mkdir -p "${SERVER_DIRECTORY}" > /dev/null 2>&1
54+
chmod 700 "${SERVER_DIRECTORY}"
55+
56+
# Generate private key
57+
openssl genrsa -out "${SERVER_PRIV_KEY}" 2048 > /dev/null 2>&1
58+
if [ $? -ne 0 ]; then
59+
echo "FAILED TO GENERATE KEY"
60+
exit 1
61+
fi
62+
63+
# Generate certificate request
64+
openssl req -new \
65+
-key "${SERVER_PRIV_KEY}" \
66+
-out "${SERVER_CSR}" \
67+
-subj "/C=UK/ST=Parsec /L=Parsec/O=Parsec/CN=parsec.com" > /dev/null 2>&1
68+
if [ $? -ne 0 ]; then
69+
echo "FAILED TO GENERATE CERTIFICATE REQUEST"
70+
exit 1
71+
fi
72+
73+
# Generate certificate
74+
openssl x509 -req -in "${SERVER_CSR}" \
75+
-CA "${CA_CERTIFICATE}" -CAkey "${CA_PRIV_KEY}" \
76+
-CAcreateserial -out "${SERVER_CERTIFICATE}" > /dev/null 2>&1
77+
if [ $? -ne 0 ]; then
78+
echo "FAILED"
79+
exit 1
80+
fi
81+
82+
echo "SUCCESS"
83+
else
84+
echo "SKIPPED"
85+
fi
86+
}
87+
88+
# ToDo: This function needs to be updated to use the parsec-tool
89+
# for key, CSR generation for hardware backed keys.
90+
# Generate the client key and certificate signed by CA
91+
# inputs:
92+
# client directory
93+
# certificate directory
94+
generate_client_certs() {
95+
CLIENT_DIRECTORY=$1
96+
CLIENT_CERTIFICATE=${CLIENT_DIRECTORY}/client_cert.pem
97+
CLIENT_CSR=${CLIENT_DIRECTORY}/client_cert.csr
98+
CLIENT_PRIV_KEY=${CLIENT_DIRECTORY}/client_private_key.pem
99+
100+
CA_DIRECTORY=$2
101+
CA_CERTIFICATE=${CA_DIRECTORY}/ca_cert.pem
102+
CA_PRIV_KEY=${CA_DIRECTORY}/ca_private_key.pem
103+
104+
if [ ! -f "${CLIENT_CSR}" ]; then
105+
mkdir -p "${CLIENT_DIRECTORY}" > /dev/null 2>&1
106+
chmod 700 "${CLIENT_DIRECTORY}"
107+
108+
# Generate private key
109+
openssl genrsa -out "${CLIENT_PRIV_KEY}" 2048 > /dev/null 2>&1
110+
if [ $? -ne 0 ]; then
111+
echo "FAILED TO GENERATE KEY"
112+
exit 1
113+
fi
114+
115+
# Generate certificate request
116+
openssl req -new \
117+
-key "${CLIENT_PRIV_KEY}" \
118+
-out "${CLIENT_CSR}" \
119+
-subj "/C=UK/ST=Parsec /L=Parsec/O=Parsec/CN=parsec.com" > /dev/null 2>&1
120+
if [ $? -ne 0 ]; then
121+
echo "FAILED TO GENERATE CERTIFICATE REQUEST"
122+
exit 1
123+
fi
124+
125+
# Generate certificate
126+
openssl x509 -req -in "${CLIENT_CSR}" \
127+
-CA "${CA_CERTIFICATE}" -CAkey "${CA_PRIV_KEY}" \
128+
-CAcreateserial -out "${CLIENT_CERTIFICATE}" > /dev/null 2>&1
129+
if [ $? -ne 0 ]; then
130+
echo "FAILED"
131+
exit 1
132+
fi
133+
134+
echo "SUCCESS"
135+
else
136+
echo "SKIPPED"
137+
fi
138+
}
139+
140+
echo -n "Generating certificate authority private key and certificate: "
141+
generate_ca_certs ./tls/ca
142+
143+
echo -n "Generating server private key and certificate: "
144+
generate_server_certs ./tls/server ./tls/ca
145+
146+
echo -n "Generating client private key and certificate: "
147+
generate_client_certs ./tls/client ./tls/ca
148+
149+
echo -n "Generating fake certificate authority private key and certificate: "
150+
generate_ca_certs ./tls/fake_ca
151+
152+
echo -n "Generating fake client private key and certificate: "
153+
generate_client_certs ./tls/fake_client ./tls/fake_ca
154+
155+
exit 0

0 commit comments

Comments
 (0)