Skip to content

Commit b8af688

Browse files
phsymphsym
committed
test: add venom test-suite
Signed-off-by: Pierre-Henri Symoneaux <[email protected]>
1 parent 20f9c76 commit b8af688

File tree

5 files changed

+426
-1
lines changed

5 files changed

+426
-1
lines changed

‎.gitignore

+4-1
Original file line numberDiff line numberDiff line change
@@ -47,4 +47,7 @@ tmp.CHANGELOG.md
4747
/git-cliff-*
4848

4949
.config/
50-
.cache/
50+
.cache/
51+
52+
# Venom tests output
53+
tests/out

‎tests/cfg/vars.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
cmd_path: ../okms
2+
cfg_path: ../okms.yaml

‎tests/keys.yaml

+329
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,329 @@
1+
name: okms-cli keys test suite
2+
description: Test the OKMS keys subcommand
3+
testcases:
4+
- name: Create Keys
5+
steps:
6+
- name: Create an AES 256 key
7+
type: okms-cmd
8+
args: keys new --type oct --size 256 test-aes-1 --usage encrypt,decrypt,wrapKey,unwrapKey
9+
assertions:
10+
- result.code ShouldEqual 0
11+
vars:
12+
aesKeyId:
13+
from: result.systemoutjson.id
14+
- name: Create an RSA 2048 key pair
15+
type: okms-cmd
16+
args: keys new --type rsa --size 2048 test-rsa-1 --usage sign,verify
17+
assertions:
18+
- result.code ShouldEqual 0
19+
vars:
20+
rsaKeyId:
21+
from: result.systemoutjson.id
22+
- name: Create an ECDSA P-256 key pair
23+
type: okms-cmd
24+
args: keys new --type ec --curve P-256 test-ecdsa-1 --usage sign,verify
25+
assertions:
26+
- result.code ShouldEqual 0
27+
vars:
28+
ecKeyId:
29+
from: result.systemoutjson.id
30+
- name: Get the {{ .value.kind }} keys
31+
type: okms-cmd
32+
range:
33+
- keyId: "{{ .Create-Keys.aesKeyId }}"
34+
kind: AES
35+
- keyId: "{{ .Create-Keys.rsaKeyId }}"
36+
kind: RSA
37+
- keyId: "{{ .Create-Keys.ecKeyId }}"
38+
kind: ECDSA
39+
args: keys get {{ .value.keyId }}
40+
assertions:
41+
- result.code ShouldEqual 0
42+
- result.systemoutjson.id ShouldEqual {{ .value.keyId }}
43+
- name: List the keys and check {{ .value.kind }}
44+
type: okms-cmd
45+
range:
46+
- keyId: "{{ .Create-Keys.aesKeyId }}"
47+
kind: AES
48+
- keyId: "{{ .Create-Keys.rsaKeyId }}"
49+
kind: RSA
50+
- keyId: "{{ .Create-Keys.ecKeyId }}"
51+
kind: ECDSA
52+
args: keys ls
53+
assertions:
54+
- result.code ShouldEqual 0
55+
- result.systemoutjson.objects_list ShouldJSONContainWithKey id {{ .value.keyId }}
56+
57+
- name: AES Encryption
58+
steps:
59+
- name: Encrypt data
60+
type: okms-cmd
61+
args: keys encrypt {{ .Create-Keys.aesKeyId }} "Hello World !!!"
62+
assertions:
63+
- result.code ShouldEqual 0
64+
vars:
65+
ciphertext:
66+
from: result.systemoutjson
67+
- name: Decrypt data
68+
type: okms-cmd
69+
args: keys decrypt {{ .Create-Keys.aesKeyId }} {{ .ciphertext }}
70+
format: text
71+
assertions:
72+
- result.code ShouldEqual 0
73+
- result.systemout ShouldEqual "Hello World !!!"
74+
75+
- name: Data Keys
76+
steps:
77+
- name: Generate data key
78+
type: okms-cmd
79+
args: keys datakey new {{ .Create-Keys.aesKeyId }} --name test-dk --size 256
80+
vars:
81+
plainDatakey:
82+
from: result.systemoutjson.plain
83+
cipherDatakey:
84+
from: result.systemoutjson.encrypted
85+
assertions:
86+
- result.code ShouldEqual 0
87+
88+
- name: Decrypt data key
89+
type: okms-cmd
90+
args: keys datakey decrypt {{ .Create-Keys.aesKeyId }} "{{ .cipherDatakey }}"
91+
assertions:
92+
- result.code ShouldEqual 0
93+
- result.systemoutjson ShouldEqual {{ .plainDatakey }}
94+
95+
- name: AEAD streaming encryption
96+
steps:
97+
- name: Create large file
98+
script: mkdir -p ./data && dd if=/dev/urandom of=./data/plain.bin bs=51200 count=10000
99+
- name: Checksum file
100+
script: sha256sum ./data/plain.bin > data/checksum.txt
101+
- name: Encrypt file
102+
type: okms-cmd
103+
args: keys encrypt --dk {{ .Create-Keys.aesKeyId }} @./data/plain.bin data/encrypted.out
104+
assertions:
105+
- result.code ShouldEqual 0
106+
- name: Decrypt file
107+
type: okms-cmd
108+
args: keys decrypt --dk {{ .Create-Keys.aesKeyId }} @data/encrypted.out ./data/plain.bin
109+
assertions:
110+
- result.code ShouldEqual 0
111+
- name: Verify decrypted output
112+
script: sha256sum -c data/checksum.txt
113+
assertions:
114+
- result.code ShouldEqual 0
115+
- name: Cleanup files
116+
script: rm -Rf ./data
117+
118+
- name: Asymmetric RSA signature
119+
steps:
120+
- name: Sign RS256
121+
type: okms-cmd
122+
args: keys sign --alg RS256 {{ .Create-Keys.rsaKeyId }} "hello world !!!"
123+
vars:
124+
signature:
125+
from: result.systemoutjson
126+
assertions:
127+
- result.code ShouldEqual 0
128+
- name: Verify RS256
129+
type: okms-cmd
130+
args: keys verify --alg RS256 {{ .Create-Keys.rsaKeyId }} "hello world !!!" {{ .signature }}
131+
assertions:
132+
- result.code ShouldEqual 0
133+
- name: Local verify RS256
134+
type: okms-cmd
135+
args: keys verify --alg RS256 --local {{ .Create-Keys.rsaKeyId }} "hello world !!!" {{ .signature }}
136+
assertions:
137+
- result.code ShouldEqual 0
138+
- name: Sign PS256
139+
type: okms-cmd
140+
args: keys sign --alg PS256 {{ .Create-Keys.rsaKeyId }} "hello world !!!"
141+
vars:
142+
signature:
143+
from: result.systemoutjson
144+
assertions:
145+
- result.code ShouldEqual 0
146+
- name: Verify PS256
147+
type: okms-cmd
148+
args: keys verify --alg PS256 {{ .Create-Keys.rsaKeyId }} "hello world !!!" {{ .signature }}
149+
assertions:
150+
- result.code ShouldEqual 0
151+
- result.systemoutjson ShouldJSONEqual true
152+
- name: Local verify PS256
153+
type: okms-cmd
154+
args: keys verify --alg PS256 --local {{ .Create-Keys.rsaKeyId }} "hello world !!!" {{ .signature }}
155+
assertions:
156+
- result.code ShouldEqual 0
157+
# - result.systemoutjson ShouldJSONEqual true
158+
159+
- name: Verify wrong alg ES256
160+
type: okms-cmd
161+
args: keys verify --alg ES256 {{ .Create-Keys.rsaKeyId }} "hello world !!!" {{ .signature }}
162+
assertions:
163+
- result.code ShouldEqual 1
164+
- name: Verify RS256 failure
165+
type: okms-cmd
166+
args: keys verify --alg RS256 {{ .Create-Keys.rsaKeyId }} "hello world !!!" "bad signature"
167+
assertions:
168+
- result.code ShouldEqual 1
169+
- result.systemoutjson ShouldJSONEqual false
170+
171+
- name: Asymmetric ECDSA signature
172+
steps:
173+
- name: Sign ES256
174+
type: okms-cmd
175+
args: keys sign --alg ES256 {{ .Create-Keys.ecKeyId }} "hello world !!!"
176+
vars:
177+
signature:
178+
from: result.systemoutjson
179+
assertions:
180+
- result.code ShouldEqual 0
181+
- name: Verify ES256
182+
type: okms-cmd
183+
args: keys verify --alg ES256 {{ .Create-Keys.ecKeyId }} "hello world !!!" {{ .signature }}
184+
assertions:
185+
- result.code ShouldEqual 0
186+
- name: Local verify ES256
187+
type: okms-cmd
188+
args: keys verify --alg ES256 --local {{ .Create-Keys.ecKeyId }} "hello world !!!" {{ .signature }}
189+
assertions:
190+
- result.code ShouldEqual 0
191+
- name: Sign ES256
192+
type: okms-cmd
193+
args: keys sign --alg ES256 {{ .Create-Keys.ecKeyId }} "hello world !!!"
194+
vars:
195+
signature:
196+
from: result.systemoutjson
197+
assertions:
198+
- result.code ShouldEqual 0
199+
- name: Verify ES256
200+
type: okms-cmd
201+
args: keys verify --alg ES256 {{ .Create-Keys.ecKeyId }} "hello world !!!" {{ .signature }}
202+
assertions:
203+
- result.code ShouldEqual 0
204+
- result.systemoutjson ShouldJSONEqual true
205+
- name: Local verify ES256
206+
type: okms-cmd
207+
args: keys verify --alg ES256 --local {{ .Create-Keys.ecKeyId }} "hello world !!!" {{ .signature }}
208+
assertions:
209+
- result.code ShouldEqual 0
210+
# - result.systemoutjson ShouldJSONEqual true
211+
212+
- name: Verify wrong alg ES384
213+
type: okms-cmd
214+
args: keys verify --alg ES384 {{ .Create-Keys.ecKeyId }} "hello world !!!" {{ .signature }}
215+
assertions:
216+
- result.code ShouldEqual 1
217+
- name: Verify ES256 failure
218+
type: okms-cmd
219+
args: keys verify --alg ES256 {{ .Create-Keys.ecKeyId }} "hello world !!!" "bad signature"
220+
assertions:
221+
- result.code ShouldEqual 1
222+
- result.systemoutjson ShouldJSONEqual false
223+
224+
- name: Key export
225+
steps:
226+
- name: Export AES
227+
type: okms-cmd
228+
format: text
229+
args: keys export {{ .Create-Keys.aesKeyId }}
230+
assertions:
231+
- result.code ShouldEqual 1
232+
- name: Export RSA to PKCS1
233+
type: okms-cmd
234+
format: text
235+
args: keys export {{ .Create-Keys.rsaKeyId }} --format pkcs1
236+
assertions:
237+
- result.code ShouldEqual 0
238+
- result.systemout ShouldStartWith "-----BEGIN RSA PUBLIC KEY-----"
239+
- result.systemout ShouldEndWith "-----END RSA PUBLIC KEY-----"
240+
- name: Export RSA to SPKI/PKIX
241+
type: okms-cmd
242+
format: text
243+
args: keys export {{ .Create-Keys.rsaKeyId }} --format pkix
244+
assertions:
245+
- result.code ShouldEqual 0
246+
- result.systemout ShouldStartWith "-----BEGIN PUBLIC KEY-----"
247+
- result.systemout ShouldEndWith "-----END PUBLIC KEY-----"
248+
- name: Export RSA to OpenSSH
249+
type: okms-cmd
250+
format: text
251+
args: keys export {{ .Create-Keys.rsaKeyId }} --format openssh
252+
assertions:
253+
- result.code ShouldEqual 0
254+
- result.systemout ShouldStartWith "ssh-rsa "
255+
- name: Export ECDSA to PKCS1
256+
type: okms-cmd
257+
format: text
258+
args: keys export {{ .Create-Keys.ecKeyId }} --format pkcs1
259+
assertions:
260+
- result.code ShouldEqual 1
261+
- name: Export ECDSA to SPKI/PKIX
262+
type: okms-cmd
263+
format: text
264+
args: keys export {{ .Create-Keys.ecKeyId }} --format pkix
265+
assertions:
266+
- result.code ShouldEqual 0
267+
- result.systemout ShouldStartWith "-----BEGIN PUBLIC KEY-----"
268+
- result.systemout ShouldEndWith "-----END PUBLIC KEY-----"
269+
- name: Export ECDSA to OpenSSH
270+
type: okms-cmd
271+
format: text
272+
args: keys export {{ .Create-Keys.ecKeyId }} --format openssh
273+
assertions:
274+
- result.code ShouldEqual 0
275+
- result.systemout ShouldStartWith "ecdsa-sha2-nistp256 "
276+
277+
- name: Key import
278+
steps:
279+
- name: Import AES key
280+
type: okms-cmd
281+
args: keys import --usage encrypt,decrypt --symmetric test-import-aes YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=
282+
assertions:
283+
- result.code ShouldEqual 0
284+
- name: Import RSA PKCS1 key
285+
type: okms-cmd
286+
args: keys import --usage sign,verify test-import-rsa-pkcs1 @testdata/rsa_pkcs1.priv.pem
287+
assertions:
288+
- result.code ShouldEqual 0
289+
- name: Import RSA PKCS8 key
290+
type: okms-cmd
291+
args: keys import --usage sign,verify test-import-rsa-pkcs8 @testdata/rsa_pkcs8.priv.pem
292+
assertions:
293+
- result.code ShouldEqual 0
294+
- name: Import RSA openssh key
295+
type: okms-cmd
296+
args: keys import --usage sign,verify test-import-rsa-ssh @testdata/rsa_ssh.priv.pem
297+
assertions:
298+
- result.code ShouldEqual 0
299+
300+
- name: Import ECDSA SEC1 key
301+
type: okms-cmd
302+
args: keys import --usage sign,verify test-import-ecdsa-sec1 @testdata/ecdsa_sec1.priv.pem
303+
assertions:
304+
- result.code ShouldEqual 0
305+
- name: Import ECDSA PKCS8 key
306+
type: okms-cmd
307+
args: keys import --usage sign,verify test-import-ecdsa-pkcs8 @testdata/ecdsa_pkcs8.priv.pem
308+
assertions:
309+
- result.code ShouldEqual 0
310+
- name: Import ECDSA openssh key
311+
type: okms-cmd
312+
args: keys import --usage sign,verify test-import-ecdsa-ssh @testdata/ecdsa_ssh.priv.pem
313+
assertions:
314+
- result.code ShouldEqual 0
315+
316+
- name: Delete the keys
317+
steps:
318+
- name: Force delete the {{ .value.kind }} key
319+
type: okms-cmd
320+
range:
321+
- keyId: "{{ .Create-Keys.aesKeyId }}"
322+
kind: AES
323+
- keyId: "{{ .Create-Keys.rsaKeyId }}"
324+
kind: RSA
325+
- keyId: "{{ .Create-Keys.ecKeyId }}"
326+
kind: ECDSA
327+
args: keys delete {{ .value.keyId }} --force
328+
assertions:
329+
- result.code ShouldEqual 0

‎tests/lib/okms-cmd.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
executor: okms-cmd
2+
input:
3+
args: {}
4+
format: json
5+
steps:
6+
- script: mkdir -p ./out/coverage && GOCOVERDIR=./out/coverage {{ .cmd_path }} -c {{ .cfg_path }} --output {{ .input.format }} {{ .input.args }}
7+
# info: "{{ .cmd_path }} -c {{ .cfg_path }} --output {{ .input.format }} {{ .input.args }}"
8+
vars:
9+
code:
10+
from: result.code
11+
systemout:
12+
from: result.systemout
13+
assertions:
14+
# Needed to overwrite default assertion which checks that code is equal to 0
15+
- result.code ShouldNotBeNil
16+
output:
17+
code: "{{.code}}"
18+
systemout: "{{.systemout}}"

0 commit comments

Comments
 (0)