go-fdo-server/test/ci/test-device-ca-rendezvous-trust.sh at 2597f9a3e8fb4f5b109f03e36700d6deda009f3e · fido-device-onboard/go-fdo-server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
#! /usr/bin/env bash

set -euo pipefail

source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)/utils.sh"

run_test() {

  log_info "Setting the error trap handler"
  trap on_failure EXIT

  log_info "Environment variables"
  show_env

  log_info "Creating directories"
  create_directories

  log_info "Generating service certificates"
  generate_service_certs

  log_info "Build and install 'go-fdo-client' binary"
  install_client

  log_info "Build and install 'go-fdo-server' binary"
  install_server

  log_info "Configuring services"
  configure_services

  log_info "Configure DNS and start services"
  start_services

  log_info "Wait for the services to be ready:"
  wait_for_services_ready

  log_info "Setting or updating Rendezvous Info (RendezvousInfo)"
  set_or_update_rendezvous_info "${manufacturer_url}" "${rv_info}"

  log_info "Run Device Initialization"
  guid=$(run_device_initialization)
  log_info "Device initialized with GUID: ${guid}"

  log_info "Setting or updating Owner Redirect Info (RVTO2Addr)"
  set_or_update_owner_redirect_info "${owner_url}" "${owner_service_name}" "${owner_dns}" "${owner_port}" "${owner_protocol}"

  log_info "Sending Ownership Voucher to the Owner"
  send_manufacturer_ov_to_owner "${manufacturer_url}" "${guid}" "${owner_url}"

  log_info "Running FIDO Device Onboard (expected to fail)"
  ! run_fido_device_onboard "${guid}" --debug || log_error "Onboarding must fail!"

  # We use get_service_logs instead of find_in_log here to make it work with containers:
  # server logs are only saved to log files if the test fails.
  get_service_logs "rendezvous" | grep "cryptographic verification failed: x509: certificate signed by unknown authority" || log_error "Rendezvous didn't reject the ownership voucher!"

  log_info "Adding Device CA certificate to rendezvous"
  add_device_ca_cert "${rendezvous_url}" "${device_ca_crt}" | jq -r -M .

  log_info "Get the rendezvous Device CA certificates"
  fingerprint=$(get_device_ca_certs ${rendezvous_url} | jq -r -M '.certs[0].fingerprint')

  log_info "Deleting certificate with fingerprint '${fingerprint}'"
  delete_device_ca_cert "${rendezvous_url}" "${fingerprint}"

  log_info "Running FIDO Device Onboard (expected to fail again)"
  ! run_fido_device_onboard "${guid}" --debug || log_error "Onboarding must fail!"
  get_service_logs "rendezvous" | grep "cryptographic verification failed: x509: certificate signed by unknown authority" || log_error "Rendezvous didn't reject the ownership voucher!"

  log_info "Adding Device CA certificate to rendezvous"
  add_device_ca_cert "${rendezvous_url}" "${device_ca_crt}" | jq -r -M .

  log_info "Running FIDO Device Onboard"
  run_fido_device_onboard "${guid}" --debug || log_error "Onboarding failed!"

  log_info "Unsetting the error trap handler"
  trap - EXIT
  test_pass
}

# Allow running directly
[[ "${BASH_SOURCE[0]}" != "$0" ]] || {
  run_test
  cleanup
}