ci: cram: Device.Security.CABundle dynamic implementation

Use Security.Certificate.CABundle in SoftHSM tests. Update ca.crt path in tests to new filesystem location. Add new field Alias in Security.Certificate to 020-security.t. References: PCF-2487 Signed-off-by: Radek Martyniszyn <radek.martyniszyn@consult.red>
2026-04-09 15:22:18 +02:00 · 2026-04-09 15:22:18 +02:00 · 5cdae888fa
commit 5cdae888fa
parent 3f1877d670
7 changed files with 32 additions and 20 deletions
--- a/.gitlab/tests/cram/generic/acceleration-plan-components/020-security.t
+++ b/.gitlab/tests/cram/generic/acceleration-plan-components/020-security.t
@ -9,9 +9,14 @@ Backup the state of the system:
  $ R "mv /etc/config/autocert /etc/config/autocert.bak"
  $ R "mkdir -p /usr/share/ca-certificates"
  $ R "mv /usr/share/ca-certificates /usr/share/ca-certificates.bak"
+  $ R "mkdir -p /etc/ssl/certs"
+  $ R "mv /etc/ssl/certs /etc/ssl/certs.bak"
+  $ R "mkdir -p /etc/amx/tr181-security/defaults.d"
+  $ R "mv /etc/amx/tr181-security/defaults.d /etc/amx/tr181-security/defaults.d.bak"

 Copy over testing certificates:

+  $ R "mkdir -p /etc/amx/tr181-security/defaults.d"
  $ R "mkdir -p /etc/config/autocert"
  $ C ${CI_PROJECT_DIR}/.gitlab/certs/tr181-security/autocert/* "root@${TARGET_LAN_IP}:/etc/config/autocert/"
  Warning: Permanently added '*' (*) to the list of known hosts* (glob)
@ -40,6 +45,7 @@ Check that certificate can be disabled (PCF-1054):
  $ R "ba-cli --json 'Security.Certificate.[SignatureAlgorithm==\"ecdsa-with-SHA512\" && Enable==False].?' | sed -n '2p'" | jq --sort-keys .[0] | grep -v -E '(NotAfter|NotBefore|LastModif)'
  {
    "Security.Certificate.\d+.": { (re)
+      "Alias": "cpe-Certificate-\d+", (re)
      "Enable": 0,
      "Issuer": "/C=US/O=PrplFoundation/OU=prplOS/CN=prplOS.lan",
      "SerialNumber": "2022A6A3FDECA910242A18EFFB214776206F2ED8",
@ -57,6 +63,7 @@ Check that certificate can be enabled (PCF-1054):
  $ R "ba-cli --json 'Security.Certificate.[SignatureAlgorithm==\"ecdsa-with-SHA512\" && Enable==True].?' | sed -n '2p'" | jq --sort-keys .[0] | grep -v -E '(NotAfter|NotBefore|LastModif)'
  {
    "Security.Certificate.\d+.": { (re)
+      "Alias": "cpe-Certificate-\d+", (re)
      "Enable": 1,
      "Issuer": "/C=US/O=PrplFoundation/OU=prplOS/CN=prplOS.lan",
      "SerialNumber": "2022A6A3FDECA910242A18EFFB214776206F2ED8",
@ -87,13 +94,13 @@ Check that CABundle are presents:
  $ R "echo '%populate{object Security{object CABundle{instance add(){parameter Enable=1; parameter Name=cram; parameter CAFileURI=\"/tmp/server-cert.crt\";}}}}' > /etc/amx/tr181-security/defaults.d/01_cram_periodic_transfer.odl" ; sleep 1
  $ R '/etc/init.d/tr181-security restart'
  $ R 'ba-cli Security.CABundleNumberOfEntries?' | grep -v '>'
-  Security.CABundleNumberOfEntries=2
+  Security.CABundleNumberOfEntries=1
  

 Check CABundle RPC:

-  $ R "ba-cli 'Security.CABundle.2.CAFile()'" | grep -v '>'
-  Security.CABundle.2.CAFile() returned
+  $ R "ba-cli 'Security.CABundle.1.CAFile()'" | grep -v '>'
+  Security.CABundle.1.CAFile() returned
  [
      "",
      {
@ -101,8 +108,8 @@ Check CABundle RPC:
      }
  ]
  
-  $ R "ba-cli 'Security.CABundle.2.CADir()'" | grep -v '>'
-  Security.CABundle.2.CADir() returned
+  $ R "ba-cli 'Security.CABundle.1.CADir()'" | grep -v '>'
+  Security.CABundle.1.CADir() returned
  [
      "",
      {
@ -110,9 +117,9 @@ Check CABundle RPC:
      }
  ]
  
-  $ R "ba-cli 'Security.CABundle.2.CADirURI=/tmp'" >/dev/null
-  $ R "ba-cli 'Security.CABundle.2.CADir()'" | grep -v '>'
-  Security.CABundle.2.CADir() returned
+  $ R "ba-cli 'Security.CABundle.1.CADirURI=/tmp'" >/dev/null
+  $ R "ba-cli 'Security.CABundle.1.CADir()'" | grep -v '>'
+  Security.CABundle.1.CADir() returned
  [
      "",
      {
@ -123,8 +130,11 @@ Check CABundle RPC:

 Restore the state of the system:

-  $ R 'rm -rf /etc/amx/tr181-security/defaults.d/01_cram_periodic_transfer.odl'
+  $ R 'rm -rf /etc/amx/tr181-security/defaults.d'
+  $ R "mv /etc/amx/tr181-security/defaults.d.bak /etc/amx/tr181-security/defaults.d"
  $ R '/etc/init.d/tr181-security restart'
+  $ R "rm -rf /etc/ssl/certs"
+  $ R "mv /etc/ssl/certs.bak /etc/ssl/certs"
  $ R "rm -rf /etc/config/autocert"
  $ R "mv /etc/config/autocert.bak /etc/config/autocert"
  $ R "rm -rf /usr/share/ca-certificates"
--- a/.gitlab/tests/cram/generic/acceleration-plan-components/130-periodicfileupload.t
+++ b/.gitlab/tests/cram/generic/acceleration-plan-components/130-periodicfileupload.t
@ -152,10 +152,10 @@ Check PeriodicFileTransfer over HTTPS:
  $ servefile_pid="$!"
  $ sleep 2
  $ R "openssl s_client -connect \"$SERVER_IP:8181\" -showcerts < /dev/null 2> /dev/null | openssl x509 -outform PEM > /tmp/server-cert.crt"; sleep 1
-  $ R "echo '%populate{object Security{object CABundle{instance add(){parameter Enable=1; parameter CAFileURI=\"/tmp/server-cert.crt\";}}}}' > /etc/amx/tr181-security/defaults.d/01_cram_periodic_transfer.odl" ; sleep 1
+  $ R "echo '%populate{object Security{object CABundle{instance add("cram"){parameter Enable=1; parameter Name=cram; parameter CAFileURI=\"/tmp/server-cert.crt\";}}}}' > /etc/amx/tr181-security/defaults.d/01_cram_periodic_transfer.odl" ; sleep 1
  $ R '/etc/init.d/tr181-security restart'; sleep 1
  $ R 'ba-cli "Device.PeriodicFileTransfer.Profile.cram-Profile-1.Protocol=HTTPS"' > /dev/null; sleep 1
-  $ R 'ba-cli "Device.PeriodicFileTransfer.Profile.cram-Profile-1.HTTP.CABundle=Device.Security.CABundle.2"' > /dev/null; sleep 1
+  $ R 'ba-cli "Device.PeriodicFileTransfer.Profile.cram-Profile-1.HTTP.CABundle=Device.Security.CABundle.cram"' > /dev/null; sleep 1
  $ R "ba-cli 'Device.PeriodicFileTransfer.Profile.cram-Profile-1.HTTP.URL=\"https://$SERVER_IP:8181\"'" > /dev/null; sleep 1
  $ R 'ba-cli "Device.PeriodicFileTransfer.Transfer.cram-Transfer-1.ForceTransfer()"' | grep -v '>' ; sleep 1
  Device.PeriodicFileTransfer.Transfer.cram-Transfer-1.ForceTransfer() returned
--- a/.gitlab/tests/cram/generic/softhsm/001-hsm-setup.t
+++ b/.gitlab/tests/cram/generic/softhsm/001-hsm-setup.t
@ -20,7 +20,7 @@ Test the creation of a certificate using PKCS11 URIs:

  $ R "openssl req -new -engine pkcs11 -keyform ENGINE -key 'pkcs11:object=cpe-key;type=private' -out /tmp/cpe.csr -subj '/CN=prplOS.lan' &> /dev/null"
  $ R "ls /tmp/cpe.csr &> /dev/null"
-  $ R "openssl x509 -req -in /tmp/cpe.csr -CA /usr/share/ca-certificates/ca.crt -engine pkcs11 -CAkeyform ENGINE -CAkey 'pkcs11:object=ca-key;type=private' -CAcreateserial -out /tmp/cpe.crt -days 3650 -sha256 &> /dev/null"
+  $ R "openssl x509 -req -in /tmp/cpe.csr -CA /usr/share/ca-certificates/test/ca.crt -engine pkcs11 -CAkeyform ENGINE -CAkey 'pkcs11:object=ca-key;type=private' -CAcreateserial -out /tmp/cpe.crt -days 3650 -sha256 &> /dev/null"
  $ R "ls /tmp/cpe.crt &> /dev/null"

 Create client key/cert needed for tests:
@ -28,7 +28,7 @@ Create client key/cert needed for tests:
  $ R "openssl genrsa -out /root/certs/client.key 2048"
  $ R "pkcs11-tool --module /usr/lib/softhsm/libsofthsm2.so --login --pin 1234 --write-object /root/certs/client.key --type privkey --label 'client-key' &> /dev/null"
  $ R "openssl req -new -engine pkcs11 -keyform ENGINE -key 'pkcs11:object=client-key;type=private' -out /root/certs/client.csr -subj '/CN=cpe.local' &> /dev/null"
-  $ R "openssl x509 -req -in /root/certs/client.csr -CA /usr/share/ca-certificates/ca.crt -engine pkcs11 -CAkeyform ENGINE -CAkey 'pkcs11:object=ca-key;type=private' -CAcreateserial -out /root/certs/client.crt -days 3650 -sha256 &> /dev/null"
+  $ R "openssl x509 -req -in /root/certs/client.csr -CA /usr/share/ca-certificates/test/ca.crt -engine pkcs11 -CAkeyform ENGINE -CAkey 'pkcs11:object=ca-key;type=private' -CAcreateserial -out /root/certs/client.crt -days 3650 -sha256 &> /dev/null"

 Allow HSM secure storage access for users in the certificates group:

--- a/.gitlab/tests/cram/generic/softhsm/002-hsm-mqtt-broker.t
+++ b/.gitlab/tests/cram/generic/softhsm/002-hsm-mqtt-broker.t
@ -11,7 +11,8 @@ Setup mqttbroker for pkcs11:
  > ba-cli MQTTBroker.Broker.secure.TlsEngine=true
  > ba-cli MQTTBroker.Broker.secure.TlsEngineId="pkcs11"
  > ba-cli MQTTBroker.Broker.secure.CertFile=""
-  > ba-cli MQTTBroker.Broker.secure.CAFile="/usr/share/ca-certificates/ca.crt"
+  > ba-cli MQTTBroker.Broker.secure.CAFile=""
+  > ba-cli MQTTBroker.Broker.secure.CABundle="Device.Security.CABundle.test."
  > ba-cli MQTTBroker.Broker.secure.Ciphers="DEFAULT"
  > ba-cli MQTTBroker.Broker.secure.RequireCertificate=true
  > ba-cli MQTTBroker.Broker.secure.KeyFile=""
@ -26,4 +27,4 @@ Check mqtt publish at port 8883:
  $ S="mqtt-publish-sec.sh"
  $ C "${TESTDIR}/${S}" "root@${TARGET_LAN_IP}:/tmp/"
  Warning: Permanently added '*' (*) to the list of known hosts* (glob)
-  $ R "source /tmp/${S} | grep -q 'sending PUBLISH'"
+  $ R "source /tmp/${S} | grep -q 'sending PUBLISH'"
--- a/.gitlab/tests/cram/generic/softhsm/003-hsm-http-server.t
+++ b/.gitlab/tests/cram/generic/softhsm/003-hsm-http-server.t
@ -18,5 +18,5 @@ Setup https server at prplOS.lan/localhost 127.0.0.1:

 Check server response ok:

-  $ R "curl --cacert /usr/share/ca-certificates/ca.crt --silent --output /dev/null --write-out \"%{http_code}\\n\" https://prplOS.lan"
-  200
+  $ R "curl --cacert /usr/share/ca-certificates/test/ca.crt --silent --output /dev/null --write-out \"%{http_code}\\n\" https://prplOS.lan"
+  200
--- a/.gitlab/tests/cram/generic/softhsm/004-hsm-mqtt-client.t
+++ b/.gitlab/tests/cram/generic/softhsm/004-hsm-mqtt-client.t
@ -15,7 +15,8 @@ Setup https server at prplOS.lan/localhost 127.0.0.1:
  > ba-cli MQTT.Client.1.BrokerAddress="127.0.0.1"
  > ba-cli MQTT.Client.1.BrokerPort=8883
  > ba-cli MQTT.Client.1.CheckServerHostName=false
-  > ba-cli MQTT.Client.1.CACertificate="/usr/share/ca-certificates/ca.crt"
+  > ba-cli MQTT.Client.1.CACertificate=""
+  > ba-cli MQTT.Client.1.CABundle="Device.Security.CABundle.test."
  > ba-cli MQTT.Client.1.ClientCertificate=""
  > ba-cli MQTT.Client.1.PrivateKey=""
  > ba-cli MQTT.Client.1.Certificate="Device.Security.Certificate.2."
@ -35,4 +36,4 @@ Setup https server at prplOS.lan/localhost 127.0.0.1:

  $ R "ba-cli 'BulkData.Enable=0' > /dev/null"
  $ R "ba-cli 'MQTT.Client.1.Enable=0' > /dev/null"
-  $ sleep 1
+  $ sleep 1
--- a/.gitlab/tests/cram/generic/softhsm/mqtt-publish-sec.sh
+++ b/.gitlab/tests/cram/generic/softhsm/mqtt-publish-sec.sh
@ -1,6 +1,6 @@
 export PKCS11_MODULE_PATH=/usr/lib/softhsm/libsofthsm2.so
 mosquitto_pub \
-  --cafile /usr/share/ca-certificates/ca.crt \
+  --cafile /usr/share/ca-certificates/test/ca.crt \
  --cert /root/certs/client.crt \
  --key /root/certs/client.key \
  -h prplOS.lan -p 8883 \