Fix tests

Yubico · Jun 18, 2024 · 5cce3a4 · 5cce3a4
1 parent c5c8b80
commit 5cce3a4
Show file tree

Hide file tree

Showing 5 changed files with 130 additions and 128 deletions.
diff --git a/tests/device/cli/conftest.py b/tests/device/cli/conftest.py
@@ -4,13 +4,17 @@
 from click.testing import CliRunner
 from functools import partial
 import pytest
+import logging
+
+logger = logging.getLogger(__name__)
 
 
 @pytest.fixture()
 def ykman_cli(capsys, device, info):
  def _ykman_cli(*argv, **kwargs):
  runner = CliRunner(mix_stderr=False)
  with capsys.disabled():
+ logger.debug("CLI: ykman %r", argv)
  result = runner.invoke(cli, argv, obj={}, **kwargs)
  if result.exit_code != 0:
  if isinstance(result.exception, CliFail):

diff --git a/tests/device/cli/test_hsmauth.py b/tests/device/cli/test_hsmauth.py
@@ -336,7 +336,7 @@ def test_change_management_password(self, ykman_cli, management_key):
  "-m",
  management_key,
  "-n",
- management_key,
+ NON_DEFAULT_MANAGEMENT_KEY,
  )
 
  # Should succeed
@@ -347,10 +347,10 @@ def test_change_management_password(self, ykman_cli, management_key):
  "-m",
  NON_DEFAULT_MANAGEMENT_KEY,
  "-n",
- management_key,
+ NON_DEFAULT_MANAGEMENT_KEY,
  )
 
- @condition.check(lambda info: not info.pin_complexity)
+ @condition.check(lambda info: not info.pin_complexity, "PIN complexity")
  def test_change_management_key_generate(self, ykman_cli, management_key):
  if len(management_key) != 32:
  pytest.skip("string management key")
@@ -373,5 +373,5 @@ def test_change_management_key_generate(self, ykman_cli, management_key):
  "-m",
  gen_key,
  "-n",
- management_key,
+ NON_DEFAULT_MANAGEMENT_KEY,
  )
diff --git a/tests/device/cli/test_securitydomain.py b/tests/device/cli/test_securitydomain.py
@@ -1,4 +1,4 @@
-from yubikit.management import CAPABILITY
+from yubikit.core import TRANSPORT
 from yubikit.core.smartcard import ApduError
 from ykman.util import parse_certificates
 from .. import condition
@@ -9,128 +9,127 @@
 
 
 @pytest.fixture(autouse=True)
-@condition.capability(CAPABILITY.HSMAUTH)
 @condition.min_version(5, 7, 2)
-def preconditions(ykman_cli):
+def preconditions(info, transport, ykman_cli):
+ if info.is_fips and transport != TRANSPORT.USB:
+ pytest.skip("SCP management on YK FIPS over NFC")
  ykman_cli("sd", "reset", "-f")
 
 
-def test_replace_kvn(ykman_cli):
- key = "01" * 16
- keys = f"{key}:{key}:{key}"
+class TestKeyManagement:
+ def test_replace_kvn(self, ykman_cli):
+ key = "01" * 16
+ keys = f"{key}:{key}:{key}"
 
- # Replace default SCP03 keyset
- ykman_cli("--scp-sd", "1", "0", "sd", "keys", "import", "scp03", "2", keys)
+  # Replace default SCP03 keyset
+  ykman_cli("--scp-sd", "1", "0", "sd", "keys", "import", "scp03", "2", keys)
 
- # Generate new SCP11a key
- ykman_cli("--scp", keys, "sd", "keys", "generate", "scp11a", "3", "-")
+  # Generate new SCP11a key
+  ykman_cli("--scp", keys, "sd", "keys", "generate", "scp11a", "3", "-")
 
- for i in range(3, 8):
- ykman_cli(
- "--scp",
- keys,
- "sd",
- "keys",
- "generate",
- "scp11a",
- str(i + 1),
- "-r",
- str(i),
- "-",
- )
+  for i in range(3, 8):
+  ykman_cli(
+  "--scp",
+  keys,
+  "sd",
+  "keys",
+  "generate",
+  "scp11a",
+  str(i + 1),
+  "-r",
+  str(i),
+  "-",
+  )
 
+ def test_scp11a(self, ykman_cli):
+ with pytest.raises(ValueError):
+ with open_file("scp/oce.pfx") as f:
+ ykman_cli("--scp", f.name, "--scp-password", "password", "sd", "info")
 
-def test_scp11a(ykman_cli):
- with pytest.raises(ValueError):
+ key = "01" * 16
+ keys = f"{key}:{key}:{key}"
+
+ # Replace default SCP03 keyset
+ ykman_cli("--scp-sd", "1", "0", "sd", "keys", "import", "scp03", "2", keys)
+
+ # Delete SCP11b key, generate SCP11a key
+ ykman_cli("--scp", keys, "sd", "keys", "delete", "--force", "scp11b", "0")
+ ykman_cli("--scp", keys, "sd", "keys", "generate", "scp11a", "3", "-")
+
+ # Import OCE CA
+ with open_file("scp/cert.ca-kloc.ecdsa.pem") as f:
+ ykman_cli("--scp", keys, "sd", "keys", "import", "0x10", "3", f.name)
+
+ # Authenticate
  with open_file("scp/oce.pfx") as f:
- ykman_cli("--scp", f.name, "--scp-password", "password", "sd", "info")
-
- key = "01" * 16
- keys = f"{key}:{key}:{key}"
-
- # Replace default SCP03 keyset
- ykman_cli("--scp-sd", "1", "0", "sd", "keys", "import", "scp03", "2", keys)
-
- # Delete SCP11b key, generate SCP11a key
- ykman_cli("--scp", keys, "sd", "keys", "delete", "--force", "scp11b", "0")
- ykman_cli("--scp", keys, "sd", "keys", "generate", "scp11a", "3", "-")
-
- # Import OCE CA
- with open_file("scp/cert.ca-kloc.ecdsa.pem") as f:
- ykman_cli("--scp", keys, "sd", "keys", "import", "0x10", "3", f.name)
-
- # Authenticate
- with open_file("scp/oce.pfx") as f:
- certificates = parse_certificates(f.read(), b"password")
- serials = [c.serial_number for c in certificates]
-
- # Set to ok allowlist
- ykman_cli(
- "--scp",
- f.name,
- "--scp-password",
- "password",
- "sd",
- "keys",
- "set-allowlist",
- "0x10",
- "3",
- *(str(s) for s in serials),
- )
-
- # Set bad allowlist
- ykman_cli(
- "--scp",
- f.name,
- "--scp-password",
- "password",
- "sd",
- "keys",
- "set-allowlist",
- "0x10",
- "3",
- "123456789",
- )
-
- with pytest.raises(ApduError):
- ykman_cli("--scp", f.name, "--scp-password", "password", "sd", "info")
-
- # Remove allowlist
- ykman_cli(
- "--scp",
- keys,
- "sd",
- "keys",
- "set-allowlist",
- "0x10",
- "3",
- )
-
- ykman_cli(
- "--scp",
- f.name,
- "--scp-password",
- "password",
- "--scp-oce",
- "0x10",
- "3",
- "sd",
- "keys",
- "delete",
- "--force",
- "0x10",
- "3",
- )
-
-
-def test_scp11b_specify_kvn(ykman_cli):
- ykman_cli("--scp-sd", "1", "0", "sd", "keys", "generate", "scp11b", "2", "-")
- ykman_cli("--scp-sd", "0x13", "1", "sd", "info")
- ykman_cli("--scp-sd", "0x13", "2", "sd", "info")
-
-
-def test_scp11b_export(ykman_cli):
- ykman_cli("--scp-sd", "1", "0", "sd", "keys", "generate", "scp11b", "2", "-")
- pem = ykman_cli("sd", "keys", "export", "scp11b", "2", "-").output.encode()
-
- x509.load_pem_x509_certificate(pem)
+ certificates = parse_certificates(f.read(), b"password")
+ serials = [c.serial_number for c in certificates]
+
+ # Set to ok allowlist
+ ykman_cli(
+ "--scp",
+ f.name,
+ "--scp-password",
+ "password",
+ "sd",
+ "keys",
+ "set-allowlist",
+ "0x10",
+ "3",
+ *(str(s) for s in serials),
+ )
+
+ # Set bad allowlist
+ ykman_cli(
+ "--scp",
+ f.name,
+ "--scp-password",
+ "password",
+ "sd",
+ "keys",
+ "set-allowlist",
+ "0x10",
+ "3",
+ "123456789",
+ )
+
+ with pytest.raises(ApduError):
+ ykman_cli("--scp", f.name, "--scp-password", "password", "sd", "info")
+
+ # Remove allowlist
+ ykman_cli(
+ "--scp",
+ keys,
+ "sd",
+ "keys",
+ "set-allowlist",
+ "0x10",
+ "3",
+ )
+
+ ykman_cli(
+ "--scp",
+ f.name,
+ "--scp-password",
+ "password",
+ "--scp-oce",
+ "0x10",
+ "3",
+ "sd",
+ "keys",
+ "delete",
+ "--force",
+ "0x10",
+ "3",
+ )
+
+ def test_scp11b_specify_kvn(self, ykman_cli):
+ ykman_cli("--scp-sd", "1", "0", "sd", "keys", "generate", "scp11b", "2", "-")
+ ykman_cli("--scp-sd", "0x13", "1", "sd", "info")
+ ykman_cli("--scp-sd", "0x13", "2", "sd", "info")
+
+ def test_scp11b_export(self, ykman_cli):
+ ykman_cli("--scp-sd", "1", "0", "sd", "keys", "generate", "scp11b", "2", "-")
+ pem = ykman_cli("sd", "keys", "export", "scp11b", "2", "-").output.encode()
+
+ x509.load_pem_x509_certificate(pem)
diff --git a/tests/device/test_hsmauth.py b/tests/device/test_hsmauth.py
@@ -232,10 +232,9 @@ def test_change_management_key(self, session, management_key):
  with pytest.raises(InvalidPinError):
  import_key_derived(session, management_key)
 
- session.put_management_key(NON_DEFAULT_MANAGEMENT_KEY, management_key)
+ import_key_derived(session, NON_DEFAULT_MANAGEMENT_KEY)
 
  def test_management_key_retries(self, session, management_key):
- session.put_management_key(management_key, management_key)
  initial_retries = session.get_management_key_retries()
  assert initial_retries == 8
 

diff --git a/tests/device/test_securitydomain.py b/tests/device/test_securitydomain.py
@@ -46,9 +46,9 @@ def _verify_auth(sd):
 
 class TestScp03:
  @pytest.fixture(autouse=True)
- @condition.transport(TRANSPORT.USB)
- def preconditions(self):
- pass
+ def preconditions(self, info, transport):
+  if info.is_fips and transport != TRANSPORT.USB:
+  pytest.skip("SCP management on YK FIPS over NFC")
 
  def test_ok(self, session):
  session.authenticate(Scp03KeyParams())
@@ -111,9 +111,9 @@ def _load_scp11_keys(session, kid, kvn):
 
 class TestScp11:
  @pytest.fixture(autouse=True)
- @condition.transport(TRANSPORT.USB)
- def preconditions(self):
- pass
+ def preconditions(self, info, transport):
+  if info.is_fips and transport != TRANSPORT.USB:
+  pytest.skip("SCP management on YK FIPS over NFC")
 
  def test_scp11b_ok(self, session):
  ref = KeyRef(0x13, 0x1)