1*** Settings ***
2Documentation  Certificate utilities keywords.
3
4Library        OperatingSystem
5Resource       rest_client.robot
6Resource       resource.robot
7
8*** Variables ***
9
10# Default wait sync time for certificate install and restart services.
11${wait_time}    30
12${keybit_length}  2048
13
14*** Keywords ***
15
16Install Certificate File On BMC
17    [Documentation]  Install certificate file in BMC using POST operation.
18    [Arguments]  ${uri}  ${status}=ok  &{kwargs}
19
20    # Description of argument(s):
21    # uri         URI for installing certificate file via Redfish
22    #             e.g. "/redfish/v1/AccountService/LDAP/Certificates".
23    # status      Expected status of certificate installation via Redfish
24    #             e.g. error, ok.
25    # kwargs      A dictionary of keys/values to be passed directly to
26    #             POST Request.
27
28    Initialize OpenBMC
29
30    ${headers}=  Create Dictionary  Content-Type=application/octet-stream
31    ...  X-Auth-Token=${XAUTH_TOKEN}
32    Set To Dictionary  ${kwargs}  headers  ${headers}
33
34    ${resp}=  POST On Session  openbmc  ${uri}  &{kwargs}  expected_status=any
35    ${cert_id}=  Set Variable If  '${resp.status_code}' == '${HTTP_OK}'  ${resp.json()["Id"]}  -1
36
37    Run Keyword If  '${status}' == 'ok'
38    ...  Should Be Equal As Strings  ${resp.status_code}  ${HTTP_OK}
39    ...  ELSE IF  '${status}' == 'error'
40    ...  Should Be Equal As Strings  ${resp.status_code}  ${HTTP_INTERNAL_SERVER_ERROR}
41
42    Delete All Sessions
43
44    [Return]  ${cert_id}
45
46
47Get Certificate Content From BMC Via Openssl
48    [Documentation]  Get certificate content from BMC via openssl.
49
50    Check If Openssl Tool Exist
51
52    ${openssl_cmd}=  Catenate
53    ...  timeout 10  openssl s_client -connect ${OPENBMC_HOST}:${HTTPS_PORT} -showcerts
54    ${output}=  Run  ${openssl_cmd}
55
56    ${result}=  Fetch From Left
57    ...  ${output}  -----END CERTIFICATE-----
58    ${result}=  Fetch From Right  ${result}  -----BEGIN CERTIFICATE-----
59    [Return]  ${result}
60
61
62Get Certificate File Content From BMC
63    [Documentation]  Get required certificate file content from BMC.
64    [Arguments]  ${cert_type}=Client
65
66    # Description of argument(s):
67    # cert_type      Certificate type (e.g. "Client" or "CA").
68
69    ${certificate}  ${stderr}  ${rc}=  Run Keyword If  '${cert_type}' == 'Client'
70    ...    BMC Execute Command  cat /etc/nslcd/certs/cert.pem
71
72    [Return]  ${certificate}
73
74
75Generate Certificate File Via Openssl
76    [Documentation]  Create certificate file via openssl with required content
77    ...              and returns its path.
78    [Arguments]  ${cert_format}  ${time}=365  ${cert_dir_name}=certificate_dir
79
80    # Description of argument(s):
81    # cert_format          Certificate file format
82    #                      e.g. Valid_Certificate_Empty_Privatekey.
83    # time                 Number of days to certify the certificate for.
84    # cert_dir_name        The name of the sub-directory where the certificate
85    #                      is stored.
86
87    Check If Openssl Tool Exist
88
89    ${openssl_cmd}=  Catenate  openssl req -x509 -sha256 -newkey rsa:${keybit_length}
90    ...  ${SPACE}-nodes -days ${time}
91    ...  ${SPACE}-keyout ${cert_dir_name}/cert.pem -out ${cert_dir_name}/cert.pem
92    ...  ${SPACE}-subj "/O=XYZ Corporation /CN=www.xyz.com"
93
94    ${rc}  ${output}=  Run And Return RC and Output  ${openssl_cmd}
95    Should Be Equal  ${rc}  ${0}  msg=${output}
96    OperatingSystem.File Should Exist
97    ...  ${EXECDIR}${/}${cert_dir_name}${/}cert.pem
98
99    ${file_content}=  OperatingSystem.Get File
100    ...  ${EXECDIR}${/}${cert_dir_name}${/}cert.pem
101    ${result}=  Fetch From Left  ${file_content}  -----END CERTIFICATE-----
102    ${cert_content}=  Fetch From Right  ${result}  -----BEGIN CERTIFICATE-----
103
104    ${result}=  Fetch From Left  ${file_content}  -----END PRIVATE KEY-----
105    ${private_key_content}=  Fetch From Right  ${result}  -----BEGIN PRIVATE KEY-----
106
107    ${cert_data}=
108    ...  Run Keyword if  '${cert_format}' == 'Valid Certificate Valid Privatekey'
109    ...  OperatingSystem.Get File  ${EXECDIR}${/}${cert_dir_name}${/}cert.pem
110    ...  ELSE IF  '${cert_format}' == 'Empty Certificate Valid Privatekey'
111    ...  Remove String  ${file_content}  ${cert_content}
112    ...  ELSE IF  '${cert_format}' == 'Valid Certificate Empty Privatekey'
113    ...  Remove String  ${file_content}  ${private_key_content}
114    ...  ELSE IF  '${cert_format}' == 'Empty Certificate Empty Privatekey'
115    ...  Remove String  ${file_content}  ${cert_content}  ${private_key_content}
116    ...  ELSE IF  '${cert_format}' == 'Expired Certificate' or '${cert_format}' == 'Not Yet Valid Certificate'
117    ...  OperatingSystem.Get File  ${EXECDIR}${/}${cert_dir_name}${/}cert.pem
118    ...  ELSE IF  '${cert_format}' == 'Valid Certificate'
119    ...  Remove String  ${file_content}  ${private_key_content}
120    ...  -----BEGIN PRIVATE KEY-----  -----END PRIVATE KEY-----
121    ...  ELSE IF  '${cert_format}' == 'Empty Certificate'
122    ...  Remove String  ${file_content}  ${cert_content}
123    ...  ${private_key_content}  -----BEGIN PRIVATE KEY-----
124    ...  -----END PRIVATE KEY-----
125
126    ${random_name}=  Generate Random String  8
127    ${cert_name}=  Catenate  SEPARATOR=  ${random_name}  .pem
128    Create File  ${cert_dir_name}/${cert_name}  ${cert_data}
129
130    [Return]  ${EXECDIR}${/}${cert_dir_name}${/}${cert_name}
131
132
133Get Certificate Content From File
134    [Documentation]  Get certificate content from certificate file.
135    [Arguments]  ${cert_file_path}
136
137    # Description of argument(s):
138    # cert_file_path  Downloaded certificate file path.
139
140    ${file_content}=  OperatingSystem.Get File  ${cert_file_path}
141    ${result}=  Fetch From Left  ${file_content}  -----END CERTIFICATE-----
142    ${result}=  Fetch From Right  ${result}  -----BEGIN CERTIFICATE-----
143    [Return]  ${result}
144
145
146Check If Openssl Tool Exist
147    [Documentation]  Check if openssl tool installed or not.
148
149    ${rc}  ${output}=  Run And Return RC and Output  which openssl
150    Should Not Be Empty  ${output}  msg=Openssl tool not installed.
151
152
153Verify Certificate Visible Via OpenSSL
154    [Documentation]  Checks if given certificate is visible via openssl's showcert command.
155    [Arguments]  ${cert_file_path}
156
157    # Description of argument(s):
158    # cert_file_path           Certificate file path.
159
160    ${cert_file_content}=  OperatingSystem.Get File  ${cert_file_path}
161    ${openssl_cert_content}=  Get Certificate Content From BMC Via Openssl
162    Should Contain  ${cert_file_content}  ${openssl_cert_content}
163
164
165Delete All CA Certificate Via Redfish
166    [Documentation]  Delete all CA certificate via Redfish.
167    ${cert_list}=  Redfish_Utils.Get Member List  /redfish/v1/Managers/${MANAGER_ID}/Truststore/Certificates
168    FOR  ${cert}  IN  @{cert_list}
169      Redfish.Delete  ${cert}  valid_status_codes=[${HTTP_NO_CONTENT}]
170      Log To Console  Wait Time started in seconds ${wait_time}
171      Sleep  ${wait_time}s
172    END
173
174
175Delete Certificate Via BMC CLI
176    [Documentation]  Delete certificate via BMC CLI.
177    [Arguments]  ${cert_type}
178
179    # Description of argument(s):
180    # cert_type           Certificate type (e.g. "Client" or "CA").
181
182    ${certificate_file_path}  ${certificate_service}  ${certificate_uri}=
183    ...  Run Keyword If  '${cert_type}' == 'Client'
184    ...    Set Variable  /etc/nslcd/certs/cert.pem  phosphor-certificate-manager@nslcd.service
185    ...    ${REDFISH_LDAP_CERTIFICATE_URI}
186    ...  ELSE IF  '${cert_type}' == 'CA'
187    ...    Set Variable  ${ROOT_CA_FILE_PATH}  phosphor-certificate-manager@authority.service
188    ...    ${REDFISH_CA_CERTIFICATE_URI}
189
190    ${file_status}  ${stderr}  ${rc}=  BMC Execute Command
191    ...  [ -f ${certificate_file_path} ] && echo "Found" || echo "Not Found"
192
193    Return From Keyword If  "${file_status}" != "Found"
194    BMC Execute Command  rm ${certificate_file_path}
195    BMC Execute Command  systemctl restart ${certificate_service}
196    BMC Execute Command  systemctl daemon-reload
197    Wait Until Keyword Succeeds  1 min  10 sec  Redfish.Get  ${certificate_uri}/1
198    ...  valid_status_codes=[${HTTP_NOT_FOUND}, ${HTTP_INTERNAL_SERVER_ERROR}]
199
200
201Replace Certificate Via Redfish
202    [Documentation]  Test 'replace certificate' operation in the BMC via Redfish.
203    [Arguments]  ${cert_type}  ${cert_format}  ${expected_status}
204
205    # Description of argument(s):
206    # cert_type           Certificate type (e.g. "Server" or "Client").
207    # cert_format         Certificate file format
208    #                     (e.g. Valid_Certificate_Valid_Privatekey).
209    # expected_status     Expected status of certificate replace Redfish
210    #                     request (i.e. "ok" or "error").
211
212    # Install certificate before replacing client or CA certificate.
213    ${cert_id}=  Run Keyword If  '${cert_type}' == 'Client'
214    ...    Install And Verify Certificate Via Redfish  ${cert_type}  Valid Certificate Valid Privatekey  ok
215    ...  ELSE IF  '${cert_type}' == 'CA'
216    ...    Install And Verify Certificate Via Redfish  ${cert_type}  Valid Certificate  ok
217
218    ${cert_file_path}=  Generate Certificate File Via Openssl  ${cert_format}
219
220    ${bytes}=  OperatingSystem.Get Binary File  ${cert_file_path}
221    ${file_data}=  Decode Bytes To String  ${bytes}  UTF-8
222
223    Run Keyword If  '${cert_format}' == 'Expired Certificate'
224    ...    Modify BMC Date  future
225    ...  ELSE IF  '${cert_format}' == 'Not Yet Valid Certificate'
226    ...    Modify BMC Date  old
227
228
229    ${certificate_uri}=  Set Variable If
230    ...  '${cert_type}' == 'Server'  ${REDFISH_HTTPS_CERTIFICATE_URI}/1
231    ...  '${cert_type}' == 'Client'  ${REDFISH_LDAP_CERTIFICATE_URI}/1
232    ...  '${cert_type}' == 'CA'  ${REDFISH_CA_CERTIFICATE_URI}/${cert_id}
233
234    ${certificate_dict}=  Create Dictionary  @odata.id=${certificate_uri}
235    ${payload}=  Create Dictionary  CertificateString=${file_data}
236    ...  CertificateType=PEM  CertificateUri=${certificate_dict}
237
238    ${expected_resp}=  Set Variable If  '${expected_status}' == 'ok'  ${HTTP_OK}, ${HTTP_NO_CONTENT}
239    ...  '${expected_status}' == 'error'  ${HTTP_NOT_FOUND}, ${HTTP_INTERNAL_SERVER_ERROR}
240    ${resp}=  redfish.Post  /redfish/v1/CertificateService/Actions/CertificateService.ReplaceCertificate
241    ...  body=${payload}  valid_status_codes=[${expected_resp}]
242
243    ${cert_file_content}=  OperatingSystem.Get File  ${cert_file_path}
244    ${bmc_cert_content}=  redfish_utils.Get Attribute  ${certificate_uri}  CertificateString
245
246    Run Keyword If  '${expected_status}' == 'ok'
247    ...    Should Contain  ${cert_file_content}  ${bmc_cert_content}
248    ...  ELSE
249    ...    Should Not Contain  ${cert_file_content}  ${bmc_cert_content}
250
251
252Install And Verify Certificate Via Redfish
253    [Documentation]  Install and verify certificate using Redfish.
254    [Arguments]  ${cert_type}  ${cert_format}  ${expected_status}  ${delete_cert}=${True}
255
256    # Description of argument(s):
257    # cert_type           Certificate type (e.g. "Client" or "CA").
258    # cert_format         Certificate file format
259    #                     (e.g. "Valid_Certificate_Valid_Privatekey").
260    # expected_status     Expected status of certificate replace Redfish
261    #                     request (i.e. "ok" or "error").
262    # delete_cert         Certificate will be deleted before installing if this True.
263
264    Run Keyword If  '${cert_type}' == 'CA' and '${delete_cert}' == '${True}'
265    ...  Delete All CA Certificate Via Redfish
266    ...  ELSE IF  '${cert_type}' == 'Client' and '${delete_cert}' == '${True}'
267    ...  Delete Certificate Via BMC CLI  ${cert_type}
268
269    ${cert_file_path}=  Generate Certificate File Via Openssl  ${cert_format}
270    ${bytes}=  OperatingSystem.Get Binary File  ${cert_file_path}
271    ${file_data}=  Decode Bytes To String  ${bytes}  UTF-8
272
273    ${certificate_uri}=  Set Variable If
274    ...  '${cert_type}' == 'Client'  ${REDFISH_LDAP_CERTIFICATE_URI}
275    ...  '${cert_type}' == 'CA'  ${REDFISH_CA_CERTIFICATE_URI}
276
277    Run Keyword If  '${cert_format}' == 'Expired Certificate'  Modify BMC Date  future
278    ...  ELSE IF  '${cert_format}' == 'Not Yet Valid Certificate'  Modify BMC Date  old
279
280    ${cert_id}=  Install Certificate File On BMC  ${certificate_uri}  ${expected_status}  data=${file_data}
281    Logging  Installed certificate id: ${cert_id}
282
283    # Adding delay after certificate installation.
284    # Lesser wait timing causes bmcweb to restart quickly and breaks the web services.
285    Log To Console  Wait Time started in seconds ${wait_time}
286    Sleep  ${wait_time}s
287
288    ${cert_file_content}=  OperatingSystem.Get File  ${cert_file_path}
289    ${bmc_cert_content}=  Run Keyword If  '${expected_status}' == 'ok'  redfish_utils.Get Attribute
290    ...  ${certificate_uri}/${cert_id}  CertificateString
291
292    Run Keyword If  '${expected_status}' == 'ok'  Should Contain  ${cert_file_content}  ${bmc_cert_content}
293    [Return]  ${cert_id}
294
295
296Modify BMC Date
297    [Documentation]  Modify date in BMC.
298    [Arguments]  ${date_set_type}=current
299
300    # Description of argument(s):
301    # date_set_type    Set BMC date to a current, future, old date by 375 days.
302    #                  current - Sets date to local system date.
303    #                  future - Sets to a future date from current date.
304    #                  old - Sets to a old date from current date.
305
306    Redfish Power Off  stack_mode=skip
307    ${current_date_time}=  Get Current Date
308    ${new_time}=  Run Keyword If  '${date_set_type}' == 'current'  Set Variable  ${current_date_time}
309    ...  ELSE IF  '${date_set_type}' == 'future'
310    ...  Add Time To Date  ${current_date_time}  375 days
311    ...  ELSE IF  '${date_set_type}' == 'old'
312    ...  Subtract Time From Date  ${current_date_time}  375 days
313
314    # Enable manual mode.
315    Redfish.Patch  ${REDFISH_NW_PROTOCOL_URI}
316    ...  body={'NTP':{'ProtocolEnabled': ${False}}}
317    ...  valid_status_codes=[${HTTP_OK}, ${HTTP_NO_CONTENT}]
318
319    # NTP network takes few seconds to restart.
320    Wait Until Keyword Succeeds  30 sec  10 sec
321    ...  Redfish.Patch  ${REDFISH_BASE_URI}Managers/${MANAGER_ID}  body={'DateTime': '${new_time}'}
322    ...  valid_status_codes=[${HTTP_OK}]
323