1*** Settings *** 2Documentation Test certificate in OpenBMC. 3 4Resource ../../lib/resource.robot 5Resource ../../lib/bmc_redfish_resource.robot 6Resource ../../lib/openbmc_ffdc.robot 7Resource ../../lib/certificate_utils.robot 8Library String 9 10Force Tags Certificate 11 12Suite Setup Suite Setup Execution 13Suite Teardown Suite Teardown 14Test Teardown Test Teardown Execution 15 16 17*** Variables *** 18 19${invalid_value} abc 20${ROOT_CA_FILE_PATH} /etc/ssl/certs/authority/* 21${keybit_length} ${2048} 22 23** Test Cases ** 24 25Verify Server Certificate Replace 26 [Documentation] Verify server certificate replace. 27 [Tags] Verify_Server_Certificate_Replace 28 [Template] Replace Certificate Via Redfish 29 30 # cert_type cert_format expected_status 31 Server Valid Certificate Valid Privatekey ok 32 Server Empty Certificate Valid Privatekey error 33 Server Valid Certificate Empty Privatekey error 34 Server Empty Certificate Empty Privatekey error 35 36 37Verify Client Certificate Replace 38 [Documentation] Verify client certificate replace. 39 [Tags] Verify_Client_Certificate_Replace 40 [Template] Replace Certificate Via Redfish 41 42 # cert_type cert_format expected_status 43 Client Valid Certificate Valid Privatekey ok 44 Client Empty Certificate Valid Privatekey error 45 Client Valid Certificate Empty Privatekey error 46 Client Empty Certificate Empty Privatekey error 47 48 49Verify CA Certificate Replace 50 [Documentation] Verify CA certificate replace. 51 [Tags] Verify_CA_Certificate_Replace 52 [Template] Replace Certificate Via Redfish 53 54 # cert_type cert_format expected_status 55 CA Valid Certificate ok 56 CA Empty Certificate error 57 58 59Verify Client Certificate Install 60 [Documentation] Verify client certificate install. 61 [Tags] Verify_Client_Certificate_Install 62 [Template] Install And Verify Certificate Via Redfish 63 64 # cert_type cert_format expected_status 65 Client Valid Certificate Valid Privatekey ok 66 Client Empty Certificate Valid Privatekey error 67 Client Valid Certificate Empty Privatekey error 68 Client Empty Certificate Empty Privatekey error 69 70 71Verify CA Certificate Install 72 [Documentation] Verify CA certificate install. 73 [Tags] Verify_CA_Certificate_Install 74 [Template] Install And Verify Certificate Via Redfish 75 76 # cert_type cert_format expected_status 77 CA Valid Certificate ok 78 CA Empty Certificate error 79 80 81Verify Maximum CA Certificate Install 82 [Documentation] Verify maximum CA certificate install. 83 [Tags] Verify_Maximum_CA_Certificate_Install 84 [Teardown] Run Keywords FFDC On Test Case Fail AND Delete All CA Certificate Via Redfish 85 86 # Get CA certificate count from BMC. 87 ${cert_list}= Redfish_Utils.Get Member List /redfish/v1/Managers/${MANAGER_ID}/Truststore/Certificates 88 ${cert_count}= Get Length ${cert_list} 89 90 # Install CA certificate to reach maximum count of 10. 91 FOR ${INDEX} IN RANGE ${cert_count} 10 92 Install And Verify Certificate Via Redfish CA Valid Certificate ok ${FALSE} 93 ${cert_count}= Evaluate ${cert_count} + 1 94 END 95 96 # Verify error while installing 11th CA certificate. 97 Install And Verify Certificate Via Redfish CA Valid Certificate error ${FALSE} 98 99 100Verify Error While Uploading Same CA Certificate 101 [Documentation] Verify error while uploading same CA certificate two times. 102 [Tags] Verify_Error_While_Uploading_Same_CA_Certificate 103 104 # Create certificate file for uploading. 105 ${cert_file_path}= Generate Certificate File Via Openssl Valid Certificate 365 106 ${bytes}= OperatingSystem.Get Binary File ${cert_file_path} 107 ${file_data}= Decode Bytes To String ${bytes} UTF-8 108 109 # Install CA certificate. 110 Install Certificate File On BMC ${REDFISH_CA_CERTIFICATE_URI} ok data=${file_data} 111 112 # Adding delay after certificate installation. 113 Sleep 30s 114 115 # Check error while uploading same certificate. 116 Install Certificate File On BMC ${REDFISH_CA_CERTIFICATE_URI} error data=${file_data} 117 118 119Verify Server Certificate View Via Openssl 120 [Documentation] Verify server certificate via openssl command. 121 [Tags] Verify_Server_Certificate_View_Via_Openssl 122 123 ${cert_file_path}= Generate Certificate File Via Openssl Valid Certificate Valid Privatekey 124 ${bytes}= OperatingSystem.Get Binary File ${cert_file_path} 125 ${file_data}= Decode Bytes To String ${bytes} UTF-8 126 127 ${certificate_dict}= Create Dictionary 128 ... @odata.id=/redfish/v1/Managers/${MANAGER_ID}/NetworkProtocol/HTTPS/Certificates/1 129 ${payload}= Create Dictionary CertificateString=${file_data} 130 ... CertificateType=PEM CertificateUri=${certificate_dict} 131 132 ${resp}= redfish.Post /redfish/v1/CertificateService/Actions/CertificateService.ReplaceCertificate 133 ... body=${payload} valid_status_codes=[${HTTP_OK}, ${HTTP_NO_CONTENT}] 134 135 Wait Until Keyword Succeeds 2 mins 15 secs Verify Certificate Visible Via OpenSSL ${cert_file_path} 136 137 138Verify CSR Generation For Server Certificate 139 [Documentation] Verify CSR generation for server certificate. 140 [Tags] Verify_CSR_Generation_For_Server_Certificate 141 [Template] Generate CSR Via Redfish 142 143 # csr_type key_pair_algorithm key_bit_length key_curv_id expected_status 144 Server RSA ${keybit_length} ${EMPTY} ok 145 Server EC ${EMPTY} prime256v1 ok 146 Server EC ${EMPTY} secp521r1 ok 147 Server EC ${EMPTY} secp384r1 ok 148 149 150Verify CSR Generation For Client Certificate 151 [Documentation] Verify CSR generation for client certificate. 152 [Tags] Verify_CSR_Generation_For_Client_Certificate 153 [Template] Generate CSR Via Redfish 154 155 # csr_type key_pair_algorithm key_bit_length key_curv_id expected_status 156 Client RSA ${keybit_length} ${EMPTY} ok 157 Client EC ${EMPTY} prime256v1 ok 158 Client EC ${EMPTY} secp521r1 ok 159 Client EC ${EMPTY} secp384r1 ok 160 161 162Verify CSR Generation For Server Certificate With Invalid Value 163 [Documentation] Verify error while generating CSR for server certificate with invalid value. 164 [Tags] Verify_CSR_Generation_For_Server_Certificate_With_Invalid_Value 165 [Template] Generate CSR Via Redfish 166 167 # csr_type key_pair_algorithm key_bit_length key_curv_id expected_status 168 Server ${invalid_value} ${keybit_length} prime256v1 error 169 Server RAS ${invalid_value} ${EMPTY} error 170 Server EC ${EMPTY} ${invalid_value} error 171 172 173Verify CSR Generation For Client Certificate With Invalid Value 174 [Documentation] Verify error while generating CSR for client certificate with invalid value. 175 [Tags] Verify_CSR_Generation_For_Client_Certificate_With_Invalid_Value 176 [Template] Generate CSR Via Redfish 177 178 Client ${invalid_value} ${keybit_length} prime256v1 error 179 Client RSA ${invalid_value} ${EMPTY} error 180 Client EC ${EMPTY} ${invalid_value} error 181 182 183Verify Expired Certificate Install 184 [Documentation] Verify installation of expired certificate. 185 [Tags] Verify_Expired_Certificate_Install 186 [Setup] Run Keywords Get Current BMC Date AND Modify BMC Date 187 [Template] Install And Verify Certificate Via Redfish 188 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore BMC Date 189 190 # cert_type cert_format expected_status 191 Client Expired Certificate ok 192 CA Expired Certificate ok 193 194 195Verify Expired Certificate Replace 196 [Documentation] Verify replacing the certificate with an expired one. 197 [Tags] Verify_Expired_Certificate_Replace 198 [Setup] Run Keywords Get Current BMC Date AND Modify BMC Date 199 [Template] Replace Certificate Via Redfish 200 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore BMC Date 201 202 # cert_type cert_format expected_status 203 Server Expired Certificate ok 204 205 206Verify Not Yet Valid Certificate Install 207 [Documentation] Verify installation of not yet valid certificates. 208 [Tags] Verify_Not_Yet_Valid_Certificate_Install 209 [Setup] Run Keywords Get Current BMC Date AND Modify BMC Date 210 [Template] Install And Verify Certificate Via Redfish 211 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore BMC Date 212 213 # cert_type cert_format expected_status 214 Client Not Yet Valid Certificate ok 215 CA Not Yet Valid Certificate ok 216 217 218Verify Not Yet Valid Certificate Replace 219 [Documentation] Verify replacing certificate with a not yet valid one. 220 [Tags] Verify_Not_Yet_Valid_Certificate_Replace 221 [Setup] Run Keywords Get Current BMC Date AND Modify BMC Date 222 [Template] Replace Certificate Via Redfish 223 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore BMC Date 224 225 # cert_type cert_format expected_status 226 Server Not Yet Valid Certificate ok 227 Client Not Yet Valid Certificate ok 228 CA Not Yet Valid Certificate ok 229 230 231Verify Certificates Location Via Redfish 232 [Documentation] Verify the location of certificates via Redfish. 233 [Tags] Verify_Certificates_Location_Via_Redfish 234 235 ${cert_id}= Install And Verify Certificate Via Redfish 236 ... CA Valid Certificate ok 237 238 ${resp}= Redfish.Get /redfish/v1/CertificateService/CertificateLocations 239 ${Links}= Get From Dictionary ${resp.dict} Links 240 241 ${match_cert}= Catenate 242 ... /redfish/v1/Managers/${MANAGER_ID}/Truststore/Certificates/${cert_id} 243 ${match}= Set Variable ${False} 244 245 FOR ${Certificates_dict} IN @{Links['Certificates']} 246 Continue For Loop If 247 ... "${Certificates_dict['@odata.id']}}" != "${match_cert}}" 248 ${match}= Set Variable ${True} 249 END 250 251 Should Be Equal ${match} ${True} 252 ... msg=Verify the location of certificates via Redfish fail. 253 254 255*** Keywords *** 256 257Get Current BMC Date 258 [Documentation] Get current BMC date. 259 260 ${cli_date_time}= CLI Get BMC DateTime 261 Set Test Variable ${cli_date_time} 262 263Restore BMC Date 264 [Documentation] Restore BMC date to its prior value. 265 266 Redfish.Patch ${REDFISH_BASE_URI}Managers/${MANAGER_ID} body={'DateTime': '${cli_date_time}'} 267 ... valid_status_codes=[${HTTP_OK}] 268 269 270Generate CSR Via Redfish 271 [Documentation] Generate CSR using Redfish. 272 [Arguments] ${cert_type} ${key_pair_algorithm} ${key_bit_length} ${key_curv_id} ${expected_status} 273 274 # Description of argument(s): 275 # cert_type Certificate type ("Server" or "Client"). 276 # key_pair_algorithm CSR key pair algorithm ("EC" or "RSA") 277 # key_bit_length CSR key bit length ("2048"). 278 # key_curv_id CSR key curv id ("prime256v1" or "secp521r1" or "secp384r1"). 279 # expected_status Expected status of certificate replace Redfish 280 # request ("ok" or "error"). 281 282 ${certificate_uri}= Set Variable If 283 ... '${cert_type}' == 'Server' ${REDFISH_HTTPS_CERTIFICATE_URI}/ 284 ... '${cert_type}' == 'Client' ${REDFISH_LDAP_CERTIFICATE_URI}/ 285 286 ${certificate_dict}= Create Dictionary @odata.id=${certificate_uri} 287 ${payload}= Create Dictionary City=Austin CertificateCollection=${certificate_dict} 288 ... CommonName=${OPENBMC_HOST} Country=US Organization=xyz 289 ... OrganizationalUnit=ISL State=AU KeyBitLength=${key_bit_length} 290 ... KeyPairAlgorithm=${key_pair_algorithm} KeyCurveId=${key_curv_id} 291 292 # Remove not applicable field for CSR generation. 293 Run Keyword If '${key_pair_algorithm}' == 'EC' Remove From Dictionary ${payload} KeyBitLength 294 ... ELSE IF '${key_pair_algorithm}' == 'RSA' Remove From Dictionary ${payload} KeyCurveId 295 296 ${expected_resp}= Set Variable If '${expected_status}' == 'ok' ${HTTP_OK} 297 ... '${expected_status}' == 'error' ${HTTP_INTERNAL_SERVER_ERROR}, ${HTTP_BAD_REQUEST} 298 ${resp}= redfish.Post /redfish/v1/CertificateService/Actions/CertificateService.GenerateCSR 299 ... body=${payload} valid_status_codes=[${expected_resp}] 300 301 # Delay added between two CSR generation request. 302 Sleep 5s 303 304 305Suite Setup Execution 306 [Documentation] Do suite setup tasks. 307 308 # Create certificate sub-directory in current working directory. 309 Create Directory certificate_dir 310 Redfish.Login 311 312 313Test Teardown Execution 314 [Documentation] Do the post test teardown. 315 316 FFDC On Test Case Fail 317 318Suite Teardown 319 [Documentation] Do suite teardown tasks. 320 321 Redfish.Logout 322