1*** Settings ***
2Documentation    Test certificate in OpenBMC.
3
4Resource         ../../lib/resource.robot
5Resource         ../../lib/bmc_redfish_resource.robot
6Resource         ../../lib/openbmc_ffdc.robot
7Resource         ../../lib/certificate_utils.robot
8Library          String
9
10Force Tags       Certificate_Test
11
12Suite Setup      Suite Setup Execution
13Suite Teardown   Suite Teardown
14Test Teardown    Test Teardown Execution
15
16
17*** Variables ***
18
19${invalid_value}  abc
20${ROOT_CA_FILE_PATH}  /etc/ssl/certs/authority/*
21
22
23** Test Cases **
24
25Verify Server Certificate Replace
26    [Documentation]  Verify server certificate replace.
27    [Tags]  Verify_Server_Certificate_Replace
28    [Template]  Replace Certificate Via Redfish
29
30    # cert_type  cert_format                         expected_status
31    Server       Valid Certificate Valid Privatekey  ok
32    Server       Empty Certificate Valid Privatekey  error
33    Server       Valid Certificate Empty Privatekey  error
34    Server       Empty Certificate Empty Privatekey  error
35
36
37Verify Client Certificate Replace
38    [Documentation]  Verify client certificate replace.
39    [Tags]  Verify_Client_Certificate_Replace
40    [Template]  Replace Certificate Via Redfish
41
42    # cert_type  cert_format                         expected_status
43    Client       Valid Certificate Valid Privatekey  ok
44    Client       Empty Certificate Valid Privatekey  error
45    Client       Valid Certificate Empty Privatekey  error
46    Client       Empty Certificate Empty Privatekey  error
47
48
49Verify CA Certificate Replace
50    [Documentation]  Verify CA certificate replace.
51    [Tags]  Verify_CA_Certificate_Replace
52    [Template]  Replace Certificate Via Redfish
53
54    # cert_type  cert_format        expected_status
55    CA           Valid Certificate  ok
56    CA           Empty Certificate  error
57
58
59Verify Client Certificate Install
60    [Documentation]  Verify client certificate install.
61    [Tags]  Verify_Client_Certificate_Install
62    [Template]  Install And Verify Certificate Via Redfish
63
64    # cert_type  cert_format                         expected_status
65    Client       Valid Certificate Valid Privatekey  ok
66    Client       Empty Certificate Valid Privatekey  error
67    Client       Valid Certificate Empty Privatekey  error
68    Client       Empty Certificate Empty Privatekey  error
69
70
71Verify CA Certificate Install
72    [Documentation]  Verify CA certificate install.
73    [Tags]  Verify_CA_Certificate_Install
74    [Template]  Install And Verify Certificate Via Redfish
75
76    # cert_type  cert_format        expected_status
77    CA           Valid Certificate  ok
78    CA           Empty Certificate  error
79
80
81Verify Maximum CA Certificate Install
82    [Documentation]  Verify maximum CA certificate install.
83    [Tags]  Verify_Maximum_CA_Certificate_Install
84    [Teardown]  Run Keywords  FFDC On Test Case Fail  AND  Delete All CA Certificate Via Redfish
85
86    # Get CA certificate count from BMC.
87    ${cert_list}=  Redfish_Utils.Get Member List  /redfish/v1/Managers/bmc/Truststore/Certificates
88    ${cert_count}=  Get Length  ${cert_list}
89
90    # Install CA certificate to reach maximum count of 10.
91    FOR  ${INDEX}  IN RANGE  ${cert_count}  10
92      Install And Verify Certificate Via Redfish  CA  Valid Certificate  ok  ${FALSE}
93      ${cert_count}=  Evaluate  ${cert_count} + 1
94    END
95
96    # Verify error while installing 11th CA certificate.
97    Install And Verify Certificate Via Redfish  CA  Valid Certificate  error  ${FALSE}
98
99
100Verify Error While Uploding Same CA Certificate
101    [Documentation]  Verify error while uploading same CA certificate two times.
102    [Tags]  Verify_Error_While_Uploding_Same_CA_Certificate
103
104    # Create certificate file for uploading.
105    ${cert_file_path}=  Generate Certificate File Via Openssl  Valid Certificate  365
106    ${bytes}=  OperatingSystem.Get Binary File  ${cert_file_path}
107    ${file_data}=  Decode Bytes To String  ${bytes}  UTF-8
108
109    # Install CA certificate.
110    Install Certificate File On BMC  ${REDFISH_CA_CERTIFICATE_URI}  ok  data=${file_data}
111
112    # Adding delay after certificate installation.
113    Sleep  30s
114
115    # Check error while uploading same certificate.
116    Install Certificate File On BMC  ${REDFISH_CA_CERTIFICATE_URI}  error  data=${file_data}
117
118
119Verify Server Certificate View Via Openssl
120    [Documentation]  Verify server certificate via openssl command.
121    [Tags]  Verify_Server_Certificate_View_Via_Openssl
122
123    ${cert_file_path}=  Generate Certificate File Via Openssl  Valid Certificate Valid Privatekey
124    ${bytes}=  OperatingSystem.Get Binary File  ${cert_file_path}
125    ${file_data}=  Decode Bytes To String  ${bytes}  UTF-8
126
127    ${certificate_dict}=  Create Dictionary
128    ...  @odata.id=/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1
129    ${payload}=  Create Dictionary  CertificateString=${file_data}
130    ...  CertificateType=PEM  CertificateUri=${certificate_dict}
131
132    ${resp}=  redfish.Post  /redfish/v1/CertificateService/Actions/CertificateService.ReplaceCertificate
133    ...  body=${payload}
134
135    Wait Until Keyword Succeeds  2 mins  15 secs  Verify Certificate Visible Via OpenSSL  ${cert_file_path}
136
137
138Verify CSR Generation For Server Certificate
139    [Documentation]  Verify CSR generation for server certificate.
140    [Tags]  Verify_CSR_Generation_For_Server_Certificate
141    [Template]  Generate CSR Via Redfish
142
143    # csr_type  key_pair_algorithm  key_bit_length  key_curv_id  expected_status
144    Server      RSA                 ${2048}         ${EMPTY}     ok
145    Server      EC                  ${EMPTY}        prime256v1   ok
146    Server      EC                  ${EMPTY}        secp521r1    ok
147    Server      EC                  ${EMPTY}        secp384r1    ok
148
149
150Verify CSR Generation For Client Certificate
151    [Documentation]  Verify CSR generation for client certificate.
152    [Tags]  Verify_CSR_Generation_For_Client_Certificate
153    [Template]  Generate CSR Via Redfish
154
155    # csr_type  key_pair_algorithm  key_bit_length  key_curv_id  expected_status
156    Client      RSA                 ${2048}         ${EMPTY}     ok
157    Client      EC                  ${EMPTY}        prime256v1   ok
158    Client      EC                  ${EMPTY}        secp521r1    ok
159    Client      EC                  ${EMPTY}        secp384r1    ok
160
161
162Verify CSR Generation For Server Certificate With Invalid Value
163    [Documentation]  Verify error while generating CSR for server certificate with invalid value.
164    [Tags]  Verify_CSR_Generation_For_Server_Certificate_With_Invalid_Value
165    [Template]  Generate CSR Via Redfish
166
167    # csr_type  key_pair_algorithm  key_bit_length    key_curv_id       expected_status
168    Server      ${invalid_value}    ${2048}           prime256v1        error
169    Server      RAS                 ${invalid_value}  ${EMPTY}          error
170    Server      EC                  ${EMPTY}          ${invalid_value}  error
171
172
173Verify CSR Generation For Client Certificate With Invalid Value
174    [Documentation]  Verify error while generating CSR for client certificate with invalid value.
175    [Tags]  Verify_CSR_Generation_For_Client_Certificate_With_Invalid_Value
176    [Template]  Generate CSR Via Redfish
177
178    Client      ${invalid_value}    ${2048}           prime256v1        error
179    Client      RSA                 ${invalid_value}  ${EMPTY}          error
180    Client      EC                  ${EMPTY}          ${invalid_value}  error
181
182
183Verify Expired Certificate Install
184    [Documentation]  Verify installation of expired certificate.
185    [Tags]  Verify_Expired_Certificate_Install
186    [Setup]  Run Keywords  Get Current BMC Date  AND  Modify BMC Date
187    [Template]  Install And Verify Certificate Via Redfish
188    [Teardown]  Run Keywords  FFDC On Test Case Fail  AND  Restore BMC Date
189
190    # cert_type  cert_format          expected_status
191    Client       Expired Certificate  error
192    CA           Expired Certificate  error
193
194
195Verify Expired Certificate Replace
196    [Documentation]  Verify replacing the certificate with an expired one.
197    [Tags]  Verify_Expired_Certificate_Replace
198    [Setup]  Run Keywords  Get Current BMC Date  AND  Modify BMC Date
199    [Template]  Replace Certificate Via Redfish
200    [Teardown]  Run Keywords  FFDC On Test Case Fail  AND  Restore BMC Date
201
202    # cert_type  cert_format          expected_status
203    Server       Expired Certificate  error
204
205
206Verify Not Yet Valid Certificate Install
207    [Documentation]  Verify installation of not yet valid certificates.
208    [Tags]  Verify_Not_Yet_Valid_Certificate_Install
209    [Setup]  Run Keywords  Get Current BMC Date  AND  Modify BMC Date
210    [Template]  Install And Verify Certificate Via Redfish
211    [Teardown]  Run Keywords  FFDC On Test Case Fail  AND  Restore BMC Date
212
213    # cert_type  cert_format                expected_status
214    Client       Not Yet Valid Certificate  ok
215    CA           Not Yet Valid Certificate  ok
216
217
218Verify Not Yet Valid Certificate Replace
219    [Documentation]  Verify replacing certificate with a not yet valid one.
220    [Tags]  Verify_Not_Yet_Valid_Certificate_Replace
221    [Setup]  Run Keywords  Get Current BMC Date  AND  Modify BMC Date
222    [Template]  Replace Certificate Via Redfish
223    [Teardown]  Run Keywords  FFDC On Test Case Fail  AND  Restore BMC Date
224
225    # cert_type  cert_format                expected_status
226    Server       Not Yet Valid Certificate  ok
227    Client       Not Yet Valid Certificate  ok
228    CA           Not Yet Valid Certificate  ok
229
230
231*** Keywords ***
232
233Install And Verify Certificate Via Redfish
234    [Documentation]  Install and verify certificate using Redfish.
235    [Arguments]  ${cert_type}  ${cert_format}  ${expected_status}  ${delete_cert}=${True}
236
237    # Description of argument(s):
238    # cert_type           Certificate type (e.g. "Client" or "CA").
239    # cert_format         Certificate file format
240    #                     (e.g. "Valid_Certificate_Valid_Privatekey").
241    # expected_status     Expected status of certificate replace Redfish
242    #                     request (i.e. "ok" or "error").
243    # delete_cert         Certificate will be deleted before installing if this True.
244
245    Run Keyword If  '${cert_type}' == 'CA' and '${delete_cert}' == '${True}'
246    ...  Delete All CA Certificate Via Redfish
247    ...  ELSE IF  '${cert_type}' == 'Client' and '${delete_cert}' == '${True}'
248    ...  Delete Certificate Via BMC CLI  ${cert_type}
249
250    ${cert_file_path}=  Generate Certificate File Via Openssl  ${cert_format}
251    ${bytes}=  OperatingSystem.Get Binary File  ${cert_file_path}
252    ${file_data}=  Decode Bytes To String  ${bytes}  UTF-8
253
254    ${certificate_uri}=  Set Variable If
255    ...  '${cert_type}' == 'Client'  ${REDFISH_LDAP_CERTIFICATE_URI}
256    ...  '${cert_type}' == 'CA'  ${REDFISH_CA_CERTIFICATE_URI}
257
258    Run Keyword If  '${cert_format}' == 'Expired Certificate'  Modify BMC Date  future
259    ...  ELSE IF  '${cert_format}' == 'Not Yet Valid Certificate'  Modify BMC Date  old
260
261    ${cert_id}=  Install Certificate File On BMC  ${certificate_uri}  ${expected_status}  data=${file_data}
262    Logging  Installed certificate id: ${cert_id}
263
264    # Adding delay after certificate installation.
265    Sleep  30s
266
267    ${cert_file_content}=  OperatingSystem.Get File  ${cert_file_path}
268    ${bmc_cert_content}=  Run Keyword If  '${expected_status}' == 'ok'  redfish_utils.Get Attribute
269    ...  ${certificate_uri}/${cert_id}  CertificateString
270
271    Run Keyword If  '${expected_status}' == 'ok'  Should Contain  ${cert_file_content}  ${bmc_cert_content}
272    [Return]  ${cert_id}
273
274Modify BMC Date
275    [Documentation]  Modify date in BMC.
276    [Arguments]  ${date_set_type}=current
277
278    # Description of argument(s):
279    # date_set_type    Set BMC date to a current, future, old date by 375 days.
280    #                  current - Sets date to local system date.
281    #                  future - Sets to a future date from current date.
282    #                  old - Sets to a old date from current date.
283
284    Redfish Power Off  stack_mode=skip
285    ${current_date_time}=  Get Current Date
286    ${new_time}=  Run Keyword If  '${date_set_type}' == 'current'  Set Variable  ${current_date_time}
287    ...  ELSE IF  '${date_set_type}' == 'future'
288    ...  Add Time To Date  ${current_date_time}  375 days
289    ...  ELSE IF  '${date_set_type}' == 'old'
290    ...  Subtract Time From Date  ${current_date_time}  375 days
291
292    # Enable manual mode.
293    Redfish.Patch  ${REDFISH_NW_PROTOCOL_URI}
294    ...  body={'NTP':{'ProtocolEnabled': ${False}}}
295    ...  valid_status_codes=[${HTTP_OK}, ${HTTP_NO_CONTENT}]
296    Sleep  2s
297    Redfish.Patch  ${REDFISH_BASE_URI}Managers/bmc  body={'DateTime': '${new_time}'}
298    ...  valid_status_codes=[${HTTP_OK}]
299
300Get Current BMC Date
301    [Documentation]  Get current BMC date.
302
303    ${cli_date_time}=  CLI Get BMC DateTime
304    Set Test Variable  ${cli_date_time}
305
306Restore BMC Date
307    [Documentation]  Restore BMC date to its prior value.
308
309    Redfish.Patch  ${REDFISH_BASE_URI}Managers/bmc  body={'DateTime': '${cli_date_time}'}
310    ...  valid_status_codes=[${HTTP_OK}]
311
312Replace Certificate Via Redfish
313    [Documentation]  Test 'replace certificate' operation in the BMC via Redfish.
314    [Arguments]  ${cert_type}  ${cert_format}  ${expected_status}
315
316    # Description of argument(s):
317    # cert_type           Certificate type (e.g. "Server" or "Client").
318    # cert_format         Certificate file format
319    #                     (e.g. Valid_Certificate_Valid_Privatekey).
320    # expected_status     Expected status of certificate replace Redfish
321    #                     request (i.e. "ok" or "error").
322
323    # Install certificate before replacing client or CA certificate.
324    ${cert_id}=  Run Keyword If  '${cert_type}' == 'Client'
325    ...    Install And Verify Certificate Via Redfish  ${cert_type}  Valid Certificate Valid Privatekey  ok
326    ...  ELSE IF  '${cert_type}' == 'CA'
327    ...    Install And Verify Certificate Via Redfish  ${cert_type}  Valid Certificate  ok
328
329    ${cert_file_path}=  Generate Certificate File Via Openssl  ${cert_format}
330
331    ${bytes}=  OperatingSystem.Get Binary File  ${cert_file_path}
332    ${file_data}=  Decode Bytes To String  ${bytes}  UTF-8
333
334    Run Keyword If  '${cert_format}' == 'Expired Certificate'
335    ...    Modify BMC Date  future
336    ...  ELSE IF  '${cert_format}' == 'Not Yet Valid Certificate'
337    ...    Modify BMC Date  old
338
339
340    ${certificate_uri}=  Set Variable If
341    ...  '${cert_type}' == 'Server'  ${REDFISH_HTTPS_CERTIFICATE_URI}/1
342    ...  '${cert_type}' == 'Client'  ${REDFISH_LDAP_CERTIFICATE_URI}/1
343    ...  '${cert_type}' == 'CA'  ${REDFISH_CA_CERTIFICATE_URI}/${cert_id}
344
345    ${certificate_dict}=  Create Dictionary  @odata.id=${certificate_uri}
346    ${payload}=  Create Dictionary  CertificateString=${file_data}
347    ...  CertificateType=PEM  CertificateUri=${certificate_dict}
348
349    ${expected_resp}=  Set Variable If  '${expected_status}' == 'ok'  ${HTTP_OK}
350    ...  '${expected_status}' == 'error'  ${HTTP_NOT_FOUND}, ${HTTP_INTERNAL_SERVER_ERROR}
351    ${resp}=  redfish.Post  /redfish/v1/CertificateService/Actions/CertificateService.ReplaceCertificate
352    ...  body=${payload}  valid_status_codes=[${expected_resp}]
353
354    ${cert_file_content}=  OperatingSystem.Get File  ${cert_file_path}
355    ${bmc_cert_content}=  redfish_utils.Get Attribute  ${certificate_uri}  CertificateString
356
357    Run Keyword If  '${expected_status}' == 'ok'
358    ...    Should Contain  ${cert_file_content}  ${bmc_cert_content}
359    ...  ELSE
360    ...    Should Not Contain  ${cert_file_content}  ${bmc_cert_content}
361
362
363Generate CSR Via Redfish
364    [Documentation]  Generate CSR using Redfish.
365    [Arguments]  ${cert_type}  ${key_pair_algorithm}  ${key_bit_length}  ${key_curv_id}  ${expected_status}
366
367    # Description of argument(s):
368    # cert_type           Certificate type ("Server" or "Client").
369    # key_pair_algorithm  CSR key pair algorithm ("EC" or "RSA")
370    # key_bit_length      CSR key bit length ("2048").
371    # key_curv_id         CSR key curv id ("prime256v1" or "secp521r1" or "secp384r1").
372    # expected_status     Expected status of certificate replace Redfish
373    #                     request ("ok" or "error").
374
375    ${certificate_uri}=  Set Variable If
376    ...  '${cert_type}' == 'Server'  ${REDFISH_HTTPS_CERTIFICATE_URI}/
377    ...  '${cert_type}' == 'Client'  ${REDFISH_LDAP_CERTIFICATE_URI}/
378
379    ${certificate_dict}=  Create Dictionary  @odata.id=${certificate_uri}
380    ${payload}=  Create Dictionary  City=Austin  CertificateCollection=${certificate_dict}
381    ...  CommonName=${OPENBMC_HOST}  Country=US  Organization=IBM
382    ...  OrganizationalUnit=ISL  State=AU  KeyBitLength=${key_bit_length}
383    ...  KeyPairAlgorithm=${key_pair_algorithm}  KeyCurveId=${key_curv_id}
384
385    # Remove not applicable field for CSR generation.
386    Run Keyword If  '${key_pair_algorithm}' == 'EC'  Remove From Dictionary  ${payload}  KeyBitLength
387    ...  ELSE IF  '${key_pair_algorithm}' == 'RSA'  Remove From Dictionary  ${payload}  KeyCurveId
388
389    ${expected_resp}=  Set Variable If  '${expected_status}' == 'ok'  ${HTTP_OK}
390    ...  '${expected_status}' == 'error'  ${HTTP_INTERNAL_SERVER_ERROR}, ${HTTP_BAD_REQUEST}
391    ${resp}=  redfish.Post  /redfish/v1/CertificateService/Actions/CertificateService.GenerateCSR
392    ...  body=${payload}  valid_status_codes=[${expected_resp}]
393
394    # Delay added between two CSR generation request.
395    Sleep  5s
396
397
398Suite Setup Execution
399    [Documentation]  Do suite setup tasks.
400
401    # Create certificate sub-directory in current working directory.
402    Create Directory  certificate_dir
403    Redfish.Login
404
405
406Test Teardown Execution
407    [Documentation]  Do the post test teardown.
408
409    FFDC On Test Case Fail
410
411Suite Teardown
412    [Documentation]  Do suite teardown tasks.
413
414    Redfish.Logout
415