1*** Settings *** 2Documentation Test certificate in OpenBMC. 3 4Resource ../../lib/resource.robot 5Resource ../../lib/bmc_redfish_resource.robot 6Resource ../../lib/openbmc_ffdc.robot 7Resource ../../lib/certificate_utils.robot 8Library String 9 10Force Tags Certificate_Test 11 12Suite Setup Suite Setup Execution 13Suite Teardown Suite Teardown 14Test Teardown Test Teardown Execution 15 16 17*** Variables *** 18 19${invalid_value} abc 20${ROOT_CA_FILE_PATH} /etc/ssl/certs/authority/* 21 22 23** Test Cases ** 24 25Verify Server Certificate Replace 26 [Documentation] Verify server certificate replace. 27 [Tags] Verify_Server_Certificate_Replace 28 [Template] Replace Certificate Via Redfish 29 30 # cert_type cert_format expected_status 31 Server Valid Certificate Valid Privatekey ok 32 Server Empty Certificate Valid Privatekey error 33 Server Valid Certificate Empty Privatekey error 34 Server Empty Certificate Empty Privatekey error 35 36 37Verify Client Certificate Replace 38 [Documentation] Verify client certificate replace. 39 [Tags] Verify_Client_Certificate_Replace 40 [Template] Replace Certificate Via Redfish 41 42 # cert_type cert_format expected_status 43 Client Valid Certificate Valid Privatekey ok 44 Client Empty Certificate Valid Privatekey error 45 Client Valid Certificate Empty Privatekey error 46 Client Empty Certificate Empty Privatekey error 47 48 49Verify CA Certificate Replace 50 [Documentation] Verify CA certificate replace. 51 [Tags] Verify_CA_Certificate_Replace 52 [Template] Replace Certificate Via Redfish 53 54 # cert_type cert_format expected_status 55 CA Valid Certificate ok 56 CA Empty Certificate error 57 58 59Verify Client Certificate Install 60 [Documentation] Verify client certificate install. 61 [Tags] Verify_Client_Certificate_Install 62 [Template] Install And Verify Certificate Via Redfish 63 64 # cert_type cert_format expected_status 65 Client Valid Certificate Valid Privatekey ok 66 Client Empty Certificate Valid Privatekey error 67 Client Valid Certificate Empty Privatekey error 68 Client Empty Certificate Empty Privatekey error 69 70 71Verify CA Certificate Install 72 [Documentation] Verify CA certificate install. 73 [Tags] Verify_CA_Certificate_Install 74 [Template] Install And Verify Certificate Via Redfish 75 76 # cert_type cert_format expected_status 77 CA Valid Certificate ok 78 CA Empty Certificate error 79 80 81Verify Maximum CA Certificate Install 82 [Documentation] Verify maximum CA certificate install. 83 [Tags] Verify_Maximum_CA_Certificate_Install 84 [Teardown] Run Keywords FFDC On Test Case Fail AND Delete All CA Certificate Via Redfish 85 86 # Get CA certificate count from BMC. 87 ${cert_list}= Redfish_Utils.Get Member List /redfish/v1/Managers/bmc/Truststore/Certificates 88 ${cert_count}= Get Length ${cert_list} 89 90 # Install CA certificate to reach maximum count of 10. 91 FOR ${INDEX} IN RANGE ${cert_count} 10 92 Install And Verify Certificate Via Redfish CA Valid Certificate ok ${FALSE} 93 ${cert_count}= Evaluate ${cert_count} + 1 94 END 95 96 # Verify error while installing 11th CA certificate. 97 Install And Verify Certificate Via Redfish CA Valid Certificate error ${FALSE} 98 99 100Verify Error While Uploading Same CA Certificate 101 [Documentation] Verify error while uploading same CA certificate two times. 102 [Tags] Verify_Error_While_Uploading_Same_CA_Certificate 103 104 # Create certificate file for uploading. 105 ${cert_file_path}= Generate Certificate File Via Openssl Valid Certificate 365 106 ${bytes}= OperatingSystem.Get Binary File ${cert_file_path} 107 ${file_data}= Decode Bytes To String ${bytes} UTF-8 108 109 # Install CA certificate. 110 Install Certificate File On BMC ${REDFISH_CA_CERTIFICATE_URI} ok data=${file_data} 111 112 # Adding delay after certificate installation. 113 Sleep 30s 114 115 # Check error while uploading same certificate. 116 Install Certificate File On BMC ${REDFISH_CA_CERTIFICATE_URI} error data=${file_data} 117 118 119Verify Server Certificate View Via Openssl 120 [Documentation] Verify server certificate via openssl command. 121 [Tags] Verify_Server_Certificate_View_Via_Openssl 122 123 ${cert_file_path}= Generate Certificate File Via Openssl Valid Certificate Valid Privatekey 124 ${bytes}= OperatingSystem.Get Binary File ${cert_file_path} 125 ${file_data}= Decode Bytes To String ${bytes} UTF-8 126 127 ${certificate_dict}= Create Dictionary 128 ... @odata.id=/redfish/v1/Managers/bmc/NetworkProtocol/HTTPS/Certificates/1 129 ${payload}= Create Dictionary CertificateString=${file_data} 130 ... CertificateType=PEM CertificateUri=${certificate_dict} 131 132 ${resp}= redfish.Post /redfish/v1/CertificateService/Actions/CertificateService.ReplaceCertificate 133 ... body=${payload} 134 135 Wait Until Keyword Succeeds 2 mins 15 secs Verify Certificate Visible Via OpenSSL ${cert_file_path} 136 137 138Verify CSR Generation For Server Certificate 139 [Documentation] Verify CSR generation for server certificate. 140 [Tags] Verify_CSR_Generation_For_Server_Certificate 141 [Template] Generate CSR Via Redfish 142 143 # csr_type key_pair_algorithm key_bit_length key_curv_id expected_status 144 Server RSA ${2048} ${EMPTY} ok 145 Server EC ${EMPTY} prime256v1 ok 146 Server EC ${EMPTY} secp521r1 ok 147 Server EC ${EMPTY} secp384r1 ok 148 149 150Verify CSR Generation For Client Certificate 151 [Documentation] Verify CSR generation for client certificate. 152 [Tags] Verify_CSR_Generation_For_Client_Certificate 153 [Template] Generate CSR Via Redfish 154 155 # csr_type key_pair_algorithm key_bit_length key_curv_id expected_status 156 Client RSA ${2048} ${EMPTY} ok 157 Client EC ${EMPTY} prime256v1 ok 158 Client EC ${EMPTY} secp521r1 ok 159 Client EC ${EMPTY} secp384r1 ok 160 161 162Verify CSR Generation For Server Certificate With Invalid Value 163 [Documentation] Verify error while generating CSR for server certificate with invalid value. 164 [Tags] Verify_CSR_Generation_For_Server_Certificate_With_Invalid_Value 165 [Template] Generate CSR Via Redfish 166 167 # csr_type key_pair_algorithm key_bit_length key_curv_id expected_status 168 Server ${invalid_value} ${2048} prime256v1 error 169 Server RAS ${invalid_value} ${EMPTY} error 170 Server EC ${EMPTY} ${invalid_value} error 171 172 173Verify CSR Generation For Client Certificate With Invalid Value 174 [Documentation] Verify error while generating CSR for client certificate with invalid value. 175 [Tags] Verify_CSR_Generation_For_Client_Certificate_With_Invalid_Value 176 [Template] Generate CSR Via Redfish 177 178 Client ${invalid_value} ${2048} prime256v1 error 179 Client RSA ${invalid_value} ${EMPTY} error 180 Client EC ${EMPTY} ${invalid_value} error 181 182 183Verify Expired Certificate Install 184 [Documentation] Verify installation of expired certificate. 185 [Tags] Verify_Expired_Certificate_Install 186 [Setup] Run Keywords Get Current BMC Date AND Modify BMC Date 187 [Template] Install And Verify Certificate Via Redfish 188 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore BMC Date 189 190 # cert_type cert_format expected_status 191 Client Expired Certificate error 192 CA Expired Certificate error 193 194 195Verify Expired Certificate Replace 196 [Documentation] Verify replacing the certificate with an expired one. 197 [Tags] Verify_Expired_Certificate_Replace 198 [Setup] Run Keywords Get Current BMC Date AND Modify BMC Date 199 [Template] Replace Certificate Via Redfish 200 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore BMC Date 201 202 # cert_type cert_format expected_status 203 Server Expired Certificate error 204 205 206Verify Not Yet Valid Certificate Install 207 [Documentation] Verify installation of not yet valid certificates. 208 [Tags] Verify_Not_Yet_Valid_Certificate_Install 209 [Setup] Run Keywords Get Current BMC Date AND Modify BMC Date 210 [Template] Install And Verify Certificate Via Redfish 211 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore BMC Date 212 213 # cert_type cert_format expected_status 214 Client Not Yet Valid Certificate ok 215 CA Not Yet Valid Certificate ok 216 217 218Verify Not Yet Valid Certificate Replace 219 [Documentation] Verify replacing certificate with a not yet valid one. 220 [Tags] Verify_Not_Yet_Valid_Certificate_Replace 221 [Setup] Run Keywords Get Current BMC Date AND Modify BMC Date 222 [Template] Replace Certificate Via Redfish 223 [Teardown] Run Keywords FFDC On Test Case Fail AND Restore BMC Date 224 225 # cert_type cert_format expected_status 226 Server Not Yet Valid Certificate ok 227 Client Not Yet Valid Certificate ok 228 CA Not Yet Valid Certificate ok 229 230 231Verify Certificates Location Via Redfish 232 [Documentation] Verify the location of certificates via Redfish. 233 [Tags] Verify_Certificates_Location_Via_Redfish 234 235 ${cert_id}= Install And Verify Certificate Via Redfish 236 ... CA Valid Certificate ok 237 238 ${resp}= Redfish.Get /redfish/v1/CertificateService/CertificateLocations 239 ${Links}= Get From Dictionary ${resp.dict} Links 240 241 ${match_cert}= Catenate 242 ... /redfish/v1/Managers/bmc/Truststore/Certificates/${cert_id} 243 ${match}= Set Variable ${False} 244 245 FOR ${Certificates_dict} IN @{Links['Certificates']} 246 Continue For Loop If 247 ... "${Certificates_dict['@odata.id']}}" != "${match_cert}}" 248 ${match}= Set Variable ${True} 249 END 250 251 Should Be Equal ${match} ${True} 252 ... msg=Verify the location of certificates via Redfish fail. 253 254 255*** Keywords *** 256 257Modify BMC Date 258 [Documentation] Modify date in BMC. 259 [Arguments] ${date_set_type}=current 260 261 # Description of argument(s): 262 # date_set_type Set BMC date to a current, future, old date by 375 days. 263 # current - Sets date to local system date. 264 # future - Sets to a future date from current date. 265 # old - Sets to a old date from current date. 266 267 Redfish Power Off stack_mode=skip 268 ${current_date_time}= Get Current Date 269 ${new_time}= Run Keyword If '${date_set_type}' == 'current' Set Variable ${current_date_time} 270 ... ELSE IF '${date_set_type}' == 'future' 271 ... Add Time To Date ${current_date_time} 375 days 272 ... ELSE IF '${date_set_type}' == 'old' 273 ... Subtract Time From Date ${current_date_time} 375 days 274 275 # Enable manual mode. 276 Redfish.Patch ${REDFISH_NW_PROTOCOL_URI} 277 ... body={'NTP':{'ProtocolEnabled': ${False}}} 278 ... valid_status_codes=[${HTTP_OK}, ${HTTP_NO_CONTENT}] 279 Sleep 2s 280 Redfish.Patch ${REDFISH_BASE_URI}Managers/bmc body={'DateTime': '${new_time}'} 281 ... valid_status_codes=[${HTTP_OK}] 282 283Get Current BMC Date 284 [Documentation] Get current BMC date. 285 286 ${cli_date_time}= CLI Get BMC DateTime 287 Set Test Variable ${cli_date_time} 288 289Restore BMC Date 290 [Documentation] Restore BMC date to its prior value. 291 292 Redfish.Patch ${REDFISH_BASE_URI}Managers/bmc body={'DateTime': '${cli_date_time}'} 293 ... valid_status_codes=[${HTTP_OK}] 294 295 296Generate CSR Via Redfish 297 [Documentation] Generate CSR using Redfish. 298 [Arguments] ${cert_type} ${key_pair_algorithm} ${key_bit_length} ${key_curv_id} ${expected_status} 299 300 # Description of argument(s): 301 # cert_type Certificate type ("Server" or "Client"). 302 # key_pair_algorithm CSR key pair algorithm ("EC" or "RSA") 303 # key_bit_length CSR key bit length ("2048"). 304 # key_curv_id CSR key curv id ("prime256v1" or "secp521r1" or "secp384r1"). 305 # expected_status Expected status of certificate replace Redfish 306 # request ("ok" or "error"). 307 308 ${certificate_uri}= Set Variable If 309 ... '${cert_type}' == 'Server' ${REDFISH_HTTPS_CERTIFICATE_URI}/ 310 ... '${cert_type}' == 'Client' ${REDFISH_LDAP_CERTIFICATE_URI}/ 311 312 ${certificate_dict}= Create Dictionary @odata.id=${certificate_uri} 313 ${payload}= Create Dictionary City=Austin CertificateCollection=${certificate_dict} 314 ... CommonName=${OPENBMC_HOST} Country=US Organization=IBM 315 ... OrganizationalUnit=ISL State=AU KeyBitLength=${key_bit_length} 316 ... KeyPairAlgorithm=${key_pair_algorithm} KeyCurveId=${key_curv_id} 317 318 # Remove not applicable field for CSR generation. 319 Run Keyword If '${key_pair_algorithm}' == 'EC' Remove From Dictionary ${payload} KeyBitLength 320 ... ELSE IF '${key_pair_algorithm}' == 'RSA' Remove From Dictionary ${payload} KeyCurveId 321 322 ${expected_resp}= Set Variable If '${expected_status}' == 'ok' ${HTTP_OK} 323 ... '${expected_status}' == 'error' ${HTTP_INTERNAL_SERVER_ERROR}, ${HTTP_BAD_REQUEST} 324 ${resp}= redfish.Post /redfish/v1/CertificateService/Actions/CertificateService.GenerateCSR 325 ... body=${payload} valid_status_codes=[${expected_resp}] 326 327 # Delay added between two CSR generation request. 328 Sleep 5s 329 330 331Suite Setup Execution 332 [Documentation] Do suite setup tasks. 333 334 # Create certificate sub-directory in current working directory. 335 Create Directory certificate_dir 336 Redfish.Login 337 338 339Test Teardown Execution 340 [Documentation] Do the post test teardown. 341 342 FFDC On Test Case Fail 343 344Suite Teardown 345 [Documentation] Do suite teardown tasks. 346 347 Redfish.Logout 348