From 89076a0c44dd12a73060dbfda419c20c4ce5285a Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Sat, 22 Oct 2016 18:12:37 +0200 Subject: Migrate commands to new format Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 unittest/test2.cc (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc new file mode 100644 index 0000000..6744b45 --- /dev/null +++ b/unittest/test2.cc @@ -0,0 +1,83 @@ +#define CATCH_CONFIG_MAIN // This tells Catch to provide a main() +#include "catch.hpp" + +#include +#include +#include "device_proto.h" +#include "log.h" +#include "stick10_commands.h" + +using namespace std; +using namespace nitrokey::device; +using namespace nitrokey::proto::stick10; +using namespace nitrokey::log; +using namespace nitrokey::misc; + + +std::string getSlotName(Stick10 &stick, int slotNo) { + auto slot_req = get_payload(); + slot_req.slot_number = slotNo; + auto slot = ReadSlot::CommandTransaction::run(stick, slot_req); + std::string sName(reinterpret_cast(slot.data().slot_name)); + return sName; +} + +TEST_CASE("Slot names are correct", "[slotNames]") { + Stick10 stick; + bool connected = stick.connect(); + REQUIRE(connected == true); + + Log::instance().set_loglevel(Loglevel::DEBUG); + + auto resp = GetStatus::CommandTransaction::run(stick); + + auto authreq = get_payload(); + strcpy((char *)(authreq.card_password), "12345678"); + FirstAuthenticate::CommandTransaction::run(stick, authreq); + + { + auto authreq = get_payload(); + strcpy((char *)(authreq.user_password), "123456"); + EnablePasswordSafe::CommandTransaction::run(stick, authreq); + } + + //assuming these values were set earlier, thus failing on normal use + REQUIRE(getSlotName(stick, 0x20) == std::string("1")); + REQUIRE(getSlotName(stick, 0x21) == std::string("slot2")); + + { + auto resp = GetPasswordRetryCount::CommandTransaction::run(stick); + REQUIRE(resp.data().password_retry_count == 3); + } + { + auto resp = GetUserPasswordRetryCount::CommandTransaction::run(stick); + REQUIRE(resp.data().password_retry_count == 3); + } + + { + auto slot = get_payload(); + slot.slot_number = 0; + auto resp2 = GetPasswordSafeSlotName::CommandTransaction::run(stick, slot); + std::string sName(reinterpret_cast(resp2.data().slot_name)); + REQUIRE(sName == std::string("web1")); + } + + { + auto slot = get_payload(); + slot.slot_number = 0; + auto resp2 = + GetPasswordSafeSlotPassword::CommandTransaction::run(stick, slot); + std::string sName(reinterpret_cast(resp2.data().slot_password)); + REQUIRE(sName == std::string("pass1")); + } + + { + auto slot = get_payload(); + slot.slot_number = 0; + auto resp2 = GetPasswordSafeSlotLogin::CommandTransaction::run(stick, slot); + std::string sName(reinterpret_cast(resp2.data().slot_login)); + REQUIRE(sName == std::string("login1")); + } + + stick.disconnect(); +} -- cgit v1.2.1 From 27355f0dd8eb11fe1a0d41bd05d3c7dcb74341d8 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Sat, 22 Oct 2016 19:02:16 +0200 Subject: C++ tests for Storage commands Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 75 ++++++++++++------------------------------------------- 1 file changed, 16 insertions(+), 59 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 6744b45..dfc4182 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -3,80 +3,37 @@ #include #include +#include #include "device_proto.h" #include "log.h" -#include "stick10_commands.h" +//#include "stick10_commands.h" +#include "stick20_commands.h" using namespace std; using namespace nitrokey::device; -using namespace nitrokey::proto::stick10; +using namespace nitrokey::proto::stick20; using namespace nitrokey::log; using namespace nitrokey::misc; -std::string getSlotName(Stick10 &stick, int slotNo) { - auto slot_req = get_payload(); - slot_req.slot_number = slotNo; - auto slot = ReadSlot::CommandTransaction::run(stick, slot_req); - std::string sName(reinterpret_cast(slot.data().slot_name)); - return sName; -} - -TEST_CASE("Slot names are correct", "[slotNames]") { - Stick10 stick; +TEST_CASE("test", "[test]") { + Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); - Log::instance().set_loglevel(Loglevel::DEBUG); - - auto resp = GetStatus::CommandTransaction::run(stick); - - auto authreq = get_payload(); - strcpy((char *)(authreq.card_password), "12345678"); - FirstAuthenticate::CommandTransaction::run(stick, authreq); - - { - auto authreq = get_payload(); - strcpy((char *)(authreq.user_password), "123456"); - EnablePasswordSafe::CommandTransaction::run(stick, authreq); - } - - //assuming these values were set earlier, thus failing on normal use - REQUIRE(getSlotName(stick, 0x20) == std::string("1")); - REQUIRE(getSlotName(stick, 0x21) == std::string("slot2")); - - { - auto resp = GetPasswordRetryCount::CommandTransaction::run(stick); - REQUIRE(resp.data().password_retry_count == 3); - } - { - auto resp = GetUserPasswordRetryCount::CommandTransaction::run(stick); - REQUIRE(resp.data().password_retry_count == 3); - } + Log::instance().set_loglevel(Loglevel::DEBUG_L2); { - auto slot = get_payload(); - slot.slot_number = 0; - auto resp2 = GetPasswordSafeSlotName::CommandTransaction::run(stick, slot); - std::string sName(reinterpret_cast(resp2.data().slot_name)); - REQUIRE(sName == std::string("web1")); + auto p = get_payload(); + p.set_kind_user(); + strcpyT(p.password, "123456"); + EnableEncryptedPartition::CommandTransaction::run(stick, p); } - - { - auto slot = get_payload(); - slot.slot_number = 0; - auto resp2 = - GetPasswordSafeSlotPassword::CommandTransaction::run(stick, slot); - std::string sName(reinterpret_cast(resp2.data().slot_password)); - REQUIRE(sName == std::string("pass1")); - } - - { - auto slot = get_payload(); - slot.slot_number = 0; - auto resp2 = GetPasswordSafeSlotLogin::CommandTransaction::run(stick, slot); - std::string sName(reinterpret_cast(resp2.data().slot_login)); - REQUIRE(sName == std::string("login1")); + { + auto p = get_payload(); + p.set_kind_user(); + strcpyT(p.password, "123456"); + DisableEncryptedPartition::CommandTransaction::run(stick, p); } stick.disconnect(); -- cgit v1.2.1 From 3b0452c05b84ede5a2085aee4a550a2a63ccdb65 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Sat, 22 Oct 2016 19:31:59 +0200 Subject: C++ tests update Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index dfc4182..b328c37 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -11,6 +11,7 @@ using namespace std; using namespace nitrokey::device; +using namespace nitrokey::proto; using namespace nitrokey::proto::stick20; using namespace nitrokey::log; using namespace nitrokey::misc; @@ -23,17 +24,31 @@ TEST_CASE("test", "[test]") { Log::instance().set_loglevel(Loglevel::DEBUG_L2); + stick10::LockDevice::CommandTransaction::run(stick); +// { +// auto p = get_payload(); +// p.set_kind_user(); +// strcpyT(p.password, "123456"); +// EnableEncryptedPartition::CommandTransaction::run(stick, p); +// } +// { +// auto p = get_payload(); +// p.set_kind_user(); +// strcpyT(p.password, "123456"); +// DisableEncryptedPartition::CommandTransaction::run(stick, p); +// } + { auto p = get_payload(); p.set_kind_user(); strcpyT(p.password, "123456"); EnableEncryptedPartition::CommandTransaction::run(stick, p); } - { - auto p = get_payload(); + { + auto p = get_payload(); p.set_kind_user(); - strcpyT(p.password, "123456"); - DisableEncryptedPartition::CommandTransaction::run(stick, p); + strcpyT(p.password, "123123123"); + EnableHiddenEncryptedPartition::CommandTransaction::run(stick, p); } stick.disconnect(); -- cgit v1.2.1 From d8a6073f6118062266df8ef77c5a7969a9ed8be7 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Sat, 22 Oct 2016 19:35:26 +0200 Subject: C++ tests update (2) - wait before lock Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 2 ++ 1 file changed, 2 insertions(+) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index b328c37..79417c6 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -50,6 +50,8 @@ TEST_CASE("test", "[test]") { strcpyT(p.password, "123123123"); EnableHiddenEncryptedPartition::CommandTransaction::run(stick, p); } + this_thread::sleep_for(1000ms); + stick10::LockDevice::CommandTransaction::run(stick); stick.disconnect(); } -- cgit v1.2.1 From 536d2b40239cbff94d7e562a0c0c9cf4f462576f Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Mon, 24 Oct 2016 14:52:53 +0200 Subject: Test: let device rest after enabling encrypted partition Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 1 + 1 file changed, 1 insertion(+) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 79417c6..883e37b 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -44,6 +44,7 @@ TEST_CASE("test", "[test]") { strcpyT(p.password, "123456"); EnableEncryptedPartition::CommandTransaction::run(stick, p); } + this_thread::sleep_for(1000ms); { auto p = get_payload(); p.set_kind_user(); -- cgit v1.2.1 From 116523fbee311aa7af5151d1a601c8a0f11965e9 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Mon, 24 Oct 2016 15:15:04 +0200 Subject: Test: reduced code bloat Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 38 +++++++++++++------------------------- 1 file changed, 13 insertions(+), 25 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 883e37b..503ab49 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -17,6 +17,15 @@ using namespace nitrokey::log; using namespace nitrokey::misc; +template +void execute_password_command(Device &stick, const char *password) { + auto p = get_payload(); + p.set_kind_user(); + strcpyT(p.password, password); + CMDTYPE::CommandTransaction::run(stick, p); +} + + TEST_CASE("test", "[test]") { Stick20 stick; bool connected = stick.connect(); @@ -25,32 +34,11 @@ TEST_CASE("test", "[test]") { Log::instance().set_loglevel(Loglevel::DEBUG_L2); stick10::LockDevice::CommandTransaction::run(stick); -// { -// auto p = get_payload(); -// p.set_kind_user(); -// strcpyT(p.password, "123456"); -// EnableEncryptedPartition::CommandTransaction::run(stick, p); -// } -// { -// auto p = get_payload(); -// p.set_kind_user(); -// strcpyT(p.password, "123456"); -// DisableEncryptedPartition::CommandTransaction::run(stick, p); -// } - - { - auto p = get_payload(); - p.set_kind_user(); - strcpyT(p.password, "123456"); - EnableEncryptedPartition::CommandTransaction::run(stick, p); - } +// execute_password_command(stick, "123456"); +// execute_password_command(stick, "123456"); + execute_password_command(stick, "123456"); this_thread::sleep_for(1000ms); - { - auto p = get_payload(); - p.set_kind_user(); - strcpyT(p.password, "123123123"); - EnableHiddenEncryptedPartition::CommandTransaction::run(stick, p); - } + execute_password_command(stick, "123123123"); this_thread::sleep_for(1000ms); stick10::LockDevice::CommandTransaction::run(stick); -- cgit v1.2.1 From 003189e780af8208f243bbd312df5f5295015eb1 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Mon, 24 Oct 2016 15:50:15 +0200 Subject: Test: check more commands Add delay after each command by default. Check EnableHiddenEncryptedPartition more than once. Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 36 ++++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 503ab49..61fb502 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -18,11 +18,16 @@ using namespace nitrokey::misc; template -void execute_password_command(Device &stick, const char *password) { +void execute_password_command(Device &stick, const char *password, const char kind = 'P') { auto p = get_payload(); - p.set_kind_user(); + if (kind == 'P'){ + p.set_kind_user(); + } else { + p.set_kind_admin(); + } strcpyT(p.password, password); CMDTYPE::CommandTransaction::run(stick, p); + this_thread::sleep_for(1000ms); } @@ -36,10 +41,33 @@ TEST_CASE("test", "[test]") { stick10::LockDevice::CommandTransaction::run(stick); // execute_password_command(stick, "123456"); // execute_password_command(stick, "123456"); - execute_password_command(stick, "123456"); this_thread::sleep_for(1000ms); - execute_password_command(stick, "123123123"); + execute_password_command(stick, "123456"); + this_thread::sleep_for(4000ms); + bool passed = false; + for(int i=0; i<5; i++){ + try { + execute_password_command(stick, "123123123"); + CHECK(true); + passed=true; + break; + } + catch (CommandFailedException &e){ + this_thread::sleep_for(2000ms); + } + } + if(!passed){ + CHECK(false); + } + + execute_password_command(stick, "123123123"); + execute_password_command(stick, "123456"); + execute_password_command(stick, "123456"); + execute_password_command(stick, "12345678", 'A'); this_thread::sleep_for(1000ms); +// execute_password_command(stick, "123123123"); +// execute_password_command(stick, "123123123"); //FIRMWARE PIN + stick10::LockDevice::CommandTransaction::run(stick); stick.disconnect(); -- cgit v1.2.1 From 6eca4d657aafddcb9685df4b599a8913ac075b3a Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Mon, 24 Oct 2016 15:52:57 +0200 Subject: Disable warnings about GNU extension during C++ tests compilation Signed-off-by: Szczepan Zalega --- unittest/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'unittest') diff --git a/unittest/Makefile b/unittest/Makefile index 9e8fbc1..dbd003e 100644 --- a/unittest/Makefile +++ b/unittest/Makefile @@ -8,7 +8,7 @@ LIB = -L../build LDLIBS = -lnitrokey BUILD = build -CXXFLAGS = -std=c++14 -fPIC +CXXFLAGS = -std=c++14 -fPIC -Wno-gnu-variable-sized-type-not-at-end CXXSOURCES = $(wildcard *.cc) TARGETS = $(CXXSOURCES:%.cc=$(BUILD)/%) -- cgit v1.2.1 From 29974c0d51f099af9869e49597f77936fc069376 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Mon, 24 Oct 2016 16:19:50 +0200 Subject: Test: another commands Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 61fb502..91982c9 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -65,8 +65,12 @@ TEST_CASE("test", "[test]") { execute_password_command(stick, "123456"); execute_password_command(stick, "12345678", 'A'); this_thread::sleep_for(1000ms); -// execute_password_command(stick, "123123123"); -// execute_password_command(stick, "123123123"); //FIRMWARE PIN +// execute_password_command(stick, "123123123"); //CAUTION +// execute_password_command(stick, "123123123"); //CAUTION FIRMWARE PIN + + execute_password_command(stick, "12345678", 'A'); +// execute_password_command(stick, "12345678", 'A'); + stick10::LockDevice::CommandTransaction::run(stick); -- cgit v1.2.1 From d02c321effbc8b1ae6e8e54f93df53d57ab0d7e1 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Mon, 24 Oct 2016 17:52:15 +0200 Subject: Test: check device status. Use automatic disconnection. Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 91982c9..9739217 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -64,6 +64,7 @@ TEST_CASE("test", "[test]") { execute_password_command(stick, "123456"); execute_password_command(stick, "123456"); execute_password_command(stick, "12345678", 'A'); + stick20::GetDeviceStatus::CommandTransaction::run(stick); this_thread::sleep_for(1000ms); // execute_password_command(stick, "123123123"); //CAUTION // execute_password_command(stick, "123123123"); //CAUTION FIRMWARE PIN @@ -71,8 +72,5 @@ TEST_CASE("test", "[test]") { execute_password_command(stick, "12345678", 'A'); // execute_password_command(stick, "12345678", 'A'); - stick10::LockDevice::CommandTransaction::run(stick); - - stick.disconnect(); } -- cgit v1.2.1 From b0412c73b8ff129183f570a4eed72bdafd9f55d3 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Tue, 25 Oct 2016 18:41:59 +0200 Subject: Handle FillSDCardWithRandomChars command and test it Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 9739217..3cfc5c1 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -31,6 +31,40 @@ void execute_password_command(Device &stick, const char *password, const char ki } +TEST_CASE("long operation test", "[test_long]") { + Stick20 stick; + bool connected = stick.connect(); + REQUIRE(connected == true); + Log::instance().set_loglevel(Loglevel::DEBUG_L2); + try{ +// execute_password_command(stick, "12345678", 'P'); + auto p = get_payload(); + p.set_defaults(); + strcpyT(p.password, "12345678"); + FillSDCardWithRandomChars::CommandTransaction::run(stick, p); + this_thread::sleep_for(1000ms); + + CHECK(false); + } + catch (LongOperationInProgressException &progressException){ + CHECK(true); + } + + + for (int i = 0; i < 30; ++i) { + try { + stick10::GetStatus::CommandTransaction::run(stick); + } + catch (LongOperationInProgressException &progressException){ + CHECK((int)progressException.progress_bar_value>=0); + CAPTURE((int)progressException.progress_bar_value); + this_thread::sleep_for(2000ms); + } + + } + +} + TEST_CASE("test", "[test]") { Stick20 stick; bool connected = stick.connect(); -- cgit v1.2.1 From 6ddbb5199dce36bbb3e40d4aca5f65593f0d7e84 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Thu, 27 Oct 2016 19:36:42 +0200 Subject: Import command ids defined as macro to test local enum Signed-off-by: Szczepan Zalega --- unittest/test_command_ids_header.h | 41 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 unittest/test_command_ids_header.h (limited to 'unittest') diff --git a/unittest/test_command_ids_header.h b/unittest/test_command_ids_header.h new file mode 100644 index 0000000..cd55c8a --- /dev/null +++ b/unittest/test_command_ids_header.h @@ -0,0 +1,41 @@ +#ifndef LIBNITROKEY_TEST_COMMAND_IDS_HEADER_H_H +#define LIBNITROKEY_TEST_COMMAND_IDS_HEADER_H_H + +#define STICK20_CMD_START_VALUE 0x20 +#define STICK20_CMD_ENABLE_CRYPTED_PARI (STICK20_CMD_START_VALUE + 0) +#define STICK20_CMD_DISABLE_CRYPTED_PARI (STICK20_CMD_START_VALUE + 1) +#define STICK20_CMD_ENABLE_HIDDEN_CRYPTED_PARI (STICK20_CMD_START_VALUE + 2) +#define STICK20_CMD_DISABLE_HIDDEN_CRYPTED_PARI (STICK20_CMD_START_VALUE + 3) +#define STICK20_CMD_ENABLE_FIRMWARE_UPDATE (STICK20_CMD_START_VALUE + 4) +#define STICK20_CMD_EXPORT_FIRMWARE_TO_FILE (STICK20_CMD_START_VALUE + 5) +#define STICK20_CMD_GENERATE_NEW_KEYS (STICK20_CMD_START_VALUE + 6) +#define STICK20_CMD_FILL_SD_CARD_WITH_RANDOM_CHARS (STICK20_CMD_START_VALUE + 7) + +#define STICK20_CMD_WRITE_STATUS_DATA (STICK20_CMD_START_VALUE + 8) +#define STICK20_CMD_ENABLE_READONLY_UNCRYPTED_LUN (STICK20_CMD_START_VALUE + 9) +#define STICK20_CMD_ENABLE_READWRITE_UNCRYPTED_LUN (STICK20_CMD_START_VALUE + 10) + +#define STICK20_CMD_SEND_PASSWORD_MATRIX (STICK20_CMD_START_VALUE + 11) +#define STICK20_CMD_SEND_PASSWORD_MATRIX_PINDATA (STICK20_CMD_START_VALUE + 12) +#define STICK20_CMD_SEND_PASSWORD_MATRIX_SETUP (STICK20_CMD_START_VALUE + 13) + +#define STICK20_CMD_GET_DEVICE_STATUS (STICK20_CMD_START_VALUE + 14) +#define STICK20_CMD_SEND_DEVICE_STATUS (STICK20_CMD_START_VALUE + 15) + +#define STICK20_CMD_SEND_HIDDEN_VOLUME_PASSWORD (STICK20_CMD_START_VALUE + 16) +#define STICK20_CMD_SEND_HIDDEN_VOLUME_SETUP (STICK20_CMD_START_VALUE + 17) +#define STICK20_CMD_SEND_PASSWORD (STICK20_CMD_START_VALUE + 18) +#define STICK20_CMD_SEND_NEW_PASSWORD (STICK20_CMD_START_VALUE + 19) +#define STICK20_CMD_CLEAR_NEW_SD_CARD_FOUND (STICK20_CMD_START_VALUE + 20) + +#define STICK20_CMD_SEND_STARTUP (STICK20_CMD_START_VALUE + 21) +#define STICK20_CMD_SEND_CLEAR_STICK_KEYS_NOT_INITIATED (STICK20_CMD_START_VALUE + 22) +#define STICK20_CMD_SEND_LOCK_STICK_HARDWARE (STICK20_CMD_START_VALUE + 23) + +#define STICK20_CMD_PRODUCTION_TEST (STICK20_CMD_START_VALUE + 24) +#define STICK20_CMD_SEND_DEBUG_DATA (STICK20_CMD_START_VALUE + 25) + +#define STICK20_CMD_CHANGE_UPDATE_PIN (STICK20_CMD_START_VALUE + 26) + + +#endif //LIBNITROKEY_TEST_COMMAND_IDS_HEADER_H_H -- cgit v1.2.1 From d7ee36dfdfc5a896f5ef7d04b7f1f70f05256ebc Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Thu, 27 Oct 2016 20:23:04 +0200 Subject: Test command ids correctness and getting device status Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 62 insertions(+), 1 deletion(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 3cfc5c1..8e3dacc 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -65,7 +65,68 @@ TEST_CASE("long operation test", "[test_long]") { } -TEST_CASE("test", "[test]") { + +#include "test_command_ids_header.h" + +TEST_CASE("test device commands ids", "[fast]") { + +// REQUIRE(STICK20_CMD_START_VALUE == static_cast(CommandID::START_VALUE)); + REQUIRE(STICK20_CMD_ENABLE_CRYPTED_PARI == static_cast(CommandID::ENABLE_CRYPTED_PARI)); + REQUIRE(STICK20_CMD_DISABLE_CRYPTED_PARI == static_cast(CommandID::DISABLE_CRYPTED_PARI)); + REQUIRE(STICK20_CMD_ENABLE_HIDDEN_CRYPTED_PARI == static_cast(CommandID::ENABLE_HIDDEN_CRYPTED_PARI)); + REQUIRE(STICK20_CMD_DISABLE_HIDDEN_CRYPTED_PARI == static_cast(CommandID::DISABLE_HIDDEN_CRYPTED_PARI)); + REQUIRE(STICK20_CMD_ENABLE_FIRMWARE_UPDATE == static_cast(CommandID::ENABLE_FIRMWARE_UPDATE)); + REQUIRE(STICK20_CMD_EXPORT_FIRMWARE_TO_FILE == static_cast(CommandID::EXPORT_FIRMWARE_TO_FILE)); + REQUIRE(STICK20_CMD_GENERATE_NEW_KEYS == static_cast(CommandID::GENERATE_NEW_KEYS)); + REQUIRE(STICK20_CMD_FILL_SD_CARD_WITH_RANDOM_CHARS == static_cast(CommandID::FILL_SD_CARD_WITH_RANDOM_CHARS)); + + REQUIRE(STICK20_CMD_WRITE_STATUS_DATA == static_cast(CommandID::WRITE_STATUS_DATA)); + REQUIRE(STICK20_CMD_ENABLE_READONLY_UNCRYPTED_LUN == static_cast(CommandID::ENABLE_READONLY_UNCRYPTED_LUN)); + REQUIRE(STICK20_CMD_ENABLE_READWRITE_UNCRYPTED_LUN == static_cast(CommandID::ENABLE_READWRITE_UNCRYPTED_LUN)); + + REQUIRE(STICK20_CMD_SEND_PASSWORD_MATRIX == static_cast(CommandID::SEND_PASSWORD_MATRIX)); + REQUIRE(STICK20_CMD_SEND_PASSWORD_MATRIX_PINDATA == static_cast(CommandID::SEND_PASSWORD_MATRIX_PINDATA)); + REQUIRE(STICK20_CMD_SEND_PASSWORD_MATRIX_SETUP == static_cast(CommandID::SEND_PASSWORD_MATRIX_SETUP)); + + REQUIRE(STICK20_CMD_GET_DEVICE_STATUS == static_cast(CommandID::GET_DEVICE_STATUS)); + REQUIRE(STICK20_CMD_SEND_DEVICE_STATUS == static_cast(CommandID::SEND_DEVICE_STATUS)); + + REQUIRE(STICK20_CMD_SEND_HIDDEN_VOLUME_PASSWORD == static_cast(CommandID::SEND_HIDDEN_VOLUME_PASSWORD)); + REQUIRE(STICK20_CMD_SEND_HIDDEN_VOLUME_SETUP == static_cast(CommandID::SEND_HIDDEN_VOLUME_SETUP)); + REQUIRE(STICK20_CMD_SEND_PASSWORD == static_cast(CommandID::SEND_PASSWORD)); + REQUIRE(STICK20_CMD_SEND_NEW_PASSWORD == static_cast(CommandID::SEND_NEW_PASSWORD)); + REQUIRE(STICK20_CMD_CLEAR_NEW_SD_CARD_FOUND == static_cast(CommandID::CLEAR_NEW_SD_CARD_FOUND)); + + REQUIRE(STICK20_CMD_SEND_STARTUP == static_cast(CommandID::SEND_STARTUP)); + REQUIRE(STICK20_CMD_SEND_CLEAR_STICK_KEYS_NOT_INITIATED == static_cast(CommandID::SEND_CLEAR_STICK_KEYS_NOT_INITIATED)); + REQUIRE(STICK20_CMD_SEND_LOCK_STICK_HARDWARE == static_cast(CommandID::SEND_LOCK_STICK_HARDWARE)); + + REQUIRE(STICK20_CMD_PRODUCTION_TEST == static_cast(CommandID::PRODUCTION_TEST)); + REQUIRE(STICK20_CMD_SEND_DEBUG_DATA == static_cast(CommandID::SEND_DEBUG_DATA)); + + REQUIRE(STICK20_CMD_CHANGE_UPDATE_PIN == static_cast(CommandID::CHANGE_UPDATE_PIN)); + +} + +TEST_CASE("test device internal status with various commands", "[fast]") { + Stick20 stick; + bool connected = stick.connect(); + REQUIRE(connected == true); + + Log::instance().set_loglevel(Loglevel::DEBUG_L2); + auto p = get_payload(); + p.set_defaults(); + auto device_status = stick20::SendStartup::CommandTransaction::run(stick, p); + REQUIRE(device_status.data().AdminPwRetryCount == 3); + REQUIRE(device_status.data().UserPwRetryCount == 3); + REQUIRE(device_status.data().ActiveSmartCardID_u32 != 0); + + auto production_status = stick20::ProductionTest::CommandTransaction::run(stick); + REQUIRE(production_status.data().SD_Card_Size_u8 == 8); + REQUIRE(production_status.data().SD_CardID_u32 != 0); +} + +TEST_CASE("general test", "[test]") { Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); -- cgit v1.2.1 From d58f3fd3bb6df5d3f46e3c4c3b719174e31b7201 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Thu, 27 Oct 2016 21:14:17 +0200 Subject: Support for setting hidden volume and test for it Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 8e3dacc..d79042a 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -126,6 +126,26 @@ TEST_CASE("test device internal status with various commands", "[fast]") { REQUIRE(production_status.data().SD_CardID_u32 != 0); } +TEST_CASE("setup hidden volume test", "[hidden]") { + Stick20 stick; + bool connected = stick.connect(); + REQUIRE(connected == true); + Log::instance().set_loglevel(Loglevel::DEBUG_L2); + stick10::LockDevice::CommandTransaction::run(stick); + this_thread::sleep_for(2000ms); + + execute_password_command(stick, "123456"); + + auto p = get_payload(); + p.set_defaults(); + auto hidden_volume_password = "123123123"; + strcpyT(p.HiddenVolumePassword_au8, hidden_volume_password); + stick20::SetupHiddenVolume::CommandTransaction::run(stick, p); + this_thread::sleep_for(2000ms); + + execute_password_command(stick, hidden_volume_password); +} + TEST_CASE("general test", "[test]") { Stick20 stick; bool connected = stick.connect(); -- cgit v1.2.1 From 9772055e79da77c6ec9ea6992cc77891efc1265a Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Fri, 28 Oct 2016 11:31:16 +0200 Subject: Test multiple hidden volumes with different passwords and locations Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index d79042a..21122ef 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -146,6 +146,38 @@ TEST_CASE("setup hidden volume test", "[hidden]") { execute_password_command(stick, hidden_volume_password); } +TEST_CASE("setup multiple hidden volumes", "[hidden2]") { + Stick20 stick; + bool connected = stick.connect(); + REQUIRE(connected == true); + Log::instance().set_loglevel(Loglevel::DEBUG_L2); + + auto user_pin = "123456"; + stick10::LockDevice::CommandTransaction::run(stick); + this_thread::sleep_for(2000ms); + execute_password_command(stick, user_pin); + + constexpr int volume_count = 4; + for (int i = 0; i < volume_count; ++i) { + auto p = get_payload(); + p.SlotNr_u8 = i; + p.StartBlockPercent_u8 = 20 + 10*i; + p.EndBlockPercent_u8 = p.StartBlockPercent_u8+i+1; + auto hidden_volume_password = std::string("123123123")+std::to_string(i); + strcpyT(p.HiddenVolumePassword_au8, hidden_volume_password.c_str()); + stick20::SetupHiddenVolume::CommandTransaction::run(stick, p); + this_thread::sleep_for(2000ms); + } + + + for (int i = 0; i < volume_count; ++i) { + execute_password_command(stick, user_pin); + auto hidden_volume_password = std::string("123123123")+std::to_string(i); + execute_password_command(stick, hidden_volume_password.c_str()); + this_thread::sleep_for(2000ms); + } +} + TEST_CASE("general test", "[test]") { Stick20 stick; bool connected = stick.connect(); -- cgit v1.2.1 From 3b1926164b2e0eb91cf3a7e9c854cca85f7d4c8e Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Fri, 28 Oct 2016 14:33:25 +0200 Subject: Support for changing firmware update password and test Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 21122ef..8db91b7 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -178,7 +178,30 @@ TEST_CASE("setup multiple hidden volumes", "[hidden2]") { } } -TEST_CASE("general test", "[test]") { +//in case of a bug this could change update PIN to some unexpected value +// - please save log with packet dump if this test will not pass +TEST_CASE("update password change", "[dangerous]") { + Stick20 stick; + bool connected = stick.connect(); + REQUIRE(connected == true); + Log::instance().set_loglevel(Loglevel::DEBUG_L2); + + auto pass1 = "12345678"; + auto pass2 = "12345678901234567890"; + + auto data = { + make_pair(pass1, pass2), + make_pair(pass2, pass1), + }; + for (auto && password: data) { + auto p = get_payload(); + strcpyT(p.current_update_password, password.first); + strcpyT(p.new_update_password, password.second); + stick20::ChangeUpdatePassword::CommandTransaction::run(stick, p); + } +} + + TEST_CASE("general test", "[test]") { Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); -- cgit v1.2.1 From 6343eea03980627cb763de777af6b316130bdf43 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Fri, 28 Oct 2016 14:55:56 +0200 Subject: Support getting SD card occupancy and test Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 8db91b7..f5d2b28 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -124,6 +124,12 @@ TEST_CASE("test device internal status with various commands", "[fast]") { auto production_status = stick20::ProductionTest::CommandTransaction::run(stick); REQUIRE(production_status.data().SD_Card_Size_u8 == 8); REQUIRE(production_status.data().SD_CardID_u32 != 0); + + auto sdcard_occupancy = stick20::GetSDCardOccupancy::CommandTransaction::run(stick); + REQUIRE((int) sdcard_occupancy.data().ReadLevelMin >= 0); + REQUIRE((int) sdcard_occupancy.data().ReadLevelMax <= 100); + REQUIRE((int) sdcard_occupancy.data().WriteLevelMin >= 0); + REQUIRE((int) sdcard_occupancy.data().WriteLevelMax <= 100); } TEST_CASE("setup hidden volume test", "[hidden]") { -- cgit v1.2.1 From ce30b49b4d50f2eff39a40ddd0c02ad96b78654c Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Fri, 28 Oct 2016 16:29:55 +0200 Subject: Make packet variables' names more clear General fixes Remove default values from hidden volume setup command rename password -> pin Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index f5d2b28..9aaef3f 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -40,7 +40,7 @@ TEST_CASE("long operation test", "[test_long]") { // execute_password_command(stick, "12345678", 'P'); auto p = get_payload(); p.set_defaults(); - strcpyT(p.password, "12345678"); + strcpyT(p.admin_pin, "12345678"); FillSDCardWithRandomChars::CommandTransaction::run(stick, p); this_thread::sleep_for(1000ms); @@ -143,7 +143,9 @@ TEST_CASE("setup hidden volume test", "[hidden]") { execute_password_command(stick, "123456"); auto p = get_payload(); - p.set_defaults(); + p.SlotNr_u8 = 0; + p.StartBlockPercent_u8 = 70; + p.EndBlockPercent_u8 = 90; auto hidden_volume_password = "123123123"; strcpyT(p.HiddenVolumePassword_au8, hidden_volume_password); stick20::SetupHiddenVolume::CommandTransaction::run(stick, p); -- cgit v1.2.1 From 6af0fa2c553ca1a31da63b7164b53defe11172df Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Fri, 28 Oct 2016 19:07:51 +0200 Subject: Tests refactoring - replace magic values with constants Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 9aaef3f..94a0dd3 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -1,4 +1,8 @@ #define CATCH_CONFIG_MAIN // This tells Catch to provide a main() +static const char *const default_admin_pin = "12345678"; + +static const char *const default_user_pin = "123456"; + #include "catch.hpp" #include @@ -37,10 +41,9 @@ TEST_CASE("long operation test", "[test_long]") { REQUIRE(connected == true); Log::instance().set_loglevel(Loglevel::DEBUG_L2); try{ -// execute_password_command(stick, "12345678", 'P'); auto p = get_payload(); p.set_defaults(); - strcpyT(p.admin_pin, "12345678"); + strcpyT(p.admin_pin, default_admin_pin); FillSDCardWithRandomChars::CommandTransaction::run(stick, p); this_thread::sleep_for(1000ms); @@ -140,7 +143,8 @@ TEST_CASE("setup hidden volume test", "[hidden]") { stick10::LockDevice::CommandTransaction::run(stick); this_thread::sleep_for(2000ms); - execute_password_command(stick, "123456"); + auto user_pin = default_user_pin; + execute_password_command(stick, user_pin); auto p = get_payload(); p.SlotNr_u8 = 0; @@ -160,7 +164,7 @@ TEST_CASE("setup multiple hidden volumes", "[hidden2]") { REQUIRE(connected == true); Log::instance().set_loglevel(Loglevel::DEBUG_L2); - auto user_pin = "123456"; + auto user_pin = default_user_pin; stick10::LockDevice::CommandTransaction::run(stick); this_thread::sleep_for(2000ms); execute_password_command(stick, user_pin); @@ -194,7 +198,7 @@ TEST_CASE("update password change", "[dangerous]") { REQUIRE(connected == true); Log::instance().set_loglevel(Loglevel::DEBUG_L2); - auto pass1 = "12345678"; + auto pass1 = default_admin_pin; auto pass2 = "12345678901234567890"; auto data = { @@ -220,7 +224,7 @@ TEST_CASE("update password change", "[dangerous]") { // execute_password_command(stick, "123456"); // execute_password_command(stick, "123456"); this_thread::sleep_for(1000ms); - execute_password_command(stick, "123456"); + execute_password_command(stick, default_user_pin); this_thread::sleep_for(4000ms); bool passed = false; for(int i=0; i<5; i++){ @@ -239,9 +243,11 @@ TEST_CASE("update password change", "[dangerous]") { } execute_password_command(stick, "123123123"); - execute_password_command(stick, "123456"); - execute_password_command(stick, "123456"); - execute_password_command(stick, "12345678", 'A'); + + + execute_password_command(stick, default_user_pin); + execute_password_command(stick, default_user_pin); + execute_password_command(stick, default_admin_pin, 'A'); stick20::GetDeviceStatus::CommandTransaction::run(stick); this_thread::sleep_for(1000ms); // execute_password_command(stick, "123123123"); //CAUTION -- cgit v1.2.1 From 4200d7428ac200fd7c0fb57e67aed9f492bfb3d5 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Fri, 28 Oct 2016 20:04:14 +0200 Subject: Tests: skip long and dangerous tests remove hidden volume test from general test Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 42 ++++++++++++++++++------------------------ 1 file changed, 18 insertions(+), 24 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index 94a0dd3..e4edf87 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -1,6 +1,6 @@ #define CATCH_CONFIG_MAIN // This tells Catch to provide a main() -static const char *const default_admin_pin = "12345678"; +static const char *const default_admin_pin = "12345678"; static const char *const default_user_pin = "123456"; #include "catch.hpp" @@ -34,8 +34,19 @@ void execute_password_command(Device &stick, const char *password, const char ki this_thread::sleep_for(1000ms); } +/** + * fail on purpose (will result in failed test) + * disable from running unwillingly + */ +void SKIP_TEST() { + CAPTURE("Failing current test to SKIP it"); + REQUIRE(false); +} + TEST_CASE("long operation test", "[test_long]") { + SKIP_TEST(); + Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); @@ -158,7 +169,7 @@ TEST_CASE("setup hidden volume test", "[hidden]") { execute_password_command(stick, hidden_volume_password); } -TEST_CASE("setup multiple hidden volumes", "[hidden2]") { +TEST_CASE("setup multiple hidden volumes", "[hidden]") { Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); @@ -190,9 +201,12 @@ TEST_CASE("setup multiple hidden volumes", "[hidden2]") { } } + //in case of a bug this could change update PIN to some unexpected value // - please save log with packet dump if this test will not pass TEST_CASE("update password change", "[dangerous]") { + SKIP_TEST(); + Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); @@ -213,7 +227,7 @@ TEST_CASE("update password change", "[dangerous]") { } } - TEST_CASE("general test", "[test]") { +TEST_CASE("general test", "[test]") { Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); @@ -223,27 +237,7 @@ TEST_CASE("update password change", "[dangerous]") { stick10::LockDevice::CommandTransaction::run(stick); // execute_password_command(stick, "123456"); // execute_password_command(stick, "123456"); - this_thread::sleep_for(1000ms); - execute_password_command(stick, default_user_pin); - this_thread::sleep_for(4000ms); - bool passed = false; - for(int i=0; i<5; i++){ - try { - execute_password_command(stick, "123123123"); - CHECK(true); - passed=true; - break; - } - catch (CommandFailedException &e){ - this_thread::sleep_for(2000ms); - } - } - if(!passed){ - CHECK(false); - } - - execute_password_command(stick, "123123123"); - +// execute_password_command(stick, "123123123"); execute_password_command(stick, default_user_pin); execute_password_command(stick, default_user_pin); -- cgit v1.2.1 From 103f71bb4e06132e70eb26fc2f1c5ca560068107 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Mon, 31 Oct 2016 20:47:23 +0100 Subject: Tests reorganization (Python) Signed-off-by: Szczepan Zalega --- unittest/conftest.py | 42 +++ unittest/constants.py | 30 +++ unittest/misc.py | 40 +++ unittest/test_bindings.py | 654 ---------------------------------------------- unittest/test_library.py | 67 +++++ unittest/test_pro.py | 488 ++++++++++++++++++++++++++++++++++ unittest/test_storage.py | 7 + 7 files changed, 674 insertions(+), 654 deletions(-) create mode 100644 unittest/conftest.py create mode 100644 unittest/constants.py create mode 100644 unittest/misc.py delete mode 100644 unittest/test_bindings.py create mode 100644 unittest/test_library.py create mode 100644 unittest/test_pro.py create mode 100644 unittest/test_storage.py (limited to 'unittest') diff --git a/unittest/conftest.py b/unittest/conftest.py new file mode 100644 index 0000000..68227d5 --- /dev/null +++ b/unittest/conftest.py @@ -0,0 +1,42 @@ +import pytest + +from misc import ffi + +@pytest.fixture(scope="module") +def C(request): + fp = '../NK_C_API.h' + + declarations = [] + with open(fp, 'r') as f: + declarations = f.readlines() + + a = iter(declarations) + for declaration in a: + if declaration.startswith('extern') and not '"C"' in declaration: + declaration = declaration.replace('extern', '').strip() + while not ';' in declaration: + declaration += (next(a)).strip() + print(declaration) + ffi.cdef(declaration, override=True) + + C = ffi.dlopen("../build/libnitrokey.so") + C.NK_set_debug(False) + nk_login = C.NK_login_auto() + if nk_login != 1: + print('No devices detected!') + assert nk_login == 1 # returns 0 if not connected or wrong model or 1 when connected + + # assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + # assert C.NK_user_authenticate(DefaultPasswords.USER, DefaultPasswords.USER_TEMP) == DeviceErrorCode.STATUS_OK + + # C.NK_status() + + def fin(): + print('\nFinishing connection to device') + C.NK_logout() + print('Finished') + + request.addfinalizer(fin) + C.NK_set_debug(True) + + return C diff --git a/unittest/constants.py b/unittest/constants.py new file mode 100644 index 0000000..e3caae3 --- /dev/null +++ b/unittest/constants.py @@ -0,0 +1,30 @@ +from enum import Enum +from misc import to_hex + +RFC_SECRET_HR = '12345678901234567890' +RFC_SECRET = to_hex(RFC_SECRET_HR) # '12345678901234567890' + + +# print( repr((RFC_SECRET, RFC_SECRET_, len(RFC_SECRET))) ) + +class DefaultPasswords(Enum): + ADMIN = '12345678' + USER = '123456' + ADMIN_TEMP = '123123123' + USER_TEMP = '234234234' + + +class DeviceErrorCode(Enum): + STATUS_OK = 0 + NOT_PROGRAMMED = 3 + WRONG_PASSWORD = 4 + STATUS_NOT_AUTHORIZED = 5 + STATUS_AES_DEC_FAILED = 0xa + + +class LibraryErrors(Enum): + TOO_LONG_STRING = 200 + INVALID_SLOT = 201 + INVALID_HEX_STRING = 202 + TARGET_BUFFER_SIZE_SMALLER_THAN_SOURCE = 203 + diff --git a/unittest/misc.py b/unittest/misc.py new file mode 100644 index 0000000..b45436d --- /dev/null +++ b/unittest/misc.py @@ -0,0 +1,40 @@ +import cffi + +ffi = cffi.FFI() +gs = ffi.string + + +def to_hex(s): + return "".join("{:02x}".format(ord(c)) for c in s) + + +def wait(t): + import time + msg = 'Waiting for %d seconds' % t + print(msg.center(40, '=')) + time.sleep(t) + + +def cast_pointer_to_tuple(obj, typen, len): + # usage: + # config = cast_pointer_to_tuple(config_raw_data, 'uint8_t', 5) + return tuple(ffi.cast("%s [%d]" % (typen, len), obj)[0:len]) + +def get_firmware_version_from_status(C): + status = gs(C.NK_status()) + status = [s if 'firmware_version' in s else '' for s in status.split('\n')] + firmware = status[0].split(':')[1] + return firmware + + +def is_pro_rtm_07(C): + firmware = get_firmware_version_from_status(C) + return '07 00' in firmware + + +def is_storage(C): + """ + exact firmware storage is sent by other function + """ + firmware = get_firmware_version_from_status(C) + return '01 00' in firmware \ No newline at end of file diff --git a/unittest/test_bindings.py b/unittest/test_bindings.py deleted file mode 100644 index f7ade46..0000000 --- a/unittest/test_bindings.py +++ /dev/null @@ -1,654 +0,0 @@ -import pytest -import cffi -from enum import Enum - -ffi = cffi.FFI() -gs = ffi.string - - -def to_hex(s): - return "".join("{:02x}".format(ord(c)) for c in s) - - -def wait(t): - import time - msg = 'Waiting for %d seconds' % t - print(msg.center(40, '=')) - time.sleep(t) - - -RFC_SECRET_HR = '12345678901234567890' -RFC_SECRET = to_hex(RFC_SECRET_HR) # '12345678901234567890' - - -# print( repr((RFC_SECRET, RFC_SECRET_, len(RFC_SECRET))) ) - -class DefaultPasswords(Enum): - ADMIN = '12345678' - USER = '123456' - ADMIN_TEMP = '123123123' - USER_TEMP = '234234234' - - -class DeviceErrorCode(Enum): - STATUS_OK = 0 - NOT_PROGRAMMED = 3 - WRONG_PASSWORD = 4 - STATUS_NOT_AUTHORIZED = 5 - STATUS_AES_DEC_FAILED = 0xa - - -class LibraryErrors(Enum): - TOO_LONG_STRING = 200 - INVALID_SLOT = 201 - INVALID_HEX_STRING = 202 - TARGET_BUFFER_SIZE_SMALLER_THAN_SOURCE = 203 - - -@pytest.fixture(scope="module") -def C(request): - fp = '../NK_C_API.h' - - declarations = [] - with open(fp, 'r') as f: - declarations = f.readlines() - - a = iter(declarations) - for declaration in a: - if declaration.startswith('extern') and not '"C"' in declaration: - declaration = declaration.replace('extern', '').strip() - while not ';' in declaration: - declaration += (next(a)).strip() - print(declaration) - ffi.cdef(declaration) - - C = ffi.dlopen("../build/libnitrokey.so") - C.NK_set_debug(False) - nk_login = C.NK_login_auto() - if nk_login != 1: - print('No devices detected!') - assert nk_login == 1 # returns 0 if not connected or wrong model or 1 when connected - - # assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - # assert C.NK_user_authenticate(DefaultPasswords.USER, DefaultPasswords.USER_TEMP) == DeviceErrorCode.STATUS_OK - - # C.NK_status() - - def fin(): - print('\nFinishing connection to device') - C.NK_logout() - print('Finished') - - request.addfinalizer(fin) - C.NK_set_debug(True) - - return C - - -def get_firmware_version_from_status(C): - status = gs(C.NK_status()) - status = [s if 'firmware_version' in s else '' for s in status.split('\n')] - firmware = status[0].split(':')[1] - return firmware - - -def is_pro_rtm_07(C): - firmware = get_firmware_version_from_status(C) - return '07 00' in firmware - - -def is_storage(C): - """ - exact firmware storage is sent by other function - """ - firmware = get_firmware_version_from_status(C) - return '01 00' in firmware - - -def test_enable_password_safe(C): - assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK - assert C.NK_enable_password_safe('wrong_password') == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - - -def test_write_password_safe_slot(C): - assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK - assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_NOT_AUTHORIZED - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_OK - - -def test_get_password_safe_slot_name(C): - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_OK - assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK - assert gs(C.NK_get_password_safe_slot_name(0)) == '' - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_NOT_AUTHORIZED - - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert gs(C.NK_get_password_safe_slot_name(0)) == 'slotname1' - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - - -def test_get_password_safe_slot_login_password(C): - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_OK - slot_login = C.NK_get_password_safe_slot_login(0) - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - assert gs(slot_login) == 'login1' - slot_password = gs(C.NK_get_password_safe_slot_password(0)) - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - assert slot_password == 'pass1' - - -def test_erase_password_safe_slot(C): - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert C.NK_erase_password_safe_slot(0) == DeviceErrorCode.STATUS_OK - assert gs(C.NK_get_password_safe_slot_name(0)) == '' - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK # TODO CHECK shouldn't this be DeviceErrorCode.NOT_PROGRAMMED ? - - -def test_password_safe_slot_status(C): - C.NK_set_debug(True) - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert C.NK_erase_password_safe_slot(0) == DeviceErrorCode.STATUS_OK - assert C.NK_write_password_safe_slot(1, 'slotname2', 'login2', 'pass2') == DeviceErrorCode.STATUS_OK - safe_slot_status = C.NK_get_password_safe_slot_status() - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - is_slot_programmed = list(ffi.cast("uint8_t [16]", safe_slot_status)[0:16]) - print((is_slot_programmed, len(is_slot_programmed))) - assert is_slot_programmed[0] == 0 - assert is_slot_programmed[1] == 1 - - -def test_issue_device_locks_on_second_key_generation_in_sequence(C): - if is_pro_rtm_07(C): - pytest.skip("issue to register: device locks up " - "after below commands sequence (reinsertion fixes), skipping for now") - assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK - assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK - - -def test_regenerate_aes_key(C): - C.NK_set_debug(True) - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - - -@pytest.mark.xfail(reason="NK Pro firmware bug: regenerating AES key command not always results in cleared slot data") -def test_destroy_password_safe(C): - """ - Sometimes fails on NK Pro - slot name is not cleared ergo key generation has not succeed despite the success result - returned from the device - """ - C.NK_set_debug(True) - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - # write password safe slot - assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_OK - # read slot - assert gs(C.NK_get_password_safe_slot_name(0)) == 'slotname1' - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - slot_login = C.NK_get_password_safe_slot_login(0) - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - assert gs(slot_login) == 'login1' - # destroy password safe by regenerating aes key - assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK - - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - - assert gs(C.NK_get_password_safe_slot_name(0)) != 'slotname1' - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - - # check was slot status cleared - safe_slot_status = C.NK_get_password_safe_slot_status() - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - is_slot_programmed = list(ffi.cast("uint8_t [16]", safe_slot_status)[0:16]) - assert is_slot_programmed[0] == 0 - - -def test_is_AES_supported(C): - if is_storage(C): - pytest.skip("Storage does not implement this command") - assert C.NK_is_AES_supported('wrong password') != 1 - assert C.NK_get_last_command_status() == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_is_AES_supported(DefaultPasswords.USER) == 1 - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - - -def test_admin_PIN_change(C): - new_password = '123123123' - assert C.NK_change_admin_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_change_admin_PIN(DefaultPasswords.ADMIN, new_password) == DeviceErrorCode.STATUS_OK - assert C.NK_change_admin_PIN(new_password, DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK - - -def test_user_PIN_change(C): - new_password = '123123123' - assert C.NK_change_user_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_change_user_PIN(DefaultPasswords.USER, new_password) == DeviceErrorCode.STATUS_OK - assert C.NK_change_user_PIN(new_password, DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - - -def test_too_long_strings(C): - new_password = '123123123' - long_string = 'a' * 100 - assert C.NK_change_user_PIN(long_string, new_password) == LibraryErrors.TOO_LONG_STRING - assert C.NK_change_user_PIN(new_password, long_string) == LibraryErrors.TOO_LONG_STRING - assert C.NK_change_admin_PIN(long_string, new_password) == LibraryErrors.TOO_LONG_STRING - assert C.NK_change_admin_PIN(new_password, long_string) == LibraryErrors.TOO_LONG_STRING - assert C.NK_first_authenticate(long_string, DefaultPasswords.ADMIN_TEMP) == LibraryErrors.TOO_LONG_STRING - assert C.NK_erase_totp_slot(0, long_string) == LibraryErrors.TOO_LONG_STRING - digits = False - assert C.NK_write_hotp_slot(1, long_string, RFC_SECRET, 0, digits, False, False, "", - DefaultPasswords.ADMIN_TEMP) == LibraryErrors.TOO_LONG_STRING - assert C.NK_write_hotp_slot(1, 'long_test', RFC_SECRET, 0, digits, False, False, "", - long_string) == LibraryErrors.TOO_LONG_STRING - assert C.NK_get_hotp_code_PIN(0, long_string) == 0 - assert C.NK_get_last_command_status() == LibraryErrors.TOO_LONG_STRING - - -def test_invalid_slot(C): - invalid_slot = 255 - assert C.NK_erase_totp_slot(invalid_slot, 'some password') == LibraryErrors.INVALID_SLOT - assert C.NK_write_hotp_slot(invalid_slot, 'long_test', RFC_SECRET, 0, False, False, False, "", - 'aaa') == LibraryErrors.INVALID_SLOT - assert C.NK_get_hotp_code_PIN(invalid_slot, 'some password') == 0 - assert C.NK_get_last_command_status() == LibraryErrors.INVALID_SLOT - assert C.NK_erase_password_safe_slot(invalid_slot) == LibraryErrors.INVALID_SLOT - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert gs(C.NK_get_password_safe_slot_name(invalid_slot)) == '' - assert C.NK_get_last_command_status() == LibraryErrors.INVALID_SLOT - assert gs(C.NK_get_password_safe_slot_login(invalid_slot)) == '' - assert C.NK_get_last_command_status() == LibraryErrors.INVALID_SLOT - - -def test_admin_retry_counts(C): - default_admin_retry_count = 3 - assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK - assert C.NK_get_admin_retry_count() == default_admin_retry_count - assert C.NK_change_admin_PIN('wrong_password', DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_get_admin_retry_count() == default_admin_retry_count - 1 - assert C.NK_change_admin_PIN(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK - assert C.NK_get_admin_retry_count() == default_admin_retry_count - - -def test_user_retry_counts_change_PIN(C): - assert C.NK_change_user_PIN(DefaultPasswords.USER, DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - wrong_password = 'wrong_password' - default_user_retry_count = 3 - assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK - assert C.NK_get_user_retry_count() == default_user_retry_count - assert C.NK_change_user_PIN(wrong_password, wrong_password) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_get_user_retry_count() == default_user_retry_count - 1 - assert C.NK_change_user_PIN(DefaultPasswords.USER, DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert C.NK_get_user_retry_count() == default_user_retry_count - -def test_user_retry_counts_PWSafe(C): - default_user_retry_count = 3 - assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK - assert C.NK_get_user_retry_count() == default_user_retry_count - assert C.NK_enable_password_safe('wrong_password') == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_get_user_retry_count() == default_user_retry_count - 1 - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert C.NK_get_user_retry_count() == default_user_retry_count - - -def test_unlock_user_password(C): - C.NK_set_debug(True) - default_user_retry_count = 3 - default_admin_retry_count = 3 - new_password = '123123123' - assert C.NK_get_user_retry_count() == default_user_retry_count - assert C.NK_change_user_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_change_user_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_change_user_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_get_user_retry_count() == default_user_retry_count - 3 - assert C.NK_get_admin_retry_count() == default_admin_retry_count - - assert C.NK_unlock_user_password('wrong password', DefaultPasswords.USER) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_get_admin_retry_count() == default_admin_retry_count - 1 - assert C.NK_unlock_user_password(DefaultPasswords.ADMIN, DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert C.NK_get_user_retry_count() == default_user_retry_count - assert C.NK_get_admin_retry_count() == default_admin_retry_count - - -def test_admin_auth(C): - assert C.NK_first_authenticate('wrong_password', DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - - -def test_user_auth(C): - assert C.NK_user_authenticate('wrong_password', DefaultPasswords.USER_TEMP) == DeviceErrorCode.WRONG_PASSWORD - assert C.NK_user_authenticate(DefaultPasswords.USER, DefaultPasswords.USER_TEMP) == DeviceErrorCode.STATUS_OK - - -def check_HOTP_RFC_codes(C, func, prep=None, use_8_digits=False): - """ - # https://tools.ietf.org/html/rfc4226#page-32 - """ - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_hotp_slot(1, 'python_test', RFC_SECRET, 0, use_8_digits, False, False, "", - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - test_data = [ - 1284755224, 1094287082, 137359152, 1726969429, 1640338314, 868254676, 1918287922, 82162583, 673399871, - 645520489, - ] - for code in test_data: - if prep: - prep() - r = func(1) - code = str(code)[-8:] if use_8_digits else str(code)[-6:] - assert int(code) == r - - -@pytest.mark.parametrize("use_8_digits", [False, True, ]) -@pytest.mark.parametrize("use_pin_protection", [False, True, ]) -def test_HOTP_RFC_use8digits_usepin(C, use_8_digits, use_pin_protection): - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, use_pin_protection, not use_pin_protection, - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - if use_pin_protection: - check_HOTP_RFC_codes(C, - lambda x: C.NK_get_hotp_code_PIN(x, DefaultPasswords.USER_TEMP), - lambda: C.NK_user_authenticate(DefaultPasswords.USER, DefaultPasswords.USER_TEMP), - use_8_digits=use_8_digits) - else: - check_HOTP_RFC_codes(C, C.NK_get_hotp_code, use_8_digits=use_8_digits) - - -def test_HOTP_token(C): - """ - Check HOTP routine with written token ID to slot. - """ - use_pin_protection = False - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, use_pin_protection, not use_pin_protection, - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - token_ID = "AAV100000022" - assert C.NK_write_hotp_slot(1, 'python_test', RFC_SECRET, 0, False, False, True, token_ID, - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - for i in range(5): - hotp_code = C.NK_get_hotp_code(1) - assert hotp_code != 0 - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - -def test_HOTP_counters(C): - """ - # https://tools.ietf.org/html/rfc4226#page-32 - """ - use_pin_protection = False - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, use_pin_protection, not use_pin_protection, - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - use_8_digits = True - HOTP_test_data = [ - 1284755224, 1094287082, 137359152, 1726969429, 1640338314, - 868254676, 1918287922, 82162583, 673399871, 645520489, - ] - slot_number = 1 - for counter, code in enumerate(HOTP_test_data): - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_hotp_slot(slot_number, 'python_test', RFC_SECRET, counter, use_8_digits, False, False, "", - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - r = C.NK_get_hotp_code(slot_number) - code = str(code)[-8:] if use_8_digits else str(code)[-6:] - assert int(code) == r - - -INT32_MAX = 2 ** 31 - 1 -def test_HOTP_64bit_counter(C): - if is_storage(C): - pytest.xfail('bug in NK Storage HOTP firmware - counter is set with a 8 digits string, ' - 'however int32max takes 10 digits to be written') - oath = pytest.importorskip("oath") - lib_at = lambda t: oath.hotp(RFC_SECRET, t, format='dec6') - PIN_protection = False - use_8_digits = False - slot_number = 1 - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, PIN_protection, not PIN_protection, - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - dev_res = [] - lib_res = [] - for t in range(INT32_MAX - 5, INT32_MAX + 5, 1): - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_hotp_slot(slot_number, 'python_test', RFC_SECRET, t, use_8_digits, False, False, "", - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - code_device = str(C.NK_get_hotp_code(slot_number)) - dev_res += (t, code_device) - lib_res += (t, lib_at(t)) - assert dev_res == lib_res - - -def test_TOTP_64bit_time(C): - if is_storage(C): - pytest.xfail('bug in NK Storage TOTP firmware') - oath = pytest.importorskip("oath") - T = 1 - lib_at = lambda t: oath.totp(RFC_SECRET, t=t) - PIN_protection = False - slot_number = 1 - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, PIN_protection, not PIN_protection, - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_totp_slot(slot_number, 'python_test', RFC_SECRET, 30, False, False, False, "", - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - dev_res = [] - lib_res = [] - for t in range(INT32_MAX - 5, INT32_MAX + 5, 1): - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_totp_set_time(t) == DeviceErrorCode.STATUS_OK - code_device = str((C.NK_get_totp_code(slot_number, T, 0, 30))) - dev_res += (t, code_device) - lib_res += (t, lib_at(t)) - assert dev_res == lib_res - - -@pytest.mark.xfail(reason="NK Pro: possible firmware bug or communication issue: set time command not always changes the time on stick thus failing this test, " - "this does not influence normal use since setting time is not done every TOTP code request" - "Rarely fail occurs on NK Storage") -@pytest.mark.parametrize("PIN_protection", [False, True, ]) -def test_TOTP_RFC_usepin(C, PIN_protection): - slot_number = 1 - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, PIN_protection, not PIN_protection, - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - # test according to https://tools.ietf.org/html/rfc6238#appendix-B - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_totp_slot(slot_number, 'python_test', RFC_SECRET, 30, True, False, False, "", - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - - get_func = None - if PIN_protection: - get_func = lambda x, y, z, r: C.NK_get_totp_code_PIN(x, y, z, r, DefaultPasswords.USER_TEMP) - else: - get_func = C.NK_get_totp_code - - # Mode: Sha1, time step X=30 - test_data = [ - #Time T (hex) TOTP - (59, 0x1, 94287082), - (1111111109, 0x00000000023523EC, 7081804), - (1111111111, 0x00000000023523ED, 14050471), - (1234567890, 0x000000000273EF07, 89005924), - (2000000000, 0x0000000003F940AA, 69279037), - # (20000000000, 0x0000000027BC86AA, 65353130), # 64bit is also checked in other test - ] - responses = [] - data = [] - correct = 0 - for t, T, expected_code in test_data: - if PIN_protection: - C.NK_user_authenticate(DefaultPasswords.USER, DefaultPasswords.USER_TEMP) - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_totp_set_time(t) == DeviceErrorCode.STATUS_OK - code_from_device = get_func(slot_number, T, 0, 30) # FIXME T is not changing the outcome - data += [ (t, expected_code) ] - responses += [ (t, code_from_device) ] - correct += expected_code == code_from_device - assert data == responses or correct == len(test_data) - -def test_get_slot_names(C): - C.NK_set_debug(True) - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_erase_totp_slot(0, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - # erasing slot invalidates temporary password, so requesting authentication - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_erase_hotp_slot(0, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - - for i in range(15): - name = ffi.string(C.NK_get_totp_slot_name(i)) - if name == '': - assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED - for i in range(3): - name = ffi.string(C.NK_get_hotp_slot_name(i)) - if name == '': - assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED - - -def test_get_OTP_codes(C): - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - for i in range(15): - code = C.NK_get_totp_code(i, 0, 0, 0) - if code == 0: - assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED - - for i in range(3): - code = C.NK_get_hotp_code(i) - if code == 0: - assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED - - -def test_get_OTP_code_from_not_programmed_slot(C): - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_erase_hotp_slot(0, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_erase_totp_slot(0, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - - code = C.NK_get_hotp_code(0) - assert code == 0 - assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED - - code = C.NK_get_totp_code(0, 0, 0, 0) - assert code == 0 - assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED - - -def test_get_code_user_authorize(C): - C.NK_set_debug(True) - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_totp_slot(0, 'python_otp_auth', RFC_SECRET, 30, True, False, False, "", - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - # enable PIN protection of OTP codes with write_config - # TODO create convinience function on C API side to enable/disable OTP USER_PIN protection - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, True, False, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - code = C.NK_get_totp_code(0, 0, 0, 0) - assert code == 0 - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_NOT_AUTHORIZED - # disable PIN protection with write_config - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - code = C.NK_get_totp_code(0, 0, 0, 0) - assert code != 0 - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - - -def cast_pointer_to_tuple(obj, typen, len): - # usage: - # config = cast_pointer_to_tuple(config_raw_data, 'uint8_t', 5) - return tuple(ffi.cast("%s [%d]" % (typen, len), obj)[0:len]) - - -def test_read_write_config(C): - C.NK_set_debug(True) - - # let's set sample config with pin protection and disabled scrolllock - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(0, 1, 2, True, False, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - config_raw_data = C.NK_read_config() - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - config = cast_pointer_to_tuple(config_raw_data, 'uint8_t', 5) - assert config == (0, 1, 2, True, False) - - # restore defaults and check - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - config_raw_data = C.NK_read_config() - assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK - config = cast_pointer_to_tuple(config_raw_data, 'uint8_t', 5) - assert config == (255, 255, 255, False, True) - - -def test_factory_reset(C): - if is_storage(C): - pytest.skip('Recovery not implemented for NK Storage') - C.NK_set_debug(True) - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_write_hotp_slot(1, 'python_test', RFC_SECRET, 0, False, False, False, "", - DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_get_hotp_code(1) == 755224 - assert C.NK_factory_reset(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK - wait(10) - assert C.NK_get_hotp_code(1) != 287082 - assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED - # restore AES key - assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK - assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK - assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK - assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK - - -@pytest.mark.skip(reason='Experimental') -def test_clear(C): - d = 'asdasdasd' - print(d) - C.clear_password(d) - print(d) - - -def test_get_status(C): - status = C.NK_status() - s = gs(status) - assert len(s) > 0 - - -def test_get_serial_number(C): - sn = C.NK_device_serial_number() - sn = gs(sn) - assert len(sn) > 0 - print(('Serial number of the device: ', sn)) - - -@pytest.mark.parametrize("invalid_hex_string", - ['text', '00 ', '0xff', 'zzzzzzzzzzzz', 'fff', '', 'f' * 257, 'f' * 258]) -def test_invalid_secret_hex_string_for_OTP_write(C, invalid_hex_string): - """ - Tests for invalid secret hex string during writing to OTP slot. Invalid strings are not hexadecimal number, - empty or longer than 255 characters. - """ - assert C.NK_write_hotp_slot(1, 'slot_name', invalid_hex_string, 0, True, False, False, '', - DefaultPasswords.ADMIN_TEMP) == LibraryErrors.INVALID_HEX_STRING - assert C.NK_write_totp_slot(1, 'python_test', invalid_hex_string, 30, True, False, False, "", - DefaultPasswords.ADMIN_TEMP) == LibraryErrors.INVALID_HEX_STRING - - -def test_warning_binary_bigger_than_secret_buffer(C): - invalid_hex_string = to_hex('1234567890') * 3 - assert C.NK_write_hotp_slot(1, 'slot_name', invalid_hex_string, 0, True, False, False, '', - DefaultPasswords.ADMIN_TEMP) == LibraryErrors.TARGET_BUFFER_SIZE_SMALLER_THAN_SOURCE - - -@pytest.mark.xfail(reason="TODO") -def test_OTP_secret_started_from_null(C): - assert False diff --git a/unittest/test_library.py b/unittest/test_library.py new file mode 100644 index 0000000..d0eef80 --- /dev/null +++ b/unittest/test_library.py @@ -0,0 +1,67 @@ +import pytest + +from misc import ffi, gs, to_hex +from constants import DefaultPasswords, DeviceErrorCode, RFC_SECRET, LibraryErrors + +def test_too_long_strings(C): + new_password = '123123123' + long_string = 'a' * 100 + assert C.NK_change_user_PIN(long_string, new_password) == LibraryErrors.TOO_LONG_STRING + assert C.NK_change_user_PIN(new_password, long_string) == LibraryErrors.TOO_LONG_STRING + assert C.NK_change_admin_PIN(long_string, new_password) == LibraryErrors.TOO_LONG_STRING + assert C.NK_change_admin_PIN(new_password, long_string) == LibraryErrors.TOO_LONG_STRING + assert C.NK_first_authenticate(long_string, DefaultPasswords.ADMIN_TEMP) == LibraryErrors.TOO_LONG_STRING + assert C.NK_erase_totp_slot(0, long_string) == LibraryErrors.TOO_LONG_STRING + digits = False + assert C.NK_write_hotp_slot(1, long_string, RFC_SECRET, 0, digits, False, False, "", + DefaultPasswords.ADMIN_TEMP) == LibraryErrors.TOO_LONG_STRING + assert C.NK_write_hotp_slot(1, 'long_test', RFC_SECRET, 0, digits, False, False, "", + long_string) == LibraryErrors.TOO_LONG_STRING + assert C.NK_get_hotp_code_PIN(0, long_string) == 0 + assert C.NK_get_last_command_status() == LibraryErrors.TOO_LONG_STRING + + +def test_invalid_slot(C): + invalid_slot = 255 + assert C.NK_erase_totp_slot(invalid_slot, 'some password') == LibraryErrors.INVALID_SLOT + assert C.NK_write_hotp_slot(invalid_slot, 'long_test', RFC_SECRET, 0, False, False, False, "", + 'aaa') == LibraryErrors.INVALID_SLOT + assert C.NK_get_hotp_code_PIN(invalid_slot, 'some password') == 0 + assert C.NK_get_last_command_status() == LibraryErrors.INVALID_SLOT + assert C.NK_erase_password_safe_slot(invalid_slot) == LibraryErrors.INVALID_SLOT + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert gs(C.NK_get_password_safe_slot_name(invalid_slot)) == '' + assert C.NK_get_last_command_status() == LibraryErrors.INVALID_SLOT + assert gs(C.NK_get_password_safe_slot_login(invalid_slot)) == '' + assert C.NK_get_last_command_status() == LibraryErrors.INVALID_SLOT + +@pytest.mark.parametrize("invalid_hex_string", + ['text', '00 ', '0xff', 'zzzzzzzzzzzz', 'fff', '', 'f' * 257, 'f' * 258]) +def test_invalid_secret_hex_string_for_OTP_write(C, invalid_hex_string): + """ + Tests for invalid secret hex string during writing to OTP slot. Invalid strings are not hexadecimal number, + empty or longer than 255 characters. + """ + assert C.NK_write_hotp_slot(1, 'slot_name', invalid_hex_string, 0, True, False, False, '', + DefaultPasswords.ADMIN_TEMP) == LibraryErrors.INVALID_HEX_STRING + assert C.NK_write_totp_slot(1, 'python_test', invalid_hex_string, 30, True, False, False, "", + DefaultPasswords.ADMIN_TEMP) == LibraryErrors.INVALID_HEX_STRING + + +def test_warning_binary_bigger_than_secret_buffer(C): + invalid_hex_string = to_hex('1234567890') * 3 + assert C.NK_write_hotp_slot(1, 'slot_name', invalid_hex_string, 0, True, False, False, '', + DefaultPasswords.ADMIN_TEMP) == LibraryErrors.TARGET_BUFFER_SIZE_SMALLER_THAN_SOURCE + + +@pytest.mark.xfail(reason="TODO") +def test_OTP_secret_started_from_null(C): + assert False + + +@pytest.mark.skip(reason='Experimental') +def test_clear(C): + d = 'asdasdasd' + print(d) + C.clear_password(d) + print(d) \ No newline at end of file diff --git a/unittest/test_pro.py b/unittest/test_pro.py new file mode 100644 index 0000000..6ab2af9 --- /dev/null +++ b/unittest/test_pro.py @@ -0,0 +1,488 @@ +import pytest + +from constants import DefaultPasswords, DeviceErrorCode, RFC_SECRET +from misc import ffi, gs, wait, cast_pointer_to_tuple +from misc import is_pro_rtm_07, is_storage + +def test_enable_password_safe(C): + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_enable_password_safe('wrong_password') == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + + +def test_write_password_safe_slot(C): + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_NOT_AUTHORIZED + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_OK + + +def test_get_password_safe_slot_name(C): + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_OK + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert gs(C.NK_get_password_safe_slot_name(0)) == '' + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_NOT_AUTHORIZED + + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert gs(C.NK_get_password_safe_slot_name(0)) == 'slotname1' + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + + +def test_get_password_safe_slot_login_password(C): + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_OK + slot_login = C.NK_get_password_safe_slot_login(0) + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + assert gs(slot_login) == 'login1' + slot_password = gs(C.NK_get_password_safe_slot_password(0)) + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + assert slot_password == 'pass1' + + +def test_erase_password_safe_slot(C): + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_erase_password_safe_slot(0) == DeviceErrorCode.STATUS_OK + assert gs(C.NK_get_password_safe_slot_name(0)) == '' + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK # TODO CHECK shouldn't this be DeviceErrorCode.NOT_PROGRAMMED ? + + +def test_password_safe_slot_status(C): + C.NK_set_debug(True) + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_erase_password_safe_slot(0) == DeviceErrorCode.STATUS_OK + assert C.NK_write_password_safe_slot(1, 'slotname2', 'login2', 'pass2') == DeviceErrorCode.STATUS_OK + safe_slot_status = C.NK_get_password_safe_slot_status() + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + is_slot_programmed = list(ffi.cast("uint8_t [16]", safe_slot_status)[0:16]) + print((is_slot_programmed, len(is_slot_programmed))) + assert is_slot_programmed[0] == 0 + assert is_slot_programmed[1] == 1 + + +def test_issue_device_locks_on_second_key_generation_in_sequence(C): + if is_pro_rtm_07(C): + pytest.skip("issue to register: device locks up " + "after below commands sequence (reinsertion fixes), skipping for now") + assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + + +def test_regenerate_aes_key(C): + C.NK_set_debug(True) + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + + +@pytest.mark.xfail(reason="NK Pro firmware bug: regenerating AES key command not always results in cleared slot data") +def test_destroy_password_safe(C): + """ + Sometimes fails on NK Pro - slot name is not cleared ergo key generation has not succeed despite the success result + returned from the device + """ + C.NK_set_debug(True) + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + # write password safe slot + assert C.NK_write_password_safe_slot(0, 'slotname1', 'login1', 'pass1') == DeviceErrorCode.STATUS_OK + # read slot + assert gs(C.NK_get_password_safe_slot_name(0)) == 'slotname1' + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + slot_login = C.NK_get_password_safe_slot_login(0) + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + assert gs(slot_login) == 'login1' + # destroy password safe by regenerating aes key + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + + assert gs(C.NK_get_password_safe_slot_name(0)) != 'slotname1' + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + + # check was slot status cleared + safe_slot_status = C.NK_get_password_safe_slot_status() + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + is_slot_programmed = list(ffi.cast("uint8_t [16]", safe_slot_status)[0:16]) + assert is_slot_programmed[0] == 0 + + +def test_is_AES_supported(C): + if is_storage(C): + pytest.skip("Storage does not implement this command") + assert C.NK_is_AES_supported('wrong password') != 1 + assert C.NK_get_last_command_status() == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_is_AES_supported(DefaultPasswords.USER) == 1 + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + + +def test_admin_PIN_change(C): + new_password = '123123123' + assert C.NK_change_admin_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_change_admin_PIN(DefaultPasswords.ADMIN, new_password) == DeviceErrorCode.STATUS_OK + assert C.NK_change_admin_PIN(new_password, DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + + +def test_user_PIN_change(C): + new_password = '123123123' + assert C.NK_change_user_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_change_user_PIN(DefaultPasswords.USER, new_password) == DeviceErrorCode.STATUS_OK + assert C.NK_change_user_PIN(new_password, DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + + +def test_admin_retry_counts(C): + default_admin_retry_count = 3 + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_get_admin_retry_count() == default_admin_retry_count + assert C.NK_change_admin_PIN('wrong_password', DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_get_admin_retry_count() == default_admin_retry_count - 1 + assert C.NK_change_admin_PIN(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + assert C.NK_get_admin_retry_count() == default_admin_retry_count + + +def test_user_retry_counts_change_PIN(C): + assert C.NK_change_user_PIN(DefaultPasswords.USER, DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + wrong_password = 'wrong_password' + default_user_retry_count = 3 + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_get_user_retry_count() == default_user_retry_count + assert C.NK_change_user_PIN(wrong_password, wrong_password) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_get_user_retry_count() == default_user_retry_count - 1 + assert C.NK_change_user_PIN(DefaultPasswords.USER, DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_get_user_retry_count() == default_user_retry_count + +def test_user_retry_counts_PWSafe(C): + default_user_retry_count = 3 + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_get_user_retry_count() == default_user_retry_count + assert C.NK_enable_password_safe('wrong_password') == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_get_user_retry_count() == default_user_retry_count - 1 + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_get_user_retry_count() == default_user_retry_count + + +def test_unlock_user_password(C): + C.NK_set_debug(True) + default_user_retry_count = 3 + default_admin_retry_count = 3 + new_password = '123123123' + assert C.NK_get_user_retry_count() == default_user_retry_count + assert C.NK_change_user_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_change_user_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_change_user_PIN('wrong_password', new_password) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_get_user_retry_count() == default_user_retry_count - 3 + assert C.NK_get_admin_retry_count() == default_admin_retry_count + + assert C.NK_unlock_user_password('wrong password', DefaultPasswords.USER) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_get_admin_retry_count() == default_admin_retry_count - 1 + assert C.NK_unlock_user_password(DefaultPasswords.ADMIN, DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_get_user_retry_count() == default_user_retry_count + assert C.NK_get_admin_retry_count() == default_admin_retry_count + + +def test_admin_auth(C): + assert C.NK_first_authenticate('wrong_password', DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + + +def test_user_auth(C): + assert C.NK_user_authenticate('wrong_password', DefaultPasswords.USER_TEMP) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_user_authenticate(DefaultPasswords.USER, DefaultPasswords.USER_TEMP) == DeviceErrorCode.STATUS_OK + + +def check_HOTP_RFC_codes(C, func, prep=None, use_8_digits=False): + """ + # https://tools.ietf.org/html/rfc4226#page-32 + """ + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_hotp_slot(1, 'python_test', RFC_SECRET, 0, use_8_digits, False, False, "", + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + test_data = [ + 1284755224, 1094287082, 137359152, 1726969429, 1640338314, 868254676, 1918287922, 82162583, 673399871, + 645520489, + ] + for code in test_data: + if prep: + prep() + r = func(1) + code = str(code)[-8:] if use_8_digits else str(code)[-6:] + assert int(code) == r + + +@pytest.mark.parametrize("use_8_digits", [False, True, ]) +@pytest.mark.parametrize("use_pin_protection", [False, True, ]) +def test_HOTP_RFC_use8digits_usepin(C, use_8_digits, use_pin_protection): + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, use_pin_protection, not use_pin_protection, + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + if use_pin_protection: + check_HOTP_RFC_codes(C, + lambda x: C.NK_get_hotp_code_PIN(x, DefaultPasswords.USER_TEMP), + lambda: C.NK_user_authenticate(DefaultPasswords.USER, DefaultPasswords.USER_TEMP), + use_8_digits=use_8_digits) + else: + check_HOTP_RFC_codes(C, C.NK_get_hotp_code, use_8_digits=use_8_digits) + + +def test_HOTP_token(C): + """ + Check HOTP routine with written token ID to slot. + """ + use_pin_protection = False + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, use_pin_protection, not use_pin_protection, + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + token_ID = "AAV100000022" + assert C.NK_write_hotp_slot(1, 'python_test', RFC_SECRET, 0, False, False, True, token_ID, + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + for i in range(5): + hotp_code = C.NK_get_hotp_code(1) + assert hotp_code != 0 + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + +def test_HOTP_counters(C): + """ + # https://tools.ietf.org/html/rfc4226#page-32 + """ + use_pin_protection = False + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, use_pin_protection, not use_pin_protection, + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + use_8_digits = True + HOTP_test_data = [ + 1284755224, 1094287082, 137359152, 1726969429, 1640338314, + 868254676, 1918287922, 82162583, 673399871, 645520489, + ] + slot_number = 1 + for counter, code in enumerate(HOTP_test_data): + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_hotp_slot(slot_number, 'python_test', RFC_SECRET, counter, use_8_digits, False, False, "", + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + r = C.NK_get_hotp_code(slot_number) + code = str(code)[-8:] if use_8_digits else str(code)[-6:] + assert int(code) == r + + +INT32_MAX = 2 ** 31 - 1 +def test_HOTP_64bit_counter(C): + if is_storage(C): + pytest.xfail('bug in NK Storage HOTP firmware - counter is set with a 8 digits string, ' + 'however int32max takes 10 digits to be written') + oath = pytest.importorskip("oath") + lib_at = lambda t: oath.hotp(RFC_SECRET, t, format='dec6') + PIN_protection = False + use_8_digits = False + slot_number = 1 + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, PIN_protection, not PIN_protection, + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + dev_res = [] + lib_res = [] + for t in range(INT32_MAX - 5, INT32_MAX + 5, 1): + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_hotp_slot(slot_number, 'python_test', RFC_SECRET, t, use_8_digits, False, False, "", + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + code_device = str(C.NK_get_hotp_code(slot_number)) + dev_res += (t, code_device) + lib_res += (t, lib_at(t)) + assert dev_res == lib_res + + +def test_TOTP_64bit_time(C): + if is_storage(C): + pytest.xfail('bug in NK Storage TOTP firmware') + oath = pytest.importorskip("oath") + T = 1 + lib_at = lambda t: oath.totp(RFC_SECRET, t=t) + PIN_protection = False + slot_number = 1 + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, PIN_protection, not PIN_protection, + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_totp_slot(slot_number, 'python_test', RFC_SECRET, 30, False, False, False, "", + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + dev_res = [] + lib_res = [] + for t in range(INT32_MAX - 5, INT32_MAX + 5, 1): + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_totp_set_time(t) == DeviceErrorCode.STATUS_OK + code_device = str((C.NK_get_totp_code(slot_number, T, 0, 30))) + dev_res += (t, code_device) + lib_res += (t, lib_at(t)) + assert dev_res == lib_res + + +@pytest.mark.xfail(reason="NK Pro: possible firmware bug or communication issue: set time command not always changes the time on stick thus failing this test, " + "this does not influence normal use since setting time is not done every TOTP code request" + "Rarely fail occurs on NK Storage") +@pytest.mark.parametrize("PIN_protection", [False, True, ]) +def test_TOTP_RFC_usepin(C, PIN_protection): + slot_number = 1 + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, PIN_protection, not PIN_protection, + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + # test according to https://tools.ietf.org/html/rfc6238#appendix-B + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_totp_slot(slot_number, 'python_test', RFC_SECRET, 30, True, False, False, "", + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + + get_func = None + if PIN_protection: + get_func = lambda x, y, z, r: C.NK_get_totp_code_PIN(x, y, z, r, DefaultPasswords.USER_TEMP) + else: + get_func = C.NK_get_totp_code + + # Mode: Sha1, time step X=30 + test_data = [ + #Time T (hex) TOTP + (59, 0x1, 94287082), + (1111111109, 0x00000000023523EC, 7081804), + (1111111111, 0x00000000023523ED, 14050471), + (1234567890, 0x000000000273EF07, 89005924), + (2000000000, 0x0000000003F940AA, 69279037), + # (20000000000, 0x0000000027BC86AA, 65353130), # 64bit is also checked in other test + ] + responses = [] + data = [] + correct = 0 + for t, T, expected_code in test_data: + if PIN_protection: + C.NK_user_authenticate(DefaultPasswords.USER, DefaultPasswords.USER_TEMP) + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_totp_set_time(t) == DeviceErrorCode.STATUS_OK + code_from_device = get_func(slot_number, T, 0, 30) # FIXME T is not changing the outcome + data += [ (t, expected_code) ] + responses += [ (t, code_from_device) ] + correct += expected_code == code_from_device + assert data == responses or correct == len(test_data) + +def test_get_slot_names(C): + C.NK_set_debug(True) + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_erase_totp_slot(0, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + # erasing slot invalidates temporary password, so requesting authentication + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_erase_hotp_slot(0, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + + for i in range(15): + name = ffi.string(C.NK_get_totp_slot_name(i)) + if name == '': + assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED + for i in range(3): + name = ffi.string(C.NK_get_hotp_slot_name(i)) + if name == '': + assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED + + +def test_get_OTP_codes(C): + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + for i in range(15): + code = C.NK_get_totp_code(i, 0, 0, 0) + if code == 0: + assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED + + for i in range(3): + code = C.NK_get_hotp_code(i) + if code == 0: + assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED + + +def test_get_OTP_code_from_not_programmed_slot(C): + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_erase_hotp_slot(0, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_erase_totp_slot(0, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + + code = C.NK_get_hotp_code(0) + assert code == 0 + assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED + + code = C.NK_get_totp_code(0, 0, 0, 0) + assert code == 0 + assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED + + +def test_get_code_user_authorize(C): + C.NK_set_debug(True) + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_totp_slot(0, 'python_otp_auth', RFC_SECRET, 30, True, False, False, "", + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + # enable PIN protection of OTP codes with write_config + # TODO create convinience function on C API side to enable/disable OTP USER_PIN protection + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, True, False, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + code = C.NK_get_totp_code(0, 0, 0, 0) + assert code == 0 + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_NOT_AUTHORIZED + # disable PIN protection with write_config + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + code = C.NK_get_totp_code(0, 0, 0, 0) + assert code != 0 + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + + +def cast_pointer_to_tuple(obj, typen, len): + # usage: + # config = cast_pointer_to_tuple(config_raw_data, 'uint8_t', 5) + return tuple(ffi.cast("%s [%d]" % (typen, len), obj)[0:len]) + + +def test_read_write_config(C): + C.NK_set_debug(True) + + # let's set sample config with pin protection and disabled scrolllock + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(0, 1, 2, True, False, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + config_raw_data = C.NK_read_config() + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + config = cast_pointer_to_tuple(config_raw_data, 'uint8_t', 5) + assert config == (0, 1, 2, True, False) + + # restore defaults and check + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + config_raw_data = C.NK_read_config() + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + config = cast_pointer_to_tuple(config_raw_data, 'uint8_t', 5) + assert config == (255, 255, 255, False, True) + + +def test_factory_reset(C): + if is_storage(C): + pytest.skip('Recovery not implemented for NK Storage') + C.NK_set_debug(True) + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_config(255, 255, 255, False, True, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_write_hotp_slot(1, 'python_test', RFC_SECRET, 0, False, False, False, "", + DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_get_hotp_code(1) == 755224 + assert C.NK_factory_reset(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + wait(10) + assert C.NK_get_hotp_code(1) != 287082 + assert C.NK_get_last_command_status() == DeviceErrorCode.NOT_PROGRAMMED + # restore AES key + assert C.NK_first_authenticate(DefaultPasswords.ADMIN, DefaultPasswords.ADMIN_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_build_aes_key(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + assert C.NK_enable_password_safe(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + + +def test_get_status(C): + status = C.NK_status() + s = gs(status) + assert len(s) > 0 + + +def test_get_serial_number(C): + sn = C.NK_device_serial_number() + sn = gs(sn) + assert len(sn) > 0 + print(('Serial number of the device: ', sn)) diff --git a/unittest/test_storage.py b/unittest/test_storage.py new file mode 100644 index 0000000..d6cc558 --- /dev/null +++ b/unittest/test_storage.py @@ -0,0 +1,7 @@ +import pytest + +from misc import ffi, gs, wait, cast_pointer_to_tuple +from constants import DefaultPasswords, DeviceErrorCode, RFC_SECRET, LibraryErrors + + + -- cgit v1.2.1 From 0a15620115f4f6d56ec99777e1996497d7175bc2 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Wed, 2 Nov 2016 21:52:09 +0100 Subject: Decrease debug log output in c++ tests Signed-off-by: Szczepan Zalega --- unittest/test2.cc | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'unittest') diff --git a/unittest/test2.cc b/unittest/test2.cc index e4edf87..00e70e3 100644 --- a/unittest/test2.cc +++ b/unittest/test2.cc @@ -50,7 +50,7 @@ TEST_CASE("long operation test", "[test_long]") { Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); - Log::instance().set_loglevel(Loglevel::DEBUG_L2); + Log::instance().set_loglevel(Loglevel::DEBUG); try{ auto p = get_payload(); p.set_defaults(); @@ -127,8 +127,8 @@ TEST_CASE("test device internal status with various commands", "[fast]") { bool connected = stick.connect(); REQUIRE(connected == true); - Log::instance().set_loglevel(Loglevel::DEBUG_L2); - auto p = get_payload(); + Log::instance().set_loglevel(Loglevel::DEBUG); + auto p = get_payload(); p.set_defaults(); auto device_status = stick20::SendStartup::CommandTransaction::run(stick, p); REQUIRE(device_status.data().AdminPwRetryCount == 3); @@ -150,7 +150,7 @@ TEST_CASE("setup hidden volume test", "[hidden]") { Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); - Log::instance().set_loglevel(Loglevel::DEBUG_L2); + Log::instance().set_loglevel(Loglevel::DEBUG); stick10::LockDevice::CommandTransaction::run(stick); this_thread::sleep_for(2000ms); @@ -173,7 +173,7 @@ TEST_CASE("setup multiple hidden volumes", "[hidden]") { Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); - Log::instance().set_loglevel(Loglevel::DEBUG_L2); + Log::instance().set_loglevel(Loglevel::DEBUG); auto user_pin = default_user_pin; stick10::LockDevice::CommandTransaction::run(stick); @@ -210,7 +210,7 @@ TEST_CASE("update password change", "[dangerous]") { Stick20 stick; bool connected = stick.connect(); REQUIRE(connected == true); - Log::instance().set_loglevel(Loglevel::DEBUG_L2); + Log::instance().set_loglevel(Loglevel::DEBUG); auto pass1 = default_admin_pin; auto pass2 = "12345678901234567890"; @@ -232,7 +232,7 @@ TEST_CASE("general test", "[test]") { bool connected = stick.connect(); REQUIRE(connected == true); - Log::instance().set_loglevel(Loglevel::DEBUG_L2); + Log::instance().set_loglevel(Loglevel::DEBUG); stick10::LockDevice::CommandTransaction::run(stick); // execute_password_command(stick, "123456"); -- cgit v1.2.1 From 7d943d3e8717ba47af4b53787cc4c29ad6ee2f90 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Wed, 2 Nov 2016 21:52:40 +0100 Subject: Python bindings and tests for most of Storage functionality Signed-off-by: Szczepan Zalega --- unittest/constants.py | 2 ++ unittest/test_storage.py | 91 ++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 93 insertions(+) (limited to 'unittest') diff --git a/unittest/constants.py b/unittest/constants.py index e3caae3..258619e 100644 --- a/unittest/constants.py +++ b/unittest/constants.py @@ -12,6 +12,8 @@ class DefaultPasswords(Enum): USER = '123456' ADMIN_TEMP = '123123123' USER_TEMP = '234234234' + UPDATE = '12345678' + UPDATE_TEMP = '123update123' class DeviceErrorCode(Enum): diff --git a/unittest/test_storage.py b/unittest/test_storage.py index d6cc558..b02b1eb 100644 --- a/unittest/test_storage.py +++ b/unittest/test_storage.py @@ -3,5 +3,96 @@ import pytest from misc import ffi, gs, wait, cast_pointer_to_tuple from constants import DefaultPasswords, DeviceErrorCode, RFC_SECRET, LibraryErrors +import pprint +pprint = pprint.PrettyPrinter(indent=4).pprint +def get_dict_from_dissect(status): + x = [] + for s in status.split('\n'): + try: + if not ':' in s: continue + ss = s.replace('\t', '').replace(' (int) ', '').split(':') + if not len(ss) == 2: continue + x.append(ss) + except: + pass + d = {k.strip(): v.strip() for k, v in x} + return d + + +def test_get_status_storage(C): + status_pointer = C.NK_get_status_storage() + status_string = gs(status_pointer) + status_dict = get_dict_from_dissect(status_string) + default_admin_password_retry_count = 3 + assert int(status_dict['AdminPwRetryCount']) == default_admin_password_retry_count + + +def test_sd_card_usage(C): + data_pointer = C.NK_get_SD_usage_data() + data_string = gs(data_pointer) + assert len(data_string) > 0 + data_dict = get_dict_from_dissect(data_string) + assert int(data_dict['WriteLevelMax']) <= 100 + + +def test_encrypted_volume_unlock(C): + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_unlock_encrypted_volume(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + + +def test_encrypted_volume_unlock_hidden(C): + hidden_volume_password = 'hiddenpassword' + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_unlock_encrypted_volume(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_create_hidden_volume(0, 20, 21, hidden_volume_password) == DeviceErrorCode.STATUS_OK + assert C.NK_unlock_hidden_volume(hidden_volume_password) == DeviceErrorCode.STATUS_OK + + +def test_encrypted_volume_setup_multiple_hidden(C): + hidden_volume_password = 'hiddenpassword' + p = lambda i: hidden_volume_password + str(i) + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_unlock_encrypted_volume(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + for i in range(4): + assert C.NK_create_hidden_volume(i, 20+i*10, 20+i*10+i+1, p(i) ) == DeviceErrorCode.STATUS_OK + for i in range(4): + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_unlock_encrypted_volume(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + assert C.NK_unlock_hidden_volume(p(i)) == DeviceErrorCode.STATUS_OK + + +def test_unencrypted_volume_set_read_only(C): + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_set_unencrypted_read_only(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + + +def test_unencrypted_volume_set_read_write(C): + assert C.NK_lock_device() == DeviceErrorCode.STATUS_OK + assert C.NK_set_unencrypted_read_write(DefaultPasswords.USER) == DeviceErrorCode.STATUS_OK + + +def test_export_firmware(C): + assert C.NK_export_firmware(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + + +def test_clear_new_sd_card_notification(C): + assert C.NK_clear_new_sd_card_warning(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + + +@pytest.mark.skip +def test_fill_SD_card(C): + assert C.NK_fill_SD_card_with_random_data(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + + +def test_change_update_password(C): + wrong_password = 'aaaaaaaaaaa' + assert C.NK_change_update_password(wrong_password, DefaultPasswords.UPDATE_TEMP) == DeviceErrorCode.WRONG_PASSWORD + assert C.NK_change_update_password(DefaultPasswords.UPDATE, DefaultPasswords.UPDATE_TEMP) == DeviceErrorCode.STATUS_OK + assert C.NK_change_update_password(DefaultPasswords.UPDATE_TEMP, DefaultPasswords.UPDATE) == DeviceErrorCode.STATUS_OK + + +def test_send_startup(C): + time_seconds_from_epoch = 0 # FIXME set proper date + assert C.NK_send_startup(time_seconds_from_epoch) == DeviceErrorCode.STATUS_OK -- cgit v1.2.1 From fe36daa38ab1995c8c7fc6470d06b8595efd2385 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Thu, 3 Nov 2016 13:51:59 +0100 Subject: Tests: remake fill SD card test. Get progress bar value when busy. Signed-off-by: Szczepan Zalega --- unittest/constants.py | 1 + unittest/test_storage.py | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) (limited to 'unittest') diff --git a/unittest/constants.py b/unittest/constants.py index 258619e..78a219b 100644 --- a/unittest/constants.py +++ b/unittest/constants.py @@ -18,6 +18,7 @@ class DefaultPasswords(Enum): class DeviceErrorCode(Enum): STATUS_OK = 0 + BUSY = 1 # busy or busy progressbar in place of wrong_CRC status NOT_PROGRAMMED = 3 WRONG_PASSWORD = 4 STATUS_NOT_AUTHORIZED = 5 diff --git a/unittest/test_storage.py b/unittest/test_storage.py index b02b1eb..600faf2 100644 --- a/unittest/test_storage.py +++ b/unittest/test_storage.py @@ -83,7 +83,20 @@ def test_clear_new_sd_card_notification(C): @pytest.mark.skip def test_fill_SD_card(C): - assert C.NK_fill_SD_card_with_random_data(DefaultPasswords.ADMIN) == DeviceErrorCode.STATUS_OK + status = C.NK_fill_SD_card_with_random_data(DefaultPasswords.ADMIN) + assert status == DeviceErrorCode.STATUS_OK or status == DeviceErrorCode.BUSY + while 1: + value = C.NK_get_progress_bar_value() + if value == -1: break + assert 0 <= value <= 100 + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK + wait(5) + + +def test_get_busy_progress_on_idle(C): + value = C.NK_get_progress_bar_value() + assert value == -1 + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK def test_change_update_password(C): -- cgit v1.2.1 From 8d4bff3590191e369be02bbe0fbf858ab8930f52 Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Thu, 3 Nov 2016 18:21:40 +0100 Subject: Skip hanging tests Signed-off-by: Szczepan Zalega --- unittest/test_storage.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'unittest') diff --git a/unittest/test_storage.py b/unittest/test_storage.py index 600faf2..e7e0bda 100644 --- a/unittest/test_storage.py +++ b/unittest/test_storage.py @@ -49,7 +49,7 @@ def test_encrypted_volume_unlock_hidden(C): assert C.NK_create_hidden_volume(0, 20, 21, hidden_volume_password) == DeviceErrorCode.STATUS_OK assert C.NK_unlock_hidden_volume(hidden_volume_password) == DeviceErrorCode.STATUS_OK - +@pytest.mark.skip(reason='hangs device, to report') def test_encrypted_volume_setup_multiple_hidden(C): hidden_volume_password = 'hiddenpassword' p = lambda i: hidden_volume_password + str(i) -- cgit v1.2.1 From cdd16f3f184b2745094da39de3f815aea6633fdb Mon Sep 17 00:00:00 2001 From: Szczepan Zalega Date: Thu, 3 Nov 2016 18:22:02 +0100 Subject: Rename methods in API to make string return more obvious Signed-off-by: Szczepan Zalega --- unittest/test_storage.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'unittest') diff --git a/unittest/test_storage.py b/unittest/test_storage.py index e7e0bda..01276ce 100644 --- a/unittest/test_storage.py +++ b/unittest/test_storage.py @@ -22,15 +22,18 @@ def get_dict_from_dissect(status): def test_get_status_storage(C): - status_pointer = C.NK_get_status_storage() + status_pointer = C.NK_get_status_storage_as_string() + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK status_string = gs(status_pointer) + assert len(status_string) > 0 status_dict = get_dict_from_dissect(status_string) default_admin_password_retry_count = 3 assert int(status_dict['AdminPwRetryCount']) == default_admin_password_retry_count def test_sd_card_usage(C): - data_pointer = C.NK_get_SD_usage_data() + data_pointer = C.NK_get_SD_usage_data_as_string() + assert C.NK_get_last_command_status() == DeviceErrorCode.STATUS_OK data_string = gs(data_pointer) assert len(data_string) > 0 data_dict = get_dict_from_dissect(data_string) -- cgit v1.2.1