mirror of
https://github.com/token2/fido2-manage.git
synced 2026-04-09 10:45:39 +00:00
Add files via upload
This commit is contained in:
Token2
GitHub
304
tools/test.sh
Normal file
304
tools/test.sh
Normal file
@@ -0,0 +1,304 @@
|
||||
#!/bin/sh -ex
|
||||
|
||||
# Copyright (c) 2021-2022 Yubico AB. All rights reserved.
|
||||
# Use of this source code is governed by a BSD-style
|
||||
# license that can be found in the LICENSE file.
|
||||
# SPDX-License-Identifier: BSD-2-Clause
|
||||
|
||||
# usage: ./test.sh "$(mktemp -d fido2test-XXXXXXXX)" device
|
||||
|
||||
# Please note that this test script:
|
||||
# - is incomplete;
|
||||
# - assumes CTAP 2.1-like hmac-secret;
|
||||
# - should pass as-is on a YubiKey with a PIN set;
|
||||
# - may otherwise require set +e above;
|
||||
# - can be executed with UV=1 to run additional UV tests;
|
||||
# - was last tested on 2022-01-11 with firmware 5.4.3.
|
||||
|
||||
cd "$1"
|
||||
DEV="$2"
|
||||
TYPE="es256"
|
||||
#TYPE="es384"
|
||||
#TYPE="eddsa"
|
||||
|
||||
make_cred() {
|
||||
sed /^$/d > cred_param << EOF
|
||||
$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
|
||||
$1
|
||||
some user name
|
||||
$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
|
||||
EOF
|
||||
fido2-cred -M $2 "${DEV}" "${TYPE}" > "$3" < cred_param
|
||||
}
|
||||
|
||||
verify_cred() {
|
||||
fido2-cred -V $1 "${TYPE}" > cred_out < "$2"
|
||||
head -1 cred_out > "$3"
|
||||
tail -n +2 cred_out > "$4"
|
||||
}
|
||||
|
||||
get_assert() {
|
||||
sed /^$/d > assert_param << EOF
|
||||
$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64)
|
||||
$1
|
||||
$(cat $3)
|
||||
$(cat $4)
|
||||
EOF
|
||||
fido2-assert -G $2 "${DEV}" > "$5" < assert_param
|
||||
}
|
||||
|
||||
verify_assert() {
|
||||
fido2-assert -V $1 "$2" "${TYPE}" < "$3"
|
||||
}
|
||||
|
||||
dd if=/dev/urandom bs=32 count=1 | base64 > hmac-salt
|
||||
|
||||
# u2f
|
||||
if [ "x${TYPE}" = "xes256" ]; then
|
||||
make_cred no.tld "-u" u2f
|
||||
! make_cred no.tld "-ru" /dev/null
|
||||
! make_cred no.tld "-uc1" /dev/null
|
||||
! make_cred no.tld "-uc2" /dev/null
|
||||
verify_cred "--" u2f u2f-cred u2f-pubkey
|
||||
! verify_cred "-h" u2f /dev/null /dev/null
|
||||
! verify_cred "-v" u2f /dev/null /dev/null
|
||||
verify_cred "-c0" u2f /dev/null /dev/null
|
||||
! verify_cred "-c1" u2f /dev/null /dev/null
|
||||
! verify_cred "-c2" u2f /dev/null /dev/null
|
||||
! verify_cred "-c3" u2f /dev/null /dev/null
|
||||
fi
|
||||
|
||||
# wrap (non-resident)
|
||||
make_cred no.tld "--" wrap
|
||||
verify_cred "--" wrap wrap-cred wrap-pubkey
|
||||
! verify_cred "-h" wrap /dev/null /dev/null
|
||||
! verify_cred "-v" wrap /dev/null /dev/null
|
||||
verify_cred "-c0" wrap /dev/null /dev/null
|
||||
! verify_cred "-c1" wrap /dev/null /dev/null
|
||||
! verify_cred "-c2" wrap /dev/null /dev/null
|
||||
! verify_cred "-c3" wrap /dev/null /dev/null
|
||||
|
||||
# wrap (non-resident) + hmac-secret
|
||||
make_cred no.tld "-h" wrap-hs
|
||||
! verify_cred "--" wrap-hs /dev/null /dev/null
|
||||
verify_cred "-h" wrap-hs wrap-hs-cred wrap-hs-pubkey
|
||||
! verify_cred "-v" wrap-hs /dev/null /dev/null
|
||||
verify_cred "-hc0" wrap-hs /dev/null /dev/null
|
||||
! verify_cred "-c0" wrap-hs /dev/null /dev/null
|
||||
! verify_cred "-c1" wrap-hs /dev/null /dev/null
|
||||
! verify_cred "-c2" wrap-hs /dev/null /dev/null
|
||||
! verify_cred "-c3" wrap-hs /dev/null /dev/null
|
||||
|
||||
# resident
|
||||
make_cred no.tld "-r" rk
|
||||
verify_cred "--" rk rk-cred rk-pubkey
|
||||
! verify_cred "-h" rk /dev/null /dev/null
|
||||
! verify_cred "-v" rk /dev/null /dev/null
|
||||
verify_cred "-c0" rk /dev/null /dev/null
|
||||
! verify_cred "-c1" rk /dev/null /dev/null
|
||||
! verify_cred "-c2" rk /dev/null /dev/null
|
||||
! verify_cred "-c3" rk /dev/null /dev/null
|
||||
|
||||
# resident + hmac-secret
|
||||
make_cred no.tld "-hr" rk-hs
|
||||
! verify_cred "--" rk-hs rk-hs-cred rk-hs-pubkey
|
||||
verify_cred "-h" rk-hs /dev/null /dev/null
|
||||
! verify_cred "-v" rk-hs /dev/null /dev/null
|
||||
verify_cred "-hc0" rk-hs /dev/null /dev/null
|
||||
! verify_cred "-c0" rk-hs /dev/null /dev/null
|
||||
! verify_cred "-c1" rk-hs /dev/null /dev/null
|
||||
! verify_cred "-c2" rk-hs /dev/null /dev/null
|
||||
! verify_cred "-c3" rk-hs /dev/null /dev/null
|
||||
|
||||
# u2f
|
||||
if [ "x${TYPE}" = "xes256" ]; then
|
||||
get_assert no.tld "-u" u2f-cred /dev/null u2f-assert
|
||||
! get_assert no.tld "-u -t up=false" u2f-cred /dev/null /dev/null
|
||||
verify_assert "--" u2f-pubkey u2f-assert
|
||||
verify_assert "-p" u2f-pubkey u2f-assert
|
||||
fi
|
||||
|
||||
# wrap (non-resident)
|
||||
get_assert no.tld "--" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "--" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t pin=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "--" wrap-pubkey wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t pin=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "--" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-p" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=true -t pin=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "--" wrap-pubkey wrap-assert
|
||||
verify_assert "-p" wrap-pubkey wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
verify_assert "-pv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=true -t pin=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "--" wrap-pubkey wrap-assert
|
||||
verify_assert "-p" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "--" wrap-pubkey wrap-assert
|
||||
! verify_assert "-p" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=false -t pin=true" wrap-cred /dev/null wrap-assert
|
||||
! verify_assert "-p" wrap-pubkey wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
! verify_assert "-pv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=false -t pin=false" wrap-cred /dev/null wrap-assert
|
||||
! verify_assert "-p" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h" wrap-cred hmac-salt wrap-assert
|
||||
! verify_assert "--" wrap-pubkey wrap-assert
|
||||
verify_assert "-h" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t pin=true" wrap-cred hmac-salt wrap-assert
|
||||
! verify_assert "--" wrap-pubkey wrap-assert
|
||||
verify_assert "-h" wrap-pubkey wrap-assert
|
||||
verify_assert "-hv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t pin=false" wrap-cred hmac-salt wrap-assert
|
||||
! verify_assert "--" wrap-pubkey wrap-assert
|
||||
verify_assert "-h" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t up=true" wrap-cred hmac-salt wrap-assert
|
||||
! verify_assert "--" wrap-pubkey wrap-assert
|
||||
verify_assert "-h" wrap-pubkey wrap-assert
|
||||
verify_assert "-hp" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t up=true -t pin=true" wrap-cred hmac-salt wrap-assert
|
||||
! verify_assert "--" wrap-pubkey wrap-assert
|
||||
verify_assert "-h" wrap-pubkey wrap-assert
|
||||
verify_assert "-hp" wrap-pubkey wrap-assert
|
||||
verify_assert "-hv" wrap-pubkey wrap-assert
|
||||
verify_assert "-hpv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t up=true -t pin=false" wrap-cred hmac-salt wrap-assert
|
||||
! verify_assert "--" wrap-pubkey wrap-assert
|
||||
verify_assert "-h" wrap-pubkey wrap-assert
|
||||
verify_assert "-hp" wrap-pubkey wrap-assert
|
||||
! get_assert no.tld "-h -t up=false" wrap-cred hmac-salt wrap-assert
|
||||
! get_assert no.tld "-h -t up=false -t pin=true" wrap-cred hmac-salt wrap-assert
|
||||
! get_assert no.tld "-h -t up=false -t pin=false" wrap-cred hmac-salt wrap-assert
|
||||
|
||||
if [ "x${UV}" != "x" ]; then
|
||||
get_assert no.tld "-t uv=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t uv=true -t pin=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t uv=true -t pin=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t uv=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "--" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t uv=false -t pin=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t uv=false -t pin=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "--" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=true -t uv=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-pv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=true -t uv=true -t pin=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-pv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=true -t uv=true -t pin=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-pv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=true -t uv=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-p" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=true -t uv=false -t pin=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-pv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=true -t uv=false -t pin=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-p" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=false -t uv=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=false -t uv=true -t pin=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=false -t uv=true -t pin=false" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=false -t uv=false" wrap-cred /dev/null wrap-assert
|
||||
! verify_assert "--" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=false -t uv=false -t pin=true" wrap-cred /dev/null wrap-assert
|
||||
verify_assert "-v" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-t up=false -t uv=false -t pin=false" wrap-cred /dev/null wrap-assert
|
||||
! verify_assert "--" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t uv=true" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t uv=true -t pin=true" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t uv=true -t pin=false" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t uv=false" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-h" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t uv=false -t pin=true" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t uv=false -t pin=false" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-h" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t up=true -t uv=true" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hpv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t up=true -t uv=true -t pin=true" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hpv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t up=true -t uv=true -t pin=false" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hpv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t up=true -t uv=false" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hp" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t up=true -t uv=false -t pin=true" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hpv" wrap-pubkey wrap-assert
|
||||
get_assert no.tld "-h -t up=true -t uv=false -t pin=false" wrap-cred hmac-salt wrap-assert
|
||||
verify_assert "-hp" wrap-pubkey wrap-assert
|
||||
! get_assert no.tld "-h -t up=false -t uv=true" wrap-cred hmac-salt wrap-assert
|
||||
! get_assert no.tld "-h -t up=false -t uv=true -t pin=true" wrap-cred hmac-salt wrap-assert
|
||||
! get_assert no.tld "-h -t up=false -t uv=true -t pin=false" wrap-cred hmac-salt wrap-assert
|
||||
! get_assert no.tld "-h -t up=false -t uv=false" wrap-cred hmac-salt wrap-assert
|
||||
! get_assert no.tld "-h -t up=false -t uv=false -t pin=true" wrap-cred hmac-salt wrap-assert
|
||||
! get_assert no.tld "-h -t up=false -t uv=false -t pin=false" wrap-cred hmac-salt wrap-assert
|
||||
fi
|
||||
|
||||
# resident
|
||||
get_assert no.tld "-r" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t pin=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t pin=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=true -t pin=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=true -t pin=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=false -t pin=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=false -t pin=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -h" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t pin=true" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t pin=false" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t up=true" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t up=true -t pin=true" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t up=true -t pin=false" /dev/null hmac-salt wrap-assert
|
||||
! get_assert no.tld "-r -h -t up=false" /dev/null hmac-salt wrap-assert
|
||||
! get_assert no.tld "-r -h -t up=false -t pin=true" /dev/null hmac-salt wrap-assert
|
||||
! get_assert no.tld "-r -h -t up=false -t pin=false" /dev/null hmac-salt wrap-assert
|
||||
|
||||
if [ "x${UV}" != "x" ]; then
|
||||
get_assert no.tld "-r -t uv=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t uv=true -t pin=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t uv=true -t pin=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t uv=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t uv=false -t pin=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t uv=false -t pin=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=true -t uv=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=true -t uv=true -t pin=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=true -t uv=true -t pin=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=true -t uv=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=true -t uv=false -t pin=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=true -t uv=false -t pin=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=false -t uv=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=false -t uv=true -t pin=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=false -t uv=true -t pin=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=false -t uv=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=false -t uv=false -t pin=true" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -t up=false -t uv=false -t pin=false" /dev/null /dev/null wrap-assert
|
||||
get_assert no.tld "-r -h -t uv=true" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t uv=true -t pin=true" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t uv=true -t pin=false" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t uv=false" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t uv=false -t pin=true" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t uv=false -t pin=false" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t up=true -t uv=true" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t up=true -t uv=true -t pin=true" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t up=true -t uv=true -t pin=false" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t up=true -t uv=false" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t up=true -t uv=false -t pin=true" /dev/null hmac-salt wrap-assert
|
||||
get_assert no.tld "-r -h -t up=true -t uv=false -t pin=false" /dev/null hmac-salt wrap-assert
|
||||
! get_assert no.tld "-r -h -t up=false -t uv=true" /dev/null hmac-salt wrap-assert
|
||||
! get_assert no.tld "-r -h -t up=false -t uv=true -t pin=true" /dev/null hmac-salt wrap-assert
|
||||
! get_assert no.tld "-r -h -t up=false -t uv=true -t pin=false" /dev/null hmac-salt wrap-assert
|
||||
! get_assert no.tld "-r -h -t up=false -t uv=false" /dev/null hmac-salt wrap-assert
|
||||
! get_assert no.tld "-r -h -t up=false -t uv=false -t pin=true" /dev/null hmac-salt wrap-assert
|
||||
! get_assert no.tld "-r -h -t up=false -t uv=false -t pin=false" /dev/null hmac-salt wrap-assert
|
||||
fi
|
||||
|
||||
exit 0
|
||||
Reference in New Issue
Block a user