utimaco_pkcs11_loader 5.23.0

//! These tests require a connection to a working HSM and are gated behind the `utimaco` feature.
//! To run a test, cd into the crate directory and run:
//! ```bash
//! HSM_USER_PASSWORD=12345678 cargo test --target x86_64-unknown-linux-gnu --features utimaco -- tests::test_hsm_utimaco_all
//! ```

use std::collections::HashMap;

use cosmian_kms_base_hsm::{
    HResult, RsaOaepDigest,
    test_helpers::{get_hsm_password, get_hsm_slot_id},
    tests_shared as shared,
};

use crate::{UTIMACO_PKCS11_LIB, UtimacoCapabilityProvider};

const SLOT_ID: usize = 0x00; // Utimaco default slot

fn cfg() -> HResult<shared::HsmTestConfig> {
    let user_password = get_hsm_password()?;
    let slot = get_hsm_slot_id().unwrap_or(SLOT_ID);
    Ok(shared::HsmTestConfig {
        lib_path: shared::lib_path("UTIMACO_PKCS11_LIB", UTIMACO_PKCS11_LIB),
        slot_ids_and_passwords: HashMap::from([(slot, Some(user_password))]),
        slot_id_for_tests: slot,
        rsa_oaep_digest: Some(RsaOaepDigest::SHA256),
        threads: 4,
        supports_rsa_wrap: true,
    })
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_all() -> HResult<()> {
    // Use a single BaseHsm for the entire test to prevent repeated C_Initialize/C_Finalize
    // cycles. Some PKCS#11 native libraries are not safely re-initializable within the same
    // process: repeated load/unload cycles can corrupt internal C state and cause a SIGSEGV.
    let cfg = cfg()?;
    let hsm = shared::instantiate::<UtimacoCapabilityProvider>(&cfg)?;
    drop(hsm.hsm_lib().get_info_struct()?);
    let slot = shared::get_slot::<UtimacoCapabilityProvider>(&hsm, &cfg)?;
    shared::get_mechanisms_and_hashes(&slot)?;
    drop(hsm.get_algorithms(cfg.slot_id_for_tests)?);
    shared::destroy_all(&slot)?;
    shared::generate_aes_key(&slot)?;
    shared::generate_rsa_keypair(&slot)?;
    shared::rsa_key_wrap(&slot, RsaOaepDigest::SHA256)?;
    shared::rsa_pkcs_encrypt(&slot)?;
    shared::rsa_oaep_encrypt(&slot, RsaOaepDigest::SHA256)?;
    shared::aes_gcm_encrypt(&slot)?;
    shared::rsa_pkcs_v15_sign(&slot)?;
    shared::rsa_sha256_sign(&slot)?;
    shared::rsa_sign_all_algorithms(&slot)?;
    shared::multi_threaded_rsa(&slot, RsaOaepDigest::SHA256, cfg.threads)?;
    shared::get_key_metadata(&slot)?;
    shared::list_objects(&slot)?;
    shared::search_incompatible_key(&hsm, &cfg)?;
    shared::destroy_all(&slot)?;
    Ok(())
}

// Note: low-level init test removed to avoid unsafe code and pedantic clippy violations.

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_get_info() -> HResult<()> {
    shared::get_info::<UtimacoCapabilityProvider>(&cfg()?)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_get_mechanisms() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::get_mechanisms_and_hashes(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_get_supported_algorithms() -> HResult<()> {
    shared::get_supported_algorithms::<UtimacoCapabilityProvider>(&cfg()?)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_generate_aes_key() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::generate_aes_key(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_generate_rsa_keypair() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::generate_rsa_keypair(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_rsa_key_wrap() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::rsa_key_wrap(&slot, RsaOaepDigest::SHA256)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_rsa_pkcs_encrypt() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::rsa_pkcs_encrypt(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_rsa_oaep_encrypt() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::rsa_oaep_encrypt(&slot, RsaOaepDigest::SHA256)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_aes_gcm_encrypt() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::aes_gcm_encrypt(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_rsa_pkcs_v15_sign() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::rsa_pkcs_v15_sign(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_rsa_sha256_sign() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::rsa_sha256_sign(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_rsa_sign_all_algorithms() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::rsa_sign_all_algorithms(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_multi_threaded_rsa_encrypt_decrypt_test() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::multi_threaded_rsa(&slot, RsaOaepDigest::SHA256, 4)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_list_objects() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::list_objects(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_get_key_metadata() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::get_key_metadata(&slot)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_search_incompatible_key() -> HResult<()> {
    let config = &cfg()?;
    let hsm = shared::instantiate::<UtimacoCapabilityProvider>(config)?;
    shared::search_incompatible_key(&hsm, &cfg()?)
}

#[test]
#[ignore = "Requires Linux, Utimaco PKCS#11 library, and HSM environment"]
fn test_hsm_utimaco_destroy_all() -> HResult<()> {
    let slot = shared::instantiate_and_get_slot::<UtimacoCapabilityProvider>(&cfg()?)?;
    shared::destroy_all(&slot)
}