blob: 60dcb276c9a0150f094ae23b6eb15f6b5996a9c3 [file] [log] [blame]
Rahul Maheshwari984791c2018-09-21 00:49:37 -05001*** Settings ***
2Documentation Certificate utilities keywords.
3
4Library OperatingSystem
5Resource rest_client.robot
Sandhya Somashekar839a0c22019-01-31 05:05:43 -06006Resource resource.robot
Rahul Maheshwari984791c2018-09-21 00:49:37 -05007
George Keishing2dc28642022-07-19 13:43:54 -05008*** Variables ***
9
10# Default wait sync time for certificate install and restart services.
11${wait_time} 30
ganesanb8d31f152023-04-27 14:01:55 +000012${keybit_length} 2048
Rahul Maheshwari984791c2018-09-21 00:49:37 -050013
14*** Keywords ***
15
16Install Certificate File On BMC
Rahul Maheshwari6a849ad2020-02-26 03:31:19 -060017 [Documentation] Install certificate file in BMC using POST operation.
18 [Arguments] ${uri} ${status}=ok &{kwargs}
Rahul Maheshwari984791c2018-09-21 00:49:37 -050019
20 # Description of argument(s):
Rahul Maheshwari6a849ad2020-02-26 03:31:19 -060021 # uri URI for installing certificate file via Redfish
22 # e.g. "/redfish/v1/AccountService/LDAP/Certificates".
23 # status Expected status of certificate installation via Redfish
Rahul Maheshwari984791c2018-09-21 00:49:37 -050024 # e.g. error, ok.
Rahul Maheshwari984791c2018-09-21 00:49:37 -050025 # kwargs A dictionary of keys/values to be passed directly to
Rahul Maheshwari6a849ad2020-02-26 03:31:19 -060026 # POST Request.
Rahul Maheshwari984791c2018-09-21 00:49:37 -050027
Rahul Maheshwari6a849ad2020-02-26 03:31:19 -060028 Initialize OpenBMC
Rahul Maheshwari984791c2018-09-21 00:49:37 -050029
30 ${headers}= Create Dictionary Content-Type=application/octet-stream
Sridevi Ramesheadeef02019-01-17 08:56:18 -060031 ... X-Auth-Token=${XAUTH_TOKEN}
Rahul Maheshwari984791c2018-09-21 00:49:37 -050032 Set To Dictionary ${kwargs} headers ${headers}
33
George Keishingfbd67002022-08-01 11:24:03 -050034 ${resp}= POST On Session openbmc ${uri} &{kwargs} expected_status=any
35 ${cert_id}= Set Variable If '${resp.status_code}' == '${HTTP_OK}' ${resp.json()["Id"]} -1
Rahul Maheshwari984791c2018-09-21 00:49:37 -050036
37 Run Keyword If '${status}' == 'ok'
George Keishingfbd67002022-08-01 11:24:03 -050038 ... Should Be Equal As Strings ${resp.status_code} ${HTTP_OK}
Rahul Maheshwari984791c2018-09-21 00:49:37 -050039 ... ELSE IF '${status}' == 'error'
George Keishingfbd67002022-08-01 11:24:03 -050040 ... Should Be Equal As Strings ${resp.status_code} ${HTTP_INTERNAL_SERVER_ERROR}
Rahul Maheshwari984791c2018-09-21 00:49:37 -050041
42 Delete All Sessions
43
Rahul Maheshwari6a849ad2020-02-26 03:31:19 -060044 [Return] ${cert_id}
45
Rahul Maheshwari984791c2018-09-21 00:49:37 -050046
47Get Certificate Content From BMC Via Openssl
48 [Documentation] Get certificate content from BMC via openssl.
49
50 Check If Openssl Tool Exist
51
52 ${openssl_cmd}= Catenate
Anusha Dathatrid334bdf2020-06-10 04:19:07 -050053 ... timeout 10 openssl s_client -connect ${OPENBMC_HOST}:${HTTPS_PORT} -showcerts
Rahul Maheshwari2a848cf2019-05-31 09:46:22 -050054 ${output}= Run ${openssl_cmd}
Rahul Maheshwari984791c2018-09-21 00:49:37 -050055
56 ${result}= Fetch From Left
57 ... ${output} -----END CERTIFICATE-----
58 ${result}= Fetch From Right ${result} -----BEGIN CERTIFICATE-----
59 [Return] ${result}
60
61
Rahul Maheshwari081eadb2018-10-26 03:11:10 -050062Get Certificate File Content From BMC
63 [Documentation] Get required certificate file content from BMC.
64 [Arguments] ${cert_type}=Client
Rahul Maheshwari984791c2018-09-21 00:49:37 -050065
Rahul Maheshwari081eadb2018-10-26 03:11:10 -050066 # Description of argument(s):
67 # cert_type Certificate type (e.g. "Client" or "CA").
68
69 ${certificate} ${stderr} ${rc}= Run Keyword If '${cert_type}' == 'Client'
70 ... BMC Execute Command cat /etc/nslcd/certs/cert.pem
Rahul Maheshwari984791c2018-09-21 00:49:37 -050071
72 [Return] ${certificate}
73
74
75Generate Certificate File Via Openssl
76 [Documentation] Create certificate file via openssl with required content
77 ... and returns its path.
Rahul Maheshwari665bc612018-10-24 04:57:53 -050078 [Arguments] ${cert_format} ${time}=365 ${cert_dir_name}=certificate_dir
Rahul Maheshwari984791c2018-09-21 00:49:37 -050079
80 # Description of argument(s):
81 # cert_format Certificate file format
82 # e.g. Valid_Certificate_Empty_Privatekey.
83 # time Number of days to certify the certificate for.
Rahul Maheshwari665bc612018-10-24 04:57:53 -050084 # cert_dir_name The name of the sub-directory where the certificate
85 # is stored.
Rahul Maheshwari984791c2018-09-21 00:49:37 -050086
87 Check If Openssl Tool Exist
88
ganesanb8d31f152023-04-27 14:01:55 +000089 ${openssl_cmd}= Catenate openssl req -x509 -sha256 -newkey rsa:${keybit_length}
Rahul Maheshwari984791c2018-09-21 00:49:37 -050090 ... ${SPACE}-nodes -days ${time}
Rahul Maheshwari665bc612018-10-24 04:57:53 -050091 ... ${SPACE}-keyout ${cert_dir_name}/cert.pem -out ${cert_dir_name}/cert.pem
Rahul Maheshwari984791c2018-09-21 00:49:37 -050092 ... ${SPACE}-subj "/O=XYZ Corporation /CN=www.xyz.com"
93
94 ${rc} ${output}= Run And Return RC and Output ${openssl_cmd}
95 Should Be Equal ${rc} ${0} msg=${output}
Rahul Maheshwari665bc612018-10-24 04:57:53 -050096 OperatingSystem.File Should Exist
97 ... ${EXECDIR}${/}${cert_dir_name}${/}cert.pem
Rahul Maheshwari984791c2018-09-21 00:49:37 -050098
Rahul Maheshwari665bc612018-10-24 04:57:53 -050099 ${file_content}= OperatingSystem.Get File
100 ... ${EXECDIR}${/}${cert_dir_name}${/}cert.pem
Rahul Maheshwari984791c2018-09-21 00:49:37 -0500101 ${result}= Fetch From Left ${file_content} -----END CERTIFICATE-----
102 ${cert_content}= Fetch From Right ${result} -----BEGIN CERTIFICATE-----
103
104 ${result}= Fetch From Left ${file_content} -----END PRIVATE KEY-----
105 ${private_key_content}= Fetch From Right ${result} -----BEGIN PRIVATE KEY-----
106
107 ${cert_data}=
108 ... Run Keyword if '${cert_format}' == 'Valid Certificate Valid Privatekey'
Rahul Maheshwari665bc612018-10-24 04:57:53 -0500109 ... OperatingSystem.Get File ${EXECDIR}${/}${cert_dir_name}${/}cert.pem
Rahul Maheshwari984791c2018-09-21 00:49:37 -0500110 ... ELSE IF '${cert_format}' == 'Empty Certificate Valid Privatekey'
111 ... Remove String ${file_content} ${cert_content}
112 ... ELSE IF '${cert_format}' == 'Valid Certificate Empty Privatekey'
113 ... Remove String ${file_content} ${private_key_content}
114 ... ELSE IF '${cert_format}' == 'Empty Certificate Empty Privatekey'
115 ... Remove String ${file_content} ${cert_content} ${private_key_content}
Anusha Dathatribc855642020-06-17 05:21:14 -0500116 ... ELSE IF '${cert_format}' == 'Expired Certificate' or '${cert_format}' == 'Not Yet Valid Certificate'
Rahul Maheshwari665bc612018-10-24 04:57:53 -0500117 ... OperatingSystem.Get File ${EXECDIR}${/}${cert_dir_name}${/}cert.pem
Rahul Maheshwari081eadb2018-10-26 03:11:10 -0500118 ... ELSE IF '${cert_format}' == 'Valid Certificate'
119 ... Remove String ${file_content} ${private_key_content}
120 ... -----BEGIN PRIVATE KEY----- -----END PRIVATE KEY-----
121 ... ELSE IF '${cert_format}' == 'Empty Certificate'
122 ... Remove String ${file_content} ${cert_content}
123 ... ${private_key_content} -----BEGIN PRIVATE KEY-----
124 ... -----END PRIVATE KEY-----
Rahul Maheshwari984791c2018-09-21 00:49:37 -0500125
126 ${random_name}= Generate Random String 8
127 ${cert_name}= Catenate SEPARATOR= ${random_name} .pem
Rahul Maheshwari665bc612018-10-24 04:57:53 -0500128 Create File ${cert_dir_name}/${cert_name} ${cert_data}
Rahul Maheshwari984791c2018-09-21 00:49:37 -0500129
Rahul Maheshwari665bc612018-10-24 04:57:53 -0500130 [Return] ${EXECDIR}${/}${cert_dir_name}${/}${cert_name}
Rahul Maheshwari984791c2018-09-21 00:49:37 -0500131
132
133Get Certificate Content From File
134 [Documentation] Get certificate content from certificate file.
135 [Arguments] ${cert_file_path}
136
137 # Description of argument(s):
138 # cert_file_path Downloaded certificate file path.
139
140 ${file_content}= OperatingSystem.Get File ${cert_file_path}
141 ${result}= Fetch From Left ${file_content} -----END CERTIFICATE-----
142 ${result}= Fetch From Right ${result} -----BEGIN CERTIFICATE-----
143 [Return] ${result}
144
145
146Check If Openssl Tool Exist
147 [Documentation] Check if openssl tool installed or not.
148
149 ${rc} ${output}= Run And Return RC and Output which openssl
150 Should Not Be Empty ${output} msg=Openssl tool not installed.
151
Rahul Maheshwaria6ae3c32019-09-05 08:52:01 -0500152
153Verify Certificate Visible Via OpenSSL
154 [Documentation] Checks if given certificate is visible via openssl's showcert command.
155 [Arguments] ${cert_file_path}
156
157 # Description of argument(s):
158 # cert_file_path Certificate file path.
159
160 ${cert_file_content}= OperatingSystem.Get File ${cert_file_path}
161 ${openssl_cert_content}= Get Certificate Content From BMC Via Openssl
162 Should Contain ${cert_file_content} ${openssl_cert_content}
163
manashsarmab9feda72020-10-05 10:40:12 -0500164
165Delete All CA Certificate Via Redfish
166 [Documentation] Delete all CA certificate via Redfish.
ganesanb4d430282023-04-27 14:33:23 +0000167 ${cert_list}= Redfish_Utils.Get Member List /redfish/v1/Managers/${MANAGER_ID}/Truststore/Certificates
manashsarmab9feda72020-10-05 10:40:12 -0500168 FOR ${cert} IN @{cert_list}
169 Redfish.Delete ${cert} valid_status_codes=[${HTTP_NO_CONTENT}]
George Keishing31888932022-07-19 23:05:50 -0500170 Log To Console Wait Time started in seconds ${wait_time}
171 Sleep ${wait_time}s
manashsarmab9feda72020-10-05 10:40:12 -0500172 END
manashsarmae07858a2020-10-16 06:09:46 -0500173
174
175Delete Certificate Via BMC CLI
176 [Documentation] Delete certificate via BMC CLI.
177 [Arguments] ${cert_type}
178
179 # Description of argument(s):
180 # cert_type Certificate type (e.g. "Client" or "CA").
181
182 ${certificate_file_path} ${certificate_service} ${certificate_uri}=
183 ... Run Keyword If '${cert_type}' == 'Client'
184 ... Set Variable /etc/nslcd/certs/cert.pem phosphor-certificate-manager@nslcd.service
185 ... ${REDFISH_LDAP_CERTIFICATE_URI}
186 ... ELSE IF '${cert_type}' == 'CA'
187 ... Set Variable ${ROOT_CA_FILE_PATH} phosphor-certificate-manager@authority.service
188 ... ${REDFISH_CA_CERTIFICATE_URI}
189
190 ${file_status} ${stderr} ${rc}= BMC Execute Command
191 ... [ -f ${certificate_file_path} ] && echo "Found" || echo "Not Found"
192
193 Return From Keyword If "${file_status}" != "Found"
194 BMC Execute Command rm ${certificate_file_path}
195 BMC Execute Command systemctl restart ${certificate_service}
196 BMC Execute Command systemctl daemon-reload
197 Wait Until Keyword Succeeds 1 min 10 sec Redfish.Get ${certificate_uri}/1
198 ... valid_status_codes=[${HTTP_NOT_FOUND}, ${HTTP_INTERNAL_SERVER_ERROR}]
Ashwini Chandrappa6b20ffa2021-08-04 03:18:37 -0500199
200
201Replace Certificate Via Redfish
202 [Documentation] Test 'replace certificate' operation in the BMC via Redfish.
203 [Arguments] ${cert_type} ${cert_format} ${expected_status}
204
205 # Description of argument(s):
206 # cert_type Certificate type (e.g. "Server" or "Client").
207 # cert_format Certificate file format
208 # (e.g. Valid_Certificate_Valid_Privatekey).
209 # expected_status Expected status of certificate replace Redfish
210 # request (i.e. "ok" or "error").
211
212 # Install certificate before replacing client or CA certificate.
213 ${cert_id}= Run Keyword If '${cert_type}' == 'Client'
214 ... Install And Verify Certificate Via Redfish ${cert_type} Valid Certificate Valid Privatekey ok
215 ... ELSE IF '${cert_type}' == 'CA'
216 ... Install And Verify Certificate Via Redfish ${cert_type} Valid Certificate ok
217
218 ${cert_file_path}= Generate Certificate File Via Openssl ${cert_format}
219
220 ${bytes}= OperatingSystem.Get Binary File ${cert_file_path}
221 ${file_data}= Decode Bytes To String ${bytes} UTF-8
222
223 Run Keyword If '${cert_format}' == 'Expired Certificate'
224 ... Modify BMC Date future
225 ... ELSE IF '${cert_format}' == 'Not Yet Valid Certificate'
226 ... Modify BMC Date old
227
228
229 ${certificate_uri}= Set Variable If
230 ... '${cert_type}' == 'Server' ${REDFISH_HTTPS_CERTIFICATE_URI}/1
231 ... '${cert_type}' == 'Client' ${REDFISH_LDAP_CERTIFICATE_URI}/1
232 ... '${cert_type}' == 'CA' ${REDFISH_CA_CERTIFICATE_URI}/${cert_id}
233
234 ${certificate_dict}= Create Dictionary @odata.id=${certificate_uri}
235 ${payload}= Create Dictionary CertificateString=${file_data}
236 ... CertificateType=PEM CertificateUri=${certificate_dict}
237
238 ${expected_resp}= Set Variable If '${expected_status}' == 'ok' ${HTTP_OK}
239 ... '${expected_status}' == 'error' ${HTTP_NOT_FOUND}, ${HTTP_INTERNAL_SERVER_ERROR}
240 ${resp}= redfish.Post /redfish/v1/CertificateService/Actions/CertificateService.ReplaceCertificate
241 ... body=${payload} valid_status_codes=[${expected_resp}]
242
243 ${cert_file_content}= OperatingSystem.Get File ${cert_file_path}
244 ${bmc_cert_content}= redfish_utils.Get Attribute ${certificate_uri} CertificateString
245
246 Run Keyword If '${expected_status}' == 'ok'
247 ... Should Contain ${cert_file_content} ${bmc_cert_content}
248 ... ELSE
249 ... Should Not Contain ${cert_file_content} ${bmc_cert_content}
Rahul Maheshwarif689bb62022-04-22 05:00:32 -0500250
251
252Install And Verify Certificate Via Redfish
253 [Documentation] Install and verify certificate using Redfish.
254 [Arguments] ${cert_type} ${cert_format} ${expected_status} ${delete_cert}=${True}
255
256 # Description of argument(s):
257 # cert_type Certificate type (e.g. "Client" or "CA").
258 # cert_format Certificate file format
259 # (e.g. "Valid_Certificate_Valid_Privatekey").
260 # expected_status Expected status of certificate replace Redfish
261 # request (i.e. "ok" or "error").
262 # delete_cert Certificate will be deleted before installing if this True.
263
264 Run Keyword If '${cert_type}' == 'CA' and '${delete_cert}' == '${True}'
265 ... Delete All CA Certificate Via Redfish
266 ... ELSE IF '${cert_type}' == 'Client' and '${delete_cert}' == '${True}'
267 ... Delete Certificate Via BMC CLI ${cert_type}
268
269 ${cert_file_path}= Generate Certificate File Via Openssl ${cert_format}
270 ${bytes}= OperatingSystem.Get Binary File ${cert_file_path}
271 ${file_data}= Decode Bytes To String ${bytes} UTF-8
272
273 ${certificate_uri}= Set Variable If
274 ... '${cert_type}' == 'Client' ${REDFISH_LDAP_CERTIFICATE_URI}
275 ... '${cert_type}' == 'CA' ${REDFISH_CA_CERTIFICATE_URI}
276
277 Run Keyword If '${cert_format}' == 'Expired Certificate' Modify BMC Date future
278 ... ELSE IF '${cert_format}' == 'Not Yet Valid Certificate' Modify BMC Date old
279
280 ${cert_id}= Install Certificate File On BMC ${certificate_uri} ${expected_status} data=${file_data}
281 Logging Installed certificate id: ${cert_id}
282
283 # Adding delay after certificate installation.
George Keishing2dc28642022-07-19 13:43:54 -0500284 # Lesser wait timing causes bmcweb to restart quickly and breaks the web services.
285 Log To Console Wait Time started in seconds ${wait_time}
286 Sleep ${wait_time}s
Rahul Maheshwarif689bb62022-04-22 05:00:32 -0500287
288 ${cert_file_content}= OperatingSystem.Get File ${cert_file_path}
289 ${bmc_cert_content}= Run Keyword If '${expected_status}' == 'ok' redfish_utils.Get Attribute
290 ... ${certificate_uri}/${cert_id} CertificateString
291
292 Run Keyword If '${expected_status}' == 'ok' Should Contain ${cert_file_content} ${bmc_cert_content}
293 [Return] ${cert_id}
Rahul Maheshwaria4f334f2022-05-13 04:59:42 -0500294
295
296Modify BMC Date
297 [Documentation] Modify date in BMC.
298 [Arguments] ${date_set_type}=current
299
300 # Description of argument(s):
301 # date_set_type Set BMC date to a current, future, old date by 375 days.
302 # current - Sets date to local system date.
303 # future - Sets to a future date from current date.
304 # old - Sets to a old date from current date.
305
306 Redfish Power Off stack_mode=skip
307 ${current_date_time}= Get Current Date
308 ${new_time}= Run Keyword If '${date_set_type}' == 'current' Set Variable ${current_date_time}
309 ... ELSE IF '${date_set_type}' == 'future'
310 ... Add Time To Date ${current_date_time} 375 days
311 ... ELSE IF '${date_set_type}' == 'old'
312 ... Subtract Time From Date ${current_date_time} 375 days
313
314 # Enable manual mode.
315 Redfish.Patch ${REDFISH_NW_PROTOCOL_URI}
316 ... body={'NTP':{'ProtocolEnabled': ${False}}}
317 ... valid_status_codes=[${HTTP_OK}, ${HTTP_NO_CONTENT}]
George Keishingda8c7682022-07-07 15:39:19 -0500318
319 # NTP network takes few seconds to restart.
320 Wait Until Keyword Succeeds 30 sec 10 sec
ganesanb4d430282023-04-27 14:33:23 +0000321 ... Redfish.Patch ${REDFISH_BASE_URI}Managers/${MANAGER_ID} body={'DateTime': '${new_time}'}
Rahul Maheshwaria4f334f2022-05-13 04:59:42 -0500322 ... valid_status_codes=[${HTTP_OK}]