Fix credentialz tests and hiba cert path handling

feature/gnsi/credentialz/tests/hiba_authentication/hiba_authentication_test.go

@@ -16,6 +16,7 @@ package hibaauthentication_test
 
 import (
 	"context"
+	"flag"
 	"fmt"
 	"testing"
 	"time"
@@ -37,6 +38,7 @@ const (
 
 var (
 	hostCertificateCreatedOn = time.Now().Unix()
+	hibaCertsDir             = flag.String("hiba_certs_dir", ".", "directory containing pre-generated HIBA CA keys and certificates")
 )
 
 func TestMain(m *testing.M) {
@@ -48,7 +50,7 @@ func TestCredentialz(t *testing.T) {
 
 	dut := ondatra.DUT(t, "dut")
 	dir := t.TempDir()
-	credz.CreateHibaKeys(t, dut, dir)
+	credz.CreateHibaKeys(t, dut, *hibaCertsDir, dir)
 	credz.SetupUser(t, dut, username)
 
 	// Set only public key authentication for our test.

feature/gnsi/credentialz/tests/host_certificates/host_certificates_test.go

@@ -25,6 +25,7 @@ import (
 	"github.com/openconfig/featureprofiles/internal/fptest"
 	"github.com/openconfig/featureprofiles/internal/security/credz"
 	"github.com/openconfig/ondatra"
+	"github.com/openconfig/ondatra/binding"
 	"github.com/openconfig/ondatra/gnmi"
 	"golang.org/x/crypto/ssh"
 )
@@ -85,9 +86,19 @@ func TestCredentialz(t *testing.T) {
 
 		ctx, cancel := context.WithTimeout(t.Context(), 30*time.Second)
 		defer cancel()
-		client, err := credz.SSHWithPassword(ctx, dut, username, password)
-		if err != nil {
-			t.Fatalf("Failed dialing ssh with password: %s", err)
+		var client binding.SSHClient
+		for {
+			var err error
+			client, err = credz.SSHWithPassword(ctx, dut, username, password)
+			if err == nil {
+				t.Logf("Dialing ssh succeeded as expected.")
+				break
+			}
+			if ctx.Err() != nil {
+				t.Fatalf("Exceeded ssh retry timeout, dialing ssh failed, error: %s", err)
+			}
+			t.Logf("Dialing ssh failed, retrying ...")
+			time.Sleep(5 * time.Second)
 		}
 		defer client.Close()
 

internal/security/credz/credz.go

@@ -25,6 +25,7 @@ import (
 	"math/rand"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -243,24 +244,23 @@ func GenerateVersion() string {
 // arguments can leave the request nil (which previously risked a nil pointer
 // dereference / gRPC panic in sendAccountCredentialsRequest).
 func RotateUserPassword(t *testing.T, dut *ondatra.DUTDevice, username, password, version string, createdOn uint64) {
-	pw := &cpb.PasswordRequest_Password{}
+	account := &cpb.PasswordRequest_Account{
+		Account:   username,
+		Version:   version,
+		CreatedOn: createdOn,
+	}
 	if password != "" {
-		pw.Value = &cpb.PasswordRequest_Password_Plaintext{
-			Plaintext: password,
+		account.Password = &cpb.PasswordRequest_Password{
+			Value: &cpb.PasswordRequest_Password_Plaintext{
+				Plaintext: password,
+			},
 		}
 	}
 
 	request := &cpb.RotateAccountCredentialsRequest{
 		Request: &cpb.RotateAccountCredentialsRequest_Password{
 			Password: &cpb.PasswordRequest{
-				Accounts: []*cpb.PasswordRequest_Account{
-					{
-						Account:   username,
-						Password:  pw,
-						Version:   version,
-						CreatedOn: createdOn,
-					},
-				},
+				Accounts: []*cpb.PasswordRequest_Account{account},
 			},
 		},
 	}
@@ -616,7 +616,7 @@ func CreateHostCertificate(t *testing.T, dut *ondatra.DUTDevice, dir string, dut
 	}
 }
 
-func createHibaKeysCopy(t *testing.T, keysDir string) {
+func createHibaKeysCopy(t *testing.T, certsDir, keysDir string) {
 	keyFiles := []string{
 		"ca",
 		"ca.pub",
@@ -638,9 +638,10 @@ func createHibaKeysCopy(t *testing.T, keysDir string) {
 
 	for _, keyFile := range keyFiles {
 		var input []byte
-		input, err = os.ReadFile(keyFile)
+		srcPath := filepath.Join(certsDir, keyFile)
+		input, err = os.ReadFile(srcPath)
 		if err != nil {
-			t.Errorf("Error reading file %v, error: %s", keyFile, err)
+			t.Fatalf("Error reading file %v, error: %s", srcPath, err)
 			return
 		}
 		err = os.WriteFile(fmt.Sprintf("%s/%s", keysDir, keyFile), input, 0o600)
@@ -753,21 +754,15 @@ func createHibaKeysGen(t *testing.T, hibaCa, hibaGen, keysDir string) {
 
 // CreateHibaKeys creates/copies hiba granted keys/certificates in the specified directory.
 // If hiba tool is not installed on the testbed, ensure following files (generated after executing steps
-// from https://github.com/google/hiba/blob/main/CA.md) are present in the test directory :
-// feature/security/gnsi/credentialz/tests/hiba_authentication/ca,
-// feature/security/gnsi/credentialz/tests/hiba_authentication/ca.pub,
-// feature/security/gnsi/credentialz/tests/hiba_authentication/hosts/dut,
-// feature/security/gnsi/credentialz/tests/hiba_authentication/hosts/dut.pub,
-// feature/security/gnsi/credentialz/tests/hiba_authentication/hosts/dut-cert.pub,
-// feature/security/gnsi/credentialz/tests/hiba_authentication/users/testuser,
-// feature/security/gnsi/credentialz/tests/hiba_authentication/users/testuser.pub,
-// feature/security/gnsi/credentialz/tests/hiba_authentication/users/testuser-cert.pub,
-func CreateHibaKeys(t *testing.T, dut *ondatra.DUTDevice, keysDir string) {
+// from https://github.com/google/hiba/blob/main/CA.md) are present in certsDir :
+// ca, ca.pub, hosts/dut, hosts/dut.pub, hosts/dut-cert.pub,
+// users/testuser, users/testuser.pub, users/testuser-cert.pub
+func CreateHibaKeys(t *testing.T, dut *ondatra.DUTDevice, certsDir, keysDir string) {
 	hibaCa, _ := exec.LookPath("hiba-ca.sh")
 	hibaGen, _ := exec.LookPath("hiba-gen")
 	if hibaCa == "" || hibaGen == "" {
-		t.Log("hiba-ca and/or hiba-gen not found on path, will try to use certs in local test dir if present.")
-		createHibaKeysCopy(t, keysDir)
+		t.Logf("hiba-ca and/or hiba-gen not found on path, will try to use certs in %q if present.", certsDir)
+		createHibaKeysCopy(t, certsDir, keysDir)
 	} else {
 		createHibaKeysGen(t, hibaCa, hibaGen, keysDir)
 	}