mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-30 14:07:59 +00:00
Code Issues Releases Wiki Activity

Fix "pkcs11" system test

Browse Source 
- Define the SLOT environment variable before starting the test.  This
    variable defaults to 0 and that does not work with SoftHSM 2.

  - The system test expects the PIN environment variable to be set to
    "1234" while bin/tests/prepare-softhsm2.sh sets it to "0000".
    Update bin/tests/prepare-softhsm2.sh so that it sets the PIN to
    "1234".

  - Move contents of bin/tests/system/pkcs11/prereq.sh to
    bin/tests/system/pkcs11/setup.sh as the former was creating a file
    called "supported" that was getting removed by the latter before
    bin/tests/system/pkcs11/tests.sh could access it.

  - Fix typo in "have_ecx".
This commit is contained in:
Michal Nowak
2020-03-04 16:06:31 +00:00
parent 7509e22725
commit 85cb3a214f
7 changed files with 83 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.gitlab-ci.yml
View File

@@ -259,7 +259,8 @@ stages:
fi fi
.setup_softhsm: &setup_softhsm | .setup_softhsm: &setup_softhsm |
sh -x bin/tests/prepare-softhsm2.sh export SLOT=$(sh -x bin/tests/prepare-softhsm2.sh)
test -n "${SLOT}" && test "${SLOT}" -gt 0
.system_test: &system_test_job .system_test: &system_test_job
<<: *default_triggering_rules <<: *default_triggering_rules

2
bin/tests/prepare-softhsm2.sh
View File

@@ -15,6 +15,6 @@ if [ -n "${SOFTHSM2_CONF}" ] && command -v softhsm2-util >/dev/null; then
echo "directories.tokendir = ${SOFTHSM2_DIR}/tokens" > "${SOFTHSM2_CONF}" echo "directories.tokendir = ${SOFTHSM2_DIR}/tokens" > "${SOFTHSM2_CONF}"
echo "objectstore.backend = file" >> "${SOFTHSM2_CONF}" echo "objectstore.backend = file" >> "${SOFTHSM2_CONF}"
echo "log.level = DEBUG" >> "${SOFTHSM2_CONF}" echo "log.level = DEBUG" >> "${SOFTHSM2_CONF}"
softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm2"; softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }'
fi fi
exit 0 exit 0

3
bin/tests/system/pkcs11/clean.sh
View File

@@ -9,9 +9,12 @@
# See the COPYRIGHT file distributed with this work for additional # See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership. # information regarding copyright ownership.
set -e
rm -f K* ns1/K* keyset-* dsset-* ns1/*.db ns1/*.signed ns1/*.jnl rm -f K* ns1/K* keyset-* dsset-* ns1/*.db ns1/*.signed ns1/*.jnl
rm -f dig.out* pin upd.log* rm -f dig.out* pin upd.log*
rm -f ns1/*.key ns1/named.memstats rm -f ns1/*.key ns1/named.memstats
rm -f supported rm -f supported
rm -f ns*/named.run
rm -f ns*/named.lock rm -f ns*/named.lock
rm -f ns*/managed-keys.bind* rm -f ns*/managed-keys.bind*

26
bin/tests/system/pkcs11/prereq.sh
View File

@@ -1,26 +0,0 @@
#!/bin/sh
#
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
echo "I:(Native PKCS#11)" >&2
ecxfail=0
$SHELL ../testcrypto.sh -q eddsa || ecxfail=1
rm -f supported
touch supported
echo rsa >> supported
echo ecc >> supported
if [ $ecxfail = 0 ]; then
echo ecx >> supported
fi

74
bin/tests/system/pkcs11/setup.sh
View File

@@ -9,33 +9,49 @@
# See the COPYRIGHT file distributed with this work for additional # See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership. # information regarding copyright ownership.
set -e
SYSTEMTESTTOP=.. SYSTEMTESTTOP=..
# shellcheck source=conf.sh
. $SYSTEMTESTTOP/conf.sh . $SYSTEMTESTTOP/conf.sh
echo "I:(Native PKCS#11)" >&2
ecxfail=0
$SHELL ../testcrypto.sh -q eddsa || ecxfail=1
rm -f supported
touch supported
echo rsa >> supported
echo ecc >> supported
if [ $ecxfail = 0 ]; then
echo ecx >> supported
fi
infile=ns1/example.db.in infile=ns1/example.db.in
/bin/echo -n ${HSMPIN:-1234}> pin printf '%s' "${HSMPIN:-1234}" > pin
PWD=`pwd` PWD=$(pwd)
zone=rsa.example zone=rsa.example
zonefile=ns1/rsa.example.db zonefile=ns1/rsa.example.db
have_rsa=`grep rsa supported` have_rsa=$(grep rsa supported || true)
if [ "x$have_rsa" != "x" ]; then if [ "x$have_rsa" != "x" ]; then
$PK11GEN -a RSA -b 1024 -l robie-rsa-zsk1 -i 01 $PK11GEN -a RSA -b 1024 -l robie-rsa-zsk1 -i 01
$PK11GEN -a RSA -b 1024 -l robie-rsa-zsk2 -i 02 $PK11GEN -a RSA -b 1024 -l robie-rsa-zsk2 -i 02
$PK11GEN -a RSA -b 2048 -l robie-rsa-ksk $PK11GEN -a RSA -b 2048 -l robie-rsa-ksk
rsazsk1=`$KEYFRLAB -a RSASHA1 \ rsazsk1=$($KEYFRLAB -a RSASHA1 \
-l "object=robie-rsa-zsk1;pin-source=$PWD/pin" rsa.example` -l "object=robie-rsa-zsk1;pin-source=$PWD/pin" rsa.example)
rsazsk2=`$KEYFRLAB -a RSASHA1 \ rsazsk2=$($KEYFRLAB -a RSASHA1 \
-l "object=robie-rsa-zsk2;pin-source=$PWD/pin" rsa.example` -l "object=robie-rsa-zsk2;pin-source=$PWD/pin" rsa.example)
rsaksk=`$KEYFRLAB -a RSASHA1 -f ksk \ rsaksk=$($KEYFRLAB -a RSASHA1 -f ksk \
-l "object=robie-rsa-ksk;pin-source=$PWD/pin" rsa.example` -l "object=robie-rsa-ksk;pin-source=$PWD/pin" rsa.example)
cat $infile $rsazsk1.key $rsaksk.key > $zonefile cat $infile "$rsazsk1".key "$rsaksk".key > $zonefile
$SIGNER -a -P -g -o $zone $zonefile \ $SIGNER -a -P -g -o $zone $zonefile \
> /dev/null 2> signer.err || cat signer.err > /dev/null 2> signer.err || cat signer.err
cp $rsazsk2.key ns1/rsa.key cp "$rsazsk2".key ns1/rsa.key
mv Krsa* ns1 mv Krsa* ns1
else else
# RSA not available and will not be tested; make a placeholder # RSA not available and will not be tested; make a placeholder
@@ -44,23 +60,23 @@ fi
zone=ecc.example zone=ecc.example
zonefile=ns1/ecc.example.db zonefile=ns1/ecc.example.db
have_ecc=`grep ecc supported` have_ecc=$(grep ecc supported || true)
if [ "x$have_ecc" != "x" ]; then if [ "x$have_ecc" != "x" ]; then
$PK11GEN -a ECC -b 256 -l robie-ecc-zsk1 -i 03 $PK11GEN -a ECC -b 256 -l robie-ecc-zsk1 -i 03
$PK11GEN -a ECC -b 256 -l robie-ecc-zsk2 -i 04 $PK11GEN -a ECC -b 256 -l robie-ecc-zsk2 -i 04
$PK11GEN -a ECC -b 384 -l robie-ecc-ksk $PK11GEN -a ECC -b 384 -l robie-ecc-ksk
ecczsk1=`$KEYFRLAB -a ECDSAP256SHA256 \ ecczsk1=$($KEYFRLAB -a ECDSAP256SHA256 \
-l "object=robie-ecc-zsk1;pin-source=$PWD/pin" ecc.example` -l "object=robie-ecc-zsk1;pin-source=$PWD/pin" ecc.example)
ecczsk2=`$KEYFRLAB -a ECDSAP256SHA256 \ ecczsk2=$($KEYFRLAB -a ECDSAP256SHA256 \
-l "object=robie-ecc-zsk2;pin-source=$PWD/pin" ecc.example` -l "object=robie-ecc-zsk2;pin-source=$PWD/pin" ecc.example)
eccksk=`$KEYFRLAB -a ECDSAP384SHA384 -f ksk \ eccksk=$($KEYFRLAB -a ECDSAP384SHA384 -f ksk \
-l "object=robie-ecc-ksk;pin-source=$PWD/pin" ecc.example` -l "object=robie-ecc-ksk;pin-source=$PWD/pin" ecc.example)
cat $infile $ecczsk1.key $eccksk.key > $zonefile cat $infile "$ecczsk1".key "$eccksk".key > $zonefile
$SIGNER -a -P -g -o $zone $zonefile \ $SIGNER -a -P -g -o $zone $zonefile \
> /dev/null 2> signer.err || cat signer.err > /dev/null 2> signer.err || cat signer.err
cp $ecczsk2.key ns1/ecc.key cp "$ecczsk2".key ns1/ecc.key
mv Kecc* ns1 mv Kecc* ns1
else else
# ECC not available and will not be tested; make a placeholder # ECC not available and will not be tested; make a placeholder
@@ -69,26 +85,26 @@ fi
zone=ecx.example zone=ecx.example
zonefile=ns1/ecx.example.db zonefile=ns1/ecx.example.db
have_ecx=`grep ecx supported` have_ecx=$(grep ecx supported || true)
if [ "x$have_ecx" != "x" ]; then if [ "x$have_ecx" != "x" ]; then
$PK11GEN -a ECX -b 256 -l robie-ecx-zsk1 -i 05 $PK11GEN -a ECX -b 256 -l robie-ecx-zsk1 -i 05
$PK11GEN -a ECX -b 256 -l robie-ecx-zsk2 -i 06 $PK11GEN -a ECX -b 256 -l robie-ecx-zsk2 -i 06
$PK11GEN -a ECX -b 256 -l robie-ecx-ksk $PK11GEN -a ECX -b 256 -l robie-ecx-ksk
# $PK11GEN -a ECX -b 456 -l robie-ecx-ksk # $PK11GEN -a ECX -b 456 -l robie-ecx-ksk
ecxzsk1=`$KEYFRLAB -a ED25519 \ ecxzsk1=$($KEYFRLAB -a ED25519 \
-l "object=robie-ecx-zsk1;pin-source=$PWD/pin" ecx.example` -l "object=robie-ecx-zsk1;pin-source=$PWD/pin" ecx.example)
ecxzsk2=`$KEYFRLAB -a ED25519 \ ecxzsk2=$($KEYFRLAB -a ED25519 \
-l "object=robie-ecx-zsk2;pin-source=$PWD/pin" ecx.example` -l "object=robie-ecx-zsk2;pin-source=$PWD/pin" ecx.example)
ecxksk=`$KEYFRLAB -a ED25519 -f ksk \ ecxksk=$($KEYFRLAB -a ED25519 -f ksk \
-l "object=robie-ecx-ksk;pin-source=$PWD/pin" ecx.example` -l "object=robie-ecx-ksk;pin-source=$PWD/pin" ecx.example)
# ecxksk=`$KEYFRLAB -a ED448 -f ksk \ # ecxksk=`$KEYFRLAB -a ED448 -f ksk \
# -l "object=robie-ecx-ksk;pin-source=$PWD/pin" ecx.example` # -l "object=robie-ecx-ksk;pin-source=$PWD/pin" ecx.example`
cat $infile $ecxzsk1.key $ecxksk.key > $zonefile cat $infile "$ecxzsk1".key "$ecxksk".key > $zonefile
$SIGNER -a -P -g -o $zone $zonefile \ $SIGNER -a -P -g -o $zone $zonefile \
> /dev/null 2> signer.err || cat signer.err > /dev/null 2> signer.err || cat signer.err
cp $ecxzsk2.key ns1/ecx.key cp "$ecxzsk2".key ns1/ecx.key
mv Kecx* ns1 mv Kecx* ns1
else else
# ECX not available and will not be tested; make a placeholder # ECX not available and will not be tested; make a placeholder

59
bin/tests/system/pkcs11/tests.sh
View File

@@ -9,24 +9,29 @@
# See the COPYRIGHT file distributed with this work for additional # See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership. # information regarding copyright ownership.
set -e
SYSTEMTESTTOP=.. SYSTEMTESTTOP=..
# shellcheck source=conf.sh
. $SYSTEMTESTTOP/conf.sh . $SYSTEMTESTTOP/conf.sh
DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300" dig_with_opts() {
$DIG +tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300 "$@"
}
status=0 status=0
ret=0 ret=0
algs="" algs=""
have_rsa=`grep rsa supported` have_rsa=$(grep rsa supported || true)
if [ "x$have_rsa" != "x" ]; then if [ "x$have_rsa" != "x" ]; then
algs="rsa " algs="rsa "
fi fi
have_ecc=`grep ecc supported` have_ecc=$(grep ecc supported || true)
if [ "x$have_ecc" != "x" ]; then if [ "x$have_ecc" != "x" ]; then
algs=$algs"ecc " algs=$algs"ecc "
fi fi
have_ecx=`grep ecc supported` have_ecx=$(grep ecx supported || true)
if [ "x$have_ecx" != "x" ]; then if [ "x$have_ecx" != "x" ]; then
algs=$algs"ecx " algs=$algs"ecx "
fi fi
@@ -34,54 +39,54 @@ fi
for alg in $algs; do for alg in $algs; do
zonefile=ns1/$alg.example.db zonefile=ns1/$alg.example.db
echo "I:testing PKCS#11 key generation ($alg)" echo "I:testing PKCS#11 key generation ($alg)"
count=`$PK11LIST | grep robie-$alg-ksk | wc -l` count=$($PK11LIST | grep -c "robie-$alg-ksk" || true)
if [ $count != 2 ]; then echo "I:failed"; status=1; fi if [ "$count" -ne 2 ]; then echo "I:failed"; status=1; fi
echo "I:testing offline signing with PKCS#11 keys ($alg)" echo "I:testing offline signing with PKCS#11 keys ($alg)"
count=`grep RRSIG $zonefile.signed | wc -l` count=$(grep -c RRSIG "$zonefile.signed" || true)
if [ $count != 12 ]; then echo "I:failed"; status=1; fi if [ "$count" -ne 12 ]; then echo "I:failed"; status=1; fi
echo "I:testing inline signing with PKCS#11 keys ($alg)" echo "I:testing inline signing with PKCS#11 keys ($alg)"
$DIG $DIGOPTS ns.$alg.example. @10.53.0.1 a > dig.out.$alg.0 || ret=1 dig_with_opts "ns.$alg.example." @10.53.0.1 a > "dig.out.$alg.0" || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi if [ $ret -ne 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret` status=$((status + ret))
count0=`grep RRSIG dig.out.$alg.0 | wc -l` count0=$(grep -c RRSIG "dig.out.$alg.0" || true)
$NSUPDATE -v > upd.log.$alg <<END || status=1 $NSUPDATE -v > "upd.log.$alg" <<END || status=1
server 10.53.0.1 5300 server 10.53.0.1 5300
ttl 300 ttl 300
zone $alg.example. zone $alg.example.
update add `grep -v ';' ns1/${alg}.key` update add $(grep -v ';' "ns1/${alg}.key" || true)
send send
END END
echo "I:waiting 20 seconds for key changes to take effect" echo "I:waiting 20 seconds for key changes to take effect"
sleep 20 sleep 20
$DIG $DIGOPTS ns.$alg.example. @10.53.0.1 a > dig.out.$alg || ret=1 dig_with_opts "ns.$alg.example." @10.53.0.1 a > "dig.out.$alg" || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi if [ $ret -ne 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret` status=$((status + ret))
count=`grep RRSIG dig.out.$alg | wc -l` count=$(grep -c RRSIG "dig.out.$alg" || true)
if [ $count -le $count0 ]; then echo "I:failed"; status=1; fi if [ "$count" -le "$count0" ]; then echo "I:failed"; status=1; fi
echo "I:testing PKCS#11 key destroy ($alg)" echo "I:testing PKCS#11 key destroy ($alg)"
ret=0 ret=0
$PK11DEL -l robie-$alg-ksk -w0 > /dev/null 2>&1 || ret=1 $PK11DEL -l "robie-$alg-ksk" -w0 > /dev/null 2>&1 || ret=1
$PK11DEL -l robie-$alg-zsk1 -w0 > /dev/null 2>&1 || ret=1 $PK11DEL -l "robie-$alg-zsk1" -w0 > /dev/null 2>&1 || ret=1
case $alg in case $alg in
rsa) id=02 ;; rsa) id=02 ;;
ecc) id=04 ;; ecc) id=04 ;;
ecx) id=06 ;; ecx) id=06 ;;
esac esac
$PK11DEL -i $id -w0 > /dev/null 2>&1 || ret=1 $PK11DEL -i $id -w0 > /dev/null 2>&1 || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi if [ $ret -ne 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret` status=$((status + ret))
count=`$PK11LIST | grep robie-$alg | wc -l` count=$($PK11LIST | grep -c "robie-$alg" || true)
if [ $count != 0 ]; then echo "I:failed"; fi if [ "$count" -ne 0 ]; then echo "I:failed"; fi
status=`expr $status + $count` status=$((status + count))
done done
echo "I:exit status: $status" echo "I:exit status: $status"
[ $status -eq 0 ] || exit 1 [ "$status" -eq 0 ] || exit 1

1
util/copyrights
View File

@@ -883,7 +883,6 @@
./bin/tests/system/pipelined/setup.sh SH 2014,2015,2016,2017,2018,2019,2020 ./bin/tests/system/pipelined/setup.sh SH 2014,2015,2016,2017,2018,2019,2020
./bin/tests/system/pipelined/tests.sh SH 2014,2015,2016,2017,2018,2019,2020 ./bin/tests/system/pipelined/tests.sh SH 2014,2015,2016,2017,2018,2019,2020
./bin/tests/system/pkcs11/clean.sh SH 2010,2012,2014,2016,2017,2018,2019,2020 ./bin/tests/system/pkcs11/clean.sh SH 2010,2012,2014,2016,2017,2018,2019,2020
./bin/tests/system/pkcs11/prereq.sh SH 2010,2012,2014,2016,2017,2018,2019,2020
./bin/tests/system/pkcs11/setup.sh SH 2010,2012,2013,2014,2016,2017,2018,2019,2020 ./bin/tests/system/pkcs11/setup.sh SH 2010,2012,2013,2014,2016,2017,2018,2019,2020
./bin/tests/system/pkcs11/tests.sh SH 2010,2012,2014,2016,2017,2018,2019,2020 ./bin/tests/system/pkcs11/tests.sh SH 2010,2012,2014,2016,2017,2018,2019,2020
./bin/tests/system/pkcs11/usepkcs11 X 2010,2018,2019,2020 ./bin/tests/system/pkcs11/usepkcs11 X 2010,2018,2019,2020