blob: 66b03d9aa6ad97a9e97969c0e7145fb4ebd80444 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
#!/bin/sh
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
set -e
SYSTEMTESTTOP=..
# shellcheck source=conf.sh
. "$SYSTEMTESTTOP/conf.sh"
count_rrsigs() (
grep -c "IN[[:space:]]*RRSIG" "$@" || true
)
dig_with_opts() (
$DIG +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
)
dig_for_rr() (
alg=$1
rrtype=$2
count0=$3
dig_with_opts "$alg.example." @10.53.0.1 "$rrtype" >"dig.out.$rrtype.$alg" \
&& count=$(count_rrsigs "dig.out.$rrtype.$alg") \
&& test "$count" -gt "$count0"
)
test_done() {
if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
ret=0
}
status=0
ret=0
n=0
while read -r alg; do
zonefile=ns1/$alg.example.db
echo_i "testing PKCS#11 key generation ($alg)"
count=$($PK11LIST | grep -c "pkcs11-$alg-ksk" || true)
[ "$count" -eq 4 ] || ret=1
test_done
echo_i "testing offline signing with PKCS#11 keys ($alg)"
count=$(grep -c "[0-9][[:space:]]*RRSIG" "$zonefile.signed")
[ "$count" -eq 9 ] || ret=1
test_done
echo_i "testing inline signing with new PKCS#11 ZSK ($alg)"
dig_with_opts "$alg.example." @10.53.0.1 "SOA" >"dig.out.SOA.$alg.0" || ret=1
countSOA0=$(count_rrsigs "dig.out.SOA.$alg.0")
new_zsk=$(grep -v ';' "ns1/$alg.zsk")
cat >"upd.cmd.ZSK.$alg" <<EOF
server 10.53.0.1 $PORT
ttl 300
zone $alg.example.
update add $new_zsk
send
EOF
$NSUPDATE -v >"upd.log.ZSK.$alg" <"upd.cmd.ZSK.$alg" || ret=1
retry_quiet 20 dig_for_rr "$alg" "SOA" "$countSOA0" || ret=1
test_done
echo_i "testing inline signing with new PKCS#11 KSK ($alg)"
dig_with_opts "$alg.example." @10.53.0.1 "DNSKEY" >"dig.out.DNSKEY.$alg.0" || ret=1
countDNSKEY0=$(count_rrsigs "dig.out.DNSKEY.$alg.0")
new_ksk=$(grep -v ';' "ns1/$alg.ksk")
cat >"upd.cmd.KSK.$alg" <<EOF
server 10.53.0.1 $PORT
ttl 300
zone $alg.example.
update add $new_ksk
send
EOF
$NSUPDATE -v >"upd.log.KSK.$alg" <"upd.cmd.KSK.$alg" || ret=1
retry_quiet 20 dig_for_rr "$alg" "DNSKEY" "$countDNSKEY0" || ret=1
test_done
echo_i "testing PKCS#11 key destroy ($alg)"
# Lookup all existing keys
echo_i "looking up all existing keys ($alg)"
$PK11LIST >"pkcs11-list.out.id.$alg" || ret=1
test_done
echo_i "destroying key with 'pkcs11-$alg-ksk1' label ($alg)"
$PK11DEL -l "pkcs11-$alg-ksk1" >/dev/null 2>&1 || ret=1
test_done
echo_i "destroying key with 'pkcs11-$alg-zsk1' label ($alg)"
$PK11DEL -l "pkcs11-$alg-zsk1" >/dev/null 2>&1 || ret=1
test_done
id=$(awk -v label="'pkcs11-$alg-ksk2'" '{ if ($7 == label) { print $9; exit; } }' <"pkcs11-list.out.id.$alg")
echo_i "destroying key with $id id ($alg)"
if [ -n "$id" ]; then
$PK11DEL -i "$id" >/dev/null 2>&1 || ret=1
else
ret=1
fi
test_done
id=$(awk -v label="'pkcs11-$alg-zsk2'" '{ if ($7 == label) { print $9; exit; } }' <"pkcs11-list.out.id.$alg")
echo_i "destroying key with $id id ($alg)"
if [ -n "$id" ]; then
$PK11DEL -i "$id" >/dev/null 2>&1 || ret=1
else
ret=1
fi
test_done
echo_i "checking if all keys have been destroyed ($alg)"
$PK11LIST >"pkcs11-list.out.$alg" || ret=1
count=$(grep -c "pkcs11-$alg-[kz]sk[0-9]*" "pkcs11-list.out.$alg" || true)
[ "$count" -eq 0 ] || ret=1
test_done
n=$((n + 1))
done <supported
echo_i "Checking if all supported algorithms were tested"
[ "$n" -eq "$(wc -l <supported)" ] || ret=1
test_done
echo_i "Checking for assertion failure in pk11_numbits()"
$PERL ../packet.pl -a "10.53.0.1" -p "$PORT" -t udp 2037-pk11_numbits-crash-test.pkt
dig_with_opts @10.53.0.1 version.bind. CH TXT >dig.out.pk11_numbits || ret=1
test_done
echo_i "exit status: $status"
[ "$status" -eq 0 ] || exit 1
|
