Adding upstream version 1:9.16.44.upstream/1%9.16.44upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 149 insertions, 0 deletions

diff --git a/bin/tests/system/pkcs11/tests.sh b/bin/tests/system/pkcs11/tests.sh
new file mode 100644
index 0000000..e8d7cb6
--- /dev/null
+++ b/bin/tests/system/pkcs11/tests.sh
@@ -0,0 +1,149 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+set -e
+
+SYSTEMTESTTOP=..
+# shellcheck source=conf.sh
+. "$SYSTEMTESTTOP/conf.sh"
+
+count_rrsigs() (
+    grep -c "IN[[:space:]]*RRSIG" "$@" || true
+)
+
+dig_with_opts() (
+    $DIG +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
+)
+
+dig_for_rr() (
+    alg=$1
+    rrtype=$2
+    count0=$3
+    dig_with_opts "$alg.example." @10.53.0.1 "$rrtype" > "dig.out.$rrtype.$alg" &&
+    count=$(count_rrsigs "dig.out.$rrtype.$alg") &&
+    test "$count" -gt "$count0"
+)
+
+test_done() {
+    if [ $ret -ne 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
+    ret=0
+}
+
+status=0
+ret=0
+
+n=0
+while read -r alg; do
+    zonefile=ns1/$alg.example.db
+    echo_i "testing PKCS#11 key generation ($alg)"
+    count=$($PK11LIST | grep -c "pkcs11-$alg-ksk" || true)
+    [ "$count" -eq 4 ] || ret=1
+    test_done
+
+    echo_i "testing offline signing with PKCS#11 keys ($alg)"
+
+    count=$(grep -c "[0-9][[:space:]]*RRSIG" "$zonefile.signed")
+    [ "$count" -eq 9 ] || ret=1
+    test_done
+
+    echo_i "testing inline signing with new PKCS#11 ZSK ($alg)"
+
+    dig_with_opts "$alg.example." @10.53.0.1 "SOA" > "dig.out.SOA.$alg.0" || ret=1
+    countSOA0=$(count_rrsigs "dig.out.SOA.$alg.0")
+    new_zsk=$(grep -v ';' "ns1/$alg.zsk")
+
+    cat > "upd.cmd.ZSK.$alg" <<EOF
+server 10.53.0.1 $PORT
+ttl 300
+zone $alg.example.
+update add $new_zsk
+send
+EOF
+
+    $NSUPDATE -v > "upd.log.ZSK.$alg" < "upd.cmd.ZSK.$alg" || ret=1
+
+    retry_quiet 20 dig_for_rr "$alg" "SOA" "$countSOA0" || ret=1
+    test_done
+
+    echo_i "testing inline signing with new PKCS#11 KSK ($alg)"
+
+    dig_with_opts "$alg.example." @10.53.0.1 "DNSKEY" > "dig.out.DNSKEY.$alg.0" || ret=1
+    countDNSKEY0=$(count_rrsigs "dig.out.DNSKEY.$alg.0")
+    new_ksk=$(grep -v ';' "ns1/$alg.ksk")
+
+    cat > "upd.cmd.KSK.$alg" <<EOF
+server 10.53.0.1 $PORT
+ttl 300
+zone $alg.example.
+update add $new_ksk
+send
+EOF
+
+    $NSUPDATE -v > "upd.log.KSK.$alg" < "upd.cmd.KSK.$alg" || ret=1
+
+    retry_quiet 20 dig_for_rr "$alg" "DNSKEY" "$countDNSKEY0" || ret=1
+    test_done
+
+    echo_i "testing PKCS#11 key destroy ($alg)"
+
+    # Lookup all existing keys
+    echo_i "looking up all existing keys ($alg)"
+    $PK11LIST > "pkcs11-list.out.id.$alg" || ret=1
+    test_done
+
+    echo_i "destroying key with 'pkcs11-$alg-ksk1' label ($alg)"
+    $PK11DEL -l "pkcs11-$alg-ksk1" > /dev/null 2>&1 || ret=1
+    test_done
+
+    echo_i "destroying key with 'pkcs11-$alg-zsk1' label ($alg)"
+    $PK11DEL -l "pkcs11-$alg-zsk1" > /dev/null 2>&1 || ret=1
+    test_done
+
+    id=$(awk -v label="'pkcs11-$alg-ksk2'" '{ if ($7 == label) { print $9; exit; } }' < "pkcs11-list.out.id.$alg")
+    echo_i "destroying key with $id id ($alg)"
+    if [ -n "$id" ]; then
+	$PK11DEL -i "$id" > /dev/null 2>&1 || ret=1
+    else
+	ret=1
+    fi
+    test_done
+
+    id=$(awk -v label="'pkcs11-$alg-zsk2'" '{ if ($7 == label) { print $9; exit; } }' < "pkcs11-list.out.id.$alg")
+    echo_i "destroying key with $id id ($alg)"
+    if [ -n "$id" ]; then
+	$PK11DEL -i "$id" > /dev/null 2>&1 || ret=1
+    else
+	ret=1
+    fi
+    test_done
+
+    echo_i "checking if all keys have been destroyed ($alg)"
+    $PK11LIST > "pkcs11-list.out.$alg" || ret=1
+    count=$(grep -c "pkcs11-$alg-[kz]sk[0-9]*" "pkcs11-list.out.$alg" || true)
+    [ "$count" -eq 0 ] || ret=1
+    test_done
+    n=$((n+1))
+done < supported
+
+echo_i "Checking if all supported algorithms were tested"
+[ "$n" -eq "$(wc -l < supported)" ] || ret=1
+test_done
+
+echo_i "Checking for assertion failure in pk11_numbits()"
+$PERL ../packet.pl -a "10.53.0.1" -p "$PORT" -t udp 2037-pk11_numbits-crash-test.pkt
+dig_with_opts @10.53.0.1 version.bind. CH TXT > dig.out.pk11_numbits || ret=1
+test_done
+
+echo_i "exit status: $status"
+[ "$status" -eq 0 ] || exit 1