diff options
Diffstat (limited to 'bin/tests/system/keyfromlabel/tests.sh')
| -rw-r--r-- | bin/tests/system/keyfromlabel/tests.sh | 118 |
1 files changed, 58 insertions, 60 deletions
diff --git a/bin/tests/system/keyfromlabel/tests.sh b/bin/tests/system/keyfromlabel/tests.sh index 5cedbf9..6c38ec6 100644 --- a/bin/tests/system/keyfromlabel/tests.sh +++ b/bin/tests/system/keyfromlabel/tests.sh @@ -19,74 +19,72 @@ set -e PWD=$(pwd) keygen() { - type="$1" - bits="$2" - zone="$3" - id="$4" - - label="${id}-${zone}" - p11id=$(echo "${label}" | openssl sha1 -r | awk '{print $1}') - pkcs11-tool --module $SOFTHSM2_MODULE --token-label "softhsm2-keyfromlabel" -l -k --key-type $type:$bits --label "${label}" --id "${p11id}" --pin $(cat $PWD/pin) > pkcs11-tool.out.$zone.$id || return 1 + type="$1" + bits="$2" + zone="$3" + id="$4" + + label="${id}-${zone}" + p11id=$(echo "${label}" | openssl sha1 -r | awk '{print $1}') + pkcs11-tool --module $SOFTHSM2_MODULE --token-label "softhsm2-keyfromlabel" -l -k --key-type $type:$bits --label "${label}" --id "${p11id}" --pin $(cat $PWD/pin) >pkcs11-tool.out.$zone.$id || return 1 } keyfromlabel() { - alg="$1" - zone="$2" - id="$3" - shift 3 + alg="$1" + zone="$2" + id="$3" + shift 3 - $KEYFRLAB -E pkcs11 -a $alg -l "token=softhsm2-keyfromlabel;object=${id}-${zone};pin-source=$PWD/pin" "$@" $zone >> keyfromlabel.out.$zone.$id 2>> /dev/null || return 1 - cat keyfromlabel.out.$zone.$id + $KEYFRLAB -E pkcs11 -a $alg -l "token=softhsm2-keyfromlabel;object=${id}-${zone};pin-source=$PWD/pin" "$@" $zone >>keyfromlabel.out.$zone.$id 2>>/dev/null || return 1 + cat keyfromlabel.out.$zone.$id } infile="template.db.in" for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \ - ecdsap256sha256:EC:prime256v1 ecdsap384sha384:EC:prime384v1 - # Edwards curves are not yet supported by OpenSC - # ed25519:EC:edwards25519 ed448:EC:edwards448 -do - alg=$(echo "$algtypebits" | cut -f 1 -d :) - type=$(echo "$algtypebits" | cut -f 2 -d :) - bits=$(echo "$algtypebits" | cut -f 3 -d :) - - if $SHELL ../testcrypto.sh $alg; then - zone="$alg.example" - zonefile="zone.$alg.example.db" - ret=0 - - echo_i "Generate keys $alg $type:$bits for zone $zone" - keygen $type $bits $zone keyfromlabel-zsk || ret=1 - keygen $type $bits $zone keyfromlabel-ksk || ret=1 - test "$ret" -eq 0 || echo_i "failed" - status=$((status+ret)) - - # Skip dnssec-keyfromlabel if key generation failed. - test $ret -eq 0 || continue - - echo_i "Get ZSK $alg $zone $type:$bits" - ret=0 - zsk=$(keyfromlabel $alg $zone keyfromlabel-zsk) - test -z "$zsk" && ret=1 - test "$ret" -eq 0 || echo_i "failed (zsk=$zsk)" - status=$((status+ret)) - - echo_i "Get KSK $alg $zone $type:$bits" - ret=0 - ksk=$(keyfromlabel $alg $zone keyfromlabel-ksk -f KSK) - test -z "$ksk" && ret=1 - test "$ret" -eq 0 || echo_i "failed (ksk=$ksk)" - status=$((status+ret)) - - # Skip signing if dnssec-keyfromlabel failed. - test $ret -eq 0 || continue - - echo_i "Sign zone with $ksk $zsk" - ret=0 - cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile" - $SIGNER -E pkcs11 -S -a -g -o "$zone" "$zonefile" > signer.out.$zone || ret=1 - test "$ret" -eq 0 || echo_i "failed" - status=$((status+ret)) - fi + ecdsap256sha256:EC:prime256v1 ecdsap384sha384:EC:prime384v1; do # Edwards curves are not yet supported by OpenSC + # ed25519:EC:edwards25519 ed448:EC:edwards448 + alg=$(echo "$algtypebits" | cut -f 1 -d :) + type=$(echo "$algtypebits" | cut -f 2 -d :) + bits=$(echo "$algtypebits" | cut -f 3 -d :) + + if $SHELL ../testcrypto.sh $alg; then + zone="$alg.example" + zonefile="zone.$alg.example.db" + ret=0 + + echo_i "Generate keys $alg $type:$bits for zone $zone" + keygen $type $bits $zone keyfromlabel-zsk || ret=1 + keygen $type $bits $zone keyfromlabel-ksk || ret=1 + test "$ret" -eq 0 || echo_i "failed" + status=$((status + ret)) + + # Skip dnssec-keyfromlabel if key generation failed. + test $ret -eq 0 || continue + + echo_i "Get ZSK $alg $zone $type:$bits" + ret=0 + zsk=$(keyfromlabel $alg $zone keyfromlabel-zsk) + test -z "$zsk" && ret=1 + test "$ret" -eq 0 || echo_i "failed (zsk=$zsk)" + status=$((status + ret)) + + echo_i "Get KSK $alg $zone $type:$bits" + ret=0 + ksk=$(keyfromlabel $alg $zone keyfromlabel-ksk -f KSK) + test -z "$ksk" && ret=1 + test "$ret" -eq 0 || echo_i "failed (ksk=$ksk)" + status=$((status + ret)) + + # Skip signing if dnssec-keyfromlabel failed. + test $ret -eq 0 || continue + + echo_i "Sign zone with $ksk $zsk" + ret=0 + cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile" + $SIGNER -E pkcs11 -S -a -g -o "$zone" "$zonefile" >signer.out.$zone || ret=1 + test "$ret" -eq 0 || echo_i "failed" + status=$((status + ret)) + fi done echo_i "exit status: $status" |