From: Matthijs Mekking Date: Mon, 28 Feb 2022 12:51:47 +0000 (+0100) Subject: Add tests for key-store with engine_pkcs11 X-Git-Tag: v9.19.22~70^2~25 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=91f18c98b385f166c54175df5702c371b59c1d88;p=thirdparty%2Fbind9.git Add tests for key-store with engine_pkcs11 Add cases for each algorithm to test the interaction between dnssec-policy and engine_pkcs11. Ensure that named creates keys on startup. Also test dnssec-keygen when using a dnssec-policy with a PKCS#11 based key-store. --- diff --git a/bin/tests/system/enginepkcs11/clean.sh b/bin/tests/system/enginepkcs11/clean.sh index 087b4347926..7233784a029 100644 --- a/bin/tests/system/enginepkcs11/clean.sh +++ b/bin/tests/system/enginepkcs11/clean.sh @@ -18,18 +18,20 @@ set -e rm -f dig.out.* rm -f dsset-* -rm -f pin rm -f keyfromlabel.err.* keyfromlabel.out.* rm -f pkcs11-tool.err.* pkcs11-tool.out.* rm -f signer.out.* rm -f ns1/*.example.db ns1/*.example.db.signed +rm -f ns1/*.kasp.db ns1/*.kasp.db.signed rm -f ns1/*.kskid1 ns1/*.kskid2 ns1/*.zskid1 ns1/*.zskid2 rm -f ns1/dig.out.* rm -f ns1/K* +rm -f ns1/keygen.out.* rm -f ns1/named.conf ns1/named.args ns1/named.run ns1/named.memstats +rm -f ns1/pin rm -f ns1/update.cmd.* rm -f ns1/update.log.* rm -f ns1/verify.out.* -rm -f ns1/zone.*.signed.jnl ns1/zone.*.signed.jbk +rm -f ns1/zone.*.jnl ns1/zone.*.jbk OPENSSL_CONF= softhsm2-util --delete-token --token "softhsm2-enginepkcs11" >/dev/null 2>&1 || echo_i "softhsm2-enginepkcs11 token not found for cleaning" diff --git a/bin/tests/system/enginepkcs11/ns1/named.conf.in b/bin/tests/system/enginepkcs11/ns1/named.conf.in index 985974db81b..2e04e45b266 100644 --- a/bin/tests/system/enginepkcs11/ns1/named.conf.in +++ b/bin/tests/system/enginepkcs11/ns1/named.conf.in @@ -34,3 +34,17 @@ key rndc_key { controls { inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; }; + +key-store "hsm" { + directory "."; + uri "pkcs11:token=softhsm2-enginepkcs11;pin-value=1234"; +}; + +key-store "pin" { + directory "."; + uri "pkcs11:token=softhsm2-enginepkcs11;pin-source=pin"; +}; + +key-store "disk" { + directory "keys"; +}; diff --git a/bin/tests/system/enginepkcs11/setup.sh b/bin/tests/system/enginepkcs11/setup.sh index 3cb216bdbf6..59db1246648 100644 --- a/bin/tests/system/enginepkcs11/setup.sh +++ b/bin/tests/system/enginepkcs11/setup.sh @@ -18,8 +18,8 @@ set -e OPENSSL_CONF= softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2-enginepkcs11" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }' -printf '%s' "${HSMPIN:-1234}" >pin parse_openssl_config +printf '%s' "${HSMPIN:-1234}" >ns1/pin PWD=$(pwd) copy_setports ns1/named.conf.in ns1/named.conf @@ -33,7 +33,7 @@ keygen() { label="${id}-${zone}" p11id=$(echo "${label}" | openssl sha1 -r | awk '{print $1}') - OPENSSL_CONF= pkcs11-tool --module $SOFTHSM2_MODULE --token-label "softhsm2-enginepkcs11" -l -k --key-type $type:$bits --label "${label}" --id "${p11id}" --pin $(cat $PWD/pin) >pkcs11-tool.out.$zone.$id 2>pkcs11-tool.err.$zone.$id || return 1 + OPENSSL_CONF= pkcs11-tool --module $SOFTHSM2_MODULE --token-label "softhsm2-enginepkcs11" -l -k --key-type $type:$bits --label "${label}" --id "${p11id}" --pin $(cat $PWD/ns1/pin) >pkcs11-tool.out.$zone.$id 2>pkcs11-tool.err.$zone.$id || return 1 } keyfromlabel() { @@ -43,7 +43,7 @@ keyfromlabel() { dir="$4" shift 4 - $KEYFRLAB $ENGINE_ARG -K $dir -a $alg -l "pkcs11:token=softhsm2-enginepkcs11;object=${id}-${zone};pin-source=$PWD/pin" "$@" $zone >>keyfromlabel.out.$zone.$id 2>keyfromlabel.err.$zone.$id || return 1 + $KEYFRLAB $ENGINE_ARG -K $dir -a $alg -l "pkcs11:token=softhsm2-enginepkcs11;object=${id}-${zone};pin-source=$PWD/ns1/pin" "$@" $zone >>keyfromlabel.out.$zone.$id 2>keyfromlabel.err.$zone.$id || return 1 cat keyfromlabel.out.$zone.$id } @@ -57,9 +57,10 @@ for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \ type=$(echo "$algtypebits" | cut -f 2 -d :) bits=$(echo "$algtypebits" | cut -f 3 -d :) + tld="example" if $SHELL ../testcrypto.sh $alg; then - zone="$alg.example" - zonefile="zone.$alg.example.db" + zone="$alg.$tld" + zonefile="zone.$alg.$tld.db" ret=0 echo_i "Generate keys $alg $type:$bits for zone $zone" @@ -111,6 +112,9 @@ for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \ cp "${ksk2}.key" "${ksk2}.ksk2" ) + echo_i "Add zone $alg.kasp to named.conf" + cp $infile ${dir}/zone.${alg}.kasp.db + echo_i "Add zone $zone to named.conf" cat >>"${dir}/named.conf" <dig.out.dnskey.$zone.$n || return 1 + count=$(awk 'BEGIN { count = 0 } $4 == "DNSKEY" { count++ } END {print count}' dig.out.dnskey.$zone.$n) + test $count -eq 2 + } + retry_quiet 2 _dig_policy_dnskey || ret=1 + test "$ret" -eq 0 || echo_i "failed (expected 2 DNSKEY records)" + status=$((status + ret)) + + n=$((n + 1)) + ret=0 + echo_i "Test SOA response for $zone ($n)" + _dig_policy_soa() { + dig_with_opts "$zone" @10.53.0.1 SOA >dig.out.soa.$zone.$n || return 1 + awk '$4 == "RRSIG" && $5 == "SOA" { print $11 }' dig.out.soa.$zone.$n >dig.out.keyids.$zone.$n || return 1 + numsigs=$(cat dig.out.keyids.$zone.$n | wc -l) + test $numsigs -eq 1 || return 1 + return 0 + } + retry_quiet 2 _dig_policy_soa || ret=1 + test "$ret" -eq 0 || echo_i "failed (expected a SOA RRSIG record)" + status=$((status + ret)) + + # Check dnssec-keygen with dnssec-policy and key-store. + zone="${alg}.keygen" + + n=$((n + 1)) + ret=0 + echo_i "Test dnssec-keygen for $zone ($n)" + $KEYGEN $ENGINE_ARG -k $alg -l named.conf $zone >keygen.out.$zone.$n 2>/dev/null || ret=1 + check_keys $zone 2 || ret=1 + status=$((status + ret)) + done # Go back to main test dir.