From: Matthijs Mekking <matthijs@isc.org>
Date: Mon, 15 Nov 2021 09:23:04 +0000 (+0100)
Subject: Add system test for dnssec-keyfromlabel
X-Git-Tag: v9.19.0~142^2~3
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=eba66665a52a5ee6c600cb87ec1d9b8d881956bd;p=thirdparty%2Fbind9.git

Add system test for dnssec-keyfromlabel

Add missing system test for dnssec-keyfromlabel. Test for various
algorithms that we can generate key files from a key that is stored in a
HSM, and that those keys can be used for signing with dnssec-signzone.
---

diff --git a/bin/tests/system/Makefile.am b/bin/tests/system/Makefile.am
index da153d66158..b6a855f45e9 100644
--- a/bin/tests/system/Makefile.am
+++ b/bin/tests/system/Makefile.am
@@ -125,6 +125,7 @@ TESTS +=			\
 	hooks			\
 	journal			\
 	keepalive		\
+	keyfromlabel		\
 	legacy			\
 	limits			\
 	logfileconfig		\
diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index da9a934ca00..cad051c5b9c 100644
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -85,6 +85,7 @@ dnssec
 dyndb
 filter-aaaa
 kasp
+keyfromlabel
 keymgr2kasp
 legacy
 logfileconfig
diff --git a/bin/tests/system/keyfromlabel/clean.sh b/bin/tests/system/keyfromlabel/clean.sh
new file mode 100644
index 00000000000..39082d4ce24
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/clean.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+rm -f K*
+rm -f pin
+rm -f dsset-*
+rm -f *.example.db *.example.db.signed
+rm -f keyfromlabel.out.*
+rm -f pkcs11-tool.out.*
+rm -f signer.out.*
+
+softhsm2-util --delete-token --token "softhsm2" || echo_i "softhsm2 token not found"
diff --git a/bin/tests/system/keyfromlabel/prereq.sh b/bin/tests/system/keyfromlabel/prereq.sh
new file mode 100644
index 00000000000..296452b4026
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/prereq.sh
@@ -0,0 +1,21 @@
+#!/bin/sh -e
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+. ../conf.sh
+
+if [ -n "${SOFTHSM2_MODULE}" ] && command -v softhsm2-util >/dev/null; then
+	exit 0
+fi
+
+echo_i "skip: softhsm2-util not available"
+exit 255
diff --git a/bin/tests/system/keyfromlabel/setup.sh b/bin/tests/system/keyfromlabel/setup.sh
new file mode 100644
index 00000000000..9f06a71faf5
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/setup.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+set -e
+
+softhsm2-util --init-token --free --pin 1234 --so-pin 1234 --label "softhsm2" | awk '/^The token has been initialized and is reassigned to slot/ { print $NF }'
+
+printf '%s' "${HSMPIN:-1234}" > pin
+PWD=$(pwd)
diff --git a/bin/tests/system/keyfromlabel/template.db.in b/bin/tests/system/keyfromlabel/template.db.in
new file mode 100644
index 00000000000..7941903808a
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/template.db.in
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	10.53.0.1
+
+txt			TXT	"test"
+
diff --git a/bin/tests/system/keyfromlabel/tests.sh b/bin/tests/system/keyfromlabel/tests.sh
new file mode 100644
index 00000000000..9764bf4606c
--- /dev/null
+++ b/bin/tests/system/keyfromlabel/tests.sh
@@ -0,0 +1,88 @@
+#!/bin/sh
+#
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../conf.sh
+
+PWD=$(pwd)
+
+keygen() {
+	type="$1"
+	bits="$2"
+	zone="$3"
+	id="$4"
+
+	pkcs11-tool --module $SOFTHSM2_MODULE -l -k --key-type $type:$bits --label "${id}-${zone}" --pin $(cat $PWD/pin) > pkcs11-tool.out.$zone.$id || return 1
+}
+
+keyfromlabel() {
+        alg="$1"
+        zone="$2"
+        id="$3"
+        shift 3
+
+	$KEYFRLAB -E pkcs11 -a $alg -l "token=softhsm2;object=${id}-${zone};pin-source=$PWD/pin" "$@" $zone >> keyfromlabel.out.$zone.$id 2>> /dev/null || return 1
+	cat keyfromlabel.out.$zone.$id
+}
+
+infile="template.db.in"
+for algtypebits in rsasha256:rsa:2048 rsasha512:rsa:2048 \
+		   ecdsap256sha256:EC:prime256v1 ecdsap384sha384:EC:prime384v1
+		   # Edwards curves are not yet supported by OpenSC
+		   # ed25519:EC:edwards25519 ed448:EC:edwards448
+do
+	alg=$(echo "$algtypebits" | cut -f 1 -d :)
+	type=$(echo "$algtypebits" | cut -f 2 -d :)
+	bits=$(echo "$algtypebits" | cut -f 3 -d :)
+
+	if $SHELL ../testcrypto.sh $alg; then
+		zone="$alg.example"
+		zonefile="zone.$alg.example.db"
+		ret=0
+
+		echo_i "Generate keys $alg $type:$bits for zone $zone"
+		keygen $type $bits $zone keyfromlabel-zsk || ret=1
+		keygen $type $bits $zone keyfromlabel-ksk || ret=1
+		test "$ret" -eq 0 || echo_i "failed"
+		status=$((status+ret))
+
+		# Skip dnssec-keyfromlabel if key generation failed.
+		test $ret == 0 || continue
+
+		echo_i "Get ZSK $alg $id-$zone $type:$bits"
+		ret=0
+		zsk=$(keyfromlabel $alg $zone keyfromlabel-zsk)
+		test -z "$zsk" && ret=1
+
+		echo_i "Get KSK $alg $id-$zone $type:$bits"
+		ret=0
+		ksk=$(keyfromlabel $alg $zone keyfromlabel-ksk -f KSK)
+		test -z "$ksk" && ret=1
+
+		test "$ret" -eq 0 || echo_i "failed (zsk=$zsk ksk=$ksk)"
+		status=$((status+ret))
+
+		# Skip signing if dnssec-keyfromlabel failed.
+		test $ret == 0 || continue
+
+		echo_i "Sign zone with $ksk $zsk"
+		ret=0
+		cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
+		$SIGNER -E pkcs11 -S -a -g -o "$zone" "$zonefile" > signer.out.$zone || ret=1
+		test "$ret" -eq 0 || echo_i "failed"
+		status=$((status+ret))
+	fi
+done
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
diff --git a/bin/tests/system/run.sh.in b/bin/tests/system/run.sh.in
index 51399a79c57..9c529d0286d 100644
--- a/bin/tests/system/run.sh.in
+++ b/bin/tests/system/run.sh.in
@@ -74,7 +74,21 @@ if ! $do_run; then
     if [ "$baseport" -eq 0 ]; then
         log_flags="$log_flags -p 5300"
     fi
-    env - SYSTEMTEST_FORCE_COLOR="$SYSTEMTEST_FORCE_COLOR" SYSTEMTEST_NO_CLEAN="$SYSTEMTEST_NO_CLEAN" SLOT="$SLOT" SOFTHSM2_CONF="$SOFTHSM2_CONF" PATH="$PATH" ${LD_LIBRARY_PATH:+"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}"} TESTS="$*" TEST_SUITE_LOG=run.log LOG_DRIVER_FLAGS="--verbose yes --color-tests yes" LOG_FLAGS="$log_flags" TEST_LARGE_MAP="${TEST_LARGE_MAP}" make -e check
+    env - \
+        SYSTEMTEST_FORCE_COLOR="$SYSTEMTEST_FORCE_COLOR" \
+        SYSTEMTEST_NO_CLEAN="$SYSTEMTEST_NO_CLEAN" \
+        SLOT="$SLOT" \
+        OPENSSL_CONF="$OPENSSL_CONF" \
+        SOFTHSM2_CONF="$SOFTHSM2_CONF" \
+        SOFTHSM2_MODULE="$SOFTHSM2_MODULE" \
+        PATH="$PATH" \
+        ${LD_LIBRARY_PATH:+"LD_LIBRARY_PATH=${LD_LIBRARY_PATH}"} \
+        TESTS="$*" \
+        TEST_SUITE_LOG=run.log \
+        LOG_DRIVER_FLAGS="--verbose yes --color-tests yes" \
+        LOG_FLAGS="$log_flags" \
+        TEST_LARGE_MAP="${TEST_LARGE_MAP}" \
+        make -e check
     exit $?
 fi