Copy of delv test with modifications
This commit is contained in:
Petr Menšík
parent
9b4f7282a7
commit
075c23ab29
3 changed files with 248 additions and 0 deletions
21
Sanity/utils/pkcs11-tools/main.fmf
Normal file
21
Sanity/utils/pkcs11-tools/main.fmf
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
summary: PKCS11 tools and operations test
|
||||
description: |
|
||||
Bug summary: PKCS11 key operations using tools
|
||||
Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1578128
|
||||
contact: Petr Sklenar <psklenar@redhat.com>
|
||||
test: ./runtest.sh
|
||||
framework: beakerlib
|
||||
duration: 15m
|
||||
enabled: true
|
||||
tag:
|
||||
- TIPpass
|
||||
link:
|
||||
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1578128
|
||||
adjust+:
|
||||
- enabled: false
|
||||
when: distro == rhel-4, rhel-5, rhel-6
|
||||
continue: false
|
||||
recommends+:
|
||||
- bind-utils
|
||||
- softhsm
|
||||
- opensc
|
||||
104
Sanity/utils/pkcs11-tools/runtest.sh
Executable file
104
Sanity/utils/pkcs11-tools/runtest.sh
Executable file
|
|
@ -0,0 +1,104 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/bind/Sanity/delv-smoke-test
|
||||
# Description: Test for BZ#1578128 ([RFE] Provide delv functionality)
|
||||
# Author: Petr Sklenar <psklenar@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2019 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
: ${PACKAGE:=bind}
|
||||
BACKUP_RESOLV=""
|
||||
SOURCE_RESOLV="/etc/resolv.conf"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE-utils
|
||||
rlRun "REAL_RESOLV=$(realpath /etc/resolv.conf)"
|
||||
rlRun "BACKUP_RESOLV=$(mktemp /etc/resolv-XXXXXX.conf)"
|
||||
rlRun "rm -f $BACKUP_RESOLV"
|
||||
rlRun -l "hostnamectl" 0-255 "Record type of used machine"
|
||||
if [ "$REAL_RESOLV" = /run/systemd/resolve/stub-resolv.conf ]; then
|
||||
rlWarning "systemd-resolved stub detected, temporary switching..."
|
||||
rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
|
||||
SOURCE_RESOLV="/run/systemd/resolve/resolv.conf"
|
||||
else
|
||||
rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
|
||||
SOURCE_RESOLV="$BACKUP_RESOLV"
|
||||
fi
|
||||
rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
|
||||
rlRun -l "cat /etc/resolv.conf"
|
||||
DNSSEC=""
|
||||
for NS in $(awk '$1 == "nameserver" { print $2 }' /etc/resolv.conf)
|
||||
do
|
||||
if dig +dnssec @$NS | grep -q RRSIG; then
|
||||
rlLog "nameserver $NS supports DNSSEC"
|
||||
DNSSEC=yes
|
||||
else
|
||||
rlLogWarning "nameserver $NS does not support DNSSEC!"
|
||||
rlRun -l "dig +short @$NS -t txt -c ch -q version.bind" 0 "Query version of server $NS"
|
||||
rlRun "sed -e '/$NS/ d' -i /etc/resolv.conf"
|
||||
fi
|
||||
rlRun -c "dig @$NS | grep -w RRSIG" 1 "Check signatures are not present always on $NS"
|
||||
done
|
||||
if [ -z "$DNSSEC" ]; then
|
||||
DNSSEC=no
|
||||
rlLogWarning "Infrastructure does not support DNSSEC at all!"
|
||||
rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
|
||||
fi
|
||||
rlRun -l "cat /etc/resolv.conf" 0 "after modifications"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlRun -l -s "delv redhat.com"
|
||||
rlAssertGrep 'IN' $rlRun_LOG
|
||||
rlRun -s "delv redhat.com soa +multi"
|
||||
rlAssertGrep 'serial' $rlRun_LOG
|
||||
rlRun -s "delv +multi +vtrace"
|
||||
rlRun "LINES=$(wc -l <$rlRun_LOG)"
|
||||
rlRun -l "cat $rlRun_LOG"
|
||||
rlAssertGreater "delv +vtrace should show few lines" "$LINES" "10"
|
||||
rlRun "delv +vtrace | grep 'fully validated'"
|
||||
if [ "$DNSSEC" = yes ]; then
|
||||
rlRun -s "delv"
|
||||
rlAssertGrep 'fully validated' $rlRun_LOG
|
||||
rlRun -s "delv example.net"
|
||||
rlAssertGrep 'fully validated' $rlRun_LOG
|
||||
rlRun -s "delv +vtrace fedoraproject.org"
|
||||
rlAssertGrep 'fully validated' $rlRun_LOG
|
||||
rlAssertGrep 'marking as secure' $rlRun_LOG
|
||||
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "rm -f $rlRun_LOG"
|
||||
if [ -n "$BACKUP_RESOLV" ]; then
|
||||
rlRun "rm -f /etc/resolv.conf"
|
||||
rlRun "mv $BACKUP_RESOLV /etc/resolv.conf"
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
123
Sanity/utils/pkcs11-tools/setup-named-softhsm.sh
Executable file
123
Sanity/utils/pkcs11-tools/setup-named-softhsm.sh
Executable file
|
|
@ -0,0 +1,123 @@
|
|||
#!/bin/sh
|
||||
#
|
||||
# This script will initialise token storage of softhsm PKCS11 provider
|
||||
# in custom location. Is useful to store tokens in non-standard location.
|
||||
#
|
||||
# Output can be evaluated from bash, it will prepare it for usage of temporary tokens.
|
||||
# Recommended use:
|
||||
# eval $(bash setup-named-softhsm.sh -A)
|
||||
#
|
||||
|
||||
SOFTHSM2_CONF="$1"
|
||||
TOKENPATH="$2"
|
||||
GROUPNAME="$3"
|
||||
# Do not use this script for real keys worth protection
|
||||
# This is intended for crypto accelerators using PKCS11 interface.
|
||||
# Uninitialized token would fail any crypto operation.
|
||||
PIN=1234
|
||||
SO_PIN=1234
|
||||
LABEL=rpm
|
||||
|
||||
set -e
|
||||
|
||||
echo_i()
|
||||
{
|
||||
echo "#" $@
|
||||
}
|
||||
|
||||
random()
|
||||
{
|
||||
if [ -x "$(which openssl 2>/dev/null)" ]; then
|
||||
openssl rand -base64 $1
|
||||
else
|
||||
dd if=/dev/urandom bs=1c count=$1 | base64
|
||||
fi
|
||||
}
|
||||
|
||||
usage()
|
||||
{
|
||||
echo "Usage: $0 -A [token directory] [group]"
|
||||
echo " or: $0 <config file> <token directory> [group]"
|
||||
}
|
||||
|
||||
if [ "$SOFTHSM2_CONF" = "-A" -a -z "$TOKENPATH" ]; then
|
||||
TOKENPATH=$(mktemp -d /var/tmp/softhsm-XXXXXX)
|
||||
fi
|
||||
|
||||
if [ -z "$SOFTHSM2_CONF" -o -z "$TOKENPATH" ]; then
|
||||
usage >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$SOFTHSM2_CONF" = "-A" ]; then
|
||||
# Automagic mode instead
|
||||
MODE=secure
|
||||
SOFTHSM2_CONF="$TOKENPATH/softhsm2.conf"
|
||||
PIN_SOURCE="$TOKENPATH/pin"
|
||||
SOPIN_SOURCE="$TOKENPATH/so-pin"
|
||||
TOKENPATH="$TOKENPATH/tokens"
|
||||
else
|
||||
MODE=legacy
|
||||
fi
|
||||
|
||||
[ -d "$TOKENPATH" ] || mkdir -p "$TOKENPATH"
|
||||
|
||||
umask 0022
|
||||
|
||||
if ! [ -f "$SOFTHSM2_CONF" ]; then
|
||||
cat << SED > "$SOFTHSM2_CONF"
|
||||
# SoftHSM v2 configuration file
|
||||
|
||||
directories.tokendir = ${TOKENPATH}
|
||||
objectstore.backend = file
|
||||
|
||||
# ERROR, WARNING, INFO, DEBUG
|
||||
log.level = ERROR
|
||||
|
||||
# If CKF_REMOVABLE_DEVICE flag should be set
|
||||
slots.removable = false
|
||||
SED
|
||||
else
|
||||
echo_i "Config file $SOFTHSM2_CONF already exists" >&2
|
||||
fi
|
||||
|
||||
if [ -n "$PIN_SOURCE" ]; then
|
||||
touch "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
chmod 0600 "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
if [ -n "$GROUPNAME" ]; then
|
||||
chgrp "$GROUPNAME" "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
chmod g+r "$PIN_SOURCE" "$SOPIN_SOURCE"
|
||||
fi
|
||||
fi
|
||||
|
||||
export SOFTHSM2_CONF
|
||||
|
||||
if softhsm2-util --show-slots | grep 'Initialized:[[:space:]]*yes' > /dev/null
|
||||
then
|
||||
echo_i "Token in ${TOKENPATH} is already initialized" >&2
|
||||
|
||||
[ -f "$PIN_SOURCE" ] && PIN=$(cat "$PIN_SOURCE")
|
||||
[ -f "$SOPIN_SOURCE" ] && SO_PIN=$(cat "$SOPIN_SOURCE")
|
||||
else
|
||||
PIN=$(random 6)
|
||||
SO_PIN=$(random 18)
|
||||
if [ -n "$PIN_SOURCE" ]; then
|
||||
echo -n "$PIN" > "$PIN_SOURCE"
|
||||
echo -n "$SO_PIN" > "$SOPIN_SOURCE"
|
||||
fi
|
||||
|
||||
echo_i "Initializing tokens to ${TOKENPATH}..."
|
||||
softhsm2-util --init-token --free --label "$LABEL" --pin "$PIN" --so-pin "$SO_PIN" | sed -e 's/^/# /'
|
||||
|
||||
if [ -n "$GROUPNAME" ]; then
|
||||
chgrp -R -- "$GROUPNAME" "$TOKENPATH"
|
||||
chmod -R -- g=rX,o= "$TOKENPATH"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "export SOFTHSM2_CONF=\"$SOFTHSM2_CONF\""
|
||||
echo "export PIN_SOURCE=\"$PIN_SOURCE\""
|
||||
echo "export SOPIN_SOURCE=\"$SOPIN_SOURCE\""
|
||||
# These are intentionaly not exported
|
||||
echo "PIN=\"$PIN\""
|
||||
echo "SO_PIN=\"$SO_PIN\""
|
||||
Loading…
Add table
Add a link
Reference in a new issue