Make test working with used engine
This commit is contained in:
Petr Menšík
parent
075c23ab29
commit
673709f10e
1 changed files with 94 additions and 57 deletions
|
|
@ -1,5 +1,5 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k expandtab sts=4
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/bind/Sanity/delv-smoke-test
|
||||
|
|
@ -31,73 +31,110 @@
|
|||
: ${PACKAGE:=bind}
|
||||
BACKUP_RESOLV=""
|
||||
SOURCE_RESOLV="/etc/resolv.conf"
|
||||
: ${ENGINE:=-E pkcs11}
|
||||
|
||||
make_openssl_conf() {
|
||||
cat << EOF
|
||||
HOME = .
|
||||
|
||||
# Use this in order to automatically load providers.
|
||||
openssl_conf = openssl_init
|
||||
|
||||
[openssl_init]
|
||||
providers = provider_sect
|
||||
|
||||
[provider_sect]
|
||||
default = default_sect
|
||||
pkcs11 = pkcs11_sect
|
||||
|
||||
[default_sect]
|
||||
activate = 1
|
||||
|
||||
[pkcs11_sect]
|
||||
module = ${PROVIDER_MODULE}
|
||||
pkcs11-module-path = ${SOFTHSM2_MODULE}
|
||||
pkcs11-module-token-pin = ${PIN_SOURCE}
|
||||
activate = 1
|
||||
EOF
|
||||
}
|
||||
|
||||
make_localhost_zone() {
|
||||
cat << 'EOF'
|
||||
$TTL 10m
|
||||
@ IN SOA @ rname.invalid. (
|
||||
0 ; serial
|
||||
1D ; refresh
|
||||
1H ; retry
|
||||
1W ; expire
|
||||
3H ) ; minimum
|
||||
NS @
|
||||
A 127.0.0.1
|
||||
AAAA ::1
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
pkcs11_tool_object_uri() {
|
||||
awk '"uri:" == $1 { print $2 }'
|
||||
}
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE-utils
|
||||
rlRun "REAL_RESOLV=$(realpath /etc/resolv.conf)"
|
||||
rlRun "BACKUP_RESOLV=$(mktemp /etc/resolv-XXXXXX.conf)"
|
||||
rlRun "rm -f $BACKUP_RESOLV"
|
||||
rlRun -l "hostnamectl" 0-255 "Record type of used machine"
|
||||
if [ "$REAL_RESOLV" = /run/systemd/resolve/stub-resolv.conf ]; then
|
||||
rlWarning "systemd-resolved stub detected, temporary switching..."
|
||||
rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
|
||||
SOURCE_RESOLV="/run/systemd/resolve/resolv.conf"
|
||||
else
|
||||
rlRun "mv /etc/resolv.conf $BACKUP_RESOLV"
|
||||
SOURCE_RESOLV="$BACKUP_RESOLV"
|
||||
|
||||
TmpDir="$(mktemp -d)"
|
||||
SETUP_SOFTHSM=`readlink -f setup-named-softhsm.sh`
|
||||
SOFTHSM2_MODULE="$(rpm -E '%{_libdir}/pkcs11/libsofthsm2.so')"
|
||||
PROVIDER_MODULE="$(rpm -E '%{_libdir}/ossl-modules/pkcs11.so')"
|
||||
# Used by OpenSSL
|
||||
PKCS11_PROVIDER_MODULE="$SOFTHSM2_MODULE"
|
||||
export PKCS11_PROVIDER_MODULE PROVIDER_MODULE
|
||||
export PKCS11_PROVIDER_DEBUG=file:$TmpDir/provider-debug.log,level:2
|
||||
|
||||
if [ -x "$SOFTHSM2_MODULE" ]; then
|
||||
export SOFTHSM2_MODULE
|
||||
fi
|
||||
rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
|
||||
rlRun -l "cat /etc/resolv.conf"
|
||||
DNSSEC=""
|
||||
for NS in $(awk '$1 == "nameserver" { print $2 }' /etc/resolv.conf)
|
||||
do
|
||||
if dig +dnssec @$NS | grep -q RRSIG; then
|
||||
rlLog "nameserver $NS supports DNSSEC"
|
||||
DNSSEC=yes
|
||||
else
|
||||
rlLogWarning "nameserver $NS does not support DNSSEC!"
|
||||
rlRun -l "dig +short @$NS -t txt -c ch -q version.bind" 0 "Query version of server $NS"
|
||||
rlRun "sed -e '/$NS/ d' -i /etc/resolv.conf"
|
||||
fi
|
||||
rlRun -c "dig @$NS | grep -w RRSIG" 1 "Check signatures are not present always on $NS"
|
||||
done
|
||||
if [ -z "$DNSSEC" ]; then
|
||||
DNSSEC=no
|
||||
rlLogWarning "Infrastructure does not support DNSSEC at all!"
|
||||
rlRun "cp $SOURCE_RESOLV /etc/resolv.conf"
|
||||
fi
|
||||
rlRun -l "cat /etc/resolv.conf" 0 "after modifications"
|
||||
|
||||
rlRun "softhsm2-util --show-slots | grep 'Initialized: *yes'" 1 "Check no slot is initialized already"
|
||||
rlRun "eval $(bash $SETUP_SOFTHSM -A)" 0 "Preparing PKCS#11 token slot"
|
||||
rlLog "Vars: conf=$SOFTHSM2_CONF pin=$PIN_SOURCE sopin=$SOPIN_SOURCE"
|
||||
|
||||
rlRun "pushd $TmpDir"
|
||||
rlRun "make_openssl_conf | tee openssl.conf" 0 "Make provider enabled OpenSSL configuration"
|
||||
rlRun "make_localhost_zone > test.zone" 0 "Create test zone"
|
||||
export OPENSSL_CONF="$TmpDir/openssl.conf"
|
||||
rlLog "OPENSSL_CONF=$TmpDir/openssl.conf"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlRun -l -s "delv redhat.com"
|
||||
rlAssertGrep 'IN' $rlRun_LOG
|
||||
rlRun -s "delv redhat.com soa +multi"
|
||||
rlAssertGrep 'serial' $rlRun_LOG
|
||||
rlRun -s "delv +multi +vtrace"
|
||||
rlRun "LINES=$(wc -l <$rlRun_LOG)"
|
||||
rlRun -l "cat $rlRun_LOG"
|
||||
rlAssertGreater "delv +vtrace should show few lines" "$LINES" "10"
|
||||
rlRun "delv +vtrace | grep 'fully validated'"
|
||||
if [ "$DNSSEC" = yes ]; then
|
||||
rlRun -s "delv"
|
||||
rlAssertGrep 'fully validated' $rlRun_LOG
|
||||
rlRun -s "delv example.net"
|
||||
rlAssertGrep 'fully validated' $rlRun_LOG
|
||||
rlRun -s "delv +vtrace fedoraproject.org"
|
||||
rlAssertGrep 'fully validated' $rlRun_LOG
|
||||
rlAssertGrep 'marking as secure' $rlRun_LOG
|
||||
rlPhaseStartSetup "Prepare token"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -L" 0 "check slots"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -T" 0 "check tokens"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:2048 --label test-zsk" 0 "generate new pair"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:4096 --label test-ksk" 0 "generate new pair"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -O" 0 "check objects saved"
|
||||
rlRun "ZSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN -O --label test-zsk --type privkey | pkcs11_tool_object_uri)" 0 "Obtain slot zsk URI"
|
||||
rlRun "KSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN -O --label test-ksk --type privkey | pkcs11_tool_object_uri)" 0 "Obtain slot ksk URI"
|
||||
rlRun "test -n \"$ZSK_URI\"" 0 "Check URI were obtained"
|
||||
rlRun "test -n \"$KSK_URI\"" 0 "Check URI were obtained"
|
||||
rlRun "openssl pkey -in '$ZSK_URI?pin-source=$PIN_SOURCE' -check" 0,1 "Test OpenSSL knows the public ZSK key"
|
||||
rlRun "openssl pkey -in '$KSK_URI?pin-source=$PIN_SOURCE' -check" 0,1 "Test OpenSSL knows the public KSK key"
|
||||
rlPhaseEnd
|
||||
|
||||
fi
|
||||
rlPhaseStartTest "Test DNSSEC operations on token"
|
||||
rlRun "dnssec-keyfromlabel -a RSASHA256 $ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" test" 0 "Import dnssec ZSK"
|
||||
rlRun "dnssec-keyfromlabel -a RSASHA256 $ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK test" 0 "Import dnssec KSK"
|
||||
rlRun "dnssec-signzone $ENGINE -S -o test test.zone" 0 "Create zone signatures"
|
||||
rlRun "test -e test.zone.signed" 0 "Check signed zone were created."
|
||||
rlRun "dnssec-verify $ENGINE -o test test.zone.signed" 0 "Check zone were signed ok"
|
||||
rlRun "named-checkzone test test.zone"
|
||||
rlRun "named-checkzone test test.zone.signed"
|
||||
[ "$DEBUG" = y ] && PS1="test-debug $PS1" bash -i
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
rlRun "rm -f $rlRun_LOG"
|
||||
if [ -n "$BACKUP_RESOLV" ]; then
|
||||
rlRun "rm -f /etc/resolv.conf"
|
||||
rlRun "mv $BACKUP_RESOLV /etc/resolv.conf"
|
||||
fi
|
||||
rlRun "softhsm2-util --token rpm --delete-token"
|
||||
rlRun "popd"
|
||||
rlRun "rm -rf $TmpDir"
|
||||
rlPhaseEnd
|
||||
|
||||
rlJournalPrintText
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue