Petr Menšík
GitHub
commit
e469b41b7f
3 changed files with 181 additions and 0 deletions
64
Sanity/rndc-and-pkcs11/Makefile
Normal file
64
Sanity/rndc-and-pkcs11/Makefile
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Makefile of /CoreOS/bind/Sanity/rndc-and-pkcs11
|
||||
# Description: rndc-and-pkcs11
|
||||
# Author: Petr Sklenar <psklenar@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2018 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
export TEST=/CoreOS/bind/Sanity/rndc-and-pkcs11
|
||||
export TESTVERSION=1.1
|
||||
|
||||
BUILT_FILES=
|
||||
|
||||
FILES=$(METADATA) runtest.sh Makefile PURPOSE
|
||||
|
||||
.PHONY: all install download clean
|
||||
|
||||
run: $(FILES) build
|
||||
./runtest.sh
|
||||
|
||||
build: $(BUILT_FILES)
|
||||
test -x runtest.sh || chmod a+x runtest.sh
|
||||
|
||||
clean:
|
||||
rm -f *~ $(BUILT_FILES)
|
||||
|
||||
|
||||
include /usr/share/rhts/lib/rhts-make.include
|
||||
|
||||
$(METADATA): Makefile
|
||||
@echo "Owner: Petr Sklenar <psklenar@redhat.com>" > $(METADATA)
|
||||
@echo "Name: $(TEST)" >> $(METADATA)
|
||||
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
|
||||
@echo "Path: $(TEST_DIR)" >> $(METADATA)
|
||||
@echo "Description: rndc-and-pkcs11" >> $(METADATA)
|
||||
@echo "Type: Sanity" >> $(METADATA)
|
||||
@echo "TestTime: 20m" >> $(METADATA)
|
||||
@echo "RunFor: bind" >> $(METADATA)
|
||||
@echo "Requires: bind softhsm bind-pkcs11 bind-pkcs11-utils dracut-fips" >> $(METADATA)
|
||||
@echo "Priority: Normal" >> $(METADATA)
|
||||
@echo "License: GPLv2+" >> $(METADATA)
|
||||
@echo "Confidential: no" >> $(METADATA)
|
||||
@echo "Destructive: no" >> $(METADATA)
|
||||
@echo "Bug: 1501531" >> $(METADATA)
|
||||
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
|
||||
|
||||
rhts-lint $(METADATA)
|
||||
5
Sanity/rndc-and-pkcs11/PURPOSE
Normal file
5
Sanity/rndc-and-pkcs11/PURPOSE
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
PURPOSE of /CoreOS/bind/Sanity/rndc-and-pkcs11
|
||||
Description: rndc-and-pkcs11
|
||||
Author: Petr Sklenar <psklenar@redhat.com>
|
||||
Bug summary: rndc does not support other algorithms than HMAC-MD5, which makes is to crash in FIPS mode
|
||||
Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1501531
|
||||
112
Sanity/rndc-and-pkcs11/runtest.sh
Normal file
112
Sanity/rndc-and-pkcs11/runtest.sh
Normal file
|
|
@ -0,0 +1,112 @@
|
|||
#!/bin/bash
|
||||
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# runtest.sh of /CoreOS/bind/Sanity/rndc-and-pkcs11
|
||||
# Description: rndc-and-pkcs11
|
||||
# Author: Petr Sklenar <psklenar@redhat.com>
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
#
|
||||
# Copyright (c) 2018 Red Hat, Inc.
|
||||
#
|
||||
# This program is free software: you can redistribute it and/or
|
||||
# modify it under the terms of the GNU General Public License as
|
||||
# published by the Free Software Foundation, either version 2 of
|
||||
# the License, or (at your option) any later version.
|
||||
#
|
||||
# This program is distributed in the hope that it will be
|
||||
# useful, but WITHOUT ANY WARRANTY; without even the implied
|
||||
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
||||
# PURPOSE. See the GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program. If not, see http://www.gnu.org/licenses/.
|
||||
#
|
||||
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||
|
||||
# Include Beaker environment
|
||||
. /usr/bin/rhts-environment.sh || exit 1
|
||||
. /usr/share/beakerlib/beakerlib.sh || exit 1
|
||||
|
||||
PACKAGE="bind"
|
||||
|
||||
rlJournalStart
|
||||
rlPhaseStartSetup
|
||||
rlAssertRpm $PACKAGE
|
||||
rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
|
||||
rlRun "pushd $TmpDir"
|
||||
rm -rf /var/lib/softhsm/tokens/*
|
||||
rm -rf /etc/rndc.key
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartSetup
|
||||
### SETUP
|
||||
PIN='petr'
|
||||
rlFileBackup /etc/sysconfig/named
|
||||
rlFileBackup /etc/softhsm2.conf
|
||||
rlFileBackup /var/lib/softhsm/tokens
|
||||
export SOFTHSM2_CONF="/etc/softhsm2.conf"
|
||||
export OPENSSL_FORCE_FIPS_MODE=1
|
||||
echo 'OPENSSL_FORCE_FIPS_MODE=1' >> /etc/sysconfig/named
|
||||
rlRun "softhsm2-util --init-token --free --label rpm --pin $PIN --so-pin $PIN"
|
||||
|
||||
### PERMISSIONS
|
||||
TOKEN=$(ls /var/lib/softhsm/tokens)
|
||||
echo $TOKEN
|
||||
chgrp named -R /var/lib/softhsm/tokens/$TOKEN
|
||||
chmod g+rX /var/lib/softhsm/tokens/$TOKEN
|
||||
chgrp named -R /var/lib/softhsm/tokens
|
||||
chmod g+rX -R /var/lib/softhsm/tokens
|
||||
usermod -aG ods named
|
||||
|
||||
|
||||
### START
|
||||
rlRun "rlServiceStart named-pkcs11"
|
||||
rlRun "service named-pkcs11 status"
|
||||
|
||||
###DEBUG
|
||||
rlLog "SOFTHSM2_CONF=`echo $SOFTHSM2_CONF`"
|
||||
rlLog "pkcs11-tokens: `pkcs11-tokens`"
|
||||
rlLog "/var/lib/softhsm/tokens `ls -lad /var/lib/softhsm/tokens;ls -la /var/lib/softhsm/tokens`"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rm -rf /etc/rndc.key
|
||||
rlRun "service named-pkcs11 restart"
|
||||
rlRun "rndc reload"
|
||||
rlRun "pkcs11-tokens"
|
||||
|
||||
for i in `seq 1 10`;do rndc reload;done
|
||||
rlLog "/etc/rndc.key `cat /etc/rndc.key`"
|
||||
rlRun "rndc reload" 0
|
||||
rlRun "rndc scan" 0
|
||||
rlRun "rndc sync" 0
|
||||
rlRun "rndc thaw" 0
|
||||
rlRun "service named-pkcs11 status"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest
|
||||
rlRun "rndc-confgen -a" 0
|
||||
RETURN=0 # it depends on fips mode status
|
||||
rlRun "service named-pkcs11 restart" 0
|
||||
for i in `seq 1 10`;do rndc reload;done
|
||||
rlLog "/etc/rndc.key `cat /etc/rndc.key`"
|
||||
rlRun "rndc reload" $RETURN
|
||||
rlRun "rndc scan" $RETURN
|
||||
rlRun "rndc sync" $RETURN
|
||||
rlRun "rndc thaw" $RETURN
|
||||
rlRun "service named-pkcs11 status" 0 "named-pkcs11 should survive"
|
||||
rlRun "pgrep named-pkcs11"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
unset OPENSSL_FORCE_FIPS_MODE
|
||||
rlRun "service named-pkcs11 restart" 0
|
||||
rlServiceRestore named-pkcs11
|
||||
rm -rf /etc/softhsm2.conf /var/lib/softhsm/tokens
|
||||
rlFileRestore
|
||||
rlPhaseEnd
|
||||
|
||||
rlJournalPrintText
|
||||
rlJournalEnd
|
||||
Loading…
Add table
Add a link
Reference in a new issue