From adaaf8c90daf2020cdbc21b7d9a772579c025eeb Mon Sep 17 00:00:00 2001 From: Petr Sklenar Date: Wed, 9 Oct 2019 15:30:52 +0200 Subject: [PATCH 1/2] add init test --- Sanity/rndc-and-pkcs11/Makefile | 64 +++++++++++++++++ Sanity/rndc-and-pkcs11/PURPOSE | 5 ++ Sanity/rndc-and-pkcs11/runtest.sh | 112 ++++++++++++++++++++++++++++++ 3 files changed, 181 insertions(+) create mode 100644 Sanity/rndc-and-pkcs11/Makefile create mode 100644 Sanity/rndc-and-pkcs11/PURPOSE create mode 100644 Sanity/rndc-and-pkcs11/runtest.sh diff --git a/Sanity/rndc-and-pkcs11/Makefile b/Sanity/rndc-and-pkcs11/Makefile new file mode 100644 index 0000000..5a34dfa --- /dev/null +++ b/Sanity/rndc-and-pkcs11/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/bind/Sanity/rndc-and-pkcs11 +# Description: rndc-and-pkcs11 +# Author: Petr Sklenar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2018 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/bind/Sanity/rndc-and-pkcs11 +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Petr Sklenar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: rndc-and-pkcs11" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) + @echo "RunFor: bind" >> $(METADATA) + @echo "Requires: bind softhsm bind-pkcs11 bind-pkcs11-utils dracut-fips" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 1501531" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/Sanity/rndc-and-pkcs11/PURPOSE b/Sanity/rndc-and-pkcs11/PURPOSE new file mode 100644 index 0000000..dcc6340 --- /dev/null +++ b/Sanity/rndc-and-pkcs11/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/bind/Sanity/rndc-and-pkcs11 +Description: rndc-and-pkcs11 +Author: Petr Sklenar +Bug summary: rndc does not support other algorithms than HMAC-MD5, which makes is to crash in FIPS mode +Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1501531 diff --git a/Sanity/rndc-and-pkcs11/runtest.sh b/Sanity/rndc-and-pkcs11/runtest.sh new file mode 100644 index 0000000..b4e5095 --- /dev/null +++ b/Sanity/rndc-and-pkcs11/runtest.sh @@ -0,0 +1,112 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/bind/Sanity/rndc-and-pkcs11 +# Description: rndc-and-pkcs11 +# Author: Petr Sklenar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2018 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="bind" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rm -rf /var/lib/softhsm/tokens/* + rm -rf /etc/rndc.key + rlPhaseEnd + + rlPhaseStartSetup +### SETUP + PIN='petr' + rlFileBackup /etc/sysconfig/named + rlFileBackup /etc/softhsm2.conf + rlFileBackup /var/lib/softhsm/tokens + export SOFTHSM2_CONF="/etc/softhsm2.conf" + export OPENSSL_FORCE_FIPS_MODE=1 + echo 'OPENSSL_FORCE_FIPS_MODE=1' >> /etc/sysconfig/named + rlRun "softhsm2-util --init-token --free --label rpm --pin $PIN --so-pin $PIN" + +### PERMISSIONS + TOKEN=$(ls /var/lib/softhsm/tokens) + echo $TOKEN + chgrp named -R /var/lib/softhsm/tokens/$TOKEN + chmod g+rX /var/lib/softhsm/tokens/$TOKEN + chgrp named -R /var/lib/softhsm/tokens + chmod g+rX -R /var/lib/softhsm/tokens + usermod -aG ods named + + +### START + rlRun "rlServiceStart named-pkcs11" + rlRun "service named-pkcs11 status" + +###DEBUG + rlLog "SOFTHSM2_CONF=`echo $SOFTHSM2_CONF`" + rlLog "pkcs11-tokens: `pkcs11-tokens`" + rlLog "/var/lib/softhsm/tokens `ls -lad /var/lib/softhsm/tokens;ls -la /var/lib/softhsm/tokens`" + rlPhaseEnd + + rlPhaseStartTest + rm -rf /etc/rndc.key + rlRun "service named-pkcs11 restart" + rlRun "rndc reload" + rlRun "pkcs11-tokens" + + for i in `seq 1 10`;do rndc reload;done + rlLog "/etc/rndc.key `cat /etc/rndc.key`" + rlRun "rndc reload" 0 + rlRun "rndc scan" 0 + rlRun "rndc sync" 0 + rlRun "rndc thaw" 0 + rlRun "service named-pkcs11 status" + rlPhaseEnd + + rlPhaseStartTest + rlRun "rndc-confgen -a" 0 + RETURN=0 # it depends on fips mode status + rlRun "service named-pkcs11 restart" 0 + for i in `seq 1 10`;do rndc reload;done + rlLog "/etc/rndc.key `cat /etc/rndc.key`" + rlRun "rndc reload" $RETURN + rlRun "rndc scan" $RETURN + rlRun "rndc sync" $RETURN + rlRun "rndc thaw" $RETURN + rlRun "service named-pkcs11 status" 0 "named-pkcs11 should survive" + rlRun "pgrep named-pkcs11" + rlPhaseEnd + + rlPhaseStartCleanup + unset OPENSSL_FORCE_FIPS_MODE + rlRun "service named-pkcs11 restart" 0 + rlServiceRestore named-pkcs11 + rm -rf /etc/softhsm2.conf /var/lib/softhsm/tokens + rlFileRestore + rlPhaseEnd + +rlJournalPrintText +rlJournalEnd From 886ed2dd1290c961e1a10af9815ca4febf449a91 Mon Sep 17 00:00:00 2001 From: Petr Sklenar Date: Wed, 9 Oct 2019 15:42:19 +0200 Subject: [PATCH 2/2] neco --- Sanity/rndc-and-pkcs11/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Sanity/rndc-and-pkcs11/Makefile b/Sanity/rndc-and-pkcs11/Makefile index 5a34dfa..2fd5e6a 100644 --- a/Sanity/rndc-and-pkcs11/Makefile +++ b/Sanity/rndc-and-pkcs11/Makefile @@ -24,7 +24,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ export TEST=/CoreOS/bind/Sanity/rndc-and-pkcs11 -export TESTVERSION=1.0 +export TESTVERSION=1.1 BUILT_FILES=