Prepare more separated zone processing
This commit is contained in:
Petr Menšík
parent
ce5efed7cb
commit
f95d760c0f
2 changed files with 44 additions and 32 deletions
|
|
@ -1,7 +1,9 @@
|
|||
summary: PKCS11 tools and operations test
|
||||
description: |
|
||||
Bug summary: PKCS11 key operations using tools
|
||||
Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1578128
|
||||
Issue link: https://issues.redhat.com/browse/RHEL-33729
|
||||
Generate softhsm token RSA keys, each for KSK and ZSK.
|
||||
Then use bind tools to actually create small signed content and verify it is dnssec compatible.
|
||||
contact: Petr Mensik <pemensik@redhat.com>
|
||||
test: ./runtest.sh
|
||||
framework: beakerlib
|
||||
|
|
@ -10,7 +12,7 @@ enabled: true
|
|||
tag:
|
||||
- TIPpass
|
||||
link:
|
||||
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1578128
|
||||
- relates: https://issues.redhat.com/browse/RHEL-33729
|
||||
adjust+:
|
||||
- enabled: false
|
||||
when: distro == rhel-4, rhel-5, rhel-6
|
||||
|
|
@ -21,3 +23,4 @@ recommend+:
|
|||
- softhsm
|
||||
- opensc
|
||||
- pkcs11-provider
|
||||
- openssl-engine
|
||||
|
|
|
|||
|
|
@ -105,29 +105,9 @@ rlJournalStart
|
|||
rlRun "make_openssl_conf | tee openssl.conf" 0 "Make provider enabled OpenSSL configuration"
|
||||
rlRun "make_localhost_zone > test.zone" 0 "Create test zone"
|
||||
export OPENSSL_CONF="$TmpDir/openssl.conf"
|
||||
rlLog "OPENSSL_CONF=$TmpDir/openssl.conf"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartSetup "Prepare token"
|
||||
# This test prepares token to be used by the root user, not really complicating it with file access rights.
|
||||
# It may not emulare properly what is used by named
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -L" 0 "check slots"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -T" 0 "check tokens"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:2048 --label test-zsk" 0 "generate new pair"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:4096 --label test-ksk" 0 "generate new pair"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -O" 0 "check objects saved"
|
||||
rlRun "ZSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE -O --label test-zsk --type pubkey | pkcs11_tool_object_uri)" 0 "Obtain slot zsk URI"
|
||||
rlRun "KSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE -O --label test-ksk --type pubkey | pkcs11_tool_object_uri)" 0 "Obtain slot ksk URI"
|
||||
rlRun "ZSK_URI=\"${ZSK_URI%;type=public}\"" 0 "Remove public type from ZSK URI"
|
||||
rlRun "KSK_URI=\"${KSK_URI%;type=public}\"" 0 "Remove public type from KSK URI"
|
||||
rlRun "test -n \"$ZSK_URI\"" 0 "Check URI were obtained"
|
||||
rlRun "test -n \"$KSK_URI\"" 0 "Check URI were obtained"
|
||||
rlRun "openssl pkey -in '$ZSK_URI?pin-source=$PIN_SOURCE' -check" 0,1 "Test OpenSSL knows the public ZSK key"
|
||||
rlRun "openssl pkey -in '$KSK_URI?pin-source=$PIN_SOURCE' -check" 0,1 "Test OpenSSL knows the public KSK key"
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Test DNSSEC operations on token"
|
||||
rlLog "OPENSSL_CONF=$OPENSSL_CONF"
|
||||
DNSSEC_ENGINE=""
|
||||
OSSL_ENGINE=""
|
||||
if [ "$USE_ENGINE" = auto ]; then
|
||||
if rlIsRHEL '<10' || rlIsFedora '<32' || rlIsCentOS '<10'; then
|
||||
USE_ENGINE='y'
|
||||
|
|
@ -136,17 +116,46 @@ rlJournalStart
|
|||
if [ "$USE_ENGINE" = y ]; then
|
||||
rlLog "Using OpenSSL engine, legacy mode"
|
||||
DNSSEC_ENGINE="-E $ENGINE"
|
||||
OSSL_ENGINE="-engine $ENGINE"
|
||||
else
|
||||
rlLog "Not using engine, using OpenSSL provider"
|
||||
fi
|
||||
rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" test" 0 "Import dnssec ZSK"
|
||||
rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK test" 0 "Import dnssec KSK"
|
||||
rlRun "dnssec-signzone $DNSSEC_ENGINE -S -o test test.zone" 0 "Create zone signatures"
|
||||
rlRun "test -e test.zone.signed" 0 "Check signed zone were created."
|
||||
rlRun "dnssec-verify $DNSSEC_ENGINE -o test test.zone.signed" 0 "Check zone were signed ok"
|
||||
rlRun "named-checkzone test test.zone"
|
||||
rlRun "named-checkzone test test.zone.signed"
|
||||
[ "$DEBUG" = y ] && PS1="test-debug $PS1" bash -i
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartSetup "Prepare token"
|
||||
# This test prepares token to be used by the root user, not really complicating it with file access rights.
|
||||
# It may not emulare properly what is used by named
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -L" 0 "check slots"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -T" 0 "check tokens"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:2048 --label test-zsk" 0 "generate new pair"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE --pin $PIN --keypairgen --key-type RSA:4096 --label test-ksk" 0 "generate new pair"
|
||||
rlRun "pkcs11-tool --module $SOFTHSM2_MODULE -O" 0 "check objects saved"
|
||||
rlRun "ZSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE -O --label test-zsk --type pubkey | pkcs11_tool_object_uri)" 0 "Obtain slot zsk URI"
|
||||
rlRun "KSK_URI=\$(pkcs11-tool --module $SOFTHSM2_MODULE -O --label test-ksk --type pubkey | pkcs11_tool_object_uri)" 0 "Obtain slot ksk URI"
|
||||
rlRun "ZSK_URI=\"${ZSK_URI%;type=public}\"" 0 "Remove public type from ZSK URI"
|
||||
rlRun "KSK_URI=\"${KSK_URI%;type=public}\"" 0 "Remove public type from KSK URI"
|
||||
rlRun "test -n \"$ZSK_URI\"" 0 "Check URI were obtained"
|
||||
rlRun "test -n \"$KSK_URI\"" 0 "Check URI were obtained"
|
||||
rlRun "openssl pkey $OSSL_ENGINE -in '$KSK_URI?pin-source=$PIN_SOURCE' -pubout" 0,1 "Test OpenSSL knows the public KSK key"
|
||||
rlRun "openssl pkey $OSSL_ENGINE -in '$ZSK_URI?pin-source=$PIN_SOURCE' -pubout" 0,1 "Test OpenSSL knows the public ZSK key"
|
||||
if openssl storeutl -help >& /dev/null; then
|
||||
rlRun "openssl storeutl $OSSL_ENGINE -text '$KSK_URI?pin-source=$PIN_SOURCE'" 0,1 "Test OpenSSL knows the public KSK key"
|
||||
rlRun "openssl storeutl $OSSL_ENGINE -text '$ZSK_URI?pin-source=$PIN_SOURCE'" 0,1 "Test OpenSSL knows the public ZSK key"
|
||||
fi
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartTest "Test DNSSEC operations on token"
|
||||
rlRun "ORIGIN='test'"
|
||||
rlRun "ZONEFILE='test.zone'"
|
||||
rlRun "SIGNEDFILE='test.zone.signed'"
|
||||
rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$ZSK_URI?pin-source=$PIN_SOURCE\" $ORIGIN" 0 "Import dnssec ZSK"
|
||||
rlRun "dnssec-keyfromlabel -a RSASHA256 $DNSSEC_ENGINE -l \"$KSK_URI?pin-source=$PIN_SOURCE\" -f KSK $ORIGIN" 0 "Import dnssec KSK"
|
||||
rlRun "dnssec-signzone $DNSSEC_ENGINE -S -o $ORIGIN -f $SIGNEDFILE $ZONEFILE" 0 "Create zone signatures"
|
||||
rlRun "test -e $SIGNEDFILE" 0 "Check signed zone were created."
|
||||
rlRun "dnssec-verify $DNSSEC_ENGINE -o $ORIGIN $SIGNEDFILE" 0 "Check zone were signed ok"
|
||||
rlRun "named-checkzone $ORIGIN $ZONEFILE" 0 "Validate input zone file"
|
||||
rlRun "named-checkzone $ORIGIN $SIGNEDFILE" 0 "Validate signed zone file"
|
||||
[ "$DEBUG" = y ] && PS1="test-debug $PS1" bash -i
|
||||
rlPhaseEnd
|
||||
|
||||
rlPhaseStartCleanup
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue