mirror of
https://github.com/isc-projects/bind9.git
synced 2026-02-28 20:41:18 -05:00
147 lines
4 KiB
Bash
147 lines
4 KiB
Bash
#!/bin/sh
|
|
#
|
|
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
#
|
|
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
#
|
|
# See the COPYRIGHT file distributed with this work for additional
|
|
# information regarding copyright ownership.
|
|
|
|
set -e
|
|
|
|
SYSTEMTESTTOP=..
|
|
# shellcheck source=conf.sh
|
|
. "$SYSTEMTESTTOP/conf.sh"
|
|
|
|
count_rrsigs() (
|
|
grep -c "IN[[:space:]]*RRSIG" "$@" || true
|
|
)
|
|
|
|
dig_with_opts() (
|
|
$DIG +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@"
|
|
)
|
|
|
|
dig_for_rr() (
|
|
alg=$1
|
|
rrtype=$2
|
|
count0=$3
|
|
dig_with_opts "$alg.example." @10.53.0.1 "$rrtype" > "dig.out.$rrtype.$alg" &&
|
|
count=$(count_rrsigs "dig.out.$rrtype.$alg") &&
|
|
test "$count" -gt "$count0"
|
|
)
|
|
|
|
test_done() {
|
|
if [ $ret -ne 0 ]; then echo_i "failed"; fi
|
|
status=$((status+ret))
|
|
ret=0
|
|
}
|
|
|
|
status=0
|
|
ret=0
|
|
|
|
n=0
|
|
while read -r alg; do
|
|
zonefile=ns1/$alg.example.db
|
|
echo_i "testing PKCS#11 key generation ($alg)"
|
|
count=$($PK11LIST | grep -c "pkcs11-$alg-ksk" || true)
|
|
[ "$count" -eq 4 ] || ret=1
|
|
test_done
|
|
|
|
echo_i "testing offline signing with PKCS#11 keys ($alg)"
|
|
|
|
count=$(grep -c "[0-9][[:space:]]*RRSIG" "$zonefile.signed")
|
|
[ "$count" -eq 9 ] || ret=1
|
|
test_done
|
|
|
|
echo_i "testing inline signing with new PKCS#11 ZSK ($alg)"
|
|
|
|
dig_with_opts "$alg.example." @10.53.0.1 "SOA" > "dig.out.SOA.$alg.0" || ret=1
|
|
countSOA0=$(count_rrsigs "dig.out.SOA.$alg.0")
|
|
new_zsk=$(grep -v ';' "ns1/$alg.zsk")
|
|
|
|
cat > "upd.cmd.ZSK.$alg" <<EOF
|
|
server 10.53.0.1 $PORT
|
|
ttl 300
|
|
zone $alg.example.
|
|
update add $new_zsk
|
|
send
|
|
EOF
|
|
|
|
$NSUPDATE -v > "upd.log.ZSK.$alg" < "upd.cmd.ZSK.$alg" || ret=1
|
|
|
|
retry_quiet 20 dig_for_rr "$alg" "SOA" "$countSOA0" || ret=1
|
|
test_done
|
|
|
|
echo_i "testing inline signing with new PKCS#11 KSK ($alg)"
|
|
|
|
dig_with_opts "$alg.example." @10.53.0.1 "DNSKEY" > "dig.out.DNSKEY.$alg.0" || ret=1
|
|
countDNSKEY0=$(count_rrsigs "dig.out.DNSKEY.$alg.0")
|
|
new_ksk=$(grep -v ';' "ns1/$alg.ksk")
|
|
|
|
cat > "upd.cmd.KSK.$alg" <<EOF
|
|
server 10.53.0.1 $PORT
|
|
ttl 300
|
|
zone $alg.example.
|
|
update add $new_ksk
|
|
send
|
|
EOF
|
|
|
|
$NSUPDATE -v > "upd.log.KSK.$alg" < "upd.cmd.KSK.$alg" || ret=1
|
|
|
|
retry_quiet 20 dig_for_rr "$alg" "DNSKEY" "$countDNSKEY0" || ret=1
|
|
test_done
|
|
|
|
echo_i "testing PKCS#11 key destroy ($alg)"
|
|
|
|
# Lookup all existing keys
|
|
echo_i "looking up all existing keys ($alg)"
|
|
$PK11LIST > "pkcs11-list.out.id.$alg" || ret=1
|
|
test_done
|
|
|
|
echo_i "destroying key with 'pkcs11-$alg-ksk1' label ($alg)"
|
|
$PK11DEL -l "pkcs11-$alg-ksk1" > /dev/null 2>&1 || ret=1
|
|
test_done
|
|
|
|
echo_i "destroying key with 'pkcs11-$alg-zsk1' label ($alg)"
|
|
$PK11DEL -l "pkcs11-$alg-zsk1" > /dev/null 2>&1 || ret=1
|
|
test_done
|
|
|
|
id=$(awk -v label="'pkcs11-$alg-ksk2'" '{ if ($7 == label) { print $9; exit; } }' < "pkcs11-list.out.id.$alg")
|
|
echo_i "destroying key with $id id ($alg)"
|
|
if [ -n "$id" ]; then
|
|
$PK11DEL -i "$id" > /dev/null 2>&1 || ret=1
|
|
else
|
|
ret=1
|
|
fi
|
|
test_done
|
|
|
|
id=$(awk -v label="'pkcs11-$alg-zsk2'" '{ if ($7 == label) { print $9; exit; } }' < "pkcs11-list.out.id.$alg")
|
|
echo_i "destroying key with $id id ($alg)"
|
|
if [ -n "$id" ]; then
|
|
$PK11DEL -i "$id" > /dev/null 2>&1 || ret=1
|
|
else
|
|
ret=1
|
|
fi
|
|
test_done
|
|
|
|
echo_i "checking if all keys have been destroyed ($alg)"
|
|
$PK11LIST > "pkcs11-list.out.$alg" || ret=1
|
|
count=$(grep -c "pkcs11-$alg-[kz]sk[0-9]*" "pkcs11-list.out.$alg" || true)
|
|
[ "$count" -eq 0 ] || ret=1
|
|
test_done
|
|
n=$((n+1))
|
|
done < supported
|
|
|
|
echo_i "Checking if all supported algorithms were tested"
|
|
[ "$n" -eq "$(wc -l < supported)" ] || ret=1
|
|
test_done
|
|
|
|
echo_i "Checking for assertion failure in pk11_numbits()"
|
|
$PERL ../packet.pl -a "10.53.0.1" -p "$PORT" -t udp 2037-pk11_numbits-crash-test.pkt
|
|
dig_with_opts @10.53.0.1 version.bind. CH TXT > dig.out.pk11_numbits || ret=1
|
|
test_done
|
|
|
|
echo_i "exit status: $status"
|
|
[ "$status" -eq 0 ] || exit 1
|