OpenDNSSEC-libhsm  2.0.4
hsmtest.c
Go to the documentation of this file.
1 /*
2  * Copyright (c) 2009 Nominet UK.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  * notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  * notice, this list of conditions and the following disclaimer in the
12  * documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
16  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
18  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
20  * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
21  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
22  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
23  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
24  * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include "config.h"
28 
29 #include <stdio.h>
30 #include <string.h>
31 #include <stdlib.h>
32 #include <unistd.h>
33 
34 #include "libhsm.h"
35 #include <libhsmdns.h>
36 #include "hsmtest.h"
37 
38 static int
39 hsm_test_sign (hsm_ctx_t *ctx, libhsm_key_t *key, ldns_algorithm alg)
40 {
41  int result;
42  ldns_rr_list *rrset;
43  ldns_rr *rr, *sig, *dnskey_rr;
44  ldns_status status;
45  hsm_sign_params_t *sign_params;
46 
47  rrset = ldns_rr_list_new();
48 
49  status = ldns_rr_new_frm_str(&rr, "example.com. IN A 192.168.0.1", 0, NULL, NULL);
50  if (status == LDNS_STATUS_OK) ldns_rr_list_push_rr(rrset, rr);
51 
52  status = ldns_rr_new_frm_str(&rr, "example.com. IN A 192.168.0.2", 0, NULL, NULL);
53  if (status == LDNS_STATUS_OK) ldns_rr_list_push_rr(rrset, rr);
54 
55  sign_params = hsm_sign_params_new();
56  sign_params->algorithm = alg;
57  sign_params->owner = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, "example.com.");
58  dnskey_rr = hsm_get_dnskey(ctx, key, sign_params);
59  sign_params->keytag = ldns_calc_keytag(dnskey_rr);
60 
61  sig = hsm_sign_rrset(ctx, rrset, key, sign_params);
62  if (sig) {
63  result = 0;
64  ldns_rr_free(sig);
65  } else {
66  result = 1;
67  }
68 
69  ldns_rr_list_deep_free(rrset);
70  hsm_sign_params_free(sign_params);
71  ldns_rr_free(dnskey_rr);
72 
73  return result;
74 }
75 
76 static int
77 hsm_test_random(hsm_ctx_t *ctx)
78 {
79  int result;
80  unsigned char rnd_buf[1024];
81  uint32_t r32;
82  uint64_t r64;
83 
84  printf("Generating %lu bytes of random data... ",
85  (unsigned long) sizeof(rnd_buf));
86  result = hsm_random_buffer(ctx, rnd_buf, sizeof(rnd_buf));
87  if (result) {
88  printf("Failed, error: %d\n", result);
89  hsm_print_error(ctx);
90  return 1;
91  } else {
92  printf("OK\n");
93  }
94 
95  printf("Generating 32-bit random data... ");
96  r32 = hsm_random32(ctx);
97  printf("%u\n", r32);
98 
99  printf("Generating 64-bit random data... ");
100  r64 = hsm_random64(ctx);
101  printf("%llu\n", (long long unsigned int)r64);
102 
103  return 0;
104 }
105 
106 int
107 hsm_test (const char *repository, hsm_ctx_t* ctx)
108 {
109  int result;
110  const unsigned int rsa_keysizes[] = { 512, 768, 1024, 1536, 2048, 4096 };
111  const unsigned int dsa_keysizes[] = { 512, 768, 1024 };
112  unsigned int keysize;
113 /* TODO: We can remove the directive if we require LDNS >= 1.6.13 */
114 #if !defined LDNS_BUILD_CONFIG_USE_ECDSA || LDNS_BUILD_CONFIG_USE_ECDSA
115  const ldns_algorithm ec_curves[] = {
116  LDNS_ECDSAP256SHA256,
117  LDNS_ECDSAP384SHA384
118  };
119  ldns_algorithm curve;
120 #endif
121 
122  libhsm_key_t *key = NULL;
123  char *id;
124  int errors = 0;
125  unsigned int i = 0;
126 
127  /* Check for repository before starting any tests */
128  if (hsm_token_attached(ctx, repository) == 0) {
129  hsm_print_error(ctx);
130  return 1;
131  }
132 
133  /*
134  * Test key generation, signing and deletion for a number of key size
135  */
136  for (i=0; i<(sizeof(rsa_keysizes)/sizeof(unsigned int)); i++) {
137  keysize = rsa_keysizes[i];
138 
139  printf("Generating %d-bit RSA key... ", keysize);
140  key = hsm_generate_rsa_key(ctx, repository, keysize);
141  if (!key) {
142  errors++;
143  printf("Failed\n");
144  hsm_print_error(ctx);
145  printf("\n");
146  continue;
147  } else {
148  printf("OK\n");
149  }
150 
151  printf("Extracting key identifier... ");
152  id = hsm_get_key_id(ctx, key);
153  if (!id) {
154  errors++;
155  printf("Failed\n");
156  hsm_print_error(ctx);
157  printf("\n");
158  } else {
159  printf("OK, %s\n", id);
160  }
161  free(id);
162 
163  printf("Signing (RSA/SHA1) with key... ");
164  result = hsm_test_sign(ctx, key, LDNS_RSASHA1);
165  if (result) {
166  errors++;
167  printf("Failed, error: %d\n", result);
168  hsm_print_error(ctx);
169  } else {
170  printf("OK\n");
171  }
172 
173  printf("Signing (RSA/SHA256) with key... ");
174  result = hsm_test_sign(ctx, key, LDNS_RSASHA256);
175  if (result) {
176  errors++;
177  printf("Failed, error: %d\n", result);
178  hsm_print_error(ctx);
179  } else {
180  printf("OK\n");
181  }
182 
183  if ( keysize >= 1024) {
184  printf("Signing (RSA/SHA512) with key... ");
185  result = hsm_test_sign(ctx, key, LDNS_RSASHA512);
186  if (result) {
187  errors++;
188  printf("Failed, error: %d\n", result);
189  hsm_print_error(ctx);
190  } else {
191  printf("OK\n");
192  }
193  }
194 
195  printf("Deleting key... ");
196  result = hsm_remove_key(ctx, key);
197  if (result) {
198  errors++;
199  printf("Failed: error: %d\n", result);
200  hsm_print_error(ctx);
201  } else {
202  printf("OK\n");
203  }
204 
205  free(key);
206 
207  printf("\n");
208  }
209 
210  /*
211  * Test key generation, signing and deletion for a number of key size
212  */
213  for (i=0; i<(sizeof(dsa_keysizes)/sizeof(unsigned int)); i++) {
214  keysize = dsa_keysizes[i];
215 
216  printf("Generating %d-bit DSA key... ", keysize);
217  key = hsm_generate_dsa_key(ctx, repository, keysize);
218  if (!key) {
219  errors++;
220  printf("Failed\n");
221  hsm_print_error(ctx);
222  printf("\n");
223  continue;
224  } else {
225  printf("OK\n");
226  }
227 
228  printf("Extracting key identifier... ");
229  id = hsm_get_key_id(ctx, key);
230  if (!id) {
231  errors++;
232  printf("Failed\n");
233  hsm_print_error(ctx);
234  printf("\n");
235  } else {
236  printf("OK, %s\n", id);
237  }
238  free(id);
239 
240  printf("Signing (DSA/SHA1) with key... ");
241  result = hsm_test_sign(ctx, key, LDNS_DSA);
242  if (result) {
243  errors++;
244  printf("Failed, error: %d\n", result);
245  hsm_print_error(ctx);
246  } else {
247  printf("OK\n");
248  }
249 
250  printf("Deleting key... ");
251  result = hsm_remove_key(ctx, key);
252  if (result) {
253  errors++;
254  printf("Failed: error: %d\n", result);
255  hsm_print_error(ctx);
256  } else {
257  printf("OK\n");
258  }
259 
260  free(key);
261 
262  printf("\n");
263  }
264 
265  /*
266  * Test key generation, signing and deletion for a number of key size
267  */
268  for (i=0; i<1; i++) {
269  printf("Generating 512-bit GOST key... ");
270  key = hsm_generate_gost_key(ctx, repository);
271  if (!key) {
272  errors++;
273  printf("Failed\n");
274  hsm_print_error(ctx);
275  printf("\n");
276  continue;
277  } else {
278  printf("OK\n");
279  }
280 
281  printf("Extracting key identifier... ");
282  id = hsm_get_key_id(ctx, key);
283  if (!id) {
284  errors++;
285  printf("Failed\n");
286  hsm_print_error(ctx);
287  printf("\n");
288  } else {
289  printf("OK, %s\n", id);
290  }
291  free(id);
292 
293  printf("Signing (GOST) with key... ");
294  result = hsm_test_sign(ctx, key, LDNS_ECC_GOST);
295  if (result) {
296  errors++;
297  printf("Failed, error: %d\n", result);
298  hsm_print_error(ctx);
299  } else {
300  printf("OK\n");
301  }
302 
303  printf("Deleting key... ");
304  result = hsm_remove_key(ctx, key);
305  if (result) {
306  errors++;
307  printf("Failed: error: %d\n", result);
308  hsm_print_error(ctx);
309  } else {
310  printf("OK\n");
311  }
312 
313  free(key);
314 
315  printf("\n");
316  }
317 
318  /*
319  * Test key generation, signing and deletion for a number of key size
320  */
321 /* TODO: We can remove the directive if we require LDNS >= 1.6.13 */
322 #if !defined LDNS_BUILD_CONFIG_USE_ECDSA || LDNS_BUILD_CONFIG_USE_ECDSA
323  for (i=0; i<(sizeof(ec_curves)/sizeof(ldns_algorithm)); i++) {
324  curve = ec_curves[i];
325 
326  if (curve == LDNS_ECDSAP256SHA256) {
327  printf("Generating ECDSA Curve P-256 key... ");
328  key = hsm_generate_ecdsa_key(ctx, repository, "P-256");
329  } else if (curve == LDNS_ECDSAP384SHA384) {
330  printf("Generating ECDSA Curve P-384 key... ");
331  key = hsm_generate_ecdsa_key(ctx, repository, "P-384");
332  } else {
333  printf("Failed: Unknown ECDSA curve\n");
334  continue;
335  }
336  if (!key) {
337  errors++;
338  printf("Failed\n");
339  hsm_print_error(ctx);
340  printf("\n");
341  continue;
342  } else {
343  printf("OK\n");
344  }
345 
346  printf("Extracting key identifier... ");
347  id = hsm_get_key_id(ctx, key);
348  if (!id) {
349  errors++;
350  printf("Failed\n");
351  hsm_print_error(ctx);
352  printf("\n");
353  } else {
354  printf("OK, %s\n", id);
355  }
356  free(id);
357 
358  if (curve == LDNS_ECDSAP256SHA256) {
359  printf("Signing (ECDSA/SHA256) with key... ");
360  } else if (curve == LDNS_ECDSAP384SHA384) {
361  printf("Signing (ECDSA/SHA384) with key... ");
362  } else {
363  printf("Signing with key... ");
364  }
365  result = hsm_test_sign(ctx, key, curve);
366  if (result) {
367  errors++;
368  printf("Failed, error: %d\n", result);
369  hsm_print_error(ctx);
370  } else {
371  printf("OK\n");
372  }
373 
374  printf("Deleting key... ");
375  result = hsm_remove_key(ctx, key);
376  if (result) {
377  errors++;
378  printf("Failed: error: %d\n", result);
379  hsm_print_error(ctx);
380  } else {
381  printf("OK\n");
382  }
383 
384  free(key);
385 
386  printf("\n");
387  }
388 #endif
389 
390  if (hsm_test_random(ctx)) {
391  errors++;
392  }
393 
394  return errors;
395 }
ldns_rr * hsm_sign_rrset(hsm_ctx_t *ctx, const ldns_rr_list *rrset, const libhsm_key_t *key, const hsm_sign_params_t *sign_params)
Definition: libhsm.c:2928
void hsm_sign_params_free(hsm_sign_params_t *params)
Definition: libhsm.c:2347
uint32_t hsm_random32(hsm_ctx_t *ctx)
Definition: libhsm.c:3114
ldns_rdf * owner
Definition: libhsmdns.h:46
libhsm_key_t * hsm_generate_rsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
Definition: libhsm.c:2428
ldns_rr * hsm_get_dnskey(hsm_ctx_t *ctx, const libhsm_key_t *key, const hsm_sign_params_t *sign_params)
Definition: libhsm.c:3041
libhsm_key_t * hsm_generate_ecdsa_key(hsm_ctx_t *ctx, const char *repository, const char *curve)
Definition: libhsm.c:2702
int hsm_token_attached(hsm_ctx_t *ctx, const char *repository)
Definition: libhsm.c:3171
int hsm_test(const char *repository, hsm_ctx_t *ctx)
Definition: hsmtest.c:107
uint16_t keytag
Definition: libhsmdns.h:44
hsm_sign_params_t * hsm_sign_params_new()
Definition: libhsm.c:2330
ldns_algorithm algorithm
Definition: libhsmdns.h:36
libhsm_key_t * hsm_generate_gost_key(hsm_ctx_t *ctx, const char *repository)
Definition: libhsm.c:2624
int hsm_remove_key(hsm_ctx_t *ctx, libhsm_key_t *key)
Definition: libhsm.c:2796
char * hsm_get_key_id(hsm_ctx_t *ctx, const libhsm_key_t *key)
Definition: libhsm.c:2836
hsm_ctx_t * ctx
Definition: hsmutil.c:46
uint64_t hsm_random64(hsm_ctx_t *ctx)
Definition: libhsm.c:3129
libhsm_key_t * hsm_generate_dsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
Definition: libhsm.c:2514
int hsm_random_buffer(hsm_ctx_t *ctx, unsigned char *buffer, unsigned long length)
Definition: libhsm.c:3087
void hsm_print_error(hsm_ctx_t *gctx)
Definition: libhsm.c:3266