OpenDNSSEC-libhsm  1.4.1
hsmtest.c
Go to the documentation of this file.
1 /*
2  * $Id: hsmtest.c 6560 2012-08-28 06:31:40Z rb $
3  *
4  * Copyright (c) 2009 Nominet UK.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  * notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  * notice, this list of conditions and the following disclaimer in the
14  * documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
18  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
20  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
22  * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
24  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
25  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
26  * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 #include "config.h"
30 #include "hsmtest.h"
31 
32 #include <stdio.h>
33 #include <string.h>
34 #include <stdlib.h>
35 #include <unistd.h>
36 
37 #include <libhsm.h>
38 #include <libhsmdns.h>
39 
40 
41 static int
42 hsm_test_sign (hsm_ctx_t *ctx, hsm_key_t *key, ldns_algorithm alg)
43 {
44  int result;
45  ldns_rr_list *rrset;
46  ldns_rr *rr, *sig, *dnskey_rr;
47  ldns_status status;
48  hsm_sign_params_t *sign_params;
49 
50  rrset = ldns_rr_list_new();
51 
52  status = ldns_rr_new_frm_str(&rr, "example.com. IN A 192.168.0.1", 0, NULL, NULL);
53  if (status == LDNS_STATUS_OK) ldns_rr_list_push_rr(rrset, rr);
54 
55  status = ldns_rr_new_frm_str(&rr, "example.com. IN A 192.168.0.2", 0, NULL, NULL);
56  if (status == LDNS_STATUS_OK) ldns_rr_list_push_rr(rrset, rr);
57 
58  sign_params = hsm_sign_params_new();
59  sign_params->algorithm = alg;
60  sign_params->owner = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, "example.com.");
61  dnskey_rr = hsm_get_dnskey(ctx, key, sign_params);
62  sign_params->keytag = ldns_calc_keytag(dnskey_rr);
63 
64  sig = hsm_sign_rrset(ctx, rrset, key, sign_params);
65  if (sig) {
66  result = 0;
67  ldns_rr_free(sig);
68  } else {
69  result = 1;
70  }
71 
72  ldns_rr_list_deep_free(rrset);
73  hsm_sign_params_free(sign_params);
74  ldns_rr_free(dnskey_rr);
75 
76  return result;
77 }
78 
79 static int
80 hsm_test_random()
81 {
82  hsm_ctx_t *ctx = NULL;
83 
84  int result;
85  unsigned char rnd_buf[1024];
86  uint32_t r32;
87  uint64_t r64;
88 
89  printf("Generating %lu bytes of random data... ",
90  (unsigned long) sizeof(rnd_buf));
91  result = hsm_random_buffer(ctx, rnd_buf, sizeof(rnd_buf));
92  if (result) {
93  printf("Failed, error: %d\n", result);
94  hsm_print_error(ctx);
95  return 1;
96  } else {
97  printf("OK\n");
98  }
99 
100  printf("Generating 32-bit random data... ");
101  r32 = hsm_random32(ctx);
102  printf("%u\n", r32);
103 
104  printf("Generating 64-bit random data... ");
105  r64 = hsm_random64(ctx);
106  printf("%llu\n", (long long unsigned int)r64);
107 
108  return 0;
109 }
110 
111 int
112 hsm_test (const char *repository)
113 {
114  int result;
115  const unsigned int rsa_keysizes[] = { 512, 768, 1024, 1536, 2048, 4096 };
116  const unsigned int dsa_keysizes[] = { 512, 768, 1024 };
117  unsigned int keysize;
118 
119  hsm_ctx_t *ctx = NULL;
120  hsm_key_t *key = NULL;
121  char *id;
122  int errors = 0;
123  unsigned int i = 0;
124 
125  /* Check for repository before starting any tests */
126  if (hsm_token_attached(ctx, repository) == 0) {
127  hsm_print_error(ctx);
128  return 1;
129  }
130 
131  /*
132  * Test key generation, signing and deletion for a number of key size
133  */
134  for (i=0; i<(sizeof(rsa_keysizes)/sizeof(unsigned int)); i++) {
135  keysize = rsa_keysizes[i];
136 
137  printf("Generating %d-bit RSA key... ", keysize);
138  key = hsm_generate_rsa_key(ctx, repository, keysize);
139  if (!key) {
140  errors++;
141  printf("Failed\n");
142  hsm_print_error(ctx);
143  printf("\n");
144  continue;
145  } else {
146  printf("OK\n");
147  }
148 
149  printf("Extracting key identifier... ");
150  id = hsm_get_key_id(ctx, key);
151  if (!id) {
152  errors++;
153  printf("Failed\n");
154  hsm_print_error(ctx);
155  printf("\n");
156  } else {
157  printf("OK, %s\n", id);
158  }
159  free(id);
160 
161  printf("Signing (RSA/SHA1) with key... ");
162  result = hsm_test_sign(ctx, key, LDNS_RSASHA1);
163  if (result) {
164  errors++;
165  printf("Failed, error: %d\n", result);
166  hsm_print_error(ctx);
167  } else {
168  printf("OK\n");
169  }
170 
171  printf("Signing (RSA/SHA256) with key... ");
172  result = hsm_test_sign(ctx, key, LDNS_RSASHA256);
173  if (result) {
174  errors++;
175  printf("Failed, error: %d\n", result);
176  hsm_print_error(ctx);
177  } else {
178  printf("OK\n");
179  }
180 
181  if ( keysize >= 1024) {
182  printf("Signing (RSA/SHA512) with key... ");
183  result = hsm_test_sign(ctx, key, LDNS_RSASHA512);
184  if (result) {
185  errors++;
186  printf("Failed, error: %d\n", result);
187  hsm_print_error(ctx);
188  } else {
189  printf("OK\n");
190  }
191  }
192 
193  printf("Deleting key... ");
194  result = hsm_remove_key(ctx, key);
195  if (result) {
196  errors++;
197  printf("Failed: error: %d\n", result);
198  hsm_print_error(ctx);
199  } else {
200  printf("OK\n");
201  }
202 
203  free(key);
204 
205  printf("\n");
206  }
207 
208  /*
209  * Test key generation, signing and deletion for a number of key size
210  */
211  for (i=0; i<(sizeof(dsa_keysizes)/sizeof(unsigned int)); i++) {
212  keysize = dsa_keysizes[i];
213 
214  printf("Generating %d-bit DSA key... ", keysize);
215  key = hsm_generate_dsa_key(ctx, repository, keysize);
216  if (!key) {
217  errors++;
218  printf("Failed\n");
219  hsm_print_error(ctx);
220  printf("\n");
221  continue;
222  } else {
223  printf("OK\n");
224  }
225 
226  printf("Extracting key identifier... ");
227  id = hsm_get_key_id(ctx, key);
228  if (!id) {
229  errors++;
230  printf("Failed\n");
231  hsm_print_error(ctx);
232  printf("\n");
233  } else {
234  printf("OK, %s\n", id);
235  }
236  free(id);
237 
238  printf("Signing (DSA/SHA1) with key... ");
239  result = hsm_test_sign(ctx, key, LDNS_DSA);
240  if (result) {
241  errors++;
242  printf("Failed, error: %d\n", result);
243  hsm_print_error(ctx);
244  } else {
245  printf("OK\n");
246  }
247 
248  printf("Deleting key... ");
249  result = hsm_remove_key(ctx, key);
250  if (result) {
251  errors++;
252  printf("Failed: error: %d\n", result);
253  hsm_print_error(ctx);
254  } else {
255  printf("OK\n");
256  }
257 
258  free(key);
259 
260  printf("\n");
261  }
262 
263  /*
264  * Test key generation, signing and deletion for a number of key size
265  */
266  for (i=0; i<1; i++) {
267  printf("Generating 512-bit GOST key... ");
268  key = hsm_generate_gost_key(ctx, repository);
269  if (!key) {
270  errors++;
271  printf("Failed\n");
272  hsm_print_error(ctx);
273  printf("\n");
274  continue;
275  } else {
276  printf("OK\n");
277  }
278 
279  printf("Extracting key identifier... ");
280  id = hsm_get_key_id(ctx, key);
281  if (!id) {
282  errors++;
283  printf("Failed\n");
284  hsm_print_error(ctx);
285  printf("\n");
286  } else {
287  printf("OK, %s\n", id);
288  }
289  free(id);
290 
291  printf("Signing (GOST) with key... ");
292  result = hsm_test_sign(ctx, key, LDNS_ECC_GOST);
293  if (result) {
294  errors++;
295  printf("Failed, error: %d\n", result);
296  hsm_print_error(ctx);
297  } else {
298  printf("OK\n");
299  }
300 
301  printf("Deleting key... ");
302  result = hsm_remove_key(ctx, key);
303  if (result) {
304  errors++;
305  printf("Failed: error: %d\n", result);
306  hsm_print_error(ctx);
307  } else {
308  printf("OK\n");
309  }
310 
311  free(key);
312 
313  printf("\n");
314  }
315 
316  if (hsm_test_random()) {
317  errors++;
318  }
319 
320  return errors;
321 }
char * hsm_get_key_id(hsm_ctx_t *ctx, const hsm_key_t *key)
Definition: libhsm.c:2637
void hsm_sign_params_free(hsm_sign_params_t *params)
Definition: libhsm.c:2207
uint32_t hsm_random32(hsm_ctx_t *ctx)
Definition: libhsm.c:3018
ldns_rdf * owner
Definition: libhsmdns.h:49
hsm_key_t * hsm_generate_dsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
Definition: libhsm.c:2395
ldns_rr * hsm_get_dnskey(hsm_ctx_t *ctx, const hsm_key_t *key, const hsm_sign_params_t *sign_params)
Definition: libhsm.c:2944
int hsm_token_attached(hsm_ctx_t *ctx, const char *repository)
Definition: libhsm.c:3100
uint16_t keytag
Definition: libhsmdns.h:47
hsm_sign_params_t * hsm_sign_params_new()
Definition: libhsm.c:2193
ldns_algorithm algorithm
Definition: libhsmdns.h:39
int hsm_test(const char *repository)
Definition: hsmtest.c:112
hsm_key_t * hsm_generate_gost_key(hsm_ctx_t *ctx, const char *repository)
Definition: libhsm.c:2509
uint64_t hsm_random64(hsm_ctx_t *ctx)
Definition: libhsm.c:3033
int hsm_remove_key(hsm_ctx_t *ctx, hsm_key_t *key)
Definition: libhsm.c:2589
int hsm_random_buffer(hsm_ctx_t *ctx, unsigned char *buffer, unsigned long length)
Definition: libhsm.c:2990
hsm_key_t * hsm_generate_rsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
Definition: libhsm.c:2309
void hsm_print_error(hsm_ctx_t *gctx)
Definition: libhsm.c:3226
ldns_rr * hsm_sign_rrset(hsm_ctx_t *ctx, const ldns_rr_list *rrset, const hsm_key_t *key, const hsm_sign_params_t *sign_params)
Definition: libhsm.c:2726