OpenDNSSEC-libhsm 2.1.13
hsmtest.c
Go to the documentation of this file.
1/*
2 * Copyright (c) 2009 Nominet UK.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
16 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
18 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
20 * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
21 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
22 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
23 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
24 * IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "config.h"
28
29#include <stdio.h>
30#include <string.h>
31#include <stdlib.h>
32#include <unistd.h>
33
34#include "libhsm.h"
35#include <libhsmdns.h>
36#include "hsmtest.h"
37
38static int
39hsm_test_sign (hsm_ctx_t *ctx, libhsm_key_t *key, ldns_algorithm alg)
40{
41 int result;
42 ldns_rr_list *rrset;
43 ldns_rr *rr, *sig, *dnskey_rr;
44 ldns_status status;
45 hsm_sign_params_t *sign_params;
46
47 rrset = ldns_rr_list_new();
48
49 status = ldns_rr_new_frm_str(&rr, "example.com. IN A 192.168.0.1", 0, NULL, NULL);
50 if (status == LDNS_STATUS_OK) ldns_rr_list_push_rr(rrset, rr);
51
52 status = ldns_rr_new_frm_str(&rr, "example.com. IN A 192.168.0.2", 0, NULL, NULL);
53 if (status == LDNS_STATUS_OK) ldns_rr_list_push_rr(rrset, rr);
54
55 sign_params = hsm_sign_params_new();
56 sign_params->algorithm = alg;
57 sign_params->owner = ldns_rdf_new_frm_str(LDNS_RDF_TYPE_DNAME, "example.com.");
58 dnskey_rr = hsm_get_dnskey(ctx, key, sign_params);
59 sign_params->keytag = ldns_calc_keytag(dnskey_rr);
60
61 sig = hsm_sign_rrset(ctx, rrset, key, sign_params);
62 if (sig) {
63 result = 0;
64 ldns_rr_free(sig);
65 } else {
66 result = 1;
67 }
68
69 ldns_rr_list_deep_free(rrset);
70 hsm_sign_params_free(sign_params);
71 ldns_rr_free(dnskey_rr);
72
73 return result;
74}
75
76static int
77hsm_test_random(hsm_ctx_t *ctx)
78{
79 int result;
80 unsigned char rnd_buf[1024];
81 uint32_t r32;
82 uint64_t r64;
83
84 printf("Generating %lu bytes of random data... ",
85 (unsigned long) sizeof(rnd_buf));
86 result = hsm_random_buffer(ctx, rnd_buf, sizeof(rnd_buf));
87 if (result) {
88 printf("Failed, error: %d\n", result);
90 return 1;
91 } else {
92 printf("OK\n");
93 }
94
95 printf("Generating 32-bit random data... ");
96 r32 = hsm_random32(ctx);
97 printf("%u\n", r32);
98
99 printf("Generating 64-bit random data... ");
100 r64 = hsm_random64(ctx);
101 printf("%llu\n", (long long unsigned int)r64);
102
103 return 0;
104}
105
106int
107hsm_test (const char *repository, hsm_ctx_t* ctx)
108{
109 int result;
110 const unsigned int rsa_keysizes[] = { 512, 768, 1024, 1536, 2048, 4096 };
111 const unsigned int dsa_keysizes[] = { 512, 768, 1024 };
112 unsigned int keysize;
113 const ldns_algorithm ec_curves[] = {
114 LDNS_ECDSAP256SHA256,
115 LDNS_ECDSAP384SHA384
116 };
117#if (LDNS_REVISION >= ((1<<16)|(7<<8)|(0)))
118 const ldns_algorithm ed_curves[] = {
119 LDNS_ED25519,
120 LDNS_ED448,
121 };
122#endif
123 ldns_algorithm curve;
124
125 libhsm_key_t *key = NULL;
126 char *id;
127 int errors = 0;
128 unsigned int i = 0;
129
130 /* Check for repository before starting any tests */
131 if (hsm_token_attached(ctx, repository) == 0) {
133 return 1;
134 }
135
136 /*
137 * Test key generation, signing and deletion for a number of key size
138 */
139 for (i=0; i<(sizeof(rsa_keysizes)/sizeof(unsigned int)); i++) {
140 keysize = rsa_keysizes[i];
141
142 printf("Generating %u-bit RSA key... ", keysize);
143 key = hsm_generate_rsa_key(ctx, repository, keysize);
144 if (!key) {
145 errors++;
146 printf("Failed\n");
148 printf("\n");
149 continue;
150 } else {
151 printf("OK\n");
152 }
153
154 printf("Extracting key identifier... ");
155 id = hsm_get_key_id(ctx, key);
156 if (!id) {
157 errors++;
158 printf("Failed\n");
160 printf("\n");
161 } else {
162 printf("OK, %s\n", id);
163 }
164 free(id);
165
166 printf("Signing (RSA/SHA1) with key... ");
167 result = hsm_test_sign(ctx, key, LDNS_RSASHA1);
168 if (result) {
169 errors++;
170 printf("Failed, error: %d\n", result);
172 } else {
173 printf("OK\n");
174 }
175
176 printf("Signing (RSA/SHA256) with key... ");
177 result = hsm_test_sign(ctx, key, LDNS_RSASHA256);
178 if (result) {
179 errors++;
180 printf("Failed, error: %d\n", result);
182 } else {
183 printf("OK\n");
184 }
185
186 if ( keysize >= 1024) {
187 printf("Signing (RSA/SHA512) with key... ");
188 result = hsm_test_sign(ctx, key, LDNS_RSASHA512);
189 if (result) {
190 errors++;
191 printf("Failed, error: %d\n", result);
193 } else {
194 printf("OK\n");
195 }
196 }
197
198 printf("Deleting key... ");
199 result = hsm_remove_key(ctx, key);
200 if (result) {
201 errors++;
202 printf("Failed: error: %d\n", result);
204 } else {
205 printf("OK\n");
206 }
207
208 libhsm_key_free(key);
209
210 printf("\n");
211 }
212
213 /*
214 * Test key generation, signing and deletion for a number of key size
215 */
216 for (i=0; i<(sizeof(dsa_keysizes)/sizeof(unsigned int)); i++) {
217 keysize = dsa_keysizes[i];
218
219 printf("Generating %u-bit DSA key... ", keysize);
220 key = hsm_generate_dsa_key(ctx, repository, keysize);
221 if (!key) {
222 errors++;
223 printf("Failed\n");
225 printf("\n");
226 continue;
227 } else {
228 printf("OK\n");
229 }
230
231 printf("Extracting key identifier... ");
232 id = hsm_get_key_id(ctx, key);
233 if (!id) {
234 errors++;
235 printf("Failed\n");
237 printf("\n");
238 } else {
239 printf("OK, %s\n", id);
240 }
241 free(id);
242
243 printf("Signing (DSA/SHA1) with key... ");
244 result = hsm_test_sign(ctx, key, LDNS_DSA);
245 if (result) {
246 errors++;
247 printf("Failed, error: %d\n", result);
249 } else {
250 printf("OK\n");
251 }
252
253 printf("Deleting key... ");
254 result = hsm_remove_key(ctx, key);
255 if (result) {
256 errors++;
257 printf("Failed: error: %d\n", result);
259 } else {
260 printf("OK\n");
261 }
262
263 libhsm_key_free(key);
264
265 printf("\n");
266 }
267
268 /*
269 * Test key generation, signing and deletion for a number of key size
270 */
271 for (i=0; i<1; i++) {
272 printf("Generating 512-bit GOST key... ");
273 key = hsm_generate_gost_key(ctx, repository);
274 if (!key) {
275 errors++;
276 printf("Failed\n");
278 printf("\n");
279 continue;
280 } else {
281 printf("OK\n");
282 }
283
284 printf("Extracting key identifier... ");
285 id = hsm_get_key_id(ctx, key);
286 if (!id) {
287 errors++;
288 printf("Failed\n");
290 printf("\n");
291 } else {
292 printf("OK, %s\n", id);
293 }
294 free(id);
295
296 printf("Signing (GOST) with key... ");
297 result = hsm_test_sign(ctx, key, LDNS_ECC_GOST);
298 if (result) {
299 errors++;
300 printf("Failed, error: %d\n", result);
302 } else {
303 printf("OK\n");
304 }
305
306 printf("Deleting key... ");
307 result = hsm_remove_key(ctx, key);
308 if (result) {
309 errors++;
310 printf("Failed: error: %d\n", result);
312 } else {
313 printf("OK\n");
314 }
315
316 libhsm_key_free(key);
317
318 printf("\n");
319 }
320
321 /*
322 * Test key generation, signing and deletion for a number of key size
323 */
324 for (i=0; i<(sizeof(ec_curves)/sizeof(ldns_algorithm)); i++) {
325 curve = ec_curves[i];
326
327 if (curve == LDNS_ECDSAP256SHA256) {
328 printf("Generating ECDSA Curve P-256 key... ");
329 key = hsm_generate_ecdsa_key(ctx, repository, "P-256");
330 } else if (curve == LDNS_ECDSAP384SHA384) {
331 printf("Generating ECDSA Curve P-384 key... ");
332 key = hsm_generate_ecdsa_key(ctx, repository, "P-384");
333 } else {
334 printf("Failed: Unknown ECDSA curve\n");
335 continue;
336 }
337 if (!key) {
338 errors++;
339 printf("Failed\n");
341 printf("\n");
342 continue;
343 } else {
344 printf("OK\n");
345 }
346
347 printf("Extracting key identifier... ");
348 id = hsm_get_key_id(ctx, key);
349 if (!id) {
350 errors++;
351 printf("Failed\n");
353 printf("\n");
354 } else {
355 printf("OK, %s\n", id);
356 }
357 free(id);
358
359 if (curve == LDNS_ECDSAP256SHA256) {
360 printf("Signing (ECDSA/SHA256) with key... ");
361 } else if (curve == LDNS_ECDSAP384SHA384) {
362 printf("Signing (ECDSA/SHA384) with key... ");
363 } else {
364 printf("Signing with key... ");
365 }
366 }
367
368#if (LDNS_REVISION >= ((1<<16)|(7<<8)|(0)))
369 for (i=0; i<(sizeof(ed_curves)/sizeof(ldns_algorithm)); i++) {
370 curve = ed_curves[i];
371
372 switch(curve) {
373 case LDNS_ED25519:
374 printf("Generating ED25519 key... ");
375 key = hsm_generate_eddsa_key(ctx, repository, "edwards25519");
376 break;
377 case LDNS_ED448:
378 printf("Generating ED448 key... ");
379 key = hsm_generate_eddsa_key(ctx, repository, "edwards448");
380 break;
381 default:
382 continue;
383 }
384 if (!key) {
385 errors++;
386 printf("Failed\n");
388 printf("\n");
389 continue;
390 } else {
391 printf("OK\n");
392 }
393
394 printf("Extracting key identifier... ");
395 id = hsm_get_key_id(ctx, key);
396 if (!id) {
397 errors++;
398 printf("Failed\n");
400 printf("\n");
401 } else {
402 printf("OK, %s\n", id);
403 }
404 free(id);
405
406 printf("Signing with key... ");
407 result = hsm_test_sign(ctx, key, curve);
408 if (result) {
409 errors++;
410 printf("Failed, error: %d\n", result);
412 } else {
413 printf("OK\n");
414 }
415
416 printf("Deleting key... ");
417 result = hsm_remove_key(ctx, key);
418 if (result) {
419 errors++;
420 printf("Failed: error: %d\n", result);
422 } else {
423 printf("OK\n");
424 }
425
426 libhsm_key_free(key);
427
428 printf("\n");
429 }
430#endif
431
432 if (hsm_test_random(ctx)) {
433 errors++;
434 }
435
436 return errors;
437}
int hsm_test(const char *repository, hsm_ctx_t *ctx)
Definition: hsmtest.c:107
hsm_ctx_t * ctx
Definition: hsmutil.c:46
ldns_rr * hsm_sign_rrset(hsm_ctx_t *ctx, const ldns_rr_list *rrset, const libhsm_key_t *key, const hsm_sign_params_t *sign_params)
Definition: libhsm.c:3154
uint64_t hsm_random64(hsm_ctx_t *ctx)
Definition: libhsm.c:3355
uint32_t hsm_random32(hsm_ctx_t *ctx)
Definition: libhsm.c:3340
void hsm_print_error(hsm_ctx_t *gctx)
Definition: libhsm.c:3493
int hsm_token_attached(hsm_ctx_t *ctx, const char *repository)
Definition: libhsm.c:3397
libhsm_key_t * hsm_generate_rsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
Definition: libhsm.c:2550
libhsm_key_t * hsm_generate_gost_key(hsm_ctx_t *ctx, const char *repository)
Definition: libhsm.c:2752
hsm_sign_params_t * hsm_sign_params_new()
Definition: libhsm.c:2448
char * hsm_get_key_id(hsm_ctx_t *ctx, const libhsm_key_t *key)
Definition: libhsm.c:3063
int hsm_random_buffer(hsm_ctx_t *ctx, unsigned char *buffer, unsigned long length)
Definition: libhsm.c:3313
ldns_rr * hsm_get_dnskey(hsm_ctx_t *ctx, const libhsm_key_t *key, const hsm_sign_params_t *sign_params)
Definition: libhsm.c:3267
libhsm_key_t * hsm_generate_dsa_key(hsm_ctx_t *ctx, const char *repository, unsigned long keysize)
Definition: libhsm.c:2638
libhsm_key_t * hsm_generate_eddsa_key(hsm_ctx_t *ctx, const char *repository, const char *curve)
Definition: libhsm.c:2928
libhsm_key_t * hsm_generate_ecdsa_key(hsm_ctx_t *ctx, const char *repository, const char *curve)
Definition: libhsm.c:2832
int hsm_remove_key(hsm_ctx_t *ctx, libhsm_key_t *key)
Definition: libhsm.c:3024
void libhsm_key_free(libhsm_key_t *key)
Definition: libhsm.c:2471
void hsm_sign_params_free(hsm_sign_params_t *params)
Definition: libhsm.c:2462
ldns_algorithm algorithm
Definition: libhsmdns.h:36
ldns_rdf * owner
Definition: libhsmdns.h:46
uint16_t keytag
Definition: libhsmdns.h:44