upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-10 20:10:04 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Adapt the tsiggss test to the SIG(0) removal

Browse source 
Test that SIG(0) signer is NOT sent to the external socket for
authorization. It MUST NOT be considered a valid signature by
any chance.

Also check that the signer's name does not appear in authsock.pl
output.
This commit is contained in:
Petr Špaček 2024-05-17 12:23:05 +02:00 committed by Nicki Křížek
parent 4b1f026ad9
commit 02dffb63a8
No known key found for this signature in database
GPG key ID: 01623B9B652A20A7
2 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
bin/tests/system/tsiggss/authsock.pl
View file

@ -54,6 +54,7 @@ if ($timeout != 0) {
}
while (my $client = $server->accept()) {
printf("accept()\n");
$client->recv(my $buf, 8, 0);
my ($version, $req_len) = unpack('N N', $buf);

12
bin/tests/system/tsiggss/tests.sh
View file

@ -117,7 +117,7 @@ status=$((status + ret))
echo_i "testing external update policy (CNAME) with auth sock ($n)"
ret=0
$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >/dev/null 2>&1 &
$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >authsock.log 2>&1 &
sleep 1
test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1
n=$((n + 1))
@ -131,17 +131,19 @@ n=$((n + 1))
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
echo_i "testing external policy with SIG(0) key ($n)"
echo_i "testing external policy with unsupported SIG(0) key ($n)"
ret=0
$NSUPDATE -k ns1/Kkey.example.nil.*.private <<END >/dev/null 2>&1 || ret=1
$NSUPDATE -d -k ns1/Kkey.example.nil.*.private <<END >nsupdate.out${n} 2>&1 || true
debug
server 10.53.0.1 ${PORT}
zone example.nil
update add fred.example.nil 120 cname foo.bar.
send
END
output=$($DIG $DIGOPTS +short cname fred.example.nil.)
[ -n "$output" ] || ret=1
[ $ret -eq 0 ] || echo_i "failed"
# update must have failed - SIG(0) signer is not supported
[ -n "$output" ] && ret=1
grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1
n=$((n + 1))
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))