From 02dffb63a84662b19da4e0efda26e061676f85a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= Date: Fri, 17 May 2024 12:23:05 +0200 Subject: [PATCH] Adapt the tsiggss test to the SIG(0) removal Test that SIG(0) signer is NOT sent to the external socket for authorization. It MUST NOT be considered a valid signature by any chance. Also check that the signer's name does not appear in authsock.pl output. --- bin/tests/system/tsiggss/authsock.pl | 1 + bin/tests/system/tsiggss/tests.sh | 12 +++++++----- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/bin/tests/system/tsiggss/authsock.pl b/bin/tests/system/tsiggss/authsock.pl index 103d3b0be2..972252aa99 100644 --- a/bin/tests/system/tsiggss/authsock.pl +++ b/bin/tests/system/tsiggss/authsock.pl @@ -54,6 +54,7 @@ if ($timeout != 0) { } while (my $client = $server->accept()) { + printf("accept()\n"); $client->recv(my $buf, 8, 0); my ($version, $req_len) = unpack('N N', $buf); diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh index c37f32ed39..004ad83f94 100644 --- a/bin/tests/system/tsiggss/tests.sh +++ b/bin/tests/system/tsiggss/tests.sh @@ -117,7 +117,7 @@ status=$((status + ret)) echo_i "testing external update policy (CNAME) with auth sock ($n)" ret=0 -$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >/dev/null 2>&1 & +$PERL ./authsock.pl --type=CNAME --path=ns1/auth.sock --pidfile=authsock.pid --timeout=120 >authsock.log 2>&1 & sleep 1 test_update $n testcname.example.nil. CNAME "86400 CNAME testdenied.example.nil" "testdenied" || ret=1 n=$((n + 1)) @@ -131,17 +131,19 @@ n=$((n + 1)) if [ "$ret" -ne 0 ]; then echo_i "failed"; fi status=$((status + ret)) -echo_i "testing external policy with SIG(0) key ($n)" +echo_i "testing external policy with unsupported SIG(0) key ($n)" ret=0 -$NSUPDATE -k ns1/Kkey.example.nil.*.private </dev/null 2>&1 || ret=1 +$NSUPDATE -d -k ns1/Kkey.example.nil.*.private <nsupdate.out${n} 2>&1 || true +debug server 10.53.0.1 ${PORT} zone example.nil update add fred.example.nil 120 cname foo.bar. send END output=$($DIG $DIGOPTS +short cname fred.example.nil.) -[ -n "$output" ] || ret=1 -[ $ret -eq 0 ] || echo_i "failed" +# update must have failed - SIG(0) signer is not supported +[ -n "$output" ] && ret=1 +grep -F "signer=key.example.nil" authsock.log >/dev/null && ret=1 n=$((n + 1)) if [ "$ret" -ne 0 ]; then echo_i "failed"; fi status=$((status + ret))