upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Better signed TKEY response verification

Browse source
This commit is contained in:
Matthijs Mekking 2019-01-30 10:57:06 +01:00 committed by Evan Hunt
parent 935af4a795
commit 1cc25ff5e0
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
bin/tests/system/tsiggss/tests.sh
View file

@ -39,8 +39,10 @@ EOF
return 1
}
# Weak verification that TKEY response is signed.
grep "TSIG PSEUDOSECTION" nsupdate.out${num} > /dev/null || {
# Verify that TKEY response is signed.
tkeyout=`awk '/recvmsg reply from GSS-TSIG query/,/Sending update to/' nsupdate.out${num}`
pattern="recvmsg reply from GSS-TSIG query .* opcode: QUERY, status: NOERROR, id: .* flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;.* ANY TKEY ;; ANSWER SECTION: .* 0 ANY TKEY gss-tsig\. .* ;; TSIG PSEUDOSECTION: .* 0 ANY TSIG gss-tsig\. .* NOERROR 0"
echo $tkeyout | grep "$pattern" > /dev/null || {
echo "I:bad tkey response (not tsig signed)"
return 1
}