mirror of
https://github.com/isc-projects/bind9.git
synced 2026-06-12 18:19:46 -04:00
Merge branch '848-keymgr-19-old-keys-failing-on-penguin' into 'master'
Resolve "keymgr 19-old-keys failing on penguin" Closes #848 See merge request isc-projects/bind9!1424
This commit is contained in:
Mark Andrews
commit
3f16a6afc1
23 changed files with 112 additions and 88 deletions
3
CHANGES
3
CHANGES
|
|
@ -1,3 +1,6 @@
|
|||
5147. [bug] dnssec-keymgr: Add a five-minute margin to better
|
||||
handle key events close to 'now'. [GL #848]
|
||||
|
||||
5146. [placeholder]
|
||||
|
||||
5145. [func] Use atomics instead of locked variables for isc_quota
|
||||
|
|
|
|||
|
|
@ -99,6 +99,12 @@
|
|||
set by the <option>-K</option> option), and check the keys for
|
||||
all the zones represented in the directory.
|
||||
</para>
|
||||
<para>
|
||||
Key times that are in the past will not be updated unless
|
||||
the <option>-f</option> is used (see below). Key inactivation
|
||||
and deletion times that are less than five minutes in the future
|
||||
will be delayed by five minutes.
|
||||
</para>
|
||||
<para>
|
||||
It is expected that this tool will be run automatically and
|
||||
unattended (for example, by <command>cron</command>).
|
||||
|
|
|
|||
|
|
@ -83,31 +83,36 @@ class keyseries:
|
|||
a = now
|
||||
|
||||
i = key.inactive()
|
||||
fudge = 300
|
||||
if not rp:
|
||||
key.setinactive(None, **kwargs)
|
||||
key.setdelete(None, **kwargs)
|
||||
elif not i or a + rp != i:
|
||||
if not i and a + rp > now + prepub:
|
||||
if not i and a + rp > now + prepub + fudge:
|
||||
key.setinactive(a + rp, **kwargs)
|
||||
key.setdelete(a + rp + postpub, **kwargs)
|
||||
elif not i:
|
||||
key.setinactive(now + prepub, **kwargs)
|
||||
key.setdelete(now + prepub + postpub, **kwargs)
|
||||
key.setinactive(now + prepub + fudge, **kwargs)
|
||||
key.setdelete(now + prepub + postpub + fudge, **kwargs)
|
||||
elif i < now:
|
||||
pass
|
||||
elif a + rp > i:
|
||||
key.setinactive(a + rp, **kwargs)
|
||||
key.setdelete(a + rp + postpub, **kwargs)
|
||||
elif a + rp > now + prepub:
|
||||
elif a + rp > now + prepub + fudge:
|
||||
key.setinactive(a + rp, **kwargs)
|
||||
key.setdelete(a + rp + postpub, **kwargs)
|
||||
else:
|
||||
key.setinactive(now + prepub, **kwargs)
|
||||
key.setdelete(now + prepub + postpub, **kwargs)
|
||||
key.setinactive(now + prepub + fudge, **kwargs)
|
||||
key.setdelete(now + prepub + postpub + fudge, **kwargs)
|
||||
else:
|
||||
d = key.delete()
|
||||
if not d or i + postpub > now:
|
||||
if not d or i + postpub > now + fudge:
|
||||
key.setdelete(i + postpub, **kwargs)
|
||||
elif not d:
|
||||
key.setdelete(now + postpub, **kwargs)
|
||||
key.setdelete(now + postpub + fudge, **kwargs)
|
||||
elif d < now + fudge:
|
||||
pass
|
||||
elif d < i + postpub:
|
||||
key.setdelete(i + postpub, **kwargs)
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1h -m 2h example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1h -m 2h example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1h -m 2h example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1h -m 2h example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1h -m 2h example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1h -m 2h example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf -f example.com"
|
||||
kargs="-f example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-f -c policy.conf example.com"
|
||||
kargs="-f example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf"
|
||||
kargs=""
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf"
|
||||
kargs=""
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=1
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
cargs="-d 1h -m 1d example.com"
|
||||
cmatch=""
|
||||
cret=0
|
||||
warn=0
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
kargs="-c policy.conf example.com"
|
||||
kargs="example.com"
|
||||
kmatch=""
|
||||
kret=0
|
||||
cargs="-d 1w -m 2w example.com"
|
||||
cargs="-d 1h -m 1w example.com"
|
||||
cmatch="4,Publish
|
||||
4,Activate
|
||||
2,Inactive
|
||||
|
|
|
|||
|
|
@ -19,12 +19,12 @@ matchall () {
|
|||
match_result=ok
|
||||
file=$1
|
||||
while IFS="," read expect matchline; do
|
||||
[ -z "$matchline" ] && continue
|
||||
matches=`grep "$matchline" $file | wc -l`
|
||||
[ "$matches" -ne "$expect" ] && {
|
||||
echo "'$matchline': expected $expect found $matches"
|
||||
return 1
|
||||
}
|
||||
[ -z "$matchline" ] && continue
|
||||
matches=`grep "$matchline" $file | wc -l`
|
||||
[ "$matches" -ne "$expect" ] && {
|
||||
echo "'$matchline': expected $expect found $matches"
|
||||
return 1
|
||||
}
|
||||
done << EOF
|
||||
$2
|
||||
EOF
|
||||
|
|
@ -34,74 +34,84 @@ EOF
|
|||
echo_i "checking for DNSSEC key coverage issues"
|
||||
ret=0
|
||||
for dir in [0-9][0-9]-*; do
|
||||
ret=0
|
||||
echo_i "$dir ($n)"
|
||||
kargs= cargs= kmatch= cmatch= kret= cret=0 warn= error= ok=
|
||||
. $dir/expect
|
||||
ret=0
|
||||
echo_i "$dir ($n)"
|
||||
kargs= cargs= kmatch= cmatch= kret= cret=0 warn= error= ok=
|
||||
. $dir/expect
|
||||
|
||||
# use policy.conf if available
|
||||
policy=""
|
||||
[ -e "$dir/policy.conf" ] && policy="-c $dir/policy.conf"
|
||||
# run keymgr to update keys
|
||||
# use policy.conf if available
|
||||
policy=""
|
||||
if [ -e "$dir/policy.conf" ]; then
|
||||
policy="-c $dir/policy.conf"
|
||||
if grep -e "-c policy.conf" $dir/expect > /dev/null
|
||||
then
|
||||
echo_i "fix $dir/expect: multiple policy files"
|
||||
ret=1
|
||||
fi
|
||||
else
|
||||
policy="-c policy.conf"
|
||||
fi
|
||||
|
||||
# run keymgr to update keys
|
||||
if [ "$CYGWIN" ]; then
|
||||
$KEYMGR $policy -K $dir -g `cygpath -w $KEYGEN` \
|
||||
$KEYMGR $policy -K $dir -g `cygpath -w $KEYGEN` \
|
||||
-s `cygpath -w $SETTIME` $kargs > keymgr.$n 2>&1
|
||||
else
|
||||
$KEYMGR $policy -K $dir -g $KEYGEN \
|
||||
-s $SETTIME $kargs > keymgr.$n 2>&1
|
||||
fi
|
||||
# check that return code matches expectations
|
||||
found=$?
|
||||
if [ $found -ne $kret ]; then
|
||||
echo "keymgr retcode was $found expected $kret"
|
||||
ret=1
|
||||
fi
|
||||
# check that return code matches expectations
|
||||
found=$?
|
||||
if [ $found -ne $kret ]; then
|
||||
echo "keymgr retcode was $found expected $kret"
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# check for matches in keymgr output
|
||||
matchall keymgr.$n "$kmatch" || ret=1
|
||||
# check for matches in keymgr output
|
||||
matchall keymgr.$n "$kmatch" || ret=1
|
||||
|
||||
# now check coverage
|
||||
$COVERAGE -K $dir $cargs > coverage.$n 2>&1
|
||||
# check that return code matches expectations
|
||||
found=$?
|
||||
if [ $found -ne $cret ]; then
|
||||
echo "coverage retcode was $found expected $cret"
|
||||
ret=1
|
||||
fi
|
||||
# now check coverage
|
||||
$COVERAGE -K $dir $cargs > coverage.$n 2>&1
|
||||
# check that return code matches expectations
|
||||
found=$?
|
||||
if [ $found -ne $cret ]; then
|
||||
echo "coverage retcode was $found expected $cret"
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# check for correct number of errors
|
||||
found=`grep ERROR coverage.$n | wc -l`
|
||||
if [ $found -ne $error ]; then
|
||||
echo "error count was $found expected $error"
|
||||
ret=1
|
||||
fi
|
||||
# check for correct number of errors
|
||||
found=`grep ERROR coverage.$n | wc -l`
|
||||
if [ $found -ne $error ]; then
|
||||
echo "error count was $found expected $error"
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# check for correct number of warnings
|
||||
found=`grep WARNING coverage.$n | wc -l`
|
||||
if [ $found -ne $warn ]; then
|
||||
echo "warning count was $found expected $warn"
|
||||
ret=1
|
||||
fi
|
||||
# check for correct number of warnings
|
||||
found=`grep WARNING coverage.$n | wc -l`
|
||||
if [ $found -ne $warn ]; then
|
||||
echo "warning count was $found expected $warn"
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# check for correct number of OKs
|
||||
found=`grep "No errors found" coverage.$n | wc -l`
|
||||
if [ $found -ne $ok ]; then
|
||||
echo "good count was $found expected $ok"
|
||||
ret=1
|
||||
fi
|
||||
# check for correct number of OKs
|
||||
found=`grep "No errors found" coverage.$n | wc -l`
|
||||
if [ $found -ne $ok ]; then
|
||||
echo "good count was $found expected $ok"
|
||||
ret=1
|
||||
fi
|
||||
|
||||
# check for matches in coverage output
|
||||
matchall coverage.$n "$cmatch" || ret=1
|
||||
# check for matches in coverage output
|
||||
matchall coverage.$n "$cmatch" || ret=1
|
||||
|
||||
if [ -f $dir/extra.sh ]; then
|
||||
cd $dir
|
||||
. ./extra.sh
|
||||
cd ..
|
||||
fi
|
||||
if [ -f $dir/extra.sh ]; then
|
||||
cd $dir
|
||||
. ./extra.sh
|
||||
cd ..
|
||||
fi
|
||||
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
done
|
||||
|
||||
echo_i "checking domains ending in . ($n)"
|
||||
|
|
|
|||
Loading…
Reference in a new issue