upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Match algorithms when checking signatures

Browse source 
In the ksr system test, the test_ksr_twotone case may fail if there
are two keys with the same keytag (but different algorithms), because
one key is expected to be signing and the other is not.

Switch to regular expression matching and include the algorithm in the
search string.

(cherry picked from commit 795fcc9f80)
This commit is contained in:
Matthijs Mekking 2024-10-31 11:25:23 +01:00
parent b02f039d3a
commit 9621369524
1 changed files with 11 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
bin/tests/system/isctest/kasp.py
View file

@ -345,37 +345,41 @@ def _check_signatures(signatures, covers, fqdn, keys):
active = now >= activate
retired = inactive is not None and inactive <= now
signing = active and not retired
alg = key.get_metadata("Algorithm")
rtype = dns.rdatatype.to_text(covers)
expect = rf"IN RRSIG {rtype} {alg} (\d) (\d+) (\d+) (\d+) {key.tag} {fqdn}"
if not signing:
for rrsig in signatures:
assert f" {key.tag} {fqdn}" not in rrsig
assert re.search(expect, rrsig) is None
continue
if zrrsig and key.is_zsk():
has_rrsig = False
for rrsig in signatures:
if f" {key.tag} {fqdn}" in rrsig:
if re.search(expect, rrsig) is not None:
has_rrsig = True
break
assert has_rrsig
assert has_rrsig, f"Expected signature but not found: {expect}"
numsigs += 1
if zrrsig and not key.is_zsk():
for rrsig in signatures:
assert f" {key.tag} {fqdn}" not in rrsig
assert re.search(expect, rrsig) is None
if krrsig and key.is_ksk():
has_rrsig = False
for rrsig in signatures:
if f" {key.tag} {fqdn}" in rrsig:
if re.search(expect, rrsig) is not None:
has_rrsig = True
break
assert has_rrsig
assert has_rrsig, f"Expected signature but not found: {expect}"
numsigs += 1
if krrsig and not key.is_ksk():
for rrsig in signatures:
assert f" {key.tag} {fqdn}" not in rrsig
assert re.search(expect, rrsig) is None
return numsigs