upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-03-09 09:40:45 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Test that named checks maximum two keys for SIG(0)-signed messages

Browse source 
Send three updates with three different keys, and expect that one
of them should fail.

Also retain more artifacts for neighboring nsupdate calls.
This commit is contained in:
Aram Sargsyan 2024-05-22 13:07:21 +00:00 committed by Nicki Křížek
parent be482311de
commit a2b61c0a65
No known key found for this signature in database
GPG key ID: 01623B9B652A20A7
5 changed files with 48 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
bin/tests/system/upforwd/clean.sh
View file

@ -29,6 +29,7 @@ rm -f */ans.run
rm -f Ksig0.example2.*
rm -f keyname keyname.err
rm -f ns1/example2.db
rm -f ns1/example2-toomanykeys.db
rm -f ns*/managed-keys.bind*
rm -f nsupdate.out.*
rm -f ns*/named.run.prev

6
bin/tests/system/upforwd/ns1/named.conf.in
View file

@ -44,6 +44,12 @@ zone "example2" {
allow-update { key sig0.example2.; };
};
zone "example2-toomanykeys" {
type primary;
file "example2-toomanykeys.db";
allow-update { key sig0.example2-toomanykeys.; };
};
zone "example3" {
type primary;
file "example3.db";

7
bin/tests/system/upforwd/ns3/named1.conf.in
View file

@ -56,6 +56,13 @@ zone "example2" {
primaries { 10.53.0.1; };
};
zone "example2-toomanykeys" {
type secondary;
file "example2-toomanykeys.bk";
allow-update-forwarding { 10.53.0.1; };
primaries { 10.53.0.1; };
};
zone "example3" {
type secondary;
file "example3.bk";

11
bin/tests/system/upforwd/setup.sh
View file

@ -32,7 +32,7 @@ else
fi
#
# SIG(0) required cryptographic support which may not be configured.
# SIG(0) requires cryptographic support which may not be configured.
#
keyname=$($KEYGEN -q -n HOST -a ${DEFAULT_ALGORITHM} -T KEY sig0.example2 2>keyname.err)
if test -n "$keyname"; then
@ -42,3 +42,12 @@ else
cat ns1/example1.db >ns1/example2.db
fi
cat_i <keyname.err
cat ns1/example1.db >ns1/example2-toomanykeys.db
for i in 1 2 3; do
keyname=$($KEYGEN -q -n HOST -a ${DEFAULT_ALGORITHM} -T KEY sig0.example2-toomanykeys 2>/dev/null)
if test -n "$keyname"; then
cat $keyname.key >>ns1/example2-toomanykeys.db
echo $keyname >keyname$i
fi
done

26
bin/tests/system/upforwd/tests.sh
View file

@ -389,7 +389,7 @@ if test -f keyname; then
nextpart_thrice
ret=0
keyname=$(cat keyname)
$NSUPDATE -k $keyname.private -- - <<EOF || ret=1
$NSUPDATE -k $keyname.private -- - <<EOF >nsupdate.out.test$n 2>&1 || ret=1
local 10.53.0.1
server 10.53.0.3 ${PORT}
zone example2
@ -424,7 +424,7 @@ EOF
nextpart_thrice
ret=0
keyname=$(cat keyname)
$NSUPDATE -k $keyname.private -S -O -- - <<EOF || ret=1
$NSUPDATE -k $keyname.private -S -O -- - <<EOF >nsupdate.out.test$n 2>&1 || ret=1
local 10.53.0.1
server 10.53.0.3 ${TLSPORT}
zone example2
@ -454,6 +454,28 @@ EOF
status=$((status + ret))
n=$((n + 1))
fi
echo_i "checking update forwarding with sig0 with too many keys ($n)"
nextpart_thrice
ret=0
good=0
bad=0
for i in 1 2 3; do
keyname=$(cat keyname$i)
$NSUPDATE -d -D -k $keyname.private -- - <<EOF >nsupdate.out.test$n.$i 2>&1 && good=$((good + 1)) || bad=$((bad + 1))
local 10.53.0.1
server 10.53.0.3 ${PORT}
zone example2-toomanykeys
update add toomanykeys$i.example2-toomanykeys. 600 A 10.10.10.1
send
EOF
done
# There are three keys in the zone but named checks the signature using
# maximum two keys, so one of these updates should have been failed.
[ $good = 2 ] && [ $bad = 1 ] || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status + ret))
n=$((n + 1))
fi
echo_i "attempting an update that should be rejected by ACL ($n)"