From de1eba6a0fe5aa477f251fc1042de8b4e14e4f34 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= Date: Wed, 20 Mar 2019 22:21:30 +0100 Subject: [PATCH] Fix key ID extraction in the "dnssec" system test Simply looking for the key ID surrounded by spaces in the tested dnssec-signzone output file is not a precise enough method of checking for signatures prepared using a given key ID: it can be tripped up by cross-algorithm key ID collisions and certain low key IDs (e.g. 60, the TTL specified in bin/tests/system/dnssec/signer/example.db.in), which triggers false positives for the "dnssec" system test. Make key ID extraction precise by using an awk script which operates on specific fields. (cherry picked from commit a40c60e4c1d974a0d9dbad513a1a78fa2a4025b5) --- bin/tests/system/dnssec/tests.sh | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index 7e479b29dc..8fedb8a878 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -1381,6 +1381,19 @@ n=`expr $n + 1` if [ $ret != 0 ]; then echo_i "failed"; fi status=`expr $status + $ret` +get_rsasha1_key_ids_from_sigs() { + awk ' + NF < 8 { next } + $(NF-5) != "RRSIG" { next } + $(NF-3) != "5" { next } + $NF != "(" { next } + { + getline; + print $3; + } + ' signer/example.db.signed | sort -u +} + echo_i "checking that we can sign a zone with out-of-zone records ($n)" ret=0 zone=example @@ -1481,8 +1494,8 @@ cat example.db.in $key1.key $key3.key > example.db echo '$INCLUDE "example.db.signed"' >> example.db $SIGNER -D -o example example.db > /dev/null 2>&1 ) || ret=1 -grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1 -grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 +get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1 +get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1 n=`expr $n + 1` if [ $ret != 0 ]; then echo_i "failed"; fi status=`expr $status + $ret` @@ -1493,8 +1506,8 @@ ret=0 cd signer $SIGNER -RD -o example example.db > /dev/null 2>&1 ) || ret=1 -grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1 -grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 +get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1 +get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1 n=`expr $n + 1` if [ $ret != 0 ]; then echo_i "failed"; fi status=`expr $status + $ret` @@ -1511,8 +1524,8 @@ echo '$INCLUDE "example.db.signed"' >> example.db $SETTIME -I now $key2 > /dev/null 2>&1 $SIGNER -SD -o example example.db > /dev/null 2>&1 ) || ret=1 -grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1 -grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 +get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1 +get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1 n=`expr $n + 1` if [ $ret != 0 ]; then echo_i "failed"; fi status=`expr $status + $ret` @@ -1523,8 +1536,8 @@ ret=0 cd signer $SIGNER -SDQ -o example example.db > /dev/null 2>&1 ) || ret=1 -grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1 -grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 +get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1 +get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1 n=`expr $n + 1` if [ $ret != 0 ]; then echo_i "failed"; fi status=`expr $status + $ret`