925 lines
31 KiB
Diff
925 lines
31 KiB
Diff
From 11d42f5d851881fd559a716df78a18dba1d6975d Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
Date: Thu, 2 Aug 2018 23:46:45 +0200
|
|
Subject: [PATCH] FIPS tests changes
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Squashed commit of the following:
|
|
|
|
commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa
|
|
Author: Petr Menšík <pemensik@redhat.com>
|
|
Date: Wed Mar 7 20:35:13 2018 +0100
|
|
|
|
Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available.
|
|
|
|
commit ab303db70082db76ecf36493d0b82ef3e8750cad
|
|
Author: Petr Menšík <pemensik@redhat.com>
|
|
Date: Wed Mar 7 18:11:10 2018 +0100
|
|
|
|
Changed root key to be RSASHA256
|
|
|
|
Change bad trusted key to be the same algorithm.
|
|
|
|
commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8
|
|
Author: Petr Menšík <pemensik@redhat.com>
|
|
Date: Wed Mar 7 16:56:17 2018 +0100
|
|
|
|
Change used key to not use hmac-md5
|
|
|
|
Fix upforwd test, do not use hmac-md5
|
|
|
|
commit aec891571626f053acfb4d0a247240cbc21a84e9
|
|
Author: Petr Menšík <pemensik@redhat.com>
|
|
Date: Wed Mar 7 15:54:11 2018 +0100
|
|
|
|
Increase bitsize of DSA key to pass FIPS 140-2 mode.
|
|
|
|
commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696
|
|
Author: Petr Menšík <pemensik@redhat.com>
|
|
Date: Wed Mar 7 15:41:08 2018 +0100
|
|
|
|
Fix tsig and rndc tests for disabled md5
|
|
|
|
Use hmac-sha256 instead of hmac-md5.
|
|
|
|
commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67
|
|
Author: Petr Menšík <pemensik@redhat.com>
|
|
Date: Wed Mar 7 13:21:00 2018 +0100
|
|
|
|
Add md5 availability detection to featuretest
|
|
|
|
commit f389a918803e2853e4b55fed62765dc4a492e34f
|
|
Author: Petr Menšík <pemensik@redhat.com>
|
|
Date: Wed Mar 7 10:44:23 2018 +0100
|
|
|
|
Change tests to not use hmac-md5 algorithms if not required
|
|
|
|
Use hmac-sha256 instead of default hmac-md5 for allow-query
|
|
---
|
|
bin/tests/system/acl/ns2/named1.conf.in | 4 +-
|
|
bin/tests/system/acl/ns2/named2.conf.in | 4 +-
|
|
bin/tests/system/acl/ns2/named3.conf.in | 6 +-
|
|
bin/tests/system/acl/ns2/named4.conf.in | 4 +-
|
|
bin/tests/system/acl/ns2/named5.conf.in | 4 +-
|
|
bin/tests/system/acl/tests.sh | 32 ++++-----
|
|
.../system/allow-query/ns2/named10.conf.in | 2 +-
|
|
.../system/allow-query/ns2/named11.conf.in | 4 +-
|
|
.../system/allow-query/ns2/named12.conf.in | 2 +-
|
|
.../system/allow-query/ns2/named30.conf.in | 2 +-
|
|
.../system/allow-query/ns2/named31.conf.in | 4 +-
|
|
.../system/allow-query/ns2/named32.conf.in | 2 +-
|
|
.../system/allow-query/ns2/named40.conf.in | 4 +-
|
|
bin/tests/system/allow-query/tests.sh | 18 ++---
|
|
bin/tests/system/catz/ns1/named.conf.in | 2 +-
|
|
bin/tests/system/catz/ns2/named.conf.in | 2 +-
|
|
bin/tests/system/checkconf/bad-tsig.conf | 2 +-
|
|
bin/tests/system/checkconf/good.conf | 2 +-
|
|
bin/tests/system/feature-test.c | 14 ++++
|
|
bin/tests/system/notify/ns5/named.conf.in | 6 +-
|
|
bin/tests/system/notify/tests.sh | 6 +-
|
|
bin/tests/system/nsupdate/ns1/named.conf.in | 2 +-
|
|
bin/tests/system/nsupdate/ns2/named.conf.in | 2 +-
|
|
bin/tests/system/nsupdate/setup.sh | 6 +-
|
|
bin/tests/system/nsupdate/tests.sh | 11 ++-
|
|
bin/tests/system/rndc/setup.sh | 2 +-
|
|
bin/tests/system/rndc/tests.sh | 23 ++++---
|
|
bin/tests/system/tsig/ns1/named.conf.in | 10 +--
|
|
bin/tests/system/tsig/setup.sh | 5 ++
|
|
bin/tests/system/tsig/tests.sh | 67 ++++++++++++-------
|
|
bin/tests/system/upforwd/ns1/named.conf.in | 2 +-
|
|
bin/tests/system/upforwd/tests.sh | 2 +-
|
|
32 files changed, 151 insertions(+), 107 deletions(-)
|
|
|
|
diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
|
|
index 0ea6502..026db3f 100644
|
|
--- a/bin/tests/system/acl/ns2/named1.conf.in
|
|
+++ b/bin/tests/system/acl/ns2/named1.conf.in
|
|
@@ -33,12 +33,12 @@ options {
|
|
};
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
key two {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
|
|
index b877880..d8f50be 100644
|
|
--- a/bin/tests/system/acl/ns2/named2.conf.in
|
|
+++ b/bin/tests/system/acl/ns2/named2.conf.in
|
|
@@ -33,12 +33,12 @@ options {
|
|
};
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
key two {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
|
|
index 0a95062..aa54088 100644
|
|
--- a/bin/tests/system/acl/ns2/named3.conf.in
|
|
+++ b/bin/tests/system/acl/ns2/named3.conf.in
|
|
@@ -33,17 +33,17 @@ options {
|
|
};
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
key two {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
key three {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
|
|
index 7cdcb6e..606a345 100644
|
|
--- a/bin/tests/system/acl/ns2/named4.conf.in
|
|
+++ b/bin/tests/system/acl/ns2/named4.conf.in
|
|
@@ -33,12 +33,12 @@ options {
|
|
};
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
key two {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
|
|
index 4b4e050..0e679a8 100644
|
|
--- a/bin/tests/system/acl/ns2/named5.conf.in
|
|
+++ b/bin/tests/system/acl/ns2/named5.conf.in
|
|
@@ -34,12 +34,12 @@ options {
|
|
};
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
key two {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
|
|
index fe49a86..d7819f1 100644
|
|
--- a/bin/tests/system/acl/tests.sh
|
|
+++ b/bin/tests/system/acl/tests.sh
|
|
@@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
|
|
# key "one" should fail
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
|
|
|
# any other key should be fine
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
|
copy_setports ns2/named2.conf.in ns2/named.conf
|
|
@@ -39,18 +39,18 @@ sleep 5
|
|
# prefix 10/8 should fail
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
|
# any other address should work, as long as it sends key "one"
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
|
echo_i "testing nested ACL processing"
|
|
@@ -62,31 +62,31 @@ sleep 5
|
|
# should succeed
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
|
# should succeed
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
|
# should succeed
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
|
# should succeed
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
|
# but only one or the other should fail
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
|
t=`expr $t + 1`
|
|
@@ -97,7 +97,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
|
|
# and other values? right out
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
|
# now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
|
|
@@ -108,31 +108,31 @@ sleep 5
|
|
# should succeed
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
|
# should succeed
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
|
# should fail
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
|
# should fail
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
|
# should fail
|
|
t=`expr $t + 1`
|
|
$DIG $DIGOPTS tsigzone. \
|
|
- @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
+ @10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
|
echo_i "testing allow-query-on ACL processing"
|
|
diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
|
|
index c5f38c9..00db0da 100644
|
|
--- a/bin/tests/system/allow-query/ns2/named10.conf.in
|
|
+++ b/bin/tests/system/allow-query/ns2/named10.conf.in
|
|
@@ -10,7 +10,7 @@
|
|
*/
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
|
|
index 56e5cc4..2c32b71 100644
|
|
--- a/bin/tests/system/allow-query/ns2/named11.conf.in
|
|
+++ b/bin/tests/system/allow-query/ns2/named11.conf.in
|
|
@@ -10,12 +10,12 @@
|
|
*/
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
key two {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234efgh8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
|
|
index 8381950..21a6366 100644
|
|
--- a/bin/tests/system/allow-query/ns2/named12.conf.in
|
|
+++ b/bin/tests/system/allow-query/ns2/named12.conf.in
|
|
@@ -10,7 +10,7 @@
|
|
*/
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
|
|
index 0e5ff55..a90ed6a 100644
|
|
--- a/bin/tests/system/allow-query/ns2/named30.conf.in
|
|
+++ b/bin/tests/system/allow-query/ns2/named30.conf.in
|
|
@@ -10,7 +10,7 @@
|
|
*/
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
|
|
index faadb3f..b99f337 100644
|
|
--- a/bin/tests/system/allow-query/ns2/named31.conf.in
|
|
+++ b/bin/tests/system/allow-query/ns2/named31.conf.in
|
|
@@ -10,12 +10,12 @@
|
|
*/
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
key two {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234efgh8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
|
|
index 9e78dd0..ea7a413 100644
|
|
--- a/bin/tests/system/allow-query/ns2/named32.conf.in
|
|
+++ b/bin/tests/system/allow-query/ns2/named32.conf.in
|
|
@@ -10,7 +10,7 @@
|
|
*/
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
|
|
index f4bc399..e01f312 100644
|
|
--- a/bin/tests/system/allow-query/ns2/named40.conf.in
|
|
+++ b/bin/tests/system/allow-query/ns2/named40.conf.in
|
|
@@ -14,12 +14,12 @@ acl accept { 10.53.0.2; };
|
|
acl badaccept { 10.53.0.1; };
|
|
|
|
key one {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
key two {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "1234efgh8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
|
|
index 479910c..53b9e5c 100644
|
|
--- a/bin/tests/system/allow-query/tests.sh
|
|
+++ b/bin/tests/system/allow-query/tests.sh
|
|
@@ -182,7 +182,7 @@ rndc_reload ns2 10.53.0.2
|
|
|
|
echo_i "test $n: key allowed - query allowed"
|
|
ret=0
|
|
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
|
|
grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
@@ -195,7 +195,7 @@ rndc_reload ns2 10.53.0.2
|
|
|
|
echo_i "test $n: key not allowed - query refused"
|
|
ret=0
|
|
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
@@ -208,7 +208,7 @@ rndc_reload ns2 10.53.0.2
|
|
|
|
echo_i "test $n: key disallowed - query refused"
|
|
ret=0
|
|
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
@@ -341,7 +341,7 @@ rndc_reload ns2 10.53.0.2
|
|
|
|
echo_i "test $n: views key allowed - query allowed"
|
|
ret=0
|
|
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
|
|
grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
@@ -354,7 +354,7 @@ rndc_reload ns2 10.53.0.2
|
|
|
|
echo_i "test $n: views key not allowed - query refused"
|
|
ret=0
|
|
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2
|
|
|
|
echo_i "test $n: views key disallowed - query refused"
|
|
ret=0
|
|
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
@@ -500,7 +500,7 @@ status=`expr $status + $ret`
|
|
n=`expr $n + 1`
|
|
echo_i "test $n: zone key allowed - query allowed"
|
|
ret=0
|
|
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
|
|
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
|
|
grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
|
|
grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
@@ -510,7 +510,7 @@ status=`expr $status + $ret`
|
|
n=`expr $n + 1`
|
|
echo_i "test $n: zone key not allowed - query refused"
|
|
ret=0
|
|
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
|
|
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
|
|
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
@@ -520,7 +520,7 @@ status=`expr $status + $ret`
|
|
n=`expr $n + 1`
|
|
echo_i "test $n: zone key disallowed - query refused"
|
|
ret=0
|
|
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
|
|
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
|
|
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
|
|
index 74b7d37..c353766 100644
|
|
--- a/bin/tests/system/catz/ns1/named.conf.in
|
|
+++ b/bin/tests/system/catz/ns1/named.conf.in
|
|
@@ -61,5 +61,5 @@ zone "catalog4.example" {
|
|
|
|
key tsig_key. {
|
|
secret "LSAnCU+Z";
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
};
|
|
diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
|
|
index ee83efb..35ced08 100644
|
|
--- a/bin/tests/system/catz/ns2/named.conf.in
|
|
+++ b/bin/tests/system/catz/ns2/named.conf.in
|
|
@@ -70,5 +70,5 @@ zone "catalog4.example" {
|
|
|
|
key tsig_key. {
|
|
secret "LSAnCU+Z";
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
};
|
|
diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
|
|
index 21be03e..e57c308 100644
|
|
--- a/bin/tests/system/checkconf/bad-tsig.conf
|
|
+++ b/bin/tests/system/checkconf/bad-tsig.conf
|
|
@@ -11,7 +11,7 @@
|
|
|
|
/* Bad secret */
|
|
key "badtsig" {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha256;
|
|
secret "jEdD+BPKg==";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
|
|
index d627d2a..9d0322a 100644
|
|
--- a/bin/tests/system/checkconf/good.conf
|
|
+++ b/bin/tests/system/checkconf/good.conf
|
|
@@ -157,6 +157,6 @@ dyndb "name" "library.so" {
|
|
system;
|
|
};
|
|
key "mykey" {
|
|
- algorithm "hmac-md5";
|
|
+ algorithm "hmac-sha256";
|
|
secret "qwertyuiopasdfgh";
|
|
};
|
|
diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
|
|
index ff92ad2..746e022 100644
|
|
--- a/bin/tests/system/feature-test.c
|
|
+++ b/bin/tests/system/feature-test.c
|
|
@@ -19,6 +19,7 @@
|
|
#include <isc/print.h>
|
|
#include <isc/util.h>
|
|
#include <isc/net.h>
|
|
+#include <isc/md.h>
|
|
#include <dns/edns.h>
|
|
|
|
#ifdef WIN32
|
|
@@ -168,6 +169,19 @@ main(int argc, char **argv) {
|
|
#endif
|
|
}
|
|
|
|
+ if (strcmp(argv[1], "--md5") == 0) {
|
|
+ unsigned char digest[ISC_MAX_MD_SIZE];
|
|
+ const unsigned char test[] = "test";
|
|
+ unsigned int size = sizeof(digest);
|
|
+
|
|
+ if (isc_md(ISC_MD_MD5, test, sizeof(test),
|
|
+ digest, &size) == ISC_R_SUCCESS) {
|
|
+ return (0);
|
|
+ } else {
|
|
+ return (1);
|
|
+ }
|
|
+ }
|
|
+
|
|
if (strcmp(argv[1], "--ipv6only=no") == 0) {
|
|
#ifdef WIN32
|
|
return (0);
|
|
diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
|
|
index 2976bfc..256d846 100644
|
|
--- a/bin/tests/system/notify/ns5/named.conf.in
|
|
+++ b/bin/tests/system/notify/ns5/named.conf.in
|
|
@@ -10,17 +10,17 @@
|
|
*/
|
|
|
|
key "a" {
|
|
- algorithm "hmac-md5";
|
|
+ algorithm "hmac-sha256";
|
|
secret "aaaaaaaaaaaaaaaaaaaa";
|
|
};
|
|
|
|
key "b" {
|
|
- algorithm "hmac-md5";
|
|
+ algorithm "hmac-sha256";
|
|
secret "bbbbbbbbbbbbbbbbbbbb";
|
|
};
|
|
|
|
key "c" {
|
|
- algorithm "hmac-md5";
|
|
+ algorithm "hmac-sha256";
|
|
secret "cccccccccccccccccccc";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
|
|
index fb2eb74..0e45424 100644
|
|
--- a/bin/tests/system/notify/tests.sh
|
|
+++ b/bin/tests/system/notify/tests.sh
|
|
@@ -212,16 +212,16 @@ ret=0
|
|
$NSUPDATE << EOF
|
|
server 10.53.0.5 ${PORT}
|
|
zone x21
|
|
-key a aaaaaaaaaaaaaaaaaaaa
|
|
+key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa
|
|
update add added.x21 0 in txt "test string"
|
|
send
|
|
EOF
|
|
|
|
for i in 1 2 3 4 5 6 7 8 9
|
|
do
|
|
- $DIG $DIGOPTS added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
|
|
+ $DIG $DIGOPTS added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
|
|
txt > dig.out.b.ns5.test$n || ret=1
|
|
- $DIG $DIGOPTS added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \
|
|
+ $DIG $DIGOPTS added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \
|
|
txt > dig.out.c.ns5.test$n || ret=1
|
|
grep "test string" dig.out.b.ns5.test$n > /dev/null &&
|
|
grep "test string" dig.out.c.ns5.test$n > /dev/null &&
|
|
diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
|
|
index e7b6adb..4ad5cc1 100644
|
|
--- a/bin/tests/system/nsupdate/ns1/named.conf.in
|
|
+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
|
|
@@ -33,7 +33,7 @@ controls {
|
|
};
|
|
|
|
key altkey {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha512;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
|
|
index b703843..8bfe2b0 100644
|
|
--- a/bin/tests/system/nsupdate/ns2/named.conf.in
|
|
+++ b/bin/tests/system/nsupdate/ns2/named.conf.in
|
|
@@ -32,7 +32,7 @@ controls {
|
|
};
|
|
|
|
key altkey {
|
|
- algorithm hmac-md5;
|
|
+ algorithm hmac-sha512;
|
|
secret "1234abcd8765";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
|
|
index 5d70114..6c4b55a 100644
|
|
--- a/bin/tests/system/nsupdate/setup.sh
|
|
+++ b/bin/tests/system/nsupdate/setup.sh
|
|
@@ -56,7 +56,11 @@ EOF
|
|
|
|
$DDNSCONFGEN -q -z example.nil > ns1/ddns.key
|
|
|
|
-$DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
|
|
+if $FEATURETEST --md5; then
|
|
+ $DDNSCONFGEN -q -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
|
|
+else
|
|
+ echo -n > ns1/md5.key
|
|
+fi
|
|
$DDNSCONFGEN -q -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
|
|
$DDNSCONFGEN -q -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
|
|
$DDNSCONFGEN -q -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
|
|
diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
|
|
index b73d178..f573905 100755
|
|
--- a/bin/tests/system/nsupdate/tests.sh
|
|
+++ b/bin/tests/system/nsupdate/tests.sh
|
|
@@ -708,7 +708,14 @@ fi
|
|
n=`expr $n + 1`
|
|
ret=0
|
|
echo_i "check TSIG key algorithms ($n)"
|
|
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
|
|
+if $FEATURETEST --md5
|
|
+then
|
|
+ ALGS="md5 sha1 sha224 sha256 sha384 sha512"
|
|
+else
|
|
+ ALGS="sha1 sha224 sha256 sha384 sha512"
|
|
+ echo_i "skipping disabled md5 algorithm"
|
|
+fi
|
|
+for alg in $ALGS; do
|
|
$NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
|
|
server 10.53.0.1 ${PORT}
|
|
update add ${alg}.keytests.nil. 600 A 10.10.10.3
|
|
@@ -716,7 +723,7 @@ send
|
|
END
|
|
done
|
|
sleep 2
|
|
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
|
|
+for alg in $ALGS; do
|
|
$DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
|
|
done
|
|
if [ $ret -ne 0 ]; then
|
|
diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
|
|
index cb64dd9..c9b2447 100644
|
|
--- a/bin/tests/system/rndc/setup.sh
|
|
+++ b/bin/tests/system/rndc/setup.sh
|
|
@@ -35,7 +35,7 @@ make_key () {
|
|
sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
|
|
}
|
|
|
|
-make_key 1 ${EXTRAPORT1} hmac-md5
|
|
+$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5
|
|
make_key 2 ${EXTRAPORT2} hmac-sha1
|
|
make_key 3 ${EXTRAPORT3} hmac-sha224
|
|
make_key 4 ${EXTRAPORT4} hmac-sha256
|
|
diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
|
|
index 7cbe2c7..b8cc6a0 100644
|
|
--- a/bin/tests/system/rndc/tests.sh
|
|
+++ b/bin/tests/system/rndc/tests.sh
|
|
@@ -356,15 +356,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=`expr $status + $ret`
|
|
|
|
n=`expr $n + 1`
|
|
-echo_i "testing rndc with hmac-md5 ($n)"
|
|
-ret=0
|
|
-$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
|
|
-for i in 2 3 4 5 6
|
|
-do
|
|
- $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
|
|
-done
|
|
-if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
-status=`expr $status + $ret`
|
|
+if $FEATURETEST --md5
|
|
+then
|
|
+ echo_i "testing rndc with hmac-md5 ($n)"
|
|
+ ret=0
|
|
+ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
|
|
+ for i in 2 3 4 5 6
|
|
+ do
|
|
+ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
|
|
+ done
|
|
+ if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
+ status=`expr $status + $ret`
|
|
+else
|
|
+ echo_i "skipping rndc with hmac-md5 ($n)"
|
|
+fi
|
|
|
|
n=`expr $n + 1`
|
|
echo_i "testing rndc with hmac-sha1 ($n)"
|
|
diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
|
|
index fbf30c6..f61657d 100644
|
|
--- a/bin/tests/system/tsig/ns1/named.conf.in
|
|
+++ b/bin/tests/system/tsig/ns1/named.conf.in
|
|
@@ -21,10 +21,7 @@ options {
|
|
notify no;
|
|
};
|
|
|
|
-key "md5" {
|
|
- secret "97rnFx24Tfna4mHPfgnerA==";
|
|
- algorithm hmac-md5;
|
|
-};
|
|
+# md5 key appended by setup.sh at the end
|
|
|
|
key "sha1" {
|
|
secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
|
|
@@ -51,10 +48,7 @@ key "sha512" {
|
|
algorithm hmac-sha512;
|
|
};
|
|
|
|
-key "md5-trunc" {
|
|
- secret "97rnFx24Tfna4mHPfgnerA==";
|
|
- algorithm hmac-md5-80;
|
|
-};
|
|
+# md5-trunc key appended by setup.sh at the end
|
|
|
|
key "sha1-trunc" {
|
|
secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
|
|
diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
|
|
index b3e0450..90a6ce4 100644
|
|
--- a/bin/tests/system/tsig/setup.sh
|
|
+++ b/bin/tests/system/tsig/setup.sh
|
|
@@ -15,3 +15,8 @@ SYSTEMTESTTOP=..
|
|
$SHELL clean.sh
|
|
|
|
copy_setports ns1/named.conf.in ns1/named.conf
|
|
+
|
|
+if $FEATURETEST --md5
|
|
+then
|
|
+ cat ns1/rndc5.conf.in >> ns1/named.conf
|
|
+fi
|
|
diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
|
|
index 3a720de..e20e7f9 100644
|
|
--- a/bin/tests/system/tsig/tests.sh
|
|
+++ b/bin/tests/system/tsig/tests.sh
|
|
@@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
|
|
|
|
status=0
|
|
|
|
-echo_i "fetching using hmac-md5 (old form)"
|
|
-ret=0
|
|
-$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
|
|
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
|
|
-if [ $ret -eq 1 ] ; then
|
|
- echo_i "failed"; status=1
|
|
-fi
|
|
-
|
|
-echo_i "fetching using hmac-md5 (new form)"
|
|
-ret=0
|
|
-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
|
|
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
|
|
-if [ $ret -eq 1 ] ; then
|
|
- echo_i "failed"; status=1
|
|
+if $FEATURETEST --md5
|
|
+then
|
|
+ echo_i "fetching using hmac-md5 (old form)"
|
|
+ ret=0
|
|
+ $DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
|
|
+ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
|
|
+ if [ $ret -eq 1 ] ; then
|
|
+ echo_i "failed"; status=1
|
|
+ fi
|
|
+
|
|
+ echo_i "fetching using hmac-md5 (new form)"
|
|
+ ret=0
|
|
+ $DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
|
|
+ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
|
|
+ if [ $ret -eq 1 ] ; then
|
|
+ echo_i "failed"; status=1
|
|
+ fi
|
|
+else
|
|
+ echo_i "skipping using hmac-md5"
|
|
fi
|
|
|
|
echo_i "fetching using hmac-sha1"
|
|
@@ -87,12 +92,17 @@ fi
|
|
# Truncated TSIG
|
|
#
|
|
#
|
|
-echo_i "fetching using hmac-md5 (trunc)"
|
|
-ret=0
|
|
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
|
|
-grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
|
|
-if [ $ret -eq 1 ] ; then
|
|
- echo_i "failed"; status=1
|
|
+if $FEATURETEST --md5
|
|
+then
|
|
+ echo_i "fetching using hmac-md5 (trunc)"
|
|
+ ret=0
|
|
+ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
|
|
+ grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
|
|
+ if [ $ret -eq 1 ] ; then
|
|
+ echo_i "failed"; status=1
|
|
+ fi
|
|
+else
|
|
+ echo_i "skipping using hmac-md5 (trunc)"
|
|
fi
|
|
|
|
echo_i "fetching using hmac-sha1 (trunc)"
|
|
@@ -141,12 +151,17 @@ fi
|
|
# Check for bad truncation.
|
|
#
|
|
#
|
|
-echo_i "fetching using hmac-md5-80 (BADTRUNC)"
|
|
-ret=0
|
|
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
|
|
-grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
|
|
-if [ $ret -eq 1 ] ; then
|
|
- echo_i "failed"; status=1
|
|
+if $FEATURETEST --md5
|
|
+then
|
|
+ echo_i "fetching using hmac-md5-80 (BADTRUNC)"
|
|
+ ret=0
|
|
+ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
|
|
+ grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
|
|
+ if [ $ret -eq 1 ] ; then
|
|
+ echo_i "failed"; status=1
|
|
+ fi
|
|
+else
|
|
+ echo_i "skipping using hmac-md5-80 (BADTRUNC)"
|
|
fi
|
|
|
|
echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
|
|
diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
|
|
index ea42b4d..08676da 100644
|
|
--- a/bin/tests/system/upforwd/ns1/named.conf.in
|
|
+++ b/bin/tests/system/upforwd/ns1/named.conf.in
|
|
@@ -10,7 +10,7 @@
|
|
*/
|
|
|
|
key "update.example." {
|
|
- algorithm "hmac-md5";
|
|
+ algorithm "hmac-sha256";
|
|
secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
|
|
};
|
|
|
|
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
|
|
index b0694bb..9adae82 100644
|
|
--- a/bin/tests/system/upforwd/tests.sh
|
|
+++ b/bin/tests/system/upforwd/tests.sh
|
|
@@ -68,7 +68,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
|
|
|
|
echo_i "updating zone (signed) ($n)"
|
|
ret=0
|
|
-$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
|
|
+$NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <<EOF || ret=1
|
|
server 10.53.0.3 ${PORT}
|
|
update add updated.example. 600 A 10.10.10.1
|
|
update add updated.example. 600 TXT Foo
|
|
--
|
|
2.20.1
|
|
|