|
 |
2e2c49 |
From 35b53607724ec4b5d4060385218c39ccd0d78a4d Mon Sep 17 00:00:00 2001
|
|
|
2e2c49 |
From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
|
|
|
2e2c49 |
Date: Thu, 2 Aug 2018 23:46:45 +0200
|
|
|
2e2c49 |
Subject: [PATCH 2/2] Squashed commit of the following:
|
|
|
2e2c49 |
MIME-Version: 1.0
|
|
|
2e2c49 |
Content-Type: text/plain; charset=UTF-8
|
|
|
2e2c49 |
Content-Transfer-Encoding: 8bit
|
|
|
2e2c49 |
|
|
|
2e2c49 |
commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa
|
|
|
2e2c49 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
2e2c49 |
Date: Wed Mar 7 20:35:13 2018 +0100
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
commit ab303db70082db76ecf36493d0b82ef3e8750cad
|
|
|
2e2c49 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
2e2c49 |
Date: Wed Mar 7 18:11:10 2018 +0100
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Changed root key to be RSASHA256
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Change bad trusted key to be the same algorithm.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8
|
|
|
2e2c49 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
2e2c49 |
Date: Wed Mar 7 16:56:17 2018 +0100
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Change used key to not use hmac-md5
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Fix upforwd test, do not use hmac-md5
|
|
|
2e2c49 |
|
|
|
2e2c49 |
commit aec891571626f053acfb4d0a247240cbc21a84e9
|
|
|
2e2c49 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
2e2c49 |
Date: Wed Mar 7 15:54:11 2018 +0100
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Increase bitsize of DSA key to pass FIPS 140-2 mode.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696
|
|
|
2e2c49 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
2e2c49 |
Date: Wed Mar 7 15:41:08 2018 +0100
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Fix tsig and rndc tests for disabled md5
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Use hmac-sha256 instead of hmac-md5.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67
|
|
|
2e2c49 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
2e2c49 |
Date: Wed Mar 7 13:21:00 2018 +0100
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Add md5 availability detection to featuretest
|
|
|
2e2c49 |
|
|
|
2e2c49 |
commit f389a918803e2853e4b55fed62765dc4a492e34f
|
|
|
2e2c49 |
Author: Petr Menšík <pemensik@redhat.com>
|
|
|
2e2c49 |
Date: Wed Mar 7 10:44:23 2018 +0100
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Change tests to not use hmac-md5 algorithms if not required
|
|
|
2e2c49 |
|
|
|
2e2c49 |
Use hmac-sha256 instead of default hmac-md5 for allow-query
|
|
|
2e2c49 |
---
|
|
|
2e2c49 |
bin/tests/system/acl/ns2/named1.conf.in | 4 +-
|
|
|
2e2c49 |
bin/tests/system/acl/ns2/named2.conf.in | 4 +-
|
|
|
2e2c49 |
bin/tests/system/acl/ns2/named3.conf.in | 6 +--
|
|
|
2e2c49 |
bin/tests/system/acl/ns2/named4.conf.in | 4 +-
|
|
|
2e2c49 |
bin/tests/system/acl/ns2/named5.conf.in | 4 +-
|
|
|
2e2c49 |
bin/tests/system/acl/tests.sh | 32 +++++------
|
|
|
2e2c49 |
bin/tests/system/allow-query/ns2/named10.conf.in | 2 +-
|
|
|
2e2c49 |
bin/tests/system/allow-query/ns2/named11.conf.in | 4 +-
|
|
|
2e2c49 |
bin/tests/system/allow-query/ns2/named12.conf.in | 2 +-
|
|
|
2e2c49 |
bin/tests/system/allow-query/ns2/named30.conf.in | 2 +-
|
|
|
2e2c49 |
bin/tests/system/allow-query/ns2/named31.conf.in | 4 +-
|
|
|
2e2c49 |
bin/tests/system/allow-query/ns2/named32.conf.in | 2 +-
|
|
|
2e2c49 |
bin/tests/system/allow-query/ns2/named40.conf.in | 4 +-
|
|
|
2e2c49 |
bin/tests/system/allow-query/tests.sh | 18 +++----
|
|
|
2e2c49 |
bin/tests/system/catz/ns1/named.conf.in | 2 +-
|
|
|
2e2c49 |
bin/tests/system/catz/ns2/named.conf.in | 2 +-
|
|
|
2e2c49 |
bin/tests/system/checkconf/bad-tsig.conf | 2 +-
|
|
|
2e2c49 |
bin/tests/system/checkconf/good.conf | 2 +-
|
|
|
2e2c49 |
bin/tests/system/digdelv/ns2/example.db | 15 +++---
|
|
|
2e2c49 |
bin/tests/system/digdelv/tests.sh | 28 +++++-----
|
|
|
2e2c49 |
bin/tests/system/dlv/ns1/sign.sh | 4 +-
|
|
|
2e2c49 |
bin/tests/system/dlv/ns2/sign.sh | 4 +-
|
|
|
2e2c49 |
bin/tests/system/dlv/ns3/sign.sh | 69 ++++++++++++------------
|
|
|
2e2c49 |
bin/tests/system/dlv/ns6/sign.sh | 66 ++++++++++++-----------
|
|
|
2e2c49 |
bin/tests/system/dnssec/ns1/sign.sh | 4 +-
|
|
|
2e2c49 |
bin/tests/system/dnssec/ns2/sign.sh | 12 ++---
|
|
|
2e2c49 |
bin/tests/system/dnssec/ns3/sign.sh | 20 +++----
|
|
|
2e2c49 |
bin/tests/system/dnssec/ns5/trusted.conf.bad | 2 +-
|
|
|
2e2c49 |
bin/tests/system/dnssec/tests.sh | 8 +--
|
|
|
2e2c49 |
bin/tests/system/feature-test.c | 14 +++++
|
|
|
2e2c49 |
bin/tests/system/filter-aaaa/ns1/sign.sh | 4 +-
|
|
|
2e2c49 |
bin/tests/system/filter-aaaa/ns4/sign.sh | 4 +-
|
|
|
2e2c49 |
bin/tests/system/notify/ns5/named.conf.in | 6 +--
|
|
|
2e2c49 |
bin/tests/system/notify/tests.sh | 6 +--
|
|
|
2e2c49 |
bin/tests/system/nsupdate/ns1/named.conf.in | 2 +-
|
|
|
2e2c49 |
bin/tests/system/nsupdate/ns2/named.conf.in | 2 +-
|
|
|
2e2c49 |
bin/tests/system/nsupdate/setup.sh | 7 ++-
|
|
|
2e2c49 |
bin/tests/system/nsupdate/tests.sh | 11 +++-
|
|
|
2e2c49 |
bin/tests/system/rndc/setup.sh | 2 +-
|
|
|
2e2c49 |
bin/tests/system/rndc/tests.sh | 23 ++++----
|
|
|
2e2c49 |
bin/tests/system/tsig/clean.sh | 1 +
|
|
|
2e2c49 |
bin/tests/system/tsig/ns1/named.conf.in | 10 +---
|
|
|
2e2c49 |
bin/tests/system/tsig/ns1/rndc5.conf.in | 11 ++++
|
|
|
2e2c49 |
bin/tests/system/tsig/setup.sh | 4 ++
|
|
|
2e2c49 |
bin/tests/system/tsig/tests.sh | 67 ++++++++++++++---------
|
|
|
2e2c49 |
bin/tests/system/tsiggss/setup.sh | 2 +-
|
|
|
2e2c49 |
bin/tests/system/upforwd/ns1/named.conf.in | 2 +-
|
|
|
2e2c49 |
bin/tests/system/upforwd/tests.sh | 2 +-
|
|
|
2e2c49 |
48 files changed, 287 insertions(+), 225 deletions(-)
|
|
|
2e2c49 |
create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in
|
|
|
2e2c49 |
index 0ea6502708..026db3f134 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/acl/ns2/named1.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/acl/ns2/named1.conf.in
|
|
|
2e2c49 |
@@ -33,12 +33,12 @@ options {
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key two {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in
|
|
|
2e2c49 |
index b877880554..d8f50be255 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/acl/ns2/named2.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/acl/ns2/named2.conf.in
|
|
|
2e2c49 |
@@ -33,12 +33,12 @@ options {
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key two {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in
|
|
|
2e2c49 |
index 0a950622a2..aa54088138 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/acl/ns2/named3.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/acl/ns2/named3.conf.in
|
|
|
2e2c49 |
@@ -33,17 +33,17 @@ options {
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key two {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key three {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in
|
|
|
2e2c49 |
index 7cdcb6e341..606a3452d8 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/acl/ns2/named4.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/acl/ns2/named4.conf.in
|
|
|
2e2c49 |
@@ -33,12 +33,12 @@ options {
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key two {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in
|
|
|
2e2c49 |
index 4b4e05027a..0e679a821d 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/acl/ns2/named5.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/acl/ns2/named5.conf.in
|
|
|
2e2c49 |
@@ -34,12 +34,12 @@ options {
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key two {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
|
|
|
2e2c49 |
index 09f31f2bb9..f88f0d4430 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/acl/tests.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/acl/tests.sh
|
|
|
2e2c49 |
@@ -22,14 +22,14 @@ echo_i "testing basic ACL processing"
|
|
|
2e2c49 |
# key "one" should fail
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# any other key should be fine
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
copy_setports ns2/named2.conf.in ns2/named.conf
|
|
|
2e2c49 |
@@ -39,18 +39,18 @@ sleep 5
|
|
|
2e2c49 |
# prefix 10/8 should fail
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# any other address should work, as long as it sends key "one"
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "testing nested ACL processing"
|
|
|
2e2c49 |
@@ -62,31 +62,31 @@ sleep 5
|
|
|
2e2c49 |
# should succeed
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# should succeed
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# should succeed
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# should succeed
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# but only one or the other should fail
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
@@ -97,7 +97,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1
|
|
|
2e2c49 |
# and other values? right out
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
|
|
|
2e2c49 |
@@ -108,31 +108,31 @@ sleep 5
|
|
|
2e2c49 |
# should succeed
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# should succeed
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# should fail
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# should fail
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
# should fail
|
|
|
2e2c49 |
t=`expr $t + 1`
|
|
|
2e2c49 |
$DIG $DIGOPTS tsigzone. \
|
|
|
2e2c49 |
- @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
+ @10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t}
|
|
|
2e2c49 |
grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "testing allow-query-on ACL processing"
|
|
|
2e2c49 |
diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in
|
|
|
2e2c49 |
index 1569913b37..e9c5c2d574 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/allow-query/ns2/named10.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/allow-query/ns2/named10.conf.in
|
|
|
2e2c49 |
@@ -12,7 +12,7 @@
|
|
|
2e2c49 |
controls { /* empty */ };
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in
|
|
|
2e2c49 |
index 18ac91c6e7..2b1c8739d8 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/allow-query/ns2/named11.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/allow-query/ns2/named11.conf.in
|
|
|
2e2c49 |
@@ -12,12 +12,12 @@
|
|
|
2e2c49 |
controls { /* empty */ };
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key two {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234efgh8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in
|
|
|
2e2c49 |
index b8248444dd..dd48945bf8 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/allow-query/ns2/named12.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/allow-query/ns2/named12.conf.in
|
|
|
2e2c49 |
@@ -12,7 +12,7 @@
|
|
|
2e2c49 |
controls { /* empty */ };
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in
|
|
|
2e2c49 |
index aeb1540e95..bfce58bddd 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/allow-query/ns2/named30.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/allow-query/ns2/named30.conf.in
|
|
|
2e2c49 |
@@ -12,7 +12,7 @@
|
|
|
2e2c49 |
controls { /* empty */ };
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in
|
|
|
2e2c49 |
index d4b743281a..e0f52526ba 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/allow-query/ns2/named31.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/allow-query/ns2/named31.conf.in
|
|
|
2e2c49 |
@@ -12,12 +12,12 @@
|
|
|
2e2c49 |
controls { /* empty */ };
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key two {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234efgh8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in
|
|
|
2e2c49 |
index c0259387e7..87afb3fa3a 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/allow-query/ns2/named32.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/allow-query/ns2/named32.conf.in
|
|
|
2e2c49 |
@@ -12,7 +12,7 @@
|
|
|
2e2c49 |
controls { /* empty */ };
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in
|
|
|
2e2c49 |
index d83b376cfd..d726b9480b 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/allow-query/ns2/named40.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/allow-query/ns2/named40.conf.in
|
|
|
2e2c49 |
@@ -16,12 +16,12 @@ acl accept { 10.53.0.2; };
|
|
|
2e2c49 |
acl badaccept { 10.53.0.1; };
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key one {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key two {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "1234efgh8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh
|
|
|
2e2c49 |
index fb6059d5b8..f9601564a2 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/allow-query/tests.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/allow-query/tests.sh
|
|
|
2e2c49 |
@@ -190,7 +190,7 @@ rndc_reload
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "test $n: key allowed - query allowed"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
@@ -203,7 +203,7 @@ rndc_reload
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "test $n: key not allowed - query refused"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
@@ -216,7 +216,7 @@ rndc_reload
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "test $n: key disallowed - query refused"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
@@ -349,7 +349,7 @@ rndc_reload
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "test $n: views key allowed - query allowed"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
@@ -362,7 +362,7 @@ rndc_reload
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "test $n: views key not allowed - query refused"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
@@ -375,7 +375,7 @@ rndc_reload
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "test $n: views key disallowed - query refused"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
@@ -508,7 +508,7 @@ status=`expr $status + $ret`
|
|
|
2e2c49 |
n=`expr $n + 1`
|
|
|
2e2c49 |
echo_i "test $n: zone key allowed - query allowed"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
@@ -518,7 +518,7 @@ status=`expr $status + $ret`
|
|
|
2e2c49 |
n=`expr $n + 1`
|
|
|
2e2c49 |
echo_i "test $n: zone key not allowed - query refused"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
@@ -528,7 +528,7 @@ status=`expr $status + $ret`
|
|
|
2e2c49 |
n=`expr $n + 1`
|
|
|
2e2c49 |
echo_i "test $n: zone key disallowed - query refused"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
|
|
|
2e2c49 |
grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
diff --git a/bin/tests/system/catz/ns1/named.conf.in b/bin/tests/system/catz/ns1/named.conf.in
|
|
|
2e2c49 |
index 74b7d371b7..c35376640d 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/catz/ns1/named.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/catz/ns1/named.conf.in
|
|
|
2e2c49 |
@@ -61,5 +61,5 @@ zone "catalog4.example" {
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key tsig_key. {
|
|
|
2e2c49 |
secret "LSAnCU+Z";
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
diff --git a/bin/tests/system/catz/ns2/named.conf.in b/bin/tests/system/catz/ns2/named.conf.in
|
|
|
2e2c49 |
index ee83efbee4..35ced08842 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/catz/ns2/named.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/catz/ns2/named.conf.in
|
|
|
2e2c49 |
@@ -70,5 +70,5 @@ zone "catalog4.example" {
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key tsig_key. {
|
|
|
2e2c49 |
secret "LSAnCU+Z";
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf
|
|
|
2e2c49 |
index 21be03e9d2..e57c30875c 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/checkconf/bad-tsig.conf
|
|
|
2e2c49 |
+++ b/bin/tests/system/checkconf/bad-tsig.conf
|
|
|
2e2c49 |
@@ -11,7 +11,7 @@
|
|
|
2e2c49 |
|
|
|
2e2c49 |
/* Bad secret */
|
|
|
2e2c49 |
key "badtsig" {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha256;
|
|
|
2e2c49 |
secret "jEdD+BPKg==";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf
|
|
|
2e2c49 |
index 9ab35b38a5..486551ae64 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/checkconf/good.conf
|
|
|
2e2c49 |
+++ b/bin/tests/system/checkconf/good.conf
|
|
|
2e2c49 |
@@ -153,6 +153,6 @@ dyndb "name" "library.so" {
|
|
|
2e2c49 |
system;
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
key "mykey" {
|
|
|
2e2c49 |
- algorithm "hmac-md5";
|
|
|
2e2c49 |
+ algorithm "hmac-sha256";
|
|
|
2e2c49 |
secret "qwertyuiopasdfgh";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
diff --git a/bin/tests/system/digdelv/ns2/example.db b/bin/tests/system/digdelv/ns2/example.db
|
|
|
2e2c49 |
index f4e30f51e5..9f53e31c97 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/digdelv/ns2/example.db
|
|
|
2e2c49 |
+++ b/bin/tests/system/digdelv/ns2/example.db
|
|
|
2e2c49 |
@@ -38,12 +38,15 @@ foo SSHFP 2 1 123456789abcdef67890123456789abcdef67890
|
|
|
2e2c49 |
;;
|
|
|
2e2c49 |
;; we are not testing DNSSEC behavior, so we don't care about the semantics
|
|
|
2e2c49 |
;; of the following records.
|
|
|
2e2c49 |
-dnskey 300 DNSKEY 256 3 1 (
|
|
|
2e2c49 |
- AQPTpWyReB/e9Ii6mVGnakS8hX2zkh/iUYAg
|
|
|
2e2c49 |
- +Ge4noWROpTWOIBvm76zeJPWs4Zfqa1IsswD
|
|
|
2e2c49 |
- Ix5Mqeg0zwclz59uecKsKyx5w9IhtZ8plc4R
|
|
|
2e2c49 |
- b9VIE5x7KNHAYTvTO5d4S8M=
|
|
|
2e2c49 |
- )
|
|
|
2e2c49 |
+dnskey 300 DNSKEY 256 3 8 (
|
|
|
2e2c49 |
+ AwEAAaWmCoDpj2K59zcpqnmnQM7IC/XbjS6jIP7uTBR4X7p1bdQJzAeo
|
|
|
2e2c49 |
+ EnMhnpnxPp0j+20eZm4847DB2U+HuHy79Mvqd3aozTmfBJvzjKs9qyba
|
|
|
2e2c49 |
+ zY/ZHn6BDYxNJiFfjSS/VJ1KuQPDbpCzhm2hbvT5s9nSOaG0WyRk+d+R
|
|
|
2e2c49 |
+ qEca11E7ZKkmmNiGlyzMAgfmTTBwgxWBAAhvd9nU1GqD6eQ6Z63hpTc/
|
|
|
2e2c49 |
+ KDIHnFTo7pOcZ4z5urIKUMCMcFytedETlEoR5CIWGPdQq2eIEEMfn5ld
|
|
|
2e2c49 |
+ QqdEZRHVErD9og8aluJ2s767HZb8LzjCfYgBFoT9/n48T75oZLEKtSkG
|
|
|
2e2c49 |
+ /idCeeQlaLU=
|
|
|
2e2c49 |
+ )
|
|
|
2e2c49 |
|
|
|
2e2c49 |
; TTL of 3 weeks
|
|
|
2e2c49 |
weeks 1814400 A 10.53.0.2
|
|
|
2e2c49 |
diff --git a/bin/tests/system/digdelv/tests.sh b/bin/tests/system/digdelv/tests.sh
|
|
|
2e2c49 |
index 1b25c4ddfc..5dbf20a3e1 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/digdelv/tests.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/digdelv/tests.sh
|
|
|
2e2c49 |
@@ -62,7 +62,7 @@ if [ -x ${DIG} ] ; then
|
|
|
2e2c49 |
echo_i "checking dig +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
|
|
|
2e2c49 |
+ grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -70,7 +70,7 @@ if [ -x ${DIG} ] ; then
|
|
|
2e2c49 |
echo_i "checking dig +multi +norrcomments works for soa (when default is rrcomments)($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DIG $DIGOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > dig.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null && ret=1
|
|
|
2e2c49 |
+ grep "; ZSK; alg = RSASHA256 ; key id = 36895" < dig.out.test$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -78,7 +78,7 @@ if [ -x ${DIG} ] ; then
|
|
|
2e2c49 |
echo_i "checking dig +rrcomments works for DNSKEY($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DIG $DIGOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -86,7 +86,7 @@ if [ -x ${DIG} ] ; then
|
|
|
2e2c49 |
echo_i "checking dig +short +rrcomments works for DNSKEY ($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "; ZSK; alg = RSAMD5 ; key id = 30795" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -94,7 +94,7 @@ if [ -x ${DIG} ] ; then
|
|
|
2e2c49 |
echo_i "checking dig +short +nosplit works($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DIG $DIGOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > dig.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "Z8plc4Rb9VIE5x7KNHAYTvTO5d4S8M=$" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "T9/n48T75oZLEKtSkG/idCeeQlaLU=$" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -102,7 +102,7 @@ if [ -x ${DIG} ] ; then
|
|
|
2e2c49 |
echo_i "checking dig +short +rrcomments works($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "S8M= ; ZSK; alg = RSAMD5 ; key id = 30795$" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "aLU= ; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -118,7 +118,7 @@ if [ -x ${DIG} ] ; then
|
|
|
2e2c49 |
echo_i "checking dig +short +rrcomments works($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DIG $DIGOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > dig.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "S8M= ; ZSK; alg = RSAMD5 ; key id = 30795$" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "aLU= ; ZSK; alg = RSASHA256 ; key id = 36895$" < dig.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -543,7 +543,7 @@ if [ -x ${DELV} ] ; then
|
|
|
2e2c49 |
echo_i "checking delv +multi +norrcomments works for dnskey (when default is rrcomments)($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
|
|
|
2e2c49 |
+ grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -551,7 +551,7 @@ if [ -x ${DELV} ] ; then
|
|
|
2e2c49 |
echo_i "checking delv +multi +norrcomments works for soa (when default is rrcomments)($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DELV $DELVOPTS +tcp @10.53.0.3 +multi +norrcomments SOA example > delv.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null && ret=1
|
|
|
2e2c49 |
+ grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null && ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -559,7 +559,7 @@ if [ -x ${DELV} ] ; then
|
|
|
2e2c49 |
echo_i "checking delv +rrcomments works for DNSKEY($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DELV $DELVOPTS +tcp @10.53.0.3 +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -567,7 +567,7 @@ if [ -x ${DELV} ] ; then
|
|
|
2e2c49 |
echo_i "checking delv +short +rrcomments works for DNSKEY ($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "; ZSK; alg = RSAMD5 ; key id = 30795" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "; ZSK; alg = RSASHA256 ; key id = 36895" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -575,7 +575,7 @@ if [ -x ${DELV} ] ; then
|
|
|
2e2c49 |
echo_i "checking delv +short +rrcomments works ($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DELV $DELVOPTS +tcp @10.53.0.3 +short +rrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "S8M= ; ZSK; alg = RSAMD5 ; key id = 30795$" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "aLU= ; ZSK; alg = RSASHA256 ; key id = 36895$" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -583,7 +583,7 @@ if [ -x ${DELV} ] ; then
|
|
|
2e2c49 |
echo_i "checking delv +short +nosplit works ($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit DNSKEY dnskey.example > delv.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "Z8plc4Rb9VIE5x7KNHAYTvTO5d4S8M=" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "T9/n48T75oZLEKtSkG/idCeeQlaLU=" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
|
|
|
2e2c49 |
f=`awk '{print NF}' < delv.out.test$n`
|
|
|
2e2c49 |
test "${f:-0}" -eq 14 || ret=1
|
|
|
2e2c49 |
@@ -594,7 +594,7 @@ if [ -x ${DELV} ] ; then
|
|
|
2e2c49 |
echo_i "checking delv +short +nosplit +norrcomments works ($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DELV $DELVOPTS +tcp @10.53.0.3 +short +nosplit +norrcomments DNSKEY dnskey.example > delv.out.test$n || ret=1
|
|
|
2e2c49 |
- grep "Z8plc4Rb9VIE5x7KNHAYTvTO5d4S8M=$" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+ grep "T9/n48T75oZLEKtSkG/idCeeQlaLU=$" < delv.out.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
if test `wc -l < delv.out.test$n` != 1 ; then ret=1 ; fi
|
|
|
2e2c49 |
f=`awk '{print NF}' < delv.out.test$n`
|
|
|
2e2c49 |
test "${f:-0}" -eq 4 || ret=1
|
|
|
2e2c49 |
diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh
|
|
|
2e2c49 |
index b8151620cc..2a62e583b8 100755
|
|
|
2e2c49 |
--- a/bin/tests/system/dlv/ns1/sign.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/dlv/ns1/sign.sh
|
|
|
2e2c49 |
@@ -23,8 +23,8 @@ infile=root.db.in
|
|
|
2e2c49 |
zonefile=root.db
|
|
|
2e2c49 |
outfile=root.signed
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh
|
|
|
2e2c49 |
index 6f84d7a525..e128303a22 100755
|
|
|
2e2c49 |
--- a/bin/tests/system/dlv/ns2/sign.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/dlv/ns2/sign.sh
|
|
|
2e2c49 |
@@ -24,8 +24,8 @@ zonefile=druz.db
|
|
|
2e2c49 |
outfile=druz.pre
|
|
|
2e2c49 |
dlvzone=utld.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh
|
|
|
2e2c49 |
index bcc9922e26..846dbcc0df 100755
|
|
|
2e2c49 |
--- a/bin/tests/system/dlv/ns3/sign.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/dlv/ns3/sign.sh
|
|
|
2e2c49 |
@@ -19,6 +19,7 @@ echo_i "dlv/ns3/sign.sh"
|
|
|
2e2c49 |
dlvzone=dlv.utld.
|
|
|
2e2c49 |
dlvsets=
|
|
|
2e2c49 |
dssets=
|
|
|
2e2c49 |
+bits=1024
|
|
|
2e2c49 |
|
|
|
2e2c49 |
zone=child1.utld.
|
|
|
2e2c49 |
infile=child.db.in
|
|
|
2e2c49 |
@@ -26,8 +27,8 @@ zonefile=child1.utld.db
|
|
|
2e2c49 |
outfile=child1.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
|
|
2e2c49 |
@@ -42,8 +43,8 @@ zonefile=child3.utld.db
|
|
|
2e2c49 |
outfile=child3.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
|
|
2e2c49 |
@@ -58,8 +59,8 @@ zonefile=child4.utld.db
|
|
|
2e2c49 |
outfile=child4.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -73,8 +74,8 @@ zonefile=child5.utld.db
|
|
|
2e2c49 |
outfile=child5.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
|
|
2e2c49 |
@@ -88,8 +89,8 @@ infile=child.db.in
|
|
|
2e2c49 |
zonefile=child7.utld.db
|
|
|
2e2c49 |
outfile=child7.signed
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
|
|
2e2c49 |
@@ -103,8 +104,8 @@ infile=child.db.in
|
|
|
2e2c49 |
zonefile=child8.utld.db
|
|
|
2e2c49 |
outfile=child8.signed
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -118,8 +119,8 @@ zonefile=child9.utld.db
|
|
|
2e2c49 |
outfile=child9.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -132,8 +133,8 @@ zonefile=child10.utld.db
|
|
|
2e2c49 |
outfile=child10.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -147,8 +148,8 @@ outfile=child1.druz.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
|
|
2e2c49 |
@@ -164,8 +165,8 @@ outfile=child3.druz.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
|
|
2e2c49 |
@@ -181,8 +182,8 @@ outfile=child4.druz.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -197,8 +198,8 @@ outfile=child5.druz.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
|
|
2e2c49 |
@@ -213,8 +214,8 @@ zonefile=child7.druz.db
|
|
|
2e2c49 |
outfile=child7.druz.signed
|
|
|
2e2c49 |
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
|
|
2e2c49 |
@@ -228,8 +229,8 @@ infile=child.db.in
|
|
|
2e2c49 |
zonefile=child8.druz.db
|
|
|
2e2c49 |
outfile=child8.druz.signed
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -243,8 +244,8 @@ zonefile=child9.druz.db
|
|
|
2e2c49 |
outfile=child9.druz.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -258,8 +259,8 @@ outfile=child10.druz.signed
|
|
|
2e2c49 |
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -272,8 +273,8 @@ infile=dlv.db.in
|
|
|
2e2c49 |
zonefile=dlv.utld.db
|
|
|
2e2c49 |
outfile=dlv.signed
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
|
|
|
2e2c49 |
index 1e398625f1..4ed19acd1f 100755
|
|
|
2e2c49 |
--- a/bin/tests/system/dlv/ns6/sign.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/dlv/ns6/sign.sh
|
|
|
2e2c49 |
@@ -16,13 +16,15 @@ SYSTESTDIR=dlv
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "dlv/ns6/sign.sh"
|
|
|
2e2c49 |
|
|
|
2e2c49 |
+bits=1024
|
|
|
2e2c49 |
+
|
|
|
2e2c49 |
zone=grand.child1.utld.
|
|
|
2e2c49 |
infile=child.db.in
|
|
|
2e2c49 |
zonefile=grand.child1.utld.db
|
|
|
2e2c49 |
outfile=grand.child1.signed
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -36,8 +38,8 @@ zonefile=grand.child3.utld.db
|
|
|
2e2c49 |
outfile=grand.child3.signed
|
|
|
2e2c49 |
dlvzone=dlv.utld.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -51,8 +53,8 @@ zonefile=grand.child4.utld.db
|
|
|
2e2c49 |
outfile=grand.child4.signed
|
|
|
2e2c49 |
dlvzone=dlv.utld.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -66,8 +68,8 @@ zonefile=grand.child5.utld.db
|
|
|
2e2c49 |
outfile=grand.child5.signed
|
|
|
2e2c49 |
dlvzone=dlv.utld.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -81,8 +83,8 @@ zonefile=grand.child7.utld.db
|
|
|
2e2c49 |
outfile=grand.child7.signed
|
|
|
2e2c49 |
dlvzone=dlv.utld.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -96,8 +98,8 @@ zonefile=grand.child8.utld.db
|
|
|
2e2c49 |
outfile=grand.child8.signed
|
|
|
2e2c49 |
dlvzone=dlv.utld.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -111,8 +113,8 @@ zonefile=grand.child9.utld.db
|
|
|
2e2c49 |
outfile=grand.child9.signed
|
|
|
2e2c49 |
dlvzone=dlv.utld.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -125,8 +127,8 @@ zonefile=grand.child10.utld.db
|
|
|
2e2c49 |
outfile=grand.child10.signed
|
|
|
2e2c49 |
dlvzone=dlv.utld.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -138,8 +140,8 @@ infile=child.db.in
|
|
|
2e2c49 |
zonefile=grand.child1.druz.db
|
|
|
2e2c49 |
outfile=grand.child1.druz.signed
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -153,8 +155,8 @@ zonefile=grand.child3.druz.db
|
|
|
2e2c49 |
outfile=grand.child3.druz.signed
|
|
|
2e2c49 |
dlvzone=dlv.druz.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -168,8 +170,8 @@ zonefile=grand.child4.druz.db
|
|
|
2e2c49 |
outfile=grand.child4.druz.signed
|
|
|
2e2c49 |
dlvzone=dlv.druz.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -183,8 +185,8 @@ zonefile=grand.child5.druz.db
|
|
|
2e2c49 |
outfile=grand.child5.druz.signed
|
|
|
2e2c49 |
dlvzone=dlv.druz.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -198,8 +200,8 @@ zonefile=grand.child7.druz.db
|
|
|
2e2c49 |
outfile=grand.child7.druz.signed
|
|
|
2e2c49 |
dlvzone=dlv.druz.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -213,8 +215,8 @@ zonefile=grand.child8.druz.db
|
|
|
2e2c49 |
outfile=grand.child8.druz.signed
|
|
|
2e2c49 |
dlvzone=dlv.druz.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -228,8 +230,8 @@ zonefile=grand.child9.druz.db
|
|
|
2e2c49 |
outfile=grand.child9.druz.signed
|
|
|
2e2c49 |
dlvzone=dlv.druz.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -242,8 +244,8 @@ zonefile=grand.child10.druz.db
|
|
|
2e2c49 |
outfile=grand.child10.druz.signed
|
|
|
2e2c49 |
dlvzone=dlv.druz.
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b $bits -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
|
|
|
2e2c49 |
index 198d60ae15..d89a539ffd 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/dnssec/ns1/sign.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/dnssec/ns1/sign.sh
|
|
|
2e2c49 |
@@ -27,7 +27,7 @@ cp ../ns2/dsset-in-addr.arpa$TP .
|
|
|
2e2c49 |
grep "8 [12] " ../ns2/dsset-algroll$TP > dsset-algroll$TP
|
|
|
2e2c49 |
cp ../ns6/dsset-optout-tld$TP .
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname.key > $zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -48,6 +48,6 @@ cp managed.conf ../ns4/managed.conf
|
|
|
2e2c49 |
#
|
|
|
2e2c49 |
# Save keyid for managed key id test.
|
|
|
2e2c49 |
#
|
|
|
2e2c49 |
-keyid=`expr $keyname : 'K.+001+\(.*\)'`
|
|
|
2e2c49 |
+keyid=`expr $keyname : 'K.+008+\([0-9]*\)'`
|
|
|
2e2c49 |
keyid=`expr $keyid + 0`
|
|
|
2e2c49 |
echo "$keyid" > managed.key.id
|
|
|
2e2c49 |
diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
|
|
|
2e2c49 |
index 9078459ac8..9dcd028eb5 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/dnssec/ns2/sign.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/dnssec/ns2/sign.sh
|
|
|
2e2c49 |
@@ -29,8 +29,8 @@ do
|
|
|
2e2c49 |
cp ../ns3/dsset-$subdomain.example$TP .
|
|
|
2e2c49 |
done
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -89,8 +89,8 @@ zone=in-addr.arpa.
|
|
|
2e2c49 |
infile=in-addr.arpa.db.in
|
|
|
2e2c49 |
zonefile=in-addr.arpa.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 1024 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
$SIGNER -P -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
|
|
|
2e2c49 |
@@ -101,7 +101,7 @@ privzone=private.secure.example.
|
|
|
2e2c49 |
privinfile=private.secure.example.db.in
|
|
|
2e2c49 |
privzonefile=private.secure.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-privkeyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $privzone`
|
|
|
2e2c49 |
+privkeyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $privzone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $privinfile $privkeyname.key >$privzonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -115,7 +115,7 @@ dlvinfile=dlv.db.in
|
|
|
2e2c49 |
dlvzonefile=dlv.db
|
|
|
2e2c49 |
dlvsetfile=dlvset-`echo $privzone |sed -e "s/\.$//g"`$TP
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $dlvzone`
|
|
|
2e2c49 |
+dlvkeyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $dlvzone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $dlvinfile $dlvkeyname.key $dlvsetfile > $dlvzonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
|
|
|
2e2c49 |
index 330abf7feb..f95a6b7ea8 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/dnssec/ns3/sign.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/dnssec/ns3/sign.sh
|
|
|
2e2c49 |
@@ -28,7 +28,7 @@ zone=bogus.example.
|
|
|
2e2c49 |
infile=bogus.example.db.in
|
|
|
2e2c49 |
zonefile=bogus.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -38,8 +38,8 @@ zone=dynamic.example.
|
|
|
2e2c49 |
infile=dynamic.example.db.in
|
|
|
2e2c49 |
zonefile=dynamic.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 1024 -n zone -f KSK $zone`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone -f KSK $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -49,7 +49,7 @@ zone=keyless.example.
|
|
|
2e2c49 |
infile=generic.example.db.in
|
|
|
2e2c49 |
zonefile=keyless.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -69,7 +69,7 @@ zone=secure.nsec3.example.
|
|
|
2e2c49 |
infile=secure.nsec3.example.db.in
|
|
|
2e2c49 |
zonefile=secure.nsec3.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -82,7 +82,7 @@ zone=nsec3.nsec3.example.
|
|
|
2e2c49 |
infile=nsec3.nsec3.example.db.in
|
|
|
2e2c49 |
zonefile=nsec3.nsec3.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -95,7 +95,7 @@ zone=optout.nsec3.example.
|
|
|
2e2c49 |
infile=optout.nsec3.example.db.in
|
|
|
2e2c49 |
zonefile=optout.nsec3.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -108,7 +108,7 @@ zone=nsec3.example.
|
|
|
2e2c49 |
infile=nsec3.example.db.in
|
|
|
2e2c49 |
zonefile=nsec3.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -121,7 +121,7 @@ zone=secure.optout.example.
|
|
|
2e2c49 |
infile=secure.optout.example.db.in
|
|
|
2e2c49 |
zonefile=secure.optout.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
@@ -498,7 +498,7 @@ zone=badds.example.
|
|
|
2e2c49 |
infile=bogus.example.db.in
|
|
|
2e2c49 |
zonefile=badds.example.db
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
|
|
2e2c49 |
+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 2048 -n zone $zone`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/dnssec/ns5/trusted.conf.bad b/bin/tests/system/dnssec/ns5/trusted.conf.bad
|
|
|
2e2c49 |
index ed30460bda..e6b112630e 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/dnssec/ns5/trusted.conf.bad
|
|
|
2e2c49 |
+++ b/bin/tests/system/dnssec/ns5/trusted.conf.bad
|
|
|
2e2c49 |
@@ -10,5 +10,5 @@
|
|
|
2e2c49 |
*/
|
|
|
2e2c49 |
|
|
|
2e2c49 |
trusted-keys {
|
|
|
2e2c49 |
- "." 256 3 1 "AQO6Cl+slAf+iuieDim9L3kujFHQD7s/IOj03ClMOpKYcTXtK4mRpuULVfvWxDi9Ew/gj0xLnnX7z9OJHIxLI+DSrAHd8Dm0XfBEAtVtJSn70GaPZgnLMw1rk5ap2DsEoWk=";
|
|
|
2e2c49 |
+ "." 256 3 8 "AwEAAarwAdjV4gIhpBCjXVAScRFEx3co7k8smJdxrnqoGsl5NB7EZ9jRdgvCXbJn6v8y9jlNWVHvaC8ilhfhLh0A1vLWiWv4ijd/12xcnrY7xpG7Cu3YkxUxaXJ7Jdg/Iw1+9mGgXF1v4UbCIcw/3U3cxyk7OxYg+VSb5KBAQSR0upxV";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
|
|
|
2e2c49 |
index bb2315fbf3..315666825e 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/dnssec/tests.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/dnssec/tests.sh
|
|
|
2e2c49 |
@@ -1690,7 +1690,7 @@ ret=0
|
|
|
2e2c49 |
$RNDCCMD 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
|
|
|
2e2c49 |
keyid=`cat ns1/managed.key.id`
|
|
|
2e2c49 |
cp ns4/named.secroots named.secroots.test$n
|
|
|
2e2c49 |
-linecount=`grep "./RSAMD5/$keyid ; trusted" named.secroots.test$n | wc -l`
|
|
|
2e2c49 |
+linecount=`grep "./RSASHA256/$keyid ; trusted" named.secroots.test$n | wc -l`
|
|
|
2e2c49 |
[ "$linecount" -eq 1 ] || ret=1
|
|
|
2e2c49 |
linecount=`cat named.secroots.test$n | wc -l`
|
|
|
2e2c49 |
[ "$linecount" -eq 10 ] || ret=1
|
|
|
2e2c49 |
@@ -3018,7 +3018,7 @@ echo_i "check dig's +nocrypto flag ($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
$DIG $DIGOPTS +norec +nocrypto DNSKEY . \
|
|
|
2e2c49 |
@10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1
|
|
|
2e2c49 |
-grep '256 3 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
+grep '256 3 8 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
grep 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
|
|
|
2e2c49 |
$DIG $DIGOPTS +norec +nocrypto DS example \
|
|
|
2e2c49 |
@10.53.0.1 > dig.out.ds.ns1.test$n || ret=1
|
|
|
2e2c49 |
@@ -3130,8 +3130,8 @@ do
|
|
|
2e2c49 |
alg=`expr $alg + 1`
|
|
|
2e2c49 |
continue;;
|
|
|
2e2c49 |
3) size="-b 512";;
|
|
|
2e2c49 |
- 5) size="-b 512";;
|
|
|
2e2c49 |
- 6) size="-b 512";;
|
|
|
2e2c49 |
+ 5) size="-b 1024";;
|
|
|
2e2c49 |
+ 6) size="-b 1024";;
|
|
|
2e2c49 |
7) size="-b 512";;
|
|
|
2e2c49 |
8) size="-b 512";;
|
|
|
2e2c49 |
10) size="-b 1024";;
|
|
|
2e2c49 |
diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c
|
|
|
2e2c49 |
index 9612450ab4..5eee6aa4f8 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/feature-test.c
|
|
|
2e2c49 |
+++ b/bin/tests/system/feature-test.c
|
|
|
2e2c49 |
@@ -19,6 +19,7 @@
|
|
|
2e2c49 |
#include <isc/print.h>
|
|
|
2e2c49 |
#include <isc/util.h>
|
|
|
2e2c49 |
#include <isc/net.h>
|
|
|
2e2c49 |
+#include <isc/md5.h>
|
|
|
2e2c49 |
#include <dns/edns.h>
|
|
|
2e2c49 |
|
|
|
2e2c49 |
#ifdef WIN32
|
|
|
2e2c49 |
@@ -45,6 +46,7 @@ usage() {
|
|
|
2e2c49 |
fprintf(stderr, " --have-geoip\n");
|
|
|
2e2c49 |
fprintf(stderr, " --have-libxml2\n");
|
|
|
2e2c49 |
fprintf(stderr, " --ipv6only=no\n");
|
|
|
2e2c49 |
+ fprintf(stderr, " --md5\n");
|
|
|
2e2c49 |
fprintf(stderr, " --rpz-nsdname\n");
|
|
|
2e2c49 |
fprintf(stderr, " --rpz-nsip\n");
|
|
|
2e2c49 |
fprintf(stderr, " --with-idn\n");
|
|
|
2e2c49 |
@@ -136,6 +138,18 @@ main(int argc, char **argv) {
|
|
|
2e2c49 |
#endif
|
|
|
2e2c49 |
}
|
|
|
2e2c49 |
|
|
|
2e2c49 |
+ if (strcmp(argv[1], "--md5") == 0) {
|
|
|
2e2c49 |
+#ifdef PK11_MD5_DISABLE
|
|
|
2e2c49 |
+ return (1);
|
|
|
2e2c49 |
+#else
|
|
|
2e2c49 |
+ if (isc_md5_available()) {
|
|
|
2e2c49 |
+ return (0);
|
|
|
2e2c49 |
+ } else {
|
|
|
2e2c49 |
+ return (1);
|
|
|
2e2c49 |
+ }
|
|
|
2e2c49 |
+#endif
|
|
|
2e2c49 |
+ }
|
|
|
2e2c49 |
+
|
|
|
2e2c49 |
if (strcmp(argv[1], "--rpz-nsip") == 0) {
|
|
|
2e2c49 |
#ifdef ENABLE_RPZ_NSIP
|
|
|
2e2c49 |
return (0);
|
|
|
2e2c49 |
diff --git a/bin/tests/system/filter-aaaa/ns1/sign.sh b/bin/tests/system/filter-aaaa/ns1/sign.sh
|
|
|
2e2c49 |
index f7555810a0..4a7d89004a 100755
|
|
|
2e2c49 |
--- a/bin/tests/system/filter-aaaa/ns1/sign.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/filter-aaaa/ns1/sign.sh
|
|
|
2e2c49 |
@@ -21,8 +21,8 @@ infile=signed.db.in
|
|
|
2e2c49 |
zonefile=signed.db.signed
|
|
|
2e2c49 |
outfile=signed.db.signed
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/filter-aaaa/ns4/sign.sh b/bin/tests/system/filter-aaaa/ns4/sign.sh
|
|
|
2e2c49 |
index f7555810a0..4a7d89004a 100755
|
|
|
2e2c49 |
--- a/bin/tests/system/filter-aaaa/ns4/sign.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/filter-aaaa/ns4/sign.sh
|
|
|
2e2c49 |
@@ -21,8 +21,8 @@ infile=signed.db.in
|
|
|
2e2c49 |
zonefile=signed.db.signed
|
|
|
2e2c49 |
outfile=signed.db.signed
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 1024 -n zone $zone 2> /dev/null`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
cat $infile $keyname1.key $keyname2.key >$zonefile
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in
|
|
|
2e2c49 |
index cfcfe8fa2f..0a1614d527 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/notify/ns5/named.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/notify/ns5/named.conf.in
|
|
|
2e2c49 |
@@ -10,17 +10,17 @@
|
|
|
2e2c49 |
*/
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key "a" {
|
|
|
2e2c49 |
- algorithm "hmac-md5";
|
|
|
2e2c49 |
+ algorithm "hmac-sha256";
|
|
|
2e2c49 |
secret "aaaaaaaaaaaaaaaaaaaa";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key "b" {
|
|
|
2e2c49 |
- algorithm "hmac-md5";
|
|
|
2e2c49 |
+ algorithm "hmac-sha256";
|
|
|
2e2c49 |
secret "bbbbbbbbbbbbbbbbbbbb";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key "c" {
|
|
|
2e2c49 |
- algorithm "hmac-md5";
|
|
|
2e2c49 |
+ algorithm "hmac-sha256";
|
|
|
2e2c49 |
secret "cccccccccccccccccccc";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh
|
|
|
2e2c49 |
index ad20e3eaca..5a9ce4688a 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/notify/tests.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/notify/tests.sh
|
|
|
2e2c49 |
@@ -186,16 +186,16 @@ ret=0
|
|
|
2e2c49 |
$NSUPDATE << EOF
|
|
|
2e2c49 |
server 10.53.0.5 ${PORT}
|
|
|
2e2c49 |
zone x21
|
|
|
2e2c49 |
-key a aaaaaaaaaaaaaaaaaaaa
|
|
|
2e2c49 |
+key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa
|
|
|
2e2c49 |
update add added.x21 0 in txt "test string"
|
|
|
2e2c49 |
send
|
|
|
2e2c49 |
EOF
|
|
|
2e2c49 |
|
|
|
2e2c49 |
for i in 1 2 3 4 5 6 7 8 9
|
|
|
2e2c49 |
do
|
|
|
2e2c49 |
- $DIG $DIGOPTS added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
|
|
|
2e2c49 |
+ $DIG $DIGOPTS added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \
|
|
|
2e2c49 |
txt > dig.out.b.ns5.test$n || ret=1
|
|
|
2e2c49 |
- $DIG $DIGOPTS added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \
|
|
|
2e2c49 |
+ $DIG $DIGOPTS added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \
|
|
|
2e2c49 |
txt > dig.out.c.ns5.test$n || ret=1
|
|
|
2e2c49 |
grep "test string" dig.out.b.ns5.test$n > /dev/null &&
|
|
|
2e2c49 |
grep "test string" dig.out.c.ns5.test$n > /dev/null &&
|
|
|
2e2c49 |
diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in
|
|
|
2e2c49 |
index 1d999adc39..26b6b7c9ab 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/nsupdate/ns1/named.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/nsupdate/ns1/named.conf.in
|
|
|
2e2c49 |
@@ -32,7 +32,7 @@ controls {
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key altkey {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha512;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in
|
|
|
2e2c49 |
index b4ecf96668..1adb33eb0b 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/nsupdate/ns2/named.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/nsupdate/ns2/named.conf.in
|
|
|
2e2c49 |
@@ -24,7 +24,7 @@ options {
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key altkey {
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
+ algorithm hmac-sha512;
|
|
|
2e2c49 |
secret "1234abcd8765";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
|
|
|
2e2c49 |
index 32674eb382..2331b30b00 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/nsupdate/setup.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/nsupdate/setup.sh
|
|
|
2e2c49 |
@@ -59,7 +59,12 @@ EOF
|
|
|
2e2c49 |
|
|
|
2e2c49 |
$DDNSCONFGEN -q -r $RANDFILE -z example.nil > ns1/ddns.key
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-$DDNSCONFGEN -q -r $RANDFILE -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
|
|
|
2e2c49 |
+if $FEATURETEST --md5; then
|
|
|
2e2c49 |
+ $DDNSCONFGEN -q -r $RANDFILE -a hmac-md5 -k md5-key -z keytests.nil > ns1/md5.key
|
|
|
2e2c49 |
+else
|
|
|
2e2c49 |
+ echo -n > ns1/md5.key
|
|
|
2e2c49 |
+fi
|
|
|
2e2c49 |
+
|
|
|
2e2c49 |
$DDNSCONFGEN -q -r $RANDFILE -a hmac-sha1 -k sha1-key -z keytests.nil > ns1/sha1.key
|
|
|
2e2c49 |
$DDNSCONFGEN -q -r $RANDFILE -a hmac-sha224 -k sha224-key -z keytests.nil > ns1/sha224.key
|
|
|
2e2c49 |
$DDNSCONFGEN -q -r $RANDFILE -a hmac-sha256 -k sha256-key -z keytests.nil > ns1/sha256.key
|
|
|
2e2c49 |
diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
|
|
|
2e2c49 |
index 2a01d1e46d..e8659587c3 100755
|
|
|
2e2c49 |
--- a/bin/tests/system/nsupdate/tests.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/nsupdate/tests.sh
|
|
|
2e2c49 |
@@ -680,7 +680,14 @@ fi
|
|
|
2e2c49 |
n=`expr $n + 1`
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
echo_i "check TSIG key algorithms ($n)"
|
|
|
2e2c49 |
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
|
|
|
2e2c49 |
+if $FEATURETEST --md5
|
|
|
2e2c49 |
+then
|
|
|
2e2c49 |
+ ALGS="md5 sha1 sha224 sha256 sha384 sha512"
|
|
|
2e2c49 |
+else
|
|
|
2e2c49 |
+ ALGS="sha1 sha224 sha256 sha384 sha512"
|
|
|
2e2c49 |
+ echo_i "skipping disabled md5 algorithm"
|
|
|
2e2c49 |
+fi
|
|
|
2e2c49 |
+for alg in $ALGS; do
|
|
|
2e2c49 |
$NSUPDATE -k ns1/${alg}.key <<END > /dev/null || ret=1
|
|
|
2e2c49 |
server 10.53.0.1 ${PORT}
|
|
|
2e2c49 |
update add ${alg}.keytests.nil. 600 A 10.10.10.3
|
|
|
2e2c49 |
@@ -688,7 +695,7 @@ send
|
|
|
2e2c49 |
END
|
|
|
2e2c49 |
done
|
|
|
2e2c49 |
sleep 2
|
|
|
2e2c49 |
-for alg in md5 sha1 sha224 sha256 sha384 sha512; do
|
|
|
2e2c49 |
+for alg in $ALGS; do
|
|
|
2e2c49 |
$DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1
|
|
|
2e2c49 |
done
|
|
|
2e2c49 |
if [ $ret -ne 0 ]; then
|
|
|
2e2c49 |
diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh
|
|
|
2e2c49 |
index 850c4d2744..09a3e0f9ad 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/rndc/setup.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/rndc/setup.sh
|
|
|
2e2c49 |
@@ -37,7 +37,7 @@ make_key () {
|
|
|
2e2c49 |
sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf
|
|
|
2e2c49 |
}
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-make_key 1 ${EXTRAPORT1} hmac-md5
|
|
|
2e2c49 |
+$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5
|
|
|
2e2c49 |
make_key 2 ${EXTRAPORT2} hmac-sha1
|
|
|
2e2c49 |
make_key 3 ${EXTRAPORT3} hmac-sha224
|
|
|
2e2c49 |
make_key 4 ${EXTRAPORT4} hmac-sha256
|
|
|
2e2c49 |
diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
|
|
|
2e2c49 |
index d364e6fea0..dbf3bc6780 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/rndc/tests.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/rndc/tests.sh
|
|
|
2e2c49 |
@@ -356,15 +356,20 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
status=`expr $status + $ret`
|
|
|
2e2c49 |
|
|
|
2e2c49 |
n=`expr $n + 1`
|
|
|
2e2c49 |
-echo_i "testing rndc with hmac-md5 ($n)"
|
|
|
2e2c49 |
-ret=0
|
|
|
2e2c49 |
-$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
|
|
|
2e2c49 |
-for i in 2 3 4 5 6
|
|
|
2e2c49 |
-do
|
|
|
2e2c49 |
- $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
|
|
|
2e2c49 |
-done
|
|
|
2e2c49 |
-if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
-status=`expr $status + $ret`
|
|
|
2e2c49 |
+if $FEATURETEST --md5
|
|
|
2e2c49 |
+then
|
|
|
2e2c49 |
+ echo_i "testing rndc with hmac-md5 ($n)"
|
|
|
2e2c49 |
+ ret=0
|
|
|
2e2c49 |
+ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1
|
|
|
2e2c49 |
+ for i in 2 3 4 5 6
|
|
|
2e2c49 |
+ do
|
|
|
2e2c49 |
+ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1
|
|
|
2e2c49 |
+ done
|
|
|
2e2c49 |
+ if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
|
2e2c49 |
+ status=`expr $status + $ret`
|
|
|
2e2c49 |
+else
|
|
|
2e2c49 |
+ echo_i "skipping rndc with hmac-md5 ($n)"
|
|
|
2e2c49 |
+fi
|
|
|
2e2c49 |
|
|
|
2e2c49 |
n=`expr $n + 1`
|
|
|
2e2c49 |
echo_i "testing rndc with hmac-sha1 ($n)"
|
|
|
2e2c49 |
diff --git a/bin/tests/system/tsig/clean.sh b/bin/tests/system/tsig/clean.sh
|
|
|
2e2c49 |
index 576ec70f76..cb7a852189 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/tsig/clean.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/tsig/clean.sh
|
|
|
2e2c49 |
@@ -20,3 +20,4 @@ rm -f */named.run
|
|
|
2e2c49 |
rm -f ns*/named.lock
|
|
|
2e2c49 |
rm -f Kexample.net.+163+*
|
|
|
2e2c49 |
rm -f keygen.out?
|
|
|
2e2c49 |
+rm -f ns1/named.conf
|
|
|
2e2c49 |
diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in
|
|
|
2e2c49 |
index fbf30c6dc4..f61657d7cf 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/tsig/ns1/named.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/tsig/ns1/named.conf.in
|
|
|
2e2c49 |
@@ -21,10 +21,7 @@ options {
|
|
|
2e2c49 |
notify no;
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-key "md5" {
|
|
|
2e2c49 |
- secret "97rnFx24Tfna4mHPfgnerA==";
|
|
|
2e2c49 |
- algorithm hmac-md5;
|
|
|
2e2c49 |
-};
|
|
|
2e2c49 |
+# md5 key appended by setup.sh at the end
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key "sha1" {
|
|
|
2e2c49 |
secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
|
|
|
2e2c49 |
@@ -51,10 +48,7 @@ key "sha512" {
|
|
|
2e2c49 |
algorithm hmac-sha512;
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-key "md5-trunc" {
|
|
|
2e2c49 |
- secret "97rnFx24Tfna4mHPfgnerA==";
|
|
|
2e2c49 |
- algorithm hmac-md5-80;
|
|
|
2e2c49 |
-};
|
|
|
2e2c49 |
+# md5-trunc key appended by setup.sh at the end
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key "sha1-trunc" {
|
|
|
2e2c49 |
secret "FrSt77yPTFx6hTs4i2tKLB9LmE0=";
|
|
|
2e2c49 |
diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in
|
|
|
2e2c49 |
new file mode 100644
|
|
|
2e2c49 |
index 0000000000..4117830adb
|
|
|
2e2c49 |
--- /dev/null
|
|
|
2e2c49 |
+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in
|
|
|
2e2c49 |
@@ -0,0 +1,11 @@
|
|
|
2e2c49 |
+
|
|
|
2e2c49 |
+key "md5" {
|
|
|
2e2c49 |
+ secret "97rnFx24Tfna4mHPfgnerA==";
|
|
|
2e2c49 |
+ algorithm hmac-md5;
|
|
|
2e2c49 |
+};
|
|
|
2e2c49 |
+
|
|
|
2e2c49 |
+key "md5-trunc" {
|
|
|
2e2c49 |
+ secret "97rnFx24Tfna4mHPfgnerA==";
|
|
|
2e2c49 |
+ algorithm hmac-md5-80;
|
|
|
2e2c49 |
+};
|
|
|
2e2c49 |
+
|
|
|
2e2c49 |
diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh
|
|
|
2e2c49 |
index 656e9bbcd8..628c5bbac1 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/tsig/setup.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/tsig/setup.sh
|
|
|
2e2c49 |
@@ -17,3 +17,7 @@ $SHELL clean.sh
|
|
|
2e2c49 |
copy_setports ns1/named.conf.in ns1/named.conf
|
|
|
2e2c49 |
|
|
|
2e2c49 |
test -r $RANDFILE || $GENRANDOM 400 $RANDFILE
|
|
|
2e2c49 |
+if $FEATURETEST --md5
|
|
|
2e2c49 |
+then
|
|
|
2e2c49 |
+ cat ns1/rndc5.conf.in >> ns1/named.conf
|
|
|
2e2c49 |
+fi
|
|
|
2e2c49 |
diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh
|
|
|
2e2c49 |
index f731fa604c..cade35bc1d 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/tsig/tests.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/tsig/tests.sh
|
|
|
2e2c49 |
@@ -26,20 +26,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f
|
|
|
2e2c49 |
|
|
|
2e2c49 |
status=0
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-echo_i "fetching using hmac-md5 (old form)"
|
|
|
2e2c49 |
-ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
|
|
|
2e2c49 |
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
|
|
|
2e2c49 |
-if [ $ret -eq 1 ] ; then
|
|
|
2e2c49 |
- echo_i "failed"; status=1
|
|
|
2e2c49 |
-fi
|
|
|
2e2c49 |
-
|
|
|
2e2c49 |
-echo_i "fetching using hmac-md5 (new form)"
|
|
|
2e2c49 |
-ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
|
|
|
2e2c49 |
-grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
|
|
|
2e2c49 |
-if [ $ret -eq 1 ] ; then
|
|
|
2e2c49 |
- echo_i "failed"; status=1
|
|
|
2e2c49 |
+if $FEATURETEST --md5
|
|
|
2e2c49 |
+then
|
|
|
2e2c49 |
+ echo_i "fetching using hmac-md5 (old form)"
|
|
|
2e2c49 |
+ ret=0
|
|
|
2e2c49 |
+ $DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1
|
|
|
2e2c49 |
+ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1
|
|
|
2e2c49 |
+ if [ $ret -eq 1 ] ; then
|
|
|
2e2c49 |
+ echo_i "failed"; status=1
|
|
|
2e2c49 |
+ fi
|
|
|
2e2c49 |
+
|
|
|
2e2c49 |
+ echo_i "fetching using hmac-md5 (new form)"
|
|
|
2e2c49 |
+ ret=0
|
|
|
2e2c49 |
+ $DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1
|
|
|
2e2c49 |
+ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1
|
|
|
2e2c49 |
+ if [ $ret -eq 1 ] ; then
|
|
|
2e2c49 |
+ echo_i "failed"; status=1
|
|
|
2e2c49 |
+ fi
|
|
|
2e2c49 |
+else
|
|
|
2e2c49 |
+ echo_i "skipping using hmac-md5"
|
|
|
2e2c49 |
fi
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "fetching using hmac-sha1"
|
|
|
2e2c49 |
@@ -87,12 +92,17 @@ fi
|
|
|
2e2c49 |
# Truncated TSIG
|
|
|
2e2c49 |
#
|
|
|
2e2c49 |
#
|
|
|
2e2c49 |
-echo_i "fetching using hmac-md5 (trunc)"
|
|
|
2e2c49 |
-ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
|
|
|
2e2c49 |
-grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
|
|
|
2e2c49 |
-if [ $ret -eq 1 ] ; then
|
|
|
2e2c49 |
- echo_i "failed"; status=1
|
|
|
2e2c49 |
+if $FEATURETEST --md5
|
|
|
2e2c49 |
+then
|
|
|
2e2c49 |
+ echo_i "fetching using hmac-md5 (trunc)"
|
|
|
2e2c49 |
+ ret=0
|
|
|
2e2c49 |
+ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1
|
|
|
2e2c49 |
+ grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1
|
|
|
2e2c49 |
+ if [ $ret -eq 1 ] ; then
|
|
|
2e2c49 |
+ echo_i "failed"; status=1
|
|
|
2e2c49 |
+ fi
|
|
|
2e2c49 |
+else
|
|
|
2e2c49 |
+ echo_i "skipping using hmac-md5 (trunc)"
|
|
|
2e2c49 |
fi
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "fetching using hmac-sha1 (trunc)"
|
|
|
2e2c49 |
@@ -141,12 +151,17 @@ fi
|
|
|
2e2c49 |
# Check for bad truncation.
|
|
|
2e2c49 |
#
|
|
|
2e2c49 |
#
|
|
|
2e2c49 |
-echo_i "fetching using hmac-md5-80 (BADTRUNC)"
|
|
|
2e2c49 |
-ret=0
|
|
|
2e2c49 |
-$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
|
|
|
2e2c49 |
-grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
|
|
|
2e2c49 |
-if [ $ret -eq 1 ] ; then
|
|
|
2e2c49 |
- echo_i "failed"; status=1
|
|
|
2e2c49 |
+if $FEATURETEST --md5
|
|
|
2e2c49 |
+then
|
|
|
2e2c49 |
+ echo_i "fetching using hmac-md5-80 (BADTRUNC)"
|
|
|
2e2c49 |
+ ret=0
|
|
|
2e2c49 |
+ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1
|
|
|
2e2c49 |
+ grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1
|
|
|
2e2c49 |
+ if [ $ret -eq 1 ] ; then
|
|
|
2e2c49 |
+ echo_i "failed"; status=1
|
|
|
2e2c49 |
+ fi
|
|
|
2e2c49 |
+else
|
|
|
2e2c49 |
+ echo_i "skipping using hmac-md5-80 (BADTRUNC)"
|
|
|
2e2c49 |
fi
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "fetching using hmac-sha1-80 (BADTRUNC)"
|
|
|
2e2c49 |
diff --git a/bin/tests/system/tsiggss/setup.sh b/bin/tests/system/tsiggss/setup.sh
|
|
|
2e2c49 |
index 5da33cfde0..fb108b02bd 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/tsiggss/setup.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/tsiggss/setup.sh
|
|
|
2e2c49 |
@@ -18,5 +18,5 @@ test -r $RANDFILE || $GENRANDOM 400 $RANDFILE
|
|
|
2e2c49 |
|
|
|
2e2c49 |
copy_setports ns1/named.conf.in ns1/named.conf
|
|
|
2e2c49 |
|
|
|
2e2c49 |
-key=`$KEYGEN -Cq -K ns1 -a DSA -b 512 -r $RANDFILE -n HOST -T KEY key.example.nil.`
|
|
|
2e2c49 |
+key=`$KEYGEN -Cq -K ns1 -a DSA -b 1024 -r $RANDFILE -n HOST -T KEY key.example.nil.`
|
|
|
2e2c49 |
cat ns1/example.nil.db.in ns1/${key}.key > ns1/example.nil.db
|
|
|
2e2c49 |
diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in
|
|
|
2e2c49 |
index e0a30cda15..6a77b1ce52 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/upforwd/ns1/named.conf.in
|
|
|
2e2c49 |
+++ b/bin/tests/system/upforwd/ns1/named.conf.in
|
|
|
2e2c49 |
@@ -10,7 +10,7 @@
|
|
|
2e2c49 |
*/
|
|
|
2e2c49 |
|
|
|
2e2c49 |
key "update.example." {
|
|
|
2e2c49 |
- algorithm "hmac-md5";
|
|
|
2e2c49 |
+ algorithm "hmac-sha256";
|
|
|
2e2c49 |
secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
|
|
|
2e2c49 |
};
|
|
|
2e2c49 |
|
|
|
2e2c49 |
diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh
|
|
|
2e2c49 |
index b0694bbd5c..9adae8228e 100644
|
|
|
2e2c49 |
--- a/bin/tests/system/upforwd/tests.sh
|
|
|
2e2c49 |
+++ b/bin/tests/system/upforwd/tests.sh
|
|
|
2e2c49 |
@@ -68,7 +68,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi
|
|
|
2e2c49 |
|
|
|
2e2c49 |
echo_i "updating zone (signed) ($n)"
|
|
|
2e2c49 |
ret=0
|
|
|
2e2c49 |
-$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <
|
|
|
2e2c49 |
+$NSUPDATE -y hmac-sha256:update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - <
|
|
|
2e2c49 |
server 10.53.0.3 ${PORT}
|
|
|
2e2c49 |
update add updated.example. 600 A 10.10.10.1
|
|
|
2e2c49 |
update add updated.example. 600 TXT Foo
|
|
|
2e2c49 |
--
|
|
|
2e2c49 |
2.14.4
|
|
|
2e2c49 |
|