From: W.C.A. Wijngaards Date: Tue, 9 Sep 2025 12:36:33 +0000 (+0200) Subject: - xfr-tsig, fix algorithm name write in xfr reply tsig and unit test X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e3c1981a6a3bf9552ce891581c36991b933623f6;p=thirdparty%2Funbound.git - xfr-tsig, fix algorithm name write in xfr reply tsig and unit test that works with output that works with dig and NSD. --- diff --git a/testcode/unittsig.c b/testcode/unittsig.c index 01533fef3..840e584ec 100644 --- a/testcode/unittsig.c +++ b/testcode/unittsig.c @@ -996,6 +996,26 @@ handle_tsig_verify_reply(char* line, FILE* in, const char* fname, tsig_delete(tsig); } +/* Read next line from file, skip empty and comment lines. It returns the + * key_keyword of the line. Returns false on failure. */ +static char* +read_next_keyword(char* line, size_t len, FILE* in) +{ + char* s = NULL; + while(1) { + if(!fgets(line, len, in)) { + if(vtest) printf("fgets: %s\n", strerror(errno)); + return NULL; + } + line[len-1]=0; + s = get_keyword(line); + if(s[0] == 0 || s[0] == '#') + continue; + break; + } + return s; +} + /** Handle the tsig-sign-reply-xfr */ static void handle_tsig_sign_reply_xfr(char* line, FILE* in, const char* fname, @@ -1013,8 +1033,8 @@ handle_tsig_sign_reply_xfr(char* line, FILE* in, const char* fname, sldns_buffer_init_frm_data(&check_pkt, buf2, sizeof(buf2)); s = arg; - timestr = get_next_arg_on_line(&s); numstr = get_next_arg_on_line(&s); + timestr = get_next_arg_on_line(&s); expected_rcode_str = get_next_arg_on_line(&s); num = atoi(numstr); @@ -1064,22 +1084,19 @@ handle_tsig_sign_reply_xfr(char* line, FILE* in, const char* fname, printf("xfr packet %d/%d\n", i+1, num); /* read packet keyword */ - if(!fgets(callline, sizeof(callline), in)) - fatal_exit("could not read line %d of " - "tsig-sign-reply-xfr", i); - callline[sizeof(callline)-1]=0; - if(strcmp(get_keyword(callline), "packet")!=0) + if(!(s=read_next_keyword(callline, sizeof(callline), in))) + fatal_exit("could not read next line for " + "tsig-sign-reply-xfr %d", i+1); + if(strcmp(s, "packet")!=0) fatal_exit("expected 'packet', but read '%s'", callline); if(!read_packet_hex("", &reply_pkt, in, fname)) fatal_exit("Could not read reply packet"); /* read call arguments */ - if(!fgets(callline, sizeof(callline), in)) - fatal_exit("could not read line %d of " - "tsig-sign-reply-xfr", i); - callline[sizeof(callline)-1]=0; - s = get_keyword(callline); + if(!(s=read_next_keyword(callline, sizeof(callline), in))) + fatal_exit("could not read next line for " + "tsig-sign-reply-xfr %d", i+1); if(strncmp(s, "call", 4) == 0) { s = get_arg_on_line(s, "call"); timestr = get_next_arg_on_line(&s); @@ -1092,15 +1109,14 @@ handle_tsig_sign_reply_xfr(char* line, FILE* in, const char* fname, fatal_exit("expected int argument for %s", expectedstr2); } else { fatal_exit("unknown line '%s' is not 'call' for %d in " - "tsig-sign-reply-xfr", s, i); + "tsig-sign-reply-xfr", s, i+1); } /* read check-packet keyword */ - if(!fgets(callline, sizeof(callline), in)) - fatal_exit("could not read line %d of " - "tsig-sign-reply-xfr", i); - callline[sizeof(callline)-1]=0; - if(strcmp(get_keyword(callline), "check-packet")!=0) + if(!(s=read_next_keyword(callline, sizeof(callline), in))) + fatal_exit("could not read next line for " + "tsig-sign-reply-xfr %d", i+1); + if(strcmp(s, "check-packet")!=0) fatal_exit("expected 'check-packet', but read '%s'", callline); if(!read_packet_hex("", &check_pkt, in, fname)) @@ -1157,7 +1173,8 @@ handle_tsig_sign_reply_xfr(char* line, FILE* in, const char* fname, sldns_buffer_begin(&check_pkt), sldns_buffer_limit(&reply_pkt)) == 0); if(vtest) - printf("check-packet is equal\n"); + printf("check-packet is equal, for %d/%d\n", + i+1, num); } tsig_delete(tsig); diff --git a/testdata/tsig_test.4 b/testdata/tsig_test.4 index b145097dc..f0c3d8b87 100644 --- a/testdata/tsig_test.4 +++ b/testdata/tsig_test.4 @@ -108,3 +108,236 @@ endpacket tsig-verify-reply test.key 1756302015 1 1 74c484000001000200000002076578616d706c6503636f6d0000fc0001c00c0006000100000e100023c00c0a686f73746d6173746572c00c5cd7fffe00000e10000003840012750000000708c00c0001000100000e1000043ed26e0700002904d00000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068af0abf012c0020df2b53f8f88720570cd0cb8f31e315037d68e95c380674f5439793a576ef615e74c400000000 endpacket + +# tsig-sign-reply-xfr test. +# The output was captured from NSD, with dig as querier. NSD and dig verified. +# It signs an AXFR for example.com, every two RRs. +# it was: dig @127.0.0.1 -p +nocookie +noadflag -y hmac-sha256:test.key:K2tf3TRjvQkVCmJF3/Z9vA== example.com AXFR + +# the incoming query, example.com AXFR +packet +1c9600000001000000000002076578616d706c6503636f6d0000fc000100002910000000000000000474657374036b65790000fa00ff00000000003d0b686d61632d73686132353600000068c01a52012c00202f017432ef8f8ef3dab9be9f9c4765eda7939f0485dfe384206e97e13acbd8f91c9600000000 +endpacket +#