echo_i "checking that expired RRSIGs from missing key are not deleted ($n)"
ret=0
-missing=`sed 's/^K.*+007+0*\([0-9]\)/\1/' < missingzsk.key`
+missing=`keyfile_to_key_id \`cat missingzsk.key\``
$JOURNALPRINT ns3/nozsk.example.db.jnl | \
awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {exit 1}} END {exit 0}' id=$missing || ret=1
n=`expr $n + 1`
echo_i "checking that expired RRSIGs from inactive key are not deleted ($n)"
ret=0
-inactive=`sed 's/^K.*+007+0*\([0-9]\)/\1/' < inactivezsk.key`
+inactive=`keyfile_to_key_id \`cat inactivezsk.key\``
$JOURNALPRINT ns3/inaczsk.example.db.jnl | \
awk '{if ($1 == "del" && $5 == "RRSIG" && $12 == id) {exit 1}} END {exit 0}' id=$inactive || ret=1
n=`expr $n + 1`
echo_i "checking for unpublished key ($n)"
ret=0
-id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < unpub.key`
+id=`keyfile_to_key_id \`cat unpub.key\``
$DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
n=`expr $n + 1`
echo_i "checking for activated but unpublished key ($n)"
ret=0
-id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < activate-now-publish-1day.key`
+id=`keyfile_to_key_id \`cat activate-now-publish-1day.key\``
$DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
n=`expr $n + 1`
echo_i "checking that standby key does not sign records ($n)"
ret=0
-id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < standby.key`
+id=`keyfile_to_key_id \`cat standby.key\``
$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
n=`expr $n + 1`
echo_i "checking that deactivated key does not sign records ($n)"
ret=0
-id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < inact.key`
+id=`keyfile_to_key_id \`cat inact.key\``
$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
n=`expr $n + 1`
echo_i "checking insertion of public-only key ($n)"
ret=0
-id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < nopriv.key`
+id=`keyfile_to_key_id \`cat nopriv.key\``
file="ns1/`cat nopriv.key`.key"
keydata=`grep DNSKEY $file`
$NSUPDATE > /dev/null 2>&1 <<END || status=1
echo_i "checking key deletion ($n)"
ret=0
-id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < del.key`
+id=`keyfile_to_key_id \`cat del.key\``
$DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
n=`expr $n + 1`
echo_i "preparing ZSK roll"
starttime=`$PERL -e 'print time(), "\n";'`
oldfile=`cat active.key`
-oldid=`sed 's/^K.+007+0*\([0-9]\)/\1/' < active.key`
+oldid=`keyfile_to_key_id \`cat active.key\``
newfile=`cat standby.key`
-newid=`sed 's/^K.+007+0*\([0-9]\)/\1/' < standby.key`
+newid=`keyfile_to_key_id \`cat standby.key\``
$SETTIME -K ns1 -I now+2s -D now+25 $oldfile > /dev/null
$SETTIME -K ns1 -i 0 -S $oldfile $newfile > /dev/null
echo_i "checking private key file removal caused no immediate harm ($n)"
ret=0
-id=`sed 's/^K.+007+0*\([0-9]\)/\1/' < vanishing.key`
+id=`keyfile_to_key_id \`cat vanishing.key\``
$DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
n=`expr $n + 1`
keyfile_to_keys_section "managed-keys" "initial-key " $*
}
+# keyfile_to_key_id: convert a key file name to a key ID
+#
+# For a given key file name (e.g. "Kexample.+013+06160") provided as $1,
+# print the key ID with leading zeros stripped ("6160" for the
+# aforementioned example).
+keyfile_to_key_id() {
+ echo "$1" | sed "s/.*+0\{0,4\}//"
+}
+
# nextpart: read everything that's been appended to a file since the
# last time 'nextpart' was called.
nextpart () {
keyfile_to_keys_section "managed-keys" "initial-key " $*
}
+# keyfile_to_key_id: convert a key file name to a key ID
+#
+# For a given key file name (e.g. "Kexample.+013+06160") provided as $1,
+# print the key ID with leading zeros stripped ("6160" for the
+# aforementioned example).
+keyfile_to_key_id() {
+ echo "$1" | sed "s/.*+0\{0,4\}//"
+}
+
# nextpart: read everything that's been appended to a file since the
# last time 'nextpart' was called.
nextpart () {
#
# Save keyid for managed key id test.
#
-echo "$keyname" | sed -e 's/.*[+]//' -e 's/^0*//' > managed.key.id
+keyfile_to_key_id "$keyname" > managed.key.id
key1=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -fk $zone`
key2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
# Save key id's for checking active key usage
-echo $key1 | sed -e 's/.*[+]//' -e 's/^0*//' > $zone.ksk.id
-echo $key2 | sed -e 's/.*[+]//' -e 's/^0*//' > $zone.zsk.id
+keyfile_to_key_id "$key1" > $zone.ksk.id
+keyfile_to_key_id "$key2" > $zone.zsk.id
echo ${key1} > $zone.ksk.key
echo ${key2} > $zone.zsk.key
# Add CDS and CDNSKEY records
zone=example
key1=`$KEYGEN -K signer -q -r $RANDFILE -f KSK -a RSASHA1 -b 1024 -n zone $zone`
key2=`$KEYGEN -K signer -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
-keyid2=`echo $key2 | sed 's/^Kexample.+005+0*\([0-9]\)/\1/'`
+keyid2=`keyfile_to_key_id $key2`
key3=`$KEYGEN -K signer -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
-keyid3=`echo $key3 | sed 's/^Kexample.+005+0*\([0-9]\)/\1/'`
+keyid3=`keyfile_to_key_id $key3`
(
cd signer
cat example.db.in $key1.key $key2.key > example.db
# Roll the ZSK.
zsk2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -K ns2 -n zone $zone`
-echo "$zsk2" | sed -e 's/.*[+]//' -e 's/^0*//' > ns2/$zone.zsk.id2
+keyfile_to_key_id "$zsk2" > ns2/$zone.zsk.id2
ZSK_ID2=`cat ns2/$zone.zsk.id2`
echo_i "load new ZSK $ZSK_ID2 for $zone ($n)"
# Roll the ZSK again.
zsk3=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -K ns2 -n zone $zone`
-echo "$zsk3" | sed -e 's/.*[+]//' -e 's/^0*//' > ns2/$zone.zsk.id3
+keyfile_to_key_id "$zsk3" > ns2/$zone.zsk.id3
ZSK_ID3=`cat ns2/$zone.zsk.id3`
echo_i "load new ZSK $ZSK_ID3 for $zone ($n)"
echo_i "setting key timers"
$SETTIME -A now+15s `cat rolling.key` > /dev/null
-inact=`sed 's/^K'${czone}'.+005+0*\([0-9]\)/\1/' < inact.key`
-ksk=`sed 's/^K'${czone}'.+005+0*\([0-9]\)/\1/' < ksk.key`
-pending=`sed 's/^K'${czone}'.+005+0*\([0-9]\)/\1/' < pending.key`
-postrev=`sed 's/^K'${czone}'.+005+0*\([0-9]\)/\1/' < postrev.key`
-prerev=`sed 's/^K'${czone}'.+005+0*\([0-9]\)/\1/' < prerev.key`
-rolling=`sed 's/^K'${czone}'.+005+0*\([0-9]\)/\1/' < rolling.key`
-standby=`sed 's/^K'${czone}'.+005+0*\([0-9]\)/\1/' < standby.key`
-zsk=`sed 's/^K'${czone}'.+005+0*\([0-9]\)/\1/' < zsk.key`
+inact=`keyfile_to_key_id \`cat inact.key\``
+ksk=`keyfile_to_key_id \`cat ksk.key\``
+pending=`keyfile_to_key_id \`cat pending.key\``
+postrev=`keyfile_to_key_id \`cat postrev.key\``
+prerev=`keyfile_to_key_id \`cat prerev.key\``
+rolling=`keyfile_to_key_id \`cat rolling.key\``
+standby=`keyfile_to_key_id \`cat standby.key\``
+zsk=`keyfile_to_key_id \`cat zsk.key\``
echo_i "signing zones"
$SIGNER -Sg -o $czone $cfile > /dev/null 2>&1
#
echo "$keyname" > managed.key
echo "$zskkeyname" > zone.key
-keyid=`expr $keyname : 'K\.+00.+\([0-9]*\)'`
-keyid=`expr $keyid + 0`
-echo "$keyid" > managed.key.id
+keyfile_to_key_id $keyname > managed.key.id
echo_i "revoke key with bad signature, check revocation is ignored ($n)"
ret=0
revoked=`$REVOKE -K ns1 $original`
-rkeyid=`expr $revoked : 'ns1/K\.+00.+0*\([1-9]*[0-9]*[0-9]\)'`
+rkeyid=`keyfile_to_key_id $revoked`
rm -f ns1/root.db.signed.jnl
# We need to activate at least one valid DNSKEY to prevent dnssec-signzone from
# failing. Alternatively, we could use -P to disable post-sign verification,
echo_i "signing parent zone"
pzoneout=`$SIGNER -Sg -r $RANDFILE -o $pzone $pfile 2>&1`
-czactive=`echo $czsk1 | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-czgenerated=`echo $czsk2 | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-czpublished=`echo $czsk3 | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-czinactive=`echo $czsk4 | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-czpredecessor=`echo $czsk5 | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-czsuccessor=`echo $czsk6 | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-ckactive=`echo $cksk1 | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-ckpublished=`echo $cksk2 | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-ckprerevoke=`echo $cksk3 | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-ckrevoked=`echo $cksk4 | sed 's/.*+005+0*\([0-9]*\)$/\1/'`
-
-pzid=`echo $pzsk | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
-pkid=`echo $pksk | sed 's/^K.*+005+0*\([0-9]\)/\1/'`
+czactive=`keyfile_to_key_id $czsk1`
+czgenerated=`keyfile_to_key_id $czsk2`
+czpublished=`keyfile_to_key_id $czsk3`
+czinactive=`keyfile_to_key_id $czsk4`
+czpredecessor=`keyfile_to_key_id $czsk5`
+czsuccessor=`keyfile_to_key_id $czsk6`
+ckactive=`keyfile_to_key_id $cksk1`
+ckpublished=`keyfile_to_key_id $cksk2`
+ckprerevoke=`keyfile_to_key_id $cksk3`
+ckrevoked=`keyfile_to_key_id $cksk4`
+
+pzid=`keyfile_to_key_id $pzsk`
+pkid=`keyfile_to_key_id $pksk`
echo_i "checking dnssec-signzone output matches expectations"
ret=0
. $SYSTEMTESTTOP/conf.sh
keyname=`$KEYGEN -T KEY -a DH -b 768 -n host -r $RANDFILE server`
-keyid=`echo $keyname | $PERL -p -e 's/^.*\+0{0,4}//;'`
+keyid=`keyfile_to_key_id $keyname`
rm -f named.conf
sed -e "s;KEYID;$keyid;" -e "s;RANDFILE;$RANDFILE;" < named.conf.in > named.conf
projects / thirdparty / bind9.git / commitdiff
