From: Matthijs Mekking <matthijs@isc.org>
Date: Tue, 29 Jan 2019 17:09:06 +0000 (+0100)
Subject: Weak verification for signed TKEY response
X-Git-Tag: v9.13.6~22^2~8
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=29323a39bfdb733ce00bf12534e37e98c70f8315;p=thirdparty%2Fbind9.git

Weak verification for signed TKEY response

The introduced grep call checks whether there was a
response that has an answer and an additional record.
There should be only one in the nsupdate output that is
for the TKEY response.
---

diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
index 5131c18217a..bf9c5bd5517 100644
--- a/bin/tests/system/tsiggss/tests.sh
+++ b/bin/tests/system/tsiggss/tests.sh
@@ -45,6 +45,12 @@ EOF
 	return 1
     }
 
+    # Weak verification that TKEY response is signed.
+    grep -q "flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1" nsupdate.out${num} || {
+	echo "I:bad tkey response (not tsig signed)"
+	return 1
+    }
+
     out=`$DIG $DIGOPTS -t $type -q $host | egrep "^${host}"`
     lines=`echo "$out" | grep "$digout" | wc -l`
     [ $lines -eq 1 ] || {