Better signed TKEY response verification

diff --git a/bin/tests/system/tsiggss/tests.sh b/bin/tests/system/tsiggss/tests.sh
index 5169e7b60861e29b18cfb24c8376cb44c8d215e2..7c938ef78b2005e7ebbc9cfc71824f85af5a7909 100644 (file)
--- a/bin/tests/system/tsiggss/tests.sh
+++ b/bin/tests/system/tsiggss/tests.sh
@@ -39,8 +39,10 @@ EOF
        return 1
     }
 
-    # Weak verification that TKEY response is signed.
-    grep "TSIG PSEUDOSECTION" nsupdate.out${num} > /dev/null || {
+    # Verify that TKEY response is signed.
+    tkeyout=`awk '/recvmsg reply from GSS-TSIG query/,/Sending update to/' nsupdate.out${num}`
+    pattern="recvmsg reply from GSS-TSIG query .* opcode: QUERY, status: NOERROR, id: .* flags: qr; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; QUESTION SECTION: ;.* ANY TKEY ;; ANSWER SECTION: .* 0 ANY TKEY gss-tsig\. .* ;; TSIG PSEUDOSECTION: .* 0 ANY TSIG gss-tsig\. .* NOERROR 0"
+    echo $tkeyout | grep "$pattern" > /dev/null || {
        echo "I:bad tkey response (not tsig signed)"
        return 1
     }