From: W.C.A. Wijngaards Date: Fri, 24 Jul 2026 09:50:15 +0000 (+0200) Subject: - Fix to allow test fake sha1 on systems with possible sha1 X-Git-Tag: release-1.26.0rc1~11 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=e1e646c6fc2d26d7cc1803f8205100d017a03e28;p=thirdparty%2Funbound.git - Fix to allow test fake sha1 on systems with possible sha1 support. - Fix to use sha256 for unbound-anchor unit test. - Fix unbound-anchor check for return value of X509_NAME_get_text_by_NID of the emailaddress. --- diff --git a/doc/Changelog b/doc/Changelog index e9156214f..2b288c053 100644 --- a/doc/Changelog +++ b/doc/Changelog @@ -8,6 +8,11 @@ and block_aaaa, and uses local-data if present. - set code repository version to 1.26.0. - Update generated man pages. + - Fix to allow test fake sha1 on systems with possible sha1 + support. + - Fix to use sha256 for unbound-anchor unit test. + - Fix unbound-anchor check for return value of + X509_NAME_get_text_by_NID of the emailaddress. 23 July 2026: Wouter - Updated credits for Xuanchao Xie in 22 july changelog. diff --git a/smallapp/unbound-anchor.c b/smallapp/unbound-anchor.c index 93379d27f..8f84bae0e 100644 --- a/smallapp/unbound-anchor.c +++ b/smallapp/unbound-anchor.c @@ -1861,10 +1861,10 @@ get_valid_signers(PKCS7* p7, const char* p7signer) } #else if(verb >= 3 && X509_NAME_get_text_by_NID(nm, - NID_commonName, buf, (int)sizeof(buf))) + NID_commonName, buf, (int)sizeof(buf)) > 0) printf("commonName: %s\n", buf); if(verb >= 3 && X509_NAME_get_text_by_NID(nm, - NID_pkcs9_emailAddress, buf, (int)sizeof(buf))) + NID_pkcs9_emailAddress, buf, (int)sizeof(buf)) > 0) printf("emailAddress: %s\n", buf); #endif } @@ -1890,18 +1890,18 @@ get_valid_signers(PKCS7* p7, const char* p7signer) } else { #if !defined(HAVE_X509_NAME_GET_TEXT_BY_NID) || defined(DEPRECATED_X509_NAME_GET_TEXT_BY_NID) if(!has_valid_emailaddr(nm, p7signer)) { - if(verb) printf("removed cert with wrong name\n"); + if(verb) printf("removed cert with wrong emailaddress\n"); continue; /* wrong name, skip it */ } #else - if(!X509_NAME_get_text_by_NID(nm, + if(X509_NAME_get_text_by_NID(nm, NID_pkcs9_emailAddress, - buf, (int)sizeof(buf))) { - if(verb) printf("removed cert with no name\n"); + buf, (int)sizeof(buf)) <= 0) { + if(verb) printf("removed cert with no emailaddress\n"); continue; /* no name, no use */ } if(strcmp(buf, p7signer) != 0) { - if(verb) printf("removed cert with wrong name\n"); + if(verb) printf("removed cert with wrong emailaddress\n"); continue; /* wrong name, skip it */ } #endif diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s b/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s index c76b5b6e4..c7c33d3db 100644 Binary files a/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s and b/testdata/10-unbound-anchor.tdir/127.0.0.1/no_more_keys.p7s differ diff --git a/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s b/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s index afbdb1b91..b0dc637a3 100644 Binary files a/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s and b/testdata/10-unbound-anchor.tdir/127.0.0.1/root.p7s differ diff --git a/testdata/10-unbound-anchor.tdir/key-setup.sh b/testdata/10-unbound-anchor.tdir/key-setup.sh new file mode 100644 index 000000000..7e37c62b9 --- /dev/null +++ b/testdata/10-unbound-anchor.tdir/key-setup.sh @@ -0,0 +1,201 @@ +#!/bin/sh + +# run in temp dir. +# Then for petal, move into basedir. +# For test_cert.key and test_cert.pem, rename the output files to that. +# And run signit.sh for both signature files, by commenting infile and outfile. +# for test_cert.pem it has emailAddress and keyUsage, but petal.pem does not +# need that. + +# settings: + +# directory for files +DESTDIR=. + +# issuer and subject name for certificates +SERVERNAME=petal +CLIENTNAME=petal + +# validity period for certificates +DAYS=7200 + +# size of keys in bits +BITS=3072 + +# hash algorithm +HASH=sha256 + +# base name for unbound server keys +SVR_BASE=petal + +# base name for unbound-control keys +CTL_BASE=petal + +# flag to recreate generated certificates +RECREATE=0 + +# we want -rw-r----- access (say you run this as root: grp=yes (server), all=no). +umask 0027 + +# end of options + +set -eu + +cleanup() { + echo "removing artifacts" + + rm -rf \ + server.cnf \ + client.cnf \ + "${SVR_BASE}_trust.pem" \ + "${CTL_BASE}_trust.pem" \ + "${SVR_BASE}_trust.srl" +} + +fatal() { + printf "fatal error: $*\n" >/dev/stderr + exit 1 +} + +usage() { + cat < used directory to store keys and certificates (default: $DESTDIR) +-h show help notice +-r recreate certificates +EOF +} + +OPTIND=1 +while getopts 'd:hr' arg; do + case "$arg" in + d) DESTDIR="$OPTARG" ;; + h) usage; exit 1 ;; + r) RECREATE=1 ;; + ?) fatal "'$arg' unknown option" ;; + esac +done +shift $((OPTIND - 1)) + +if ! openssl version /dev/null 2>&1; then + echo "$0 requires openssl to be installed for keys/certificates generation." >&2 + exit 1 +fi + +echo "setup in directory $DESTDIR" +cd "$DESTDIR" + +trap cleanup INT + +# === +# Generate server certificate +# === + +# generate private key; do no recreate it if they already exist. +if [ ! -f "$SVR_BASE.key" ]; then + openssl genrsa -out "$SVR_BASE.key" "$BITS" +fi + +cat >server.cnf <client.cnf <