diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2017-12-22 17:19:37 +0000 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2017-12-22 20:42:38 +0000 |
| commit | 94c1328507098238ae5ec784150c1ae58f3b3118 (patch) | |
| tree | 33f9a1ecdf808459581ec9f5254cc5e5fd33ccb1 /test/dnszones-src | |
| parent | 2b01e5359b79cfa9b31296700eb7fc5ae69162c5 (diff) | |
DANE/GnuTLS: split verification of mixed sets of TLSA records by usage
This is because we cannot do the required CA-anchor and names checks for TA-mode
and not for EE-mode, without knowing which usage TLSA was used.
Diffstat (limited to 'test/dnszones-src')
| -rw-r--r-- | test/dnszones-src/db.test.ex | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/test/dnszones-src/db.test.ex b/test/dnszones-src/db.test.ex index 0b8e3f1f4..9bd39dfeb 100644 --- a/test/dnszones-src/db.test.ex +++ b/test/dnszones-src/db.test.ex @@ -446,7 +446,7 @@ DNSSEC _1225._tcp.dane256ee TLSA 3 1 1 827664533176a58b3578e0e91d77d79d036d3a97 ; full MX, sha256, TA-mode ; ; openssl x509 -in aux-fixed/exim-ca/example.com/CA/CA.pem -fingerprint -sha256 -noout \ -; | awk -F= '{print $2}' | tr -d : | tr '[A-F]' '[a-f]' +; | awk -F= '{print $2}' | tr -d : | tr '[A-F]' '[a-f]' ; DNSSEC mxdane256ta MX 1 dane256ta DNSSEC dane256ta A HOSTIPV4 @@ -519,6 +519,11 @@ DNSSEC dane.no.4 A 127.0.0.1 DNSSEC NXDOMAIN _1225._tcp.dane.no.3 TLSA 2 0 1 eec923139018c540a344c5191660ecba1ac3708525a98bfc338e17f31d3fa741 DNSSEC NXDOMAIN _1225._tcp.dane.no.4 TLSA 2 0 1 eec923139018c540a344c5191660ecba1ac3708525a98bfc338e17f31d3fa741 +; a mixed-usage set of TLSA records, EE one failing. TA one coped from dane256ta. +DNSSEC danemixed A 127.0.0.1 +DNSSEC _1225._tcp.danemixed TLSA 2 0 1 cb0fa6a633e52c787657f5ca0da1030800223cac459577b9b6a55ac9733348e5 +DNSSEC TLSA 3 1 1 8276000000000000000000000000000000000000000000000000000000000000 + ; ------- Testing delays ------------ DELAY=500 delay500 A HOSTIPV4 |