From ad1e35ab3c83e0136557726c432340ee19621822 Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Wed, 26 Oct 2022 14:42:03 +0100 Subject: Testsuite: Automation for TLDA regen --- test/aux-fixed/exim-ca/README.regenerate | 1 + test/aux-fixed/exim-ca/tlsa_regenerate | 8 ++++++++ test/aux-fixed/exim-ca/tlsa_regenerate.awk | 31 ++++++++++++++++++++++++++++++ test/dnszones-src/db.example.com | 2 ++ test/dnszones-src/db.test.ex | 24 +++++++++++++++++++++++ 5 files changed, 66 insertions(+) create mode 100755 test/aux-fixed/exim-ca/tlsa_regenerate create mode 100644 test/aux-fixed/exim-ca/tlsa_regenerate.awk diff --git a/test/aux-fixed/exim-ca/README.regenerate b/test/aux-fixed/exim-ca/README.regenerate index a4d7ff9c0..7a1ef2936 100755 --- a/test/aux-fixed/exim-ca/README.regenerate +++ b/test/aux-fixed/exim-ca/README.regenerate @@ -2,3 +2,4 @@ WARNING for Exim Testsuite: If you change these certificates you will also need to update the TLSA records in dnszone-src/db.test.ex and dnszones-src/db.example.com (the commands are next to each one). +The script "tlsa_regenerate" automates this. diff --git a/test/aux-fixed/exim-ca/tlsa_regenerate b/test/aux-fixed/exim-ca/tlsa_regenerate new file mode 100755 index 000000000..e3cc2f406 --- /dev/null +++ b/test/aux-fixed/exim-ca/tlsa_regenerate @@ -0,0 +1,8 @@ + +cd `git rev-parse --show-toplevel`/test + +for f in dnszones-src/db.test.ex dnszones-src/db.example.com +do + awk -f aux-fixed/exim-ca/tlsa_regenerate.awk $f >new + mv new $f +done diff --git a/test/aux-fixed/exim-ca/tlsa_regenerate.awk b/test/aux-fixed/exim-ca/tlsa_regenerate.awk new file mode 100644 index 000000000..17802f022 --- /dev/null +++ b/test/aux-fixed/exim-ca/tlsa_regenerate.awk @@ -0,0 +1,31 @@ +# The commands beaing read-out and run assume CWD is the test/ directory +# +# start collecting a command to run +/^; TLSA_AUTOGEN$/ { active = 1; print; next; } +# +# keep appending to the command while there is a continuation-line marker (trailing backslash) +active==1 && /^;/ { print; + if (NF > 1) + { + cmdstr = cmdstr " " substr($0, 2); + if (cmdstr ~ /\\$/) + cmdstr = substr(cmdstr, 1, length(cmdstr)-1); + else + active = 2; + } + next; + } +# +# apply the command to the next TLSA linem and go quiescent +active==2 && /TLSA/ { cmdstr | getline cmdres; + if (NF == 7) + { printf("%s %s %s %s %s %s %s\n", $1, $2, $3, $4, $5, $6, cmdres); } + else + { printf("%s %s %s %s %s %s\n", $1, $2, $3, $4, $5, cmdres); } + cmdstr = ""; + active = 0; + next; + } +# +# just copy other lines +{ print; } diff --git a/test/dnszones-src/db.example.com b/test/dnszones-src/db.example.com index 4997d4d7c..4c33dc180 100644 --- a/test/dnszones-src/db.example.com +++ b/test/dnszones-src/db.example.com @@ -47,6 +47,7 @@ alternatename.server1 CNAME server1 ; a broken dane config where the name does not match in the cert, TA-mode, dane-requested ; NOTE: the server uses the example.net cert hence the mismatch ; +; TLSA_AUTOGEN ; openssl x509 -in aux-fixed/exim-ca/example.net/CA/CA.pem -fingerprint -sha256 -noout \ ; | awk -F= '{print $2}' | tr -d : | tr '[A-F]' '[a-f]' ; @@ -56,6 +57,7 @@ DNSSEC _1225._tcp.danebroken7 TLSA 2 0 1 7b7f27746dafe59e5b419ee4c5ea97f04fcf100 ; the same, EE-mode ; +; TLSA_AUTOGEN ; openssl x509 -in aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem -noout -pubkey \ ; | openssl pkey -pubin -outform DER | openssl dgst -sha256 | awk '{print $2}' ; diff --git a/test/dnszones-src/db.test.ex b/test/dnszones-src/db.test.ex index 5c7c5a5ae..c2a8eeb47 100644 --- a/test/dnszones-src/db.test.ex +++ b/test/dnszones-src/db.test.ex @@ -435,6 +435,7 @@ AA a-aa A V4NET.0.0.100 ; full suite dns chain, sha512 ; +; TLSA_AUTOGEN ; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \ ; | openssl pkey -pubin -outform DER \ ; | openssl dgst -sha512 \ @@ -464,6 +465,7 @@ daneinsecchain CNAME dane512ee ; A-only, sha256 ; +; TLSA_AUTOGEN ; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \ ; | openssl pkey -pubin -outform DER \ ; | openssl dgst -sha256 \ @@ -474,6 +476,7 @@ DNSSEC _1225._tcp.dane256ee TLSA 3 1 1 9177e577d294f52da8eb206eb53e7963fb8d354b ; full MX, sha256, TA-mode ; +; TLSA_AUTOGEN ; openssl x509 -in aux-fixed/exim-ca/example.com/CA/CA.pem -fingerprint -sha256 -noout \ ; | awk -F= '{print $2}' | tr -d : | tr '[A-F]' '[a-f]' ; @@ -489,6 +492,7 @@ DNSSEC _1225._tcp.dane256ta TLSA 2 0 1 0d41f0b28cf41f19f6f5fe116300e2cc8c6076454 ; As it happens it is also an intermediate cert in the CA-rooted chain, as this ; was initially thought to be a factor. ; +; TLSA_AUTOGEN ; openssl x509 -in aux-fixed/exim-ca/example.com/CA/Signer.pem -noout -pubkey \ ; | openssl pkey -pubin -outform DER \ ; | openssl dgst -sha256 \ @@ -526,17 +530,37 @@ DNSSEC _1225._tcp.danebroken2 TLSA 2 0 1 cb0fa6000000000000000000000000000000000 ; a broken dane config (or under attack) where the TLSA record is correct but not DNSSEC-assured ; (record copied from dane256ee above) +; TLSA_AUTOGEN +; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \ +; | openssl pkey -pubin -outform DER \ +; | openssl dgst -sha256 \ +; | awk '{print $2}' ; 3 for dane-requested, 4 for dane-required DNSSEC danebroken3 A 127.0.0.1 _1225._tcp.danebroken3 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46 +; TLSA_AUTOGEN +; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \ +; | openssl pkey -pubin -outform DER \ +; | openssl dgst -sha256 \ +; | awk '{print $2}' DNSSEC danebroken4 A HOSTIPV4 _1225._tcp.danebroken4 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46 ; a broken dane config (or under attack) where the address record is correct but not DNSSEC-assured ; (TLSA record copied from dane256ee above) ; 5 for dane-requested, 6 for dane-required +; TLSA_AUTOGEN +; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \ +; | openssl pkey -pubin -outform DER \ +; | openssl dgst -sha256 \ +; | awk '{print $2}' danebroken5 A 127.0.0.1 DNSSEC _1225._tcp.danebroken5 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46 +; TLSA_AUTOGEN +; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \ +; | openssl pkey -pubin -outform DER \ +; | openssl dgst -sha256 \ +; | awk '{print $2}' danebroken6 A HOSTIPV4 DNSSEC _1225._tcp.danebroken6 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46 -- cgit v1.2.3