Gitweb:
https://git.exim.org/exim.git/commitdiff/ad1e35ab3c83e0136557726c432340ee19621822
Commit: ad1e35ab3c83e0136557726c432340ee19621822
Parent: 44c3863eb634def9cb5b64ca43f463bd7bf72b6f
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Wed Oct 26 14:42:03 2022 +0100
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Thu Nov 3 22:33:03 2022 +0000
Testsuite: Automation for TLDA regen
---
test/aux-fixed/exim-ca/README.regenerate | 1 +
test/aux-fixed/exim-ca/tlsa_regenerate | 8 ++++++++
test/aux-fixed/exim-ca/tlsa_regenerate.awk | 31 ++++++++++++++++++++++++++++++
test/dnszones-src/db.example.com | 2 ++
test/dnszones-src/db.test.ex | 24 +++++++++++++++++++++++
5 files changed, 66 insertions(+)
diff --git a/test/aux-fixed/exim-ca/README.regenerate b/test/aux-fixed/exim-ca/README.regenerate
index a4d7ff9c0..7a1ef2936 100755
--- a/test/aux-fixed/exim-ca/README.regenerate
+++ b/test/aux-fixed/exim-ca/README.regenerate
@@ -2,3 +2,4 @@ WARNING for Exim Testsuite:
If you change these certificates you will also need to update the TLSA records in dnszone-src/db.test.ex
and dnszones-src/db.example.com (the commands are next to each one).
+The script "tlsa_regenerate" automates this.
diff --git a/test/aux-fixed/exim-ca/tlsa_regenerate b/test/aux-fixed/exim-ca/tlsa_regenerate
new file mode 100755
index 000000000..e3cc2f406
--- /dev/null
+++ b/test/aux-fixed/exim-ca/tlsa_regenerate
@@ -0,0 +1,8 @@
+
+cd `git rev-parse --show-toplevel`/test
+
+for f in dnszones-src/db.test.ex dnszones-src/db.example.com
+do
+ awk -f aux-fixed/exim-ca/tlsa_regenerate.awk $f >new
+ mv new $f
+done
diff --git a/test/aux-fixed/exim-ca/tlsa_regenerate.awk b/test/aux-fixed/exim-ca/tlsa_regenerate.awk
new file mode 100644
index 000000000..17802f022
--- /dev/null
+++ b/test/aux-fixed/exim-ca/tlsa_regenerate.awk
@@ -0,0 +1,31 @@
+# The commands beaing read-out and run assume CWD is the test/ directory
+#
+# start collecting a command to run
+/^; TLSA_AUTOGEN$/ { active = 1; print; next; }
+#
+# keep appending to the command while there is a continuation-line marker (trailing backslash)
+active==1 && /^;/ { print;
+ if (NF > 1)
+ {
+ cmdstr = cmdstr " " substr($0, 2);
+ if (cmdstr ~ /\\$/)
+ cmdstr = substr(cmdstr, 1, length(cmdstr)-1);
+ else
+ active = 2;
+ }
+ next;
+ }
+#
+# apply the command to the next TLSA linem and go quiescent
+active==2 && /TLSA/ { cmdstr | getline cmdres;
+ if (NF == 7)
+ { printf("%s %s %s %s %s %s %s\n", $1, $2, $3, $4, $5, $6, cmdres); }
+ else
+ { printf("%s %s %s %s %s %s\n", $1, $2, $3, $4, $5, cmdres); }
+ cmdstr = "";
+ active = 0;
+ next;
+ }
+#
+# just copy other lines
+{ print; }
diff --git a/test/dnszones-src/db.example.com b/test/dnszones-src/db.example.com
index 4997d4d7c..4c33dc180 100644
--- a/test/dnszones-src/db.example.com
+++ b/test/dnszones-src/db.example.com
@@ -47,6 +47,7 @@ alternatename.server1 CNAME server1
; a broken dane config where the name does not match in the cert, TA-mode, dane-requested
; NOTE: the server uses the example.net cert hence the mismatch
;
+; TLSA_AUTOGEN
; openssl x509 -in aux-fixed/exim-ca/example.net/CA/CA.pem -fingerprint -sha256 -noout \
; | awk -F= '{print $2}' | tr -d : | tr '[A-F]' '[a-f]'
;
@@ -56,6 +57,7 @@ DNSSEC _1225._tcp.danebroken7 TLSA 2 0 1 7b7f27746dafe59e5b419ee4c5ea97f04fcf100
; the same, EE-mode
;
+; TLSA_AUTOGEN
; openssl x509 -in aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem -noout -pubkey \
; | openssl pkey -pubin -outform DER | openssl dgst -sha256 | awk '{print $2}'
;
diff --git a/test/dnszones-src/db.test.ex b/test/dnszones-src/db.test.ex
index 5c7c5a5ae..c2a8eeb47 100644
--- a/test/dnszones-src/db.test.ex
+++ b/test/dnszones-src/db.test.ex
@@ -435,6 +435,7 @@ AA a-aa A V4NET.0.0.100
; full suite dns chain, sha512
;
+; TLSA_AUTOGEN
; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
; | openssl pkey -pubin -outform DER \
; | openssl dgst -sha512 \
@@ -464,6 +465,7 @@ daneinsecchain CNAME dane512ee
; A-only, sha256
;
+; TLSA_AUTOGEN
; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
; | openssl pkey -pubin -outform DER \
; | openssl dgst -sha256 \
@@ -474,6 +476,7 @@ DNSSEC _1225._tcp.dane256ee TLSA 3 1 1 9177e577d294f52da8eb206eb53e7963fb8d354b
; full MX, sha256, TA-mode
;
+; TLSA_AUTOGEN
; openssl x509 -in aux-fixed/exim-ca/example.com/CA/CA.pem -fingerprint -sha256 -noout \
; | awk -F= '{print $2}' | tr -d : | tr '[A-F]' '[a-f]'
;
@@ -489,6 +492,7 @@ DNSSEC _1225._tcp.dane256ta TLSA 2 0 1 0d41f0b28cf41f19f6f5fe116300e2cc8c6076454
; As it happens it is also an intermediate cert in the CA-rooted chain, as this
; was initially thought to be a factor.
;
+; TLSA_AUTOGEN
; openssl x509 -in aux-fixed/exim-ca/example.com/CA/Signer.pem -noout -pubkey \
; | openssl pkey -pubin -outform DER \
; | openssl dgst -sha256 \
@@ -526,17 +530,37 @@ DNSSEC _1225._tcp.danebroken2 TLSA 2 0 1 cb0fa6000000000000000000000000000000000
; a broken dane config (or under attack) where the TLSA record is correct but not DNSSEC-assured
; (record copied from dane256ee above)
+; TLSA_AUTOGEN
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
+; | openssl pkey -pubin -outform DER \
+; | openssl dgst -sha256 \
+; | awk '{print $2}'
; 3 for dane-requested, 4 for dane-required
DNSSEC danebroken3 A 127.0.0.1
_1225._tcp.danebroken3 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46
+; TLSA_AUTOGEN
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
+; | openssl pkey -pubin -outform DER \
+; | openssl dgst -sha256 \
+; | awk '{print $2}'
DNSSEC danebroken4 A HOSTIPV4
_1225._tcp.danebroken4 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46
; a broken dane config (or under attack) where the address record is correct but not DNSSEC-assured
; (TLSA record copied from dane256ee above)
; 5 for dane-requested, 6 for dane-required
+; TLSA_AUTOGEN
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
+; | openssl pkey -pubin -outform DER \
+; | openssl dgst -sha256 \
+; | awk '{print $2}'
danebroken5 A 127.0.0.1
DNSSEC _1225._tcp.danebroken5 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46
+; TLSA_AUTOGEN
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
+; | openssl pkey -pubin -outform DER \
+; | openssl dgst -sha256 \
+; | awk '{print $2}'
danebroken6 A HOSTIPV4
DNSSEC _1225._tcp.danebroken6 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46
