[exim-cvs] Testsuite: Automation for TLDA regen

Startseite
Nachricht löschen
Nachricht beantworten
Autor: Exim Git Commits Mailing List
Datum:  
To: exim-cvs
Betreff: [exim-cvs] Testsuite: Automation for TLDA regen
Gitweb: https://git.exim.org/exim.git/commitdiff/ad1e35ab3c83e0136557726c432340ee19621822
Commit:     ad1e35ab3c83e0136557726c432340ee19621822
Parent:     44c3863eb634def9cb5b64ca43f463bd7bf72b6f
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Wed Oct 26 14:42:03 2022 +0100
Committer:  Jeremy Harris <jgh146exb@???>
CommitDate: Thu Nov 3 22:33:03 2022 +0000


    Testsuite: Automation for TLDA regen
---
 test/aux-fixed/exim-ca/README.regenerate   |  1 +
 test/aux-fixed/exim-ca/tlsa_regenerate     |  8 ++++++++
 test/aux-fixed/exim-ca/tlsa_regenerate.awk | 31 ++++++++++++++++++++++++++++++
 test/dnszones-src/db.example.com           |  2 ++
 test/dnszones-src/db.test.ex               | 24 +++++++++++++++++++++++
 5 files changed, 66 insertions(+)


diff --git a/test/aux-fixed/exim-ca/README.regenerate b/test/aux-fixed/exim-ca/README.regenerate
index a4d7ff9c0..7a1ef2936 100755
--- a/test/aux-fixed/exim-ca/README.regenerate
+++ b/test/aux-fixed/exim-ca/README.regenerate
@@ -2,3 +2,4 @@ WARNING for Exim Testsuite:

 If you change these certificates you will also need to update the TLSA records in dnszone-src/db.test.ex
 and dnszones-src/db.example.com  (the commands are next to each one).
+The script "tlsa_regenerate" automates this.
diff --git a/test/aux-fixed/exim-ca/tlsa_regenerate b/test/aux-fixed/exim-ca/tlsa_regenerate
new file mode 100755
index 000000000..e3cc2f406
--- /dev/null
+++ b/test/aux-fixed/exim-ca/tlsa_regenerate
@@ -0,0 +1,8 @@
+
+cd `git rev-parse --show-toplevel`/test
+
+for f in dnszones-src/db.test.ex dnszones-src/db.example.com
+do
+  awk -f aux-fixed/exim-ca/tlsa_regenerate.awk $f >new
+  mv new $f
+done
diff --git a/test/aux-fixed/exim-ca/tlsa_regenerate.awk b/test/aux-fixed/exim-ca/tlsa_regenerate.awk
new file mode 100644
index 000000000..17802f022
--- /dev/null
+++ b/test/aux-fixed/exim-ca/tlsa_regenerate.awk
@@ -0,0 +1,31 @@
+# The commands beaing read-out and run assume CWD is the test/ directory
+#
+# start collecting a command to run
+/^; TLSA_AUTOGEN$/ { active = 1; print; next; }
+#
+# keep appending to the command while there is a continuation-line marker (trailing backslash)
+active==1 && /^;/ { print;
+            if (NF > 1)
+              {
+              cmdstr = cmdstr " " substr($0, 2);
+              if (cmdstr ~ /\\$/)
+            cmdstr = substr(cmdstr, 1, length(cmdstr)-1);
+              else
+            active = 2;
+              }
+            next;
+          }
+#
+# apply the command to the next TLSA linem and go quiescent
+active==2 && /TLSA/ { cmdstr | getline cmdres;
+              if (NF == 7)
+            { printf("%s %s %s %s %s %s %s\n", $1, $2, $3, $4, $5, $6, cmdres); }
+              else
+            { printf("%s %s %s %s %s %s\n",    $1, $2, $3, $4, $5, cmdres); }
+              cmdstr = "";
+              active = 0;
+              next;
+            }
+#
+# just copy other lines
+{ print; }
diff --git a/test/dnszones-src/db.example.com b/test/dnszones-src/db.example.com
index 4997d4d7c..4c33dc180 100644
--- a/test/dnszones-src/db.example.com
+++ b/test/dnszones-src/db.example.com
@@ -47,6 +47,7 @@ alternatename.server1 CNAME server1
 ; a broken dane config where the name does not match in the cert, TA-mode, dane-requested
 ; NOTE: the server uses the example.net cert hence the mismatch
 ;
+; TLSA_AUTOGEN
 ; openssl x509 -in aux-fixed/exim-ca/example.net/CA/CA.pem -fingerprint -sha256 -noout \
 ;  | awk -F= '{print $2}' | tr -d : | tr '[A-F]' '[a-f]'
 ;
@@ -56,6 +57,7 @@ DNSSEC _1225._tcp.danebroken7 TLSA 2 0 1 7b7f27746dafe59e5b419ee4c5ea97f04fcf100


 ; the same, EE-mode
 ;
+; TLSA_AUTOGEN
 ; openssl x509 -in aux-fixed/exim-ca/example.net/server1.example.net/server1.example.net.pem -noout -pubkey \
 ; | openssl pkey -pubin -outform DER | openssl dgst -sha256 | awk '{print $2}'
 ;
diff --git a/test/dnszones-src/db.test.ex b/test/dnszones-src/db.test.ex
index 5c7c5a5ae..c2a8eeb47 100644
--- a/test/dnszones-src/db.test.ex
+++ b/test/dnszones-src/db.test.ex
@@ -435,6 +435,7 @@ AA a-aa        A V4NET.0.0.100


 ; full suite dns chain, sha512
 ;
+; TLSA_AUTOGEN
 ; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
 ; | openssl pkey -pubin -outform DER \
 ; | openssl dgst -sha512 \
@@ -464,6 +465,7 @@ daneinsecchain              CNAME  dane512ee


; A-only, sha256
;
+; TLSA_AUTOGEN
; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
; | openssl pkey -pubin -outform DER \
; | openssl dgst -sha256 \
@@ -474,6 +476,7 @@ DNSSEC _1225._tcp.dane256ee TLSA 3 1 1 9177e577d294f52da8eb206eb53e7963fb8d354b

; full MX, sha256, TA-mode
;
+; TLSA_AUTOGEN
; openssl x509 -in aux-fixed/exim-ca/example.com/CA/CA.pem -fingerprint -sha256 -noout \
; | awk -F= '{print $2}' | tr -d : | tr '[A-F]' '[a-f]'
;
@@ -489,6 +492,7 @@ DNSSEC _1225._tcp.dane256ta TLSA 2 0 1 0d41f0b28cf41f19f6f5fe116300e2cc8c6076454
; As it happens it is also an intermediate cert in the CA-rooted chain, as this
; was initially thought to be a factor.
;
+; TLSA_AUTOGEN
; openssl x509 -in aux-fixed/exim-ca/example.com/CA/Signer.pem -noout -pubkey \
; | openssl pkey -pubin -outform DER \
; | openssl dgst -sha256 \
@@ -526,17 +530,37 @@ DNSSEC _1225._tcp.danebroken2 TLSA 2 0 1 cb0fa6000000000000000000000000000000000

 ; a broken dane config (or under attack) where the TLSA record is correct but not DNSSEC-assured
 ; (record copied from dane256ee above)
+; TLSA_AUTOGEN
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
+; | openssl pkey -pubin -outform DER \
+; | openssl dgst -sha256 \
+; | awk '{print $2}'
 ; 3 for dane-requested, 4 for dane-required
 DNSSEC danebroken3          A       127.0.0.1
 _1225._tcp.danebroken3 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46
+; TLSA_AUTOGEN
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
+; | openssl pkey -pubin -outform DER \
+; | openssl dgst -sha256 \
+; | awk '{print $2}'
 DNSSEC danebroken4          A       HOSTIPV4
 _1225._tcp.danebroken4 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46


 ; a broken dane config (or under attack) where the address record is correct but not DNSSEC-assured
 ; (TLSA record copied from dane256ee above)
 ; 5 for dane-requested, 6 for dane-required
+; TLSA_AUTOGEN
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
+; | openssl pkey -pubin -outform DER \
+; | openssl dgst -sha256 \
+; | awk '{print $2}'
 danebroken5          A       127.0.0.1
 DNSSEC _1225._tcp.danebroken5 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46
+; TLSA_AUTOGEN
+; openssl x509 -in aux-fixed/exim-ca/example.com/server1.example.com/server1.example.com.pem -noout -pubkey \
+; | openssl pkey -pubin -outform DER \
+; | openssl dgst -sha256 \
+; | awk '{print $2}'
 danebroken6          A       HOSTIPV4
 DNSSEC _1225._tcp.danebroken6 TLSA 2 0 1 9177e577d294f52da8eb206eb53e7963fb8d354bb4a1a62aa8318101dbc11e46