1 /*
2 * testcode/unitverify.c - unit test for signature verification routines.
3 *
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 *
35 */
36 /**
37 * \file
38 * Calls verification unit tests. Exits with code 1 on a failure.
39 */
40
41 #include "config.h"
42 #include "util/log.h"
43 #include "testcode/unitmain.h"
44 #include "validator/val_sigcrypt.h"
45 #include "validator/val_secalgo.h"
46 #include "validator/val_nsec.h"
47 #include "validator/val_nsec3.h"
48 #include "validator/validator.h"
49 #include "testcode/testpkts.h"
50 #include "util/data/msgreply.h"
51 #include "util/data/msgparse.h"
52 #include "util/data/dname.h"
53 #include "util/regional.h"
54 #include "util/alloc.h"
55 #include "util/rbtree.h"
56 #include "util/net_help.h"
57 #include "util/module.h"
58 #include "util/config_file.h"
59 #include "sldns/sbuffer.h"
60 #include "sldns/keyraw.h"
61 #include "sldns/str2wire.h"
62 #include "sldns/wire2str.h"
63
64 /** verbose signature test */
65 static int vsig = 0;
66
67 /** entry to packet buffer with wireformat */
68 static void
entry_to_buf(struct entry * e,sldns_buffer * pkt)69 entry_to_buf(struct entry* e, sldns_buffer* pkt)
70 {
71 unit_assert(e->reply_list);
72 if(e->reply_list->reply_from_hex) {
73 sldns_buffer_copy(pkt, e->reply_list->reply_from_hex);
74 } else {
75 sldns_buffer_clear(pkt);
76 sldns_buffer_write(pkt, e->reply_list->reply_pkt,
77 e->reply_list->reply_len);
78 sldns_buffer_flip(pkt);
79 }
80 }
81
82 /** entry to reply info conversion */
83 static void
entry_to_repinfo(struct entry * e,struct alloc_cache * alloc,struct regional * region,sldns_buffer * pkt,struct query_info * qi,struct reply_info ** rep)84 entry_to_repinfo(struct entry* e, struct alloc_cache* alloc,
85 struct regional* region, sldns_buffer* pkt, struct query_info* qi,
86 struct reply_info** rep)
87 {
88 int ret;
89 struct edns_data edns;
90 entry_to_buf(e, pkt);
91 /* lock alloc lock to please lock checking software.
92 * alloc_special_obtain assumes it is talking to a ub-alloc,
93 * and does not need to perform locking. Here the alloc is
94 * the only one, so we lock it here */
95 lock_quick_lock(&alloc->lock);
96 ret = reply_info_parse(pkt, alloc, qi, rep, region, &edns);
97 lock_quick_unlock(&alloc->lock);
98 if(ret != 0) {
99 char rcode[16];
100 sldns_wire2str_rcode_buf(ret, rcode, sizeof(rcode));
101 printf("parse code %d: %s\n", ret, rcode);
102 unit_assert(ret != 0);
103 }
104 }
105
106 /** extract DNSKEY rrset from answer and convert it */
107 static struct ub_packed_rrset_key*
extract_keys(struct entry * e,struct alloc_cache * alloc,struct regional * region,sldns_buffer * pkt)108 extract_keys(struct entry* e, struct alloc_cache* alloc,
109 struct regional* region, sldns_buffer* pkt)
110 {
111 struct ub_packed_rrset_key* dnskey = NULL;
112 struct query_info qinfo;
113 struct reply_info* rep = NULL;
114 size_t i;
115
116 entry_to_repinfo(e, alloc, region, pkt, &qinfo, &rep);
117 for(i=0; i<rep->an_numrrsets; i++) {
118 if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_DNSKEY) {
119 dnskey = rep->rrsets[i];
120 rep->rrsets[i] = NULL;
121 break;
122 }
123 }
124 unit_assert(dnskey);
125
126 reply_info_parsedelete(rep, alloc);
127 query_info_clear(&qinfo);
128 return dnskey;
129 }
130
131 /** return true if answer should be bogus */
132 static int
should_be_bogus(struct ub_packed_rrset_key * rrset,struct query_info * qinfo)133 should_be_bogus(struct ub_packed_rrset_key* rrset, struct query_info* qinfo)
134 {
135 struct packed_rrset_data* d = (struct packed_rrset_data*)rrset->
136 entry.data;
137 if(d->rrsig_count == 0)
138 return 1;
139 /* name 'bogus' as first label signals bogus */
140 if(rrset->rk.dname_len > 6 && memcmp(rrset->rk.dname+1, "bogus", 5)==0)
141 return 1;
142 if(qinfo->qname_len > 6 && memcmp(qinfo->qname+1, "bogus", 5)==0)
143 return 1;
144 return 0;
145 }
146
147 /** return number of rrs in an rrset */
148 static size_t
rrset_get_count(struct ub_packed_rrset_key * rrset)149 rrset_get_count(struct ub_packed_rrset_key* rrset)
150 {
151 struct packed_rrset_data* d = (struct packed_rrset_data*)
152 rrset->entry.data;
153 if(!d) return 0;
154 return d->count;
155 }
156
157 /** setup sig alg list from dnskey */
158 static void
setup_sigalg(struct ub_packed_rrset_key * dnskey,uint8_t * sigalg)159 setup_sigalg(struct ub_packed_rrset_key* dnskey, uint8_t* sigalg)
160 {
161 uint8_t a[ALGO_NEEDS_MAX];
162 size_t i, n = 0;
163 memset(a, 0, sizeof(a));
164 for(i=0; i<rrset_get_count(dnskey); i++) {
165 uint8_t algo = (uint8_t)dnskey_get_algo(dnskey, i);
166 if(a[algo] == 0) {
167 a[algo] = 1;
168 sigalg[n++] = algo;
169 }
170 }
171 sigalg[n] = 0;
172 }
173
174 /** verify and test one rrset against the key rrset */
175 static void
verifytest_rrset(struct module_env * env,struct val_env * ve,struct ub_packed_rrset_key * rrset,struct ub_packed_rrset_key * dnskey,struct query_info * qinfo)176 verifytest_rrset(struct module_env* env, struct val_env* ve,
177 struct ub_packed_rrset_key* rrset, struct ub_packed_rrset_key* dnskey,
178 struct query_info* qinfo)
179 {
180 enum sec_status sec;
181 char* reason = NULL;
182 uint8_t sigalg[ALGO_NEEDS_MAX+1];
183 if(vsig) {
184 log_nametypeclass(VERB_QUERY, "verify of rrset",
185 rrset->rk.dname, ntohs(rrset->rk.type),
186 ntohs(rrset->rk.rrset_class));
187 }
188 setup_sigalg(dnskey, sigalg); /* check all algorithms in the dnskey */
189 /* ok to give null as qstate here, won't be used for answer section. */
190 sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, sigalg, &reason,
191 LDNS_SECTION_ANSWER, NULL);
192 if(vsig) {
193 printf("verify outcome is: %s %s\n", sec_status_to_string(sec),
194 reason?reason:"");
195 }
196 if(should_be_bogus(rrset, qinfo)) {
197 unit_assert(sec == sec_status_bogus);
198 } else {
199 unit_assert(sec == sec_status_secure);
200 }
201 }
202
203 /** verify and test an entry - every rr in the message */
204 static void
verifytest_entry(struct entry * e,struct alloc_cache * alloc,struct regional * region,sldns_buffer * pkt,struct ub_packed_rrset_key * dnskey,struct module_env * env,struct val_env * ve)205 verifytest_entry(struct entry* e, struct alloc_cache* alloc,
206 struct regional* region, sldns_buffer* pkt,
207 struct ub_packed_rrset_key* dnskey, struct module_env* env,
208 struct val_env* ve)
209 {
210 struct query_info qinfo;
211 struct reply_info* rep = NULL;
212 size_t i;
213
214 regional_free_all(region);
215 if(vsig) {
216 char* s = sldns_wire2str_pkt(e->reply_list->reply_pkt,
217 e->reply_list->reply_len);
218 printf("verifying pkt:\n%s\n", s?s:"outofmemory");
219 free(s);
220 }
221 entry_to_repinfo(e, alloc, region, pkt, &qinfo, &rep);
222
223 for(i=0; i<rep->rrset_count; i++) {
224 verifytest_rrset(env, ve, rep->rrsets[i], dnskey, &qinfo);
225 }
226
227 reply_info_parsedelete(rep, alloc);
228 query_info_clear(&qinfo);
229 }
230
231 /** find RRset in reply by type */
232 static struct ub_packed_rrset_key*
find_rrset_type(struct reply_info * rep,uint16_t type)233 find_rrset_type(struct reply_info* rep, uint16_t type)
234 {
235 size_t i;
236 for(i=0; i<rep->rrset_count; i++) {
237 if(ntohs(rep->rrsets[i]->rk.type) == type)
238 return rep->rrsets[i];
239 }
240 return NULL;
241 }
242
243 /** DS sig test an entry - get DNSKEY and DS in entry and verify */
244 static void
dstest_entry(struct entry * e,struct alloc_cache * alloc,struct regional * region,sldns_buffer * pkt,struct module_env * env)245 dstest_entry(struct entry* e, struct alloc_cache* alloc,
246 struct regional* region, sldns_buffer* pkt, struct module_env* env)
247 {
248 struct query_info qinfo;
249 struct reply_info* rep = NULL;
250 struct ub_packed_rrset_key* ds, *dnskey;
251 int ret;
252
253 regional_free_all(region);
254 if(vsig) {
255 char* s = sldns_wire2str_pkt(e->reply_list->reply_pkt,
256 e->reply_list->reply_len);
257 printf("verifying DS-DNSKEY match:\n%s\n", s?s:"outofmemory");
258 free(s);
259 }
260 entry_to_repinfo(e, alloc, region, pkt, &qinfo, &rep);
261 ds = find_rrset_type(rep, LDNS_RR_TYPE_DS);
262 dnskey = find_rrset_type(rep, LDNS_RR_TYPE_DNSKEY);
263 /* check test is OK */
264 unit_assert(ds && dnskey);
265
266 ret = ds_digest_match_dnskey(env, dnskey, 0, ds, 0);
267 if(strncmp((char*)qinfo.qname, "\003yes", 4) == 0) {
268 if(vsig) {
269 printf("result(yes)= %s\n", ret?"yes":"no");
270 }
271 unit_assert(ret);
272 } else if (strncmp((char*)qinfo.qname, "\002no", 3) == 0) {
273 if(vsig) {
274 printf("result(no)= %s\n", ret?"yes":"no");
275 }
276 unit_assert(!ret);
277 verbose(VERB_QUERY, "DS fail: OK; matched unit test");
278 } else {
279 fatal_exit("Bad qname in DS unit test, yes or no");
280 }
281
282 reply_info_parsedelete(rep, alloc);
283 query_info_clear(&qinfo);
284 }
285
286 /** verify from a file */
287 static void
verifytest_file(const char * fname,const char * at_date)288 verifytest_file(const char* fname, const char* at_date)
289 {
290 /*
291 * The file contains a list of ldns-testpkts entries.
292 * The first entry must be a query for DNSKEY.
293 * The answer rrset is the keyset that will be used for verification
294 */
295 struct ub_packed_rrset_key* dnskey;
296 struct regional* region = regional_create();
297 struct alloc_cache alloc;
298 sldns_buffer* buf = sldns_buffer_new(65535);
299 struct entry* e;
300 struct entry* list = read_datafile(fname, 1);
301 struct module_env env;
302 struct val_env ve;
303 time_t now = time(NULL);
304 unit_show_func("signature verify", fname);
305
306 if(!list)
307 fatal_exit("could not read %s: %s", fname, strerror(errno));
308 alloc_init(&alloc, NULL, 1);
309 memset(&env, 0, sizeof(env));
310 memset(&ve, 0, sizeof(ve));
311 env.scratch = region;
312 env.scratch_buffer = buf;
313 env.now = &now;
314 ve.date_override = cfg_convert_timeval(at_date);
315 unit_assert(region && buf);
316 dnskey = extract_keys(list, &alloc, region, buf);
317 if(vsig) log_nametypeclass(VERB_QUERY, "test dnskey",
318 dnskey->rk.dname, ntohs(dnskey->rk.type),
319 ntohs(dnskey->rk.rrset_class));
320 /* ready to go! */
321 for(e = list->next; e; e = e->next) {
322 verifytest_entry(e, &alloc, region, buf, dnskey, &env, &ve);
323 }
324
325 ub_packed_rrset_parsedelete(dnskey, &alloc);
326 delete_entry(list);
327 regional_destroy(region);
328 alloc_clear(&alloc);
329 sldns_buffer_free(buf);
330 }
331
332 /** verify DS matches DNSKEY from a file */
333 static void
dstest_file(const char * fname)334 dstest_file(const char* fname)
335 {
336 /*
337 * The file contains a list of ldns-testpkts entries.
338 * The first entry must be a query for DNSKEY.
339 * The answer rrset is the keyset that will be used for verification
340 */
341 struct regional* region = regional_create();
342 struct alloc_cache alloc;
343 sldns_buffer* buf = sldns_buffer_new(65535);
344 struct entry* e;
345 struct entry* list = read_datafile(fname, 1);
346 struct module_env env;
347 unit_show_func("DS verify", fname);
348
349 if(!list)
350 fatal_exit("could not read %s: %s", fname, strerror(errno));
351 alloc_init(&alloc, NULL, 1);
352 memset(&env, 0, sizeof(env));
353 env.scratch = region;
354 env.scratch_buffer = buf;
355 unit_assert(region && buf);
356
357 /* ready to go! */
358 for(e = list; e; e = e->next) {
359 dstest_entry(e, &alloc, region, buf, &env);
360 }
361
362 delete_entry(list);
363 regional_destroy(region);
364 alloc_clear(&alloc);
365 sldns_buffer_free(buf);
366 }
367
368 /** helper for unittest of NSEC routines */
369 static int
unitest_nsec_has_type_rdata(char * bitmap,size_t len,uint16_t type)370 unitest_nsec_has_type_rdata(char* bitmap, size_t len, uint16_t type)
371 {
372 return nsecbitmap_has_type_rdata((uint8_t*)bitmap, len, type);
373 }
374
375 /** Test NSEC type bitmap routine */
376 static void
nsectest(void)377 nsectest(void)
378 {
379 /* bitmap starts at type bitmap rdata field */
380 /* from rfc 4034 example */
381 char* bitmap = "\000\006\100\001\000\000\000\003"
382 "\004\033\000\000\000\000\000\000"
383 "\000\000\000\000\000\000\000\000"
384 "\000\000\000\000\000\000\000\000"
385 "\000\000\000\000\040";
386 size_t len = 37;
387
388 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 0));
389 unit_assert(unitest_nsec_has_type_rdata(bitmap, len, LDNS_RR_TYPE_A));
390 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 2));
391 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 3));
392 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 4));
393 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 5));
394 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 6));
395 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 7));
396 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 8));
397 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 9));
398 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 10));
399 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 11));
400 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 12));
401 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 13));
402 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 14));
403 unit_assert(unitest_nsec_has_type_rdata(bitmap, len, LDNS_RR_TYPE_MX));
404 unit_assert(unitest_nsec_has_type_rdata(bitmap, len, LDNS_RR_TYPE_RRSIG));
405 unit_assert(unitest_nsec_has_type_rdata(bitmap, len, LDNS_RR_TYPE_NSEC));
406 unit_assert(unitest_nsec_has_type_rdata(bitmap, len, 1234));
407 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 1233));
408 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 1235));
409 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 1236));
410 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 1237));
411 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 1238));
412 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 1239));
413 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 1240));
414 unit_assert(!unitest_nsec_has_type_rdata(bitmap, len, 2230));
415 }
416
417 /** Test hash algo - NSEC3 hash it and compare result */
418 static void
nsec3_hash_test_entry(struct entry * e,rbtree_type * ct,struct alloc_cache * alloc,struct regional * region,sldns_buffer * buf)419 nsec3_hash_test_entry(struct entry* e, rbtree_type* ct,
420 struct alloc_cache* alloc, struct regional* region,
421 sldns_buffer* buf)
422 {
423 struct query_info qinfo;
424 struct reply_info* rep = NULL;
425 struct ub_packed_rrset_key* answer, *nsec3;
426 struct nsec3_cached_hash* hash = NULL;
427 int ret;
428 uint8_t* qname;
429
430 if(vsig) {
431 char* s = sldns_wire2str_pkt(e->reply_list->reply_pkt,
432 e->reply_list->reply_len);
433 printf("verifying NSEC3 hash:\n%s\n", s?s:"outofmemory");
434 free(s);
435 }
436 entry_to_repinfo(e, alloc, region, buf, &qinfo, &rep);
437 nsec3 = find_rrset_type(rep, LDNS_RR_TYPE_NSEC3);
438 answer = find_rrset_type(rep, LDNS_RR_TYPE_AAAA);
439 qname = regional_alloc_init(region, qinfo.qname, qinfo.qname_len);
440 /* check test is OK */
441 unit_assert(nsec3 && answer && qname);
442
443 ret = nsec3_hash_name(ct, region, buf, nsec3, 0, qname,
444 qinfo.qname_len, &hash);
445 if(ret != 1) {
446 printf("Bad nsec3_hash_name retcode %d\n", ret);
447 unit_assert(ret == 1);
448 }
449 unit_assert(hash->dname && hash->hash && hash->hash_len &&
450 hash->b32 && hash->b32_len);
451 unit_assert(hash->b32_len == (size_t)answer->rk.dname[0]);
452 /* does not do lowercasing. */
453 unit_assert(memcmp(hash->b32, answer->rk.dname+1, hash->b32_len)
454 == 0);
455
456 reply_info_parsedelete(rep, alloc);
457 query_info_clear(&qinfo);
458 }
459
460
461 /** Read file to test NSEC3 hash algo */
462 static void
nsec3_hash_test(const char * fname)463 nsec3_hash_test(const char* fname)
464 {
465 /*
466 * The list contains a list of ldns-testpkts entries.
467 * Every entry is a test.
468 * The qname is hashed.
469 * The answer section AAAA RR name is the required result.
470 * The auth section NSEC3 is used to get hash parameters.
471 * The hash cache is maintained per file.
472 *
473 * The test does not perform canonicalization during the compare.
474 */
475 rbtree_type ct;
476 struct regional* region = regional_create();
477 struct alloc_cache alloc;
478 sldns_buffer* buf = sldns_buffer_new(65535);
479 struct entry* e;
480 struct entry* list = read_datafile(fname, 1);
481 unit_show_func("NSEC3 hash", fname);
482
483 if(!list)
484 fatal_exit("could not read %s: %s", fname, strerror(errno));
485 rbtree_init(&ct, &nsec3_hash_cmp);
486 alloc_init(&alloc, NULL, 1);
487 unit_assert(region && buf);
488
489 /* ready to go! */
490 for(e = list; e; e = e->next) {
491 nsec3_hash_test_entry(e, &ct, &alloc, region, buf);
492 }
493
494 delete_entry(list);
495 regional_destroy(region);
496 alloc_clear(&alloc);
497 sldns_buffer_free(buf);
498 }
499
500 #define xstr(s) str(s)
501 #define str(s) #s
502
503 #define SRCDIRSTR xstr(SRCDIR)
504
505 void
verify_test(void)506 verify_test(void)
507 {
508 unit_show_feature("signature verify");
509 #ifdef USE_SHA1
510 verifytest_file(SRCDIRSTR "/testdata/test_signatures.1", "20070818005004");
511 #endif
512 #if defined(USE_DSA) && defined(USE_SHA1)
513 verifytest_file(SRCDIRSTR "/testdata/test_signatures.2", "20080414005004");
514 verifytest_file(SRCDIRSTR "/testdata/test_signatures.3", "20080416005004");
515 verifytest_file(SRCDIRSTR "/testdata/test_signatures.4", "20080416005004");
516 verifytest_file(SRCDIRSTR "/testdata/test_signatures.5", "20080416005004");
517 verifytest_file(SRCDIRSTR "/testdata/test_signatures.6", "20080416005004");
518 verifytest_file(SRCDIRSTR "/testdata/test_signatures.7", "20070829144150");
519 #endif /* USE_DSA */
520 #ifdef USE_SHA1
521 verifytest_file(SRCDIRSTR "/testdata/test_signatures.8", "20070829144150");
522 #endif
523 #if (defined(HAVE_EVP_SHA256) || defined(HAVE_NSS) || defined(HAVE_NETTLE)) && defined(USE_SHA2)
524 verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256", "20070829144150");
525 # ifdef USE_SHA1
526 verifytest_file(SRCDIRSTR "/testdata/test_sigs.sha1_and_256", "20070829144150");
527 # endif
528 verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha256_draft", "20090101000000");
529 #endif
530 #if (defined(HAVE_EVP_SHA512) || defined(HAVE_NSS) || defined(HAVE_NETTLE)) && defined(USE_SHA2)
531 verifytest_file(SRCDIRSTR "/testdata/test_sigs.rsasha512_draft", "20070829144150");
532 verifytest_file(SRCDIRSTR "/testdata/test_signatures.9", "20171215000000");
533 #endif
534 #ifdef USE_SHA1
535 verifytest_file(SRCDIRSTR "/testdata/test_sigs.hinfo", "20090107100022");
536 verifytest_file(SRCDIRSTR "/testdata/test_sigs.revoked", "20080414005004");
537 #endif
538 #ifdef USE_GOST
539 if(sldns_key_EVP_load_gost_id())
540 verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost", "20090807060504");
541 else printf("Warning: skipped GOST, openssl does not provide gost.\n");
542 #endif
543 #ifdef USE_ECDSA
544 /* test for support in case we use libNSS and ECC is removed */
545 if(dnskey_algo_id_is_supported(LDNS_ECDSAP256SHA256)) {
546 verifytest_file(SRCDIRSTR "/testdata/test_sigs.ecdsa_p256", "20100908100439");
547 verifytest_file(SRCDIRSTR "/testdata/test_sigs.ecdsa_p384", "20100908100439");
548 }
549 dstest_file(SRCDIRSTR "/testdata/test_ds.sha384");
550 #endif
551 #ifdef USE_ED25519
552 if(dnskey_algo_id_is_supported(LDNS_ED25519)) {
553 verifytest_file(SRCDIRSTR "/testdata/test_sigs.ed25519", "20170530140439");
554 }
555 #endif
556 #ifdef USE_ED448
557 if(dnskey_algo_id_is_supported(LDNS_ED448)) {
558 verifytest_file(SRCDIRSTR "/testdata/test_sigs.ed448", "20180408143630");
559 }
560 #endif
561 #ifdef USE_SHA1
562 dstest_file(SRCDIRSTR "/testdata/test_ds.sha1");
563 #endif
564 nsectest();
565 nsec3_hash_test(SRCDIRSTR "/testdata/test_nsec3_hash.1");
566 }
567