ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Regression check for missing RRSIGs

Browse Source 
When transitioning from NSEC3 to NSEC the added records where not
being signed because the wrong time was being used to determine if
a key should be used or not.  Check that these records are actually
signed.

(cherry picked from commit bdb42d3838)
This commit is contained in:
Mark Andrews
2023-12-18 11:23:21 +11:00
parent 65fdc892eb
commit 15601cca43
2 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
bin/tests/system/autosign/ns3/named.conf.in
View File

@@ -167,6 +167,7 @@ zone "nsec3-to-nsec.example" {
type primary;
file "nsec3-to-nsec.example.db";
allow-update { any; };
max-journal-size 10M;
auto-dnssec maintain;
};

11
bin/tests/system/autosign/tests.sh
View File

@@ -1793,5 +1793,16 @@ n=$((n + 1))
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
echo_i "check that the startup change from NSEC3 to NSEC is properly signed ($n)"
ret=0
$JOURNALPRINT ns3/nsec3-to-nsec.example.db.jnl \
| awk 'BEGIN { count=0; ok=0 }
$1 == "del" && $5 == "SOA" { count++; if (count == 2) { if (ok) { exit(0); } else { exit(1); } } }
$1 == "add" && $5 == "RRSIG" && $6 == "TYPE65534" { ok=1 }
' || ret=1
n=$((n + 1))
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1