ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

[v9_9]3682. [bug] Correct the behavior of rndc retransfer to allow

Browse Source 
inline-signing slave zones to retain NSEC3 parameters instead of
			reverting to NSEC [RT #34745]
This commit is contained in:
Curtis Blackburn
2013-12-04 12:32:21 -06:00
parent 6c184eadbd
commit 1a890ff58a
9 changed files with 327 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
bin/tests/system/inline/clean.sh
View File

@@ -60,6 +60,10 @@ rm -f ns3/retransfer.bk
rm -f ns3/retransfer.bk.jnl
rm -f ns3/retransfer.bk.signed
rm -f ns3/retransfer.bk.signed.jnl
rm -f ns3/retransfer3.bk
rm -f ns3/retransfer3.bk.jnl
rm -f ns3/retransfer3.bk.signed
rm -f ns3/retransfer3.bk.signed.jnl
rm -f ns3/externalkey.db
rm -f ns3/externalkey.db.signed
rm -f ns3/externalkey.db.signed.jnl

3
bin/tests/system/inline/ns1/root.db.in
View File

@@ -53,3 +53,6 @@ ns3.nsec3. A 10.53.0.3
externalkey. NS ns3.externalkey.
ns3.externalkey. A 10.53.0.3
retransfer3. NS ns3.retransfer.
ns3.retransfer3. A 10.53.0.3

7
bin/tests/system/inline/ns2/named.conf
View File

@@ -48,3 +48,10 @@ zone "retransfer" {
allow-update { any; };
notify no;
};
zone "retransfer3" {
type master;
file "retransfer.db";
allow-update { any; };
notify no;
};

8
bin/tests/system/inline/ns3/named.conf
View File

@@ -111,3 +111,11 @@ zone "externalkey" {
allow-update { any; };
file "externalkey.db";
};
zone "retransfer3" {
type slave;
masters { 10.53.0.2; };
inline-signing yes;
auto-dnssec maintain;
file "retransfer3.bk";
};

7
bin/tests/system/inline/ns3/sign.sh Normal file → Executable file
View File

@@ -80,6 +80,13 @@ rm -f K${zone}.+*+*.private
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=retransfer3
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
for s in a c d h k l m q z
do
zone=test-$s

43
bin/tests/system/inline/tests.sh Normal file → Executable file
View File

@@ -25,7 +25,7 @@ RANDFILE=random.data
status=0
n=0
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 signing -nsec3param 1 0 0 - nsec3
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 signing -nsec3param 1 0 0 - nsec3 > /dev/null 2>&1
for i in 1 2 3 4 5 6 7 8 9 0
do
@@ -34,6 +34,21 @@ do
sleep 1
done
# Loop until retransfer3 has been transferred.
for i in 1 2 3 4 5 6 7 8 9 0
do
ans=0
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ans=1
[ $ans = 0 ] && break
done
for i in 1 2 3 4 5 6 7 8 9 0
do
nsec3param=`$DIG +short @10.53.0.3 -p 5300 nsec3param retransfer3.`
test -n "$nsec3param" && break
sleep 1
done
n=`expr $n + 1`
echo "I:checking that rrsigs are replaced with ksk only"
ret=0
@@ -761,6 +776,32 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:check rndc retransfer of a inline nsec3 slave retains nsec3 ($n)"
ret=0
for i in 0 1 2 3 4 5 6 7 8 9
do
ans=0
$DIG $DIGOPTS @10.53.0.3 -p 5300 nonexist.retransfer3 A > dig.out.ns3.pre.test$n
grep "status: NXDOMAIN" dig.out.ns3.pre.test$n > /dev/null || ans=1
grep "NSEC3" dig.out.ns3.pre.test$n > /dev/null || ans=1
[ $ans = 0 ] && break
sleep 1
done
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 retransfer retransfer3 2>&1 || ret=1
for i in 0 1 2 3 4 5 6 7 8 9
do
ans=0
$DIG $DIGOPTS @10.53.0.3 -p 5300 nonexist.retransfer3 A > dig.out.ns3.post.test$n
grep "status: NXDOMAIN" dig.out.ns3.post.test$n > /dev/null || ans=1
grep "NSEC3" dig.out.ns3.post.test$n > /dev/null || ans=1
[ $ans = 0 ] && break
sleep 1
done
[ $ans = 1 ] && ret=1
n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo "I:stop bump in the wire signer server ($n)"
ret=0