ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Check dnssec-signzone behaviour with revoked keys

Browse Source 
Only DNSKEY records should be signed with a revoked key.
This commit is contained in:
Mark Andrews
2024-12-02 18:30:41 +11:00
parent 23775c6006
commit 30ef6dde05
2 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
bin/tests/system/dnssec/tests.sh
View File

@@ -4517,5 +4517,34 @@ n=$((n + 1))
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
echo_i "checking that records other than DNSKEY are not signed by a revoked key by dnssec-signzone ($n)"
ret=0
(
cd signer || exit 0
key1=$(${KEYGEN} -a "${DEFAULT_ALGORITHM}" -f KSK revoke.example)
key2=$(${KEYGEN} -a "${DEFAULT_ALGORITHM}" -f KSK revoke.example)
key3=$(${KEYGEN} -a "${DEFAULT_ALGORITHM}" revoke.example)
rkey=$(${REVOKE} "$key2")
cat >>revoke.example.db <<EOF
\$TTL 3600
@ SOA . . 0 0 0 0 3600
@ NS .
\$INCLUDE "${key1}.key"
\$INCLUDE "${rkey}.key"
\$INCLUDE "${key3}.key"
EOF
"${DSFROMKEY}" -C "$key1" >>revoke.example.db
"${SIGNER}" -o revoke.example revoke.example.db >signer.out.$n
) || ret=1
keycount=$(grep -c "RRSIG.DNSKEY ${DEFAULT_ALGORITHM_NUMBER} " signer/revoke.example.db.signed)
cdscount=$(grep -c "RRSIG.CDS ${DEFAULT_ALGORITHM_NUMBER} " signer/revoke.example.db.signed)
soacount=$(grep -c "RRSIG.SOA ${DEFAULT_ALGORITHM_NUMBER} " signer/revoke.example.db.signed)
[ $keycount -eq 3 ] || ret=1
[ $cdscount -eq 2 ] || ret=1
[ $soacount -eq 1 ] || ret=1
n=$((n + 1))
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1

1
bin/tests/system/dnssec/tests_sh_dnssec.py
View File

@@ -151,6 +151,7 @@ pytestmark = pytest.mark.extra_artifacts(
"signer/general/signer.out.*",
"signer/nsec3param.out",
"signer/prepub.db",
"signer/revoke.example.db",
"signer/signer.err.*",
"signer/signer.out.*",
]