4127. [protocol] CDS and CDNSKEY need to be signed by the key signing
key as per RFC 7344, Section 4.1. [RT #37215]
This commit is contained in:
Mark Andrews
@@ -16,72 +16,79 @@
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed
|
||||
rm -f */trusted.conf */managed.conf */revoked.conf
|
||||
rm -f */tmp* */*.jnl */*.bk */*.jbk
|
||||
rm -f ns1/root.db ns2/example.db ns3/secure.example.db
|
||||
rm -f ns3/unsecure.example.db ns3/bogus.example.db ns3/keyless.example.db
|
||||
rm -f ns3/dynamic.example.db ns3/dynamic.example.db.signed.jnl
|
||||
rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
|
||||
rm -f ns3/split-dnssec.example.db
|
||||
rm -f ns3/expiring.example.db ns3/nosign.example.db
|
||||
rm -f ns2/private.secure.example.db
|
||||
rm -f ns2/badparam.db ns2/badparam.db.bad
|
||||
rm -f ns2/single-nsec3.db
|
||||
rm -f ns2/nsec3chain-test.db
|
||||
rm -f ns2/in-addr.arpa.db
|
||||
rm -f */example.bk
|
||||
rm -f dig.out.*
|
||||
rm -f rndc.out.*
|
||||
rm -f delv.out*
|
||||
rm -f ns2/dlv.db
|
||||
rm -f ns3/multiple.example.db ns3/nsec3-unknown.example.db ns3/nsec3.example.db
|
||||
rm -f ns3/optout-unknown.example.db ns3/optout.example.db
|
||||
rm -f ns3/expired.example.db ns3/update-nsec3.example.db
|
||||
rm -f ns7/multiple.example.bk ns7/nsec3.example.bk ns7/optout.example.bk
|
||||
rm -f */named.memstats
|
||||
rm -f */named.run
|
||||
rm -f ns3/nsec3.nsec3.example.db
|
||||
rm -f ns3/nsec3.optout.example.db
|
||||
rm -f ns3/optout.nsec3.example.db
|
||||
rm -f ns3/optout.optout.example.db
|
||||
rm -f ns3/secure.nsec3.example.db
|
||||
rm -f ns3/secure.optout.example.db
|
||||
rm -f */named.secroots
|
||||
rm -f ns1/managed.key.id
|
||||
rm -f signer/*.db
|
||||
rm -f signer/signer.out.*
|
||||
rm -f ns2/algroll.db
|
||||
rm -f ns3/kskonly.example.db
|
||||
rm -f ns4/named.conf ns5/named.conf
|
||||
rm -f ns4/managed-keys.bind*
|
||||
rm -f ns3/auto-nsec.example.db ns3/auto-nsec3.example.db
|
||||
rm -f ns3/secure.below-cname.example.db
|
||||
rm -f ns3/publish-inactive.example.db
|
||||
rm -f signer/example.db.after signer/example.db.before
|
||||
rm -f signer/example.db.changed
|
||||
rm -f signer/nsec3param.out
|
||||
rm -f ns3/ttlpatch.example.db ns3/ttlpatch.example.db.signed
|
||||
rm -f ns3/ttlpatch.example.db.patched
|
||||
rm -f ns3/split-smart.example.db
|
||||
rm -f ns3/siginterval.example.db
|
||||
rm -f ns3/inline.example.db.signed
|
||||
rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower
|
||||
rm -f ns6/optout-tld.db
|
||||
rm -f nosign.before
|
||||
rm -f signing.out*
|
||||
rm -f canonical?.*
|
||||
rm -f ns3/siginterval.conf
|
||||
rm -f ns4/named_dump.db
|
||||
rm -f ns3/badds.example.db
|
||||
rm -f delve.out*
|
||||
rm -f ns7/split-rrsig.db ns7/split-rrsig.db.unsplit
|
||||
rm -f */tmp* */*.jnl */*.bk */*.jbk
|
||||
rm -f */trusted.conf */managed.conf */revoked.conf
|
||||
rm -f Kexample.*
|
||||
rm -f canonical?.*
|
||||
rm -f delv.out*
|
||||
rm -f delve.out*
|
||||
rm -f dig.out.*
|
||||
rm -f keygen.err
|
||||
rm -f ns3/future.example.db ns3/trusted-future.key
|
||||
rm -f named.secroots.test*
|
||||
rm -f nosign.before
|
||||
rm -f ns*/*.nta
|
||||
rm -f ns*/named.lock
|
||||
rm -f ns1/managed.key.id
|
||||
rm -f ns1/root.db ns2/example.db ns3/secure.example.db
|
||||
rm -f ns2/algroll.db
|
||||
rm -f ns2/badparam.db ns2/badparam.db.bad
|
||||
rm -f ns2/cdnskey-update.secure.db
|
||||
rm -f ns2/cdnskey.secure.db
|
||||
rm -f ns2/cds-auto.secure.db ns2/cds-auto.secure.db.jnl
|
||||
rm -f ns2/cds-update.secure.db ns2/cds-update.secure.db.jnl
|
||||
rm -f ns2/cds.secure.db
|
||||
rm -f ns2/dlv.db
|
||||
rm -f ns2/in-addr.arpa.db
|
||||
rm -f ns2/nsec3chain-test.db
|
||||
rm -f ns2/private.secure.example.db
|
||||
rm -f ns2/single-nsec3.db
|
||||
rm -f ns3/auto-nsec.example.db ns3/auto-nsec3.example.db
|
||||
rm -f ns3/badds.example.db
|
||||
rm -f ns3/dnskey-nsec3-unknown.example.db
|
||||
rm -f ns3/dnskey-nsec3-unknown.example.db.tmp
|
||||
rm -f ns3/dnskey-unknown.example.db
|
||||
rm -f ns3/dnskey-unknown.example.db.tmp
|
||||
rm -f ns*/named.lock
|
||||
rm -f ns*/*.nta
|
||||
rm -f named.secroots.test*
|
||||
rm -f ns3/dynamic.example.db ns3/dynamic.example.db.signed.jnl
|
||||
rm -f ns3/expired.example.db ns3/update-nsec3.example.db
|
||||
rm -f ns3/expiring.example.db ns3/nosign.example.db
|
||||
rm -f ns3/future.example.db ns3/trusted-future.key
|
||||
rm -f ns3/inline.example.db.signed
|
||||
rm -f ns3/kskonly.example.db
|
||||
rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower
|
||||
rm -f ns3/multiple.example.db ns3/nsec3-unknown.example.db ns3/nsec3.example.db
|
||||
rm -f ns3/nsec3.nsec3.example.db
|
||||
rm -f ns3/nsec3.optout.example.db
|
||||
rm -f ns3/optout-unknown.example.db ns3/optout.example.db
|
||||
rm -f ns3/optout.nsec3.example.db
|
||||
rm -f ns3/optout.optout.example.db
|
||||
rm -f ns3/publish-inactive.example.db
|
||||
rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
|
||||
rm -f ns3/secure.below-cname.example.db
|
||||
rm -f ns3/secure.nsec3.example.db
|
||||
rm -f ns3/secure.optout.example.db
|
||||
rm -f ns3/siginterval.conf
|
||||
rm -f ns3/siginterval.example.db
|
||||
rm -f ns3/split-dnssec.example.db
|
||||
rm -f ns3/split-smart.example.db
|
||||
rm -f ns3/ttlpatch.example.db ns3/ttlpatch.example.db.signed
|
||||
rm -f ns3/ttlpatch.example.db.patched
|
||||
rm -f ns3/unsecure.example.db ns3/bogus.example.db ns3/keyless.example.db
|
||||
rm -f ns4/managed-keys.bind*
|
||||
rm -f ns4/named.conf
|
||||
rm -f ns4/named.conf ns5/named.conf
|
||||
rm -f ns4/named_dump.db
|
||||
rm -f ns6/optout-tld.db
|
||||
rm -f ns7/multiple.example.bk ns7/nsec3.example.bk ns7/optout.example.bk
|
||||
rm -f ns7/split-rrsig.db ns7/split-rrsig.db.unsplit
|
||||
rm -f nsupdate.out*
|
||||
rm -f rndc.out.*
|
||||
rm -f signer/*.db
|
||||
rm -f signer/example.db.after signer/example.db.before
|
||||
rm -f signer/example.db.changed
|
||||
rm -f signer/nsec3param.out
|
||||
rm -f signer/signer.out.*
|
||||
rm -f signing.out*
|
||||
|
||||
17
bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in
Normal file
17
bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in
Normal file
@@ -0,0 +1,17 @@
|
||||
; Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; Permission to use, copy, modify, and/or distribute this software for any
|
||||
; purpose with or without fee is hereby granted, provided that the above
|
||||
; copyright notice and this permission notice appear in all copies.
|
||||
;
|
||||
; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
$TTL 3600
|
||||
@ SOA ns2.example. . 1 3600 1200 86400 1200
|
||||
@ NS ns2.example.
|
||||
17
bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in
Normal file
17
bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in
Normal file
@@ -0,0 +1,17 @@
|
||||
; Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; Permission to use, copy, modify, and/or distribute this software for any
|
||||
; purpose with or without fee is hereby granted, provided that the above
|
||||
; copyright notice and this permission notice appear in all copies.
|
||||
;
|
||||
; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
$TTL 3600
|
||||
@ SOA ns2.example. . 1 3600 1200 86400 1200
|
||||
@ NS ns2.example.
|
||||
17
bin/tests/system/dnssec/ns2/cdnskey.secure.db.in
Normal file
17
bin/tests/system/dnssec/ns2/cdnskey.secure.db.in
Normal file
@@ -0,0 +1,17 @@
|
||||
; Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; Permission to use, copy, modify, and/or distribute this software for any
|
||||
; purpose with or without fee is hereby granted, provided that the above
|
||||
; copyright notice and this permission notice appear in all copies.
|
||||
;
|
||||
; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
$TTL 3600
|
||||
@ SOA ns2.example. . 1 3600 1200 86400 1200
|
||||
@ NS ns2.example.
|
||||
17
bin/tests/system/dnssec/ns2/cds-auto.secure.db.in
Normal file
17
bin/tests/system/dnssec/ns2/cds-auto.secure.db.in
Normal file
@@ -0,0 +1,17 @@
|
||||
; Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; Permission to use, copy, modify, and/or distribute this software for any
|
||||
; purpose with or without fee is hereby granted, provided that the above
|
||||
; copyright notice and this permission notice appear in all copies.
|
||||
;
|
||||
; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
$TTL 3600
|
||||
@ SOA ns2.example. . 1 3600 1200 86400 1200
|
||||
@ NS ns2.example.
|
||||
17
bin/tests/system/dnssec/ns2/cds-update.secure.db.in
Normal file
17
bin/tests/system/dnssec/ns2/cds-update.secure.db.in
Normal file
@@ -0,0 +1,17 @@
|
||||
; Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; Permission to use, copy, modify, and/or distribute this software for any
|
||||
; purpose with or without fee is hereby granted, provided that the above
|
||||
; copyright notice and this permission notice appear in all copies.
|
||||
;
|
||||
; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
$TTL 3600
|
||||
@ SOA ns2.example. . 1 3600 1200 86400 1200
|
||||
@ NS ns2.example.
|
||||
17
bin/tests/system/dnssec/ns2/cds.secure.db.in
Normal file
17
bin/tests/system/dnssec/ns2/cds.secure.db.in
Normal file
@@ -0,0 +1,17 @@
|
||||
; Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; Permission to use, copy, modify, and/or distribute this software for any
|
||||
; purpose with or without fee is hereby granted, provided that the above
|
||||
; copyright notice and this permission notice appear in all copies.
|
||||
;
|
||||
; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
$TTL 3600
|
||||
@ SOA ns2.example. . 1 3600 1200 86400 1200
|
||||
@ NS ns2.example.
|
||||
@@ -107,4 +107,40 @@ zone "in-addr.arpa" {
|
||||
file "in-addr.arpa.db.signed";
|
||||
};
|
||||
|
||||
zone "cds.secure" {
|
||||
type master;
|
||||
file "cds.secure.db.signed";
|
||||
};
|
||||
|
||||
zone "cds-update.secure" {
|
||||
type master;
|
||||
file "cds-update.secure.db.signed";
|
||||
allow-update { any; };
|
||||
};
|
||||
|
||||
zone "cds-auto.secure" {
|
||||
type master;
|
||||
file "cds-auto.secure.db.signed";
|
||||
auto-dnssec maintain;
|
||||
allow-update { any; };
|
||||
};
|
||||
|
||||
zone "cdnskey.secure" {
|
||||
type master;
|
||||
file "cdnskey.secure.db.signed";
|
||||
};
|
||||
|
||||
zone "cdnskey-update.secure" {
|
||||
type master;
|
||||
file "cdnskey-update.secure.db.signed";
|
||||
allow-update { any; };
|
||||
};
|
||||
|
||||
zone "cdnskey-auto.secure" {
|
||||
type master;
|
||||
file "cdnskey-auto.secure.db.signed";
|
||||
auto-dnssec maintain;
|
||||
allow-update { any; };
|
||||
};
|
||||
|
||||
include "trusted.conf";
|
||||
|
||||
@@ -192,3 +192,53 @@ key1=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone -fk $zone`
|
||||
key2=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
|
||||
cat $key1.key $key2.key >> $zonefile
|
||||
$SIGNER -P -3 - -A -H 1 -g -r $RANDFILE -o $zone -k $key1 $zonefile $key2 > /dev/null
|
||||
|
||||
zone=cds.secure
|
||||
infile=cds.secure.db.in
|
||||
zonefile=cds.secure.db
|
||||
key1=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -fk $zone`
|
||||
key2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
|
||||
$DSFROMKEY -C $key1.key > $key1.cds
|
||||
cat $infile $key1.key $key2.key $key1.cds >$zonefile
|
||||
$SIGNER -P -g -r $RANDFILE -o $zone $zonefile > /dev/null
|
||||
|
||||
zone=cds-update.secure
|
||||
infile=cds-update.secure.db.in
|
||||
zonefile=cds-update.secure.db
|
||||
key1=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -fk $zone`
|
||||
key2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
|
||||
cat $infile $key1.key $key2.key > $zonefile
|
||||
$SIGNER -P -g -r $RANDFILE -o $zone $zonefile > /dev/null
|
||||
|
||||
zone=cds-auto.secure
|
||||
infile=cds-auto.secure.db.in
|
||||
zonefile=cds-auto.secure.db
|
||||
key1=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -fk $zone`
|
||||
key2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
|
||||
$DSFROMKEY -C $key1.key > $key1.cds
|
||||
cat $infile $key1.cds > $zonefile.signed
|
||||
|
||||
zone=cdnskey.secure
|
||||
infile=cdnskey.secure.db.in
|
||||
zonefile=cdnskey.secure.db
|
||||
key1=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -fk $zone`
|
||||
key2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
|
||||
sed 's/DNSKEY/CDNSKEY/' $key1.key > $key1.cds
|
||||
cat $infile $key1.key $key2.key $key1.cds >$zonefile
|
||||
$SIGNER -P -g -r $RANDFILE -o $zone $zonefile > /dev/null
|
||||
|
||||
zone=cdnskey-update.secure
|
||||
infile=cdnskey-update.secure.db.in
|
||||
zonefile=cdnskey-update.secure.db
|
||||
key1=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -fk $zone`
|
||||
key2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
|
||||
cat $infile $key1.key $key2.key > $zonefile
|
||||
$SIGNER -P -g -r $RANDFILE -o $zone $zonefile > /dev/null
|
||||
|
||||
zone=cdnskey-auto.secure
|
||||
infile=cdnskey-auto.secure.db.in
|
||||
zonefile=cdnskey-auto.secure.db
|
||||
key1=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -fk $zone`
|
||||
key2=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
|
||||
sed 's/DNSKEY/CDNSKEY/' $key1.key > $key1.cds
|
||||
cat $infile $key1.cds > $zonefile.signed
|
||||
|
||||
@@ -2950,6 +2950,15 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that CDS records are signed using KSK by dnssec-signzone ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
#
|
||||
# Test for +sigchase with a null set of trusted keys.
|
||||
#
|
||||
@@ -2985,6 +2994,57 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that CDS records are signed using KSK by with dnssec-auto ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-auto.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that a lone non matching CDS record is rejected ($n)"
|
||||
ret=0
|
||||
(
|
||||
echo zone cds-update.secure
|
||||
echo server 10.53.0.2 5300
|
||||
echo update delete cds-update.secure CDS
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cds-update.secure |
|
||||
grep "DNSKEY.257" | sed 's/DNSKEY.257/DNSKEY 258/' |
|
||||
$DSFROMKEY -C -A -f - -T 1 cds-update.secure |
|
||||
sed "s/^/update add /"
|
||||
echo send
|
||||
) | $NSUPDATE > nsupdate.out.test$n 2>&1
|
||||
grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "CDS" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-10} -eq 0 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that CDS records are signed using KSK when added by nsupdate ($n)"
|
||||
ret=0
|
||||
(
|
||||
echo zone cds-update.secure
|
||||
echo server 10.53.0.2 5300
|
||||
echo update delete cds-update.secure CDS
|
||||
echo send
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cds-update.secure |
|
||||
grep "DNSKEY.257" |
|
||||
$DSFROMKEY -C -f - -T 1 cds-update.secure |
|
||||
sed "s/^/update add /"
|
||||
echo send
|
||||
) | $NSUPDATE
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
lines=`awk '$4 == "CDS" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:checking that positive unknown NSEC3 hash algorithm with OPTOUT does validate ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth +noadd +nodnssec +adflag -p 5300 @10.53.0.3 optout-unknown.example SOA > dig.out.ns3.test$n
|
||||
@@ -2997,6 +3057,32 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that a non matching CDS record is accepted with a matching CDS record ($n)"
|
||||
ret=0
|
||||
(
|
||||
echo zone cds-update.secure
|
||||
echo server 10.53.0.2 5300
|
||||
echo update delete cds-update.secure CDS
|
||||
echo send
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cds-update.secure |
|
||||
grep "DNSKEY.257" |
|
||||
$DSFROMKEY -C -f - -T 1 cds-update.secure |
|
||||
sed "s/^/update add /"
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cds-update.secure |
|
||||
grep "DNSKEY.257" | sed 's/DNSKEY.257/DNSKEY 258/' |
|
||||
$DSFROMKEY -C -A -f - -T 1 cds-update.secure |
|
||||
sed "s/^/update add /"
|
||||
echo send
|
||||
) | $NSUPDATE
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
lines=`awk '$4 == "CDS" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 4 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:checking that negative unknown NSEC3 hash algorithm does not validate ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth +noadd +nodnssec +adflag -p 5300 @10.53.0.3 nsec3-unknown.example A > dig.out.ns3.test$n
|
||||
@@ -3007,6 +3093,15 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that CDNSKEY records are signed using KSK by dnssec-signzone ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:checking that negative unknown NSEC3 hash algorithm with OPTOUT does not validate ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth +noadd +nodnssec +adflag -p 5300 @10.53.0.3 optout-unknown.example A > dig.out.ns3.test$n
|
||||
@@ -3017,6 +3112,15 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that CDNSKEY records are signed using KSK by with dnssec-auto ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-auto.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:checking that unknown DNSKEY algorithm validates as insecure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth +noadd +nodnssec +adflag -p 5300 @10.53.0.3 dnskey-unknown.example A > dig.out.ns3.test$n
|
||||
@@ -3028,6 +3132,25 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that a lone non matching CDNSKEY record is rejected ($n)"
|
||||
ret=0
|
||||
(
|
||||
echo zone cdnskey-update.secure
|
||||
echo server 10.53.0.2 5300
|
||||
echo update delete cdnskey-update.secure CDNSKEY
|
||||
echo send
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cdnskey-update.secure |
|
||||
sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 258/p'
|
||||
echo send
|
||||
) | $NSUPDATE > nsupdate.out.test$n 2>&1
|
||||
grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-10} -eq 0 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:checking that unknown DNSKEY algorithm + unknown NSEC3 has algorithm validates as insecure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth +noadd +nodnssec +adflag -p 5300 @10.53.0.3 dnskey-nsec3-unknown.example A > dig.out.ns3.test$n
|
||||
@@ -3039,6 +3162,25 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that CDNSKEY records are signed using KSK when added by nsupdate ($n)"
|
||||
ret=0
|
||||
(
|
||||
echo zone cdnskey-update.secure
|
||||
echo server 10.53.0.2 5300
|
||||
echo update delete cdnskey-update.secure CDNSKEY
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cdnskey-update.secure |
|
||||
sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p'
|
||||
echo send
|
||||
) | $NSUPDATE
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
lines=`awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 1 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:checking initialization with a revoked managed key ($n)"
|
||||
ret=0
|
||||
cp ns5/named2.conf ns5/named.conf
|
||||
@@ -3050,5 +3192,26 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:check that a non matching CDNSKEY record is accepted with a matching CDNSKEY record ($n)"
|
||||
ret=0
|
||||
(
|
||||
echo zone cdnskey-update.secure
|
||||
echo server 10.53.0.2 5300
|
||||
echo update delete cdnskey-update.secure CDNSKEY
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cdnskey-update.secure |
|
||||
sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p'
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cdnskey-update.secure |
|
||||
sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 258/p'
|
||||
echo send
|
||||
) | $NSUPDATE
|
||||
$DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n
|
||||
lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
lines=`awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l`
|
||||
test ${lines:-0} -eq 2 || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:exit status: $status"
|
||||
exit $status
|
||||
|
||||
Reference in New Issue
Block a user