ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add todo in dnssec system test for [GL #1689]

Browse Source 
Add a note why we don't have a test case for the issue.

It is tricky to write a good test case for this if our tools are
not allowed to create signatures for unsupported algorithms.

(cherry picked from commit c6345fffe9)
This commit is contained in:
Matthijs Mekking
2020-06-25 13:39:24 +02:00
committed by Mark Andrews
parent 3e3afeb31e
commit 6d91799388
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
bin/tests/system/dnssec/tests.sh
View File

@@ -3545,6 +3545,13 @@ n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
# TODO: test case for GL #1689.
# If we allow the dnssec tools to use deprecated algorithms (such as RSAMD5)
# we could write a test that signs a zone with supported and unsupported
# algorithm, apply a fixed rrset order such that the unsupported algorithm
# precedes the supported one in the DNSKEY RRset, and verify the result still
# validates succesfully.
echo_i "check that a lone non matching CDNSKEY record is rejected ($n)"
ret=0
(