ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Add dnssec-signzone tests with unsupported alg

Browse Source 
dnssec-signzone should sign a zonefile that contains a DNSKEY record
with an unsupported algorithm.
This commit is contained in:
Matthijs Mekking
2018-12-18 12:10:05 +01:00
parent b04842c057
commit 6d976b37c1
8 changed files with 129 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
bin/tests/system/dnssec/tests.sh
View File

@@ -3393,6 +3393,26 @@ n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
echo_i "checking that unsupported DNSKEY algorithm validates as insecure ($n)"
ret=0
dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unsupported.example A > dig.out.ns3.test$n
dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-unsupported.example A > dig.out.ns4.test$n
grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1
grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
echo_i "checking that unsupported DNSKEY algorithm is in DNSKEY RRset ($n)"
ret=0
dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unsupported-2.example DNSKEY > dig.out.test$n
grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1
grep "dnskey-unsupported-2\.example\..*IN.*DNSKEY.*257 3 3" dig.out.test$n > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
echo_i "check that a lone non matching CDNSKEY record is rejected ($n)"
ret=0
(