ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Check SOA without DNSKEY behaviour

Browse Source
This commit is contained in:
Mark Andrews
2021-12-01 17:03:13 +11:00
committed by Petr Špaček
parent dfe31e61d2
commit 8878adcd61
6 changed files with 54 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bin/tests/system/synthfromdnssec/clean.sh
View File

@@ -30,6 +30,8 @@ rm -f ./ns1/minimal.db
rm -f ./ns1/minimal.db.signed
rm -f ./ns1/root.db
rm -f ./ns1/root.db.signed
rm -f ./ns1/soa-without-dnskey.db
rm -f ./ns1/soa-without-dnskey.db.signed
rm -f ./ns1/trusted.conf
rm -f ./ns2/named_dump.db
rm -f ./ns*/managed-keys.bind*

5
bin/tests/system/synthfromdnssec/ns1/named.conf.in
View File

@@ -62,4 +62,9 @@ zone "minimal" {
file "minimal.db.signed";
};
zone "soa-without-dnskey" {
type primary;
file "soa-without-dnskey.db.signed";
};
include "trusted.conf";

2
bin/tests/system/synthfromdnssec/ns1/root.db.in
View File

@@ -17,3 +17,5 @@ dnamed NS ns1.dnamed
ns1.dnamed A 10.53.0.1
minimal NS ns1.minimal
ns1.minimal A 10.53.0.1
soa-without-dnskey NS ns1.soa-without-dnskey
ns1.soa-without-dnskey A 10.53.0.1

10
bin/tests/system/synthfromdnssec/ns1/sign.sh
View File

@@ -51,6 +51,16 @@ cat "$infile" "$keyname.key" > "$zonefile"
# do not regenerate NSEC chain as there in a minimal NSEC record present
$SIGNER -P -Z nonsecify -o $zone $zonefile > /dev/null
zone=soa-without-dnskey
infile=soa-without-dnskey.db.in
zonefile=soa-without-dnskey.db
keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
cat "$infile" "$keyname.key" > "$zonefile"
# do not regenerate NSEC chain as there in a minimal NSEC record present
$SIGNER -P -Z nonsecify -o $zone $zonefile > /dev/null
zone=.
infile=root.db.in
zonefile=root.db

12
bin/tests/system/synthfromdnssec/ns1/soa-without-dnskey.db.in Normal file
View File

@@ -0,0 +1,12 @@
$TTL 3600
soa-without-dnskey. 3600 SOA ns1.soa-without-dnskey. hostmaster.soa-without-dnskey. (
1 ; serial
3600 ; refresh (1 hour)
1200 ; retry (20 minutes)
604800 ; expire (1 week)
3600 ; minimum (1 hour)
)
3600 NS ns1.soa-without-dnskey.
3600 NSEC ns1.soa-without-dnskey. NS SOA RRSIG NSEC
ns1.soa-without-dnskey. 3600 A 10.53.0.1
3600 NSEC soa-without-dnskey. A RRSIG NSEC

23
bin/tests/system/synthfromdnssec/tests.sh
View File

@@ -302,6 +302,18 @@ do
n=$((n+1))
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "prime SOA without DNSKEY bad type map NODATA response (synth-from-dnssec ${description};) ($n)"
ret=0
dig_with_opts soa-without-dnskey. @10.53.0.${ns} TXT > dig.out.ns${ns}.test$n || ret=1
check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
check_status NOERROR dig.out.ns${ns}.test$n || ret=1
check_nosynth_soa soa-without-dnskey. dig.out.ns${ns}.test$n || ret=1
grep 'soa-without-dnskey.*3600.IN.NSEC.ns1.soa-without-dnskey. NS SOA RRSIG NSEC$' dig.out.ns${ns}.test$n > /dev/null || ret=1
n=$((n+1))
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
done
echo_i "prime redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
@@ -616,6 +628,17 @@ do
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "check SOA without DNSKEY bad type map NODATA response (synth-from-dnssec ${description};) ($n)"
ret=0
dig_with_opts soa-without-dnskey. @10.53.0.${ns} A > dig.out.ns${ns}.test$n || ret=1
check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
check_status NOERROR dig.out.ns${ns}.test$n || ret=1
check_nosynth_soa soa-without-dnskey. dig.out.ns${ns}.test$n || ret=1
grep 'soa-without-dnskey.*3600.IN.NSEC.ns1.soa-without-dnskey. NS SOA RRSIG NSEC$' dig.out.ns${ns}.test$n > /dev/null || ret=1
n=$((n+1))
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status+ret))
echo_i "check 'rndc stats' output for 'covering nsec returned' (synth-from-dnssec ${description};) ($n)"
ret=0
${RNDCCMD} 10.53.0.${ns} stats 2>&1 | sed 's/^/ns6 /' | cat_i