ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Check NSEC3 iterations with dnssec-signzone

Browse Source
This commit is contained in:
Mark Andrews
2021-04-23 11:46:31 +10:00
parent 4ce8437a6e
commit 8ec16c378d
7 changed files with 85 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
bin/tests/system/dnssec/tests.sh
View File

@@ -1312,7 +1312,7 @@ status=$((status+ret))
echo_ic "one non-KSK DNSKEY ($n)"
ret=0
(
cd signer/general || exit 1
cd signer/general || exit 0
rm -f signed.zone
$SIGNER -f signed.zone -o example.com. test2.zone > signer.out.$n
test -f signed.zone
@@ -1324,7 +1324,7 @@ status=$((status+ret))
echo_ic "one KSK DNSKEY ($n)"
ret=0
(
cd signer/general || exit 1
cd signer/general || exit 0
rm -f signed.zone
$SIGNER -f signed.zone -o example.com. test3.zone > signer.out.$n
test -f signed.zone
@@ -1372,7 +1372,7 @@ status=$((status+ret))
echo_ic "two DNSKEY, both private keys missing ($n)"
ret=0
(
cd signer/general || exit 1
cd signer/general || exit 0
rm -f signed.zone
$SIGNER -f signed.zone -o example.com. test7.zone > signer.out.$n
test -f signed.zone
@@ -1384,7 +1384,7 @@ status=$((status+ret))
echo_ic "two DNSKEY, one private key missing ($n)"
ret=0
(
cd signer/general || exit 1
cd signer/general || exit 0
rm -f signed.zone
$SIGNER -f signed.zone -o example.com. test8.zone > signer.out.$n
test -f signed.zone
@@ -1393,6 +1393,30 @@ n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
echo_ic "check that dnssec-signzone rejects excessive NSEC3 iterations ($n)"
ret=0
(
cd signer/general || exit 0
rm -f signed.zone
$SIGNER -f signed.zone -3 - -H 151 -o example.com. test9.zone > signer.out.$n
test -f signed.zone
) && ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
echo_ic "check that dnssec-signzone accepts maximum NSEC3 iterations ($n)"
ret=0
(
cd signer/general || exit 1
rm -f signed.zone
$SIGNER -f signed.zone -3 - -H 150 -o example.com. test9.zone > signer.out.$n
test -f signed.zone
) || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
echo_i "checking that a key using an unsupported algorithm cannot be generated ($n)"
ret=0
zone=example