ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

disable adding keys to keytable; only DS trust anchors can now be added

Browse Source 
the internal keytable structure has not yet been changed, but
insertion of DS anchors is the only method now available.

NOTE: the keytable unit test is currently failing because of tests
that expect individual keynode objects to contain single DST key
objects.
This commit is contained in:
Evan Hunt
2019-12-20 11:37:11 -08:00
parent 7fdf40770f
commit b984a4b647
10 changed files with 218 additions and 255 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
bin/tests/system/dnssec/tests.sh
View File

@@ -3700,12 +3700,12 @@ status=$((status+ret))
# DNSSEC tests related to unsupported, disabled and revoked trust anchors.
#
# This nameserver (ns8) is loaded with a bunch of trust anchors. Some of them
# are good (enabled.managed, enabled.trusted, secure.managed, secure.trusted),
# and some of them are bad (disabled.managed, revoked.managed, unsupported.managed,
# disabled.trusted, revoked.trusted, unsupported.trusted). Make sure that the bad
# trust anchors are ignored. This is tested by looking for the corresponding
# lines in the logfile.
# This nameserver (ns8) is loaded with a bunch of trust anchors. Some of
# them are good (enabled.managed, enabled.trusted, secure.managed,
# secure.trusted), and some of them are bad (disabled.managed,
# revoked.managed, unsupported.managed, disabled.trusted, revoked.trusted,
# unsupported.trusted). Make sure that the bad trust anchors are ignored.
# This is tested by looking for the corresponding lines in the logfile.
echo_i "checking that keys with unsupported algorithms and disabled algorithms are ignored ($n)"
ret=0
grep -q "ignoring static-key for 'disabled\.trusted\.': algorithm is disabled" ns8/named.run || ret=1