ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Implement draft-vandijk-dnsop-nsec-ttl

Browse Source 
The draft says that the NSEC(3) TTL must have the same TTL value
as the minimum of the SOA MINIMUM field and the SOA TTL. This was
always the intended behaviour.

Update the zone structure to also track the SOA TTL. Whenever we
use the MINIMUM value to determine the NSEC(3) TTL, use the minimum
of MINIMUM and SOA TTL instead.

There is no specific test for this, however two tests need adjusting
because otherwise they failed: They were testing for NSEC3 records
including the TTL. Update these checks to use 600 (the SOA TTL),
rather than 3600 (the SOA MINIMUM).

(cherry picked from commit 9af8caa733)
This commit is contained in:
Matthijs Mekking
2020-12-18 14:19:36 +01:00
parent bb90cb2619
commit e5736de60d
6 changed files with 100 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bin/tests/system/dnssec/tests.sh
View File

@@ -3813,7 +3813,7 @@ status=$((status+ret))
echo_i "check that DNAME at apex with NSEC3 is correctly signed (dnssec-signzone) ($n)"
ret=0
dig_with_opts txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
grep "RRSIG.NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 3600" dig.out.ns3.test$n > /dev/null || ret=1
grep "RRSIG.NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 600" dig.out.ns3.test$n > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))