3120. [bug] Named could fail to validate zones list in a DLV
that validated insecure without using DLV and had
DS records in the parent zone. [RT #24631]
This commit is contained in:
Mark Andrews
@@ -14,17 +14,30 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: clean.sh,v 1.7 2010/05/27 23:51:08 tbox Exp $
|
||||
# $Id: clean.sh,v 1.8 2011/05/26 04:35:01 marka Exp $
|
||||
|
||||
rm -f random.data
|
||||
rm -f ns*/named.run
|
||||
rm -f ns1/K*
|
||||
rm -f ns1/dsset-*
|
||||
rm -f ns1/*.signed
|
||||
rm -f ns1/signer.err
|
||||
rm -f ns1/root.db
|
||||
rm -f ns2/K*
|
||||
rm -f ns2/dlvset-*
|
||||
rm -f ns2/dsset-*
|
||||
rm -f ns2/*.signed
|
||||
rm -f ns2/*.pre
|
||||
rm -f ns2/signer.err
|
||||
rm -f ns2/druz.db
|
||||
rm -f ns3/K*
|
||||
rm -f ns3/*.db
|
||||
rm -f ns3/*.signed
|
||||
rm -f ns3/dlvset-*
|
||||
rm -f ns3/dsset-*
|
||||
rm -f ns3/keyset-*
|
||||
rm -f ns3/trusted.conf ns5/trusted.conf
|
||||
rm -f ns1/trusted.conf ns5/trusted.conf
|
||||
rm -f ns3/trusted-dlv.conf ns5/trusted-dlv.conf
|
||||
rm -f ns3/signer.err
|
||||
rm -f ns6/K*
|
||||
rm -f ns6/*.db
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.4 2007/06/19 23:47:02 tbox Exp $ */
|
||||
/* $Id: named.conf,v 1.5 2011/05/26 04:35:01 marka Exp $ */
|
||||
|
||||
controls { /* empty */ };
|
||||
|
||||
@@ -28,8 +28,8 @@ options {
|
||||
listen-on-v6 { none; };
|
||||
recursion no;
|
||||
notify yes;
|
||||
dnssec-enable no;
|
||||
dnssec-enable yes;
|
||||
};
|
||||
|
||||
zone "." { type master; file "root.db"; };
|
||||
zone "." { type master; file "root.signed"; };
|
||||
zone "rootservers.utld" { type master; file "rootservers.utld.db"; };
|
||||
|
||||
@@ -12,7 +12,7 @@
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
; $Id: root.db,v 1.4 2007/06/19 23:47:02 tbox Exp $
|
||||
; $Id: root.db.in,v 1.2 2011/05/26 04:35:01 marka Exp $
|
||||
|
||||
$TTL 120
|
||||
@ SOA ns.rootservers.utld hostmaster.ns.rootservers.utld (
|
||||
@@ -22,3 +22,5 @@ ns A 10.53.0.1
|
||||
;
|
||||
utld NS ns.utld
|
||||
ns.utld A 10.53.0.2
|
||||
druz NS ns.druz
|
||||
ns.druz A 10.53.0.2
|
||||
52
bin/tests/system/dlv/ns1/sign.sh
Executable file
52
bin/tests/system/dlv/ns1/sign.sh
Executable file
@@ -0,0 +1,52 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2004, 2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# Permission to use, copy, modify, and/or distribute this software for any
|
||||
# purpose with or without fee is hereby granted, provided that the above
|
||||
# copyright notice and this permission notice appear in all copies.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: sign.sh,v 1.2 2011/05/26 04:35:01 marka Exp $
|
||||
|
||||
(cd ../ns2 && sh -e ./sign.sh || exit 1)
|
||||
|
||||
echo "I:dlv/ns1/sign.sh"
|
||||
|
||||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
RANDFILE=../random.data
|
||||
|
||||
zone=.
|
||||
infile=root.db.in
|
||||
zonefile=root.db
|
||||
outfile=root.signed
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -g -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
|
||||
echo "I: signed $zone"
|
||||
|
||||
grep -v '^;' $keyname2.key | $PERL -n -e '
|
||||
local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split;
|
||||
local $key = join("", @rest);
|
||||
print <<EOF
|
||||
trusted-keys {
|
||||
"$dn" $flags $proto $alg "$key";
|
||||
};
|
||||
EOF
|
||||
' > trusted.conf
|
||||
cp trusted.conf ../ns5
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
; Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC")
|
||||
; Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; Permission to use, copy, modify, and/or distribute this software for any
|
||||
; purpose with or without fee is hereby granted, provided that the above
|
||||
@@ -12,7 +12,7 @@
|
||||
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
; PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
; $Id: druz.db.in,v 1.2 2011/05/25 23:47:16 tbox Exp $
|
||||
; $Id: druz.db.in,v 1.3 2011/05/26 04:35:01 marka Exp $
|
||||
|
||||
$TTL 120
|
||||
@ SOA ns hostmaster.ns 1 3600 1200 604800 60
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.4 2007/06/19 23:47:02 tbox Exp $ */
|
||||
/* $Id: named.conf,v 1.5 2011/05/26 04:35:01 marka Exp $ */
|
||||
|
||||
controls { /* empty */ };
|
||||
|
||||
@@ -28,8 +28,9 @@ options {
|
||||
listen-on-v6 { none; };
|
||||
recursion no;
|
||||
notify yes;
|
||||
dnssec-enable no;
|
||||
dnssec-enable yes;
|
||||
};
|
||||
|
||||
zone "." { type hint; file "hints"; };
|
||||
zone "utld" { type master; file "utld.db"; };
|
||||
zone "druz" { type master; file "druz.signed"; };
|
||||
|
||||
44
bin/tests/system/dlv/ns2/sign.sh
Executable file
44
bin/tests/system/dlv/ns2/sign.sh
Executable file
@@ -0,0 +1,44 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2004, 2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC")
|
||||
#
|
||||
# Permission to use, copy, modify, and/or distribute this software for any
|
||||
# purpose with or without fee is hereby granted, provided that the above
|
||||
# copyright notice and this permission notice appear in all copies.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: sign.sh,v 1.2 2011/05/26 04:35:01 marka Exp $
|
||||
|
||||
(cd ../ns3 && sh -e ./sign.sh || exit 1)
|
||||
|
||||
echo "I:dlv/ns2/sign.sh"
|
||||
|
||||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
RANDFILE=../random.data
|
||||
|
||||
zone=druz.
|
||||
infile=druz.db.in
|
||||
zonefile=druz.db
|
||||
outfile=druz.pre
|
||||
dlvzone=utld.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -g -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
|
||||
$CHECKZONE -q -D -i none druz druz.pre |
|
||||
sed '/IN DNSKEY/s/\([a-z0-9A-Z/]\{10\}\)[a-z0-9A-Z/]\{16\}/\1XXXXXXXXXXXXXXXX/'> druz.signed
|
||||
|
||||
echo "I: signed $zone"
|
||||
@@ -14,7 +14,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.4 2007/06/19 23:47:02 tbox Exp $ */
|
||||
/* $Id: named.conf,v 1.5 2011/05/26 04:35:01 marka Exp $ */
|
||||
|
||||
controls { /* empty */ };
|
||||
|
||||
@@ -41,3 +41,11 @@ zone "child7.utld" { type master; file "child7.signed"; }; // no dlv
|
||||
zone "child8.utld" { type master; file "child8.signed"; }; // no dlv
|
||||
zone "child9.utld" { type master; file "child9.signed"; }; // dlv
|
||||
zone "child10.utld" { type master; file "child.db.in"; }; // dlv unsigned
|
||||
zone "child1.druz" { type master; file "child1.druz.signed"; }; // dlv
|
||||
zone "child3.druz" { type master; file "child3.druz.signed"; }; // dlv
|
||||
zone "child4.druz" { type master; file "child4.druz.signed"; }; // dlv
|
||||
zone "child5.druz" { type master; file "child5.druz.signed"; }; // dlv
|
||||
zone "child7.druz" { type master; file "child7.druz.signed"; }; // no dlv
|
||||
zone "child8.druz" { type master; file "child8.druz.signed"; }; // no dlv
|
||||
zone "child9.druz" { type master; file "child9.druz.signed"; }; // dlv
|
||||
zone "child10.druz" { type master; file "child.db.in"; }; // dlv unsigned
|
||||
|
||||
@@ -14,21 +14,24 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: sign.sh,v 1.9 2010/05/27 23:51:08 tbox Exp $
|
||||
# $Id: sign.sh,v 1.10 2011/05/26 04:35:02 marka Exp $
|
||||
|
||||
(cd ../ns6 && sh -e ./sign.sh)
|
||||
|
||||
echo "I:dlv/ns3/sign.sh"
|
||||
|
||||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
RANDFILE=../random.data
|
||||
dlvzone=dlv.utld.
|
||||
dlvsets=
|
||||
dssets=
|
||||
|
||||
zone=child1.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child1.utld.db
|
||||
outfile=child1.signed
|
||||
dlvzone=dlv.utld.
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
@@ -44,7 +47,6 @@ zone=child3.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child3.utld.db
|
||||
outfile=child3.signed
|
||||
dlvzone=dlv.utld.
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
@@ -60,7 +62,6 @@ zone=child4.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child4.utld.db
|
||||
outfile=child4.signed
|
||||
dlvzone=dlv.utld.
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
@@ -76,7 +77,6 @@ zone=child5.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child5.utld.db
|
||||
outfile=child5.signed
|
||||
dlvzone=dlv.utld.
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
@@ -92,7 +92,6 @@ zone=child7.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child7.utld.db
|
||||
outfile=child7.signed
|
||||
dlvzone=dlv.utld.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
@@ -107,7 +106,6 @@ zone=child8.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child8.utld.db
|
||||
outfile=child8.signed
|
||||
dlvzone=dlv.utld.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
@@ -122,7 +120,6 @@ zone=child9.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child9.utld.db
|
||||
outfile=child9.signed
|
||||
dlvzone=dlv.utld.
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
@@ -137,7 +134,6 @@ zone=child10.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child10.utld.db
|
||||
outfile=child10.signed
|
||||
dlvzone=dlv.utld.
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
@@ -148,12 +144,133 @@ cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
zone=child1.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child1.druz.db
|
||||
outfile=child1.druz.signed
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
dssets="$dssets dsset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=child3.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child3.druz.db
|
||||
outfile=child3.druz.signed
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
dssets="$dssets dsset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=child4.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child4.druz.db
|
||||
outfile=child4.druz.signed
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
dssets="$dssets dsset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=child5.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child5.druz.db
|
||||
outfile=child5.druz.signed
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
dssets="$dssets dsset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=child7.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child7.druz.db
|
||||
outfile=child7.druz.signed
|
||||
dssets="$dssets dsset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=child8.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child8.druz.db
|
||||
outfile=child8.druz.signed
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=child9.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child9.druz.db
|
||||
outfile=child9.druz.signed
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
zone=child10.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child10.druz.db
|
||||
outfile=child10.druz.signed
|
||||
dlvsets="$dlvsets dlvset-$zone"
|
||||
dssets="$dssets dsset-$zone"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=dlv.utld.
|
||||
infile=dlv.db.in
|
||||
zonefile=dlv.utld.db
|
||||
outfile=dlv.signed
|
||||
dlvzone=dlv.utld.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
@@ -172,5 +289,7 @@ trusted-keys {
|
||||
"$dn" $flags $proto $alg "$key";
|
||||
};
|
||||
EOF
|
||||
' > trusted.conf
|
||||
cp trusted.conf ../ns5
|
||||
' > trusted-dlv.conf
|
||||
cp trusted-dlv.conf ../ns5
|
||||
|
||||
cp $dssets ../ns2
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.8 2007/06/18 23:47:28 tbox Exp $ */
|
||||
/* $Id: named.conf,v 1.9 2011/05/26 04:35:02 marka Exp $ */
|
||||
|
||||
/*
|
||||
* Choose a keyname that is unlikely to clash with any real key names.
|
||||
@@ -46,6 +46,7 @@ controls {
|
||||
};
|
||||
|
||||
include "trusted.conf";
|
||||
include "trusted-dlv.conf";
|
||||
|
||||
options {
|
||||
query-source address 10.53.0.5;
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
* PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
|
||||
/* $Id: named.conf,v 1.4 2010/07/11 01:18:24 each Exp $ */
|
||||
/* $Id: named.conf,v 1.5 2011/05/26 04:35:02 marka Exp $ */
|
||||
|
||||
controls { /* empty */ };
|
||||
|
||||
@@ -40,3 +40,11 @@ zone "grand.child7.utld" { type master; file "grand.child7.signed"; };
|
||||
zone "grand.child8.utld" { type master; file "grand.child8.signed"; };
|
||||
zone "grand.child9.utld" { type master; file "grand.child9.signed"; };
|
||||
zone "grand.child10.utld" { type master; file "grand.child10.signed"; };
|
||||
zone "grand.child1.druz" { type master; file "grand.child1.druz.signed"; };
|
||||
zone "grand.child3.druz" { type master; file "grand.child3.druz.signed"; };
|
||||
zone "grand.child4.druz" { type master; file "grand.child4.druz.signed"; };
|
||||
zone "grand.child5.druz" { type master; file "grand.child5.druz.signed"; };
|
||||
zone "grand.child7.druz" { type master; file "grand.child7.druz.signed"; };
|
||||
zone "grand.child8.druz" { type master; file "grand.child8.druz.signed"; };
|
||||
zone "grand.child9.druz" { type master; file "grand.child9.druz.signed"; };
|
||||
zone "grand.child10.druz" { type master; file "grand.child10.druz.signed"; };
|
||||
|
||||
@@ -14,11 +14,13 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: sign.sh,v 1.3 2010/05/27 23:51:08 tbox Exp $
|
||||
# $Id: sign.sh,v 1.4 2011/05/26 04:35:02 marka Exp $
|
||||
|
||||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
echo "I:dlv/ns6/sign.sh"
|
||||
|
||||
RANDFILE=../random.data
|
||||
|
||||
zone=grand.child1.utld.
|
||||
@@ -137,3 +139,120 @@ cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
zone=grand.child1.druz.
|
||||
infile=child.db.in
|
||||
zonefile=grand.child1.druz.db
|
||||
outfile=grand.child1.druz.signed
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=grand.child3.druz.
|
||||
infile=child.db.in
|
||||
zonefile=grand.child3.druz.db
|
||||
outfile=grand.child3.druz.signed
|
||||
dlvzone=dlv.druz.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=grand.child4.druz.
|
||||
infile=child.db.in
|
||||
zonefile=grand.child4.druz.db
|
||||
outfile=grand.child4.druz.signed
|
||||
dlvzone=dlv.druz.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=grand.child5.druz.
|
||||
infile=child.db.in
|
||||
zonefile=grand.child5.druz.db
|
||||
outfile=grand.child5.druz.signed
|
||||
dlvzone=dlv.druz.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=grand.child7.druz.
|
||||
infile=child.db.in
|
||||
zonefile=grand.child7.druz.db
|
||||
outfile=grand.child7.druz.signed
|
||||
dlvzone=dlv.druz.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=grand.child8.druz.
|
||||
infile=child.db.in
|
||||
zonefile=grand.child8.druz.db
|
||||
outfile=grand.child8.druz.signed
|
||||
dlvzone=dlv.druz.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
|
||||
zone=grand.child9.druz.
|
||||
infile=child.db.in
|
||||
zonefile=grand.child9.druz.db
|
||||
outfile=grand.child9.druz.signed
|
||||
dlvzone=dlv.druz.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
zone=grand.child10.druz.
|
||||
infile=child.db.in
|
||||
zonefile=grand.child10.druz.db
|
||||
outfile=grand.child10.druz.signed
|
||||
dlvzone=dlv.druz.
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo "I: signed $zone"
|
||||
|
||||
@@ -14,8 +14,8 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: setup.sh,v 1.6 2009/03/02 23:47:43 tbox Exp $
|
||||
# $Id: setup.sh,v 1.7 2011/05/26 04:35:01 marka Exp $
|
||||
|
||||
../../../tools/genrandom 400 random.data
|
||||
|
||||
(cd ns3 && sh -e sign.sh)
|
||||
(cd ns1 && sh -e sign.sh)
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
# $Id: tests.sh,v 1.6 2010/05/27 23:51:08 tbox Exp $
|
||||
# $Id: tests.sh,v 1.7 2011/05/26 04:35:01 marka Exp $
|
||||
|
||||
SYSTEMTESTTOP=..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
@@ -42,5 +42,21 @@ n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:checking that SOA reference by DLV in a DRUZ with DS validates as secure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS child1.druz soa @10.53.0.5 > dig.out.ns5.test$n || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:checking that child SOA reference by DLV in a DRUZ with DS validates as secure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS grand.child1.druz soa @10.53.0.5 > dig.out.ns5.test$n || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:exit status: $status"
|
||||
exit $status
|
||||
|
||||
Reference in New Issue
Block a user