mirror of
https://github.com/isc-projects/bind9.git
synced 2026-06-03 13:59:27 -04:00
Merge branch '757-unsupported-algorithms-v9_11' into 'v9_11'
Resolve "Investigate and fix what happens when managed-key algorithm is not supported" See merge request isc-projects/bind9!1825
This commit is contained in:
Matthijs Mekking
commit
00e59acab4
40 changed files with 1043 additions and 238 deletions
|
|
@ -844,7 +844,7 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
|
|||
key = cfg_listelt_value(elt2);
|
||||
result = dstkey_fromconfig(vconfig, key, managed,
|
||||
&dstkey, mctx);
|
||||
if (result == DST_R_UNSUPPORTEDALG) {
|
||||
if (result == DST_R_UNSUPPORTEDALG) {
|
||||
result = ISC_R_SUCCESS;
|
||||
continue;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -27,6 +27,13 @@ ALTERNATIVE_ALGORITHM=RSASHA1
|
|||
ALTERNATIVE_ALGORITHM_NUMBER=5
|
||||
ALTERNATIVE_BITS=1280
|
||||
|
||||
# This is an algorithm that is used for tests against the
|
||||
# "disable-algorithms" configuration option. Must be different from above
|
||||
# algorithms.
|
||||
DISABLED_ALGORITHM=ECDSAP384SHA384
|
||||
DISABLED_ALGORITHM_NUMBER=14
|
||||
DISABLED_BITS=384
|
||||
|
||||
NAMED=$TOP/bin/named/named
|
||||
# We must use "named -l" instead of "lwresd" because argv[0] is lost
|
||||
# if the program is libtoolized.
|
||||
|
|
@ -353,6 +360,9 @@ copy_setports() {
|
|||
-e "s/@ALTERNATIVE_ALGORITHM@/${ALTERNATIVE_ALGORITHM}/g" \
|
||||
-e "s/@ALTERNATIVE_ALGORITHM_NUMBER@/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
|
||||
-e "s/@ALTERNATIVE_BITS@/${ALTERNATIVE_BITS}/g" \
|
||||
-e "s/@DISABLED_ALGORITHM@/${DISABLED_ALGORITHM}/g" \
|
||||
-e "s/@DISABLED_ALGORITHM_NUMBER@/${DISABLED_ALGORITHM_NUMBER}/g" \
|
||||
-e "s/@DISABLED_BITS@/${DISABLED_BITS}/g" \
|
||||
$1 > $2
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -36,6 +36,13 @@ ALTERNATIVE_ALGORITHM=RSASHA1
|
|||
ALTERNATIVE_ALGORITHM_NUMBER=5
|
||||
ALTERNATIVE_BITS=1280
|
||||
|
||||
# This is an algorithm that is used for tests against the
|
||||
# "disable-algorithms" configuration option. Must be different from above
|
||||
# algorithms.
|
||||
DISABLED_ALGORITHM=ECDSAP384SHA384
|
||||
DISABLED_ALGORITHM_NUMBER=14
|
||||
DISABLED_BITS=384
|
||||
|
||||
ARPANAME=$TOP/Build/$VSCONF/arpaname@EXEEXT@
|
||||
CHECKCONF=$TOP/Build/$VSCONF/named-checkconf@EXEEXT@
|
||||
CHECKDS="$PYTHON `cygpath -w $TOP/bin/python/dnssec-checkds.py`"
|
||||
|
|
@ -336,6 +343,9 @@ copy_setports() {
|
|||
-e "s/${atsign}ALTERNATIVE_ALGORITHM${atsign}/${ALTERNATIVE_ALGORITHM}/g" \
|
||||
-e "s/${atsign}ALTERNATIVE_ALGORITHM_NUMBER${atsign}/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
|
||||
-e "s/${atsign}ALTERNATIVE_BITS${atsign}/${ALTERNATIVE_BITS}/g" \
|
||||
-e "s/${atsign}DISABLED_ALGORITHM${atsign}/${DISABLED_ALGORITHM}/g" \
|
||||
-e "s/${atsign}DISABLED_ALGORITHM_NUMBER${atsign}/${DISABLED_ALGORITHM_NUMBER}/g" \
|
||||
-e "s/${atsign}DISABLED_BITS${atsign}/${DISABLED_BITS}/g" \
|
||||
$1 > $2
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -16,6 +16,7 @@ rm -f ns1/dsset-*
|
|||
rm -f ns1/*.signed
|
||||
rm -f ns1/signer.err
|
||||
rm -f ns1/root.db
|
||||
rm -f ns1/trusted.conf
|
||||
rm -f ns2/K*
|
||||
rm -f ns2/dlvset-*
|
||||
rm -f ns2/dsset-*
|
||||
|
|
@ -25,18 +26,19 @@ rm -f ns2/signer.err
|
|||
rm -f ns2/druz.db
|
||||
rm -f ns3/K*
|
||||
rm -f ns3/*.db
|
||||
rm -f ns3/*.signed
|
||||
rm -f ns3/*.signed ns3/*.signed.tmp
|
||||
rm -f ns3/dlvset-*
|
||||
rm -f ns3/dsset-*
|
||||
rm -f ns3/keyset-*
|
||||
rm -f ns1/trusted.conf ns5/trusted.conf
|
||||
rm -f ns3/trusted-dlv.conf ns5/trusted-dlv.conf
|
||||
rm -f ns3/trusted*.conf
|
||||
rm -f ns3/signer.err
|
||||
rm -f ns5/trusted*.conf
|
||||
rm -f ns6/K*
|
||||
rm -f ns6/*.db
|
||||
rm -f ns6/*.signed
|
||||
rm -f ns6/dsset-*
|
||||
rm -f ns6/signer.err
|
||||
rm -f ns7/trusted*.conf
|
||||
rm -f */named.memstats
|
||||
rm -f dig.out.ns*.test*
|
||||
rm -f ns*/named.lock
|
||||
|
|
|
|||
|
|
@ -13,7 +13,14 @@ $TTL 120
|
|||
@ NS ns.rootservers.utld
|
||||
ns A 10.53.0.1
|
||||
;
|
||||
; A zone that is unsigned (utld=unsigned tld) that will include a second level
|
||||
; zone that acts as a DLV.
|
||||
;
|
||||
utld NS ns.utld
|
||||
ns.utld A 10.53.0.2
|
||||
;
|
||||
; A zone that has a bad DNSKEY RRset but has good DLV records for its child
|
||||
; zones.
|
||||
;
|
||||
druz NS ns.druz
|
||||
ns.druz A 10.53.0.2
|
||||
|
|
|
|||
|
|
@ -23,7 +23,7 @@ infile=root.db.in
|
|||
zonefile=root.db
|
||||
outfile=root.signed
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
|
@ -34,3 +34,4 @@ echo_i "signed $zone"
|
|||
|
||||
keyfile_to_trusted_keys $keyname2 > trusted.conf
|
||||
cp trusted.conf ../ns5
|
||||
cp trusted.conf ../ns7
|
||||
|
|
|
|||
|
|
@ -22,6 +22,17 @@ options {
|
|||
dnssec-enable yes;
|
||||
};
|
||||
|
||||
/* Root hints. */
|
||||
zone "." { type hint; file "hints"; };
|
||||
|
||||
/*
|
||||
* A zone that is unsigned (utld=unsigned tld) that will include a second level
|
||||
* zone that acts as a DLV.
|
||||
*/
|
||||
zone "utld" { type master; file "utld.db"; };
|
||||
|
||||
/*
|
||||
* A zone that has a bad DNSKEY RRset but has good DLV records for its child
|
||||
* zones.
|
||||
*/
|
||||
zone "druz" { type master; file "druz.signed"; };
|
||||
|
|
|
|||
|
|
@ -18,6 +18,12 @@ ns.rootservers A 10.53.0.1
|
|||
dlv NS ns.dlv
|
||||
ns.dlv A 10.53.0.3
|
||||
;
|
||||
disabled-algorithm-dlv NS ns.disabled-algorithm-dlv
|
||||
ns.disabled-algorithm-dlv A 10.53.0.3
|
||||
;
|
||||
unsupported-algorithm-dlv NS ns.unsupported-algorithm-dlv
|
||||
ns.unsupported-algorithm-dlv A 10.53.0.3
|
||||
;
|
||||
child1 NS ns.child1
|
||||
ns.child1 A 10.53.0.3
|
||||
;
|
||||
|
|
@ -47,3 +53,9 @@ ns.child9 A 10.53.0.3
|
|||
;
|
||||
child10 NS ns.child10
|
||||
ns.child10 A 10.53.0.3
|
||||
;
|
||||
disabled-algorithm NS ns.disabled-algorithm
|
||||
ns.disabled-algorithm A 10.53.0.3
|
||||
;
|
||||
unsupported-algorithm NS ns.unsupported-algorithm
|
||||
ns.unsupported-algorithm A 10.53.0.3
|
||||
|
|
|
|||
|
|
@ -22,21 +22,106 @@ options {
|
|||
dnssec-enable yes;
|
||||
};
|
||||
|
||||
/* Root hints. */
|
||||
zone "." { type hint; file "hints"; };
|
||||
zone "dlv.utld" { type master; file "dlv.signed"; };
|
||||
zone "child1.utld" { type master; file "child1.signed"; }; // dlv
|
||||
zone "child3.utld" { type master; file "child3.signed"; }; // dlv
|
||||
zone "child4.utld" { type master; file "child4.signed"; }; // dlv
|
||||
zone "child5.utld" { type master; file "child5.signed"; }; // dlv
|
||||
zone "child7.utld" { type master; file "child7.signed"; }; // no dlv
|
||||
zone "child8.utld" { type master; file "child8.signed"; }; // no dlv
|
||||
zone "child9.utld" { type master; file "child9.signed"; }; // dlv
|
||||
zone "child10.utld" { type master; file "child.db.in"; }; // dlv unsigned
|
||||
zone "child1.druz" { type master; file "child1.druz.signed"; }; // dlv
|
||||
zone "child3.druz" { type master; file "child3.druz.signed"; }; // dlv
|
||||
zone "child4.druz" { type master; file "child4.druz.signed"; }; // dlv
|
||||
zone "child5.druz" { type master; file "child5.druz.signed"; }; // dlv
|
||||
zone "child7.druz" { type master; file "child7.druz.signed"; }; // no dlv
|
||||
zone "child8.druz" { type master; file "child8.druz.signed"; }; // no dlv
|
||||
zone "child9.druz" { type master; file "child9.druz.signed"; }; // dlv
|
||||
zone "child10.druz" { type master; file "child.db.in"; }; // dlv unsigned
|
||||
|
||||
/* DLV zone below unsigned TLD. */
|
||||
zone "dlv.utld" { type master; file "dlv.utld.signed"; };
|
||||
|
||||
/* DLV zone signed with an unsupported algorithm below unsigned TLD. */
|
||||
zone "unsupported-algorithm-dlv.utld." {
|
||||
type master;
|
||||
file "unsupported-algorithm-dlv.utld.signed";
|
||||
};
|
||||
|
||||
/* Signed zone below unsigned TLD with DLV entry. */
|
||||
zone "child1.utld" { type master; file "child1.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below unsigned TLD with DLV entry in DLV zone that is signed
|
||||
* with a disabled algorithm.
|
||||
*/
|
||||
zone "child3.utld" { type master; file "child3.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below unsigned TLD with DLV entry. This one is slightly
|
||||
* different because its children (the grandchildren) don't have a DS record in
|
||||
* this zone. The grandchild zones are served by ns6.
|
||||
*
|
||||
*/
|
||||
zone "child4.utld" { type master; file "child4.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below unsigned TLD with DLV entry in DLV zone that is signed
|
||||
* with an unsupported algorithm.
|
||||
*/
|
||||
zone "child5.utld" { type master; file "child5.signed"; };
|
||||
|
||||
/* Signed zone below unsigned TLD without DLV entry. */
|
||||
zone "child7.utld" { type master; file "child7.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below unsigned TLD without DLV entry and no DS records for the
|
||||
* grandchildren.
|
||||
*/
|
||||
zone "child8.utld" { type master; file "child8.signed"; };
|
||||
|
||||
/* Signed zone below unsigned TLD with DLV entry. */
|
||||
zone "child9.utld" { type master; file "child9.signed"; };
|
||||
|
||||
/* Unsigned zone below an unsigned TLD with DLV entry. */
|
||||
zone "child10.utld" { type master; file "child.db.in"; };
|
||||
|
||||
/* Zone signed with an unsupported algorithm with DLV entry. */
|
||||
zone "unsupported-algorithm.utld" {
|
||||
type master;
|
||||
file "unsupported-algorithm.utld.signed";
|
||||
};
|
||||
|
||||
/*
|
||||
* Signed zone below signed TLD with good DLV entry but no chain of
|
||||
* trust.
|
||||
*/
|
||||
zone "child1.druz" { type master; file "child1.druz.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below signed TLD with good DLV entry but no chain of
|
||||
* trust. The DLV zone is signed with a disabled algorithm.
|
||||
*/
|
||||
zone "child3.druz" { type master; file "child3.druz.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below signed TLD with good DLV entry but no chain of
|
||||
* trust. Also there are no DS records for the grandchildren.
|
||||
*/
|
||||
zone "child4.druz" { type master; file "child4.druz.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below signed TLD with good DLV entry but no chain of
|
||||
* trust. The DLV zone is signed with an unsupported algorithm.
|
||||
*/
|
||||
zone "child5.druz" { type master; file "child5.druz.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below signed TLD without DLV entry, and no chain of
|
||||
* trust.
|
||||
*/
|
||||
zone "child7.druz" { type master; file "child7.druz.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below signed TLD without DLV entry and no DS set. Also DS
|
||||
* records for the grandchildren are not included in the zone.
|
||||
*/
|
||||
zone "child8.druz" { type master; file "child8.druz.signed"; };
|
||||
|
||||
/*
|
||||
* Signed zone below signed TLD with good DLV entry but no DS set. Also DS
|
||||
* records for the grandchildren are not included in the zone.
|
||||
*/
|
||||
zone "child9.druz" { type master; file "child9.druz.signed"; };
|
||||
|
||||
/*
|
||||
* Unsigned zone below signed TLD with good DLV entry but no chain of
|
||||
* trust.
|
||||
*/
|
||||
zone "child10.druz" { type master; file "child.db.in"; };
|
||||
|
|
|
|||
|
|
@ -16,130 +16,169 @@ SYSTEMTESTTOP=../..
|
|||
|
||||
echo_i "dlv/ns3/sign.sh"
|
||||
|
||||
dlvzone=dlv.utld.
|
||||
dlvzone="dlv.utld."
|
||||
dlvsets=
|
||||
dssets=
|
||||
|
||||
unsupporteddlvzone="unsupported-algorithm-dlv.utld."
|
||||
unsupporteddlvsets=
|
||||
unsupporteddssets=
|
||||
|
||||
# Signed zone below unsigned TLD with DLV entry.
|
||||
zone=child1.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child1.utld.db
|
||||
outfile=child1.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
||||
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below unsigned TLD with DLV entry in DLV zone that is signed
|
||||
# with a disabled algorithm.
|
||||
zone=child3.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child3.utld.db
|
||||
outfile=child3.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
||||
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below unsigned TLD with DLV entry. This one is slightly
|
||||
# different because its children (the grandchildren) don't have a DS record in
|
||||
# this zone. The grandchild zones are served by ns6.
|
||||
zone=child4.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child4.utld.db
|
||||
outfile=child4.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below unsigned TLD with DLV entry in DLV zone that is signed
|
||||
# with an unsupported algorithm.
|
||||
zone=child5.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child5.utld.db
|
||||
outfile=child5.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
unsupporteddlvsets="$unsupporteddlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
||||
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below unsigned TLD without DLV entry.
|
||||
zone=child7.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child7.utld.db
|
||||
outfile=child7.signed
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
||||
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below unsigned TLD without DLV entry and no DS records for the
|
||||
# grandchildren.
|
||||
zone=child8.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child8.utld.db
|
||||
outfile=child8.signed
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below unsigned TLD with DLV entry.
|
||||
zone=child9.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child9.utld.db
|
||||
outfile=child9.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
# Unsigned zone below an unsigned TLD with DLV entry. We still need to sign
|
||||
# the zone to generate the DLV set.
|
||||
zone=child10.utld.
|
||||
infile=child.db.in
|
||||
zonefile=child10.utld.db
|
||||
outfile=child10.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Zone signed with an unsupported algorithm with DLV entry.
|
||||
zone=unsupported-algorithm.utld.
|
||||
infile=child.db.in
|
||||
zonefile=unsupported-algorithm.utld.db
|
||||
outfile=unsupported-algorithm.utld.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f ${outfile}.tmp $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${outfile}.tmp > $outfile
|
||||
|
||||
cp ${keyname2}.key ${keyname2}.tmp
|
||||
awk '$3 == "DNSKEY" { $6 = 255 } { print }' ${keyname2}.tmp > ${keyname2}.key
|
||||
cp dlvset-${zone} dlvset-${zone}tmp
|
||||
awk '$3 == "DLV" { $5 = 255 } { print }' dlvset-${zone}tmp > dlvset-${zone}
|
||||
|
||||
echo_i "signed $zone"
|
||||
|
||||
# Signed zone below signed TLD with DLV entry and DS set.
|
||||
zone=child1.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child1.druz.db
|
||||
|
|
@ -147,33 +186,35 @@ outfile=child1.druz.signed
|
|||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
||||
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below signed TLD with DLV entry and DS set. The DLV zone is
|
||||
# signed with a disabled algorithm.
|
||||
zone=child3.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child3.druz.db
|
||||
outfile=child3.druz.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
||||
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below signed TLD with DLV entry and DS set, but missing
|
||||
# DS records for the grandchildren.
|
||||
zone=child4.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child4.druz.db
|
||||
|
|
@ -181,76 +222,86 @@ outfile=child4.druz.signed
|
|||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below signed TLD with DLV entry and DS set. The DLV zone is
|
||||
# signed with an unsupported algorithm algorithm.
|
||||
zone=child5.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child5.druz.db
|
||||
outfile=child5.druz.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
unsupporteddlvsets="$unsupporteddlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
unsupporteddssets="$unsupportedssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
||||
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below signed TLD without DLV entry, but with normal DS set.
|
||||
zone=child7.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child7.druz.db
|
||||
outfile=child7.druz.signed
|
||||
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
dsfilename=../ns6/dsset-grand.`echo $zone |sed -e "s/\.$//g"`$TP
|
||||
cat $infile $keyname1.key $keyname2.key $dsfilename >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below signed TLD without DLV entry and no DS set. Also DS
|
||||
# records for the grandchildren are not included in the zone.
|
||||
zone=child8.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child8.druz.db
|
||||
outfile=child8.druz.signed
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Signed zone below signed TLD with DLV entry but no DS set. Also DS
|
||||
# records for the grandchildren are not included in the zone.
|
||||
zone=child9.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child9.druz.db
|
||||
outfile=child9.druz.signed
|
||||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
# Unsigned zone below signed TLD with DLV entry and DS set. We still need to
|
||||
# sign the zone to generate the DS sets.
|
||||
zone=child10.druz.
|
||||
infile=child.db.in
|
||||
zonefile=child10.druz.db
|
||||
|
|
@ -258,29 +309,56 @@ outfile=child10.druz.signed
|
|||
dlvsets="$dlvsets dlvset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
dssets="$dssets dsset-`echo $zone |sed -e "s/.$//g"`$TP"
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
$SIGNER -O full -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
|
||||
zone=dlv.utld.
|
||||
infile=dlv.db.in
|
||||
zonefile=dlv.utld.db
|
||||
outfile=dlv.signed
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
echo_i "signed $zone"
|
||||
|
||||
keyfile_to_trusted_keys $keyname2 > trusted-dlv.conf
|
||||
cp trusted-dlv.conf ../ns5
|
||||
|
||||
cp $dssets ../ns2
|
||||
cp $unsupporteddssets ../ns2
|
||||
|
||||
# DLV zones
|
||||
infile=dlv.db.in
|
||||
|
||||
for zone in dlv.utld. unsupported-algorithm-dlv.utld.
|
||||
do
|
||||
zonefile="${zone}db"
|
||||
outfile="${zone}signed"
|
||||
|
||||
case $zone in
|
||||
"dlv.utld.")
|
||||
algorithm=$DEFAULT_ALGORITHM
|
||||
bits=$DEFAULT_BITS
|
||||
dlvfiles=$dlvsets
|
||||
;;
|
||||
"unsupported-algorithm-dlv.utld.")
|
||||
algorithm=$DEFAULT_ALGORITHM
|
||||
bits=$DEFAULT_BITS
|
||||
dlvfiles=$unsupporteddlvsets
|
||||
;;
|
||||
esac
|
||||
|
||||
keyname1=`$KEYGEN -r $RANDFILE -a $algorithm -b $bits -n zone $zone 2> /dev/null`
|
||||
keyname2=`$KEYGEN -r $RANDFILE -f KSK -a $algorithm -b $bits -n zone $zone 2> /dev/null`
|
||||
|
||||
cat $infile $dlvfiles $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
case $zone in
|
||||
"dlv.utld.")
|
||||
$SIGNER -O full -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
keyfile_to_trusted_keys $keyname2 > ../ns5/trusted-dlv.conf
|
||||
;;
|
||||
"unsupported-algorithm-dlv.utld.")
|
||||
cp ${keyname2}.key ${keyname2}.tmp
|
||||
$SIGNER -O full -r $RANDFILE -o $zone -f ${outfile}.tmp $zonefile > /dev/null 2> signer.err || cat signer.err
|
||||
awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${outfile}.tmp > $outfile
|
||||
awk '$3 == "DNSKEY" { $6 = 255 } { print }' ${keyname2}.tmp > ${keyname2}.key
|
||||
keyfile_to_trusted_keys $keyname2 > ../ns7/trusted-dlv-unsupported.conf
|
||||
;;
|
||||
esac
|
||||
|
||||
echo_i "signed $zone"
|
||||
done
|
||||
|
|
|
|||
|
|
@ -26,6 +26,7 @@ options {
|
|||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
dnssec-lookaside "." trust-anchor "dlv.utld";
|
||||
disable-algorithms "utld." { @DISABLED_ALGORITHM@; };
|
||||
};
|
||||
|
||||
zone "." { type hint; file "hints"; };
|
||||
|
|
|
|||
12
bin/tests/system/dlv/ns7/hints
Normal file
12
bin/tests/system/dlv/ns7/hints
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; This Source Code Form is subject to the terms of the Mozilla Public
|
||||
; License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
;
|
||||
; See the COPYRIGHT file distributed with this work for additional
|
||||
; information regarding copyright ownership.
|
||||
|
||||
. 0 NS ns.rootservers.utld.
|
||||
ns.rootservers.utld. 0 A 10.53.0.1
|
||||
|
||||
31
bin/tests/system/dlv/ns7/named.conf.in
Normal file
31
bin/tests/system/dlv/ns7/named.conf.in
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
include "trusted.conf";
|
||||
include "trusted-dlv-unsupported.conf";
|
||||
|
||||
options {
|
||||
query-source address 10.53.0.7;
|
||||
notify-source 10.53.0.7;
|
||||
transfer-source 10.53.0.7;
|
||||
port @PORT@;
|
||||
pid-file "named.pid";
|
||||
listen-on { 10.53.0.7; };
|
||||
listen-on-v6 { none; };
|
||||
recursion yes;
|
||||
notify yes;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
dnssec-lookaside "." trust-anchor "unsupported-algorithm-dlv.utld";
|
||||
};
|
||||
|
||||
zone "." { type hint; file "hints"; };
|
||||
|
||||
|
|
@ -22,5 +22,6 @@ copy_setports ns3/named.conf.in ns3/named.conf
|
|||
copy_setports ns4/named.conf.in ns4/named.conf
|
||||
copy_setports ns5/named.conf.in ns5/named.conf
|
||||
copy_setports ns6/named.conf.in ns6/named.conf
|
||||
copy_setports ns7/named.conf.in ns7/named.conf
|
||||
|
||||
(cd ns1 && $SHELL -e sign.sh)
|
||||
|
|
|
|||
|
|
@ -19,37 +19,67 @@ rm -f dig.out.*
|
|||
|
||||
DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p ${PORT}"
|
||||
|
||||
echo_i "checking that DNSKEY reference by DLV validates as secure ($n)"
|
||||
echo_i "checking that unsigned TLD zone DNSKEY referenced by DLV validates as secure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS child1.utld dnskey @10.53.0.5 > dig.out.ns5.test$n || ret=1
|
||||
grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo_i "checking that child DNSKEY reference by DLV validates as secure ($n)"
|
||||
echo_i "checking that unsigned TLD child zone DNSKEY referenced by DLV validates as secure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS grand.child1.utld dnskey @10.53.0.5 > dig.out.ns5.test$n || ret=1
|
||||
grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo_i "checking that SOA reference by DLV in a DRUZ with DS validates as secure ($n)"
|
||||
echo_i "checking that no chain of trust SOA referenced by DLV validates as secure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS child1.druz soa @10.53.0.5 > dig.out.ns5.test$n || ret=1
|
||||
grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo_i "checking that child SOA reference by DLV in a DRUZ with DS validates as secure ($n)"
|
||||
echo_i "checking that no chain of trust child SOA referenced by DLV validates as secure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS grand.child1.druz soa @10.53.0.5 > dig.out.ns5.test$n || ret=1
|
||||
grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
# Test that a child zone that is signed with an unsupported algorithm,
|
||||
# referenced by a good DLV zone, yields an insecure response.
|
||||
echo_i "checking that unsupported algorithm TXT referenced by DLV validates as insecure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS foo.unsupported-algorithm.utld txt @10.53.0.3 > dig.out.ns3.test$n || ret=1
|
||||
$DIG $DIGOPTS foo.unsupported-algorithm.utld txt @10.53.0.5 > dig.out.ns5.test$n || ret=1
|
||||
grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1
|
||||
grep -q "foo\.unsupported-algorithm\.utld\..*TXT.*\"foo\"" dig.out.ns5.test$n || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
# Test that a child zone that is signed with a known algorithm, referenced by
|
||||
# a DLV zone that is signed with an unsupported algorithm, yields a bogus
|
||||
# response.
|
||||
echo_i "checking that good signed TXT referenced by unsupported algorithm DLV validates as bogus ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS foo.child5.utld txt @10.53.0.7 > dig.out.ns7.test$n || ret=1
|
||||
grep "status: SERVFAIL" dig.out.ns7.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns7.test$n > /dev/null && ret=1
|
||||
grep -q "foo\.child5\.utld\..*TXT.*\"foo\"" dig.out.ns7.test$n && ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo_i "exit status: $status"
|
||||
[ $status -eq 0 ] || exit 1
|
||||
|
|
|
|||
|
|
@ -17,3 +17,6 @@ key for the root. It is used for testing failure cases.
|
|||
ns6 is a caching-only server configured to use DLV.
|
||||
|
||||
ns7 is used for checking non-cacheable answers.
|
||||
|
||||
ns8 is a caching-only server, configured with unsupported and disabled
|
||||
algorithms. It is used for testing failure cases.
|
||||
|
|
|
|||
|
|
@ -26,13 +26,14 @@ rm -f ./delve.out*
|
|||
rm -f ./dig.out.*
|
||||
rm -f ./dsfromkey.out.*
|
||||
rm -f ./keygen.err
|
||||
rm -f ./dnssectools.out*
|
||||
rm -f ./named.secroots.test*
|
||||
rm -f ./nosign.before
|
||||
rm -f ./ns*/*.nta
|
||||
rm -f ./ns*/managed-keys.bind* ./ns*/*.mkeys*
|
||||
rm -f ./ns*/named.lock
|
||||
rm -f ./ns1/managed.key.id
|
||||
rm -f ./ns1/root.db ./ns2/example.db ./ns3/secure.example.db
|
||||
rm -f ./ns1/root.db ./ns2/example.db ./ns2/managed.db ./ns2/trusted.db
|
||||
rm -f ./ns2/algroll.db
|
||||
rm -f ./ns2/badparam.db ./ns2/badparam.db.bad
|
||||
rm -f ./ns2/cdnskey-kskonly.secure.db
|
||||
|
|
|
|||
|
|
@ -8,12 +8,12 @@
|
|||
; information regarding copyright ownership.
|
||||
|
||||
$TTL 300
|
||||
. IN SOA gson.nominum.com. a.root.servers.nil. (
|
||||
2000042100 ; serial
|
||||
600 ; refresh
|
||||
600 ; retry
|
||||
1200 ; expire
|
||||
600 ; minimum
|
||||
. IN SOA gson.nominum.com. a.root.servers.nil. (
|
||||
2000042100 ; serial
|
||||
600 ; refresh
|
||||
600 ; retry
|
||||
1200 ; expire
|
||||
600 ; minimum
|
||||
)
|
||||
. NS a.root-servers.nil.
|
||||
a.root-servers.nil. A 10.53.0.1
|
||||
|
|
@ -22,8 +22,12 @@ example. NS ns2.example.
|
|||
ns2.example. A 10.53.0.2
|
||||
dlv. NS ns2.dlv.
|
||||
ns2.dlv. A 10.53.0.2
|
||||
algroll NS ns2.algroll
|
||||
algroll. NS ns2.algroll.
|
||||
ns2.algroll. A 10.53.0.2
|
||||
managed. NS ns2.managed.
|
||||
ns2.managed. A 10.53.0.2
|
||||
trusted. NS ns2.trusted.
|
||||
ns2.trusted. A 10.53.0.2
|
||||
optout-tld NS ns6.optout-tld.
|
||||
ns6.optout-tld. A 10.53.0.6
|
||||
in-addr.arpa. NS ns2.example.
|
||||
|
|
|
|||
|
|
@ -20,14 +20,16 @@ zonefile=root.db
|
|||
(cd ../ns6 && $SHELL sign.sh )
|
||||
(cd ../ns7 && $SHELL sign.sh )
|
||||
|
||||
echo_i "ns1/sign.sh"
|
||||
|
||||
cp ../ns2/dsset-example$TP .
|
||||
cp ../ns2/dsset-dlv$TP .
|
||||
cp ../ns2/dsset-in-addr.arpa$TP .
|
||||
|
||||
grep "8 [12] " ../ns2/dsset-algroll$TP > dsset-algroll$TP
|
||||
grep "$DEFAULT_ALGORITHM_NUMBER [12] " ../ns2/dsset-algroll$TP > dsset-algroll$TP
|
||||
cp ../ns6/dsset-optout-tld$TP .
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key > $zonefile
|
||||
|
||||
|
|
@ -48,6 +50,4 @@ cp managed.conf ../ns4/managed.conf
|
|||
#
|
||||
# Save keyid for managed key id test.
|
||||
#
|
||||
keyid=`expr $keyname : 'K.+001+\(.*\)'`
|
||||
keyid=`expr $keyid + 0`
|
||||
echo "$keyid" > managed.key.id
|
||||
echo "$keyname" | sed -e 's/.*[+]//' -e 's/^0*//' > managed.key.id
|
||||
|
|
|
|||
40
bin/tests/system/dnssec/ns2/key.db.in
Normal file
40
bin/tests/system/dnssec/ns2/key.db.in
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; This Source Code Form is subject to the terms of the Mozilla Public
|
||||
; License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
;
|
||||
; See the COPYRIGHT file distributed with this work for additional
|
||||
; information regarding copyright ownership.
|
||||
|
||||
$TTL 300 ; 5 minutes
|
||||
@ IN SOA mname1. . (
|
||||
2000042407 ; serial
|
||||
20 ; refresh (20 seconds)
|
||||
20 ; retry (20 seconds)
|
||||
1814400 ; expire (3 weeks)
|
||||
3600 ; minimum (1 hour)
|
||||
)
|
||||
NS ns2
|
||||
ns2 A 10.53.0.2
|
||||
|
||||
a A 10.0.0.1
|
||||
b A 10.0.0.2
|
||||
d A 10.0.0.4
|
||||
|
||||
; A secure subdomain
|
||||
secure NS ns3.secure
|
||||
ns3.secure A 10.53.0.3
|
||||
|
||||
; A subdomain that is signed with an unsupported algorithm
|
||||
unsupported NS ns3.unsupported
|
||||
ns3.unsupported A 10.53.0.3
|
||||
|
||||
; A secure subdomain with a disabled algorithm
|
||||
disabled NS ns3.disabled
|
||||
ns3.disabled A 10.53.0.3
|
||||
|
||||
; A secure subdomain with a disabled algorithm, but not in bailiwick
|
||||
enabled NS ns3.enabled
|
||||
ns3.enabled A 10.53.0.3
|
||||
|
||||
|
|
@ -45,6 +45,16 @@ zone "dlv" {
|
|||
file "dlv.db.signed";
|
||||
};
|
||||
|
||||
zone "trusted" {
|
||||
type master;
|
||||
file "trusted.db.signed";
|
||||
};
|
||||
|
||||
zone "managed" {
|
||||
type master;
|
||||
file "managed.db.signed";
|
||||
};
|
||||
|
||||
zone "example" {
|
||||
type master;
|
||||
file "example.db.signed";
|
||||
|
|
|
|||
|
|
@ -12,26 +12,61 @@
|
|||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
# Sign child zones (served by ns3).
|
||||
( cd ../ns3 && $SHELL sign.sh )
|
||||
|
||||
echo_i "ns2/sign.sh"
|
||||
|
||||
# Get the DS records for the "trusted." and "managed." zones.
|
||||
for subdomain in secure unsupported disabled enabled
|
||||
do
|
||||
cp ../ns3/dsset-$subdomain.managed$TP .
|
||||
cp ../ns3/dsset-$subdomain.trusted$TP .
|
||||
done
|
||||
|
||||
# Sign the "trusted." and "managed." zones.
|
||||
zone=managed.
|
||||
infile=key.db.in
|
||||
zonefile=managed.db
|
||||
|
||||
keyname1=`$KEYGEN -q -r $RANDFILE -a $ALTERNATIVE_ALGORITHM -b $ALTERNATIVE_BITS -n zone -f KSK $zone`
|
||||
keyname2=`$KEYGEN -q -r $RANDFILE -a $ALTERNATIVE_ALGORITHM -b $ALTERNATIVE_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key > $zonefile
|
||||
|
||||
$SIGNER -P -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null 2>&1
|
||||
|
||||
zone=trusted.
|
||||
infile=key.db.in
|
||||
zonefile=trusted.db
|
||||
|
||||
keyname1=`$KEYGEN -q -r $RANDFILE -a $ALTERNATIVE_ALGORITHM -b $ALTERNATIVE_BITS -n zone -f KSK $zone`
|
||||
keyname2=`$KEYGEN -q -r $RANDFILE -a $ALTERNATIVE_ALGORITHM -b $ALTERNATIVE_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key > $zonefile
|
||||
|
||||
$SIGNER -P -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null 2>&1
|
||||
|
||||
# The "example." zone.
|
||||
zone=example.
|
||||
infile=example.db.in
|
||||
zonefile=example.db
|
||||
|
||||
# Have the child generate a zone key and pass it to us.
|
||||
|
||||
( cd ../ns3 && $SHELL sign.sh )
|
||||
|
||||
# Get the DS records for the "example." zone.
|
||||
for subdomain in secure badds bogus dynamic keyless nsec3 optout \
|
||||
nsec3-unknown optout-unknown multiple rsasha256 rsasha512 \
|
||||
kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
|
||||
ttlpatch split-dnssec split-smart expired expiring upper lower \
|
||||
dnskey-unknown dnskey-nsec3-unknown managed-future revkey \
|
||||
dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \
|
||||
dnskey-nsec3-unknown managed-future revkey \
|
||||
dname-at-apex-nsec3 occluded
|
||||
do
|
||||
cp ../ns3/dsset-$subdomain.example$TP .
|
||||
done
|
||||
|
||||
keyname1=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
|
||||
keyname2=`$KEYGEN -q -r $RANDFILE -a DSA -b 768 -n zone $zone`
|
||||
# Sign the "example." zone.
|
||||
keyname1=`$KEYGEN -q -r $RANDFILE -a $ALTERNATIVE_ALGORITHM -b $ALTERNATIVE_BITS -n zone -f KSK $zone`
|
||||
keyname2=`$KEYGEN -q -r $RANDFILE -a $ALTERNATIVE_ALGORITHM -b $ALTERNATIVE_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
|
|
|
|||
24
bin/tests/system/dnssec/ns3/key.db.in
Normal file
24
bin/tests/system/dnssec/ns3/key.db.in
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
;
|
||||
; This Source Code Form is subject to the terms of the Mozilla Public
|
||||
; License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
; file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
;
|
||||
; See the COPYRIGHT file distributed with this work for additional
|
||||
; information regarding copyright ownership.
|
||||
|
||||
$TTL 300 ; 5 minutes
|
||||
@ IN SOA mname1. . (
|
||||
2000042407 ; serial
|
||||
20 ; refresh (20 seconds)
|
||||
20 ; retry (20 seconds)
|
||||
1814400 ; expire (3 weeks)
|
||||
3600 ; minimum (1 hour)
|
||||
)
|
||||
NS ns3
|
||||
ns3 A 10.53.0.3
|
||||
|
||||
a A 10.0.0.1
|
||||
b A 10.0.0.2
|
||||
c A 10.0.0.3
|
||||
|
||||
|
|
@ -313,6 +313,26 @@ zone "occluded.example" {
|
|||
file "occluded.example.db.signed";
|
||||
};
|
||||
|
||||
zone "secure.managed" {
|
||||
type master;
|
||||
file "secure.managed.db.signed";
|
||||
};
|
||||
|
||||
zone "unsupported.managed" {
|
||||
type master;
|
||||
file "unsupported.managed.db.signed";
|
||||
};
|
||||
|
||||
zone "secure.trusted" {
|
||||
type master;
|
||||
file "secure.trusted.db.signed";
|
||||
};
|
||||
|
||||
zone "unsupported.trusted" {
|
||||
type master;
|
||||
file "unsupported.trusted.db.signed";
|
||||
};
|
||||
|
||||
include "siginterval.conf";
|
||||
|
||||
include "trusted.conf";
|
||||
|
|
|
|||
|
|
@ -12,13 +12,55 @@
|
|||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
echo_i "ns3/sign.sh"
|
||||
|
||||
infile=key.db.in
|
||||
for tld in managed trusted
|
||||
do
|
||||
# A secure zone to test.
|
||||
zone=secure.${tld}
|
||||
zonefile=${zone}.db
|
||||
|
||||
keyname1=`$KEYGEN -f KSK -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
cat $infile $keyname1.key > $zonefile
|
||||
$SIGNER -z -P -3 - -o $zone -r $RANDFILE -O full -f ${zonefile}.signed $zonefile > /dev/null 2>&1
|
||||
DSFILE=dsset-`echo ${zone} |sed -e "s/\.$//g"`$TP
|
||||
$DSFROMKEY -A -f ${zonefile}.signed $zone > $DSFILE
|
||||
|
||||
# Zone to test trust anchor with unsupported algorithm.
|
||||
zone=unsupported.${tld}
|
||||
zonefile=${zone}.db
|
||||
|
||||
keyname2=`$KEYGEN -f KSK -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
cat $infile $keyname2.key > $zonefile
|
||||
$SIGNER -z -P -3 - -o $zone -r $RANDFILE -O full -f ${zonefile}.tmp $zonefile > /dev/null 2>&1
|
||||
awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${zonefile}.tmp > ${zonefile}.signed
|
||||
DSFILE=dsset-`echo ${zone} |sed -e "s/\.$//g"`$TP
|
||||
$DSFROMKEY -A -f ${zonefile}.signed $zone > $DSFILE
|
||||
|
||||
# Make trusted-keys and managed keys conf sections for ns8.
|
||||
mv ${keyname2}.key ${keyname2}.tmp
|
||||
awk '$1 == "unsupported.'"${tld}"'." { $6 = 255 } { print }' ${keyname2}.tmp > ${keyname2}.key
|
||||
|
||||
case $tld in
|
||||
"managed")
|
||||
keyfile_to_managed_keys $keyname1 $keyname2 > ../ns8/managed.conf
|
||||
;;
|
||||
"trusted")
|
||||
keyfile_to_trusted_keys $keyname1 $keyname2 > ../ns8/trusted.conf
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
echo_i "ns3/sign.sh: example zones"
|
||||
|
||||
zone=secure.example.
|
||||
infile=secure.example.db.in
|
||||
zonefile=secure.example.db
|
||||
|
||||
cnameandkey=`$KEYGEN -T KEY -q -r $RANDFILE -a RSASHA1 -b 768 -n host cnameandkey.$zone`
|
||||
dnameandkey=`$KEYGEN -T KEY -q -r $RANDFILE -a RSASHA1 -b 768 -n host dnameandkey.$zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 768 -n zone $zone`
|
||||
cnameandkey=`$KEYGEN -T KEY -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n host cnameandkey.$zone`
|
||||
dnameandkey=`$KEYGEN -T KEY -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n host dnameandkey.$zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $cnameandkey.key $dnameandkey.key $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -28,7 +70,7 @@ zone=bogus.example.
|
|||
infile=bogus.example.db.in
|
||||
zonefile=bogus.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -38,8 +80,8 @@ zone=dynamic.example.
|
|||
infile=dynamic.example.db.in
|
||||
zonefile=dynamic.example.db
|
||||
|
||||
keyname1=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname2=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 1024 -n zone -f KSK $zone`
|
||||
keyname1=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
keyname2=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b 1024 -n zone -f KSK $zone`
|
||||
|
||||
cat $infile $keyname1.key $keyname2.key >$zonefile
|
||||
|
||||
|
|
@ -49,7 +91,7 @@ zone=keyless.example.
|
|||
infile=generic.example.db.in
|
||||
zonefile=keyless.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -69,7 +111,7 @@ zone=secure.nsec3.example.
|
|||
infile=secure.nsec3.example.db.in
|
||||
zonefile=secure.nsec3.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -82,7 +124,7 @@ zone=nsec3.nsec3.example.
|
|||
infile=nsec3.nsec3.example.db.in
|
||||
zonefile=nsec3.nsec3.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -95,7 +137,7 @@ zone=optout.nsec3.example.
|
|||
infile=optout.nsec3.example.db.in
|
||||
zonefile=optout.nsec3.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -108,7 +150,7 @@ zone=nsec3.example.
|
|||
infile=nsec3.example.db.in
|
||||
zonefile=nsec3.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -121,7 +163,7 @@ zone=secure.optout.example.
|
|||
infile=secure.optout.example.db.in
|
||||
zonefile=secure.optout.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -134,7 +176,7 @@ zone=nsec3.optout.example.
|
|||
infile=nsec3.optout.example.db.in
|
||||
zonefile=nsec3.optout.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -147,7 +189,7 @@ zone=optout.optout.example.
|
|||
infile=optout.optout.example.db.in
|
||||
zonefile=optout.optout.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -160,7 +202,7 @@ zone=optout.example.
|
|||
infile=optout.example.db.in
|
||||
zonefile=optout.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -173,7 +215,7 @@ zone=nsec3-unknown.example.
|
|||
infile=nsec3-unknown.example.db.in
|
||||
zonefile=nsec3-unknown.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -186,7 +228,7 @@ zone=optout-unknown.example.
|
|||
infile=optout-unknown.example.db.in
|
||||
zonefile=optout-unknown.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -200,13 +242,13 @@ zone=dnskey-unknown.example.
|
|||
infile=dnskey-unknown.example.db.in
|
||||
zonefile=dnskey-unknown.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
$SIGNER -P -3 - -r $RANDFILE -o $zone -O full -f ${zonefile}.tmp $zonefile > /dev/null 2>&1
|
||||
|
||||
awk '$4 == "DNSKEY" { $7 = 100; print } $4 == "RRSIG" { $6 = 100; print } { print }' ${zonefile}.tmp > ${zonefile}.signed
|
||||
awk '$4 == "DNSKEY" { $7 = 100 } $4 == "RRSIG" { $6 = 100 } { print }' ${zonefile}.tmp > ${zonefile}.signed
|
||||
|
||||
DSFILE=dsset-`echo ${zone} |sed -e "s/\.$//g"`$TP
|
||||
$DSFROMKEY -A -f ${zonefile}.signed $zone > $DSFILE
|
||||
|
|
@ -219,16 +261,16 @@ zone=dnskey-unsupported.example.
|
|||
infile=dnskey-unsupported.example.db.in
|
||||
zonefile=dnskey-unsupported.example.db
|
||||
|
||||
keyname=$("$KEYGEN" -q -r $RANDFILE -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat "$infile" "$keyname.key" > "$zonefile"
|
||||
cat $infile $keyname.key > $zonefile
|
||||
|
||||
"$SIGNER" -P -3 - -r $RANDFILE -o "$zone" -O full -f ${zonefile}.tmp "$zonefile" > /dev/null 2>&1
|
||||
$SIGNER -P -3 - -r $RANDFILE -o $zone -O full -f ${zonefile}.tmp $zonefile > /dev/null 2>&1
|
||||
|
||||
awk '$4 == "DNSKEY" { $7 = 255; print } $4 == "RRSIG" { $6 = 255; print } { print }' ${zonefile}.tmp > ${zonefile}.signed
|
||||
awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${zonefile}.tmp > ${zonefile}.signed
|
||||
|
||||
DSFILE="dsset-$(echo ${zone} |sed -e "s/\\.$//g")$TP"
|
||||
$DSFROMKEY -A -f ${zonefile}.signed "$zone" > "$DSFILE"
|
||||
$DSFROMKEY -A -f ${zonefile}.signed $zone > $DSFILE
|
||||
|
||||
#
|
||||
# A zone with a published unsupported DNSKEY algorithm (Reserved).
|
||||
|
|
@ -238,12 +280,12 @@ zone=dnskey-unsupported-2.example.
|
|||
infile=dnskey-unsupported-2.example.db.in
|
||||
zonefile=dnskey-unsupported-2.example.db
|
||||
|
||||
ksk=$("$KEYGEN" -f KSK -q -r $RANDFILE -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
|
||||
zsk=$("$KEYGEN" -q -r $RANDFILE -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
|
||||
ksk=`$KEYGEN -f KSK -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
zsk=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat "$infile" "$ksk.key" "$zsk.key" unsupported-algorithm.key > "$zonefile"
|
||||
cat $infile $ksk.key $zsk.key unsupported-algorithm.key > $zonefile
|
||||
|
||||
"$SIGNER" -P -3 - -r $RANDFILE -o "$zone" -f ${zonefile}.signed "$zonefile" > /dev/null 2>&1
|
||||
$SIGNER -P -3 - -r $RANDFILE -o $zone -f ${zonefile}.signed $zonefile > /dev/null 2>&1
|
||||
|
||||
#
|
||||
# A zone with a unknown DNSKEY algorithm + unknown NSEC3 hash algorithm (-U).
|
||||
|
|
@ -253,7 +295,7 @@ zone=dnskey-nsec3-unknown.example.
|
|||
infile=dnskey-nsec3-unknown.example.db.in
|
||||
zonefile=dnskey-nsec3-unknown.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -271,7 +313,7 @@ zone=multiple.example.
|
|||
infile=multiple.example.db.in
|
||||
zonefile=multiple.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -294,7 +336,7 @@ zone=rsasha256.example.
|
|||
infile=rsasha256.example.db.in
|
||||
zonefile=rsasha256.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -386,7 +428,7 @@ $SIGNER -P -3 - -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
|
|||
zone=secure.below-cname.example.
|
||||
infile=secure.below-cname.example.db.in
|
||||
zonefile=secure.below-cname.example.db
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
cat $infile $keyname.key >$zonefile
|
||||
$SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
|
||||
|
||||
|
|
@ -399,7 +441,7 @@ zonefile=ttlpatch.example.db
|
|||
signedfile=ttlpatch.example.db.signed
|
||||
patchedfile=ttlpatch.example.db.patched
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
$SIGNER -P -r $RANDFILE -f $signedfile -o $zone $zonefile > /dev/null 2>&1
|
||||
|
|
@ -414,7 +456,7 @@ infile=split-dnssec.example.db.in
|
|||
zonefile=split-dnssec.example.db
|
||||
signedfile=split-dnssec.example.db.signed
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
cat $infile $keyname.key >$zonefile
|
||||
echo '$INCLUDE "'"$signedfile"'"' >> $zonefile
|
||||
: > $signedfile
|
||||
|
|
@ -428,13 +470,13 @@ infile=split-smart.example.db.in
|
|||
zonefile=split-smart.example.db
|
||||
signedfile=split-smart.example.db.signed
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
cp $infile $zonefile
|
||||
echo '$INCLUDE "'"$signedfile"'"' >> $zonefile
|
||||
: > $signedfile
|
||||
$SIGNER -P -S -r $RANDFILE -D -o $zone $zonefile > /dev/null 2>&1
|
||||
|
||||
#
|
||||
#
|
||||
# Zone with signatures about to expire, but no private key to replace them
|
||||
#
|
||||
zone="expiring.example."
|
||||
|
|
@ -532,7 +574,7 @@ zone=badds.example.
|
|||
infile=bogus.example.db.in
|
||||
zonefile=badds.example.db
|
||||
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
|
||||
cat $infile $keyname.key >$zonefile
|
||||
|
||||
|
|
@ -584,8 +626,8 @@ $SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
|
|||
zone=dname-at-apex-nsec3.example
|
||||
infile=dname-at-apex-nsec3.example.db.in
|
||||
zonefile=dname-at-apex-nsec3.example.db
|
||||
kskname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -3fk $zone`
|
||||
zskname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -3 $zone`
|
||||
kskname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -3fk $zone`
|
||||
zskname=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -3 $zone`
|
||||
cat $infile $kskname.key $zskname.key >$zonefile
|
||||
$SIGNER -P -r $RANDFILE -3 - -o $zone $zonefile > /dev/null 2>&1
|
||||
|
||||
|
|
@ -595,10 +637,10 @@ $SIGNER -P -r $RANDFILE -3 - -o $zone $zonefile > /dev/null 2>&1
|
|||
zone=occluded.example
|
||||
infile=occluded.example.db.in
|
||||
zonefile=occluded.example.db
|
||||
kskname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA256 -b 1024 -fk "$zone"`
|
||||
zskname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA256 -b 1024 "$zone"`
|
||||
dnskeyname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA256 -b 1024 -fk "delegation.$zone"`
|
||||
keyname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA1 -b 1024 -n ENTITY -T KEY "delegation.$zone"`
|
||||
kskname=`"$KEYGEN" -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk "$zone"`
|
||||
zskname=`"$KEYGEN" -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS "$zone"`
|
||||
dnskeyname=`"$KEYGEN" -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -fk "delegation.$zone"`
|
||||
keyname=`"$KEYGEN" -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n ENTITY -T KEY "delegation.$zone"`
|
||||
$DSFROMKEY "$dnskeyname.key" > "dsset-delegation.${zone}$TP"
|
||||
cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
|
||||
"${dnskeyname}.key" "dsset-delegation.${zone}$TP" >"$zonefile"
|
||||
|
|
|
|||
|
|
@ -12,6 +12,8 @@
|
|||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
echo_i "ns5/sign.sh"
|
||||
|
||||
zone=.
|
||||
infile=../ns1/root.db.in
|
||||
zonefile=root.db.signed
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ options {
|
|||
recursion yes;
|
||||
acache-enable yes;
|
||||
notify yes;
|
||||
disable-algorithms . { DSA; };
|
||||
disable-algorithms . { @ALTERNATIVE_ALGORITHM@; };
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
dnssec-lookaside . trust-anchor dlv;
|
||||
|
|
|
|||
|
|
@ -12,6 +12,8 @@
|
|||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
echo_i "ns6/sign.sh"
|
||||
|
||||
zone=optout-tld
|
||||
infile=optout-tld.db.in
|
||||
zonefile=optout-tld.db
|
||||
|
|
|
|||
|
|
@ -12,6 +12,8 @@
|
|||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
echo_i "ns7/sign.sh"
|
||||
|
||||
zone=split-rrsig
|
||||
infile=split-rrsig.db.in
|
||||
zonefile=split-rrsig.db
|
||||
|
|
|
|||
44
bin/tests/system/dnssec/ns8/named.conf.in
Normal file
44
bin/tests/system/dnssec/ns8/named.conf.in
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
// NS8
|
||||
|
||||
options {
|
||||
query-source address 10.53.0.8;
|
||||
notify-source 10.53.0.8;
|
||||
transfer-source 10.53.0.8;
|
||||
port @PORT@;
|
||||
pid-file "named.pid";
|
||||
listen-on { 10.53.0.8; };
|
||||
listen-on-v6 { none; };
|
||||
recursion yes;
|
||||
dnssec-enable yes;
|
||||
dnssec-validation yes;
|
||||
minimal-responses no;
|
||||
};
|
||||
|
||||
key rndc_key {
|
||||
secret "1234abcd8765";
|
||||
algorithm hmac-sha256;
|
||||
};
|
||||
|
||||
controls {
|
||||
inet 10.53.0.8 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
|
||||
};
|
||||
|
||||
zone "." {
|
||||
type hint;
|
||||
file "../../common/root.hint";
|
||||
};
|
||||
|
||||
include "managed.conf";
|
||||
include "trusted.conf";
|
||||
|
||||
|
|
@ -25,6 +25,7 @@ copy_setports ns5/named1.conf.in ns5/named.conf
|
|||
|
||||
copy_setports ns6/named.conf.in ns6/named.conf
|
||||
copy_setports ns7/named.conf.in ns7/named.conf
|
||||
copy_setports ns8/named.conf.in ns8/named.conf
|
||||
|
||||
cd ns1
|
||||
$SHELL sign.sh
|
||||
|
|
|
|||
|
|
@ -168,7 +168,7 @@ if [ -x ${DELV} ] ; then
|
|||
echo_i "checking postive validation NSEC using dns_client ($n)"
|
||||
$DELV $DELVOPTS @10.53.0.4 a a.example > delv.out$n || ret=1
|
||||
grep "a.example..*10.0.0.1" delv.out$n > /dev/null || ret=1
|
||||
grep "a.example..*.RRSIG.A 3 2 300 .*" delv.out$n > /dev/null || ret=1
|
||||
grep "a.example..*.RRSIG.A [0-9][0-9]* 2 300 .*" delv.out$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
|
@ -191,7 +191,7 @@ if [ -x ${DELV} ] ; then
|
|||
echo_i "checking positive validation NSEC3 using dns_client ($n)"
|
||||
$DELV $DELVOPTS @10.53.0.4 a a.nsec3.example > delv.out$n || ret=1
|
||||
grep "a.nsec3.example..*10.0.0.1" delv.out$n > /dev/null || ret=1
|
||||
grep "a.nsec3.example..*RRSIG.A 7 3 300.*" delv.out$n > /dev/null || ret=1
|
||||
grep "a.nsec3.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
|
@ -214,7 +214,7 @@ if [ -x ${DELV} ] ; then
|
|||
echo_i "checking positive validation OPTOUT using dns_client ($n)"
|
||||
$DELV $DELVOPTS @10.53.0.4 a a.optout.example > delv.out$n || ret=1
|
||||
grep "a.optout.example..*10.0.0.1" delv.out$n > /dev/null || ret=1
|
||||
grep "a.optout.example..*RRSIG.A 7 3 300.*" delv.out$n > /dev/null || ret=1
|
||||
grep "a.optout.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
|
@ -240,7 +240,7 @@ if [ -x ${DELV} ] ; then
|
|||
echo_i "checking positive wildcard validation NSEC using dns_client ($n)"
|
||||
$DELV $DELVOPTS @10.53.0.4 a a.wild.example > delv.out$n || ret=1
|
||||
grep "a.wild.example..*10.0.0.27" delv.out$n > /dev/null || ret=1
|
||||
grep "a.wild.example..*RRSIG.A 3 2 300.*" delv.out$n > /dev/null || ret=1
|
||||
grep "a.wild.example..*RRSIG.A [0-9][0-9]* 2 300.*" delv.out$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
|
@ -282,7 +282,7 @@ if [ -x ${DELV} ] ; then
|
|||
echo_i "checking positive wildcard validation NSEC3 using dns_client ($n)"
|
||||
$DELV $DELVOPTS @10.53.0.4 a a.wild.nsec3.example > delv.out$n || ret=1
|
||||
grep "a.wild.nsec3.example..*10.0.0.6" delv.out$n > /dev/null || ret=1
|
||||
grep "a.wild.nsec3.example..*RRSIG.A 7 3 300.*" delv.out$n > /dev/null || ret=1
|
||||
grep "a.wild.nsec3.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
|
@ -308,7 +308,7 @@ if [ -x ${DELV} ] ; then
|
|||
echo_i "checking positive wildcard validation OPTOUT using dns_client ($n)"
|
||||
$DELV $DELVOPTS @10.53.0.4 a a.wild.optout.example > delv.out$n || ret=1
|
||||
grep "a.wild.optout.example..*10.0.0.6" delv.out$n > /dev/null || ret=1
|
||||
grep "a.wild.optout.example..*RRSIG.A 7 3 300.*" delv.out$n > /dev/null || ret=1
|
||||
grep "a.wild.optout.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
|
@ -1414,6 +1414,47 @@ get_rsasha1_key_ids_from_sigs() {
|
|||
' signer/example.db.signed | sort -u
|
||||
}
|
||||
|
||||
echo_i "checking that a key using an unsupported algorithm cannot be generated ($n)"
|
||||
ret=0
|
||||
zone=example
|
||||
# If dnssec-keygen fails, the test script will exit immediately. Prevent that
|
||||
# from happening, and also trigger a test failure if dnssec-keygen unexpectedly
|
||||
# succeeds, by using "&& ret=1".
|
||||
$KEYGEN -a 255 $zone > dnssectools.out.test$n 2>&1 && ret=1
|
||||
grep -q "unsupported algorithm: 255" dnssectools.out.test$n || ret=1
|
||||
n=$((n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
echo_i "checking that a DS record cannot be generated for a key using an unsupported algorithm ($n)"
|
||||
ret=0
|
||||
zone=example
|
||||
# Fake an unsupported algorithm key
|
||||
unsupportedkey=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
|
||||
awk '$3 == "DNSKEY" { $6 = 255 } { print }' ${unsupportedkey}.key > ${unsupportedkey}.tmp
|
||||
mv ${unsupportedkey}.tmp ${unsupportedkey}.key
|
||||
# If dnssec-dsfromkey fails, the test script will exit immediately. Prevent
|
||||
# that from happening, and also trigger a test failure if dnssec-dsfromkey
|
||||
# unexpectedly succeeds, by using "&& ret=1".
|
||||
$DSFROMKEY ${unsupportedkey} > dnssectools.out.test$n 2>&1 && ret=1
|
||||
grep -q "algorithm is unsupported" dnssectools.out.test$n || ret=1
|
||||
n=$((n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
echo_i "checking that a zone cannot be signed with a key using an unsupported algorithm ($n)"
|
||||
ret=0
|
||||
ret=0
|
||||
cat signer/example.db.in "${unsupportedkey}.key" > signer/example.db
|
||||
# If dnssec-signzone fails, the test script will exit immediately. Prevent that
|
||||
# from happening, and also trigger a test failure if dnssec-signzone
|
||||
# unexpectedly succeeds, by using "&& ret=1".
|
||||
$SIGNER -o example signer/example.db ${unsupportedkey} > dnssectools.out.test$n 2>&1 && ret=1
|
||||
grep -q "algorithm is unsupported" dnssectools.out.test$n || ret=1
|
||||
n=$((n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
echo_i "checking that we can sign a zone with out-of-zone records ($n)"
|
||||
ret=0
|
||||
zone=example
|
||||
|
|
@ -1721,7 +1762,7 @@ ret=0
|
|||
$RNDCCMD 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i
|
||||
keyid=`cat ns1/managed.key.id`
|
||||
cp ns4/named.secroots named.secroots.test$n
|
||||
linecount=`grep "./RSAMD5/$keyid ; trusted" named.secroots.test$n | wc -l`
|
||||
linecount=`grep "./$DEFAULT_ALGORITHM/$keyid ; trusted" named.secroots.test$n | wc -l`
|
||||
[ "$linecount" -eq 1 ] || ret=1
|
||||
linecount=`cat named.secroots.test$n | wc -l`
|
||||
[ "$linecount" -eq 10 ] || ret=1
|
||||
|
|
@ -3049,11 +3090,11 @@ echo_i "check dig's +nocrypto flag ($n)"
|
|||
ret=0
|
||||
$DIG $DIGOPTS +norec +nocrypto DNSKEY . \
|
||||
@10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1
|
||||
grep '256 3 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
|
||||
grep '256 3 [0-9][0-9]* \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
|
||||
grep 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS +norec +nocrypto DS example \
|
||||
@10.53.0.1 > dig.out.ds.ns1.test$n || ret=1
|
||||
grep 'DS.* 3 [12] \[omitted]' dig.out.ds.ns1.test$n > /dev/null || ret=1
|
||||
grep 'DS.* [0-9][0-9]* [12] \[omitted]' dig.out.ds.ns1.test$n > /dev/null || ret=1
|
||||
n=`expr $n + 1`
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
|
@ -3775,5 +3816,75 @@ n=$((n+1))
|
|||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
#
|
||||
# DNSSEC tests related to unsupported trust anchors.
|
||||
#
|
||||
|
||||
# This nameserver (ns8) is loaded with a bunch of trust anchors. Some of them
|
||||
# are good (enabled.managed, enabled.trusted, secure.managed, secure.trusted),
|
||||
# and some of them are bad (unsupported.managed, unsupported.trusted). Make
|
||||
# sure that the bad trust anchors are ignored. This is tested by looking for
|
||||
# the corresponding lines in the logfile.
|
||||
echo_i "checking that keys with unsupported algorithms are ignored ($n)"
|
||||
ret=0
|
||||
grep "skipping trusted key for 'unsupported\.trusted\.': algorithm is unsupported" ns8/named.run > /dev/null || ret=1
|
||||
grep "skipping managed key for 'unsupported\.managed\.': algorithm is unsupported" ns8/named.run > /dev/null || ret=1
|
||||
n=$((n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
# The next two tests are fairly normal DNSSEC queries to signed zones with a
|
||||
# default algorithm. First, a query is made against the server that is
|
||||
# authoritative for the given zone (ns3). Second, a query is made against a
|
||||
# resolver with trust anchors for the given zone (ns8). Both are expected to
|
||||
# return an authentic data positive response.
|
||||
echo_i "checking that a trusted key using a supported algorithm validates as secure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 a.secure.trusted A > dig.out.ns3.test$n
|
||||
$DIG $DIGOPTS @10.53.0.8 a.secure.trusted A > dig.out.ns8.test$n
|
||||
grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null || ret=1
|
||||
n=$((n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
echo_i "checking that a managed key using a supported algorithm validates as secure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 a.secure.managed A > dig.out.ns3.test$n
|
||||
$DIG $DIGOPTS @10.53.0.8 a.secure.managed A > dig.out.ns8.test$n
|
||||
grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null || ret=1
|
||||
n=$((n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
# The next two queries ensure that a zone signed with a DNSKEY with an unsupported
|
||||
# algorithm will yield insecure positive responses. These trust anchors in ns8 are
|
||||
# ignored and so this domain is treated as insecure. The AD bit should not be set
|
||||
# in the response.
|
||||
echo_i "checking that a trusted key using an unsupported algorithm validates as insecure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 a.unsupported.trusted A > dig.out.ns3.test$n
|
||||
$DIG $DIGOPTS @10.53.0.8 a.unsupported.trusted A > dig.out.ns8.test$n
|
||||
grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null && ret=1
|
||||
n=$((n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
echo_i "checking that a managed key using an unsupported algorithm validates as insecure ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 a.unsupported.managed A > dig.out.ns3.test$n
|
||||
$DIG $DIGOPTS @10.53.0.8 a.unsupported.managed A > dig.out.ns8.test$n
|
||||
grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null && ret=1
|
||||
n=$((n+1))
|
||||
test "$ret" -eq 0 || echo_i "failed"
|
||||
status=$((status+ret))
|
||||
|
||||
echo_i "exit status: $status"
|
||||
[ $status -eq 0 ] || exit 1
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ rm -f K.+*+*.key
|
|||
rm -f K.+*+*.private
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -f KSK $zone`
|
||||
$SIGNER -S -x -T 1200 -o ${zone} root.db > signer.out 2>&1
|
||||
$SIGNER -r $RANDFILE -S -x -T 1200 -o ${zone} root.db > signer.out 2>&1
|
||||
[ $? = 0 ] || cat signer.out
|
||||
|
||||
keyfile_to_trusted_keys $keyname > trusted.conf
|
||||
|
|
|
|||
|
|
@ -23,6 +23,7 @@ options {
|
|||
transfer-source 10.53.0.3;
|
||||
port @PORT@;
|
||||
pid-file "named.pid";
|
||||
session-keyfile "session.key";
|
||||
listen-on { 10.53.0.3; };
|
||||
listen-on-v6 { none; };
|
||||
recursion no;
|
||||
|
|
@ -168,3 +169,10 @@ zone "removedkeys-secondary" {
|
|||
auto-dnssec maintain;
|
||||
file "removedkeys-secondary.bk";
|
||||
};
|
||||
|
||||
zone "unsupported" {
|
||||
type master;
|
||||
file "unsupported.db";
|
||||
inline-signing yes;
|
||||
auto-dnssec maintain;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -12,6 +12,11 @@
|
|||
SYSTEMTESTTOP=../..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
# Fake an unsupported key
|
||||
unsupportedkey=`$KEYGEN -q -r $RANDFILE -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone unsupported`
|
||||
awk '$3 == "DNSKEY" { $6 = 255 } { print }' ${unsupportedkey}.key > ${unsupportedkey}.tmp
|
||||
mv ${unsupportedkey}.tmp ${unsupportedkey}.key
|
||||
|
||||
zone=bits
|
||||
rm -f K${zone}.+*+*.key
|
||||
rm -f K${zone}.+*+*.private
|
||||
|
|
@ -46,7 +51,7 @@ rm -f K${zone}.+*+*.private
|
|||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -f KSK $zone`
|
||||
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
|
||||
$SIGNER -S -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null 2>&1
|
||||
$SIGNER -r $RANDFILE -S -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null 2>&1
|
||||
cp master2.db.in updated.db
|
||||
|
||||
# signatures are expired and should be regenerated on startup
|
||||
|
|
@ -56,7 +61,7 @@ rm -f K${zone}.+*+*.private
|
|||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 768 -n zone $zone`
|
||||
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone -f KSK $zone`
|
||||
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
|
||||
$SIGNER -PS -s 20100101000000 -e 20110101000000 -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null 2>&1
|
||||
$SIGNER -r $RANDFILE -PS -s 20100101000000 -e 20110101000000 -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null 2>&1
|
||||
|
||||
zone=retransfer
|
||||
rm -f K${zone}.+*+*.key
|
||||
|
|
|
|||
|
|
@ -29,6 +29,7 @@ cp ns2/bits.db.in ns2/retransfer3.db
|
|||
cp ns3/master.db.in ns3/master.db
|
||||
cp ns3/master.db.in ns3/dynamic.db
|
||||
cp ns3/master.db.in ns3/updated.db
|
||||
cp ns3/master.db.in ns3/unsupported.db
|
||||
cp ns3/master.db.in ns3/expired.db
|
||||
cp ns3/master.db.in ns3/nsec3.db
|
||||
cp ns3/master.db.in ns3/externalkey.db
|
||||
|
|
|
|||
|
|
@ -13,6 +13,7 @@ SYSTEMTESTTOP=..
|
|||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
DIGOPTS="+tcp +dnssec -p ${PORT}"
|
||||
DIGUDPOPTS="+dnssec -p ${PORT}"
|
||||
RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
|
||||
|
||||
status=0
|
||||
|
|
@ -27,6 +28,13 @@ do
|
|||
sleep 1
|
||||
done
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo_i "checking that an unsupported algorithm is not used for signing ($n)"
|
||||
ret=0
|
||||
grep -q "algorithm is unsupported" ns3/named.run || ret=1
|
||||
if [ $ret != 0 ]; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo_i "checking that rrsigs are replaced with ksk only ($n)"
|
||||
ret=0
|
||||
|
|
@ -41,8 +49,8 @@ ret=0
|
|||
for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
|
||||
keys=`grep '^Done signing' signing.out.test$n | wc -l`
|
||||
$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n.$i 2>&1
|
||||
keys=`grep '^Done signing' signing.out.test$n.$i | wc -l`
|
||||
[ $keys = 2 ] || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
|
|
@ -72,8 +80,8 @@ done 2>&1 |sed 's/^/ns3 /' | cat_i
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ans=0
|
||||
$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
|
||||
num=`grep "Done signing with" signing.out.test$n | wc -l`
|
||||
$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n.$i 2>&1
|
||||
num=`grep "Done signing with" signing.out.test$n.$i | wc -l`
|
||||
[ $num = 1 ] && break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -100,8 +108,8 @@ $RNDCCMD 10.53.0.3 signing -clear all bits > /dev/null || ret=1
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ans=0
|
||||
$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1
|
||||
grep "No signing records found" signing.out.test$n > /dev/null || ans=1
|
||||
$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n.$i 2>&1
|
||||
grep "No signing records found" signing.out.test$n.$i > /dev/null || ans=1
|
||||
[ $ans = 1 ] || break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -144,9 +152,9 @@ ret=0
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 added.bits A > dig.out.ns3.test$n
|
||||
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS @10.53.0.3 added.bits A > dig.out.ns3.test$n.$i
|
||||
grep "status: NOERROR" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -175,10 +183,10 @@ echo_i "checking YYYYMMDDVV (2011072400) serial in signed zone ($n)"
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n
|
||||
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "2011072400" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n.$i
|
||||
grep "status: NOERROR" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "2011072400" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -191,8 +199,8 @@ ret=0
|
|||
for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$RNDCCMD 10.53.0.3 signing -list noixfr > signing.out.test$n 2>&1
|
||||
keys=`grep '^Done signing' signing.out.test$n | wc -l`
|
||||
$RNDCCMD 10.53.0.3 signing -list noixfr > signing.out.test$n.$i 2>&1
|
||||
keys=`grep '^Done signing' signing.out.test$n.$i | wc -l`
|
||||
[ $keys = 2 ] || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
|
|
@ -222,9 +230,9 @@ ret=0
|
|||
for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 added.noixfr A > dig.out.ns3.test$n
|
||||
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS @10.53.0.3 added.noixfr A > dig.out.ns3.test$n.$i
|
||||
grep "status: NOERROR" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -253,10 +261,10 @@ echo_i "checking YYYYMMDDVV (2011072400) serial in signed zone, noixfr ($n)"
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n
|
||||
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "2011072400" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n.$i
|
||||
grep "status: NOERROR" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "2011072400" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -269,8 +277,8 @@ ret=0
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1
|
||||
keys=`grep '^Done signing' signing.out.test$n | wc -l`
|
||||
$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n.$i 2>&1
|
||||
keys=`grep '^Done signing' signing.out.test$n.$i | wc -l`
|
||||
[ $keys = 2 ] || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
|
|
@ -291,8 +299,8 @@ done 2>&1 |sed 's/^/ns3 /' | cat_i
|
|||
for i in 1 2 3 4 5 6 7 8 9
|
||||
do
|
||||
ans=0
|
||||
$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1
|
||||
num=`grep "Done signing with" signing.out.test$n | wc -l`
|
||||
$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n.$i 2>&1
|
||||
num=`grep "Done signing with" signing.out.test$n.$i | wc -l`
|
||||
[ $num = 1 ] && break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -318,8 +326,8 @@ $RNDCCMD 10.53.0.3 signing -clear all master > /dev/null || ret=1
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ans=0
|
||||
$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1
|
||||
grep "No signing records found" signing.out.test$n > /dev/null || ans=1
|
||||
$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n.$i 2>&1
|
||||
grep "No signing records found" signing.out.test$n.$i > /dev/null || ans=1
|
||||
[ $ans = 1 ] || break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -336,9 +344,9 @@ $RNDCCMD 10.53.0.3 reload master 2>&1 | sed 's/^/ns3 /' | cat_i
|
|||
for i in 1 2 3 4 5 6 7 8 9
|
||||
do
|
||||
ans=0
|
||||
$DIG $DIGOPTS @10.53.0.3 e.master A > dig.out.ns3.test$n
|
||||
grep "10.0.0.5" dig.out.ns3.test$n > /dev/null || ans=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1
|
||||
$DIG $DIGOPTS @10.53.0.3 e.master A > dig.out.ns3.test$n.$i
|
||||
grep "10.0.0.5" dig.out.ns3.test$n.$i > /dev/null || ans=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ans=1
|
||||
[ $ans = 1 ] || break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -365,9 +373,9 @@ $RNDCCMD 10.53.0.3 reload master 2>&1 | sed 's/^/ns3 /' | cat_i
|
|||
for i in 1 2 3 4 5 6 7 8 9
|
||||
do
|
||||
ans=0
|
||||
$DIG $DIGOPTS @10.53.0.3 c.master A > dig.out.ns3.test$n
|
||||
grep "10.0.0.3" dig.out.ns3.test$n > /dev/null || ans=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1
|
||||
$DIG $DIGOPTS @10.53.0.3 c.master A > dig.out.ns3.test$n.$i
|
||||
grep "10.0.0.3" dig.out.ns3.test$n.$i > /dev/null || ans=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ans=1
|
||||
[ $ans = 1 ] || break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -392,8 +400,8 @@ ret=0
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$RNDCCMD 10.53.0.3 signing -list dynamic > signing.out.test$n 2>&1
|
||||
keys=`grep '^Done signing' signing.out.test$n | wc -l`
|
||||
$RNDCCMD 10.53.0.3 signing -list dynamic > signing.out.test$n.$i 2>&1
|
||||
keys=`grep '^Done signing' signing.out.test$n.$i | wc -l`
|
||||
[ $keys = 2 ] || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
|
|
@ -440,10 +448,10 @@ EOF
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ans=0
|
||||
$DIG $DIGOPTS @10.53.0.3 e.dynamic > dig.out.ns3.test$n
|
||||
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ans=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1
|
||||
grep "1.2.3.4" dig.out.ns3.test$n > /dev/null || ans=1
|
||||
$DIG $DIGOPTS @10.53.0.3 e.dynamic > dig.out.ns3.test$n.$i
|
||||
grep "status: NOERROR" dig.out.ns3.test$n.$i > /dev/null || ans=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ans=1
|
||||
grep "1.2.3.4" dig.out.ns3.test$n.$i > /dev/null || ans=1
|
||||
[ $ans = 0 ] && break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -488,10 +496,10 @@ echo_i "checking YYYYMMDDVV (2011072450) serial in signed zone ($n)"
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n
|
||||
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "2011072450" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n.$i
|
||||
grep "status: NOERROR" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "2011072450" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -520,10 +528,10 @@ echo_i "checking YYYYMMDDVV (2011072450) serial in signed zone, noixfr ($n)"
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n
|
||||
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "2011072450" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n.$i
|
||||
grep "status: NOERROR" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "2011072450" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -552,10 +560,10 @@ echo_i "checking forwarded update on signed zone ($n)"
|
|||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
ret=0
|
||||
$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n
|
||||
grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1
|
||||
grep "2011072460" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
$DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n.$i
|
||||
grep "status: NOERROR" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "ANSWER: 2," dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
grep "2011072460" dig.out.ns3.test$n.$i > /dev/null || ret=1
|
||||
if [ $ret = 0 ]; then break; fi
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -800,9 +808,9 @@ $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || r
|
|||
for i in 0 1 2 3 4 5 6 7 8 9
|
||||
do
|
||||
ans=0
|
||||
$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.pre.test$n
|
||||
grep "status: NXDOMAIN" dig.out.ns3.pre.test$n > /dev/null || ans=1
|
||||
grep "NSEC3" dig.out.ns3.pre.test$n > /dev/null || ans=1
|
||||
$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.pre.test$n.$i
|
||||
grep "status: NXDOMAIN" dig.out.ns3.pre.test$n.$i > /dev/null || ans=1
|
||||
grep "NSEC3" dig.out.ns3.pre.test$n.$i > /dev/null || ans=1
|
||||
[ $ans = 0 ] && break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -810,9 +818,9 @@ $RNDCCMD 10.53.0.3 retransfer retransfer3 2>&1 || ret=1
|
|||
for i in 0 1 2 3 4 5 6 7 8 9
|
||||
do
|
||||
ans=0
|
||||
$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n
|
||||
grep "status: NXDOMAIN" dig.out.ns3.post.test$n > /dev/null || ans=1
|
||||
grep "NSEC3" dig.out.ns3.post.test$n > /dev/null || ans=1
|
||||
$DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n.$i
|
||||
grep "status: NXDOMAIN" dig.out.ns3.post.test$n.$i > /dev/null || ans=1
|
||||
grep "NSEC3" dig.out.ns3.post.test$n.$i > /dev/null || ans=1
|
||||
[ $ans = 0 ] && break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -1087,8 +1095,8 @@ EOF
|
|||
|
||||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
$DIG $DIGOPTS @10.53.0.3 soa inactivezsk > dig.out.ns3.post.test$n || ret=1
|
||||
soa2=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
|
||||
$DIG $DIGOPTS @10.53.0.3 soa inactivezsk > dig.out.ns3.post.test$n.$i || ret=1
|
||||
soa2=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n.$i`
|
||||
test ${soa1:-0} -ne ${soa2:-0} && break
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -1317,8 +1325,8 @@ $RNDCCMD 10.53.0.3 loadkeys delayedkeys > rndc.out.ns3.pre.test$n 2>&1 || ret=1
|
|||
ans=1
|
||||
for i in 1 2 3 4 5 6 7 8 9 10
|
||||
do
|
||||
$RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1
|
||||
num=`grep "Done signing with" signing.out.test$n | wc -l`
|
||||
$RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n.$i 2>&1
|
||||
num=`grep "Done signing with" signing.out.test$n.$i | wc -l`
|
||||
if [ $num -eq 2 ]; then
|
||||
ans=0
|
||||
break
|
||||
|
|
|
|||
|
|
@ -5171,6 +5171,12 @@ options {
|
|||
by the <command>disable-algorithms</command> will be treated
|
||||
as insecure.
|
||||
</para>
|
||||
<para>
|
||||
Configured trust anchors in <command>trusted-keys</command>
|
||||
or <command>managed-keys</command> that match a disabled
|
||||
algorithm will be ignored and treated as if they were not
|
||||
configured at all.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
|
|
|
|||
139
doc/design/unsupported-algorithms-in-bind9
Normal file
139
doc/design/unsupported-algorithms-in-bind9
Normal file
|
|
@ -0,0 +1,139 @@
|
|||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
|
||||
See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
|
||||
|
||||
# Unsupported algorithms in BIND 9
|
||||
|
||||
Following RFC 6944 and jumping ahead to draft-ietf-dnsop-algorithm-update-04,
|
||||
BIND 9 takes preparations to remove support for deprecated DNSSEC algorithms.
|
||||
These include RSAMD5, DSA, and ECC-GOST.
|
||||
|
||||
How does this impact BIND 9 behavior? In order to determine this, we first
|
||||
need to establish in what contexts can DNSSEC algorithms be used. Two logical
|
||||
categories of such contexts can be identified: signing and validation.
|
||||
|
||||
## DNSSEC signing
|
||||
|
||||
### DNSSEC tools
|
||||
|
||||
BIND 9 DNSSEC tools do not allow generating new keys using unsupported
|
||||
algorithms:
|
||||
|
||||
$ dnssec-keygen -a RSAMD5 example.
|
||||
dnssec-keygen: fatal: unsupported algorithm: 1
|
||||
|
||||
The tools also refuse to work with previously generated keys using unsupported
|
||||
algorithms:
|
||||
|
||||
$ dnssec-dsfromkey Kexample.+001+53634
|
||||
dnssec-dsfromkey: fatal: can't load Kexample.+001+53634.key: algorithm is unsupported
|
||||
|
||||
$ dnssec-signzone example.db Kexample.+001+53634
|
||||
dnssec-signzone: fatal: cannot load dnskey Kexample.+001+53634: algorithm is unsupported
|
||||
|
||||
A DNSKEY RR with an unsupported algorithm may be *included* in a zone, as long
|
||||
as it is not used for *signing* that zone.
|
||||
|
||||
BIND 9 also does not allow unsupported algorithms to be used with `auto-dnssec`:
|
||||
|
||||
zone "example" IN {
|
||||
type master;
|
||||
file "db/example.db";
|
||||
key-directory "keys/example";
|
||||
inline-signing yes;
|
||||
auto-dnssec maintain;
|
||||
}
|
||||
...
|
||||
dns_dnssec_findmatchingkeys: error reading key file Kexample.+001+53634.private: algorithm is unsupported
|
||||
|
||||
(DISCUSS: We might want to fail hard for such configurations.)
|
||||
|
||||
## DNSSEC validation
|
||||
|
||||
A validator has more possible interactions with unsupported algorithms:
|
||||
|
||||
* a key using one of these algorithms may be configured as a trust anchor,
|
||||
* a DLV record for such a key may be placed in a DLV zone.
|
||||
* upstream answers may contain signatures using such algorithms,
|
||||
|
||||
### Disabled algorithms
|
||||
|
||||
The `disable-algorithms` clause in `named.conf` can be used to prevent the
|
||||
specified algorithms from being used when validating responses at and below a
|
||||
certain name. For example, the following configuration:
|
||||
|
||||
disable-algorithms "example." { RSASHA512; };
|
||||
|
||||
will mark RSASHA512 as disabled at and below `example.`. This effectively
|
||||
means that for this domain and all domains below it, the RSASHA512 algorithm is
|
||||
treated as unsupported.
|
||||
|
||||
### Trust anchors
|
||||
|
||||
In BIND 9, trust anchors can be configured using two clauses:
|
||||
|
||||
* `trusted-keys`, which contains hardcoded (static) trust anchors,
|
||||
* `managed-keys`, which will be kept up to date automatically, following the
|
||||
zone's key rollovers (according to the algorithm specified in RFC 5011).
|
||||
|
||||
When put into the above clauses, keys using unsupported algorithms will be
|
||||
ignored:
|
||||
|
||||
trusted.conf:3: skipping trusted key for 't.example.': algorithm is unsupported
|
||||
managed.conf:3: skipping managed key for 'm.example.': algorithm is unsupported
|
||||
|
||||
BIND 9 also ignores any configured trust anchor whose owner name and algorithm
|
||||
match any `disable-algorithms` clause present in `named.conf`.
|
||||
|
||||
If a given trust point is left with no trust anchors using supported
|
||||
algorithms, BIND 9 will act as if the trust point was not configured at all and
|
||||
if there are no trust points configured higher up the tree, names at the trust
|
||||
point and below it will be treated as insecure.
|
||||
|
||||
Note that prior to BIND 9.13.6, configured trust anchors that matched disabled
|
||||
algorithms were not ignored and that lead to SERVFAILs for associated domains.
|
||||
This behavior has changed to be more consistent with unsupported algorithms:
|
||||
BIND 9 will ignore such trust anchors, and responses for those domains will
|
||||
now be treated as insecure.
|
||||
|
||||
### DLV
|
||||
|
||||
If a DLV record in a DLV zone points to a DNSKEY using an unsupported algorithm
|
||||
or an algorithm which has been disabled for the relevant part of the tree using
|
||||
a `disable-algorithms` clause in `named.conf`, the corresponding zone will be
|
||||
treated as insecure.
|
||||
|
||||
However, if the trust anchor specified for the DLV zone itself uses an
|
||||
unsupported or disabled algorithm, no DLV record in that DLV zone can be
|
||||
treated as secure and thus attempts to resolve names in the domains pointed to
|
||||
by the records in that DLV zone will yield SERVFAIL responses. Consider the
|
||||
following example:
|
||||
|
||||
trusted-keys {
|
||||
"dlv.example." 257 3 1 ...;
|
||||
};
|
||||
|
||||
options {
|
||||
...
|
||||
dnssec-lookaside "foo." trust-anchor "dlv.example";
|
||||
};
|
||||
|
||||
The example above specifies a DLV trust anchor using the RSAMD5 algorithm
|
||||
(algorithm number 1), which effectively prevents resolution of data in any zone
|
||||
at and below `foo.` that is listed in `dlv.example` (and does not have a valid,
|
||||
non-DLV chain of trust established otherwise). This outcome is different than
|
||||
for a trust anchor which uses an unsupported or disabled algorithm and is not
|
||||
associated with a `dnssec-lookaside` clause; the reason for this is that in the
|
||||
case of a DLV-referenced, unusable key, the trust point is still defined, but
|
||||
has no keys associated with it, whereas non-DLV-referenced, unusable keys are
|
||||
ignored altogether and do not cause an associated trust point to be defined.
|
||||
|
||||
### Algorithm rollover
|
||||
|
||||
A zone for which BIND 9 has a trust anchor configured may decide to do an
|
||||
algorithm rollover to an unsupported algorithm. If configured with
|
||||
`managed-keys`, BIND 9 will ignore the newly introduced DNSKEY if it does
|
||||
not support the algorithm. That means that the moment the predecessor DNSKEY
|
||||
gets revoked, BIND 9 will no longer have any trust anchors for the given zone
|
||||
and it will treat the trust point as if it does not exist, meaning that
|
||||
the corresponding zone will now validate as insecure.
|
||||
|
|
@ -1020,6 +1020,8 @@
|
|||
./bin/tests/system/dlv/ns6/hints ZONE 2010,2016,2018,2019
|
||||
./bin/tests/system/dlv/ns6/named.conf.in CONF-C 2018,2019
|
||||
./bin/tests/system/dlv/ns6/sign.sh SH 2010,2011,2012,2014,2016,2018,2019
|
||||
./bin/tests/system/dlv/ns7/hints ZONE 2019
|
||||
./bin/tests/system/dlv/ns7/named.conf.in CONF-C 2019
|
||||
./bin/tests/system/dlv/prereq.sh SH 2014,2016,2018,2019
|
||||
./bin/tests/system/dlv/setup.sh SH 2004,2007,2009,2011,2012,2014,2016,2018,2019
|
||||
./bin/tests/system/dlv/tests.sh SH 2004,2007,2010,2011,2012,2016,2018,2019
|
||||
|
|
@ -1090,6 +1092,7 @@
|
|||
./bin/tests/system/dnssec/ns2/example.db.in ZONE 2000,2001,2002,2004,2007,2008,2009,2010,2011,2012,2013,2014,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns2/in-addr.arpa.db.in ZONE 2014,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns2/insecure.secure.example.db ZONE 2000,2001,2004,2007,2013,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns2/key.db.in ZONE 2019
|
||||
./bin/tests/system/dnssec/ns2/named.conf.in CONF-C 2018,2019
|
||||
./bin/tests/system/dnssec/ns2/private.secure.example.db.in ZONE 2000,2001,2004,2007,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns2/rfc2335.example.db X 2004,2018,2019
|
||||
|
|
@ -1114,6 +1117,7 @@
|
|||
./bin/tests/system/dnssec/ns3/insecure.example.db ZONE 2000,2001,2004,2007,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns3/insecure.nsec3.example.db ZONE 2008,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns3/insecure.optout.example.db ZONE 2008,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns3/key.db.in ZONE 2019
|
||||
./bin/tests/system/dnssec/ns3/kskonly.example.db.in ZONE 2010,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns3/lower.example.db.in ZONE 2012,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns3/managed-future.example.db.in ZONE 2016,2018,2019
|
||||
|
|
@ -1164,6 +1168,7 @@
|
|||
./bin/tests/system/dnssec/ns7/nosoa.secure.example.db ZONE 2010,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns7/sign.sh SH 2014,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns7/split-rrsig.db.in ZONE 2014,2016,2018,2019
|
||||
./bin/tests/system/dnssec/ns8/named.conf.in CONF-C 2019
|
||||
./bin/tests/system/dnssec/ntadiff.pl PERL 2015,2016,2018,2019
|
||||
./bin/tests/system/dnssec/prereq.sh SH 2000,2001,2002,2004,2006,2007,2009,2012,2014,2015,2016,2018,2019
|
||||
./bin/tests/system/dnssec/setup.sh SH 2000,2001,2004,2007,2009,2011,2012,2013,2014,2015,2016,2018,2019
|
||||
|
|
@ -3151,6 +3156,7 @@
|
|||
./doc/design/resolver TXT.BRIEF 1999,2000,2001,2004,2016,2018,2019
|
||||
./doc/design/search TXT.BRIEF 1999,2000,2001,2004,2016,2018,2019
|
||||
./doc/design/tasks TXT.BRIEF 1999,2000,2001,2004,2016,2018,2019
|
||||
./doc/design/unsupported-algorithms-in-bind9 TXT.BRIEF 2019
|
||||
./doc/design/verify TXT.BRIEF 2012,2016,2018,2019
|
||||
./doc/design/windows-nt TXT.BRIEF 1999,2000,2001,2004,2016,2018,2019
|
||||
./doc/design/zone TXT.BRIEF 1999,2000,2001,2004,2016,2018,2019
|
||||
|
|
|
|||
Loading…
Reference in a new issue