From 38da4bdf5ee7a0b878aae2f33c59bc6873c4cbdf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= Date: Mon, 11 Mar 2019 12:04:42 +0100 Subject: [PATCH] Fix NTA-related races Changes introduced by commit 6b8e4d6e695fc13b2d2a93437418a047b5adce81 were incomplete as not all time-sensitive checks were updated to match revised "nta-lifetime" and "nta-recheck" values. Prevent rare false positives by updating all NTA-related checks so that they work reliably with "nta-lifetime 12s;" and "nta-recheck 9s;". Update comments as well to prevent confusion. (cherry picked from commit 9a36a1bba34d178ee65d24d1dd71c7ae7953abf6) --- bin/tests/system/dnssec/tests.sh | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index 646434f9bb..d760c32256 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -1845,8 +1845,8 @@ echo_i "waiting for NTA rechecks/expirations" # # secure.example and badds.example used default nta-duration -# (configured as 10s in ns4/named1.conf), but nta recheck interval -# is configured to 7s, so at t=8 the NTAs for secure.example and +# (configured as 12s in ns4/named1.conf), but nta recheck interval +# is configured to 9s, so at t=10 the NTAs for secure.example and # fakenode.secure.example should both be lifted, but badds.example # should still be going. # @@ -1866,9 +1866,9 @@ status=`expr $status + $ret` ret=0 # -# bogus.example was set to expire in 20s, so at t=11 +# bogus.example was set to expire in 20s, so at t=13 # it should still be NTA'd, but badds.example used the default -# lifetime of 10s, so it should revert to SERVFAIL now. +# lifetime of 12s, so it should revert to SERVFAIL now. # $PERL -e 'my $delay = '$start' + 13 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' # check nta table @@ -2067,10 +2067,10 @@ else exit 1 fi -# nta-recheck is configured as 7s, so at t=10 the NTAs for +# nta-recheck is configured as 9s, so at t=12 the NTAs for # secure.example. should be lifted as it is not a forced NTA. -echo_i "waiting till 10s have passed after ns4 was restarted" -$PERL -e 'my $delay = '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' +echo_i "waiting till 12s have passed after ns4 was restarted" +$PERL -e 'my $delay = '$start' + 12 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' # secure.example. should now return an AD=1 answer (still validates) as # the NTA has been lifted. @@ -2124,10 +2124,10 @@ else exit 1 fi -# nta-recheck is configured as 7s, but even at t=10 the NTAs for +# nta-recheck is configured as 9s, but even at t=12 the NTAs for # secure.example. should not be lifted as it is a forced NTA. -echo_i "waiting till 10s have passed after ns4 was restarted" -$PERL -e 'my $delay = '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' +echo_i "waiting till 12s have passed after ns4 was restarted" +$PERL -e 'my $delay = '$start' + 12 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' # secure.example. should now return an AD=0 answer (non-authenticated) # as the NTA is still there.