upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-27 12:13:20 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Check deprecated algorithms in dnssec-policy

Browse source 
(cherry picked from commit 86fb638085)
This commit is contained in:
Mark Andrews 2025-06-30 15:56:21 +10:00
parent 981d90485e
commit ef09d9230f
2 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
bin/tests/system/checkconf/kasp-deprecated.conf Normal file
View file

@ -0,0 +1,19 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
dnssec-policy deprecated {
keys {
csk lifetime unlimited algorithm rsasha1;
csk lifetime unlimited algorithm nsec3rsasha1;
};
};

9
bin/tests/system/checkconf/tests.sh
View file

@ -712,6 +712,15 @@ if [ $lines -ne 5 ]; then ret=1; fi
if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
n=$((n + 1))
echo_i "checking named-checkconf kasp deprecated algorithms ($n)"
ret=0
$CHECKCONF kasp-deprecated.conf >checkconf.out$n 2>&1 || ret=1
grep "dnssec-policy: DNSSEC algorithm rsasha1 is deprecated" checkconf.out$n >/dev/null || ret=1
grep "dnssec-policy: DNSSEC algorithm nsec3rsasha1 is deprecated" checkconf.out$n >/dev/null || ret=1
if [ $ret -ne 0 ]; then echo_i "failed"; fi
status=$((status + ret))
n=$((n + 1))
echo_i "check that a good 'kasp' configuration is accepted ($n)"
ret=0