mirror of
https://github.com/isc-projects/bind9.git
synced 2026-06-10 12:20:00 -04:00
b9c1b90b50
After SIG and NXT lost their special handling, KEY remained the only RFC 2535-era type still receiving coexistence allowances: KEY alongside CNAME at the same owner, KEY answered from the parent side of a zone cut, KEY kept across CNAME eviction in the cache. RFC 3755 retains type 25 only for SIG(0) and TKEY transaction signatures, and neither relies on those allowances in practice. The in-tree comment that flagged the RFC 3007 parent-side carve-out as "unclear" predicted this cleanup. Zones that publish CNAME and KEY at the same owner — already invalid under RFC 2181 — now fail to load. System test fixtures are updated accordingly, and a new test asserts that SIG, NXT, and KEY records pick up covering RRSIGs when their zone is signed. |
||
|---|---|---|
| .. | ||
| ans10 | ||
| ns1 | ||
| ns2 | ||
| ns3 | ||
| ns4 | ||
| ns5 | ||
| ns6 | ||
| ns9 | ||
| prereq.sh | ||
| README | ||
| setup.sh | ||
| tests_badkey.py | ||
| tests_badkey_broken.py | ||
| tests_badkey_revoked.py | ||
| tests_delv.py | ||
| tests_policy.py | ||
| tests_signing.py | ||
| tests_tat.py | ||
| tests_validation.py | ||
| tests_validation_accept_expired.py | ||
| tests_validation_managed_keys.py | ||
| tests_validation_many_anchors.py | ||
| tests_validation_multiview.py | ||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
SPDX-License-Identifier: MPL-2.0
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, you can obtain one at https://mozilla.org/MPL/2.0/.
See the COPYRIGHT file distributed with this work for additional
information regarding copyright ownership.
The test setup for the DNSSEC tests has a secure root.
ns1 is the root server.
ns2 and ns3 are authoritative servers for the various test domains.
ns4 is a caching-only server, configured with the correct trusted key
for the root.
ns5 is a caching-only server, configured with the an incorrect trusted
key for the root, or with unsupported and disabled algorithms. It is used
for testing failure cases.
ns6 is a caching and authoritative server used for testing unusual
server behaviors such as disabled DNSSEC algorithms and non-cacheable
responses. It runs with -T nonearest, -T nosoa, and -T tat=3.
ns9 is a forwarding-only server.