mirror of
https://github.com/isc-projects/bind9.git
synced 2026-05-23 10:37:43 -04:00
e856afa3b5
The authoritative server on "missing-dnskey." zone is ns2, the zone is initially signed normally, but then the DNSKEY are pulled out from the signed generated zone file. As a consequence, a quering the resolver ns4 returns a SERVFAIL with EDE9 as the chain of trust is broken: the DS is prsent in the parent zone (the root zone in ns1), but the DNSKEY is missing from the zone. A similar is "wrong-dnskey.", but here the zone is signed correctly, but the DS points to a different DNSKEY. Hence no supported matching DNSKEY record could be found for the child. |
||
|---|---|---|
| .. | ||
| ans10 | ||
| ns1 | ||
| ns2 | ||
| ns3 | ||
| ns4 | ||
| ns5 | ||
| ns6 | ||
| ns9 | ||
| prereq.sh | ||
| README | ||
| setup.sh | ||
| tests_badkey.py | ||
| tests_badkey_broken.py | ||
| tests_badkey_revoked.py | ||
| tests_delv.py | ||
| tests_policy.py | ||
| tests_signing.py | ||
| tests_tat.py | ||
| tests_validation.py | ||
| tests_validation_accept_expired.py | ||
| tests_validation_managed_keys.py | ||
| tests_validation_many_anchors.py | ||
| tests_validation_multiview.py | ||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
SPDX-License-Identifier: MPL-2.0
This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, you can obtain one at https://mozilla.org/MPL/2.0/.
See the COPYRIGHT file distributed with this work for additional
information regarding copyright ownership.
The test setup for the DNSSEC tests has a secure root.
ns1 is the root server.
ns2 and ns3 are authoritative servers for the various test domains.
ns4 is a caching-only server, configured with the correct trusted key
for the root.
ns5 is a caching-only server, configured with the an incorrect trusted
key for the root, or with unsupported and disabled algorithms. It is used
for testing failure cases.
ns6 is a caching and authoritative server used for testing unusual
server behaviors such as disabled DNSSEC algorithms and non-cacheable
responses. It runs with -T nonearest, -T nosoa, and -T tat=3.
ns9 is a forwarding-only server.