upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-04-27 09:06:51 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/bin/tests/system/mkeys
History
Evan Hunt 3abcd7cd8a [master] Revert "[master] tag initializing keys so they can't be used for normal validation" 
This reverts commit 560d8b833e.

This change created a potential race between key refresh queries and
root zone priming queries which could leave the root name servers in
the bad-server cache.
2017-10-12 10:53:35 -07:00
..
ns1 [master] Revert "[master] tag initializing keys so they can't be used for normal validation" 2017-10-12 10:53:35 -07:00
ns2 [master] Revert "[master] tag initializing keys so they can't be used for normal validation" 2017-10-12 10:53:35 -07:00
ns3 4477. [test] Fix mkeys test timing issues. [RT #41028] 2016-10-05 13:42:53 +02:00
clean.sh [master] Revert "[master] tag initializing keys so they can't be used for normal validation" 2017-10-12 10:53:35 -07:00
prereq.sh 4401. [misc] Change LICENSE to MPL 2.0. 2016-06-27 14:56:38 +10:00
README [master] Revert "[master] tag initializing keys so they can't be used for normal validation" 2017-10-12 10:53:35 -07:00
setup.sh [master] Revert "[master] tag initializing keys so they can't be used for normal validation" 2017-10-12 10:53:35 -07:00
tests.sh [master] Revert "[master] tag initializing keys so they can't be used for normal validation" 2017-10-12 10:53:35 -07:00

README 

Copyright (C) 2015-2017  Internet Systems Consortium, Inc. ("ISC")

This Source Code Form is subject to the terms of the Mozilla Public
License, v. 2.0. If a copy of the MPL was not distributed with this
file, You can obtain one at http://mozilla.org/MPL/2.0/.

This is for testing managed-keys, in particular with problems
with RFC 5011 Automated Updates of DNSSEC Trust Anchors.

ns1 is the root server that offers new KSKs and hosts one record for
testing. The TTL for the zone's records is 2 seconds.

ns2 is a validator that uses managed-keys.  "-T mkeytimers=2/20/40"
is used so it will attempt do automated updates frequently. "-T tat=1"
is used so it will send TAT queries once per second.

ns3 is a validator with a broken key in managed-keys.

Tests TODO:

- initial working KSK

TODO: test using delv with new trusted key too

- introduce a REVOKE bit

- later remove a signature

- corrupt a signature

TODO: also same things with dlv auto updates of trust anchor