mirror of
https://github.com/isc-projects/bind9.git
synced 2026-03-12 05:32:42 -04:00
aebb2aaa0f
There is a failure mode which gets triggered on heavily loaded systems. A key change is scheduled in 5 seconds to make ZSK2 inactive and ZSK3 active, but `named` takes more than 5 seconds to progress from `rndc loadkeys` to the query check. At this time the SOA RRset is already signed by the new ZSK which is not expected to be active at that point yet. Split up the checks to test the case where RRsets are signed correctly with the offline KSK (maintained the signature) and the active ZSK. First run, RRsets should be signed with the still active ZSK2, second run RRsets should be signed with the new active ZSK3. |
||
|---|---|---|
| .. | ||
| ns1 | ||
| ns2 | ||
| ns3 | ||
| ns4 | ||
| ns5 | ||
| ns6 | ||
| ns7 | ||
| ns8 | ||
| ns9 | ||
| signer | ||
| clean.sh | ||
| dnssec_update_test.pl | ||
| ntadiff.pl | ||
| prereq.sh | ||
| README | ||
| setup.sh | ||
| tests.sh | ||
Copyright (C) Internet Systems Consortium, Inc. ("ISC")
See COPYRIGHT in the source root or http://isc.org/copyright.html for terms.
The test setup for the DNSSEC tests has a secure root.
ns1 is the root server.
ns2 and ns3 are authoritative servers for the various test domains.
ns4 is a caching-only server, configured with the correct trusted key
for the root.
ns5 is a caching-only server, configured with the an incorrect trusted
key for the root. It is used for testing failure cases.
ns6 is an caching and authoritative server used for testing unusual
server behaviors such as disabled DNSSEC algorithms.
ns7 is used for checking non-cacheable answers.
ns8 is a caching-only server, configured with unsupported and disabled
algorithms. It is used for testing failure cases.
ns9 is a forwarding-only server.