mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-22 10:10:06 +00:00
Code Issues Releases Wiki Activity

check that DNSKEY and other occluded data are excluded from the delegating bitmap

Browse Source
This commit is contained in:
Mark Andrews 2018-12-12 12:21:50 +11:00
parent f4ceb12b69
commit 7e4b82103b
6 changed files with 56 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
bin/tests/system/dnssec/clean.sh
View File

@ -66,6 +66,7 @@ rm -f ./ns3/managed-future.example.db
rm -f ./ns3/multiple.example.db ./ns3/nsec3-unknown.example.db ./ns3/nsec3.example.db
rm -f ./ns3/nsec3.nsec3.example.db
rm -f ./ns3/nsec3.optout.example.db
rm -f ./ns3/occluded.example.db
rm -f ./ns3/optout-unknown.example.db ./ns3/optout.example.db
rm -f ./ns3/optout.nsec3.example.db
rm -f ./ns3/optout.optout.example.db

2
bin/tests/system/dnssec/ns2/sign.sh
View File

@ -27,7 +27,7 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
ttlpatch split-dnssec split-smart expired expiring upper lower \
dnskey-unknown dnskey-nsec3-unknown managed-future revkey \
dname-at-apex-nsec3
dname-at-apex-nsec3 occluded
do
cp "../ns3/dsset-$subdomain.example$TP" .
done

5
bin/tests/system/dnssec/ns3/named.conf.in
View File

@ -299,6 +299,11 @@ zone "dname-at-apex-nsec3.example" {
file "dname-at-apex-nsec3.example.db.signed";
};
zone "occluded.example" {
type master;
file "occluded.example.db.signed";
};
include "siginterval.conf";
include "trusted.conf";

24
bin/tests/system/dnssec/ns3/occluded.example.db.in Normal file
View File

@ -0,0 +1,24 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, You can obtain one at http://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
$TTL 300 ; 5 minutes
@ IN SOA mname1. . (
2000042407 ; serial
20 ; refresh (20 seconds)
20 ; retry (20 seconds)
1814400 ; expire (3 weeks)
3600 ; minimum (1 hour)
)
NS ns
ns A 10.53.0.3
a.b A 10.0.0.1
delegation NS ns
A 10.53.0.3
AAAA 2002::

15
bin/tests/system/dnssec/ns3/sign.sh
View File

@ -558,3 +558,18 @@ kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -3fk "$zone")
zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -3 "$zone")
cat "$infile" "${kskname}.key" "${zskname}.key" >"$zonefile"
"$SIGNER" -P -3 - -o "$zone" "$zonefile" > /dev/null 2>&1
#
# A NSEC zone with occuded data at the delegation
#
zone=occluded.example
infile=occluded.example.db.in
zonefile=occluded.example.db
kskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "$zone")
zskname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" "$zone")
keyname=$("$KEYGEN" -q -a RSASHA1 -n ENTITY -T KEY "delegation.$zone")
dnskeyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -fk "delegation.$zone")
$DSFROMKEY "$dnskeyname.key" > "dsset-delegation.${zone}$TP"
cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
"${dnskeyname}.key" "dsset-delegation.${zone}$TP" >"$zonefile"
"$SIGNER" -P -o "$zone" "$zonefile" > /dev/null 2>&1

10
bin/tests/system/dnssec/tests.sh
View File

@ -3595,6 +3595,16 @@ n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
echo_i "check that DNSKEY and other occluded data are excluded from the delegating bitmap ($n)"
ret=0
dig_with_opts axfr occluded.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
grep "^delegation.occluded.example..*NSEC.*NS KEY DS RRSIG NSEC$" dig.out.ns3.test$n > /dev/null || ret=1
grep "^delegation.occluded.example..*DNSKEY.*" dig.out.ns3.test$n > /dev/null || ret=1
grep "^delegation.occluded.example..*AAAA.*" dig.out.ns3.test$n > /dev/null || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
# Note: after this check, ns4 will not be validating any more; do not add any
# further validation tests employing ns4 below this check.
echo_i "check that validation defaults to off when dnssec-enable is off ($n)"