From c6345fffe96fb6b71eb1a736e528a811b037288d Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Thu, 25 Jun 2020 13:39:24 +0200 Subject: [PATCH] Add todo in dnssec system test for [GL #1689] Add a note why we don't have a test case for the issue. It is tricky to write a good test case for this if our tools are not allowed to create signatures for unsupported algorithms. --- bin/tests/system/dnssec/tests.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index 84e4ad627b..562be71122 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -3562,6 +3562,13 @@ n=$((n+1)) test "$ret" -eq 0 || echo_i "failed" status=$((status+ret)) +# TODO: test case for GL #1689. +# If we allow the dnssec tools to use deprecated algorithms (such as RSAMD5) +# we could write a test that signs a zone with supported and unsupported +# algorithm, apply a fixed rrset order such that the unsupported algorithm +# precedes the supported one in the DNSKEY RRset, and verify the result still +# validates succesfully. + echo_i "check that a lone non matching CDNSKEY record is rejected ($n)" ret=0 (