From d159fdf25d61b69a8ea17517ca6931604d0e17ae Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Wed, 29 Jan 2020 19:42:21 +1100 Subject: [PATCH] add more CDS / CDNSKEY deletion record tests --- bin/tests/system/dnssec/tests.sh | 42 ++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index b43abb55b3..56ece2f883 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -3317,6 +3317,24 @@ n=$((n+1)) test "$ret" -eq 0 || echo_i "failed" status=$((status+ret)) +echo_i "check that a CDS deletion record is accepted ($n)" +ret=0 +( +echo zone cds-update.secure +echo server 10.53.0.2 "$PORT" +echo update delete cds-update.secure CDS +echo update add cds-update.secure 0 CDS 0 0 0 00 +echo send +) | $NSUPDATE > nsupdate.out.test$n 2>&1 +dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n +lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) +test "${lines:-10}" -eq 1 || ret=1 +lines=$(awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' dig.out.test$n | wc -l) +test "$lines" -eq 1 || ret=1 +n=$((n+1)) +test "$ret" -eq 0 || echo_i "failed" +status=$((status+ret)) + echo_i "check that CDS records are signed using KSK when added by nsupdate ($n)" ret=0 ( @@ -3595,6 +3613,30 @@ n=$((n+1)) test "$ret" -eq 0 || echo_i "failed" status=$((status+ret)) +echo_i "check that CDNSKEY deletion records are signed only using KSK when added by" +echo_i " nsupdate when dnssec-dnskey-kskonly is yes ($n)" +ret=0 +keyid=$(cat ns2/cdnskey-kskonly.secure.id) +( +echo zone cdnskey-kskonly.secure +echo server 10.53.0.2 "$PORT" +echo update delete cdnskey-kskonly.secure CDNSKEY +echo update add cdnskey-kskonly.secure 0 CDNSKEY 0 3 0 AA== +echo send +) | $NSUPDATE +dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n +lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) +test "$lines" -eq 1 || ret=1 +lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {print}' dig.out.test$n | wc -l) +test "$lines" -eq 1 || ret=1 +lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) +test "$lines" -eq 1 || ret=1 +lines=$(awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' dig.out.test$n | wc -l) +test "${lines:-10}" -eq 1 || ret=1 +n=$((n+1)) +test "$ret" -eq 0 || echo_i "failed" +status=$((status+ret)) + echo_i "checking initialization with a revoked managed key ($n)" ret=0 copy_setports ns5/named2.conf.in ns5/named.conf