From e7a3ada1d2fe787e55f8eddf4674c2ef6b01a0ab Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Wed, 17 Nov 2021 13:06:44 +1100 Subject: [PATCH] Check dnssec-dsfromkey with revoked DNSKEY Checks that there is a revoked key in the DNSKEY RRset then checks that only the correct number of DS records are produced. --- bin/tests/system/dnssec/tests.sh | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index edb6bf7bb9..fecf504855 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -2898,6 +2898,18 @@ n=$((n+1)) test "$ret" -eq 0 || echo_i "failed" status=$((status+ret)) +echo_i "check dnssec-dsfromkey with revoked key ($n)" +ret=0 +dig_with_opts revkey.example dnskey @10.53.0.4 > dig.out.ns4.test$n || ret=1 +grep "DNSKEY.256 3 13" dig.out.ns4.test$n > /dev/null || ret=1 # ZSK +grep "DNSKEY.385 3 13" dig.out.ns4.test$n > /dev/null || ret=1 # revoked KSK +grep "DNSKEY.257 3 13" dig.out.ns4.test$n > /dev/null || ret=1 # KSK +test $(awk '$4 == "DNSKEY" { print }' dig.out.ns4.test$n | wc -l) -eq 3 || ret=1 +$DSFROMKEY -f dig.out.ns4.test$n revkey.example. > dsfromkey.out.test$n || ret=1 +test $(wc -l < dsfromkey.out.test$n) -eq 1 || ret=1 +n=$((n+1)) +test "$ret" -eq 0 || echo_i "failed" + echo_i "testing soon-to-expire RRSIGs without a replacement private key ($n)" ret=0 dig_with_answeropts +nottlid expiring.example ns @10.53.0.3 | grep RRSIG > dig.out.ns3.test$n 2>&1