mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 06:25:31 +00:00
Code Issues Releases Wiki Activity

Convert keystore and rumoured kasp test cases

Browse Source 
For 'keystore.kasp', a setting 'key-directories' is used. If set, this
will expect a list of two directories, the first one is where the KSKs
will be stored, the second in the list is the ZSK key directory. This
may be expanded in the future to test more complex key storage cases.

The 'rumoured.kasp' zone is weird, the key timings can never match
those key states. But it is a regression test for an early day bug,
so we convert it, but skip the expected key times check.
This commit is contained in:
Matthijs Mekking
2025-03-17 15:32:43 +01:00
parent 5f23f750c2
commit ee7120eb34
2 changed files with 42 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
bin/tests/system/kasp/tests_kasp.py
View File

@@ -310,11 +310,18 @@ def test_kasp_cases(servers):
ttl=ttl, keys=test["key-properties"]
)
# Key files.
keys = isctest.kasp.keydir_to_keylist(
zone, test["config"]["key-directory"], in_use=pregenerated
)
ksks = [k for k in keys if k.is_ksk()]
zsks = [k for k in keys if not k.is_ksk()]
if "key-directories" in test:
kdir = test["key-directories"][0]
ksks = isctest.kasp.keydir_to_keylist(zone, kdir, in_use=pregenerated)
kdir = test["key-directories"][1]
zsks = isctest.kasp.keydir_to_keylist(zone, kdir, in_use=pregenerated)
keys = ksks + zsks
else:
keys = isctest.kasp.keydir_to_keylist(
zone, test["config"]["key-directory"], in_use=pregenerated
)
ksks = [k for k in keys if k.is_ksk()]
zsks = [k for k in keys if not k.is_ksk()]
isctest.kasp.check_zone_is_signed(server, zone)
isctest.kasp.check_keys(zone, keys, expected)
@@ -326,7 +333,8 @@ def test_kasp_cases(servers):
test["config"], offset=offset, pregenerated=pregenerated
)
isctest.kasp.check_keytimes(keys, expected)
if "rumoured" not in test:
isctest.kasp.check_keytimes(keys, expected)
check_all(server, zone, policy, ksks, zsks, zsk_missing=zsk_missing)
@@ -458,6 +466,27 @@ def test_kasp_cases(servers):
"config": kasp_config,
"key-properties": fips_properties(8),
},
{
"zone": "keystore.kasp",
"policy": "keystore",
"config": {
"dnskey-ttl": timedelta(seconds=303),
"ds-ttl": timedelta(days=1),
"key-directory": keydir,
"max-zone-ttl": timedelta(days=1),
"parent-propagation-delay": timedelta(hours=1),
"publish-safety": timedelta(hours=1),
"retire-safety": timedelta(hours=1),
"signatures-refresh": timedelta(days=5),
"signatures-validity": timedelta(days=14),
"zone-propagation-delay": timedelta(minutes=5),
},
"key-directories": [f"{keydir}/ksk", f"{keydir}/zsk"],
"key-properties": [
f"ksk unlimited {alg} {size} goal:omnipresent dnskey:rumoured krrsig:rumoured ds:hidden",
f"zsk unlimited {alg} {size} goal:omnipresent dnskey:rumoured zrrsig:rumoured",
],
},
{
"zone": "legacy-keys.kasp",
"policy": "migrate-to-dnssec-policy",
@@ -493,6 +522,13 @@ def test_kasp_cases(servers):
"config": kasp_config,
"key-properties": fips_properties(10),
},
{
"zone": "rumoured.kasp",
"policy": "rsasha256",
"config": kasp_config,
"rumoured": True,
"key-properties": fips_properties(8),
},
{
"zone": "secondary.kasp",
"policy": "rsasha256",