Commit 4731ee6a authored by Mark Andrews's avatar Mark Andrews

verify that dnssec-signzone generates NSEC3 records with DNAME at the apex

(cherry picked from commit 06e218c4)
parent aa6dc21a
......@@ -11,9 +11,9 @@
rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed
rm -f */example.bk
rm -f */named.conf
rm -f */named.memstats
rm -f */named.run
rm -f */named.conf
rm -f */named.secroots
rm -f */tmp* */*.jnl */*.bk */*.jbk
rm -f */trusted.conf */managed.conf */revoked.conf
......@@ -27,6 +27,7 @@ rm -f keygen.err
rm -f named.secroots.test*
rm -f nosign.before
rm -f ns*/*.nta
rm -f ns*/managed-keys.bind* ns*/*.mkeys*
rm -f ns*/named.lock
rm -f ns1/managed.key.id
rm -f ns1/root.db ns2/example.db ns3/secure.example.db
......@@ -44,6 +45,7 @@ rm -f ns2/private.secure.example.db
rm -f ns2/single-nsec3.db
rm -f ns3/auto-nsec.example.db ns3/auto-nsec3.example.db
rm -f ns3/badds.example.db
rm -f ns3/dname-at-apex-nsec3.example.db
rm -f ns3/dnskey-nsec3-unknown.example.db
rm -f ns3/dnskey-nsec3-unknown.example.db.tmp
rm -f ns3/dnskey-unknown.example.db
......@@ -81,15 +83,16 @@ rm -f ns6/optout-tld.db
rm -f ns7/multiple.example.bk ns7/nsec3.example.bk ns7/optout.example.bk
rm -f ns7/split-rrsig.db ns7/split-rrsig.db.unsplit
rm -f nsupdate.out*
rm -f python.out.*
rm -f rndc.out.*
rm -f signer/*.db
rm -f signer/example.db.after signer/example.db.before
rm -f signer/example.db.changed
rm -f signer/nsec3param.out
rm -f signer/signer.out.*
rm -f signer/general/dsset*
rm -f signer/general/signed.zone
rm -f signer/general/signer.out.*
rm -f signer/general/dsset*
rm -f signer/nsec3param.out
rm -f signer/signer.out.*
rm -f signing.out*
rm -f signer/*.signed.pre*
rm -f signer/*.signed.post*
......@@ -158,3 +158,5 @@ ns.managed-future A 10.53.0.3
revkey NS ns.revkey
ns.revkey A 10.53.0.3
dname-at-apex-nsec3 NS ns3
......@@ -24,7 +24,8 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
nsec3-unknown optout-unknown multiple rsasha256 rsasha512 \
kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
ttlpatch split-dnssec split-smart expired expiring upper lower \
dnskey-unknown dnskey-nsec3-unknown managed-future revkey
dnskey-unknown dnskey-nsec3-unknown managed-future revkey \
dname-at-apex-nsec3
do
cp ../ns3/dsset-$subdomain.example$TP .
done
......
$TTL 600
@ SOA ns3.example. . 1 1200 1200 1814400 3600
@ NS ns3.example.
@ DNAME example.
......@@ -293,6 +293,11 @@ zone "revkey.example" {
file "revkey.example.db.signed";
};
zone "dname-at-apex-nsec3.example" {
type master;
file "dname-at-apex-nsec3.example.db.signed";
};
include "siginterval.conf";
include "trusted.conf";
......@@ -543,3 +543,14 @@ zsk1=`$KEYGEN -q -r $RANDFILE -3 $zone`
cat $infile ${ksk1}.key ${ksk2}.key ${zsk1}.key >$zonefile
$SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
#
# Check that NSEC3 are correctly signed and returned from below a DNAME
#
zone=dname-at-apex-nsec3.example
infile=dname-at-apex-nsec3.example.db.in
zonefile=dname-at-apex-nsec3.example.db
kskname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -3fk $zone`
zskname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -3 $zone`
cat $infile $kskname.key $zskname.key >$zonefile
$SIGNER -P -r $RANDFILE -3 - -o $zone $zonefile > /dev/null 2>&1
......@@ -3513,5 +3513,13 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
echo_i "check that DNAME at apex with NSEC3 is correctly signed (dnssec-signzone) ($n)"
ret=0
$DIG $DIGOPTS txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
grep "RRSIG.NSEC3 8 3 3600" dig.out.ns3.test$n > /dev/null || ret=1
n=`expr $n + 1`
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1
......@@ -1090,6 +1090,7 @@
./bin/tests/system/dnssec/ns3/auto-nsec.example.db.in ZONE 2011,2016,2018
./bin/tests/system/dnssec/ns3/auto-nsec3.example.db.in ZONE 2011,2016,2018
./bin/tests/system/dnssec/ns3/bogus.example.db.in ZONE 2000,2001,2004,2007,2014,2016,2018
./bin/tests/system/dnssec/ns3/dname-at-apex-nsec3.example.db.in ZONE 2018
./bin/tests/system/dnssec/ns3/dnskey-nsec3-unknown.example.db.in ZONE 2014,2016,2018
./bin/tests/system/dnssec/ns3/dnskey-unknown.example.db.in ZONE 2014,2016,2018
./bin/tests/system/dnssec/ns3/dynamic.example.db.in ZONE 2002,2004,2007,2016,2018
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment