Skip to content

GitLab

Commit 91d12180 authored by Evan Hunt's avatar Evan Hunt
Browse files

Merge branch '560-dnssec-keymgr-root' into 'master' 

improve handling of trailing dots in dnssec-keymgr and dnssec-coverage

Closes #560

See merge request !1374
parents 58e4d00c 1ccf4e6c
Pipeline #9039 passed with stages
in 56 seconds
Hide whitespace changes
Inline Side-by-side
Showing with 68 additions and 44 deletions
CHANGES
View file @ 91d12180
5143. [bug] dnssec-keymgr and dnssec-coverage failed to find
key files for zone names ending in ".". [GL #560]
5142. [cleanup] Removed "configure --disable-rpz-nsip" and
"--disable-rpz-nsdname" options. "nsip-enable"
and "nsdname-enable" both now default to yes,
......
bin/python/isc/coverage.py.in
View file @ 91d12180
......@@ -188,6 +188,9 @@ def parse_args():
if args.filename and len(args.zone) > 1:
fatal("ERROR: -f can only be used with one zone.")
# strip trailing dots
args.zone = [x[:-1] for x in args.zone if len(x) > 1 and x[-1] == '.']
# convert from time arguments to seconds
try:
if args.maxttl:
......@@ -251,7 +254,7 @@ def main():
print("PHASE 1--Loading keys to check for internal timing problems")
try:
kd = keydict(path=args.path, zone=args.zone, keyttl=args.keyttl)
kd = keydict(path=args.path, zones=args.zone, keyttl=args.keyttl)
except Exception as e:
fatal('ERROR: Unable to build key dictionary: ' + str(e))
......
bin/python/isc/eventlist.py.in
View file @ 91d12180
......@@ -73,7 +73,7 @@ class eventlist:
kok = self.checkzone(z, "KSK", until, output)
if not no_zsk and z in self._Z.keys():
found = True
kok = self.checkzone(z, "ZSK", until, output)
zok = self.checkzone(z, "ZSK", until, output)
if not found:
output("ERROR: No key events found")
......
bin/python/isc/keydict.py.in
View file @ 91d12180
......@@ -49,15 +49,18 @@ class keydict:
self._keydict[key.name][key.alg][key.keyid] = key
def readone(self, path, zone):
match='K' + zone + '.+*.private'
if not zone.endswith('.'):
zone += '.'
match='K' + zone + '+*.private'
files = glob.glob(os.path.join(path, match))
found = False
for infile in files:
key = dnskey(infile, path, self._defttl)
if key.name != zone: # shouldn't ever happen
if key.fullname != zone: # shouldn't ever happen
continue
self._keydict[key.name][key.alg][key.keyid] = key
keyname=key.name if zone != '.' else '.'
self._keydict[keyname][key.alg][key.keyid] = key
found = True
return found
......
bin/tests/system/coverage/setup.sh
View file @ 91d12180
......@@ -20,115 +20,115 @@ ln -s $CHECKZONE named-compilezone
dir=01-ksk-inactive
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
ksk2=`$KEYGEN -q -K $dir -S $ksk1`
$SETTIME -K $dir -I +7mo $ksk1 > /dev/null 2>&1
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
# Test 2: ZSK goes inactive before successor is active
dir=02-zsk-inactive
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
zsk2=`$KEYGEN -q -K $dir -S $zsk1`
$SETTIME -K $dir -I +7mo $zsk1 > /dev/null 2>&1
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
# Test 3: KSK is unpublished before its successor is published
dir=03-ksk-unpublished
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
ksk2=`$KEYGEN -q -K $dir -S $ksk1`
$SETTIME -K $dir -D +6mo $ksk1 > /dev/null 2>&1
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
# Test 4: ZSK is unpublished before its successor is published
dir=04-zsk-unpublished
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
zsk2=`$KEYGEN -q -K $dir -S $zsk1`
$SETTIME -K $dir -D +6mo $zsk1 > /dev/null 2>&1
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
# Test 5: KSK deleted and successor published before KSK is deactivated
# and successor activated.
dir=05-ksk-unpub-active
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
$SETTIME -K $dir -I +9mo -D +8mo $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
ksk2=`$KEYGEN -q -K $dir -S $ksk1`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
# Test 6: ZSK deleted and successor published before ZSK is deactivated
# and successor activated.
dir=06-zsk-unpub-active
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
$SETTIME -K $dir -I +9mo -D +8mo $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
zsk2=`$KEYGEN -q -K $dir -S $zsk1`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
# Test 7: KSK rolled with insufficient delay after prepublication.
dir=07-ksk-ttl
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
ksk2=`$KEYGEN -q -K $dir -S $ksk1`
# allow only 1 day between publication and activation
$SETTIME -K $dir -P +269d $ksk2 > /dev/null 2>&1
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
# Test 8: ZSK rolled with insufficient delay after prepublication.
dir=08-zsk-ttl
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
zsk2=`$KEYGEN -q -K $dir -S $zsk1`
# allow only 1 day between publication and activation
$SETTIME -K $dir -P +269d $zsk2 > /dev/null 2>&1
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
# Test 9: KSK goes inactive before successor is active, but checking ZSKs
dir=09-check-zsk
rm -f $dir/K*.key
rm -f $dir/K*.private
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
$SETTIME -K $dir -I +9mo -D +1y $ksk1 > /dev/null 2>&1
ksk2=`$KEYGEN -K $dir -S $ksk1`
ksk2=`$KEYGEN -q -K $dir -S $ksk1`
$SETTIME -K $dir -I +7mo $ksk1 > /dev/null 2>&1
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
# Test 10: ZSK goes inactive before successor is active, but checking KSKs
dir=10-check-ksk
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
$SETTIME -K $dir -I +9mo -D +1y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
zsk2=`$KEYGEN -q -K $dir -S $zsk1`
$SETTIME -K $dir -I +7mo $zsk1 > /dev/null 2>&1
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
# Test 11: ZSK goes inactive before successor is active, but after cutoff
dir=11-cutoff
rm -f $dir/K*.key
rm -f $dir/K*.private
zsk1=`$KEYGEN -K $dir -a rsasha1 -3 example.com`
zsk1=`$KEYGEN -q -K $dir -a rsasha1 -3 example.com`
$SETTIME -K $dir -I +18mo -D +2y $zsk1 > /dev/null 2>&1
zsk2=`$KEYGEN -K $dir -S $zsk1`
zsk2=`$KEYGEN -q -K $dir -S $zsk1`
$SETTIME -K $dir -I +16mo $zsk1 > /dev/null 2>&1
ksk1=`$KEYGEN -K $dir -a rsasha1 -3fk example.com`
ksk1=`$KEYGEN -q -K $dir -a rsasha1 -3fk example.com`
# Test 12: Too early KSK deletion
dir=12-ksk-deletion
ksk1=`$KEYGEN -K $dir -f KSK -a 8 -b 2048 -I +40d -D +40d example.com`
ksk2=`$KEYGEN -K $dir -S $ksk1.key example.com`
ksk1=`$KEYGEN -q -K $dir -f KSK -a 8 -b 2048 -I +40d -D +40d example.com`
ksk2=`$KEYGEN -q -K $dir -S $ksk1.key example.com`
bin/tests/system/keymgr/clean.sh
View file @ 91d12180
......@@ -9,10 +9,8 @@
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
rm -f */K*.key
rm -f */K*.private
rm -f Kexample.com.*.key
rm -f Kexample.com.*.private
rm -f K*.key */K*.key
rm -f K*.private */K*.private
rm -f coverage.* keymgr.* settime.*
rm -f ns*/managed-keys.bind*
rm -f policy.out
bin/tests/system/keymgr/tests.sh
View file @ 91d12180
......@@ -104,6 +104,23 @@ for dir in [0-9][0-9]-*; do
status=`expr $status + $ret`
done
echo_i "checking domains ending in . ($n)"
ret=0
$KEYMGR -g $KEYGEN -s $SETTIME . > keymgr.1.$n 2>&1
nkeys=`grep dnssec-keygen keymgr.1.$n | wc -l`
[ "$nkeys" -eq 2 ] || ret=1
$KEYMGR -g $KEYGEN -s $SETTIME . > keymgr.2.$n 2>&1
nkeys=`grep dnssec-keygen keymgr.2.$n | wc -l`
[ "$nkeys" -eq 0 ] || ret=1
$KEYMGR -g $KEYGEN -s $SETTIME example.com. > keymgr.3.$n 2>&1
nkeys=`grep dnssec-keygen keymgr.3.$n | wc -l`
[ "$nkeys" -eq 2 ] || ret=1
$KEYMGR -g $KEYGEN -s $SETTIME example.com. > keymgr.4.$n 2>&1
nkeys=`grep dnssec-keygen keymgr.4.$n | wc -l`
[ "$nkeys" -eq 0 ] || ret=1
status=`expr $status + $ret`
n=`expr $n + 1`
echo_i "checking policy.conf parser ($n)"
ret=0
${PYTHON} testpolicy.py policy.sample > policy.out
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment