upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-03-14 14:42:22 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/bin/tests/system/inline/setup.sh

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

67 lines
1.7 KiB
Bash
Raw Normal View History

Add shell interpreter line where missing The checkbashisms script reports errors like this one: script util/check-line-length.sh does not appear to have a #! interpreter line; you may get strange results
2022-08-02 09:01:01 -04:00
#!/bin/sh
final cleanup - add CHANGES note - update copyrights and license headers - add -j to the make commands in .gitlab-ci.yml to take advantage of parallelization in the gitlab CI process
2018-02-22 18:10:37 -05:00
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
reverse bad copyright update
2012-06-28 21:39:47 -04:00
#
update copyright notice
2011-08-30 19:46:53 -04:00
# SPDX-License-Identifier: MPL-2.0
Update the copyright information in all files in the repository This commit converts the license handling to adhere to the REUSE specification. It specifically: 1. Adds used licnses to LICENSES/ directory 2. Add "isc" template for adding the copyright boilerplate 3. Changes all source files to include copyright and SPDX license header, this includes all the C sources, documentation, zone files, configuration files. There are notes in the doc/dev/copyrights file on how to add correct headers to the new files. 4. Handle the rest that can't be modified via .reuse/dep5 file. The binary (or otherwise unmodifiable) files could have license places next to them in <foo>.license file, but this would lead to cluttered repository and most of the files handled in the .reuse/dep5 file are system test files.
2021-06-03 02:37:05 -04:00
#
update copyright notice
2011-08-30 19:46:53 -04:00
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
Update license headers to not include years in copyright in all applicable files
2018-02-23 03:53:12 -05:00
#
update copyright notice
2011-08-30 19:46:53 -04:00
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
Drop $SYSTEMTESTTOP from bin/tests/system/ The $SYSTEMTESTTOP shell variable if often set to .. in various shell scripts inside bin/tests/system/, but most of the time it is only used one line later, while sourcing conf.sh. This hardly improves code readability. $SYSTEMTESTTOP is also used for the purpose of referencing scripts/files living in bin/tests/system/, but given that the variable is always set to a short, relative path, we can drop it and replace all of its occurrences with the relative path without adversely affecting code readability.
2020-07-21 06:12:59 -04:00
. ../conf.sh
[master] testcrypto.sh in system tests 3714. [test] System tests that need to test for cryptography support before running can now use a common "testcrypto.sh" script to do so. [RT #35213]
2014-01-20 19:08:09 -05:00
3177. [func] 'rndc keydone', remove the indicator record that named has finished signing the zone with the corresponding key. [RT #26206]
2011-10-24 21:54:22 -04:00
cp ns1/root.db.in ns1/root.db
3147. [func] Initial inline signing support. [RT #23657]
2011-08-30 01:16:15 -04:00
touch ns2/trusted.conf
Simplify the inline clean script
2019-02-05 16:23:11 -05:00
cp ns2/nsec3-loop.db.in ns2/nsec3-loop.db
3147. [func] Initial inline signing support. [RT #23657]
2011-08-30 01:16:15 -04:00
cp ns2/bits.db.in ns2/bits.db
Apply raw zone deltas to yet unsigned secure zones When inline signing is enabled for a zone without creating signing keys for it, changes subsequently applied to the raw zone will not be reflected in the secure zone due to the dns_update_signaturesinc() call inside receive_secure_serial() failing. Given that an inline zone will be served (without any signatures) even with no associated signing keys being present, keep applying raw zone deltas to the secure zone until keys become available in an attempt to follow the principle of least astonishment.
2018-03-16 19:12:23 -04:00
cp ns2/bits.db.in ns2/nokeys.db
cp ns2/bits.db.in ns2/removedkeys-secondary.db
3289. [bug] 'rndc retransfer' failed for inline zones. [RT #28036]
2012-02-23 01:53:15 -05:00
cp ns2/bits.db.in ns2/retransfer.db
3147. [func] Initial inline signing support. [RT #23657]
2011-08-30 01:16:15 -04:00
Replace "master/slave" terminology in tests Replace most "master/slave" terminology in tests with the preferred "primary/secondary", with the following exceptions: - When testing the old syntax - When master is used in master file and master file format terms - When master is used in hostmaster or postmaster terms - When master used in legacy domain names (for example in dig.batch) - When there is no replacement (for example default-masters)
2021-10-05 04:41:27 -04:00
cp ns3/primary.db.in ns3/primary.db
cp ns3/primary.db.in ns3/dynamic.db
cp ns3/primary.db.in ns3/updated.db
cp ns3/primary.db.in ns3/unsupported.db
cp ns3/primary.db.in ns3/expired.db
cp ns3/primary.db.in ns3/nsec3.db
cp ns3/primary.db.in ns3/externalkey.db
cp ns3/primary.db.in ns3/delayedkeys.db
cp ns3/primary.db.in ns3/removedkeys-primary.db
Fix inline test with missing $INCLUDE The test case for a zone with a missing include file was wrong for two reasons: 1. It was loading the wrong file (master5 instead of master6) 2. It did actually not set the $ret variable to 1 if the test failed (it should default to ret=1 and clear the variable if the appropriate log is found).
2021-03-19 10:23:01 -04:00
cp ns3/include.db.in ns3/include.db
Apply raw zone deltas to yet unsigned secure zones When inline signing is enabled for a zone without creating signing keys for it, changes subsequently applied to the raw zone will not be reflected in the secure zone due to the dns_update_signaturesinc() call inside receive_secure_serial() failing. Given that an inline zone will be served (without any signatures) even with no associated signing keys being present, keep applying raw zone deltas to the secure zone until keys become available in an attempt to follow the principle of least astonishment.
2018-03-16 19:12:23 -04:00
mkdir ns3/removedkeys
3181. [func] Inline-signing is now supported for master zones. [RT #26224]
2011-10-26 16:56:45 -04:00
touch ns4/trusted.conf
cp ns4/noixfr.db.in ns4/noixfr.db
parallelize most system tests
2018-02-20 18:43:27 -05:00
copy_setports ns1/named.conf.in ns1/named.conf
copy_setports ns2/named.conf.in ns2/named.conf
copy_setports ns3/named.conf.in ns3/named.conf
Change inline system test The inline system test tests 'auto-dnssec' in conjunction with 'inline-signing'. Change the tests to make use of 'dnssec-policy'. Remove some tests that no longer make sense: - The 'retransfer3.' zone tests changing the parameters with 'rndc signing -nsec3param'. This command is going away and NSEC3 parameters now need to be configured with nsec3param within 'dnssec-policy'. - The 'inactivezsk.' and 'inactiveksk.' zones test whether the ZSK take over signing if the KSK is inactive, or vice versa. This fallback mode longer makes sense when using a DNSSEC policy. Some tests need to be adapted more than just changing 'auto-dnssec' to 'dnssec-policy': - The 'delayedkeys.' zone first needs to be configured as insecure, then we can change it to start signing. Previously, no existing keys means that you cannot sign the zone, with 'dnssec-policy' new keys will be created. - The 'updated.' zone needs to have key states in a specific state so that the minimal journal check still works (otherwise CDS/ CDNSKEY and related records will be in the journal too). - External keys are now added to the unsigned zone and no longer are maintained with key files. Adjust the 'externalkey.' zone accordingly. - The 'nsec3-loop.' zone requires three signing keys. Since 'dnssec-policy' will ignore duplicates in the 'keys' section, create RSASHA256 keys with different role and/or key length. Finally, the 'externalkey.' zone checks for an expected number of DNSKEY and RRSIG records in the response. This used to be 3 DNSKEY and 2 RRSIG records. Due to logic behavior changes (key timing metadata is no longer authoritative, these expected values are changed to 4 DNSKEY records (two signing keys and two external keys per algorithm) and 1 RRSIG record (one active KSK per signing algorithm).
2023-06-19 10:21:11 -04:00
cp ns3/delayedkeys.conf.1 ns3/delayedkeys.conf
parallelize most system tests
2018-02-20 18:43:27 -05:00
copy_setports ns4/named.conf.in ns4/named.conf
copy_setports ns5/named.conf.pre ns5/named.conf
copy_setports ns6/named.conf.in ns6/named.conf
copy_setports ns7/named.conf.in ns7/named.conf
Check inline master zones that are touched reload correctly.
2020-03-02 03:38:29 -05:00
copy_setports ns8/named.conf.in ns8/named.conf
3166. [bug] Upgrading a zone to support inline-signing failed. [RT #26014]
2011-10-11 20:10:20 -04:00
[master] use posix-compatible shell in system tests 3839. [test] Use only posix-compatible shell in system tests. [RT #35625]
2014-05-07 01:06:04 -04:00
(
cd ns3
$SHELL -e sign.sh
)
(
cd ns1
$SHELL -e sign.sh
)
[master] Prevent possible infinite signing loop after retransferring an inline-signed slave using NSEC3 4727. [bug] Retransferring an inline-signed slave using NSEC3 around the time its NSEC3 salt was changed could result in an infinite signing loop. [RT #45080]
2017-09-18 03:18:45 -04:00
(
cd ns7
$SHELL -e sign.sh
)
Check inline master zones that are touched reload correctly.
2020-03-02 03:38:29 -05:00
(
cd ns8
$SHELL -e sign.sh
)
Reference in a new issue Copy permalink