mirror of
https://github.com/isc-projects/bind9.git
synced 2026-02-27 20:11:12 -05:00
314accf7ef
The 'legacy-keys.kasp' test checks that a zone with key files but not
yet state files is signed correctly. This test is expanded to cover
the case where old key files still exist in the key directory. This
covers bug #2406 where keys with the "Delete" timing metadata are
picked up by the keymgr as active keys.
Fix the 'legacy-keys.kasp' test, by creating the right key files
(for zone 'legacy-keys.kasp', not 'legacy,kasp').
Use a unique policy for this zone, using shorter lifetimes.
Create two more keys for the zone, and use 'dnssec-settime' to set
the timing metadata in the past, long enough ago so that the keys
should not be considered by the keymgr.
Update the 'key_unused()' test function, and consider keys with
their "Delete" timing metadata in the past as unused.
Extend the test to ensure that the keys to be used are not the old
predecessor keys (with their "Delete" timing metadata in the past).
Update the test so that the checks performed are consistent with the
newly configured policy.
(cherry picked from commit d4b2b7072d)
33 lines
1 KiB
Bash
33 lines
1 KiB
Bash
#!/bin/sh
|
|
#
|
|
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
#
|
|
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
#
|
|
# See the COPYRIGHT file distributed with this work for additional
|
|
# information regarding copyright ownership.
|
|
|
|
set -e
|
|
|
|
rm -f ./keygen.*
|
|
rm -f ./K*.private ./K*.key ./K*.state ./K*.cmp
|
|
rm -rf ./keys/
|
|
rm -f dig.out* rrsig.out.* keyevent.out.*
|
|
rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
|
|
rm -f ns*/policies/*.conf
|
|
rm -f ns*/*.jnl ns*/*.jbk
|
|
rm -f ns*/K*.private ns*/K*.key ns*/K*.state
|
|
rm -f ns*/dsset-* ns*/*.db ns*/*.db.signed
|
|
rm -f ns*/keygen.out.* ns*/settime.out.* ns*/signer.out.*
|
|
rm -f ns*/managed-keys.bind
|
|
rm -f ns*/*.mkeys
|
|
rm -f ns*/zones ns*/*.db.infile
|
|
rm -f ns*/*.zsk1 ns*/*.zsk2
|
|
rm -f ns3/legacy-keys.*
|
|
rm -f *.created published.test* retired.test*
|
|
rm -f rndc.dnssec.*.out.*
|
|
rm -f python.out.*
|
|
rm -f *-supported.file
|
|
rm -f created.key-* unused.key-*
|