mirror of
https://github.com/isc-projects/bind9.git
synced 2026-02-24 02:10:30 -05:00
f4eb3ba459
The inline system test tests 'auto-dnssec' in conjunction with 'inline-signing'. Change the tests to make use of 'dnssec-policy'. Remove some tests that no longer make sense: - The 'retransfer3.' zone tests changing the parameters with 'rndc signing -nsec3param'. This command is going away and NSEC3 parameters now need to be configured with nsec3param within 'dnssec-policy'. - The 'inactivezsk.' and 'inactiveksk.' zones test whether the ZSK take over signing if the KSK is inactive, or vice versa. This fallback mode longer makes sense when using a DNSSEC policy. Some tests need to be adapted more than just changing 'auto-dnssec' to 'dnssec-policy': - The 'delayedkeys.' zone first needs to be configured as insecure, then we can change it to start signing. Previously, no existing keys means that you cannot sign the zone, with 'dnssec-policy' new keys will be created. - The 'updated.' zone needs to have key states in a specific state so that the minimal journal check still works (otherwise CDS/ CDNSKEY and related records will be in the journal too). - External keys are now added to the unsigned zone and no longer are maintained with key files. Adjust the 'externalkey.' zone accordingly. - The 'nsec3-loop.' zone requires three signing keys. Since 'dnssec-policy' will ignore duplicates in the 'keys' section, create RSASHA256 keys with different role and/or key length. Finally, the 'externalkey.' zone checks for an expected number of DNSKEY and RRSIG records in the response. This used to be 3 DNSKEY and 2 RRSIG records. Due to logic behavior changes (key timing metadata is no longer authoritative, these expected values are changed to 4 DNSKEY records (two signing keys and two external keys per algorithm) and 1 RRSIG record (one active KSK per signing algorithm).
54 lines
1.6 KiB
Bash
54 lines
1.6 KiB
Bash
#!/bin/sh
|
|
|
|
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
#
|
|
# SPDX-License-Identifier: MPL-2.0
|
|
#
|
|
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
#
|
|
# See the COPYRIGHT file distributed with this work for additional
|
|
# information regarding copyright ownership.
|
|
|
|
. ../conf.sh
|
|
|
|
cp ns1/root.db.in ns1/root.db
|
|
|
|
touch ns2/trusted.conf
|
|
cp ns2/nsec3-loop.db.in ns2/nsec3-loop.db
|
|
cp ns2/bits.db.in ns2/bits.db
|
|
cp ns2/bits.db.in ns2/nokeys.db
|
|
cp ns2/bits.db.in ns2/removedkeys-secondary.db
|
|
cp ns2/bits.db.in ns2/retransfer.db
|
|
|
|
cp ns3/primary.db.in ns3/primary.db
|
|
cp ns3/primary.db.in ns3/dynamic.db
|
|
cp ns3/primary.db.in ns3/updated.db
|
|
cp ns3/primary.db.in ns3/unsupported.db
|
|
cp ns3/primary.db.in ns3/expired.db
|
|
cp ns3/primary.db.in ns3/nsec3.db
|
|
cp ns3/primary.db.in ns3/externalkey.db
|
|
cp ns3/primary.db.in ns3/delayedkeys.db
|
|
cp ns3/primary.db.in ns3/removedkeys-primary.db
|
|
cp ns3/include.db.in ns3/include.db
|
|
|
|
mkdir ns3/removedkeys
|
|
|
|
touch ns4/trusted.conf
|
|
cp ns4/noixfr.db.in ns4/noixfr.db
|
|
|
|
copy_setports ns1/named.conf.in ns1/named.conf
|
|
copy_setports ns2/named.conf.in ns2/named.conf
|
|
copy_setports ns3/named.conf.in ns3/named.conf
|
|
cp ns3/delayedkeys.conf.1 ns3/delayedkeys.conf
|
|
copy_setports ns4/named.conf.in ns4/named.conf
|
|
copy_setports ns5/named.conf.pre ns5/named.conf
|
|
copy_setports ns6/named.conf.in ns6/named.conf
|
|
copy_setports ns7/named.conf.in ns7/named.conf
|
|
copy_setports ns8/named.conf.in ns8/named.conf
|
|
|
|
(cd ns3; $SHELL -e sign.sh)
|
|
(cd ns1; $SHELL -e sign.sh)
|
|
(cd ns7; $SHELL -e sign.sh)
|
|
(cd ns8; $SHELL -e sign.sh)
|