diff options
Diffstat (limited to 'bin/tests/system/synthfromdnssec/ns1')
| -rw-r--r-- | bin/tests/system/synthfromdnssec/ns1/dnamed.db.in | 17 | ||||
| -rw-r--r-- | bin/tests/system/synthfromdnssec/ns1/example.db.in | 25 | ||||
| -rw-r--r-- | bin/tests/system/synthfromdnssec/ns1/minimal.db.in | 46 | ||||
| -rw-r--r-- | bin/tests/system/synthfromdnssec/ns1/named.conf.in | 72 | ||||
| -rw-r--r-- | bin/tests/system/synthfromdnssec/ns1/root.db.in | 24 | ||||
| -rw-r--r-- | bin/tests/system/synthfromdnssec/ns1/sign.sh | 76 | ||||
| -rw-r--r-- | bin/tests/system/synthfromdnssec/ns1/soa-without-dnskey.db.in | 23 |
7 files changed, 283 insertions, 0 deletions
diff --git a/bin/tests/system/synthfromdnssec/ns1/dnamed.db.in b/bin/tests/system/synthfromdnssec/ns1/dnamed.db.in new file mode 100644 index 0000000..61dfcf8 --- /dev/null +++ b/bin/tests/system/synthfromdnssec/ns1/dnamed.db.in @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 3600 +@ SOA ns1 hostmaster 1 3600 1200 604800 5 +@ NS ns1 +ns1 A 10.53.0.1 +a A 10.53.0.1 +dname DNAME example. diff --git a/bin/tests/system/synthfromdnssec/ns1/example.db.in b/bin/tests/system/synthfromdnssec/ns1/example.db.in new file mode 100644 index 0000000..79d5c27 --- /dev/null +++ b/bin/tests/system/synthfromdnssec/ns1/example.db.in @@ -0,0 +1,25 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 3600 +@ SOA ns1 hostmaster 1 3600 1200 604800 3600 +@ NS ns1 +ns1 A 10.53.0.1 +nodata TXT nodata +*.wild-a A 1.2.3.4 +*.wild-cname CNAME ns1 +*.wild-1-nsec A 1.2.3.4 +*.wild-2-nsec A 1.2.3.4 +_x.wild-2-nsec TXT a name beween wild-2-nsec and a.wild-2-nsec +*.wild-2-nsec-afterdata A 1.2.3.4 +*.wild-2-nsec-afterdata AAAA 2002::1 +_x.wild-2-nsec-afterdata TXT a name beween wild-2-nsec-afterdata and a.wild-2-nsec-afterdata +dnamed DNAME dnamed. diff --git a/bin/tests/system/synthfromdnssec/ns1/minimal.db.in b/bin/tests/system/synthfromdnssec/ns1/minimal.db.in new file mode 100644 index 0000000..2df3890 --- /dev/null +++ b/bin/tests/system/synthfromdnssec/ns1/minimal.db.in @@ -0,0 +1,46 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 3600 +minimal. 3600 SOA ns1.minimal. hostmaster.minimal. ( + 1 ; serial + 3600 ; refresh (1 hour) + 1200 ; retry (20 minutes) + 604800 ; expire (1 week) + 3600 ; minimum (1 hour) + ) + 3600 NS ns1.minimal. + 3600 NSEC badtypemap.minimal. NS SOA RRSIG NSEC DNSKEY +; bad NSEC type map without RRSIG or NSEC +badtypemap.minimal. 3600 NSEC black.minimal. A +badtypemap.minimal. 3600 A 1.2.3.4 +badtypemap.minimal. 3600 AAAA 2002::1 +; cloudflare black lie +black.minimal. 3600 NSEC \000.black.minimal. RRSIG NSEC +; +dnamed.minimal. 3600 DNAME dnamed. + 3600 NSEC insecure.minimal. DNAME RRSIG NSEC +insecure.minimal. 3600 NS ns1.insecure.minimal. + 3600 NSEC nodata.minimal. NS RRSIG NSEC +nodata.minimal. 3600 TXT "nodata" + 3600 NSEC ns1.minimal. TXT RRSIG NSEC +; incomplete chain pointing at non-existent ns2.minimal +ns1.minimal. 3600 A 10.53.0.1 + 3600 NSEC ns2.minimal. A RRSIG NSEC +; minimal response for nxdomain.minimal. +nxdomaia.minimal. 3600 NSEC nxdomaiz.minimal. RRSIG NSEC +; +*.wild-a.minimal. 3600 A 1.2.3.4 + 3600 NSEC *.wild-cname.minimal. A RRSIG NSEC +*.wild-cname.minimal. 3600 CNAME ns1.minimal. + 3600 NSEC minimal. CNAME RRSIG NSEC +; glue +ns1.insecure.minimal. 3600 A 10.53.0.1 diff --git a/bin/tests/system/synthfromdnssec/ns1/named.conf.in b/bin/tests/system/synthfromdnssec/ns1/named.conf.in new file mode 100644 index 0000000..9a86e24 --- /dev/null +++ b/bin/tests/system/synthfromdnssec/ns1/named.conf.in @@ -0,0 +1,72 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +// NS1 + +options { + query-source address 10.53.0.1; + notify-source 10.53.0.1; + transfer-source 10.53.0.1; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.1; }; + listen-on-v6 { none; }; + recursion no; + notify yes; + dnssec-validation yes; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm @DEFAULT_HMAC@; +}; + +controls { + inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +statistics-channels { + inet 10.53.0.1 port @EXTRAPORT1@ allow { any; }; +}; + +zone "." { + type primary; + file "root.db.signed"; +}; + +zone "example" { + type primary; + file "example.db.signed"; +}; + +zone "insecure.example" { + type primary; + file "insecure.example.db.signed"; +}; + +zone "dnamed" { + type primary; + file "dnamed.db.signed"; +}; + +zone "minimal" { + type primary; + file "minimal.db.signed"; +}; + +zone "soa-without-dnskey" { + type primary; + file "soa-without-dnskey.db.signed"; +}; + +include "trusted.conf"; diff --git a/bin/tests/system/synthfromdnssec/ns1/root.db.in b/bin/tests/system/synthfromdnssec/ns1/root.db.in new file mode 100644 index 0000000..bade656 --- /dev/null +++ b/bin/tests/system/synthfromdnssec/ns1/root.db.in @@ -0,0 +1,24 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 3600 +@ SOA ns1 hostmaster 1 3600 1200 604800 3600 +@ NS ns1 +ns1 A 10.53.0.1 +example NS ns1.example +fun NS ns1.example +ns1.example A 10.53.0.1 +dnamed NS ns1.dnamed +ns1.dnamed A 10.53.0.1 +minimal NS ns1.minimal +ns1.minimal A 10.53.0.1 +soa-without-dnskey NS ns1.soa-without-dnskey +ns1.soa-without-dnskey A 10.53.0.1 diff --git a/bin/tests/system/synthfromdnssec/ns1/sign.sh b/bin/tests/system/synthfromdnssec/ns1/sign.sh new file mode 100644 index 0000000..9f699a0 --- /dev/null +++ b/bin/tests/system/synthfromdnssec/ns1/sign.sh @@ -0,0 +1,76 @@ +#!/bin/sh -e + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# shellcheck source=conf.sh +. ../../conf.sh + +zone=example +infile=example.db.in +zonefile=example.db + +keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone) +cat "$infile" "$keyname.key" > "$zonefile" +echo insecure NS ns1.insecure >> "$zonefile" +echo ns1.insecure A 10.53.0.1 >> "$zonefile" + +$SIGNER -P -o $zone $zonefile > /dev/null + +zone=insecure.example +infile=example.db.in +zonefile=insecure.example.db + +keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone) +cat "$infile" "$keyname.key" > "$zonefile" + +$SIGNER -P -o $zone $zonefile > /dev/null + +zone=dnamed +infile=dnamed.db.in +zonefile=dnamed.db + +keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone) +cat "$infile" "$keyname.key" > "$zonefile" + +$SIGNER -P -o $zone $zonefile > /dev/null + +zone=minimal +infile=minimal.db.in +zonefile=minimal.db + +keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone) +cat "$infile" "$keyname.key" > "$zonefile" + +# do not regenerate NSEC chain as there in a minimal NSEC record present +$SIGNER -P -Z nonsecify -o $zone $zonefile > /dev/null + +zone=soa-without-dnskey +infile=soa-without-dnskey.db.in +zonefile=soa-without-dnskey.db + +keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -n zone $zone) +cat "$infile" "$keyname.key" > "$zonefile" + +# do not regenerate NSEC chain as there in a minimal NSEC record present +$SIGNER -P -Z nonsecify -o $zone $zonefile > /dev/null + +zone=. +infile=root.db.in +zonefile=root.db + +keyname=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -b ${DEFAULT_BITS} -n zone $zone) +cat "$infile" "$keyname.key" > "$zonefile" + +$SIGNER -P -g -o $zone $zonefile > /dev/null + +# Configure the resolving server with a static key. +keyfile_to_static_ds "$keyname" > trusted.conf diff --git a/bin/tests/system/synthfromdnssec/ns1/soa-without-dnskey.db.in b/bin/tests/system/synthfromdnssec/ns1/soa-without-dnskey.db.in new file mode 100644 index 0000000..a8ad40c --- /dev/null +++ b/bin/tests/system/synthfromdnssec/ns1/soa-without-dnskey.db.in @@ -0,0 +1,23 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 3600 +soa-without-dnskey. 3600 SOA ns1.soa-without-dnskey. hostmaster.soa-without-dnskey. ( + 1 ; serial + 3600 ; refresh (1 hour) + 1200 ; retry (20 minutes) + 604800 ; expire (1 week) + 3600 ; minimum (1 hour) + ) + 3600 NS ns1.soa-without-dnskey. + 3600 NSEC ns1.soa-without-dnskey. NS SOA RRSIG NSEC +ns1.soa-without-dnskey. 3600 A 10.53.0.1 + 3600 NSEC soa-without-dnskey. A RRSIG NSEC |