WEBDIENSTE/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2026-09-23 18:24:58 +02:00
Code Issues Packages Projects Releases Wiki Activity

add dnssec ede tests

Browse Source
This commit is contained in:
TCY16
2021-10-18 16:45:42 +02:00
parent fed0fb42dd
commit df984d9c6f
4 changed files with 28 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
testdata/ede.tdir/bogus/make-broken-zone.sh
Vendored
+5 -5
View File
@@ -4,22 +4,22 @@ CSK=`ldns-keygen -a ECDSAP256SHA256 -k -r /dev/urandom dnssec-failures.test`
echo $CSK
echo ". IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d" | \
cat $CSK.ds - > trust-anchors
cat $CSK.ds - > bogus/trust-anchors
ONEMONTHAGO=`date -d 'now - 1 month' +%Y%m%d`
YESTERDAY=`date -d 'now - 2 days' +%Y%m%d`
TOMORROW=`date -d 'now + 2 days' +%Y%m%d`
ldns-signzone -i $YESTERDAY dnssec-failures.test $CSK -f - | \
ldns-signzone -i $YESTERDAY bogus/dnssec-failures.test $CSK -f - | \
grep -v '^missingrrsigs\.dnssec-failures\.test\..*IN.*RRSIG.*TXT' | \
sed 's/Signatures invalid/Signatures INVALID/g' | \
grep -v '^notyetincepted\.dnssec-failures\.test\..*IN.*TXT' | \
grep -v '^notyetincepted\.dnssec-failures\.test\..*IN.*RRSIG.*TXT' | \
grep -v '^expired\.dnssec-failures\.test\..*IN.*TXT' | \
grep -v '^expired\.dnssec-failures\.test\..*IN.*RRSIG.*TXT' > base
ldns-signzone -i $ONEMONTHAGO -e $YESTERDAY dnssec-failures.test $CSK -f - | \
ldns-signzone -i $ONEMONTHAGO -e $YESTERDAY bogus/dnssec-failures.test $CSK -f - | \
grep -v '[ ]NSEC[ ]' | \
grep '^expired\.dnssec-failures\.test\..*IN.*TXT' > expired
ldns-signzone -i $TOMORROW dnssec-failures.test $CSK -f - | \
ldns-signzone -i $TOMORROW bogus/dnssec-failures.test $CSK -f - | \
grep -v '[ ]NSEC[ ]' | \
grep '^notyetincepted\.dnssec-failures\.test\..*IN.*TXT' > notyetincepted
cat base expired notyetincepted > dnssec-failures.test.signed && rm -f base expired notyetincepted $CSK.*
cat base expired notyetincepted > bogus/dnssec-failures.test.signed && rm -f base expired notyetincepted $CSK.*
testdata/ede.tdir/ede-auth.conf
Vendored
+2 -2
View File
@@ -5,8 +5,8 @@ server:
username: ""
directory: ""
local-zone: test nodefault
port: 53535
port: @PORT2@
auth-zone:
name: "dnssec-failures.test"
zonefile: "testdata/ede.tdir/bogus/dnssec-failures.test.signed"
zonefile: "bogus/dnssec-failures.test.signed"
testdata/ede.tdir/ede.conf
Vendored
+5 -5
View File
@@ -11,7 +11,7 @@ server:
# @TODO change this to local file
#auto-trust-anchor-file: "/var/lib/unbound/root.key"
trust-anchor-file: "testdata/ede.tdir/bogus/trust-anchors"
trust-anchor-file: "bogus/trust-anchors"
module-config: "respip validator iterator"
@@ -20,10 +20,10 @@ server:
local-zone: hopsa.kidee. always_refuse
local-data: "hopsa.kidee. TXT hela hola"
localzone: nlnetlabs.nl transparant
local-zone: nlnetlabs.nl transparent
local-data: "hopsa.nlnetlabs.nl. TXT hela hola"
local-zone: uva.nl. always_null
local-zone: uva.nl. always_null
local-zone: example.com redirect
local-data: "example.com CNAME *.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaa."
@@ -32,5 +32,5 @@ server:
do-not-query-localhost: no
forward-zone:
name: "dnssec-failures.test"
forward-addr: 127.0.0.1@@PORT2@
name: "dnssec-failures.test"
forward-addr: 127.0.0.1@@PORT2@
testdata/ede.tdir/ede.test
Vendored
+16 -6
View File
@@ -12,15 +12,25 @@ echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
echo "UNBOUND_PORT2=$UNBOUND_PORT2" >> .tpkg.var.test
# rewrite config file with created ports
sed -e 's/@PORT\@/'$UNBOUND_PORT'/g; s/@PORT2\@/'$UNBOUND_PORT2'/g' < ede.conf > ub.conf
sed -e 's/@PORT\@/'$UNBOUND_PORT'/' < ede.conf > temp.conf
sed -e 's/@PORT2\@/'$UNBOUND_PORT2'/' < temp.conf > ub.conf
sed -e 's/@PORT2\@/'$UNBOUND_PORT2'/' < ede-auth.conf > ub2.conf
# create broken dnssec zone
bogus/make-broken-zone.sh
# start unbound in the background
PRE="../.."
$PRE/unbound -d -c ub.conf > unbound.log 2>&1 &
UNBOUND_PID=$!
echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
# start authoritative unbound in the background
$PRE/unbound -d -c ub2.conf > unbound.log 2>&1 &
UNBOUND_PID2=$!
echo "UNBOUND_PID2=$UNBOUND_PID2" >> .tpkg.var.test
# query with bad edns keepalive
dig @127.0.0.1 -p $UNBOUND_PORT +tcp +ednsopt=11:010203 > keepalive.txt
@@ -74,14 +84,14 @@ fi
# RPZ always_refuse
dig @127.0.0.1 -p $UNBOUND_PORT hopsa.kidee. A > always_refuse.txt
if ! grep -q "OPT=15: 00 04" always_refuse.txt
if ! grep -q "OPT=15: 00 0f" always_refuse.txt
then
echo "local-zone always_null must have EDE blocked code"
echo "local-zone always_refuse must have EDE blocked code"
exit 1
fi
# @TODO what does this trigger?
dig @localhost hopsa.kidee. A
# @TODO what does this trigger? -> ede blocked
dig @127.0.0.1 -p $UNBOUND_PORT hopsa.kidee. A
# @TODO trigger mesh DNSSEC bogus
dig @127.0.0.1 -p $UNBOUND_PORT servfail.nl > servfail.txt
@@ -93,7 +103,7 @@ then
fi
# local data forged answer
dig @127.0.0.1 -p $UNBOUND_PORT hopsa.nlnetlabs.nl TXT
#dig @127.0.0.1 -p $UNBOUND_PORT hopsa.nlnetlabs.nl TXT
#@TODO write actual test