From ad3d0c8a30487dec5865393b56d686616a3b6998 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 26 Aug 2022 18:40:53 +0200 Subject: [PATCH 1/4] test: drop old DS records if present This makes the test re-runnable without having to go through the cleanup and setup phases again. --- test/units/testsuite-75.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/test/units/testsuite-75.sh b/test/units/testsuite-75.sh index 43741227e1..8446615383 100755 --- a/test/units/testsuite-75.sh +++ b/test/units/testsuite-75.sh @@ -72,9 +72,14 @@ resolvectl log-level debug # We need to manually propagate the DS records of onlinesign.test. to the parent # zone, since they're generated online knotc zone-begin test. +if knotc zone-get test. onlinesign.test. ds | grep .; then + # Drop any old DS records, if present (e.g. on test re-run) + knotc zone-unset test. onlinesign.test. ds +fi +# Propagate the new DS records while read -ra line; do knotc zone-set test. "${line[@]}" -done < <(keymgr onlinesign.test ds) +done < <(keymgr onlinesign.test. ds) knotc zone-commit test. ### SETUP END ### From 57063a4ab25851d453423408d5b740b27007c7fe Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 26 Aug 2022 20:08:40 +0200 Subject: [PATCH 2/4] test: fix typo --- test/units/testsuite-75.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/units/testsuite-75.sh b/test/units/testsuite-75.sh index 8446615383..a14ee22841 100755 --- a/test/units/testsuite-75.sh +++ b/test/units/testsuite-75.sh @@ -142,7 +142,7 @@ run resolvectl query --legend=no -t MX unsigned.test grep -qF "unsigned.test IN MX 15 mail.unsigned.test" "$RUN_OUT" -: "--- ZONE: signed.systemd (static DNSSEC) ---" +: "--- ZONE: signed.test (static DNSSEC) ---" # Check the trust chain (with and without systemd-resolved in between # Issue: https://github.com/systemd/systemd/issues/22002 # PR: https://github.com/systemd/systemd/pull/23289 From fa17101b8efed0e2deeffe5ecd67c993f639debb Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 26 Aug 2022 18:45:38 +0200 Subject: [PATCH 3/4] test: fix delv trust anchors location on Ubuntu delv on Ubuntu defaults to /etc/bind/bind.keys instead of /etc/bind.keys when reading trust anchors, so let's create a symlink to make the test work there as well. Resolves: #24453 --- test/units/testsuite-75.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/test/units/testsuite-75.sh b/test/units/testsuite-75.sh index a14ee22841..fbe37342dd 100755 --- a/test/units/testsuite-75.sh +++ b/test/units/testsuite-75.sh @@ -57,6 +57,9 @@ keymgr . ds | sed 's/ DS/ IN DS/g' >/etc/dnssec-trust-anchors.d/root.positive keymgr . dnskey | sed -r 's/^\. DNSKEY ([0-9]+ [0-9]+ [0-9]+) (.+)$/. static-key \1 "\2";/g' echo '};' } >/etc/bind.keys +# Create an /etc/bind/bind.keys symlink, which is used by delv on Ubuntu +mkdir -p /etc/bind +ln -svf /etc/bind.keys /etc/bind/bind.keys # Start the services systemctl unmask systemd-networkd systemd-resolved From 9c524a07f6bf4b211c9d47326c9bdc983141adb2 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 26 Aug 2022 21:07:44 +0200 Subject: [PATCH 4/4] test: reload knotd after committing all zone changes Otherwise, on Ubuntu, the DS RRs sometimes won't get propagated correctly to parent zones for some reason, ending in a loop: ``` knotd[70]: info: [test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [signed.test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [signed.test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [signed.test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [signed.test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [signed.test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [signed.test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [signed.test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative knotd[70]: info: [signed.test.] DS check, outgoing, remote 10.0.0.1@53, KSK submission check: negative ... ``` causing DNSSEC verification fails. I'm not sure why that happens (yet)... --- test/units/testsuite-75.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/units/testsuite-75.sh b/test/units/testsuite-75.sh index fbe37342dd..08abc3f272 100755 --- a/test/units/testsuite-75.sh +++ b/test/units/testsuite-75.sh @@ -85,6 +85,8 @@ while read -ra line; do done < <(keymgr onlinesign.test. ds) knotc zone-commit test. +knotc reload + ### SETUP END ### : "--- nss-resolve/nss-myhostname tests"