genzones.sh revision 0c27b3fe77ac1d5094ba3521e8142d9e7973133f
# Copyright (C) 2012-2014, 2016 Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# $Id$
SYSTEMTESTTOP=../..
echo "D:${debug}: dumping ${1}"
}
echo "I:setting up $2 zone: $1"
debug="$1"
zone="$1"
file="$1.$2"
n=`expr ${n:-0} + 1`
}
# A unsigned zone should fail validation.
# A set of nsec zones.
# A set of nsec3 zones.
# A set of zones with only DNSKEY records.
# A set of zones with expired records
s="-s -2678400"
# ksk expired
# broken nsec chain
# bad nsec bitmap
# extra NSEC record out side of zone
echo "out-of-zone. 3600 IN NSEC ${zone}. A" >> ${file}
$SIGNER -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file} $zsk > s.out$n 2>&1 || dumpit s.out$n
# extra NSEC record below bottom of one
$SIGNER -Px -Z nonsecify -O full -o ${zone} -f ${file}.tmp ${file} $zsk > s.out$n 2>&1 || dumpit s.out$n
# dnssec-signzone signs any node with a NSEC record.
# missing NSEC3 record at empty node
# extract the hash fields from the empty node's NSEC 3 record then fix up
# the NSEC3 chain to remove it
awk '
$4 == "NSEC3" && $9 == "'$a'" { $9 = "'$b'"; print; next; }
$4 == "NSEC3" && NF == 9 { next; }
$SIGNER -3 - -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file}.tmp $zsk > s.out$n 2>&1 || dumpit s.out$n
# extra NSEC3 record
awk '
BEGIN {
}
$4 == "NSEC3" && NF == 9 {
$1 = "H9P7U7TR2U91D0V0LJS9L1GIDNP90U3H." ZONE;
$9 = "H9P7U7TR2U91D0V0LJS9L1GIDNP90U3I";
print;
$SIGNER -3 - -Px -Z nonsecify -O full -o ${zone} -f ${file} ${file} $zsk > s.out$n 2>&1 || dumpit s.out$n