Skip to content

Adds test scenarios for DNSSEC10#1294

Merged
matsduf merged 41 commits into
zonemaster:developfrom
matsduf:create-test-scenarios-dnssec10
Nov 27, 2024
Merged

Adds test scenarios for DNSSEC10#1294
matsduf merged 41 commits into
zonemaster:developfrom
matsduf:create-test-scenarios-dnssec10

Conversation

@matsduf

@matsduf matsduf commented Sep 19, 2024

Copy link
Copy Markdown
Contributor

Purpose

The specification of DNSSEC10 has been rewritten in PR #1179 (not yet merged or implemented). This PR defines test scenarios for DNSSEC10 based on the mentioned PR. This PR is not yet complete since all test zones are not yet created.

Context

#1179

Status of PR

The content of the PR is complete. There are two scenarios for which it does not seem to be possible to create test zones with the current tools. My plan is to rearrange the commits and also review what to save in Git. The keys for the Bind zone can probably be left out and recreated each time. Some documentation around Bind and its files will also be updated. None of this affects the test zones for the unit tests.

Changes

All planned scenarios have been defined. Ticked scenarios have complete test zone data and can be used for preliminary unit tests.

  • GOOD-NSEC-1
  • GOOD-NSEC3-1
  • ALGO-NOT-SUPP-BY-ZM-1
  • ALGO-NOT-SUPP-BY-ZM-2
  • ERR-MULT-NSEC-1
  • ERR-MULT-NSEC3-1
  • EXP-NSEC-NSEC3-MISS-1
  • INCONSISTENT-NSEC-1
  • INCONSISTENT-NSEC3-1
  • INCONSIST-NSEC-NSEC3-1
  • INCONSIST-NSEC-NSEC3-2
  • MIXED-NSEC-NSEC3-1
  • MIXED-NSEC-NSEC3-1
  • NSEC3PARAM-GIVES-ERR-ANSWER-1
  • NSEC3PARAM-GIVES-ERR-ANSWER-2
  • NSEC3PARAM-GIVES-ERR-ANSWER-3
  • NSEC3PARAM-Q-RESPONSE-ERR-1
  • NSEC3PARAM-Q-RESPONSE-ERR-2
  • NSEC3PARAM-Q-RESPONSE-ERR-3 (maybe not possible in coredns()?)
  • NSEC3-ERR-TYPE-LIST-1
  • NSEC3-ERR-TYPE-LIST-2
  • NSEC3-MISMATCHES-APEX-1
  • NSEC3-MISSING-SIGNATURE-1
  • NSEC3-NODATA-MISSING-SOA-1
  • NSEC3-NODATA-WRONG-SOA-1
  • NSEC3-NO-VERIFIED-SIGNATURE-1
  • NSEC3-NO-VERIFIED-SIGNATURE-2
  • NSEC3-NO-VERIFIED-SIGNATURE-3
  • NSEC3-NO-VERIFIED-SIGNATURE-4
  • NSEC-ERR-TYPE-LIST-1
  • NSEC-ERR-TYPE-LIST-2
  • NSEC-GIVES-ERR-ANSWER-1
  • NSEC-GIVES-ERR-ANSWER-2
  • NSEC-MISMATCHES-APEX-1
  • NSEC-MISMATCHES-APEX-2
  • NSEC-MISSING-SIGNATURE-1
  • NSEC-NODATA-MISSING-SOA-1
  • NSEC-NODATA-WRONG-SOA-1
  • NSEC-NO-VERIFIED-SIGNATURE-1
  • NSEC-NO-VERIFIED-SIGNATURE-2
  • NSEC-NO-VERIFIED-SIGNATURE-3
  • NSEC-NO-VERIFIED-SIGNATURE-4
  • NSEC-QUERY-RESPONSE-ERR-1
  • NSEC-QUERY-RESPONSE-ERR-2
  • NSEC-QUERY-RESPONSE-ERR-3 (maybe not possible in coredns()?)
  • SERVER-NO-DNSSEC-1
  • SERVER-NO-DNSSEC-2
  • ZONE-NO-DNSSEC-1

How to test this PR

Review the test scenarios. Files under the Bind directory are not meaningful to review.

@matsduf matsduf added the A-TestCase Area: Test case specification or implementation of test case label Sep 19, 2024
@matsduf matsduf added this to the v2024.2 milestone Sep 19, 2024
@matsduf matsduf marked this pull request as draft September 19, 2024 08:01
@matsduf matsduf changed the title Adds test scenrios for DNSSEC10 Adds test scenarios for DNSSEC10 Sep 24, 2024
@matsduf matsduf force-pushed the create-test-scenarios-dnssec10 branch from 886ce93 to 16b0b1c Compare October 2, 2024 14:41
@matsduf matsduf marked this pull request as ready for review October 2, 2024 19:32
@matsduf matsduf requested a review from tgreenx October 2, 2024 19:32
@matsduf

matsduf commented Oct 7, 2024

Copy link
Copy Markdown
Contributor Author

@tgreenx, all test zones are created for updated DNSSEC10.

@marc-vanderwal marc-vanderwal left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see no obvious issues except for a little typo.

Comment thread docs/public/specifications/test-zones/DNSSEC-TP/dnssec10.md Outdated
@matsduf

matsduf commented Nov 20, 2024

Copy link
Copy Markdown
Contributor Author

Commit 1aaab82 adds scenarios ERR-MULT-NSEC3PARAM-1 and MISMATCHES-APEX-1. Scenario GIVES-ERR-ANSWER-3 has been removed.

Comment thread docs/public/specifications/test-zones/DNSSEC-TP/dnssec10.md Outdated
* An extra NSEC3PARAM record is returned in the response to the NSEC query.
* The extra NSEC3PARAM record has the same owner name, but different number
of iterations.
* The NSEC3PARAM RRset has been signed with the normal DNSKEY.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* The NSEC3PARAM RRset has been signed with the normal DNSKEY.
* The NSEC3PARAM RRset has been signed with the correct DNSKEY.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure that "correct" is more correct than "normal". I will update.

Comment thread docs/public/specifications/test-zones/DNSSEC-TP/dnssec10.md Outdated
Comment thread docs/public/specifications/test-zones/DNSSEC-TP/dnssec10.md Outdated
Comment thread docs/public/specifications/test-zones/DNSSEC-TP/dnssec10.md Outdated
Comment thread test-zone-data/DNSSEC-TP/dnssec10/dnssec10.cfg Outdated
Comment thread test-zone-data/DNSSEC-TP/dnssec10/dnssec10.cfg Outdated
Comment thread test-zone-data/DNSSEC-TP/dnssec10/dnssec10.cfg Outdated
Comment thread test-zone-data/DNSSEC-TP/dnssec10/dnssec10.cfg Outdated
Comment thread test-zone-data/DNSSEC-TP/dnssec10/dnssec10.cfg Outdated
matsduf and others added 10 commits November 25, 2024 20:09
Correction of typo

Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
Co-authored-by: tgreenx <96772376+tgreenx@users.noreply.github.com>
tgreenx

This comment was marked as duplicate.

@tgreenx tgreenx self-requested a review November 26, 2024 13:24

@tgreenx tgreenx left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The file docs/public/SUMMARY.md should be updated too.

@matsduf

matsduf commented Nov 26, 2024

Copy link
Copy Markdown
Contributor Author

The file docs/public/SUMMARY.md should be updated too.

Fixed. That is easy to miss. We need a script to search for unlinked documents.

@matsduf matsduf requested a review from tgreenx November 26, 2024 14:04
tgreenx
tgreenx previously approved these changes Nov 26, 2024
@matsduf matsduf merged commit 156389d into zonemaster:develop Nov 27, 2024
@matsduf matsduf deleted the create-test-scenarios-dnssec10 branch November 27, 2024 13:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-TestCase Area: Test case specification or implementation of test case

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants