add dnssec ede tests

diff --git a/testdata/ede.tdir/bogus/make-broken-zone.sh b/testdata/ede.tdir/bogus/make-broken-zone.sh
index efc230da40b39bf14c78798c6a4e86bcf88ef235..8298dd34d12915d318aac6cd90b7381ca63a29c5 100755 (executable)
--- a/testdata/ede.tdir/bogus/make-broken-zone.sh
+++ b/testdata/ede.tdir/bogus/make-broken-zone.sh
@@ -4,22 +4,22 @@ CSK=`ldns-keygen -a ECDSAP256SHA256 -k -r /dev/urandom dnssec-failures.test`
 echo $CSK
 
 echo ". IN DS 20326 8 2 e06d44b80b8f1d39a95c0b0d7c65d08458e880409bbc683457104237c7f8ec8d" | \
-        cat $CSK.ds - > trust-anchors
+        cat $CSK.ds - > bogus/trust-anchors
 
 ONEMONTHAGO=`date -d 'now - 1 month' +%Y%m%d`
 YESTERDAY=`date -d 'now - 2 days' +%Y%m%d`
 TOMORROW=`date -d 'now + 2 days' +%Y%m%d`
-ldns-signzone -i $YESTERDAY dnssec-failures.test $CSK -f - | \
+ldns-signzone -i $YESTERDAY bogus/dnssec-failures.test $CSK -f - | \
         grep -v '^missingrrsigs\.dnssec-failures\.test\..*IN.*RRSIG.*TXT' | \
         sed 's/Signatures invalid/Signatures INVALID/g' | \
         grep -v '^notyetincepted\.dnssec-failures\.test\..*IN.*TXT' | \
         grep -v '^notyetincepted\.dnssec-failures\.test\..*IN.*RRSIG.*TXT' | \
         grep -v '^expired\.dnssec-failures\.test\..*IN.*TXT' | \
         grep -v '^expired\.dnssec-failures\.test\..*IN.*RRSIG.*TXT' > base
-ldns-signzone -i $ONEMONTHAGO -e $YESTERDAY dnssec-failures.test $CSK -f - | \
+ldns-signzone -i $ONEMONTHAGO -e $YESTERDAY bogus/dnssec-failures.test $CSK -f - | \
         grep -v '[      ]NSEC[  ]' | \
         grep '^expired\.dnssec-failures\.test\..*IN.*TXT' > expired
-ldns-signzone -i $TOMORROW dnssec-failures.test $CSK -f - | \
+ldns-signzone -i $TOMORROW bogus/dnssec-failures.test $CSK -f - | \
         grep -v '[      ]NSEC[  ]' | \
         grep '^notyetincepted\.dnssec-failures\.test\..*IN.*TXT' > notyetincepted
-cat base expired notyetincepted > dnssec-failures.test.signed && rm -f base expired notyetincepted $CSK.*
+cat base expired notyetincepted > bogus/dnssec-failures.test.signed && rm -f base expired notyetincepted $CSK.*

diff --git a/testdata/ede.tdir/ede-auth.conf b/testdata/ede.tdir/ede-auth.conf
index 1d7e9a181fd168c1e6aaa1137dca1f5243e262ef..792f5b46badd9ea05f4cc10b8cecfaf7c45c8adb 100644 (file)
--- a/testdata/ede.tdir/ede-auth.conf
+++ b/testdata/ede.tdir/ede-auth.conf
@@ -5,8 +5,8 @@ server:
         username: ""
         directory: ""
         local-zone: test nodefault
-        port: 53535
+        port: @PORT2@
 
 auth-zone:
         name: "dnssec-failures.test"
-        zonefile: "testdata/ede.tdir/bogus/dnssec-failures.test.signed"
\ No newline at end of file
+        zonefile: "bogus/dnssec-failures.test.signed"
\ No newline at end of file

diff --git a/testdata/ede.tdir/ede.conf b/testdata/ede.tdir/ede.conf
index 8f02a3c1e6aac9a9021892aa2d21e7002bf0cf9e..309e79a93164b48d2f4442180b839f57d7f9f970 100644 (file)
--- a/testdata/ede.tdir/ede.conf
+++ b/testdata/ede.tdir/ede.conf
@@ -11,7 +11,7 @@ server:
 
        # @TODO change this to local file
        #auto-trust-anchor-file: "/var/lib/unbound/root.key"
-       trust-anchor-file: "testdata/ede.tdir/bogus/trust-anchors"
+       trust-anchor-file: "bogus/trust-anchors"
 
        module-config: "respip validator iterator"
 
@@ -20,10 +20,10 @@ server:
        local-zone: hopsa.kidee. always_refuse
        local-data: "hopsa.kidee. TXT hela hola"
 
-       localzone: nlnetlabs.nl transparant
+       local-zone: nlnetlabs.nl transparent
        local-data: "hopsa.nlnetlabs.nl. TXT hela hola"
 
-       local-zone: uva.nl. always_null
+       local-zone: uva.nl. always_null
 
        local-zone: example.com redirect
        local-data: "example.com CNAME *.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaa."
@@ -32,5 +32,5 @@ server:
        do-not-query-localhost: no
 
 forward-zone:
-        name: "dnssec-failures.test"
-        forward-addr: 127.0.0.1@@PORT2@
\ No newline at end of file
+       name: "dnssec-failures.test"
+       forward-addr: 127.0.0.1@@PORT2@
\ No newline at end of file

diff --git a/testdata/ede.tdir/ede.test b/testdata/ede.tdir/ede.test
index 2c05ac4496155754ffff88250725e483df722f44..5823dc68a5e530c4fa3fd2d7883c339f28115ba9 100644 (file)
--- a/testdata/ede.tdir/ede.test
+++ b/testdata/ede.tdir/ede.test
@@ -12,15 +12,25 @@ echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
 echo "UNBOUND_PORT2=$UNBOUND_PORT2" >> .tpkg.var.test
 
 # rewrite config file with created ports
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/g; s/@PORT2\@/'$UNBOUND_PORT2'/g' < ede.conf > ub.conf
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' < ede.conf > temp.conf
+sed -e 's/@PORT2\@/'$UNBOUND_PORT2'/' < temp.conf > ub.conf
 sed -e 's/@PORT2\@/'$UNBOUND_PORT2'/' < ede-auth.conf > ub2.conf
 
+# create broken dnssec zone
+bogus/make-broken-zone.sh
+
 # start unbound in the background
 PRE="../.."
 $PRE/unbound -d -c ub.conf > unbound.log 2>&1 &
 UNBOUND_PID=$!
 echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
 
+# start authoritative unbound in the background
+$PRE/unbound -d -c ub2.conf > unbound.log 2>&1 &
+UNBOUND_PID2=$!
+echo "UNBOUND_PID2=$UNBOUND_PID2" >> .tpkg.var.test
+
+
 # query with bad edns keepalive
 dig @127.0.0.1 -p $UNBOUND_PORT +tcp +ednsopt=11:010203 > keepalive.txt
 
@@ -74,14 +84,14 @@ fi
 # RPZ always_refuse
 dig @127.0.0.1 -p $UNBOUND_PORT hopsa.kidee. A > always_refuse.txt
 
-if ! grep -q "OPT=15: 00 04" always_refuse.txt
+if ! grep -q "OPT=15: 00 0f" always_refuse.txt
 then
-       echo "local-zone always_null must have EDE blocked code"
+       echo "local-zone always_refuse must have EDE blocked code"
        exit 1
 fi
 
-# @TODO what does this trigger?
-dig @localhost hopsa.kidee. A
+# @TODO what does this trigger? -> ede blocked
+dig @127.0.0.1 -p $UNBOUND_PORT hopsa.kidee. A
 
 # @TODO trigger mesh DNSSEC bogus
 dig @127.0.0.1 -p $UNBOUND_PORT servfail.nl > servfail.txt
@@ -93,7 +103,7 @@ then
 fi
 
 # local data forged answer
-dig @127.0.0.1 -p $UNBOUND_PORT hopsa.nlnetlabs.nl TXT
+#dig @127.0.0.1 -p $UNBOUND_PORT hopsa.nlnetlabs.nl TXT
 
 #@TODO write actual test