From: Libor Peltan <libor.peltan@nic.cz>
Date: Fri, 22 Dec 2023 13:59:44 +0000 (+0100)
Subject: tests: dnssec validate event
X-Git-Tag: v3.4.0~205^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=310dc41f967dcbe042c4a37a2b4e5e0543ff75e4;p=thirdparty%2Fknot-dns.git

tests: dnssec validate event
---

diff --git a/tests-extra/tests/dnssec/validate_event/test.py b/tests-extra/tests/dnssec/validate_event/test.py
new file mode 100644
index 0000000000..35b7e97c48
--- /dev/null
+++ b/tests-extra/tests/dnssec/validate_event/test.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python3
+
+'''Test for DNSSEC validation event'''
+
+from dnstest.test import Test
+from dnstest.utils import *
+
+def dig_multi(server, zones, exp_rcode):
+    for z in zones:
+        resp = server.dig(z.name, "DNSKEY", dnssec=True)
+        resp.check(rcode=exp_rcode)
+
+t = Test()
+
+master = t.server("knot")
+slave = t.server("knot")
+zones = t.zone("example.")
+
+t.link(zones, master, slave, ixfr=True, ddns=True)
+
+for z in zones:
+    master.dnssec(z).enable = True
+    master.dnssec(z).rrsig_lifetime = 10
+    master.dnssec(z).rrsig_refresh = 1
+    master.dnssec(z).rrsig_prerefresh = 1
+
+t.start()
+
+# SCENARIO I -- manual knotc zone-validate
+serials = slave.zones_wait(zones)
+serials = slave.zones_wait(zones, serials) # wait for first zone re-sign to demonstrate normal operation
+master.stop()
+slave.ctl("zone-validate", wait=True)
+dig_multi(slave, zones, "NOERROR")
+t.sleep(master.dnssec(z).rrsig_lifetime)
+try:
+    slave.ctl("zone-validate", wait=True)
+    set_err("EXPIRED NOT FAILED")
+except:
+    pass
+dig_multi(slave, zones, "SERVFAIL")
+
+# SCENARIO II -- configured  dnssec-validation
+master.start()
+slave.stop()
+for z in zones:
+    slave.dnssec(z).validate = True
+slave.gen_confile()
+slave.start()
+serials = slave.zones_wait(zones, serials)
+serials = slave.zones_wait(zones, serials) # wait for first zone re-sign to demonstrate normal operation
+master.stop()
+dig_multi(slave, zones, "NOERROR")
+t.sleep(master.dnssec(z).rrsig_lifetime + 1)
+dig_multi(slave, zones, "SERVFAIL")
+
+t.end()