--- /dev/null
+; This zone file intentionally isn't a jinja2 template.
+;
+; It needs to be read before the templates are rended, to generate hypothesis
+; test cases.
+$ORIGIN nsec3-answer.
+$TTL 300
+nsec3-answer. IN SOA . . (
+ 1 ; serial
+ 20 ; refresh (20 seconds)
+ 20 ; retry (20 seconds)
+ 1814400 ; expire (3 weeks)
+ 3600 ; minimum (1 hour)
+)
+
+nsec3-answer. NS ns2
+ns2 A 10.53.0.2
+
+02hc3em7bdd011a0gms3hkkjt2if5vp8 A 10.0.0.0
+a A 10.0.0.1
+*.a.a A 10.0.0.6
+a.a.a.a A 10.0.0.3
+b A 10.0.0.2
+b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b A 10.0.0.2
+cname CNAME does-not-exist
+cname.cname CNAME cname
+cname.ent.cname CNAME cname.cname
+d A 10.0.0.4
+dname-to-nowhere DNAME does-not-exist
+; DNAME owner longer than target to avoid YXDOMAIN dependent on QNAME
+insecure NS a.root-servers.nil
+ns.insecure A 10.53.0.3
+a.root-servers.nil A 10.53.0.1
+secure NS a.root-servers.nil
+secure DS 11111 13 255 00
+occluded.secure A 0.0.0.0
+*.wild A 10.0.0.6
+explicit.wild A 192.0.2.66
+z A 10.0.0.26
+
+; randomly generated subtree to excercise unknown corner cases
+; intentionally small, to not blow up algorithms with quadratic complexity in ZoneAnalyzer and name generator
+a.a.a.b.a.a.a.b.a.a.b.b.a.random TXT "r"
+b.b.a.a.b.b.a.a.a.b.b.a.b.a.a.a.a.a.b.a.a.b.a.b.a.b.b.b.b.b.a.a.a.a.b.a.a.a.b.a.a.b.b.a.random TXT "r"
+a.a.a.b.b.a.b.b.a.b.a.b.a.b.a.b.b.b.a.random TXT "r"
+b.b.a.b.a.b.a.a.a.b.a.a.b.a.a.a.a.b.b.a.b.b.a.b.a.b.a.b.a.b.b.b.a.random TXT "r"
+a.b.a.a.b.a.b.a.b.a.a.b.a.b.a.a.a.b.b.a.b.b.a.a.b.b.a.a.b.a.b.a.b.b.b.b.a.a.a.a.a.a.a.a.b.a.b.a.b.b.a.b.a.b.a.a.a.b.a.a.b.a.a.a.a.b.b.a.b.b.a.b.a.b.a.b.a.b.b.b.a.random TXT "r"
+a.a.a.a.a.b.b.a.a.b.a.a.b.a.a.b.b.a.a.a.b.a.a.a.b.b.b.b.b.a.a.a.b.b.b.b.b.b.a.b.b.b.a.a.b.b.b.b.a.a.a.a.b.a.b.b.a.b.a.a.b.b.b.b.b.b.b.a.b.b.a.b.a.b.a.a.a.b.b.a.a.b.b.a.b.a.b.b.a.b.b.b.a.b.b.b.b.b.a.a.b.a.a.a.b.b.a.a.a.b.b.b.b.b.a.random TXT "r"
-#!/usr/bin/python3
-
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
-# Silence incorrect warnings cause by hypothesis.assume()
+# Silence incorrect warnings caused by hypothesis.assume()
# https://github.com/pylint-dev/pylint/issues/10785#issuecomment-3677224217
# pylint: disable=unreachable
from pathlib import Path
import os
+import time
from hypothesis import assume, given
import dns.rrset
import pytest
+from dnssec_py.common import DNSSEC_PY_MARK
from isctest.hypothesis.strategies import dns_names, sampled_from
+from isctest.template import NS2, zones
+from isctest.zone import Zone, configure_root
import isctest
import isctest.name
-SUFFIX = dns.name.from_text(".")
-AUTH = "10.53.0.1"
-RESOLVER = "10.53.0.2"
+pytestmark = DNSSEC_PY_MARK
+
+
+def bootstrap():
+ zone = Zone(
+ "nsec3-answer",
+ NS2,
+ signed=True,
+ )
+ zone.add_keys()
+ salt = int(time.time()) // 3600 % 65536
+ salt_hex = f"{salt:04X}"
+ isctest.log.info(f"NSEC3 salt for this hour: {salt_hex}")
+ zone.sign(f"-3 {salt_hex}")
+
+ root = configure_root([zone])
+ return {
+ "trust_anchors": root.trust_anchors(),
+ "zones": zones([root, zone]),
+ }
+
+
+SUFFIX = dns.name.from_text("nsec3-answer.")
+AUTH = "10.53.0.2"
+RESOLVER = "10.53.0.9"
TIMEOUT = 5
ZONE = isctest.name.ZoneAnalyzer.read_path(
- Path(os.environ["srcdir"]) / "nsec3_answer/ns1/root.db.in", origin=SUFFIX
+ Path(os.environ["srcdir"]) / "dnssec_py/ns2/zones/nsec3-answer.db",
+ origin=SUFFIX,
)
@pytest.mark.parametrize(
- "server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
+ "server", [pytest.param(AUTH, id="ns2"), pytest.param(RESOLVER, id="ns9")]
)
@given(
qname=sampled_from(
check_nodata(qname, nsec3check)
-@pytest.mark.parametrize("server", [pytest.param(AUTH, id="ns1")])
+@pytest.mark.parametrize("server", [pytest.param(AUTH, id="ns2")])
@given(
qname=dns_names(
suffix=(ZONE.delegations - ZONE.get_names_with_type(dns.rdatatype.DS))
assume(qname not in ZONE.all_existing_names)
# name must not be under a delegation or DNAME:
- # it would not work with resolver ns2
+ # it would not work with resolver ns9
assume(
not is_related_to_any(
qname,
@pytest.mark.parametrize(
- "server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
+ "server", [pytest.param(AUTH, id="ns2"), pytest.param(RESOLVER, id="ns9")]
)
@given(qname=dns_names(suffix=SUFFIX))
def test_nxdomain(server: str, qname: dns.name.Name, named_port: int) -> None:
@pytest.mark.parametrize(
- "server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
+ "server", [pytest.param(AUTH, id="ns2"), pytest.param(RESOLVER, id="ns9")]
)
@given(qname=sampled_from(sorted(ZONE.get_names_with_type(dns.rdatatype.CNAME))))
def test_cname_nxdomain(server: str, qname: dns.name.Name, named_port: int) -> None:
@pytest.mark.parametrize(
- "server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
+ "server", [pytest.param(AUTH, id="ns2"), pytest.param(RESOLVER, id="ns9")]
)
@given(qname=dns_names(suffix=ZONE.get_names_with_type(dns.rdatatype.DNAME)))
def test_dname_nxdomain(server: str, qname: dns.name.Name, named_port: int) -> None:
@pytest.mark.parametrize(
- "server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
+ "server", [pytest.param(AUTH, id="ns2"), pytest.param(RESOLVER, id="ns9")]
)
@given(qname=dns_names(suffix=ZONE.ents))
def test_ents(server: str, qname: dns.name.Name, named_port: int) -> None:
@pytest.mark.parametrize(
- "server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
+ "server", [pytest.param(AUTH, id="ns2"), pytest.param(RESOLVER, id="ns9")]
)
@given(qname=dns_names(suffix=ZONE.reachable_wildcard_parents))
def test_wildcard_synthesis(server: str, qname: dns.name.Name, named_port: int) -> None:
@pytest.mark.parametrize(
- "server", [pytest.param(AUTH, id="ns1"), pytest.param(RESOLVER, id="ns2")]
+ "server", [pytest.param(AUTH, id="ns2"), pytest.param(RESOLVER, id="ns9")]
)
@given(qname=dns_names(suffix=ZONE.reachable_wildcard_parents))
def test_wildcard_nodata(server: str, qname: dns.name.Name, named_port: int) -> None:
+++ /dev/null
-$TTL 300
-. IN SOA . . (
- 2025063000 ; serial
- 600 ; refresh
- 600 ; retry
- 1200 ; expire
- 600 ; minimum
- )
-. NS a.root-servers.nil.
-
-02hc3em7bdd011a0gms3hkkjt2if5vp8. A 10.0.0.0
-a. A 10.0.0.1
-*.a.a. A 10.0.0.6
-a.a.a.a. A 10.0.0.3
-b. A 10.0.0.2
-b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b.b. A 10.0.0.2
-cname. CNAME does-not-exist.
-cname.cname. CNAME cname.
-cname.ent.cname. CNAME cname.cname.
-d. A 10.0.0.4
-dname-to-nowhere. DNAME does-not-exist.
-; DNAME owner longer than target to avoid YXDOMAIN dependent on QNAME
-insecure. NS a.root-servers.nil.
-ns.insecure. A 10.53.0.3
-a.root-servers.nil. A 10.53.0.1
-secure. NS a.root-servers.nil.
-secure. DS 11111 13 255 00
-occluded.secure. A 0.0.0.0
-*.wild. A 10.0.0.6
-explicit.wild. A 192.0.2.66
-z. A 10.0.0.26
-
-; randomly generated subtree to excercise unknown corner cases
-; intentionally small, to not blow up algorithms with quadratic complexity in ZoneAnalyzer and name generator
-a.a.a.b.a.a.a.b.a.a.b.b.a.random. TXT "r"
-b.b.a.a.b.b.a.a.a.b.b.a.b.a.a.a.a.a.b.a.a.b.a.b.a.b.b.b.b.b.a.a.a.a.b.a.a.a.b.a.a.b.b.a.random. TXT "r"
-a.a.a.b.b.a.b.b.a.b.a.b.a.b.a.b.b.b.a.random. TXT "r"
-b.b.a.b.a.b.a.a.a.b.a.a.b.a.a.a.a.b.b.a.b.b.a.b.a.b.a.b.a.b.b.b.a.random. TXT "r"
-a.b.a.a.b.a.b.a.b.a.a.b.a.b.a.a.a.b.b.a.b.b.a.a.b.b.a.a.b.a.b.a.b.b.b.b.a.a.a.a.a.a.a.a.b.a.b.a.b.b.a.b.a.b.a.a.a.b.a.a.b.a.a.a.a.b.b.a.b.b.a.b.a.b.a.b.a.b.b.b.a.random. TXT "r"
-a.a.a.a.a.b.b.a.a.a.a.a.b.b.a.a.b.a.a.b.a.a.b.b.a.a.a.b.a.a.a.b.b.b.b.b.a.a.a.b.b.b.b.b.b.a.b.b.b.a.a.b.b.b.b.a.a.a.a.b.a.b.b.a.b.a.a.b.b.b.b.b.b.b.a.b.b.a.b.a.b.a.a.a.b.b.a.a.b.b.a.b.a.b.b.a.b.b.b.a.b.b.b.b.b.a.a.b.a.a.a.b.b.a.a.a.b.b.b.b.b.a.random. TXT "r"
projects / thirdparty / bind9.git / commitdiff
