Test trusted anchors configurations for 'dnssec-validation yes'

Add checks into the  'checkconf' system test to make sure that the
'dnssec-validation yes' option fails without configured trusted
anchors, and succeeds with configured non-empty, as well as empty
trusted anchors.

diff --git a/bin/tests/system/checkconf/bad-no-trusted-key.conf b/bin/tests/system/checkconf/bad-no-trusted-key.conf
new file mode 100644 (file)
index 0000000..42cfe1f
--- /dev/null
+++ b/bin/tests/system/checkconf/bad-no-trusted-key.conf
@@ -0,0 +1,16 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dnssec-validation yes;
+};

diff --git a/bin/tests/system/checkconf/good-empty-trust-anchors.conf b/bin/tests/system/checkconf/good-empty-trust-anchors.conf
new file mode 100644 (file)
index 0000000..f6277a3
--- /dev/null
+++ b/bin/tests/system/checkconf/good-empty-trust-anchors.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dnssec-validation yes;
+};
+
+trust-anchors {};

diff --git a/bin/tests/system/checkconf/good-empty-trusted-keys.conf b/bin/tests/system/checkconf/good-empty-trusted-keys.conf
new file mode 100644 (file)
index 0000000..b153d45
--- /dev/null
+++ b/bin/tests/system/checkconf/good-empty-trusted-keys.conf
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dnssec-validation yes;
+};
+
+trusted-keys {};

diff --git a/bin/tests/system/checkconf/good-nonempty-trust-anchors.conf b/bin/tests/system/checkconf/good-nonempty-trust-anchors.conf
new file mode 100644 (file)
index 0000000..8f9e048
--- /dev/null
+++ b/bin/tests/system/checkconf/good-nonempty-trust-anchors.conf
@@ -0,0 +1,20 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dnssec-validation yes;
+};
+
+trust-anchors {
+    example. static-ds 60724 5 2 "29E79B9064EE1A11DF3BFF19581DDFED7952C22CC204ACE17B6007EB1437E9E6";
+};

diff --git a/bin/tests/system/checkconf/good-nonempty-trusted-keys.conf b/bin/tests/system/checkconf/good-nonempty-trusted-keys.conf
new file mode 100644 (file)
index 0000000..43c9b49
--- /dev/null
+++ b/bin/tests/system/checkconf/good-nonempty-trusted-keys.conf
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dnssec-validation yes;
+};
+
+trusted-keys {
+       example. 257 3 8 "AwEAAawvFp8GlBx8Qt6yaIqXkDe+nMkSk2HkTAG7qlVBo++AQwZ1j3Xl
+               25IN4jsw0VTMbKUbafw9DYsVzztIwx1sNkKRLo6qP9SSkBL8RicQaafG
+               tURtsYI3oqte5qqLve1CUpRD8J06Pg1xkOxsDlz9sQAyiQrOyvMbykJY
+               kYrFYGLzYAgl/JtMyVVYlBl9pqxQuAPKYPOuO1axaad/wLN3+wTy/hcJ
+               fpvJpqzXlDF9bI5RmpoX/7geZ06vpcYJEoT0xkkmPlEl0ZjEDrm/WIaS
+               WG0/CEDpHcOXFz4OEczMVpY+lnuFfKybwF1WHFn2BwVEOS6cMM6ukIjI
+               NQyrszHhWUU=";
+};