Add test for "insecure" policy

While it is meant to be used for transitioning a zone to insecure,
add a test case where a zone uses the "insecure" policy immediately.

The zone will go through DNSSEC maintenance, but the outcome should
be the same as 'dnssec-policy none;', that is the zone should be
unsigned.

(cherry picked from commit 9c6ff463fdd26aab45dd95b68d6c0816da753545)

diff --git a/bin/tests/system/kasp/ns3/named.conf.in b/bin/tests/system/kasp/ns3/named.conf.in
index 28e9c6aee3230effbeaf9148df726c80e3baa670..6e6f7bfa06e6de0d8619b005b67cfc5878c79764 100644 (file)
--- a/bin/tests/system/kasp/ns3/named.conf.in
+++ b/bin/tests/system/kasp/ns3/named.conf.in
@@ -100,6 +100,13 @@ zone "unsigned.kasp" {
        dnssec-policy "none";
 };
 
+/* A zone that is initially set to insecure. */
+zone "insecure.kasp" {
+       type primary;
+       file "insecure.kasp.db";
+       dnssec-policy "insecure";
+};
+
 /* A master zone with dnssec-policy but keys already created. */
 zone "dnssec-keygen.kasp" {
        type primary;

diff --git a/bin/tests/system/kasp/ns3/setup.sh b/bin/tests/system/kasp/ns3/setup.sh
index 13c14839ab9e571f4bbfd63b51c3e251064e42b5..c6666758f9ce84f767ce5241225da499907267e4 100644 (file)
--- a/bin/tests/system/kasp/ns3/setup.sh
+++ b/bin/tests/system/kasp/ns3/setup.sh
@@ -79,6 +79,13 @@ zonefile="${zone}.db"
 infile="${zone}.db.infile"
 cp template.db.in $zonefile
 
+# Set up zone that stays unsigned.
+zone="insecure.kasp"
+echo_i "setting up zone: $zone"
+zonefile="${zone}.db"
+infile="${zone}.db.infile"
+cp template.db.in $zonefile
+
 # Some of these zones already have keys.
 zone="dnssec-keygen.kasp"
 $KEYGEN -k rsasha1 -l policies/kasp.conf $zone > keygen.out.$zone.1 2>&1

diff --git a/bin/tests/system/kasp/tests.sh b/bin/tests/system/kasp/tests.sh
index d033b7d11c5b2007e8f0be06e0795a8175cd57df..71258b9f55cab57d47921a7307dc29f730b8e49b 100644 (file)
--- a/bin/tests/system/kasp/tests.sh
+++ b/bin/tests/system/kasp/tests.sh
@@ -785,6 +785,23 @@ check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
 check_apex
 check_subdomain
 
+#
+# Zone: insecure.kasp.
+#
+set_zone "insecure.kasp"
+set_policy "insecure" "0" "0"
+set_server "ns3" "10.53.0.3"
+
+key_clear "KEY1"
+key_clear "KEY2"
+key_clear "KEY3"
+key_clear "KEY4"
+
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE"
+check_apex
+check_subdomain
+
 #
 # Zone: unlimited.kasp.
 #