Add test case for in-view with dnssec-policy

Add a test case for a zone that uses 'in-view' and 'dnssec-policy'.
BIND should not deadlock.

diff --git a/bin/tests/system/kasp.sh b/bin/tests/system/kasp.sh
index d21839a08bda57c70adbaf95621d76ec22fa68be..0129374d717f8d219aa4a7f427235f7558cb4989 100644 (file)
--- a/bin/tests/system/kasp.sh
+++ b/bin/tests/system/kasp.sh
@@ -31,6 +31,7 @@ SHA224="hXfwwwiag2QGqblopofai9NuW28q/1rH4CaTnA=="
 SHA256="R16NojROxtxH/xbDl//ehDsHm5DjWTQ2YXV+hGC2iBY="
 VIEW1="YPfMoAk6h+3iN8MDRQC004iSNHY="
 VIEW2="4xILSZQnuO1UKubXHkYUsvBRPu8="
+VIEW3="C1Azf+gGPMmxrUg/WQINP6eV9Y0="
 
 ###############################################################################
 # Key properties                                                              #

diff --git a/bin/tests/system/kasp/ns4/named.conf.in b/bin/tests/system/kasp/ns4/named.conf.in
index 5743d71ac180f2af15b64ab60b09d70ac0f23f9d..b1f87fdf441e8a992f54cac67c1b88735f837b62 100644 (file)
--- a/bin/tests/system/kasp/ns4/named.conf.in
+++ b/bin/tests/system/kasp/ns4/named.conf.in
@@ -45,6 +45,11 @@ key "keyforview2" {
        secret "4xILSZQnuO1UKubXHkYUsvBRPu8=";
 };
 
+key "keyforview3" {
+       algorithm "hmac-sha1";
+       secret "C1Azf+gGPMmxrUg/WQINP6eV9Y0=";
+};
+
 dnssec-policy "test" {
        keys {
                csk key-directory lifetime 0 algorithm 14;
@@ -152,3 +157,10 @@ view "example2" {
                file "example2.db";
        };
 };
+
+view "example3" {
+       match-clients { key "keyforview3"; };
+       zone "example.net" {
+               in-view example2;
+       };
+};

diff --git a/bin/tests/system/kasp/tests.sh b/bin/tests/system/kasp/tests.sh
index d970491f2c2c46a32bcb2c9444938fbef0bc4a22..aa84ebe43fcd1a8d70ba2c7c9ccc78ccd339f53d 100644 (file)
--- a/bin/tests/system/kasp/tests.sh
+++ b/bin/tests/system/kasp/tests.sh
@@ -1829,6 +1829,7 @@ check_apex
 check_subdomain
 dnssec_verify
 
+# Test with views.
 set_zone "example.net"
 set_server "ns4" "10.53.0.4"
 TSIG="hmac-sha1:keyforview1:$VIEW1"
@@ -1867,6 +1868,23 @@ check_signatures TXT "dig.out.$DIR.test$n.txt" "ZSK"
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+TSIG="hmac-sha1:keyforview3:$VIEW3"
+wait_for_nsec
+check_keys
+check_dnssecstatus "$SERVER" "$POLICY" "$ZONE" "example2"
+check_apex
+dnssec_verify
+n=$((n+1))
+# check subdomain
+echo_i "check TXT example.net (in-view example2) rrset is signed correctly ($n)"
+ret=0
+dig_with_opts "view.${ZONE}" "@${SERVER}" TXT > "dig.out.$DIR.test$n.txt" || log_error "dig view.${ZONE} TXT failed"
+grep "status: NOERROR" "dig.out.$DIR.test$n.txt" > /dev/null || log_error "mismatch status in DNS response"
+grep "view.${ZONE}\..*${DEFAULT_TTL}.*IN.*TXT.*view2" "dig.out.$DIR.test$n.txt" > /dev/null || log_error "missing view.${ZONE} TXT record in response"
+check_signatures TXT "dig.out.$DIR.test$n.txt" "ZSK"
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 # Clear TSIG.
 TSIG=""