From: Evan Hunt <each@isc.org>
Date: Wed, 11 Apr 2012 22:28:23 +0000 (-0700)
Subject: Report KSK's that are missing from DS/DLV RRset
X-Git-Tag: v9.10.0a1~1062^2~12
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=0436d5cc0f2aae87766e0766a733691d45bc9ad4;p=thirdparty%2Fbind9.git

Report KSK's that are missing from DS/DLV RRset
---

diff --git a/contrib/dnssec/checkds.py b/contrib/dnssec/checkds.py
index d4603a42849..4a23385eefe 100644
--- a/contrib/dnssec/checkds.py
+++ b/contrib/dnssec/checkds.py
@@ -170,9 +170,9 @@ def checkds(zone, masterfile = None):
                    (ds.rrname.strip('.'), ds.keyalg,
                     ds.keyid, DSRR.hashalgs[ds.hashalg]))
             found = True
-
-    if not found:
-        print ("No DS records found covering %s/DNSKEY" % zone)
+        else:
+            print ("No DS records found for KSK %s/%03d/%05d" %
+                   (ds.rrname, ds.keyalg, ds.keyid))
 
     return found
 
@@ -216,9 +216,9 @@ def checkdlv(zone, lookaside, masterfile = None):
                    (dlv.parent, dlv.keyalg, dlv.keyid,
                     DLVRR.hashalgs[dlv.hashalg], dlv.dlvname))
             found = True
-
-    if not found:
-        print ("No DLV records found covering %s/DNSKEY" % zone)
+        else:
+            print ("No DLV records found for KSK %s/%03d/%05d in %s" %
+                   (dlv.parent, dlv.keyalg, dlv.keyid, dlv.dlvname))
 
     return found
 
diff --git a/contrib/dnssec/tests/tests.sh b/contrib/dnssec/tests/tests.sh
index 27bd947221d..af090b29e54 100644
--- a/contrib/dnssec/tests/tests.sh
+++ b/contrib/dnssec/tests/tests.sh
@@ -100,7 +100,7 @@ ret=0
 $CHECKDS missing.example > checkds.out.$n || ret=1
 grep 'SHA-1' checkds.out.$n > /dev/null 2>&1 || ret=1
 grep 'SHA-256' checkds.out.$n > /dev/null 2>&1 || ret=1
-grep 'DS missing' checkds.out.$n > /dev/null 2>&1 || ret=1
+grep 'No DS' checkds.out.$n > /dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
@@ -110,7 +110,7 @@ ret=0
 $CHECKDS -f missing.example.dnskey.db missing.example > checkds.out.$n || ret=1
 grep 'SHA-1' checkds.out.$n > /dev/null 2>&1 || ret=1
 grep 'SHA-256' checkds.out.$n > /dev/null 2>&1 || ret=1
-grep 'DS missing' checkds.out.$n > /dev/null 2>&1 || ret=1
+grep 'No DS' checkds.out.$n > /dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
@@ -120,7 +120,7 @@ ret=0
 $CHECKDS -l dlv.example missing.example > checkds.out.$n || ret=1
 grep 'SHA-1' checkds.out.$n > /dev/null 2>&1 || ret=1
 grep 'SHA-256' checkds.out.$n > /dev/null 2>&1 || ret=1
-grep 'DS missing' checkds.out.$n > /dev/null 2>&1 || ret=1
+grep 'No DLV' checkds.out.$n > /dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
@@ -130,7 +130,7 @@ ret=0
 $CHECKDS -l dlv.example -f missing.example.dnskey.db missing.example > checkds.out.$n || ret=1
 grep 'SHA-1' checkds.out.$n > /dev/null 2>&1 || ret=1
 grep 'SHA-256' checkds.out.$n > /dev/null 2>&1 || ret=1
-grep 'DS missing' checkds.out.$n > /dev/null 2>&1 || ret=1
+grep 'No DLV' checkds.out.$n > /dev/null 2>&1 || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`