GitLab

It didn't work properly due to negative trust anchor being outside a
zone cut, so I move the tested names to an unsigned zone.

root.db: the only real change was addition of "unsigned." delegation,
causing root-key-sentinel-not-ta-48409.test. NSEC to get modified.
The other changes are just reordering and drops of "resign=" lines;
I'm not sure why dnssec-signzone decided to do such changes.
(I didn't put the unsigned. zone into any zone file.)

https://gitlab.labs.nic.cz/knot/knot-resolver/merge_requests/544

The test logic was inverted, so it was expecting SERVFAIL instead of
NOERROR and the other way around.

I'm not sure if it's a good approach, but I think it will do for now.

I'm not sure why it started to matter now in kresd WIP code,
but it was a bug in the test anyway.

All unknown (and, formerly, silently ignored) keywords were removed from
existing tests. This allows us to detect typos.

Tests working with current version of kresd.
Import from git-svn-id: file:///svn/unbound/trunk@4299 be551aaa-1e26-0410-a405-d3ace91eadb9

DLV tests were skipped because DLV is dead now.

The steps get split in two, with the authoritative parts getting copied.
When it's possible to INCLUDE, this should get refactored.

kresd now won't put them into answer even in wildcarded cases.
Required for:
https://gitlab.labs.nic.cz/knot/knot-resolver/merge_requests/371

These tests check whether DNSSEC validator detects data
with invalid signatures.

Directory rfc5011 contains test generator which can be used to
re-generate the test from scratch. This will get handy when we decide to
generate more RFC 5011 test cases like that.

There is a trick:
Original answer to query `. NS` contains a lot of NS names which are not
interesting for the test itself. The additional section supplies just
single IP address and the test does not contain root-servers.net. domain
and related infrastructure. This works with current kresd but might
break in future if kresd starts to require all names (or IPv6 or so).

The test stopped working because of expired RRSIGs.
This is now fixed by faking system time into middle of validity interval.

In current kresd implementation, in some cases it requires existence
of RRSIGs and DNSKEYs even if the zone uses an unknown algorithm.
There seems no indication that missing those records should be OK for
some future algorithms, so we fix the test instead of kresd, for now.

That mailing-list message explains is best.

www.lidovky.cz CNAME c23.idnes.cz points from signed domain into unsigned
domain hosted on the same server. The result must be NOERROR without AD flag.

Modifications done with intent to make tests compatible with query name
minimization changed nature of the test. Now the test is simulating the
same problem as before and supports query name minimization at the same
time.

Fixup 2bfa632c.

Infrastructure records for net. subtree were missing.
The test now works with Unbound as well.

Infrastructure records for net. subtree were missing.
The test now works with Unbound as well.

These tests should not be affected by query minimization so it is not
worth the complexity added by entries required for query minimization.

These tests should not be affected by query minimization so it is not
worth the complexity added by entries required for query minimization.

The test now works with Unbound as well.

The test now works with Unbound as well.

The test now works with Unbound as well.

The test now works with Unbound as well.

The test now works with Unbound as well.