312 lines
11 KiB
Markdown
312 lines
11 KiB
Markdown
|
# Specification of Test Scenarios for DNSSEC01
|
||
|
|
|
||
|
|
|
||
|
|
## Table of contents
|
||
|
|
|
||
|
|
* [Background](#background)
|
||
|
|
* [Test Case](#test-case)
|
||
|
|
* [Test scenarios](#test-scenarios)
|
||
|
|
* [Test zone names](#test-zone-names)
|
||
|
|
* [All message tags](#all-message-tags)
|
||
|
|
* [Test scenarios and message tags](#test-scenarios-and-message-tags)
|
||
|
|
* [Test scenarios and setup of test zones]
|
||
|
|
|
||
|
|
|
||
|
|
## Background
|
||
|
|
|
||
|
|
See the [test scenario README file].
|
||
|
|
|
||
|
|
|
||
|
|
## Test Case
|
||
|
|
|
||
|
|
This document specifies defined test scenarios for test case [DNSSEC01].
|
||
|
|
|
||
|
|
|
||
|
|
## Test scenarios
|
||
|
|
|
||
|
|
The purpose of the test scenarios is to cover all reasonable contexts where
|
||
|
|
different message tags are outputted when [DNSSEC01] is run on a test zone. The
|
||
|
|
message tags are defined in the test case ([DNSSEC01]) and the scenarios are
|
||
|
|
defined below.
|
||
|
|
|
||
|
|
The test scenarios are structured as stated in the [test scenario README file].
|
||
|
|
|
||
|
|
|
||
|
|
## Test zone names
|
||
|
|
|
||
|
|
The test zone or zones for each test scenario in this document is a subdomain
|
||
|
|
(or lower zone) delegated from the base name (`dnssec01.xa`) and that subdomain
|
||
|
|
having the same name as the scenario. The names of those zones are given in
|
||
|
|
section "[Test scenarios and setup of test zones]" below.
|
||
|
|
|
||
|
|
|
||
|
|
## All message tags
|
||
|
|
|
||
|
|
The test case can output any of these message tags, but not necessarily in any
|
||
|
|
combination. See [DNSSEC01] for the specification of the tags.
|
||
|
|
|
||
|
|
* DS01_DS_ALGO_2_MISSING
|
||
|
|
* DS01_DS_ALGO_DEPRECATED
|
||
|
|
* DS01_DS_ALGO_NOT_DS
|
||
|
|
* DS01_DS_ALGO_OK
|
||
|
|
* DS01_DS_ALGO_PRIVATE
|
||
|
|
* DS01_DS_ALGO_RESERVED
|
||
|
|
* DS01_DS_ALGO_UNASSIGNED
|
||
|
|
* DS01_NO_RESPONSE
|
||
|
|
* DS01_PARENT_SERVER_NO_DS
|
||
|
|
* DS01_PARENT_ZONE_NO_DS
|
||
|
|
* DS01_ROOT_N_NO_UNDEL_DS
|
||
|
|
* DS01_UNDEL_N_NO_UNDEL_DS
|
||
|
|
|
||
|
|
|
||
|
|
## Test scenarios and message tags
|
||
|
|
|
||
|
|
If a message tag is not listed for the scenario, its presence or non-presence is
|
||
|
|
irrelevant to the test scenario and must be ignored.
|
||
|
|
|
||
|
|
| Scenario name | Mandatory tags | Forbidden tags |
|
||
|
|
|:----------------------|:---------------------------------------------------------------|:---------------|
|
||
|
|
| ALGO-DEPRECATED-1 | DS01_DS_ALGO_DEPRECATED, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-DEPRECATED-3 | DS01_DS_ALGO_DEPRECATED, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-NOT-DS-0 | DS01_DS_ALGO_NOT_DS, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-OK-2 | DS01_DS_ALGO_OK | 2) |
|
||
|
|
| ALGO-OK-4 | DS01_DS_ALGO_OK, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-OK-5 | DS01_DS_ALGO_OK, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-OK-6 | DS01_DS_ALGO_OK, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-PRIVATE-253 | DS01_DS_ALGO_PRIVATE, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-PRIVATE-254 | DS01_DS_ALGO_PRIVATE, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-RESERVED-128 | DS01_DS_ALGO_RESERVED, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-RESERVED-188 | DS01_DS_ALGO_RESERVED, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-RESERVED-252 | DS01_DS_ALGO_RESERVED, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-UNASSIGNED-7 | DS01_DS_ALGO_UNASSIGNED, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-UNASSIGNED-67 | DS01_DS_ALGO_UNASSIGNED, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| ALGO-UNASSIGNED-127 | DS01_DS_ALGO_UNASSIGNED, DS01_DS_ALGO_2_MISSING | 2) |
|
||
|
|
| MIXED-ALGO-1 | DS01_DS_ALGO_DEPRECATED, DS01_DS_ALGO_PRIVATE, DS01_DS_ALGO_OK | 2) |
|
||
|
|
| SHARED-IP-1 | DS01_DS_ALGO_OK | 2) |
|
||
|
|
| SHARED-IP-2 | DS01_DS_ALGO_OK | 2) |
|
||
|
|
| NO-RESPONSE-1 | DS01_NO_RESPONSE | 2) |
|
||
|
|
| NO-VALID-RESPONSE-1 | DS01_NO_RESPONSE | 2) |
|
||
|
|
| PARENT-SERVER-NO-DS-1 | DS01_PARENT_SERVER_NO_DS, DS01_DS_ALGO_OK | 2) |
|
||
|
|
| PARENT-ZONE-NO-DS-1 | DS01_PARENT_ZONE_NO_DS | 2) |
|
||
|
|
| UNDEL-NO-UNDEL-DS-1 | DS01_UNDEL_N_NO_UNDEL_DS | 2) |
|
||
|
|
| UNDEL-WITH-UNDEL-DS-1 | DS01_DS_ALGO_OK | 2) |
|
||
|
|
| ROOT-NO-UNDEL-DS-1 | DS01_ROOT_N_NO_UNDEL_DS | 2) |
|
||
|
|
| ROOT-WITH-UNDEL-DS-1 | DS01_DS_ALGO_OK | 2) |
|
||
|
|
|
||
|
|
* (1) All tags except for those specified as "Forbidden tags" (no instances for these test scenarios)
|
||
|
|
* (2) All tags except for those specified as "Mandatory tags"
|
||
|
|
|
||
|
|
## Test scenarios and setup of test zones
|
||
|
|
|
||
|
|
### Default zone configuration
|
||
|
|
Unless otherwise specified in the specific scenario specification, the test zone
|
||
|
|
or zones for the scenario will follow the default setup as stated below. The
|
||
|
|
`child zone` is the zone to be tested for the scenario.
|
||
|
|
|
||
|
|
* The child zone is `SCENARIO.dnssec01.xa`.
|
||
|
|
* It is delegated to two name servers, `ns1.SCENARIO.dnssec01.xa`
|
||
|
|
and `ns2.SCENARIO.dnssec01.xa`.
|
||
|
|
* The name server names have A and AAAA records to avoid non-relevant error
|
||
|
|
messages.
|
||
|
|
* The delegation of the child zone is to an OOB NS.
|
||
|
|
* NS can be resolved through the `dnssec01.xa` zone.
|
||
|
|
* There is a zone file for the child zone.
|
||
|
|
* All child zone servers give the same response.
|
||
|
|
* The only responses that can be assumed are queries for
|
||
|
|
* NS
|
||
|
|
* SOA
|
||
|
|
* The parent zone will respond with one DS record per child zone.
|
||
|
|
* The parent zone is `dnssec01.xa`.
|
||
|
|
* It is served by two in-bailiwick NS (ns1 and ns2).
|
||
|
|
* ns1 and ns2 have the same zone content.
|
||
|
|
* ns1 and ns2 have both IPv4 and IPv6 glue.
|
||
|
|
* The records matching glue in the zone are complete.
|
||
|
|
* All responses will have the AA bit set.
|
||
|
|
* All responses will have the [RCODE Name] "NoError".
|
||
|
|
* The DS digest algorithm is 2 unless specified for the scenario.
|
||
|
|
* The DS record can be technically invalid. Only the format is valid and
|
||
|
|
only the digest algorithm value is checked.
|
||
|
|
* The zone is not signed.
|
||
|
|
|
||
|
|
### ALGO-DEPRECATED-1
|
||
|
|
The DS digest algorithm number is 1
|
||
|
|
|
||
|
|
* Zone: algo-deprecated-1.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 1.
|
||
|
|
|
||
|
|
### ALGO-DEPRECATED-3
|
||
|
|
The DS digest algorithm number is 3
|
||
|
|
|
||
|
|
* Zone: algo-deprecated-3.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 3.
|
||
|
|
|
||
|
|
### ALGO-RESERVED-128
|
||
|
|
The DS digest algorithm number is 128
|
||
|
|
|
||
|
|
* Zone: algo-reserved-128.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 128.
|
||
|
|
|
||
|
|
### ALGO-RESERVED-188
|
||
|
|
The DS digest algorithm number is 188
|
||
|
|
|
||
|
|
* Zone: algo-reserved-188.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 188.
|
||
|
|
|
||
|
|
### ALGO-RESERVED-252
|
||
|
|
The DS digest algorithm number is 252
|
||
|
|
|
||
|
|
* Zone: algo-reserved-252.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 252.
|
||
|
|
|
||
|
|
### ALGO-UNASSIGNED-7
|
||
|
|
The DS digest algorithm number is 7
|
||
|
|
|
||
|
|
* Zone: algo-unassigned-7.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 7.
|
||
|
|
|
||
|
|
### ALGO-UNASSIGNED-67
|
||
|
|
The DS digest algorithm number is 67
|
||
|
|
|
||
|
|
* Zone: algo-unassigned-67.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 67.
|
||
|
|
|
||
|
|
### ALGO-UNASSIGNED-127
|
||
|
|
The DS digest algorithm number is 127
|
||
|
|
|
||
|
|
* Zone: algo-unassigned-127.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 127.
|
||
|
|
|
||
|
|
### ALGO-PRIVATE-253
|
||
|
|
The DS digest algorithm number is 253
|
||
|
|
|
||
|
|
* Zone: algo-private-253.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 253.
|
||
|
|
|
||
|
|
### ALGO-PRIVATE-254
|
||
|
|
The DS digest algorithm number is 254
|
||
|
|
|
||
|
|
* Zone: algo-private-254.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 254.
|
||
|
|
|
||
|
|
### ALGO-NOT-DS-0
|
||
|
|
The DS digest algorithm number is 0
|
||
|
|
|
||
|
|
* Zone: algo-not-ds-0.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 0.
|
||
|
|
|
||
|
|
### ALGO-OK-2
|
||
|
|
The DS digest algorithm number is 2
|
||
|
|
|
||
|
|
* Zone: algo-ok-2.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 2.
|
||
|
|
|
||
|
|
### ALGO-OK-4
|
||
|
|
The DS digest algorithm number is 4
|
||
|
|
|
||
|
|
* Zone: algo-ok-4.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 4.
|
||
|
|
|
||
|
|
### ALGO-OK-5
|
||
|
|
The DS digest algorithm number is 5
|
||
|
|
|
||
|
|
* Zone: algo-ok-5.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 5.
|
||
|
|
|
||
|
|
### ALGO-OK-6
|
||
|
|
The DS digest algorithm number is 6
|
||
|
|
|
||
|
|
* Zone: algo-ok-6.dnssec01.xa.
|
||
|
|
* The algorithm of the DS digest in the response is 6.
|
||
|
|
|
||
|
|
### MIXED-ALGO-1
|
||
|
|
Three DS with different algorithms.
|
||
|
|
|
||
|
|
* Zone: mixed-algo-1.dnssec01.xa.
|
||
|
|
* The response has three DS with different algorithms:
|
||
|
|
* 1
|
||
|
|
* 2
|
||
|
|
* 253
|
||
|
|
|
||
|
|
### SHARED-IP-1
|
||
|
|
Two parent name servers resolv to the same IP address.
|
||
|
|
|
||
|
|
* Zone: child.shared-ip-1.dnssec01.xa.
|
||
|
|
* The parent zone is "shared-ip-1.dnssec01.xa" and the grandparent zone is
|
||
|
|
"dnssec01.xa".
|
||
|
|
* The parent is delegated to IB ns1a and ns1b with the same IPv4 and IPv6
|
||
|
|
addresses.
|
||
|
|
|
||
|
|
### SHARED-IP-2
|
||
|
|
Delegation of parent does not use the same name server name as parent zone.
|
||
|
|
|
||
|
|
* Zone: child.shared-ip-2.dnssec01.xa.
|
||
|
|
* The parent zone is "shared-ip-2.dnssec01.xa" and the grandparent zone is
|
||
|
|
"dnssec01.xa".
|
||
|
|
* The parent is delegated to IB ns1 and ns2, but in the parent zone the names
|
||
|
|
are dns1 and dns2.
|
||
|
|
* ns1 and dns1 resolve to the same IP addresses.
|
||
|
|
* ns2 and dns2 resolve to the same IP addresses.
|
||
|
|
|
||
|
|
### NO-RESPONSE-1
|
||
|
|
No response from any of the servers on the DS query.
|
||
|
|
|
||
|
|
* Zone: child.no-response-1.dnssec01.xa.
|
||
|
|
* No response at all from parent ns1 and ns2.
|
||
|
|
|
||
|
|
### NO-VALID-RESPONSE-1
|
||
|
|
No valid response from any of the servers on the DS query.
|
||
|
|
|
||
|
|
* Zone: child.no-valid-response-1.dnssec01.xa.
|
||
|
|
* Response from parent ns1 has RCODE SERVFAIL.
|
||
|
|
* Response from parent ns2 has RCODE REFUSED.
|
||
|
|
* Child zone does not exist
|
||
|
|
|
||
|
|
### PARENT-SERVER-NO-DS-1
|
||
|
|
No DS from parent ns1.
|
||
|
|
|
||
|
|
* Zone: child.parent-server-no-ds-1.dnssec01.xa.
|
||
|
|
* Response from parent ns1 is NODATA (no DS).
|
||
|
|
* Response from parent ns2 is normal.
|
||
|
|
|
||
|
|
### PARENT-ZONE-NO-DS-1
|
||
|
|
No DS from neither parent ns1 nor parent ns2.
|
||
|
|
|
||
|
|
* Zone: parent-zone-no-ds-1.dnssec01.xa.
|
||
|
|
* Responses from parent ns1 and parent ns2 are NODATA (no DS).
|
||
|
|
|
||
|
|
### UNDEL-NO-UNDEL-DS-1
|
||
|
|
Zone is not delegated, but undelegated data is provided. No DS.
|
||
|
|
|
||
|
|
* Zone: undel-no-undel-ds-1.dnssec01.xa.
|
||
|
|
* The zone is not delegated, but there is undelegated data.
|
||
|
|
* ns1 and ns2 are OOB.
|
||
|
|
* No undelegated DS is provided.
|
||
|
|
|
||
|
|
### UNDEL-WITH-UNDEL-DS-1
|
||
|
|
Zone is not delegated, but undelegated data is provided with DS.
|
||
|
|
|
||
|
|
* Zone: undel-with-undel-ds-1.dnssec01.xa.
|
||
|
|
* The zone is not delegated, but there is undelegated data.
|
||
|
|
* ns1 and ns2 are OOB.
|
||
|
|
* Undelegated DS is provided.
|
||
|
|
|
||
|
|
### ROOT-NO-UNDEL-DS-1
|
||
|
|
Zone is the root zone, and no undelegated DS is provided.
|
||
|
|
|
||
|
|
* Zone: "."
|
||
|
|
* ns1 and ns2 are IB.
|
||
|
|
* The zone exists.
|
||
|
|
|
||
|
|
### ROOT-WITH-UNDEL-DS-1
|
||
|
|
Zone is the root zone, and undelegated DS is provided.
|
||
|
|
|
||
|
|
* Zone: "."
|
||
|
|
* ns1 and ns2 are IB.
|
||
|
|
* The zone exists.
|
||
|
|
|
||
|
|
|
||
|
|
[DNSSEC01]: ../../tests/DNSSEC-TP/dnssec01.md
|
||
|
|
[RCODE Name]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6
|
||
|
|
[Test scenario README file]: ../README.md
|
||
|
|
[Test scenarios and setup of test zones]: #test-scenarios-and-setup-of-test-zones
|