205 lines
8.3 KiB
Markdown
205 lines
8.3 KiB
Markdown
|
# Specification of Test Scenarios for DNSSEC07
|
||
|
|
|
||
|
|
|
||
|
|
## Table of contents
|
||
|
|
|
||
|
|
* [Background](#background)
|
||
|
|
* [Test Case](#test-case)
|
||
|
|
* [Test scenarios](#test-scenarios)
|
||
|
|
* [Test zone names](#test-zone-names)
|
||
|
|
* [All message tags](#all-message-tags)
|
||
|
|
* [Test scenarios and message tags](#test-scenarios-and-message-tags)
|
||
|
|
* [Test scenarios and setup of test zones]
|
||
|
|
|
||
|
|
|
||
|
|
## Background
|
||
|
|
|
||
|
|
See the [test scenario README file].
|
||
|
|
|
||
|
|
|
||
|
|
## Test Case
|
||
|
|
|
||
|
|
This document specifies defined test scenarios for test case [DNSSEC07].
|
||
|
|
|
||
|
|
|
||
|
|
## Test scenarios
|
||
|
|
|
||
|
|
The purpose of the test scenarios is to cover all reasonable contexts where
|
||
|
|
different message tags are outputted when [DNSSEC07] is run on a test zone. The
|
||
|
|
message tags are defined in the test case ([DNSSEC07]) and the scenarios are
|
||
|
|
defined below.
|
||
|
|
|
||
|
|
The test scenarios are structured as stated in the [test scenario README file].
|
||
|
|
|
||
|
|
|
||
|
|
## Test zone names
|
||
|
|
|
||
|
|
The test zone or zones for each test scenario in this document is a subdomain
|
||
|
|
(or lower zone) delegated from the base name (`dnssec07.xa`) and that subdomain
|
||
|
|
having the same name as the scenario. The names of those zones are given in
|
||
|
|
section "[Test scenarios and setup of test zones]" below.
|
||
|
|
|
||
|
|
|
||
|
|
## All message tags
|
||
|
|
|
||
|
|
The test case can output any of these message tags, but not necessarily in any
|
||
|
|
combination. See [DNSSEC07] for the specification of the tags.
|
||
|
|
|
||
|
|
* DS07_DS_FOR_SIGNED_ZONE
|
||
|
|
* DS07_DS_ON_PARENT_SERVER
|
||
|
|
* DS07_INCONSISTENT_DS
|
||
|
|
* DS07_INCONSISTENT_SIGNED
|
||
|
|
* DS07_NON_AUTH_RESPONSE_DNSKEY
|
||
|
|
* DS07_NOT_SIGNED
|
||
|
|
* DS07_NOT_SIGNED_ON_SERVER
|
||
|
|
* DS07_NO_DS_ON_PARENT_SERVER
|
||
|
|
* DS07_NO_DS_FOR_SIGNED_ZONE
|
||
|
|
* DS07_NO_RESPONSE_DNSKEY
|
||
|
|
* DS07_SIGNED
|
||
|
|
* DS07_SIGNED_ON_SERVER
|
||
|
|
* DS07_UNEXP_RCODE_RESP_DNSKEY
|
||
|
|
|
||
|
|
|
||
|
|
## Test scenarios and message tags
|
||
|
|
|
||
|
|
If a message tag is not listed for the scenario, its presence or non-presence is
|
||
|
|
irrelevant to the test scenario and must be ignored.
|
||
|
|
|
||
|
|
| Scenario name | Mandatory tags | Forbidden tags |
|
||
|
|
|:---------------------------|:---------------------------------------------------------------------------------------------------------------------|:---------------|
|
||
|
|
| SIGNED-AND-DS-1 | DS07_DS_FOR_SIGNED_ZONE, DS07_DS_ON_PARENT_SERVER, DS07_SIGNED, DS07_SIGNED_ON_SERVER | 2) |
|
||
|
|
| SIGNED-NO-DS-1 | DS07_NO_DS_ON_PARENT_SERVER, DS07_NO_DS_FOR_SIGNED_ZONE, DS07_SIGNED, DS07_SIGNED_ON_SERVER | 2) |
|
||
|
|
| INCONSIST-SIGNED-AND-DS-1 | DS07_DS_ON_PARENT_SERVER, DS07_INCONSISTENT_SIGNED, DS07_NOT_SIGNED_ON_SERVER, DS07_SIGNED_ON_SERVER | 2) |
|
||
|
|
| INCONSIST-SIGNED-NO-DS-1 | DS07_INCONSISTENT_SIGNED, DS07_NOT_SIGNED_ON_SERVER, DS07_NO_DS_ON_PARENT_SERVER, DS07_SIGNED_ON_SERVER | 2) |
|
||
|
|
| SIGNED-AND-INCONSIST-DS-1 | DS07_DS_ON_PARENT_SERVER, DS07_INCONSISTENT_DS, DS07_NO_DS_ON_PARENT_SERVER, DS07_SIGNED, DS07_SIGNED_ON_SERVER | 2) |
|
||
|
|
| UNSIGNED-AND-DS-1 | DS07_NOT_SIGNED, DS07_NOT_SIGNED_ON_SERVER | 2) |
|
||
|
|
| UNSIGNED-NO-DS-1 | DS07_NOT_SIGNED, DS07_NOT_SIGNED_ON_SERVER | 2) |
|
||
|
|
| NON-AUTH-RESPONSE-DNSKEY-1 | DS07_NON_AUTH_RESPONSE_DNSKEY, DS07_SIGNED, DS07_SIGNED_ON_SERVER, DS07_DS_ON_PARENT_SERVER, DS07_DS_FOR_SIGNED_ZONE | 2) |
|
||
|
|
| NO-RESPONSE-DNSKEY-1 | DS07_SIGNED, DS07_SIGNED_ON_SERVER, DS07_NO_RESPONSE_DNSKEY, DS07_DS_ON_PARENT_SERVER, DS07_DS_FOR_SIGNED_ZONE | 2) |
|
||
|
|
| UNEXP-RCODE-RESP-DNSKEY-1 | DS07_SIGNED, DS07_SIGNED_ON_SERVER, DS07_UNEXP_RCODE_RESP_DNSKEY, DS07_DS_ON_PARENT_SERVER, DS07_DS_FOR_SIGNED_ZONE | 2) |
|
||
|
|
|
||
|
|
|
||
|
|
* (1) All tags except for those specified as "Forbidden tags" (no instances for these test scenarios)
|
||
|
|
* (2) All tags except for those specified as "Mandatory tags"
|
||
|
|
|
||
|
|
## Test scenarios and setup of test zones
|
||
|
|
|
||
|
|
### Default zone configuration
|
||
|
|
Unless otherwise specified in the specific scenario specification, the test zone
|
||
|
|
or zones for the scenario will follow the default setup as stated below. The
|
||
|
|
`child zone` is the zone to be tested for the scenario.
|
||
|
|
|
||
|
|
* The child zone is `SCENARIO.dnssec07.xa`.
|
||
|
|
* It is delegated to two name servers, `ns1.SCENARIO.dnssec07.xa`
|
||
|
|
and `ns2.SCENARIO.dnssec07.xa`.
|
||
|
|
* The name server names have A and AAAA records to avoid non-relevant error
|
||
|
|
messages.
|
||
|
|
* The delegation of the child zone is to an IB NS.
|
||
|
|
* There is a zone file for the child zone.
|
||
|
|
* All child zone servers give the same response.
|
||
|
|
* The only responses, with data queried for, to the child zone that can be assumed are queries for
|
||
|
|
* NS
|
||
|
|
* SOA
|
||
|
|
* DNSKEY
|
||
|
|
* Response on DNSKEY query will include RRSIG, others will not.
|
||
|
|
* The parent zone is `dnssec07.xa`.
|
||
|
|
* It is served by two in-bailiwick NS (ns1 and ns2).
|
||
|
|
* ns1 and ns2 have the same zone content.
|
||
|
|
* ns1 and ns2 have both IPv4 and IPv6 glue.
|
||
|
|
* The records matching glue in the zone are complete.
|
||
|
|
* The parent zone will respond with one DS record per child zone.
|
||
|
|
* The only responses to the parent zone that can be assumed are queries for
|
||
|
|
* NS
|
||
|
|
* SOA
|
||
|
|
* DNSKEY
|
||
|
|
* delegation of the child
|
||
|
|
* DS for child
|
||
|
|
* Response on DS query will include RRSIG, others will not.
|
||
|
|
* All responses will have the AA bit set.
|
||
|
|
* All responses will have the [RCODE Name] "NoError".
|
||
|
|
* The DS digest algorithm is 2.
|
||
|
|
* The DS will not correctly match DNSKEY.
|
||
|
|
* The zones are not signed.
|
||
|
|
|
||
|
|
### SIGNED-AND-DS-1
|
||
|
|
All is good with signed zone and DS record in parent.
|
||
|
|
|
||
|
|
* Zone: signed-and-ds-1.dnssec07.xa.
|
||
|
|
* All default settings.
|
||
|
|
|
||
|
|
### SIGNED-NO-DS-1
|
||
|
|
The child zone is signed, but no DS in parent.
|
||
|
|
|
||
|
|
* Zone: signed-no-ds-1.dnssec07.xa.
|
||
|
|
* The child zone has default settings.
|
||
|
|
* The parent zone has no DS for the child zone.
|
||
|
|
|
||
|
|
### INCONSIST-SIGNED-AND-DS-1
|
||
|
|
The child is signed on ns1 but not on ns2.
|
||
|
|
|
||
|
|
* Zone: inconsist-signed-and-ds-1.dnssec07.xa.
|
||
|
|
* Response from ns1 with DNSKEY.
|
||
|
|
* Response from ns2 without DNSKEY.
|
||
|
|
|
||
|
|
### INCONSIST-SIGNED-NO-DS-1
|
||
|
|
The child is signed on ns1 but not on ns2.
|
||
|
|
|
||
|
|
* Zone: inconsist-signed-no-ds-1.dnssec07.xa.
|
||
|
|
* Response from ns1 with DNSKEY.
|
||
|
|
* Response from ns2 without DNSKEY.
|
||
|
|
* Parent provides no DS.
|
||
|
|
|
||
|
|
### SIGNED-AND-INCONSIST-DS-1
|
||
|
|
Parent provides DS on one server, but not the other.
|
||
|
|
|
||
|
|
* Zone: child.signed-and-inconsist-ds-1.dnssec07.xa.
|
||
|
|
* Grandparent zone is dnssec07.xa.
|
||
|
|
* Parent zone is signed-and-inconsist-ds-1.dnssec07.xa.
|
||
|
|
* ns1 provides DS, ns2 does not.
|
||
|
|
* Child zone is child.signed-and-inconsist-ds-1.dnssec07.xa.
|
||
|
|
* Child zone is signed.
|
||
|
|
|
||
|
|
### UNSIGNED-AND-DS-1
|
||
|
|
Both NS respond with no DNSKEY. Parent has NS but it is disregarded.
|
||
|
|
|
||
|
|
* Zone: unsigned-and-ds-1.dnssec07.xa.
|
||
|
|
* ns1 and ns2 respond with NO DATA on DNSKEY query.
|
||
|
|
* Parent provides DS record, but it is not expected to be queried for.
|
||
|
|
|
||
|
|
### UNSIGNED-NO-DS-1
|
||
|
|
Both NS respond with no DNSKEY. Parent has NS but it is disregarded.
|
||
|
|
|
||
|
|
* Zone: unsigned-no-ds-1.dnssec07.xa.
|
||
|
|
* ns1 and ns2 respond with NODATA on DNSKEY query.
|
||
|
|
* Parent provides no DS record, but it is not expected to be queried for.
|
||
|
|
|
||
|
|
### NON-AUTH-RESPONSE-DNSKEY-1
|
||
|
|
One server responds with non-authoritative DNSKEY response.
|
||
|
|
|
||
|
|
* Zone: non-auth-response-dnskey-1.dnssec07.xa.
|
||
|
|
* ns1 responds with AA bit unset on DNSKEY query.
|
||
|
|
* Other queries have normal responses.
|
||
|
|
* Normal responses from ns2.
|
||
|
|
|
||
|
|
### NO-RESPONSE-DNSKEY-1
|
||
|
|
One server does not respond on DNSKEY query.
|
||
|
|
|
||
|
|
* Zone: no-response-dnskey-1.dnssec07.xa.
|
||
|
|
* ns1 does not respond on the DNSKEY query.
|
||
|
|
* Other queries have normal responses.
|
||
|
|
* Normal responses from ns2.
|
||
|
|
|
||
|
|
### UNEXP-RCODE-RESP-DNSKEY-1
|
||
|
|
One server give unexpected RCODE in response on DNSKEY query.
|
||
|
|
|
||
|
|
* Zone: unexp-rcode-resp-dnskey-1.dnssec07.xa.
|
||
|
|
* ns1 responds with RCODE REFUSED on the DNSKEY query.
|
||
|
|
* Other queries have normal responses.
|
||
|
|
* Normal responses from ns2.
|
||
|
|
|
||
|
|
|
||
|
|
[DNSSEC07]: ../../tests/DNSSEC-TP/dnssec07.md
|
||
|
|
[RCODE Name]: https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6
|
||
|
|
[Test scenario README file]: ../README.md
|
||
|
|
[Test scenarios and setup of test zones]: #test-scenarios-and-setup-of-test-zones
|