From dbd2cb722c2cb8d5a0b60a8a5c5c26c9e6cb2b8f Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 27 Jul 2022 08:46:23 +0200 Subject: [PATCH] Tests: Explicityl disable DNSSEC for zone ftl. Signed-off-by: DL6ER --- test/pdns/recursor.conf | 9 +++++++++ test/pdns/setup.sh | 15 +++++---------- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/test/pdns/recursor.conf b/test/pdns/recursor.conf index 6919a556..06f40946 100644 --- a/test/pdns/recursor.conf +++ b/test/pdns/recursor.conf @@ -12,3 +12,12 @@ local-address=127.0.0.1:5555 # Use authoritative server for ftl. and arpa. zones forward-zones=ftl=127.0.0.1:5554,168.192.in-addr.arpa=127.0.0.1:5554,ip6.arpa=127.0.0.1:5554 + +# In this mode the Recursor acts as a “security aware, non-validating” +# nameserver, meaning it will set the DO-bit on outgoing queries and will +# provide DNSSEC related RRsets (NSEC, RRSIG) to clients that ask for them (by +# means of a DO-bit in the query), except for zones provided through the +# auth-zones setting. It will not do any validation in this mode, not even when +# requested by the client. +# The default mode until PowerDNS Recursor 4.5.0. +dnssec=process-no-validate diff --git a/test/pdns/setup.sh b/test/pdns/setup.sh index a5832674..a751f85e 100644 --- a/test/pdns/setup.sh +++ b/test/pdns/setup.sh @@ -40,7 +40,7 @@ else fi # Create zone ftl pdnsutil create-zone ftl ns1.ftl -pdnsutil add-record ftl. . SOA "ns1.ftl. hostmaster.ftl. 1 10800 3600 604800 3600" +pdnsutil disable-dnssec ftl # Create A records pdnsutil add-record ftl. a A 192.168.1.1 @@ -92,17 +92,10 @@ pdnsutil add-record ftl. naptr NAPTR '20 10 "s" "http+N2L+N2C+N2R" "" ftl.' pdnsutil add-record ftl. mx MX "50 ns1.ftl." # SVCB + HTTPS -if ! pdnsutil add-record ftl. svcb SVCB '1 port="80"'; then - # see RFC3597: Handling of Unknown DNS Resource Record (RR) Types - # and https://ypcs.fi/howto/2020/09/30/announce-https-via-dns/ - pdnsutil add-record ftl. svcb TYPE64 "\# 13 000109706F72743D2238302200" -fi +pdnsutil add-record ftl. svcb SVCB '1 port="80"' # HTTPS -if ! pdnsutil add-record ftl. https HTTPS '1 . alpn="h3,h2"'; then - # comment above applies - pdnsutil add-record ftl. https TYPE65 "\# 13 00010000010006026833026832" -fi +pdnsutil add-record ftl. https HTTPS '1 . alpn="h3,h2"' # Create reverse lookup zone pdnsutil create-zone arpa ns1.ftl @@ -120,6 +113,8 @@ pdnsutil rectify-all-zones pdnsutil check-zone ftl pdnsutil check-zone arpa +pdnsutil list-all-zones + echo "********* Done installing PowerDNS configuration **********" # Start services