abrown38andClaude Opus 5.5
5630e7a848
Zones get a DNSSEC setting: named signs them with BIND's default (or a custom) dnssec-policy and inline signing, with keys in a per-view key directory. Jarl shows the keys, the DS record and when it is safe to publish it, checks the parent's DS records (check-ds, which also tells named), and refuses steps that would break a signed domain: switching straight to unsigned, finishing a turn-off too early, deleting or moving a signed zone, TTLs above max-zone-ttl. Turning off goes through the insecure policy; wipe starts over once the parent has no DS. Backups store the DNSSEC keys and restore puts them back for named; the backup unit gets CAP_DAC_READ_SEARCH to read them. Jarl raises a zone's serial above named's whenever it writes an older one (after a restore). The serials check compares the signed serial. With a Porkbun API key in jarl.yaml, the registrar's name servers, glue records and DS records can be shown and changed, each change checked first (dry run, force to override). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
50 lines
1.7 KiB
Go
50 lines
1.7 KiB
Go
package bind
|
|
|
|
import "testing"
|
|
|
|
func TestResultClassification(t *testing.T) {
|
|
// named-checkconf exited 0: everything it printed is a warning.
|
|
ok := newResult(`both "recursion no;" and "allow-recursion" active for view external
|
|
zone example.com/IN/internal: loaded serial 1
|
|
`, 0)
|
|
if !ok.OK || len(ok.Messages) != 2 || ok.Messages[0].Error || ok.Messages[1].Error {
|
|
t.Errorf("exit 0: %+v", ok)
|
|
}
|
|
// Non-zero exit: real problems stay errors.
|
|
bad := newResult(`/etc/bind/jarl/named.conf:12: unknown option 'recursoin'
|
|
`, 1)
|
|
if bad.OK || len(bad.Messages) != 1 || !bad.Messages[0].Error || bad.Messages[0].Line != 12 {
|
|
t.Errorf("exit 1: %+v", bad)
|
|
}
|
|
}
|
|
|
|
func TestParseZoneStatusSigned(t *testing.T) {
|
|
// rndc zonestatus of a zone named signs with dnssec-policy (BIND 9.20).
|
|
zs := ParseZoneStatus(`name: example.test
|
|
type: primary
|
|
files: /var/lib/bind/jarl/_default/example.test.zone
|
|
serial: 2026100802
|
|
signed serial: 2026100804
|
|
nodes: 4
|
|
last loaded: Thu, 08 Oct 2026 19:03:31 GMT
|
|
secure: yes
|
|
inline signing: yes
|
|
key maintenance: automatic
|
|
next key event: Thu, 08 Oct 2026 21:08:31 GMT
|
|
next resign node: new.example.test/A
|
|
next resign time: Sat, 17 Oct 2026 07:32:59 GMT
|
|
dynamic: no
|
|
reconfigurable via modzone: no
|
|
`)
|
|
if zs.Serial != 2026100802 || zs.SignedSerial != 2026100804 || !zs.Secure || !zs.InlineSigning || zs.NextKeyEvent != "Thu, 08 Oct 2026 21:08:31 GMT" {
|
|
t.Errorf("%+v", zs)
|
|
}
|
|
if s, ok := zs.ServedSerial(); !ok || s != 2026100804 {
|
|
t.Errorf("served serial %d %v", s, ok)
|
|
}
|
|
plain := ParseZoneStatus("name: example.com\nserial: 7\nsecure: no\n")
|
|
if s, ok := plain.ServedSerial(); !ok || s != 7 || plain.HasSignedSerial {
|
|
t.Errorf("unsigned: %+v", plain)
|
|
}
|
|
}
|