diff options
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/test_dnssec.py | 52 |
1 files changed, 47 insertions, 5 deletions
diff --git a/tests/test_dnssec.py b/tests/test_dnssec.py index 07d7a9f..db7153f 100644 --- a/tests/test_dnssec.py +++ b/tests/test_dnssec.py @@ -206,16 +206,34 @@ wildcard_txt_rrsig = dns.rrset.from_text('*.example.com.', 3600, 'IN', 'RRSIG', wildcard_when = 1593541048 -class DNSSECMakeDSTestCase(unittest.TestCase): - def testMnemonicParser(self): - good_ds_mnemonic = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.DS, - '57349 RSASHA1 2 53A79A3E7488AB44FFC56B2D1109F0699D1796DD977E72108B841F96 E47D7013') - self.assertEqual(good_ds, good_ds_mnemonic) + +rsamd5_keys = { + abs_example: dns.rrset.from_text( + 'example', 3600, 'in', 'dnskey', + '257 3 1 AwEAAewnoEWe+AVEnQzcZTwpl8K/QKuScYIX 9xHOhejAL1enMjE0j97Gq3XXJJPWF7eQQGHs 1De4Srv2UT0zRCLkH9r36lOR/ggANvthO/Ub Es0hlD3A58LumEPudgIDwEkxGvQAXMFTMw0x 1d/a82UtzmNoPVzFOl2r+OCXx9Jbdh/L; KSK; alg = RSAMD5; key id = 30239', + '256 3 1 AwEAAb8OJM5YcqaYG0fenUdRlrhBQ6LuwCvr 5BRlrVbVzadSDBpq+yIiklfdGNBg3WZztDy1 du62NWC/olMfc6uRe/SjqTa7IJ3MdEuZQXQw MedGdNSF73zbokx8wg7zBBr74xHczJcEpQhr ZLzwCDmIPu0yoVi3Yqdl4dm4vNBj9hAD; ZSK; alg = RSAMD5; key id = 62992') +} + +rsamd5_ns = dns.rrset.from_text('example.', 3600, 'in', 'ns', + 'ns1.example.', 'ns2.example.') +rsamd5_ns_rrsig = dns.rrset.from_text('example.', 3600, 'in', 'rrsig', + 'NS 1 1 3600 20200825153103 20200726153103 62992 example. YPv0WVqzQBDH45mFcYGo9psCVoMoeeHeAugh 9RZuO2NmdwfQ3mmiQm7WJ3AYnzYIozFGf7CL nwn3vN8/fjsfcQgEv5xfhFTSd4IoAzJJiZAa vrI4L5590C/+aXQ8tjRmbMTPiqoudaXvsevE jP2lTFg5DCruJyFq5dnAY5b90RY=') + +rsamd5_when = 1595781671 + @unittest.skipUnless(dns.dnssec._have_pyca, "Python Cryptography cannot be imported") class DNSSECValidatorTestCase(unittest.TestCase): + def testAbsoluteRSAMD5Good(self): # type: () -> None + dns.dnssec.validate(rsamd5_ns, rsamd5_ns_rrsig, rsamd5_keys, None, + rsamd5_when) + + def testRSAMD5Keyid(self): + self.assertEqual(dns.dnssec.key_id(rsamd5_keys[abs_example][0]), 30239) + self.assertEqual(dns.dnssec.key_id(rsamd5_keys[abs_example][1]), 62992) + def testAbsoluteRSAGood(self): # type: () -> None dns.dnssec.validate(abs_soa, abs_soa_rrsig, abs_keys, None, when) @@ -330,6 +348,12 @@ class DNSSECValidatorTestCase(unittest.TestCase): keys[name] = dns.node.Node() keys[name].rdatasets.append(key_rrset.to_rdataset()) dns.dnssec.validate(abs_soa, abs_soa_rrsig, keys, None, when) + # test key not found. + keys = {} + for (name, key_rrset) in abs_keys.items(): + keys[name] = dns.node.Node() + with self.assertRaises(dns.dnssec.ValidationFailure): + dns.dnssec.validate(abs_soa, abs_soa_rrsig, keys, None, when) # Pass origin as a string, not a name. dns.dnssec.validate(rel_soa, rel_soa_rrsig, rel_keys, @@ -351,6 +375,11 @@ class DNSSECValidatorTestCase(unittest.TestCase): with self.assertRaises(dns.dnssec.ValidationFailure): dns.dnssec.validate(abs_ed448_mx, abs_ed448_mx_rrsig_1, abs_ed448_keys_1, None, when5 + 1) + # expired using the current time (to test the "get the time" code + # path) + with self.assertRaises(dns.dnssec.ValidationFailure): + dns.dnssec.validate(abs_ed448_mx, abs_ed448_mx_rrsig_1, + abs_ed448_keys_1, None) def testOwnerNameMismatch(self): bogus = dns.name.from_text('example.bogus') @@ -368,9 +397,22 @@ class DNSSECMiscTestCase(unittest.TestCase): with self.assertRaises(ValueError): dns.dnssec.NSEC3Hash.make(256) + def testIsNotGOST(self): + self.assertTrue(dns.dnssec._is_gost(dns.dnssec.Algorithm.ECCGOST)) + + def testUnknownHash(self): + with self.assertRaises(dns.dnssec.ValidationFailure): + dns.dnssec._make_hash(100) + class DNSSECMakeDSTestCase(unittest.TestCase): + def testMnemonicParser(self): + good_ds_mnemonic = dns.rdata.from_text(dns.rdataclass.IN, + dns.rdatatype.DS, + '57349 RSASHA1 2 53A79A3E7488AB44FFC56B2D1109F0699D1796DD977E72108B841F96 E47D7013') + self.assertEqual(good_ds, good_ds_mnemonic) + def testMakeExampleSHA1DS(self): # type: () -> None for algorithm in ('SHA1', 'sha1', dns.dnssec.DSDigest.SHA1): ds = dns.dnssec.make_ds(abs_example, example_sep_key, algorithm) |