testing suite for dnssec extension

[msehnout]

The dnssec extension is described here: https://github.com/rpm-software-management/dnf/pull/1085

I created a simple testing environment based on Vagrant to test this functionality, but it would be nice to migrate it into this repository instead. https://github.com/msehnout/dnf-testing

My current approach is to create 2 virtual machines where one serves as a DNS server and the second one as a client. The server is running:

• root DNS,
• com zone server
• example.com zone server
• DNS resolver

The whole system does not work without DNSSEC, so it is necessary to generate KSK (key-signing-key) and ZSK (zone-signing-key) for each authoritative server. Once all of these keys are available, every zone file is signed to create the DNSSEC chain of trust. The package signing key needs to be added to the appropriate zone.

Fedora comes with preinstalled root zone key, but I need to add the newly generated root zone key to enable DNSSEC verification inside of the testing environment: https://github.com/msehnout/dnf-testing/blob/master/roles/client/tasks/main.yml#L43

So to sum up the requirements:

• 3 authoritative DNS servers
• export RPM signing key into a zone file (I use gpg2 with --export-options export-dane)
• sign all the zones (https://github.com/msehnout/dnf-testing/blob/master/configuration/sign.sh)
• 1 resolver with DNSSEC support, testing correct root hints and testing root key (https://github.com/msehnout/dnf-testing/tree/master/configuration/resolver)
• The client with additional root zone key (https://github.com/msehnout/dnf-testing/blob/master/roles/client/tasks/main.yml#L43)

I think this should be feasible even with a single container, but with multiple IP addresses assigned to it. Configuration files for the DNS servers can be reused from my testing environment.

Do you have any comments or ideas regarding the design?

[ppisar]

I would like to see tests for fixes in https://github.com/rpm-software-management/dnf/pull/2019.