1MAKETESTZONE(1) User Contributed Perl Documentation MAKETESTZONE(1)
2
6 generaterecords - generates a test dnssec zone that can be used to
7 DNSSEC
8
10 generaterecords -v -d mytestzone.example.com
11
13 The generaterecords script generates a zone file, given a domain name,
14 which is then signed and modified to invalidate portions of the data in
15 particular ways. Each generated record is named appropriately to how
16 the security data is modified (the gooda record will contain a A record
17 with valid DNSSEC data, but the badseca record will contain an A record
18 where the signature has been modified to invalidate it).
19 The results of this process can then be served and test secure
21 validators, applications, and other software can be thrown at it to see
22 if they properly fail or succeed under the dns security policies being
23 deployed.
24 After the files are generated, consider running donuts on them to see
26 how the data in them has been tampered with to be invalid.
27
29 zonesigner from the dnssec-tools project bind software 9.3.1 or greater
30
32 To get started creating a new zone, you'll need to tell zonesigner to
33 create new keys for all of the new zones that maketestzone creates.
34 Thus, the first run of maketestzone should look like:
35 First Time:
37 maketestzone -k [OTHER DESIRED OPTIONS]
38 After that, the generated zone files can be loaded and served in a test
40 server.
41 Once every 30 days (by default via zonesigner) the script will need to
43 be rerun to recreate the records and resign the data so the signature
44 date stamps remain valid (or in some cases invalid).
45 Every 30 days:
47 maketestzone [OTHER DESIRED OPTIONS]
48
50 Below are thoe options that are accepted by the maketestzone tool.
51 Output File Naming:
53 -o STRING
54 --output-file-prefix=STRING
55 Output prefix to use for zone files (default = db.)
56 -O STRING
58 --output-suffix-signed-file=STRING
59 Output suffix to be given to zonesigner (default = .zs)
60 -M STRING
62 --output-modified-file=STRING
63 Output suffix for the modified zone file (default = .modified)
64 -D
66 --run-donuts
67 Run donuts on the results
68 --donuts-output-suffix=STRING
70 The file suffix to use for donuts output (default = .donuts)
71 Output Zone Information:
73 -d STRING
74 --domain=STRING
75 domain name to generate records for
76 --ns=STRING
78 --name-servers=STRING
79 -n STRING
80 Comma separated name=addr name-server records
81 --a-addr=STRING
83 --a-record-address=STRING
84 A record (IPv4) address to use in data
85 --aaaa-addr=STRING
87 --a-record-address=STRING
88 AAAA record (IPv6) address to use in data
89 Output Data Type Selection:
91 -p STRING
92 --record-prefixes=STRING
93 Comma separated list of record prefixes to use
94 -P STRING
96 --ns-prefixes=STRING
97 Comma separated list of NS record prefixes to use
98 -c
100 --no-cname-records
101 Don't create CNAME records
102 -s
104 --no-ns-records
105 Don't create sub-zone records
106 Task Selection:
108 -g
109 --dont-generate-zone
110 Do not generate the zone; use the existing and sign/modify it
111 -z
113 --dont-run-zonesigner
114 Do not run zonesigner to sign the records
115 -Z
117 --dont-destroy
118 Do not destroy the records and leave them properly signed
119 --bind-config=STRING
121 Generate a bind configuration file snippit to load the DB sets
122 --html-out=STRING
124 Generate a HTML page containing a list of record names
125 --apache-out=STRING
127 Generate a Apache config snippit for configuring apache for each
128 zone record
129 --sh-test-out=STRING
131 Generate a test script for running dig commands
132 -v
134 --verbose
135 Verbose output
136 Zonesigner Configuration:
138 -a STRING
139 --zonesigner-arguments=STRING
140 Arguments to pass to zonesigner
141 -k
143 --generate-keys
144 Have zonesigner generate needed keys
145 Bind Configuration Options
147 --bind-db-dir=STRING
148 The base directory where the bind DB files will be placed
149 HTML Output Configuration
151 --html-out-add-links
152 Make each html record name a http link to that address
153 --html-out-add-db-links
155 Add a link to each of the generated DB files.
156 --html-out-add-donuts-links
158 Add a link to each of the generated donuts error list files.
159 SH Test Script Configuration Options
161 --sh-test-resolver=STRING
162 The resolver address to force
163 Help Options
165 -h Display a help summary (short flags preferred)
166 --help
168 Display a help summary (long flags preferred)
169 --help-full
171 Display all help options (both short and long)
172 --version
174 Display the script version number.
175
177 The following section discusses how to extend the maketestzone tool
178 with new output modifications.
179 ADDING LEGEND INFORMATION
181 For the legend HTML output, the %LegendInformation hash contains a
182 keyname and description for each modification type.
183 ADDING NEW SUBZONE DIFFERENCES
185 The %zonesigner_domain_opts hash lists additional arguments between how
186 zonesigner is called for various sub-domains. Thus you can create
187 additional sub-zones with different zonesigner optionns to test other
188 operational parameters between parent and child. For example:
189 'rollzsk-ns.' . $opts{'d'} => '-rollzsk',
191 Forces the rollzsk-ns test sub-zone to roll it's zsk when the zone is
193 signed.
194 ADDING NEW RECORD MODIFICATIONS
196 Maketestzone is in early development stages but already has the
197 beginnings of an extnesible system allowing you to modify records at
198 will based on regexp => subroutine hooks.
199 To add a new modification, add a new keyword to the 'p' and optionally
201 'P' default flags (or add it at run time), and then add a new function
202 to the list of callbacks defined in the %destroyFunctions hash that is
203 based on your new keyword. When the file is getting parsed and hits a
204 record matching your expression, your functional will be called.
205 Arguments can be added to the function by passing an array reference
206 where the first argument is the subroutine to be called, and the
207 remainder are additional arguments. Output lines should be printed to
208 the $fh file handle.
209 Here's an example function that deletes the RRSIG signature of the next
211 record:
212 sub delete_signature {
214 # the first 2 arguments are always passed; the other was in the
215 # array refeence the subroutine was registered with.
216 my ($name, $type, $expr) = @_;
217 Verbose(" deleting signatures of $_[0]");
219 # print the current line
221 print $fh $_;
222 my $inrec = 0;
224 while (<I>) {
225 # new name record means we're done.
226 last if /^\w/;
227 # we're in a multi-line rrsig record
229 $inrec = 1 if (/$expr\s+$type/);
230 # print the line if we're not in the rrsig record
232 print $fh $_ if (!$inrec);
233 # when done with the last line of the rrsig record, mark this spot
235 $inrec = 0 if (/\)/);
236 }
237 }
238 This is then registered within %destroyFunctions. Here's an example of
240 registering the function to delete the signature on a DS record:
241 '^(nosig[-\w]+).*IN\s+NS\s+' => [\&delete_signature, 'DS', 'RRSIG'],
243
245 Copyright 2004-2013 SPARTA, Inc. All rights reserved. See the COPYING
246 file included with the DNSSEC-Tools package for details.
247
249 Wes Hardaker <hardaker@users.sourceforge.net>
250
252 Net::DNS
253 http://dnssec-tools.sourceforge.net
255 zonesigner(1), donuts(1)
257
259 Hey! The above document had some coding errors, which are explained
260 below:
261 Around line 1009:
263 You forgot a '=back' before '=head2'
264 Around line 1011:
266 '=item' outside of any '=over'
267 Around line 1039:
269 You forgot a '=back' before '=head2'
270 Around line 1041:
272 '=item' outside of any '=over'
273 Around line 1067:
275 You forgot a '=back' before '=head2'
276 Around line 1069:
278 '=item' outside of any '=over'
279 Around line 1093:
281 You forgot a '=back' before '=head2'
282 Around line 1095:
284 '=item' outside of any '=over'
285 Around line 1135:
287 You forgot a '=back' before '=head2'
288 Around line 1137:
290 '=item' outside of any '=over'
291 Around line 1149:
293 You forgot a '=back' before '=head2'
294 Around line 1151:
296 '=item' outside of any '=over'
297 Around line 1155:
299 You forgot a '=back' before '=head2'
300 Around line 1157:
302 '=item' outside of any '=over'
303 Around line 1169:
305 You forgot a '=back' before '=head2'
306 Around line 1171:
308 '=item' outside of any '=over'
309 Around line 1175:
311 You forgot a '=back' before '=head2'
312 Around line 1177:
314 '=item' outside of any '=over'
315perl v5.36.0 2022-07-21 MAKETESTZONE(1)