Exercising RFC 5011 rollovers
Phil Mayers
p.mayers at imperial.ac.uk
Sat Nov 26 12:44:08 UTC 2011
On 11/26/2011 12:21 PM, Jan-Piet Mens wrote:
>> Feature suggestion: some sort of synthetic clock option to named for
>> use in the test suite ("--test-unixtime-offset") or something?
>>
>> Obviously non-trivial.
>
> Indeed.
>
> I think Chris'& Evan's suggestion of a public zone that revokes and
> replaces trust anchors periodically (every few hours?) is better suited
> to testing.
Wasn't the point of Evan's mail that you can't roll over every few
hours? That:
"""the RFC requires certain things to take a very long time"""
...and:
"""rolling to a new trust anchor and deleting the old one takes over a
month"""
?
Certainly a test zone is a good idea, but unless you create lots of them
with staggered rollovers, you'll have quite a lag before you see a
problem e.g. in a new version of bind. Though I guess there no
particular difficulty in creating a lot of them.
The synthetic clock approach is used in other large applications and
framework test suites to simulate long time windows, and will tell you
in seconds rather than hours or days. Maybe something to consider in
bind 10.
Cheers,
Phil
More information about the bind-users
mailing list