tests for support for EDE 1 & 2

diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
index 63e090757073fdecc879ac86f0ab4dc04d1dee7a..03246978c7c974a71ef431b2e525021803ef5111 100644 (file)
--- a/bin/tests/system/dnssec/ns2/example.db.in
+++ b/bin/tests/system/dnssec/ns2/example.db.in
@@ -102,6 +102,9 @@ ns.dnskey-unknown   A       10.53.0.3
 dnskey-unsupported     NS      ns.dnskey-unsupported
 ns.dnskey-unsupported  A       10.53.0.3
 
+ds-unsupported NS      ns.ds-unsupported
+ns.ds-unsupported      A       10.53.0.3
+
 dnskey-nsec3-unknown   NS      ns.dnskey-nsec3-unknown
 ns.dnskey-nsec3-unknown        A       10.53.0.3
 

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index 680d296ac5a5610c3158bad595c591a0e3b78522..5d326c23c5d3f434762e2427b0b2c92fc42712ba 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -56,7 +56,7 @@ infile=example.db.in
 zonefile=example.db
 
 # Get the DS records for the "example." zone.
-for subdomain in secure badds bogus dynamic keyless nsec3 optout \
+for subdomain in ds-unsupported secure badds bogus dynamic keyless nsec3 optout \
   nsec3-unknown optout-unknown multiple rsasha256 rsasha512 \
   kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
   ttlpatch split-dnssec split-smart expired expiring upper lower \

diff --git a/bin/tests/system/dnssec/ns3/ds-unsupported.example.db.in b/bin/tests/system/dnssec/ns3/ds-unsupported.example.db.in
new file mode 100644 (file)
index 0000000..94fa465
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/ds-unsupported.example.db.in
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300       ; 5 minutes
+@                      IN SOA  mname1. . (
+                               2000042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns
+ns                     A       10.53.0.3
+a                      A       10.0.0.1

diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
index d8f45a825a5c6f2a100b3e2898c610f5cc9d4f83..1d7157b93b6b8ef21a03440ace769adcb7da28aa 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
@@ -195,6 +195,12 @@ zone "dnskey-unknown.example" {
        file "dnskey-unknown.example.db.signed";
 };
 
+zone "ds-unsupported.example" {
+       type primary;
+       file "ds-unsupported.example.db.signed";
+       allow-update { any; };
+};
+
 zone "dnskey-unsupported.example" {
        type primary;
        file "dnskey-unsupported.example.db.signed";

diff --git a/bin/tests/system/dnssec/ns3/secure.example.db.in b/bin/tests/system/dnssec/ns3/secure.example.db.in
index b82b280219dc94f0443f17df51d85832b0552aae..9aebd98007889154775b79305ba4ba9cf7abb78f 100644 (file)
--- a/bin/tests/system/dnssec/ns3/secure.example.db.in
+++ b/bin/tests/system/dnssec/ns3/secure.example.db.in
@@ -30,6 +30,7 @@ g                     A       10.0.0.7
 z                      A       10.0.0.26
 a.a.a.a.a.a.a.a.a.a.e  A       10.0.0.27
 x                      CNAME   a
+badalg                 A       10.53.0.4
 
 private                        NS      ns.private
 ns.private             A       10.53.0.2

diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
index 958c7e64c603103709cc6ed28f57693c1e71638d..cdf06f45d4ce0fadaf891546b9ed7bfbc2da05d4 100644 (file)
--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
@@ -298,6 +298,24 @@ awk '$4 == "DNSKEY" { $7 = 255 } $4 == "RRSIG" { $6 = 255 } { print }' ${zonefil
 DSFILE="dsset-${zone}."
 $DSFROMKEY -A -f ${zonefile}.signed "$zone" >"$DSFILE"
 
+#
+# A zone which is fime by itself (supported alg and digest) but that is used
+# to mimic unsupported DS digest (see ns8).
+#
+zone=ds-unsupported.example.
+infile=ds-unsupported.example.db.in
+zonefile=ds-unsupported.example.db
+
+cnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "cnameandkey.$zone")
+dnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "dnameandkey.$zone")
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+
+cat "$infile" "$cnameandkey.key" "$dnameandkey.key" "$keyname.key" >"$zonefile"
+
+"$SIGNER" -z -D -o "$zone" "$zonefile" >/dev/null
+cat "$zonefile" "$zonefile".signed >"$zonefile".tmp
+mv "$zonefile".tmp "$zonefile".signed
+
 #
 # A zone with a published unsupported DNSKEY algorithm (Reserved).
 # Different from above because this key is not intended for signing.

diff --git a/bin/tests/system/dnssec/ns4/named1.conf.in b/bin/tests/system/dnssec/ns4/named1.conf.in
index f179bbdbd7579ad324bed85933cffd11c784c0f8..8d2d87141e1bc877cbec2115059a5f058595661a 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named1.conf.in
+++ b/bin/tests/system/dnssec/ns4/named1.conf.in
@@ -27,9 +27,11 @@ options {
 
        nta-lifetime 12s;
        nta-recheck 9s;
-
        validate-except { corp; };
 
+       disable-ds-digests "ds-unsupported.example." {"SHA1"; "SHA-1"; "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
+       disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
+
        # Note: We only reference the bind.keys file here to confirm that it
        # is *not* being used.  It contains the real root key, and we're
        # using a local toy root zone for the tests, so it wouldn't work.

diff --git a/bin/tests/system/dnssec/ns4/named2.conf.in b/bin/tests/system/dnssec/ns4/named2.conf.in
index 56bdfe4235814e164520cb8731c7df60e669675a..82c8ecfffc85c2ffad53275a59a0fa54f26f2611 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named2.conf.in
+++ b/bin/tests/system/dnssec/ns4/named2.conf.in
@@ -25,6 +25,8 @@ options {
        dnssec-validation auto;
        bindkeys-file "managed.conf";
        minimal-responses no;
+       disable-ds-digests "ds-unsupported.example." {"SHA1"; "SHA-1"; "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
+       disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
 };
 
 key rndc_key {

diff --git a/bin/tests/system/dnssec/ns4/named3.conf.in b/bin/tests/system/dnssec/ns4/named3.conf.in
index e160d374336a72ddf24c966b92b1f5fe31b59d3b..4b9e93cc5aa512132ce00b1d52810b0606156af8 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named3.conf.in
+++ b/bin/tests/system/dnssec/ns4/named3.conf.in
@@ -26,6 +26,8 @@ options {
        bindkeys-file "managed.conf";
        dnssec-accept-expired yes;
        minimal-responses no;
+       disable-ds-digests "ds-unsupported.example." {"SHA1"; "SHA-1"; "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
+       disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
 };
 
 key rndc_key {

diff --git a/bin/tests/system/dnssec/ns4/named4.conf.in b/bin/tests/system/dnssec/ns4/named4.conf.in
index 941211993d564e362234fff9a85a9f832f865fdc..9cda7eb456555c942eed7107fa0490732b17f920 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named4.conf.in
+++ b/bin/tests/system/dnssec/ns4/named4.conf.in
@@ -21,6 +21,8 @@ options {
        pid-file "named.pid";
        listen-on { 10.53.0.4; };
        listen-on-v6 { none; };
+       disable-ds-digests "ds-unsupported.example." {"SHA1"; "SHA-1"; "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
+       disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
 };
 
 key rndc_key {

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 400d9db80622fe621a772b701e600b64de9a2a3c..cd85e8e7ff085be0cb97649b94fdac5ced57e241 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -3677,6 +3677,25 @@ dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unsupported.exa
 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-unsupported.example A >dig.out.ns4.test$n
 grep "status: NOERROR," dig.out.ns3.test$n >/dev/null || ret=1
 grep "status: NOERROR," dig.out.ns4.test$n >/dev/null || ret=1
+grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (255 dnskey-unsupported.example/SOA)" dig.out.ns4.test$n >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
+echo_i "checking EDE code 2 for unsupported DS digest ($n)"
+ret=0
+dig_with_opts @10.53.0.4 a.ds-unsupported.example >dig.out.ns4.test$n || ret=1
+grep "; EDE: 2 (Unsupported DS Digest Type): (SHA-256 ds-unsupported.example/DNSKEY)" dig.out.ns4.test$n >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
+echo_i "checking EDE code 1 for bad alg mnemonic ($n)"
+ret=0
+dig_with_opts @10.53.0.4 badalg.secure.example >dig.out.ns4.test$n || ret=1
+grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (ECDSAP256SHA256 badalg.secure.example/A)" dig.out.ns4.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -3974,6 +3993,7 @@ dig_with_opts @10.53.0.8 a.secure.trusted A >dig.out.ns8.test$n
 grep "status: NOERROR," dig.out.ns3.test$n >/dev/null || ret=1
 grep "status: NOERROR," dig.out.ns8.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n >/dev/null || ret=1
+grep "; EDE: " dig.out.ns8.test$n >/dev/null && ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
@@ -3985,6 +4005,7 @@ dig_with_opts @10.53.0.8 a.secure.managed A >dig.out.ns8.test$n
 grep "status: NOERROR," dig.out.ns3.test$n >/dev/null || ret=1
 grep "status: NOERROR," dig.out.ns8.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n >/dev/null || ret=1
+grep "; EDE: " dig.out.ns8.test$n >/dev/null && ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
@@ -3999,6 +4020,7 @@ dig_with_opts @10.53.0.3 a.unsupported.trusted A >dig.out.ns3.test$n
 dig_with_opts @10.53.0.8 a.unsupported.trusted A >dig.out.ns8.test$n
 grep "status: NOERROR," dig.out.ns3.test$n >/dev/null || ret=1
 grep "status: NOERROR," dig.out.ns8.test$n >/dev/null || ret=1
+grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (255 ns3.unsupported.trusted (cached))" dig.out.ns8.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n >/dev/null && ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
@@ -4010,6 +4032,7 @@ dig_with_opts @10.53.0.3 a.unsupported.managed A >dig.out.ns3.test$n
 dig_with_opts @10.53.0.8 a.unsupported.managed A >dig.out.ns8.test$n
 grep "status: NOERROR," dig.out.ns3.test$n >/dev/null || ret=1
 grep "status: NOERROR," dig.out.ns8.test$n >/dev/null || ret=1
+grep "; EDE: 1 (Unsupported DNSKEY Algorithm): (255 ns3.unsupported.managed (cached))" dig.out.ns8.test$n >/dev/null || ret=1
 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n >/dev/null && ret=1
 n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"

diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py
index 91817bd0b7b509a28ff7b8f0b06bd768c2829503..bd7cd111c221bad906b5ad599946054d08034e96 100644 (file)
--- a/bin/tests/system/dnssec/tests_sh_dnssec.py
+++ b/bin/tests/system/dnssec/tests_sh_dnssec.py
@@ -131,6 +131,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "ns3/update-nsec3.example.db.signed",
         "ns3/upper.example.db",
         "ns3/upper.example.db.lower",
+        "ns3/ds-unsupported.example.db",
         "ns4/managed.conf",
         "ns4/managed-keys.bind",
         "ns4/named.secroots",