update SERVFAIL cache test

An existing SERVFAIL cache test is updated as it initially checks there
are no EDE (the first SERVFAIL) then immediately re-does the same query,
(still SERVFAIL), and expect the CACHED_ERROR EDE.

However, the configuration used for this test to generate a SERVFAIL is
a broken DNSSEC configuration, where the DNSKEY is not the expected one
(it's a ZSK instead of a KZK). As a result, the first attempt also now
raise an EDE (MISSING_DNSKEY).

diff --git a/bin/tests/system/sfcache/ns2/sign.sh b/bin/tests/system/sfcache/ns2/sign.sh
index fa5cf501328c502524bd20b97c6bfe845d3db647..867c8b658f9f8af4df4c8aaf8ca2f72452f19017 100644 (file)
--- a/bin/tests/system/sfcache/ns2/sign.sh
+++ b/bin/tests/system/sfcache/ns2/sign.sh
@@ -20,6 +20,10 @@ zone=example.
 infile=example.db.in
 zonefile=example.db
 
+# The zone is signed but it's broken: instead of having a ZSK and a KSK (which
+# is the DNSKEY pointed by the parent's DS), it has two ZSKs. As a result,
+# `example.` validations will always fail, resulting into a SERVFAIL on
+# validating resolvers.
 keyname1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
 keyname2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
 

diff --git a/bin/tests/system/sfcache/tests_sfcache.py b/bin/tests/system/sfcache/tests_sfcache.py
index 4802fbafa96b07846f5372e594b97e2d4644b6bb..bed8b36da9d785322adc55f2089258be94784ec2 100644 (file)
--- a/bin/tests/system/sfcache/tests_sfcache.py
+++ b/bin/tests/system/sfcache/tests_sfcache.py
@@ -20,9 +20,11 @@ def check_sfcache_ede(ns, ede):
     res = isctest.query.udp(msg, ns.ip)
     isctest.check.servfail(res)
     if ede:
+        # The SERVFAIL is cached, so now it shows up the EDE CACHED_ERROR, but not the DNSKEY_MISSING.
         isctest.check.ede(res, EDECode.CACHED_ERROR)
     else:
-        isctest.check.noede(res)
+        # example. domain DNSSEC is misconfigured on ns2, as it have two ZSK but no KSK. As a result, the DNSKEY for example. can't be found.
+        isctest.check.ede(res, EDECode.DNSKEY_MISSING)
 
 
 def test_sfcache_ede(ns5, templates):