Test policy key tag ranges in dnssec-keygen

Cover policy-driven key generation so a broken KASP range accessor
cannot silently disable key tag validation.

diff --git a/bin/tests/system/dnssectools/kasp.conf.j2 b/bin/tests/system/dnssectools/kasp.conf.j2
new file mode 100644 (file)
index 0000000..5d01249
--- /dev/null
+++ b/bin/tests/system/dnssectools/kasp.conf.j2
@@ -0,0 +1,8 @@
+dnssec-policy "tagged-keys" {
+       dnskey-ttl 3600;
+
+       keys {
+               ksk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ tag-range 0 32767;
+               zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@ tag-range 32768 65535;
+       };
+};

diff --git a/bin/tests/system/dnssectools/tests.sh b/bin/tests/system/dnssectools/tests.sh
index def0051f8a070d8bbe5dd636675ea932ce78bb28..ee38d2086c9b6d91a6331354380e1d0762444eef 100644 (file)
--- a/bin/tests/system/dnssectools/tests.sh
+++ b/bin/tests/system/dnssectools/tests.sh
@@ -1091,6 +1091,25 @@ n=$((n + 1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+echo_i "check that dnssec-keygen honours key tag ranges from dnssec-policy ($n)"
+ret=0
+zone=settagrangepolicy
+ksk=$("$KEYGEN" -f KSK -k tagged-keys -l kasp.conf "$zone")
+zsk=$("$KEYGEN" -f ZSK -k tagged-keys -l kasp.conf "$zone")
+kid=$(keyfile_to_key_id "$ksk")
+zid=$(keyfile_to_key_id "$zsk")
+[ $kid -ge 0 -a $kid -le 32767 ] || ret=1
+[ $zid -ge 32768 -a $zid -le 65535 ] || ret=1
+rksk=$($REVOKE -R $ksk)
+rzsk=$($REVOKE -R $zsk)
+krid=$(keyfile_to_key_id "$rksk")
+zrid=$(keyfile_to_key_id "$rzsk")
+[ $krid -ge 0 -a $krid -le 32767 ] || ret=1
+[ $zrid -ge 32768 -a $zrid -le 65535 ] || ret=1
+n=$((n + 1))
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "check dnssec-dsfromkey from stdin ($n)"
 ret=0
 cat algroll.dnskey | $DSFROMKEY -f - algroll. >dsfromkey.out.test$n

diff --git a/bin/tests/system/dnssectools/tests_sh_dnssectools.py b/bin/tests/system/dnssectools/tests_sh_dnssectools.py
index 4d17f61c2d782b6151b84b640aaac46deed08ce3..7a47a627eab6f3ce3506ee9f73f0b1ea8053d444 100644 (file)
--- a/bin/tests/system/dnssectools/tests_sh_dnssectools.py
+++ b/bin/tests/system/dnssectools/tests_sh_dnssectools.py
@@ -18,6 +18,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "delv.out*",
         "dnssectools.out.*",
         "dsfromkey.out.*",
+        "kasp.conf",
         "keygen*.err*",
         "*/K*",
         "*/dsset-*",