Check that minimal NSEC records are not cached

construct a test zone which contains a minimal NSEC record,
emit priming queries for this record, and then check that
a respose that would be synthesised from it isn't.

diff --git a/bin/tests/system/synthfromdnssec/clean.sh b/bin/tests/system/synthfromdnssec/clean.sh
index e4b79138877b680190beea2573bc817c53ef4647..6c9647f9f6bf380ebdde99ee44af781a368c487f 100644 (file)
--- a/bin/tests/system/synthfromdnssec/clean.sh
+++ b/bin/tests/system/synthfromdnssec/clean.sh
@@ -25,6 +25,8 @@ rm -f ./ns1/insecure.example.db
 rm -f ./ns1/insecure.example.db.signed
 rm -f ./ns1/dnamed.db
 rm -f ./ns1/dnamed.db.signed
+rm -f ./ns1/minimal.db
+rm -f ./ns1/minimal.db.signed
 rm -f ./ns1/root.db
 rm -f ./ns1/root.db.signed
 rm -f ./ns1/trusted.conf
@@ -34,3 +36,4 @@ rm -f ./nodata.out ./insecure.nodata.out
 rm -f ./nxdomain.out ./insecure.nxdomain.out
 rm -f ./wild.out ./insecure.wild.out
 rm -f ./wildcname.out ./insecure.wildcname.out
+rm -f ./minimal.nxdomain.out

diff --git a/bin/tests/system/synthfromdnssec/ns1/minimal.db.in b/bin/tests/system/synthfromdnssec/ns1/minimal.db.in
new file mode 100644 (file)
index 0000000..1755c40
--- /dev/null
+++ b/bin/tests/system/synthfromdnssec/ns1/minimal.db.in
@@ -0,0 +1,28 @@
+$TTL 3600
+minimal.               3600    SOA     ns1.minimal. hostmaster.minimal. (
+                                       1          ; serial
+                                       3600       ; refresh (1 hour)
+                                       1200       ; retry (20 minutes)
+                                       604800     ; expire (1 week)
+                                       3600       ; minimum (1 hour)
+                                       )
+                       3600    NS      ns1.minimal.
+                       3600    NSEC    dnamed.minimal. NS SOA RRSIG NSEC DNSKEY
+dnamed.minimal.                3600    DNAME   dnamed.
+                       3600    NSEC    insecure.minimal. DNAME RRSIG NSEC
+insecure.minimal.      3600    NS      ns1.insecure.minimal.
+                       3600    NSEC    nodata.minimal. NS RRSIG NSEC
+nodata.minimal.                3600    TXT     "nodata"
+                       3600    NSEC    ns1.minimal. TXT RRSIG NSEC
+; incomplete chain pointing at non-existent ns2.minimal
+ns1.minimal.           3600    A       10.53.0.1
+                       3600    NSEC    ns2.minimal. A RRSIG NSEC
+; minimal response for nxdomain.minimal.
+nxdomaia.minimal.      3600    NSEC    nxdomaiz.minimal. RRSIG NSEC
+;
+*.wild-a.minimal.      3600    A       1.2.3.4
+                       3600    NSEC    *.wild-cname.minimal. A RRSIG NSEC
+*.wild-cname.minimal.  3600    CNAME   ns1.minimal.
+                       3600    NSEC    minimal. CNAME RRSIG NSEC
+; glue
+ns1.insecure.minimal.  3600    A       10.53.0.1

diff --git a/bin/tests/system/synthfromdnssec/ns1/named.conf.in b/bin/tests/system/synthfromdnssec/ns1/named.conf.in
index bb1d0738309829e2438d3ea4a8dbbcd8511b1a52..072c7d208a836fafe01da492e52a81f5e2930e92 100644 (file)
--- a/bin/tests/system/synthfromdnssec/ns1/named.conf.in
+++ b/bin/tests/system/synthfromdnssec/ns1/named.conf.in
@@ -44,4 +44,9 @@ zone "dnamed" {
        file "dnamed.db.signed";
 };
 
+zone "minimal" {
+       type primary;
+       file "minimal.db.signed";
+};
+
 include "trusted.conf";

diff --git a/bin/tests/system/synthfromdnssec/ns1/root.db.in b/bin/tests/system/synthfromdnssec/ns1/root.db.in
index f396106fdb9a757964124abdf35dcbf3a1850806..3ef5f9702d6440c748d7735206ddcfae57de09ec 100644 (file)
--- a/bin/tests/system/synthfromdnssec/ns1/root.db.in
+++ b/bin/tests/system/synthfromdnssec/ns1/root.db.in
@@ -15,3 +15,5 @@ example               NS      ns1.example
 ns1.example    A       10.53.0.1
 dnamed         NS      ns1.dnamed
 ns1.dnamed     A       10.53.0.1
+minimal                NS      ns1.minimal
+ns1.minimal    A       10.53.0.1

diff --git a/bin/tests/system/synthfromdnssec/ns1/sign.sh b/bin/tests/system/synthfromdnssec/ns1/sign.sh
index 9a5819e6183af9f5bd52baa91ac3fce95975203d..ee517b0a09978ec82f498f336efea519bb5fb135 100644 (file)
--- a/bin/tests/system/synthfromdnssec/ns1/sign.sh
+++ b/bin/tests/system/synthfromdnssec/ns1/sign.sh
@@ -41,6 +41,16 @@ cat "$infile" "$keyname.key" > "$zonefile"
 
 $SIGNER -P -o $zone $zonefile > /dev/null
 
+zone=minimal
+infile=minimal.db.in
+zonefile=minimal.db
+
+keyname=$($KEYGEN -q -a RSASHA256 -b 2048 -n zone $zone)
+cat "$infile" "$keyname.key" > "$zonefile"
+
+# do not regenerate NSEC chain as there in a minimal NSEC record present
+$SIGNER -P -Z nonsecify -o $zone $zonefile > /dev/null
+
 zone=.
 infile=root.db.in
 zonefile=root.db

diff --git a/bin/tests/system/synthfromdnssec/tests.sh b/bin/tests/system/synthfromdnssec/tests.sh
index 70ac6eedc204fafd44cb372130ff78d7136d9441..72981635e7495c62f1ae9f6dff61617622e48b62 100644 (file)
--- a/bin/tests/system/synthfromdnssec/tests.sh
+++ b/bin/tests/system/synthfromdnssec/tests.sh
@@ -173,6 +173,18 @@ do
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
+
+    echo_i "prime minimal NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    dig_with_opts nxdomain.minimal. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NXDOMAIN dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa minimal. dig.out.ns${ns}.test$n || ret=1
+    grep "nxdomaia.minimal.*3600.IN.NSEC.nxdomaiz.minimal. RRSIG NSEC" dig.out.ns${ns}.test$n > /dev/null || ret=1
+    [ $ns -eq 2 ] && cp dig.out.ns${ns}.test$n minimal.nxdomain.out
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 done
 
 echo_i "prime redirect response (+nodnssec) (synth-from-dnssec <default>;) ($n)"
@@ -328,6 +340,19 @@ do
     n=$((n+1))
     if [ $ret != 0 ]; then echo_i "failed"; fi
     status=$((status+ret))
+
+    echo_i "check minimal NXDOMAIN response (synth-from-dnssec ${description};) ($n)"
+    ret=0
+    nextpart ns1/named.run > /dev/null
+    dig_with_opts nxdomaic.minimal. @10.53.0.${ns} a > dig.out.ns${ns}.test$n || ret=1
+    check_ad_flag $ad dig.out.ns${ns}.test$n || ret=1
+    check_status NXDOMAIN dig.out.ns${ns}.test$n || ret=1
+    check_nosynth_soa minimal. dig.out.ns${ns}.test$n || ret=1
+    nextpart ns1/named.run | grep nxdomaic.minimal/A > /dev/null || ret=1
+    digcomp minimal.nxdomain.out dig.out.ns${ns}.test$n || ret=1
+    n=$((n+1))
+    if [ $ret != 0 ]; then echo_i "failed"; fi
+    status=$((status+ret))
 done
 
 echo_i "check redirect response (+dnssec) (synth-from-dnssec <default>;) ($n)"