Check unsigned serial number in signed zone files

All signed zone files present in bin/tests/system/inline/ns8 should
contain the unsigned serial number in the raw-format header.  Add a
check to ensure that is the case.  Extend the dnssec-signzone command
line in ns8/sign.sh with the -L option to allow the zones initially
signed there to pass the newly added check.  Add another zone to the
configuration for the ns8 named instance to ensure the check also passes
when multiple zones are inline-signed by a single named instance.

(cherry picked from commit ab49205af37ffafb70a3ba112897152f31a7a83d)

diff --git a/bin/tests/system/inline/ns8/named.conf.in b/bin/tests/system/inline/ns8/named.conf.in
index 242c4dc870b6828f2d4b17fc8a69633a575d41ed..b6ee1bf16afdc2f16dc152e8fd025daa3840ac94 100644 (file)
--- a/bin/tests/system/inline/ns8/named.conf.in
+++ b/bin/tests/system/inline/ns8/named.conf.in
@@ -151,3 +151,10 @@ zone example {
        auto-dnssec maintain;
        file "example.db";
 };
+
+zone "unsigned-serial-test" {
+       type primary;
+       inline-signing yes;
+       auto-dnssec maintain;
+       file "unsigned-serial-test.db";
+};

diff --git a/bin/tests/system/inline/ns8/sign.sh b/bin/tests/system/inline/ns8/sign.sh
index ed9ce5ace36ef980ac15fc6085b2258a7ac238ef..8a2b79afa7519d6de1de51d1e082ad0842b94e72 100755 (executable)
--- a/bin/tests/system/inline/ns8/sign.sh
+++ b/bin/tests/system/inline/ns8/sign.sh
@@ -22,12 +22,13 @@ do
   keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
   keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
   cp example.com.db.in ${zone}.db
-  $SIGNER -S -T 3600 -O raw -o ${zone} ${zone}.db > /dev/null 2>&1
+  $SIGNER -S -T 3600 -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null 2>&1
 done
 
-zone=example
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
-cp ${zone}.db.in ${zone}.db
+for zone in example unsigned-serial-test; do
+  rm -f K${zone}.+*+*.key
+  rm -f K${zone}.+*+*.private
+  keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+  keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
+  cp example.db.in ${zone}.db
+done

diff --git a/bin/tests/system/inline/tests_signed_zone_files.py b/bin/tests/system/inline/tests_signed_zone_files.py
new file mode 100755 (executable)
index 0000000..0abbb98
--- /dev/null
+++ b/bin/tests/system/inline/tests_signed_zone_files.py
@@ -0,0 +1,68 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+import glob
+import struct
+
+
+class RawFormatHeader(dict):
+    '''
+    A dictionary of raw-format header fields read from a zone file.
+    '''
+
+    fields = [
+        'format',
+        'version',
+        'dumptime',
+        'flags',
+        'sourceserial',
+        'lastxfrin',
+    ]
+
+    def __init__(self, file_name):
+        header = struct.Struct('>IIIIII')
+        with open(file_name, 'rb') as data:
+            header_data = data.read(header.size)
+        super().__init__(zip(self.fields, header.unpack_from(header_data)))
+
+
+def test_unsigned_serial_number():
+
+    '''
+    Check whether all signed zone files in the "ns8" subdirectory contain the
+    serial number of the unsigned version of the zone in the raw-format header.
+    The test assumes that all "*.signed" files in the "ns8" subdirectory are in
+    raw format.
+
+    Notes:
+
+      - The actual zone signing and dumping happens while the tests.sh phase of
+        the "inline" system test is set up and run.  This check only verifies
+        the outcome of those events; it does not initiate any signing or
+        dumping itself.
+
+      - example[0-9][0-9].com.db.signed files are initially signed by
+        dnssec-signzone while the others - by named.
+    '''
+
+    zones_with_unsigned_serial_missing = []
+
+    for signed_zone in sorted(glob.glob('ns8/*.signed')):
+        raw_header = RawFormatHeader(signed_zone)
+        # Ensure the unsigned serial number is placed where it is expected.
+        assert raw_header['format'] == 2
+        assert raw_header['version'] == 1
+        # Check whether the header flags indicate that the unsigned serial
+        # number is set and that the latter is indeed set.
+        if raw_header['flags'] & 0x02 == 0 or raw_header['sourceserial'] == 0:
+            zones_with_unsigned_serial_missing.append(signed_zone)
+
+    assert not zones_with_unsigned_serial_missing

diff --git a/util/copyrights b/util/copyrights
index 673de4b358bf53eb364c5e9b99691e08325c6446..5599d83537cd308c6478999dcb3f9a2635cf4183 100644 (file)
--- a/util/copyrights
+++ b/util/copyrights
@@ -645,6 +645,7 @@
 ./bin/tests/system/inline/ns8/sign.sh          SH      2020,2021,2022
 ./bin/tests/system/inline/setup.sh             SH      2011,2012,2013,2014,2016,2017,2018,2019,2020,2021,2022
 ./bin/tests/system/inline/tests.sh             SH      2011,2012,2013,2014,2016,2017,2018,2019,2020,2021,2022
+./bin/tests/system/inline/tests_signed_zone_files.py   PYTHON  2022
 ./bin/tests/system/integrity/clean.sh          SH      2017,2018,2019,2020,2021,2022
 ./bin/tests/system/integrity/setup.sh          SH      2018,2019,2020,2021,2022
 ./bin/tests/system/integrity/tests.sh          SH      2017,2018,2019,2020,2021,2022