Add stripped DS RRSIG senario

(cherry picked from commit 66f293a9529dc4b80fd89126e36abd9dccef7649)

diff --git a/bin/tests/system/dnssec/ns1/root.db.in b/bin/tests/system/dnssec/ns1/root.db.in
index d3750ea70a6ba41fdb7d0981111a19aa6f9fcc80..d76c89f455b2ffa8d194e29ac0fc5199ed8f4ed5 100644 (file)
--- a/bin/tests/system/dnssec/ns1/root.db.in
+++ b/bin/tests/system/dnssec/ns1/root.db.in
@@ -39,3 +39,5 @@ too-many-iterations.  NS      ns2.too-many-iterations.
 ns2.too-many-iterations.       A       10.53.0.2
 dnskey-rrsigs-stripped.        NS      ns2.dnskey-rrsigs-stripped.
 ns2.dnskey-rrsigs-stripped.    A       10.53.0.2
+ds-rrsigs-stripped.    NS      ns2.ds-rrsigs-stripped.
+ns2.ds-rrsigs-stripped.        A       10.53.0.2

diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index 1d6bc2c825d78bb63e65c50c803dbdb88a4d1c89..d5e4e5ff53809dbf9e45d888613d5bca9afde115 100644 (file)
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -31,6 +31,7 @@ cp "../ns2/dsset-in-addr.arpa." .
 cp "../ns2/dsset-too-many-iterations." .
 cp "../ns2/dsset-lazy-ksk." .
 cp "../ns2/dsset-dnskey-rrsigs-stripped." .
+cp "../ns2/dsset-ds-rrsigs-stripped." .
 
 grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll." >"dsset-algroll."
 cp "../ns6/dsset-optout-tld." .

diff --git a/bin/tests/system/dnssec/ns2/child.ds-rrsigs-stripped.db.in b/bin/tests/system/dnssec/ns2/child.ds-rrsigs-stripped.db.in
new file mode 100644 (file)
index 0000000..5fcc74d
--- /dev/null
+++ b/bin/tests/system/dnssec/ns2/child.ds-rrsigs-stripped.db.in
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300       ; 5 minutes
+@                      IN SOA  mname1. . (
+                               2000042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns2
+                       NS      ns3
+ns2                    A       10.53.0.2
+ns3                    A       10.53.0.3
+
+a                      A       10.0.0.1
+b                      A       10.0.0.2
+d                      A       10.0.0.4

diff --git a/bin/tests/system/dnssec/ns2/ds-rrsigs-stripped.db.in b/bin/tests/system/dnssec/ns2/ds-rrsigs-stripped.db.in
new file mode 100644 (file)
index 0000000..7b1a7a5
--- /dev/null
+++ b/bin/tests/system/dnssec/ns2/ds-rrsigs-stripped.db.in
@@ -0,0 +1,29 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300       ; 5 minutes
+@                      IN SOA  mname1. . (
+                               2000042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns2
+                       NS      ns3
+ns2                    A       10.53.0.2
+ns3                    A       10.53.0.3
+
+child                  NS      ns2.child
+ns2.child              A       10.53.0.2
+a                      A       10.0.0.1
+b                      A       10.0.0.2
+d                      A       10.0.0.4

diff --git a/bin/tests/system/dnssec/ns2/named.conf.in b/bin/tests/system/dnssec/ns2/named.conf.in
index 1cbb382e0da4d3e4db2b6f271ecb98806a86da47..fef3f47c4175ca0fd2bcb76a05a923afad5b1d3e 100644 (file)
--- a/bin/tests/system/dnssec/ns2/named.conf.in
+++ b/bin/tests/system/dnssec/ns2/named.conf.in
@@ -221,4 +221,14 @@ zone "dnskey-rrsigs-stripped" {
        file "dnskey-rrsigs-stripped.db.signed";
 };
 
+zone "ds-rrsigs-stripped" {
+       type primary;
+       file "ds-rrsigs-stripped.db.signed";
+};
+
+zone "child.ds-rrsigs-stripped" {
+       type primary;
+       file "child.ds-rrsigs-stripped.db.signed";
+};
+
 include "trusted.conf";

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index 9aa7d22a373904db5010e13cbc08aaaeb2620408..1e7779e14d175b1f6e3a5e3ffd1b9232d1726d2a 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -386,3 +386,31 @@ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
   | awk '$4 == "SOA" { $7 = $7 + 1; print; next } { print }' >"$zonefile.next"
 "$SIGNER" -g -o "$zone" -f "$zonefile.next" "$zonefile.next" >/dev/null 2>&1
 cp "$zonefile.stripped" "$zonefile.signed"
+
+#
+# A child zone for the stripped DS RRSIGs test
+#
+zone=child.ds-rrsigs-stripped
+infile=child.ds-rrsigs-stripped.db.in
+zonefile=child.ds-rrsigs-stripped.db
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
+
+#
+# A zone with the DNSKEY RRSIGS stripped
+#
+zone=ds-rrsigs-stripped
+infile=ds-rrsigs-stripped.db.in
+zonefile=ds-rrsigs-stripped.db
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
+"$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" \
+  | awk '$4 == "RRSIG" && $5 == "DS" { next } { print }' >"$zonefile.stripped"
+"$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" \
+  | awk '$4 == "SOA" { $7 = $7 + 1; print; next } { print }' >"$zonefile.next"
+"$SIGNER" -g -o "$zone" -f "$zonefile.next" "$zonefile.next" >/dev/null 2>&1
+cp "$zonefile.stripped" "$zonefile.signed"

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index b589e282f814ea2809a4e5ae7c0fea1748c93c77..9f29018c0625db27be836a1212f79c366068f346 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -207,6 +207,29 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
 
+echo_i "checking recovery from stripped DS RRSIG ($n)"
+ret=0
+# prime cache with DS without RRSIGs
+dig_with_opts +noauth +cd child.ds-rrsigs-stripped. @10.53.0.4 ds >dig.out.prime.ns4.test$n || ret=1
+grep ";; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1" dig.out.prime.ns4.test$n >/dev/null || ret=1
+grep "status: NOERROR" dig.out.prime.ns4.test$n >/dev/null || ret=1
+grep "RRSIG.DS" dig.out.prime.ns4.test$n >/dev/null && ret=1
+# reload server with properly signed zone
+cp ns2/ds-rrsigs-stripped.db.next ns2/ds-rrsigs-stripped.db.signed
+nextpart ns2/named.run >/dev/null
+rndccmd 10.53.0.2 reload ds-rrsigs-stripped | sed 's/^/ns2 /' | cat_i
+wait_for_log 5 "zone ds-rrsigs-stripped/IN: loaded serial 2000042408" ns2/named.run || ret=1
+# make a query that flushes the unsigned DS RRset
+dig_with_opts +noauth a.child.ds-rrsigs-stripped. @10.53.0.4 a >dig.out.ns4.test$n || ret=1
+# make a second query that should now validate
+dig_with_opts +noauth b.child.ds-rrsigs-stripped. @10.53.0.2 a >dig.out.ns2.test$n || ret=1
+dig_with_opts +noauth b.child.ds-rrsigs-stripped. @10.53.0.4 a >dig.out.ns4.test$n || ret=1
+digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 echo_i "checking that 'example/DS' from the referral was used in previous validation ($n)"
 ret=0
 grep "query 'example/DS/IN' approved" ns1/named.run >/dev/null && ret=1

diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py
index e529a72a7aace6e6f7f42bd1a12d11e421b5900e..60176f95553a1f60a4a148dc62a21fee402c9b58 100644 (file)
--- a/bin/tests/system/dnssec/tests_sh_dnssec.py
+++ b/bin/tests/system/dnssec/tests_sh_dnssec.py
@@ -59,6 +59,10 @@ pytestmark = pytest.mark.extra_artifacts(
         "ns2/dnskey-rrsigs-stripped.db",
         "ns2/dnskey-rrsigs-stripped.db.next",
         "ns2/dnskey-rrsigs-stripped.db.stripped",
+        "ns2/child.ds-rrsigs-stripped.db",
+        "ns2/ds-rrsigs-stripped.db",
+        "ns2/ds-rrsigs-stripped.db.next",
+        "ns2/ds-rrsigs-stripped.db.stripped",
         "ns2/example.db",
         "ns2/in-addr.arpa.db",
         "ns2/lazy-ksk.db",