Revive dupsigs system test

Speed up the test from 20 minutes to 2.5 minutes and make it part of the
default test suite executed in CI.
- decrease number of records to sign from 2000 to 500
- decrease the signing interval by a factor of 6
- shorten the final part of the test after last signing (since nothing
  new happens there)

Finally, clarify misleading comments about (in)sufficient time for zone
re-signing. The time used in the test is in fact sufficient for the
re-signing to happen. If it wasn't, the previous ZSK would end up being
deleted while its signatures would still be present, which is a
situation where duplicate signatures can still happen.

(cherry picked from commit cb0a2ae1dd9f36c7dfb909d06453cd2beba595ea)

diff --git a/bin/tests/system/conf.sh.common b/bin/tests/system/conf.sh.common
index 89d4895b9786fca66f37186ae07cd38ca6625873..8860ab2fee1ed2adcdd9ddb6bf244f0560ee6f5a 100644 (file)
--- a/bin/tests/system/conf.sh.common
+++ b/bin/tests/system/conf.sh.common
@@ -27,9 +27,6 @@ export LANG=C
 #
 # Common lists of system tests to run.
 #
-# The "dupsigs" test is not run by default because it takes
-# a very long time to complete.
-#
 # The following tests are hard-coded to use ports 5300 and 9953. For
 # this reason, these must be run sequentially.
 #
@@ -52,7 +49,7 @@ SEQUENTIAL_COMMON="ecdsa eddsa tkey"
 # rpzrecurse are scheduled first, in order to get more benefit from
 # parallelism.
 #
-PARALLEL_COMMON="dnssec rpzrecurse serve-stale \
+PARALLEL_COMMON="dnssec rpzrecurse serve-stale dupsigs \
 acl \
 additional \
 addzone \

diff --git a/bin/tests/system/dupsigs/clean.sh b/bin/tests/system/dupsigs/clean.sh
index 9db0799490023b658d2bcfc8bdd65c9d5769a558..68ddace99e917917889a01d5fce40af808071e61 100644 (file)
--- a/bin/tests/system/dupsigs/clean.sh
+++ b/bin/tests/system/dupsigs/clean.sh
@@ -9,6 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+rm -f dig.out*
 rm -f ns1/named.conf
 rm -f ns1/named.lock
 rm -f ns1/named.memstats

diff --git a/bin/tests/system/dupsigs/ns1/named.conf.in b/bin/tests/system/dupsigs/ns1/named.conf.in
index c5ade8bf8ecf277792864604c030517ffa1920ef..494ecfb9e3d7fa76694e923ec8c9233817a010da 100644 (file)
--- a/bin/tests/system/dupsigs/ns1/named.conf.in
+++ b/bin/tests/system/dupsigs/ns1/named.conf.in
@@ -29,5 +29,5 @@ zone "signing.test" {
        key-directory "keys/signing.test";
        inline-signing yes;
        auto-dnssec maintain;
-       sig-validity-interval 120 30;
+       sig-validity-interval 20 5;
 };

diff --git a/bin/tests/system/dupsigs/ns1/reset_keys.sh b/bin/tests/system/dupsigs/ns1/reset_keys.sh
index 6f3defbd8268054e8a8d7443912aa8dd69b5da37..4faa0bb8776cf9c1a8b21376283cad720f571a86 100644 (file)
--- a/bin/tests/system/dupsigs/ns1/reset_keys.sh
+++ b/bin/tests/system/dupsigs/ns1/reset_keys.sh
@@ -53,14 +53,14 @@ $SETTIME -P $BASET -A $BASET $KEYDIR/$KSK
 $SETTIME -P $BASET -A $BASET $KEYDIR/$ZSK0
 
 # schedule the first roll
-R1=`expr $BASE + 300`
+R1=`expr $BASE + 50`
 R1T=`timetodnssec $R1`
 
 $SETTIME -I $R1T $KEYDIR/$ZSK0
 $SETTIME -P $BASET -A $R1T $KEYDIR/$ZSK1
 
 # schedule the second roll (which includes the delete of the first key)
-R2=`expr $R1 + 300`
+R2=`expr $R1 + 50`
 R2T=`timetodnssec $R2`
 DT=$R2
 DTT=`timetodnssec $DT`
@@ -70,8 +70,7 @@ $SETTIME -I $R2T $KEYDIR/$ZSK1
 $SETTIME -P $R1T -A $R2T $KEYDIR/$ZSK2
 
 # schedule the third roll
-# this isn't long enough for the signing to complete
-R3=`expr $R2 + 60`
+R3=`expr $R2 + 25`
 R3T=`timetodnssec $R3`
 
 $SETTIME -D $R3T $KEYDIR/$ZSK1
@@ -90,8 +89,10 @@ echo ZSK4=$ZSK4
 exit
 
 # schedule the fourth roll
-# this isn't long enough for the signing to complete
-R4=`expr $R3 + 30`
+# this isn't long enough for the signing to complete and would result in
+# duplicate signatures, see
+# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/231#note_9597
+R4=`expr $R3 + 10`
 R4T=`timetodnssec $R4`
 
 $SETTIME -D $R4T $KEYDIR/$ZSK2

diff --git a/bin/tests/system/dupsigs/ns1/signing.test.db.in b/bin/tests/system/dupsigs/ns1/signing.test.db.in
index f4c6643533c9f1a6ab25e11a69bffbf4632e9bd2..b522b6f0ef12faa111cd350e85d73ebebde0ef7d 100644 (file)
--- a/bin/tests/system/dupsigs/ns1/signing.test.db.in
+++ b/bin/tests/system/dupsigs/ns1/signing.test.db.in
@@ -15,4 +15,4 @@ $TTL 3600
 ns   A    127.0.0.1
 ns   AAAA ::1
 
-$GENERATE 0-1999 a${0,4,d} AAAA ::$
+$GENERATE 0-499 a${0,4,d} AAAA ::$

diff --git a/bin/tests/system/dupsigs/tests.sh b/bin/tests/system/dupsigs/tests.sh
index d529cfa64a7978c6d8fa42cb90dfa0d23dded6cf..87f9347e4f645a277ba0433c1ee9023bd3d5b783 100644 (file)
--- a/bin/tests/system/dupsigs/tests.sh
+++ b/bin/tests/system/dupsigs/tests.sh
@@ -14,8 +14,9 @@ SYSTEMTESTTOP=..
 
 status=0
 start=`date +%s`
-end=`expr $start + 1200`
-now=$start
+end=`expr $start + 150`
+sleep 10  # wait for a bit for the initial signing
+now=`expr $start + 10`
 while test $now -lt $end
 do
        et=`expr $now - $start`
@@ -24,12 +25,12 @@ do
        $DIG axfr signing.test -p ${PORT} @10.53.0.1 > dig.out.at$et
        awk '$4 == "RRSIG" { print $11 }' dig.out.at$et | sort | uniq -c
        lines=`awk '$4 == "RRSIG" { print}' dig.out.at$et | wc -l`
-       if [ ${et} -ne 0 -a ${lines} -ne 4009 ]
+       if [ ${et} -ne 0 -a ${lines} -ne 1009 ]
        then
                echo_i "failed"
                status=`expr $status + 1`
        fi
-       sleep 20
+       sleep 5
        now=`date +%s`
 done