check that DNSKEY and other occluded data are excluded from the delegating bitmap

(cherry picked from commit 7e4b82103be08f0cbd17e1e3871e17246a53e859)

diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index bc7472432561f08c9128e39612b1b5fbd19208af..1bbfd203a55caae1e125749cc4837b9dc9f0874f 100644 (file)
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -9,90 +9,96 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed
-rm -f */example.bk
-rm -f */named.conf
-rm -f */named.memstats
-rm -f */named.run
-rm -f */named.secroots
-rm -f */tmp* */*.jnl */*.bk */*.jbk
-rm -f */trusted.conf */managed.conf */revoked.conf
-rm -f Kexample.*
-rm -f canonical?.*
-rm -f delv.out*
-rm -f delve.out*
-rm -f dig.out.*
-rm -f dsfromkey.out.*
-rm -f keygen.err
-rm -f named.secroots.test*
-rm -f nosign.before
-rm -f ns*/*.nta
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*
-rm -f ns*/named.lock
-rm -f ns1/managed.key.id
-rm -f ns1/root.db ns2/example.db ns3/secure.example.db
-rm -f ns2/algroll.db
-rm -f ns2/badparam.db ns2/badparam.db.bad
-rm -f ns2/cdnskey-update.secure.db
-rm -f ns2/cdnskey.secure.db
-rm -f ns2/cds-auto.secure.db ns2/cds-auto.secure.db.jnl
-rm -f ns2/cds-update.secure.db ns2/cds-update.secure.db.jnl
-rm -f ns2/cds.secure.db
-rm -f ns2/dlv.db
-rm -f ns2/in-addr.arpa.db
-rm -f ns2/nsec3chain-test.db
-rm -f ns2/private.secure.example.db
-rm -f ns2/single-nsec3.db
-rm -f ns3/auto-nsec.example.db ns3/auto-nsec3.example.db
-rm -f ns3/badds.example.db
-rm -f ns3/dname-at-apex-nsec3.example.db
-rm -f ns3/dnskey-nsec3-unknown.example.db
-rm -f ns3/dnskey-nsec3-unknown.example.db.tmp
-rm -f ns3/dnskey-unknown.example.db
-rm -f ns3/dnskey-unknown.example.db.tmp
-rm -f ns3/dynamic.example.db ns3/dynamic.example.db.signed.jnl
-rm -f ns3/expired.example.db ns3/update-nsec3.example.db
-rm -f ns3/expiring.example.db ns3/nosign.example.db
-rm -f ns3/future.example.db ns3/trusted-future.key
-rm -f ns3/inline.example.db.signed
-rm -f ns3/kskonly.example.db
-rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower
-rm -f ns3/multiple.example.db ns3/nsec3-unknown.example.db ns3/nsec3.example.db
-rm -f ns3/nsec3.nsec3.example.db
-rm -f ns3/nsec3.optout.example.db
-rm -f ns3/optout-unknown.example.db ns3/optout.example.db
-rm -f ns3/optout.nsec3.example.db
-rm -f ns3/optout.optout.example.db
-rm -f ns3/publish-inactive.example.db
-rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
-rm -f ns3/secure.below-cname.example.db
-rm -f ns3/secure.nsec3.example.db
-rm -f ns3/secure.optout.example.db
-rm -f ns3/siginterval.conf
-rm -f ns3/siginterval.example.db
-rm -f ns3/split-dnssec.example.db
-rm -f ns3/split-smart.example.db
-rm -f ns3/ttlpatch.example.db ns3/ttlpatch.example.db.signed
-rm -f ns3/ttlpatch.example.db.patched
-rm -f ns3/unsecure.example.db ns3/bogus.example.db ns3/keyless.example.db
-rm -f ns3/revkey.example.db
-rm -f ns3/managed-future.example.db
-rm -f ns4/managed-keys.bind*
-rm -f ns4/named_dump.db
-rm -f ns6/optout-tld.db
-rm -f ns7/multiple.example.bk ns7/nsec3.example.bk ns7/optout.example.bk
-rm -f ns7/split-rrsig.db ns7/split-rrsig.db.unsplit
-rm -f nsupdate.out*
-rm -f python.out.*
-rm -f rndc.out.*
-rm -f signer/*.db
-rm -f signer/example.db.after signer/example.db.before
-rm -f signer/example.db.changed
-rm -f signer/general/dsset*
-rm -f signer/general/signed.zone
-rm -f signer/general/signer.out.*
-rm -f signer/nsec3param.out
-rm -f signer/signer.out.*
-rm -f signing.out*
-rm -f signer/*.signed.pre*
-rm -f signer/*.signed.post*
+set -e
+
+rm -f ./*/K* ./*/keyset-* ./*/dsset-* ./*/dlvset-* ./*/signedkey-* ./*/*.signed
+rm -f ./*/example.bk
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.run
+rm -f ./*/named.secroots
+rm -f ./*/tmp* ./*/*.jnl ./*/*.bk ./*/*.jbk
+rm -f ./*/trusted.conf ./*/managed.conf ./*/revoked.conf
+rm -f ./Kexample.*
+rm -f ./canonical?.*
+rm -f ./delv.out*
+rm -f ./delve.out*
+rm -f ./dig.out.*
+rm -f ./dsfromkey.out.*
+rm -f ./keygen.err
+rm -f ./named.secroots.test*
+rm -f ./nosign.before
+rm -f ./ns*/*.nta
+rm -f ./ns*/managed-keys.bind* ./ns*/*.mkeys*
+rm -f ./ns*/named.lock
+rm -f ./ns1/managed.key.id
+rm -f ./ns1/root.db ./ns2/example.db ./ns3/secure.example.db
+rm -f ./ns2/algroll.db
+rm -f ./ns2/badparam.db ./ns2/badparam.db.bad
+rm -f ./ns2/cdnskey-kskonly.secure.db
+rm -f ./ns2/cdnskey-update.secure.db
+rm -f ./ns2/cdnskey-x.secure.db
+rm -f ./ns2/cdnskey.secure.db
+rm -f ./ns2/cds-auto.secure.db ./ns2/cds-auto.secure.db.jnl
+rm -f ./ns2/cds-kskonly.secure.db
+rm -f ./ns2/cds-update.secure.db ./ns2/cds-update.secure.db.jnl
+rm -f ./ns2/cds.secure.db ./ns2/cds-x.secure.db
+rm -f ./ns2/dlv.db
+rm -f ./ns2/in-addr.arpa.db
+rm -f ./ns2/nsec3chain-test.db
+rm -f ./ns2/private.secure.example.db
+rm -f ./ns2/single-nsec3.db
+rm -f ./ns3/auto-nsec.example.db ./ns3/auto-nsec3.example.db
+rm -f ./ns3/badds.example.db
+rm -f ./ns3/dname-at-apex-nsec3.example.db
+rm -f ./ns3/dnskey-nsec3-unknown.example.db
+rm -f ./ns3/dnskey-nsec3-unknown.example.db.tmp
+rm -f ./ns3/dnskey-unknown.example.db
+rm -f ./ns3/dnskey-unknown.example.db.tmp
+rm -f ./ns3/dynamic.example.db ./ns3/dynamic.example.db.signed.jnl
+rm -f ./ns3/expired.example.db ./ns3/update-nsec3.example.db
+rm -f ./ns3/expiring.example.db ./ns3/nosign.example.db
+rm -f ./ns3/future.example.db ./ns3/trusted-future.key
+rm -f ./ns3/inline.example.db.signed
+rm -f ./ns3/kskonly.example.db
+rm -f ./ns3/lower.example.db ./ns3/upper.example.db ./ns3/upper.example.db.lower
+rm -f ./ns3/managed-future.example.db
+rm -f ./ns3/multiple.example.db ./ns3/nsec3-unknown.example.db ./ns3/nsec3.example.db
+rm -f ./ns3/nsec3.nsec3.example.db
+rm -f ./ns3/nsec3.optout.example.db
+rm -f ./ns3/occluded.example.db
+rm -f ./ns3/optout-unknown.example.db ./ns3/optout.example.db
+rm -f ./ns3/optout.nsec3.example.db
+rm -f ./ns3/optout.optout.example.db
+rm -f ./ns3/publish-inactive.example.db
+rm -f ./ns3/revkey.example.db
+rm -f ./ns3/rsasha256.example.db ./ns3/rsasha512.example.db
+rm -f ./ns3/secure.below-cname.example.db
+rm -f ./ns3/secure.nsec3.example.db
+rm -f ./ns3/secure.optout.example.db
+rm -f ./ns3/siginterval.conf
+rm -f ./ns3/siginterval.example.db
+rm -f ./ns3/split-dnssec.example.db
+rm -f ./ns3/split-smart.example.db
+rm -f ./ns3/ttlpatch.example.db ./ns3/ttlpatch.example.db.signed
+rm -f ./ns3/ttlpatch.example.db.patched
+rm -f ./ns3/unsecure.example.db ./ns3/bogus.example.db ./ns3/keyless.example.db
+rm -f ./ns4/managed-keys.bind*
+rm -f ./ns4/named_dump.db
+rm -f ./ns6/optout-tld.db
+rm -f ./ns7/multiple.example.bk ./ns7/nsec3.example.bk ./ns7/optout.example.bk
+rm -f ./ns7/split-rrsig.db ./ns7/split-rrsig.db.unsplit
+rm -f ./nsupdate.out*
+rm -f ./python.out.*
+rm -f ./rndc.out.*
+rm -f ./signer/*.db
+rm -f ./signer/*.signed.post*
+rm -f ./signer/*.signed.pre*
+rm -f ./signer/example.db.after ./signer/example.db.before
+rm -f ./signer/example.db.changed
+rm -f ./signer/general/dsset*
+rm -f ./signer/general/signed.zone
+rm -f ./signer/general/signer.out.*
+rm -f ./signer/nsec3param.out
+rm -f ./signer/signer.out.*
+rm -f ./signing.out*

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index a645b1209f7d47d287d1be764d7a12420db8a8e2..c177b5163c8e2c0329541374aca7abd4a0ba7dea 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -25,7 +25,7 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
        kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
        ttlpatch split-dnssec split-smart expired expiring upper lower \
        dnskey-unknown dnskey-nsec3-unknown managed-future revkey \
-       dname-at-apex-nsec3
+       dname-at-apex-nsec3 occluded
 do
        cp ../ns3/dsset-$subdomain.example$TP .
 done

diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
index 779eb7d6315c9ee480c82d9a23dca1d7d2e7a3e2..02443d5291edca52ae3287e5b6c8abfd923c125f 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
@@ -298,6 +298,11 @@ zone "dname-at-apex-nsec3.example" {
        file "dname-at-apex-nsec3.example.db.signed";
 };
 
+zone "occluded.example" {
+       type master;
+       file "occluded.example.db.signed";
+};
+
 include "siginterval.conf";
 
 include "trusted.conf";

diff --git a/bin/tests/system/dnssec/ns3/occluded.example.db.in b/bin/tests/system/dnssec/ns3/occluded.example.db.in
new file mode 100644 (file)
index 0000000..77a1cfb
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/occluded.example.db.in
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300       ; 5 minutes
+@                      IN SOA  mname1. . (
+                               2000042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns
+ns                     A       10.53.0.3
+
+a.b                    A       10.0.0.1
+delegation             NS      ns
+                       A       10.53.0.3
+                       AAAA    2002::

diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
index 75d76cca0fb9ded50aea5721ead302dc3e9bec67..6d9c31c1f78c10c411882b5f44d5e3e2be7137c3 100644 (file)
--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
@@ -554,3 +554,18 @@ kskname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -3fk $zone`
 zskname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -3 $zone`
 cat $infile $kskname.key $zskname.key >$zonefile
 $SIGNER -P -r $RANDFILE -3 - -o $zone $zonefile > /dev/null 2>&1
+
+#
+# A NSEC zone with occuded data at the delegation
+#
+zone=occluded.example
+infile=occluded.example.db.in
+zonefile=occluded.example.db
+kskname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA256 -b 1024 -fk "$zone"`
+zskname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA256 -b 1024 "$zone"`
+keyname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA1 -b 1024 -n ENTITY -T KEY "delegation.$zone"`
+dnskeyname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA256 -b 1024 -fk "delegation.$zone"`
+$DSFROMKEY "$dnskeyname.key" > "dsset-delegation.${zone}$TP"
+cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
+    "${dnskeyname}.key" "dsset-delegation.${zone}$TP" >"$zonefile"
+"$SIGNER" -P -r $RANDFILE -o "$zone" "$zonefile" > /dev/null 2>&1

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 29ffb75df3386a1178a037eff4f361905f315b5d..6fac279941c340d81c5c2b1fcbfa0496a9afb9c4 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -3521,5 +3521,15 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+echo_i "check that DNSKEY and other occluded data are excluded from the delegating bitmap ($n)"
+ret=0
+$DIG $DIGOPTS axfr occluded.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "^delegation.occluded.example..*NSEC.*NS KEY DS RRSIG NSEC$" dig.out.ns3.test$n > /dev/null || ret=1
+grep "^delegation.occluded.example..*DNSKEY.*" dig.out.ns3.test$n > /dev/null || ret=1
+grep "^delegation.occluded.example..*AAAA.*" dig.out.ns3.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+test "$ret" -eq 0 || echo_i "failed"
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/util/copyrights b/util/copyrights
index cffda80d762ebcc8a0479dfa80a0dc7b4a69688e..67b432cfc0d27aa53b47b69380f57e281def0b0a 100644 (file)
--- a/util/copyrights
+++ b/util/copyrights
@@ -1114,6 +1114,7 @@
 ./bin/tests/system/dnssec/ns3/nsec3.example.db.in      ZONE    2006,2008,2016,2018
 ./bin/tests/system/dnssec/ns3/nsec3.nsec3.example.db.in        ZONE    2008,2016,2018
 ./bin/tests/system/dnssec/ns3/nsec3.optout.example.db.in       ZONE    2008,2016,2018
+./bin/tests/system/dnssec/ns3/occluded.example.db.in   ZONE    2018
 ./bin/tests/system/dnssec/ns3/optout-unknown.example.db.in     ZONE    2006,2008,2016,2018
 ./bin/tests/system/dnssec/ns3/optout.example.db.in     ZONE    2006,2008,2016,2018
 ./bin/tests/system/dnssec/ns3/optout.nsec3.example.db.in       ZONE    2008,2016,2018