add a test with an inconsistent NS RRset

add a zone with different NS RRsets in the parent and child,
and test resolver and forwarder behavior with and without +CD.

(cherry picked from commit e4652a0444a514773686e75752ad5c65daa753d5)

diff --git a/bin/tests/system/dnssec/ns1/root.db.in b/bin/tests/system/dnssec/ns1/root.db.in
index d76c89f455b2ffa8d194e29ac0fc5199ed8f4ed5..52d88ab50034231687fd21b3d53ba14809c48756 100644 (file)
--- a/bin/tests/system/dnssec/ns1/root.db.in
+++ b/bin/tests/system/dnssec/ns1/root.db.in
@@ -41,3 +41,5 @@ dnskey-rrsigs-stripped.       NS      ns2.dnskey-rrsigs-stripped.
 ns2.dnskey-rrsigs-stripped.    A       10.53.0.2
 ds-rrsigs-stripped.    NS      ns2.ds-rrsigs-stripped.
 ns2.ds-rrsigs-stripped.        A       10.53.0.2
+inconsistent.          NS      ns2.inconsistent.
+ns2.inconsistent.      A       10.53.0.2

diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index d5e4e5ff53809dbf9e45d888613d5bca9afde115..62331d6cdc52d4f4588ba68ec8ba993ec625d134 100644 (file)
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -32,6 +32,7 @@ cp "../ns2/dsset-too-many-iterations." .
 cp "../ns2/dsset-lazy-ksk." .
 cp "../ns2/dsset-dnskey-rrsigs-stripped." .
 cp "../ns2/dsset-ds-rrsigs-stripped." .
+cp "../ns2/dsset-inconsistent." .
 
 grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll." >"dsset-algroll."
 cp "../ns6/dsset-optout-tld." .

diff --git a/bin/tests/system/dnssec/ns2/inconsistent.db.in b/bin/tests/system/dnssec/ns2/inconsistent.db.in
new file mode 100644 (file)
index 0000000..0f9c211
--- /dev/null
+++ b/bin/tests/system/dnssec/ns2/inconsistent.db.in
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300       ; 5 minutes
+@                      IN SOA  ns2.example. . (
+                               2010042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns2.example.
+                       NS      ns3.example.
+                       A       10.53.0.1
+ns2                    A       10.53.0.2
+ns3                    A       10.53.0.3

diff --git a/bin/tests/system/dnssec/ns2/named.conf.in b/bin/tests/system/dnssec/ns2/named.conf.in
index fef3f47c4175ca0fd2bcb76a05a923afad5b1d3e..fc59d4090ff41480fc166b6682be0546f66b9012 100644 (file)
--- a/bin/tests/system/dnssec/ns2/named.conf.in
+++ b/bin/tests/system/dnssec/ns2/named.conf.in
@@ -209,6 +209,11 @@ zone "too-many-iterations" {
        file "too-many-iterations.db.signed";
 };
 
+zone "inconsistent" {
+       type primary;
+       file "inconsistent.db.signed";
+};
+
 zone "lazy-ksk" {
        type primary;
        file "lazy-ksk.db";

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index 1e7779e14d175b1f6e3a5e3ffd1b9232d1726d2a..318c31edad916d96f403b01ecaa90c8b7d113fac 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -414,3 +414,14 @@ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
   | awk '$4 == "SOA" { $7 = $7 + 1; print; next } { print }' >"$zonefile.next"
 "$SIGNER" -g -o "$zone" -f "$zonefile.next" "$zonefile.next" >/dev/null 2>&1
 cp "$zonefile.stripped" "$zonefile.signed"
+
+#
+# Inconsistent NS RRset between parent and child
+#
+zone=inconsistent
+infile=inconsistent.db.in
+zonefile=inconsistent.db
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$key1.key" "$key2.key" >"$zonefile"
+"$SIGNER" -3 - -g -o "$zone" "$zonefile" >/dev/null 2>&1

diff --git a/bin/tests/system/dnssec/ns4/named3.conf.in b/bin/tests/system/dnssec/ns4/named3.conf.in
index e160d374336a72ddf24c966b92b1f5fe31b59d3b..58bc1b4ab599a74fe313bd82353348f8b4623550 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named3.conf.in
+++ b/bin/tests/system/dnssec/ns4/named3.conf.in
@@ -26,6 +26,7 @@ options {
        bindkeys-file "managed.conf";
        dnssec-accept-expired yes;
        minimal-responses no;
+       servfail-ttl 0;
 };
 
 key rndc_key {

diff --git a/bin/tests/system/dnssec/ns9/named.conf.in b/bin/tests/system/dnssec/ns9/named.conf.in
index 06530a08c1b0fdfdd17289adc0d64eb922c16155..cdbe7ec8eaccf8a9ec55f79239324d133aa61bbf 100644 (file)
--- a/bin/tests/system/dnssec/ns9/named.conf.in
+++ b/bin/tests/system/dnssec/ns9/named.conf.in
@@ -25,6 +25,7 @@ options {
        dnssec-validation yes;
        forward only;
        forwarders { 10.53.0.4; };
+       servfail-ttl 0;
 };
 
 key rndc_key {

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 061a27262a7f24647959f4a1b2e9621ee765c63b..c022e8afca91b0bd7fee02e0cb9f9e1ab99e6911 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -4537,5 +4537,21 @@ n=$((n + 1))
 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
+echo_i "checking validator behavior with mismatching NS ($n)"
+ret=0
+rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i
+$DIG +tcp +cd -p "$PORT" -t ns inconsistent @10.53.0.4 >dig.out.ns4.test$n.1 || ret=1
+grep "ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2" dig.out.ns4.test$n.1 >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n.1 >/dev/null && ret=1
+$DIG +tcp +cd +dnssec -p "$PORT" -t ns inconsistent @10.53.0.4 >dig.out.ns4.test$n.2 || ret=1
+grep "ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2" dig.out.ns4.test$n.2 >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n.2 >/dev/null && ret=1
+$DIG +tcp +dnssec -p "$PORT" -t ns inconsistent @10.53.0.4 >dig.out.ns4.test$n.3 || ret=1
+grep "ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1" dig.out.ns4.test$n.3 >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n.3 >/dev/null || ret=1
+n=$((n + 1))
+if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py
index 60176f95553a1f60a4a148dc62a21fee402c9b58..4bf8819f97635b47297ff6caa5f4b4374a50dd01 100644 (file)
--- a/bin/tests/system/dnssec/tests_sh_dnssec.py
+++ b/bin/tests/system/dnssec/tests_sh_dnssec.py
@@ -70,6 +70,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "ns2/nsec3chain-test.db",
         "ns2/single-nsec3.db",
         "ns2/too-many-iterations.db",
+        "ns2/inconsistent.db",
         "ns2/trusted.db",
         "ns2/updatecheck-kskonly.secure.ksk.id",
         "ns2/updatecheck-kskonly.secure.ksk.key",