Check unsigned serial number in signed zone files

All signed zone files present in bin/tests/system/inline/ns8 should
contain the unsigned serial number in the raw-format header.  Add a
check to ensure that is the case.  Extend the dnssec-signzone command
line in ns8/sign.sh with the -L option to allow the zones initially
signed there to pass the newly added check.  Add another zone to the
configuration for the ns8 named instance to ensure the check also passes
when multiple zones are inline-signed by a single named instance.

diff --git a/bin/tests/system/inline/ns8/named.conf.in b/bin/tests/system/inline/ns8/named.conf.in
index 242c4dc870b6828f2d4b17fc8a69633a575d41ed..b6ee1bf16afdc2f16dc152e8fd025daa3840ac94 100644 (file)
--- a/bin/tests/system/inline/ns8/named.conf.in
+++ b/bin/tests/system/inline/ns8/named.conf.in
@@ -151,3 +151,10 @@ zone example {
        auto-dnssec maintain;
        file "example.db";
 };
+
+zone "unsigned-serial-test" {
+       type primary;
+       inline-signing yes;
+       auto-dnssec maintain;
+       file "unsigned-serial-test.db";
+};

diff --git a/bin/tests/system/inline/ns8/sign.sh b/bin/tests/system/inline/ns8/sign.sh
index 9033c720796862e8d316da8f1686e62f2a86df90..d8702fd2bc9148e823f526f385a84252bc8bce8e 100755 (executable)
--- a/bin/tests/system/inline/ns8/sign.sh
+++ b/bin/tests/system/inline/ns8/sign.sh
@@ -21,12 +21,13 @@ do
   keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
   keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
   cp example.com.db.in ${zone}.db
-  $SIGNER -S -T 3600 -O raw -o ${zone} ${zone}.db > /dev/null 2>&1
+  $SIGNER -S -T 3600 -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null 2>&1
 done
 
-zone=example
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
-cp ${zone}.db.in ${zone}.db
+for zone in example unsigned-serial-test; do
+  rm -f K${zone}.+*+*.key
+  rm -f K${zone}.+*+*.private
+  keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+  keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
+  cp example.db.in ${zone}.db
+done

diff --git a/bin/tests/system/inline/tests_signed_zone_files.py b/bin/tests/system/inline/tests_signed_zone_files.py
new file mode 100755 (executable)
index 0000000..0abbb98
--- /dev/null
+++ b/bin/tests/system/inline/tests_signed_zone_files.py
@@ -0,0 +1,68 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+import glob
+import struct
+
+
+class RawFormatHeader(dict):
+    '''
+    A dictionary of raw-format header fields read from a zone file.
+    '''
+
+    fields = [
+        'format',
+        'version',
+        'dumptime',
+        'flags',
+        'sourceserial',
+        'lastxfrin',
+    ]
+
+    def __init__(self, file_name):
+        header = struct.Struct('>IIIIII')
+        with open(file_name, 'rb') as data:
+            header_data = data.read(header.size)
+        super().__init__(zip(self.fields, header.unpack_from(header_data)))
+
+
+def test_unsigned_serial_number():
+
+    '''
+    Check whether all signed zone files in the "ns8" subdirectory contain the
+    serial number of the unsigned version of the zone in the raw-format header.
+    The test assumes that all "*.signed" files in the "ns8" subdirectory are in
+    raw format.
+
+    Notes:
+
+      - The actual zone signing and dumping happens while the tests.sh phase of
+        the "inline" system test is set up and run.  This check only verifies
+        the outcome of those events; it does not initiate any signing or
+        dumping itself.
+
+      - example[0-9][0-9].com.db.signed files are initially signed by
+        dnssec-signzone while the others - by named.
+    '''
+
+    zones_with_unsigned_serial_missing = []
+
+    for signed_zone in sorted(glob.glob('ns8/*.signed')):
+        raw_header = RawFormatHeader(signed_zone)
+        # Ensure the unsigned serial number is placed where it is expected.
+        assert raw_header['format'] == 2
+        assert raw_header['version'] == 1
+        # Check whether the header flags indicate that the unsigned serial
+        # number is set and that the latter is indeed set.
+        if raw_header['flags'] & 0x02 == 0 or raw_header['sourceserial'] == 0:
+            zones_with_unsigned_serial_missing.append(signed_zone)
+
+    assert not zones_with_unsigned_serial_missing

diff --git a/util/copyrights b/util/copyrights
index e57b83189ee337d63cd7dbb550909726f1094678..b1752be8ce1654491d1ba7617be37e9aa44ea4d5 100644 (file)
--- a/util/copyrights
+++ b/util/copyrights
@@ -426,6 +426,7 @@
 ./bin/tests/system/inline/ns8/sign.sh          SH      2020,2021,2022
 ./bin/tests/system/inline/setup.sh             SH      2011,2012,2013,2014,2016,2017,2018,2019,2020,2021,2022
 ./bin/tests/system/inline/tests.sh             SH      2011,2012,2013,2014,2016,2017,2018,2019,2020,2021,2022
+./bin/tests/system/inline/tests_signed_zone_files.py   PYTHON  2022
 ./bin/tests/system/integrity/clean.sh          SH      2017,2018,2019,2020,2021,2022
 ./bin/tests/system/integrity/setup.sh          SH      2018,2019,2020,2021,2022
 ./bin/tests/system/integrity/tests.sh          SH      2017,2018,2019,2020,2021,2022