Add test case with no empty non-terminals

The previous test cases already test the more complex case where there
are empty non-terminals between the child apex and the parent domain.

Add a test case where this is not the case, to execute the other code
path.

diff --git a/bin/tests/system/checkds/ns2/ns2.db.in b/bin/tests/system/checkds/ns2/ns2.db.in
index 293a4467783670899e3c31c6213646e8d3d735de..5d59a06b66d51f6ca700550f05310ef282579ad7 100644 (file)
--- a/bin/tests/system/checkds/ns2/ns2.db.in
+++ b/bin/tests/system/checkds/ns2/ns2.db.in
@@ -21,6 +21,9 @@ $TTL 300
                                NS      ns2
 ns2                            A       10.53.0.2
 
+no-ent                         NS      ns9.no-ent
+ns9.no-ent                     A       10.53.0.9
+
 $ORIGIN explicit.dspublish.ns2.
 good                           NS      ns9.good
 reference                      NS      ns9.reference

diff --git a/bin/tests/system/checkds/ns2/ns5.db.in b/bin/tests/system/checkds/ns2/ns5.db.in
index 70f6619e0c8e5369c6d047fbdaf34b2ae84dc388..640af0f78ecb1951661f07d3a7485dac6e53f4b6 100644 (file)
--- a/bin/tests/system/checkds/ns2/ns5.db.in
+++ b/bin/tests/system/checkds/ns2/ns5.db.in
@@ -21,6 +21,9 @@ $TTL 300
                                NS      ns5
 ns5                            A       10.53.0.5
 
+no-ent                         NS      ns9.no-ent
+ns9.no-ent                     A       10.53.0.9
+
 $ORIGIN explicit.dspublish.ns5.
 not-yet                                NS      ns9.not-yet
 ns9.not-yet                    A       10.53.0.9

diff --git a/bin/tests/system/checkds/ns5/ns2.db.in b/bin/tests/system/checkds/ns5/ns2.db.in
index 293a4467783670899e3c31c6213646e8d3d735de..5d59a06b66d51f6ca700550f05310ef282579ad7 100644 (file)
--- a/bin/tests/system/checkds/ns5/ns2.db.in
+++ b/bin/tests/system/checkds/ns5/ns2.db.in
@@ -21,6 +21,9 @@ $TTL 300
                                NS      ns2
 ns2                            A       10.53.0.2
 
+no-ent                         NS      ns9.no-ent
+ns9.no-ent                     A       10.53.0.9
+
 $ORIGIN explicit.dspublish.ns2.
 good                           NS      ns9.good
 reference                      NS      ns9.reference

diff --git a/bin/tests/system/checkds/ns5/ns5.db.in b/bin/tests/system/checkds/ns5/ns5.db.in
index 70f6619e0c8e5369c6d047fbdaf34b2ae84dc388..640af0f78ecb1951661f07d3a7485dac6e53f4b6 100644 (file)
--- a/bin/tests/system/checkds/ns5/ns5.db.in
+++ b/bin/tests/system/checkds/ns5/ns5.db.in
@@ -21,6 +21,9 @@ $TTL 300
                                NS      ns5
 ns5                            A       10.53.0.5
 
+no-ent                         NS      ns9.no-ent
+ns9.no-ent                     A       10.53.0.9
+
 $ORIGIN explicit.dspublish.ns5.
 not-yet                                NS      ns9.not-yet
 ns9.not-yet                    A       10.53.0.9

diff --git a/bin/tests/system/checkds/ns9/named.conf.in b/bin/tests/system/checkds/ns9/named.conf.in
index ad78f620ff3761e4b326423395f6785991a1d68c..dc6e26ad3cdc4e4a6fe49c15bca65342911f5bac 100644 (file)
--- a/bin/tests/system/checkds/ns9/named.conf.in
+++ b/bin/tests/system/checkds/ns9/named.conf.in
@@ -96,6 +96,15 @@ zone "good.no.dspublish.ns2" {
        checkds no;
 };
 
+/* Same as auto parental agents, but now without empty non-terminals. */
+zone "no-ent.ns2" {
+       type primary;
+       file "no-ent.ns2.db";
+       inline-signing yes;
+       dnssec-policy "default";
+       checkds yes;
+};
+
 /*
  * 1.     Enabling DNSSEC
  * 1.1    - With one parental agent
@@ -281,6 +290,14 @@ zone "good.no.dsremoved.ns5" {
        checkds no;
 };
 
+zone "no-ent.ns5" {
+       type primary;
+       file "no-ent.ns5.db";
+       inline-signing yes;
+       dnssec-policy "default";
+       checkds yes;
+};
+
 /*
  * 2.     Going insecure
  * 2.1    - With one parental agent

diff --git a/bin/tests/system/checkds/ns9/setup.sh b/bin/tests/system/checkds/ns9/setup.sh
index 3bfdfe921d415b30599af5567e4e11936c97ea81..d3ea25dee9607d70bf63e2baa45bcd278a46ab09 100644 (file)
--- a/bin/tests/system/checkds/ns9/setup.sh
+++ b/bin/tests/system/checkds/ns9/setup.sh
@@ -24,6 +24,30 @@ setup() {
        echo "$zone" >> zones
 }
 
+sign_dspublish() {
+       cp template.db.in "$zonefile"
+       keytimes="-P $T -P sync $T -A $T"
+       CSK=$($KEYGEN -k default $keytimes $zone 2> keygen.out.$zone)
+       $SETTIME -s -g $O -k $O $T -r $O $T -z $O $T -d $R $T "$CSK" > settime.out.$zone 2>&1
+       cat "$zonefile" "${CSK}.key" > "$infile"
+       private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
+       cp $infile $zonefile
+       $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+        cp "dsset-${zone}." ../ns2/
+}
+
+sign_dsremoved() {
+       cp template.db.in "$zonefile"
+       keytimes="-P $Y -P sync $Y -A $Y"
+       CSK=$($KEYGEN -k default $keytimes $zone 2> keygen.out.$zone)
+       $SETTIME -s -g $H -k $O $T -r $O $T -z $O $T -d $U $T "$CSK" > settime.out.$zone 2>&1
+       cat "$zonefile" "${CSK}.key" > "$infile"
+       private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
+       cp $infile $zonefile
+       $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+        cp "dsset-${zone}." ../ns2/
+}
+
 # Short environment variable names for key states and times.
 H="HIDDEN"
 R="RUMOURED"
@@ -46,16 +70,7 @@ do
                bad.${checkds}.dspublish.ns2-4-6
        do
                setup "${zn}"
-               cp template.db.in "$zonefile"
-               keytimes="-P $T -P sync $T -A $T"
-               CSK=$($KEYGEN -k default $keytimes $zone 2> keygen.out.$zone)
-               $SETTIME -s -g $O -k $O $T -r $O $T -z $O $T -d $R $T "$CSK" > settime.out.$zone 2>&1
-               cat "$zonefile" "${CSK}.key" > "$infile"
-               private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-               cp $infile $zonefile
-               $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
-
-               cp "dsset-${zone}." ../ns2/
+               sign_dspublish
        done
 done
 
@@ -72,15 +87,12 @@ do
                bad.${checkds}.dsremoved.ns5-6-7
        do
                setup "${zn}"
-               cp template.db.in "$zonefile"
-               keytimes="-P $Y -P sync $Y -A $Y"
-               CSK=$($KEYGEN -k default $keytimes $zone 2> keygen.out.$zone)
-               $SETTIME -s -g $H -k $O $T -r $O $T -z $O $T -d $U $T "$CSK" > settime.out.$zone 2>&1
-               cat "$zonefile" "${CSK}.key" > "$infile"
-               private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
-               cp $infile $zonefile
-               $SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
-
-               cp "dsset-${zone}." ../ns2/
+               sign_dsremoved
        done
 done
+
+setup "no-ent.ns2"
+sign_dspublish
+
+setup "no-ent.ns5"
+sign_dsremoved

diff --git a/bin/tests/system/checkds/tests_checkds.py b/bin/tests/system/checkds/tests_checkds.py
index 757e58113f2aec210c960528d3940403cd970df8..31c073f1496f4604d0080f6648a213d3288cebd5 100755 (executable)
--- a/bin/tests/system/checkds/tests_checkds.py
+++ b/bin/tests/system/checkds/tests_checkds.py
@@ -555,6 +555,31 @@ def test_checkds_resolver(named_port):
     keystate_check(parent, "resolver.explicit.dsremoved.ns5.", "DSRemoved")
 
 
+def test_checkds_no_ent(named_port):
+    # We create resolver instances that will be used to send queries.
+    server = dns.resolver.Resolver()
+    server.nameservers = ["10.53.0.9"]
+    server.port = named_port
+
+    parent = dns.resolver.Resolver()
+    parent.nameservers = ["10.53.0.2"]
+    parent.port = named_port
+
+    zone_check(server, "no-ent.ns2.")
+    wait_for_log(
+        "ns9/named.run",
+        "zone no-ent.ns2/IN (signed): checkds: DS response from 10.53.0.2",
+    )
+    keystate_check(parent, "no-ent.ns2.", "DSPublish")
+
+    zone_check(server, "no-ent.ns5.")
+    wait_for_log(
+        "ns9/named.run",
+        "zone no-ent.ns5/IN (signed): checkds: DS response from 10.53.0.5",
+    )
+    keystate_check(parent, "no-ent.ns5.", "DSRemoved")
+
+
 def test_checkds_dspublished(named_port):
     checkds_dspublished(named_port, "explicit")
     checkds_dspublished(named_port, "yes")