Check disable-algorithms with non-zone names

Test that if disable-algorithms is configured on a name that is below
the zonecut, it still validates (z.secure.example).

Test that if disable-algorithms is configured on a name that is above
the zonecut, it is treated as insecure (zonecut.ent.secure.example).

(cherry picked from commit 81d3a29e4ef0730871bdc4954a5c4b6fd3e030b8)

diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
index 3b66a9d69614f6d9ff6abe085f7f95830cb21863..5eba816b795595f05fdd8a260e37b3af41b6c579 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
@@ -97,6 +97,12 @@ zone "badalg.secure.example" {
        allow-update { any; };
 };
 
+zone "zonecut.ent.secure.example" {
+       type primary;
+       file "zonecut.ent.secure.example.db.signed";
+       allow-update { any; };
+};
+
 zone "bogus.example" {
        type primary;
        file "bogus.example.db.signed";

diff --git a/bin/tests/system/dnssec/ns3/secure.example.db.in b/bin/tests/system/dnssec/ns3/secure.example.db.in
index 43ad1e557e88f865afa82afa2254b23db6dd6e94..eeb5a4cf4929b5404136afdcc02aba606c333f84 100644 (file)
--- a/bin/tests/system/dnssec/ns3/secure.example.db.in
+++ b/bin/tests/system/dnssec/ns3/secure.example.db.in
@@ -34,6 +34,9 @@ x                     CNAME   a
 badalg                 NS      ns3.badalg
 ns3.badalg             A       10.53.0.3
 
+zonecut.ent            NS      ns3.zonecut.ent
+ns3.zonecut.ent                A       10.53.0.3
+
 private                        NS      ns.private
 ns.private             A       10.53.0.2
 

diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
index 3669cd3f7b30ba92a8b432f50541a337baaa424c..350a504a13a0ea55e1ea6ff7a45fa35116d5c1f9 100644 (file)
--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
@@ -89,6 +89,18 @@ cat "$infile" "$keyname.key" >"$zonefile"
 
 "$SIGNER" -z -o "$zone" "$zonefile" >/dev/null
 
+# A zone that will be treated as insecure as the DEFAULT_ALGORITHM is
+# disabled for ent.secure.example.
+zone=zonecut.ent.secure.example.
+infile=zonecut.ent.secure.example.db.in
+zonefile=zonecut.ent.secure.example.db
+
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+
+cat "$infile" "$keyname.key" >"$zonefile"
+
+"$SIGNER" -z -o "$zone" "$zonefile" >/dev/null
+
 #
 zone=secure.example.
 infile=secure.example.db.in

diff --git a/bin/tests/system/dnssec/ns3/zonecut.ent.secure.example.db.in b/bin/tests/system/dnssec/ns3/zonecut.ent.secure.example.db.in
new file mode 100644 (file)
index 0000000..93cb343
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/zonecut.ent.secure.example.db.in
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300       ; 5 minutes
+@                      IN SOA  mname1. . (
+                               2000042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns3
+                       A       10.53.0.4
+ns3                    A       10.53.0.3

diff --git a/bin/tests/system/dnssec/ns4/named1.conf.in b/bin/tests/system/dnssec/ns4/named1.conf.in
index 8e29a45db76506d625126a76048535ff2b8a6c82..c3e055f8e9ddb9f63e139618d8929da44cbd9afc 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named1.conf.in
+++ b/bin/tests/system/dnssec/ns4/named1.conf.in
@@ -34,6 +34,8 @@ options {
        disable-ds-digests "digest-alg-unsupported.example." { "SHA384"; "SHA-384"; };
        disable-ds-digests "ds-unsupported.example." {"SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
        disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
+       disable-algorithms "z.secure.example." { ECDSAP256SHA256; };
+       disable-algorithms "ent.secure.example." { ECDSAP256SHA256; };
 
        # Note: We only reference the bind.keys file here to confirm that it
        # is *not* being used.  It contains the real root key, and we're

diff --git a/bin/tests/system/dnssec/ns4/named2.conf.in b/bin/tests/system/dnssec/ns4/named2.conf.in
index bf82385f7115244524e517b31f2aca79f674156a..ab14d44f34bb023ab0fede26bbb69646a525efff 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named2.conf.in
+++ b/bin/tests/system/dnssec/ns4/named2.conf.in
@@ -29,6 +29,8 @@ options {
        disable-ds-digests "digest-alg-unsupported.example." { "SHA384"; "SHA-384";  };
        disable-ds-digests "ds-unsupported.example." { "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
        disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
+       disable-algorithms "z.secure.example." { ECDSAP256SHA256; };
+       disable-algorithms "ent.secure.example." { ECDSAP256SHA256; };
 };
 
 key rndc_key {

diff --git a/bin/tests/system/dnssec/ns4/named3.conf.in b/bin/tests/system/dnssec/ns4/named3.conf.in
index d6a44c799de726a1782bd7a3d1ac61b71b6ae2b1..be9bb5431ab0ed52410839dbed2611dd7a2b9f36 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named3.conf.in
+++ b/bin/tests/system/dnssec/ns4/named3.conf.in
@@ -32,6 +32,8 @@ options {
        disable-ds-digests "digest-alg-unsupported.example." { "SHA384"; "SHA-384";};
        disable-ds-digests "ds-unsupported.example." { "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
        disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
+       disable-algorithms "z.secure.example." { ECDSAP256SHA256; };
+       disable-algorithms "ent.secure.example." { ECDSAP256SHA256; };
 };
 
 key rndc_key {

diff --git a/bin/tests/system/dnssec/ns4/named4.conf.in b/bin/tests/system/dnssec/ns4/named4.conf.in
index 34f59b498a2090dd91bb6dc768ce18e49e9681e7..f0dc264ddca1351ac4e368463bce0053b3b7003c 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named4.conf.in
+++ b/bin/tests/system/dnssec/ns4/named4.conf.in
@@ -25,6 +25,8 @@ options {
        disable-ds-digests "digest-alg-unsupported.example." { "SHA384"; "SHA-384"; };
        disable-ds-digests "ds-unsupported.example." { "SHA256"; "SHA-256"; "SHA384"; "SHA-384"; };
        disable-algorithms "badalg.secure.example." { ECDSAP256SHA256; };
+       disable-algorithms "z.secure.example." { ECDSAP256SHA256; };
+       disable-algorithms "ent.secure.example." { ECDSAP256SHA256; };
 };
 
 key rndc_key {

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index a192f5e0049064ed42356f385d7de3d80caa983f..5a01561eaa806dd8e527dbd1f9f901eb272b5aeb 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -3757,6 +3757,27 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
 
+echo_i "check that zone contents are still secure despite disable-algorithms on query name (name below zone name) ($n)"
+ret=0
+dig_with_opts @10.53.0.4 z.secure.example >dig.out.ns4.test$n || ret=1
+grep "ANSWER: 2," dig.out.ns4.test$n >/dev/null || ret=1
+grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
+echo_i "check that zone contents are treated as insecure when disable-algorithms name is above zone name ($n)"
+ret=0
+dig_with_opts @10.53.0.4 zonecut.ent.secure.example >dig.out.ns4.test$n || ret=1
+grep "ANSWER: 2," dig.out.ns4.test$n >/dev/null || ret=1
+grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null && ret=1
+grep "; EDE: 1 (Unsupported DNSKEY Algorithm): " dig.out.ns4.test$n >/dev/null || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 echo_i "check that DS records are still treated as secure at the disable-algorithm name ($n)"
 ret=0
 dig_with_opts @10.53.0.4 badalg.secure.example DS >dig.out.ns4.test$n || ret=1

diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py
index 52730aec0bd2e4014fcfb96928d637c381cdbb2f..7cd2633fe3f8c0db9edd54a8d9c821e43411d74a 100644 (file)
--- a/bin/tests/system/dnssec/tests_sh_dnssec.py
+++ b/bin/tests/system/dnssec/tests_sh_dnssec.py
@@ -92,6 +92,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "ns3/dnskey-unsupported-2.example.db",
         "ns3/dnskey-unsupported.example.db",
         "ns3/dnskey-unsupported.example.db.tmp",
+        "ns3/ds-unsupported.example.db",
         "ns3/dynamic.example.db",
         "ns3/digest-alg-unsupported.example.db",
         "ns3/enabled.managed.db",
@@ -142,7 +143,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "ns3/update-nsec3.example.db.signed",
         "ns3/upper.example.db",
         "ns3/upper.example.db.lower",
-        "ns3/ds-unsupported.example.db",
+        "ns3/zonecut.ent.secure.example.db",
         "ns4/managed.conf",
         "ns4/managed-keys.bind",
         "ns4/named.secroots",