Make system test changes needed for PRIVATEOID/PRIVATEDNS

- When the algorithm value for a DNSSEC key is set to PRIVATEOID
  or PRIVATEDNS, that's a placeholder value indicating that the
  real algorithm identifier is encoded into the key or signature
  data.  That means the DNSKEY algorithm value and the DST algorithm
  value may not be identical, so we must now add environment variables
  DEFAULT_ALGORITHM_DST_NUMBER, ALTERNATIVE_ALGORITHM_DST_NUMBER
  and DISABLED_ALGORITHM_DST_NUMBER to the test suite, with support
  for mapping from DST algorithm value to PRIVATEDNS or PRIVATEOID.

- Some test cases use RRSIGs that have been modified to force
  validation to fail. When making those modifications, we now
  preserve the first part of the signature, so that PRIVATEDNS and
  PRIVATEOID algorithm identifier values will still work.  (This
  assumes that the identifiers are short and fit into the first
  base64 block.)

diff --git a/bin/tests/system/conf.sh b/bin/tests/system/conf.sh
index fa5b17b703fea354771f7cdd53dc783c824d8859..e17e83116c2d58c49e441a641d4fd51696cefb04 100644 (file)
--- a/bin/tests/system/conf.sh
+++ b/bin/tests/system/conf.sh
@@ -518,13 +518,16 @@ copy_setports() {
     -e "s/@CONTROLPORT@/${CONTROLPORT}/g" \
     -e "s/@DEFAULT_ALGORITHM@/${DEFAULT_ALGORITHM}/g" \
     -e "s/@DEFAULT_ALGORITHM_NUMBER@/${DEFAULT_ALGORITHM_NUMBER}/g" \
+    -e "s/@DEFAULT_ALGORITHM_DST_NUMBER@/${DEFAULT_ALGORITHM_DST_NUMBER}/g" \
     -e "s/@DEFAULT_BITS@/${DEFAULT_BITS}/g" \
     -e "s/@ALTERNATIVE_ALGORITHM@/${ALTERNATIVE_ALGORITHM}/g" \
     -e "s/@ALTERNATIVE_ALGORITHM_NUMBER@/${ALTERNATIVE_ALGORITHM_NUMBER}/g" \
+    -e "s/@ALTERNATIVE_ALGORITHM_DST_NUMBER@/${ALTERNATIVE_ALGORITHM_DST_NUMBER}/g" \
     -e "s/@ALTERNATIVE_BITS@/${ALTERNATIVE_BITS}/g" \
     -e "s/@DEFAULT_HMAC@/${DEFAULT_HMAC}/g" \
     -e "s/@DISABLED_ALGORITHM@/${DISABLED_ALGORITHM}/g" \
     -e "s/@DISABLED_ALGORITHM_NUMBER@/${DISABLED_ALGORITHM_NUMBER}/g" \
+    -e "s/@DISABLED_ALGORITHM_NUMBER@/${DISABLED_ALGORITHM_DST_NUMBER}/g" \
     -e "s/@DISABLED_BITS@/${DISABLED_BITS}/g" \
     $1 >$2
 }

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index 08f4d89e277a244b57515ed92f58df5f8c0b7d79..31494222654947441723ecc13a981137e235831c 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -87,7 +87,7 @@ zonefiletmp=$(mktemp "$zonefile.XXXXXX") || exit 1
   | awk '
 tolower($1) == "bad-cname.example." && $4 == "RRSIG" && $5 == "CNAME" {
        for (i = 1; i <= NF; i++ ) {
-               if (i <= 12) {
+               if (i <= 13) {
                        printf("%s ", $i);
                        continue;
                }
@@ -106,7 +106,7 @@ tolower($1) == "bad-cname.example." && $4 == "RRSIG" && $5 == "CNAME" {
 
 tolower($1) == "bad-dname.example." && $4 == "RRSIG" && $5 == "DNAME" {
        for (i = 1; i <= NF; i++ ) {
-               if (i <= 12) {
+               if (i <= 13) {
                        printf("%s ", $i);
                        continue;
                }

diff --git a/bin/tests/system/isctest/kasp.py b/bin/tests/system/isctest/kasp.py
index 1aec27c3f5fa24f034b8d500a0451ea9fc5d5d39..e334ee3ac50137305860da907aeeb276bfa88141 100644 (file)
--- a/bin/tests/system/isctest/kasp.py
+++ b/bin/tests/system/isctest/kasp.py
@@ -390,6 +390,10 @@ class Key:
 
         return ksigning, zsigning
 
+    def get_dnsalg(self) -> int:
+        alg = int(self.get_metadata("Algorithm"))
+        return alg
+
     def ttl(self) -> int:
         with open(self.keyfile, "r", encoding="utf-8") as file:
             for line in file:
@@ -810,7 +814,7 @@ def _check_signatures(
             offline_ksk=offline_ksk, zsk_missing=zsk_missing, smooth=smooth
         )
 
-        alg = key.get_metadata("Algorithm")
+        alg = key.get_dnsalg()
         rtype = dns.rdatatype.to_text(covers)
 
         expect = rf"IN RRSIG {rtype} {alg} (\d) (\d+) (\d+) (\d+) {key.tag} {fqdn}"

diff --git a/bin/tests/system/isctest/vars/algorithms.py b/bin/tests/system/isctest/vars/algorithms.py
index 446ab09d695a1e38c4c31487ebb8a89fd90e7c2b..86741e14a2aa1416b11deee7172b18c8ef732c4b 100644 (file)
--- a/bin/tests/system/isctest/vars/algorithms.py
+++ b/bin/tests/system/isctest/vars/algorithms.py
@@ -30,17 +30,20 @@ ALG_VARS = {
     "ALGORITHM_SET": "none",
     "DEFAULT_ALGORITHM": "",
     "DEFAULT_ALGORITHM_NUMBER": "",
+    "DEFAULT_ALGORITHM_DST_NUMBER": "",
     "DEFAULT_BITS": "",
     # Alternative algorithm for test cases that require more than one algorithm
     # (for example algorithm rollover). Must be different from
     # DEFAULT_ALGORITHM.
     "ALTERNATIVE_ALGORITHM": "",
     "ALTERNATIVE_ALGORITHM_NUMBER": "",
+    "ALTERNATIVE_ALGORITHM_DST_NUMBER": "",
     "ALTERNATIVE_BITS": "",
     # Algorithm that is used for tests against the "disable-algorithms"
     # configuration option. Must be different from above algorithms.
     "DISABLED_ALGORITHM": "",
     "DISABLED_ALGORITHM_NUMBER": "",
+    "DISABLED_ALGORITHM_DST_NUMBER": "",
     "DISABLED_BITS": "",
     # Default HMAC algorithm. Must match the rndc configuration in
     # bin/tests/system/_common (rndc.conf, rndc.key)
@@ -54,6 +57,7 @@ STABLE_PERIOD = 3600 * 3
 class Algorithm(NamedTuple):
     name: str
     number: int
+    dst: int
     bits: int
 
 
@@ -72,13 +76,13 @@ class AlgorithmSet(NamedTuple):
     "disable-algorithms" configuration option."""
 
 
-RSASHA1 = Algorithm("RSASHA1", 5, 2048)
-RSASHA256 = Algorithm("RSASHA256", 8, 2048)
-RSASHA512 = Algorithm("RSASHA512", 10, 2048)
-ECDSAP256SHA256 = Algorithm("ECDSAP256SHA256", 13, 256)
-ECDSAP384SHA384 = Algorithm("ECDSAP384SHA384", 14, 384)
-ED25519 = Algorithm("ED25519", 15, 256)
-ED448 = Algorithm("ED448", 16, 456)
+RSASHA1 = Algorithm("RSASHA1", 5, 5, 2048)
+RSASHA256 = Algorithm("RSASHA256", 8, 8, 2048)
+RSASHA512 = Algorithm("RSASHA512", 10, 10, 2048)
+ECDSAP256SHA256 = Algorithm("ECDSAP256SHA256", 13, 13, 256)
+ECDSAP384SHA384 = Algorithm("ECDSAP384SHA384", 14, 14, 384)
+ED25519 = Algorithm("ED25519", 15, 15, 256)
+ED448 = Algorithm("ED448", 16, 16, 456)
 
 ALL_ALGORITHMS = [
     RSASHA1,
@@ -250,6 +254,7 @@ def _algorithms_env(algs: AlgorithmSet, name: str) -> Dict[str, str]:
     def set_alg_env(alg: Algorithm, prefix):
         algs_env[f"{prefix}_ALGORITHM"] = alg.name
         algs_env[f"{prefix}_ALGORITHM_NUMBER"] = str(alg.number)
+        algs_env[f"{prefix}_ALGORITHM_DST_NUMBER"] = str(alg.dst)
         algs_env[f"{prefix}_BITS"] = str(alg.bits)
 
     assert isinstance(algs.default, Algorithm)

diff --git a/bin/tests/system/ksr/tests_ksr.py b/bin/tests/system/ksr/tests_ksr.py
index a5aefa0b219fb036c74a58ae2709d29448761d69..fa09e85d84ab5cde68ad498c476387e0f34b5042 100644 (file)
--- a/bin/tests/system/ksr/tests_ksr.py
+++ b/bin/tests/system/ksr/tests_ksr.py
@@ -105,7 +105,7 @@ def ksr(zone, policy, action, options="", raise_on_exception=True):
 def check_keys(
     keys,
     lifetime,
-    alg=os.environ["DEFAULT_ALGORITHM_NUMBER"],
+    alg=os.environ["DEFAULT_ALGORITHM_DST_NUMBER"],
     size=os.environ["DEFAULT_BITS"],
     offset=0,
     with_state=False,
@@ -246,7 +246,7 @@ def check_rrsig_bundle(bundle_keys, bundle_lines, zone, rrtype, sigend, sigstart
     count = 0
     for key in bundle_keys:
         found = False
-        alg = key.get_metadata("Algorithm")
+        alg = key.get_dnsalg()
         expect = f"{zone}. 3600 IN RRSIG {rrtype} {alg} 2 3600 {sigend} {sigstart} {key.tag} {zone}."
         # there must be a signature of this ksk
         for line in bundle_lines:
@@ -1125,9 +1125,9 @@ def test_ksr_twotone(servers):
     ksks_altalg = []
     for ksk in ksks:
         alg = ksk.get_metadata("Algorithm")
-        if alg == os.environ.get("DEFAULT_ALGORITHM_NUMBER"):
+        if alg == os.environ.get("DEFAULT_ALGORITHM_DST_NUMBER"):
             ksks_defalg.append(ksk)
-        elif alg == os.environ.get("ALTERNATIVE_ALGORITHM_NUMBER"):
+        elif alg == os.environ.get("ALTERNATIVE_ALGORITHM_DST_NUMBER"):
             ksks_altalg.append(ksk)
 
     assert len(ksks_defalg) == 1
@@ -1135,7 +1135,7 @@ def test_ksr_twotone(servers):
 
     check_keys(ksks_defalg, None)
 
-    alg = os.environ.get("ALTERNATIVE_ALGORITHM_NUMBER")
+    alg = os.environ.get("ALTERNATIVE_ALGORITHM_DST_NUMBER")
     size = os.environ.get("ALTERNATIVE_BITS")
     check_keys(ksks_altalg, None, alg, size)
 
@@ -1154,9 +1154,9 @@ def test_ksr_twotone(servers):
     zsks_altalg = []
     for zsk in zsks:
         alg = zsk.get_metadata("Algorithm")
-        if alg == os.environ.get("DEFAULT_ALGORITHM_NUMBER"):
+        if alg == os.environ.get("DEFAULT_ALGORITHM_DST_NUMBER"):
             zsks_defalg.append(zsk)
-        elif alg == os.environ.get("ALTERNATIVE_ALGORITHM_NUMBER"):
+        elif alg == os.environ.get("ALTERNATIVE_ALGORITHM_DST_NUMBER"):
             zsks_altalg.append(zsk)
 
     assert len(zsks_defalg) == 4
@@ -1165,7 +1165,7 @@ def test_ksr_twotone(servers):
     lifetime = timedelta(days=31 * 3)
     check_keys(zsks_defalg, lifetime)
 
-    alg = os.environ.get("ALTERNATIVE_ALGORITHM_NUMBER")
+    alg = os.environ.get("ALTERNATIVE_ALGORITHM_DST_NUMBER")
     size = os.environ.get("ALTERNATIVE_BITS")
     lifetime = timedelta(days=31 * 5)
     check_keys(zsks_altalg, lifetime, alg, size)
@@ -1216,7 +1216,7 @@ def test_ksr_twotone(servers):
     lifetime = timedelta(days=31 * 3)
     check_keys(zsks_defalg, lifetime, with_state=True)
 
-    alg = os.environ.get("ALTERNATIVE_ALGORITHM_NUMBER")
+    alg = os.environ.get("ALTERNATIVE_ALGORITHM_DST_NUMBER")
     size = os.environ.get("ALTERNATIVE_BITS")
     lifetime = timedelta(days=31 * 5)
     check_keys(zsks_altalg, lifetime, alg, size, with_state=True)