upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-07-15 22:32:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add revoked truncated self-signed DNSKEY test to dnssec_py

Browse source 
Port test_truncated_dnskey from dnssec_malformed_dnskey into the shared
dnssec_py fixture harness, completing the migration and deleting the
remaining dnssec_malformed_dnskey files.

Assisted-by: Claude:claude-opus-4-8
(cherry picked from commit 1d6866b0ee)
This commit is contained in:
Nicki Křížek 2026-06-08 15:34:35 +00:00
parent 6e070eaf6a
commit c141c30040
8 changed files with 47 additions and 179 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
bin/tests/system/dnssec_malformed_dnskey/ns2/named.conf.j2
View file

@ -1,37 +0,0 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
options {
query-source address 10.53.0.2;
notify-source 10.53.0.2;
transfer-source 10.53.0.2;
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.2; };
listen-on-v6 { none; };
allow-transfer { any; };
recursion no;
dnssec-validation yes;
};
zone truncated-active.selfsigned. {
type primary;
file "truncated-active.selfsigned.db.signed";
};
zone truncated-revoked.selfsigned. {
type primary;
file "truncated-revoked.selfsigned.db.signed";
};
include "trusted.conf";

34
bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-active.selfsigned.db.signed
View file

@ -1,34 +0,0 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; SPDX-License-Identifier: MPL-2.0
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
$TTL 300
@ IN SOA mname1. . (
1 ; serial
600 ; refresh
600 ; retry
1200 ; expire
600 ; minimum
)
@ NS @
@ A 10.53.0.2
; The following DNSKEY is too short for the algorithm, but will be
; accepted by the DNSKEY parser code, which only checks for minimum length.
@ DNSKEY 257 3 14 fYA=
@ RRSIG SOA 14 2 86400 20950926153053 20251013153053 33167 @ xxxx5f7U0DiPvKFxpB83mTyqkAO0TfM0 xe4ZMYoJUQEPYdd0GTNkFzI6crsbU0lQ t/V1YOxAt5B+T1ch9n5dhYwt7ZTqluI2 mr6myKMesdPl1zp1hEgkmFpCG3NOXl2Z
@ RRSIG NS 14 2 86400 20950926153053 20251013153053 33167 @ xxxxLBPc05g7v/K5UfGuXsHH8xd29eQb 5qWe+Ei4Qn0GlmH0x/VIJiJMZXuxD5S+ VhP7DiX7uKIxi0QS2DOK1aOMXq/2WiUV 2VBmYAoSUilMlJY84I2XbzqD5iz5y+yp
@ RRSIG A 14 2 86400 20950926153053 20251013153053 33167 @ xxxx6UguMh8jgdVox2UVURjEsAP0D8o2 mFofnFOd6eYf+49QlWD+GX6x60X/hPVi f2XFsajouCvT/ZSmoXKWad3RC1DLHF/H TdOGMKlT4DfvbeJV+N5N0bgu2Wv3QRdM
@ RRSIG DNSKEY 14 2 86400 20950926153053 20251013153053 33167 @ xxxxqayRNsL32Km0c9AjwN0RNktt4iGb 97Dwi0uiHPcM4eVNZR2w68XMUh43+nR1 DA1QE2RqIqt7soEIwi1z4kAczf7W1wrP 7dcbEwjxS9D1CefuNRG1xnj9wGsqKecI
@ NSEC a A NS SOA RRSIG NSEC DNSKEY
@ RRSIG NSEC 14 2 0 20950926153053 20251013153053 33167 @ xxxx4Y6vqeOJHWEeg0T0OY4z7BdDrTkn BY9Yra8zSjFEGZvIX3irPd81+u5xlA0T 9waJO2Y9W42IMrOeKdQt++QXVHsLhOYn 4NAF6RotHSb4cqv1DXI1PSchMaJ5FWwD

28
bin/tests/system/dnssec_malformed_dnskey/ns2/trusted.conf.j2
View file

@ -1,28 +0,0 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
trust-anchors {
truncated-active.selfsigned. static-key 257 3 14 "fYA=";
/*
* The key tag in the trust anchor must match that of the revoked
* truncated self-signed key in the truncated-revoked.selfsigned.
* zone.
*
* The DNSKEY contents are intentionally different here, because the
* key doesn't have the revoked bit here and that flag is part of the
* key tag. The following decodes to key tag 33167, which is the same
* as the revoked truncated key in the zone file.
*/
truncated-revoked.selfsigned. static-key 257 3 14 "fYA=";
};

44
bin/tests/system/dnssec_malformed_dnskey/ns3/named.conf.j2
View file

@ -1,44 +0,0 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
options {
query-source address 10.53.0.3;
notify-source 10.53.0.3;
transfer-source 10.53.0.3;
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.3; };
listen-on-v6 { none; };
allow-transfer { any; };
dnssec-validation yes;
/* This is the default, but the test relies on it. */
max-validation-failures-per-fetch 1;
};
zone "example." {
type static-stub;
server-addresses { 10.53.0.2; };
};
zone "truncated-active.selfsigned." {
type static-stub;
server-addresses { 10.53.0.2; };
};
zone "truncated-revoked.selfsigned." {
type static-stub;
server-addresses { 10.53.0.2; };
};
include "trusted.conf";

1
bin/tests/system/dnssec_malformed_dnskey/ns3/trusted.conf.j2
View file

@ -1 +0,0 @@
../ns2/trusted.conf.j2

24
bin/tests/system/dnssec_malformed_dnskey/tests_malformed_dnskey.py
View file

@ -1,24 +0,0 @@
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
import isctest
def test_truncated_active_dnskey():
msg = isctest.query.create("a.truncated-active.selfsigned.", "A")
res = isctest.query.tcp(msg, "10.53.0.3")
isctest.check.servfail(res)
def test_truncated_revoked_dnskey():
msg = isctest.query.create("a.truncated-revoked.selfsigned.", "A")
res = isctest.query.tcp(msg, "10.53.0.3")
isctest.check.servfail(res)

13
bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-revoked.selfsigned.db.signed → bin/tests/system/dnssec_py/ns2/zones/truncated.selfsigned.db.signed.j2
View file

@ -1,14 +1,4 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; SPDX-License-Identifier: MPL-2.0
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
{% raw %}
$TTL 300
@ IN SOA mname1. . (
@ -38,3 +28,4 @@ a A 10.53.0.2
a RRSIG A 14 3 86400 20950926153053 20251013153053 33167 @ xxxxv31CNatB9xzj3AfTMlwiO0OqxbpJ cWrHN8zjj1ScXpqrHITfG/CZpoECDLWF wkXshDB/QMxHrnXkPKEcR2c9o5tcQT5R nHvtr7HT4Ob5PcY5DnItf3OWhE+bocmW
a NSEC @ A RRSIG NSEC
a RRSIG NSEC 14 3 0 20950926153053 20251013153053 33167 @ xxxxwMWbUxb3ScBKEVheQ2wFqujc6cyt 28GVCU0wPrBpK72HSsgdYme7IG8ZXGfa IWSU1Kf/om5+El7Tf2vDs7aI1yI7e7YG D5IxMejQg5v3/wtP7AJZXP5K9ICjq/ph
{% endraw %}

45
bin/tests/system/dnssec_py/tests_dnskey_truncated_selfsigned.py Normal file
View file

@ -0,0 +1,45 @@
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
from re import compile as Re
from dnssec_py.common import DNSSEC_PY_MARK
from isctest.template import NS2, TrustAnchor, zones
from isctest.zone import Zone, configure_root
import isctest
pytestmark = DNSSEC_PY_MARK
def bootstrap():
zone = Zone("truncated.selfsigned", NS2, signed=True)
root = configure_root([zone], signed=False) # just delegation, TA is added directly
# The trust anchor key tag must match the revoked truncated self-signed key
# in the zone (key tag 33167). The flags differ here (257 vs 385) because
# the revoked bit is not part of the trust anchor, but it is part of the key
# tag calculation.
zone_ta = TrustAnchor("truncated.selfsigned", "static-key", '257 3 14 "fYA="')
return {
"trust_anchors": [zone_ta],
"zones": zones([root, zone]),
}
def test_truncated_dnskey(ns9):
msg = isctest.query.create("a.truncated.selfsigned.", "A")
with ns9.watch_log_from_here() as watcher:
res = isctest.query.tcp(msg, ns9.ip)
watcher.wait_for_line(Re("a.truncated.selfsigned/A.*broken trust chain"))
isctest.check.servfail(res)