From c141c30040fdf97a3fe3f8aaeaa14f0ea5b5b861 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicki=20K=C5=99=C3=AD=C5=BEek?= Date: Mon, 8 Jun 2026 15:34:35 +0000 Subject: [PATCH] Add revoked truncated self-signed DNSKEY test to dnssec_py Port test_truncated_dnskey from dnssec_malformed_dnskey into the shared dnssec_py fixture harness, completing the migration and deleting the remaining dnssec_malformed_dnskey files. Assisted-by: Claude:claude-opus-4-8 (cherry picked from commit 1d6866b0ee3167df6114c4943060ca810a8df58f) --- .../dnssec_malformed_dnskey/ns2/named.conf.j2 | 37 --------------- .../ns2/truncated-active.selfsigned.db.signed | 34 -------------- .../ns2/trusted.conf.j2 | 28 ------------ .../dnssec_malformed_dnskey/ns3/named.conf.j2 | 44 ------------------ .../ns3/trusted.conf.j2 | 1 - .../tests_malformed_dnskey.py | 24 ---------- .../zones/truncated.selfsigned.db.signed.j2} | 13 +----- .../tests_dnskey_truncated_selfsigned.py | 45 +++++++++++++++++++ 8 files changed, 47 insertions(+), 179 deletions(-) delete mode 100644 bin/tests/system/dnssec_malformed_dnskey/ns2/named.conf.j2 delete mode 100644 bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-active.selfsigned.db.signed delete mode 100644 bin/tests/system/dnssec_malformed_dnskey/ns2/trusted.conf.j2 delete mode 100644 bin/tests/system/dnssec_malformed_dnskey/ns3/named.conf.j2 delete mode 120000 bin/tests/system/dnssec_malformed_dnskey/ns3/trusted.conf.j2 delete mode 100644 bin/tests/system/dnssec_malformed_dnskey/tests_malformed_dnskey.py rename bin/tests/system/{dnssec_malformed_dnskey/ns2/truncated-revoked.selfsigned.db.signed => dnssec_py/ns2/zones/truncated.selfsigned.db.signed.j2} (81%) create mode 100644 bin/tests/system/dnssec_py/tests_dnskey_truncated_selfsigned.py diff --git a/bin/tests/system/dnssec_malformed_dnskey/ns2/named.conf.j2 b/bin/tests/system/dnssec_malformed_dnskey/ns2/named.conf.j2 deleted file mode 100644 index 0d55a720c4..0000000000 --- a/bin/tests/system/dnssec_malformed_dnskey/ns2/named.conf.j2 +++ /dev/null @@ -1,37 +0,0 @@ -/* - * Copyright (C) Internet Systems Consortium, Inc. ("ISC") - * - * SPDX-License-Identifier: MPL-2.0 - * - * This Source Code Form is subject to the terms of the Mozilla Public - * License, v. 2.0. If a copy of the MPL was not distributed with this - * file, you can obtain one at https://mozilla.org/MPL/2.0/. - * - * See the COPYRIGHT file distributed with this work for additional - * information regarding copyright ownership. - */ - -options { - query-source address 10.53.0.2; - notify-source 10.53.0.2; - transfer-source 10.53.0.2; - port @PORT@; - pid-file "named.pid"; - listen-on { 10.53.0.2; }; - listen-on-v6 { none; }; - allow-transfer { any; }; - recursion no; - dnssec-validation yes; -}; - -zone truncated-active.selfsigned. { - type primary; - file "truncated-active.selfsigned.db.signed"; -}; - -zone truncated-revoked.selfsigned. { - type primary; - file "truncated-revoked.selfsigned.db.signed"; -}; - -include "trusted.conf"; diff --git a/bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-active.selfsigned.db.signed b/bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-active.selfsigned.db.signed deleted file mode 100644 index 16416bfeb0..0000000000 --- a/bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-active.selfsigned.db.signed +++ /dev/null @@ -1,34 +0,0 @@ -; Copyright (C) Internet Systems Consortium, Inc. ("ISC") -; -; SPDX-License-Identifier: MPL-2.0 -; -; This Source Code Form is subject to the terms of the Mozilla Public -; License, v. 2.0. If a copy of the MPL was not distributed with this -; file, you can obtain one at https://mozilla.org/MPL/2.0/. -; -; See the COPYRIGHT file distributed with this work for additional -; information regarding copyright ownership. - -$TTL 300 - -@ IN SOA mname1. . ( - 1 ; serial - 600 ; refresh - 600 ; retry - 1200 ; expire - 600 ; minimum - ) - -@ NS @ -@ A 10.53.0.2 - -; The following DNSKEY is too short for the algorithm, but will be -; accepted by the DNSKEY parser code, which only checks for minimum length. -@ DNSKEY 257 3 14 fYA= - -@ RRSIG SOA 14 2 86400 20950926153053 20251013153053 33167 @ xxxx5f7U0DiPvKFxpB83mTyqkAO0TfM0 xe4ZMYoJUQEPYdd0GTNkFzI6crsbU0lQ t/V1YOxAt5B+T1ch9n5dhYwt7ZTqluI2 mr6myKMesdPl1zp1hEgkmFpCG3NOXl2Z -@ RRSIG NS 14 2 86400 20950926153053 20251013153053 33167 @ xxxxLBPc05g7v/K5UfGuXsHH8xd29eQb 5qWe+Ei4Qn0GlmH0x/VIJiJMZXuxD5S+ VhP7DiX7uKIxi0QS2DOK1aOMXq/2WiUV 2VBmYAoSUilMlJY84I2XbzqD5iz5y+yp -@ RRSIG A 14 2 86400 20950926153053 20251013153053 33167 @ xxxx6UguMh8jgdVox2UVURjEsAP0D8o2 mFofnFOd6eYf+49QlWD+GX6x60X/hPVi f2XFsajouCvT/ZSmoXKWad3RC1DLHF/H TdOGMKlT4DfvbeJV+N5N0bgu2Wv3QRdM -@ RRSIG DNSKEY 14 2 86400 20950926153053 20251013153053 33167 @ xxxxqayRNsL32Km0c9AjwN0RNktt4iGb 97Dwi0uiHPcM4eVNZR2w68XMUh43+nR1 DA1QE2RqIqt7soEIwi1z4kAczf7W1wrP 7dcbEwjxS9D1CefuNRG1xnj9wGsqKecI -@ NSEC a A NS SOA RRSIG NSEC DNSKEY -@ RRSIG NSEC 14 2 0 20950926153053 20251013153053 33167 @ xxxx4Y6vqeOJHWEeg0T0OY4z7BdDrTkn BY9Yra8zSjFEGZvIX3irPd81+u5xlA0T 9waJO2Y9W42IMrOeKdQt++QXVHsLhOYn 4NAF6RotHSb4cqv1DXI1PSchMaJ5FWwD diff --git a/bin/tests/system/dnssec_malformed_dnskey/ns2/trusted.conf.j2 b/bin/tests/system/dnssec_malformed_dnskey/ns2/trusted.conf.j2 deleted file mode 100644 index 03d2a326b1..0000000000 --- a/bin/tests/system/dnssec_malformed_dnskey/ns2/trusted.conf.j2 +++ /dev/null @@ -1,28 +0,0 @@ -/* - * Copyright (C) Internet Systems Consortium, Inc. ("ISC") - * - * SPDX-License-Identifier: MPL-2.0 - * - * This Source Code Form is subject to the terms of the Mozilla Public - * License, v. 2.0. If a copy of the MPL was not distributed with this - * file, you can obtain one at https://mozilla.org/MPL/2.0/. - * - * See the COPYRIGHT file distributed with this work for additional - * information regarding copyright ownership. - */ - -trust-anchors { - truncated-active.selfsigned. static-key 257 3 14 "fYA="; - - /* - * The key tag in the trust anchor must match that of the revoked - * truncated self-signed key in the truncated-revoked.selfsigned. - * zone. - * - * The DNSKEY contents are intentionally different here, because the - * key doesn't have the revoked bit here and that flag is part of the - * key tag. The following decodes to key tag 33167, which is the same - * as the revoked truncated key in the zone file. - */ - truncated-revoked.selfsigned. static-key 257 3 14 "fYA="; -}; diff --git a/bin/tests/system/dnssec_malformed_dnskey/ns3/named.conf.j2 b/bin/tests/system/dnssec_malformed_dnskey/ns3/named.conf.j2 deleted file mode 100644 index 5008e75e73..0000000000 --- a/bin/tests/system/dnssec_malformed_dnskey/ns3/named.conf.j2 +++ /dev/null @@ -1,44 +0,0 @@ -/* - * Copyright (C) Internet Systems Consortium, Inc. ("ISC") - * - * SPDX-License-Identifier: MPL-2.0 - * - * This Source Code Form is subject to the terms of the Mozilla Public - * License, v. 2.0. If a copy of the MPL was not distributed with this - * file, you can obtain one at https://mozilla.org/MPL/2.0/. - * - * See the COPYRIGHT file distributed with this work for additional - * information regarding copyright ownership. - */ - -options { - query-source address 10.53.0.3; - notify-source 10.53.0.3; - transfer-source 10.53.0.3; - port @PORT@; - pid-file "named.pid"; - listen-on { 10.53.0.3; }; - listen-on-v6 { none; }; - allow-transfer { any; }; - dnssec-validation yes; - - /* This is the default, but the test relies on it. */ - max-validation-failures-per-fetch 1; -}; - -zone "example." { - type static-stub; - server-addresses { 10.53.0.2; }; -}; - -zone "truncated-active.selfsigned." { - type static-stub; - server-addresses { 10.53.0.2; }; -}; - -zone "truncated-revoked.selfsigned." { - type static-stub; - server-addresses { 10.53.0.2; }; -}; - -include "trusted.conf"; diff --git a/bin/tests/system/dnssec_malformed_dnskey/ns3/trusted.conf.j2 b/bin/tests/system/dnssec_malformed_dnskey/ns3/trusted.conf.j2 deleted file mode 120000 index e14af83a92..0000000000 --- a/bin/tests/system/dnssec_malformed_dnskey/ns3/trusted.conf.j2 +++ /dev/null @@ -1 +0,0 @@ -../ns2/trusted.conf.j2 \ No newline at end of file diff --git a/bin/tests/system/dnssec_malformed_dnskey/tests_malformed_dnskey.py b/bin/tests/system/dnssec_malformed_dnskey/tests_malformed_dnskey.py deleted file mode 100644 index 1dde0d16d5..0000000000 --- a/bin/tests/system/dnssec_malformed_dnskey/tests_malformed_dnskey.py +++ /dev/null @@ -1,24 +0,0 @@ -# Copyright (C) Internet Systems Consortium, Inc. ("ISC") -# -# SPDX-License-Identifier: MPL-2.0 -# -# This Source Code Form is subject to the terms of the Mozilla Public -# License, v. 2.0. If a copy of the MPL was not distributed with this -# file, you can obtain one at https://mozilla.org/MPL/2.0/. -# -# See the COPYRIGHT file distributed with this work for additional -# information regarding copyright ownership. - -import isctest - - -def test_truncated_active_dnskey(): - msg = isctest.query.create("a.truncated-active.selfsigned.", "A") - res = isctest.query.tcp(msg, "10.53.0.3") - isctest.check.servfail(res) - - -def test_truncated_revoked_dnskey(): - msg = isctest.query.create("a.truncated-revoked.selfsigned.", "A") - res = isctest.query.tcp(msg, "10.53.0.3") - isctest.check.servfail(res) diff --git a/bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-revoked.selfsigned.db.signed b/bin/tests/system/dnssec_py/ns2/zones/truncated.selfsigned.db.signed.j2 similarity index 81% rename from bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-revoked.selfsigned.db.signed rename to bin/tests/system/dnssec_py/ns2/zones/truncated.selfsigned.db.signed.j2 index ea49773fe6..533dbca091 100644 --- a/bin/tests/system/dnssec_malformed_dnskey/ns2/truncated-revoked.selfsigned.db.signed +++ b/bin/tests/system/dnssec_py/ns2/zones/truncated.selfsigned.db.signed.j2 @@ -1,14 +1,4 @@ -; Copyright (C) Internet Systems Consortium, Inc. ("ISC") -; -; SPDX-License-Identifier: MPL-2.0 -; -; This Source Code Form is subject to the terms of the Mozilla Public -; License, v. 2.0. If a copy of the MPL was not distributed with this -; file, you can obtain one at https://mozilla.org/MPL/2.0/. -; -; See the COPYRIGHT file distributed with this work for additional -; information regarding copyright ownership. - +{% raw %} $TTL 300 @ IN SOA mname1. . ( @@ -38,3 +28,4 @@ a A 10.53.0.2 a RRSIG A 14 3 86400 20950926153053 20251013153053 33167 @ xxxxv31CNatB9xzj3AfTMlwiO0OqxbpJ cWrHN8zjj1ScXpqrHITfG/CZpoECDLWF wkXshDB/QMxHrnXkPKEcR2c9o5tcQT5R nHvtr7HT4Ob5PcY5DnItf3OWhE+bocmW a NSEC @ A RRSIG NSEC a RRSIG NSEC 14 3 0 20950926153053 20251013153053 33167 @ xxxxwMWbUxb3ScBKEVheQ2wFqujc6cyt 28GVCU0wPrBpK72HSsgdYme7IG8ZXGfa IWSU1Kf/om5+El7Tf2vDs7aI1yI7e7YG D5IxMejQg5v3/wtP7AJZXP5K9ICjq/ph +{% endraw %} diff --git a/bin/tests/system/dnssec_py/tests_dnskey_truncated_selfsigned.py b/bin/tests/system/dnssec_py/tests_dnskey_truncated_selfsigned.py new file mode 100644 index 0000000000..fa6ceea85f --- /dev/null +++ b/bin/tests/system/dnssec_py/tests_dnskey_truncated_selfsigned.py @@ -0,0 +1,45 @@ +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +from re import compile as Re + +from dnssec_py.common import DNSSEC_PY_MARK +from isctest.template import NS2, TrustAnchor, zones +from isctest.zone import Zone, configure_root + +import isctest + +pytestmark = DNSSEC_PY_MARK + + +def bootstrap(): + zone = Zone("truncated.selfsigned", NS2, signed=True) + + root = configure_root([zone], signed=False) # just delegation, TA is added directly + + # The trust anchor key tag must match the revoked truncated self-signed key + # in the zone (key tag 33167). The flags differ here (257 vs 385) because + # the revoked bit is not part of the trust anchor, but it is part of the key + # tag calculation. + zone_ta = TrustAnchor("truncated.selfsigned", "static-key", '257 3 14 "fYA="') + + return { + "trust_anchors": [zone_ta], + "zones": zones([root, zone]), + } + + +def test_truncated_dnskey(ns9): + msg = isctest.query.create("a.truncated.selfsigned.", "A") + with ns9.watch_log_from_here() as watcher: + res = isctest.query.tcp(msg, ns9.ip) + watcher.wait_for_line(Re("a.truncated.selfsigned/A.*broken trust chain")) + isctest.check.servfail(res)