From a1eb69b8a5f7c0b375c1f5c4192dd1cd0c18a970 Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Sat, 4 Nov 2023 11:44:40 +0100 Subject: [PATCH] Setup multisigner system test for NOTIFY CDS Add root and parent zones to store NOTIFY CDS records. --- .../system/multisigner/ns1/named.conf.in | 32 +++++++++++ bin/tests/system/multisigner/ns1/root.db.in | 23 ++++++++ bin/tests/system/multisigner/ns1/setup.sh | 35 ++++++++++++ .../system/multisigner/ns2/multisigner.db.in | 30 +++++++++++ .../system/multisigner/ns2/named.conf.in | 53 +++++++++++++++++++ .../system/multisigner/ns2/secondary.db.in | 30 +++++++++++ bin/tests/system/multisigner/ns2/setup.sh | 34 ++++++++++++ .../system/multisigner/ns3/named.conf.in | 11 +++- bin/tests/system/multisigner/ns3/setup.sh | 4 ++ .../system/multisigner/ns4/named.conf.in | 5 ++ bin/tests/system/multisigner/ns4/setup.sh | 4 ++ .../system/multisigner/ns5/named.conf.in | 5 ++ bin/tests/system/multisigner/setup.sh | 14 ++++- 13 files changed, 276 insertions(+), 4 deletions(-) create mode 100644 bin/tests/system/multisigner/ns1/named.conf.in create mode 100644 bin/tests/system/multisigner/ns1/root.db.in create mode 100644 bin/tests/system/multisigner/ns1/setup.sh create mode 100644 bin/tests/system/multisigner/ns2/multisigner.db.in create mode 100644 bin/tests/system/multisigner/ns2/named.conf.in create mode 100644 bin/tests/system/multisigner/ns2/secondary.db.in create mode 100644 bin/tests/system/multisigner/ns2/setup.sh diff --git a/bin/tests/system/multisigner/ns1/named.conf.in b/bin/tests/system/multisigner/ns1/named.conf.in new file mode 100644 index 0000000000..5b1c9fe7ca --- /dev/null +++ b/bin/tests/system/multisigner/ns1/named.conf.in @@ -0,0 +1,32 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +// NS1 + +options { + query-source address 10.53.0.1; + notify-source 10.53.0.1; + transfer-source 10.53.0.1; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.1; }; + listen-on-v6 { none; }; + recursion no; + notify yes; + dnssec-validation no; +}; + +zone "." { + type primary; + file "root.db.signed"; +}; diff --git a/bin/tests/system/multisigner/ns1/root.db.in b/bin/tests/system/multisigner/ns1/root.db.in new file mode 100644 index 0000000000..d4fa6738d2 --- /dev/null +++ b/bin/tests/system/multisigner/ns1/root.db.in @@ -0,0 +1,23 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 + +@ SOA me. hostmaster. 1 1800 900 604800 86400 + +. NS a.root-servers.nil. +a.root-servers.nil. A 10.53.0.1 + +multisigner. NS ns2.multisigner. +ns2.multisigner. A 10.53.0.2 + +secondary. NS ns2.secondary. +ns2.secondary. A 10.53.0.2 diff --git a/bin/tests/system/multisigner/ns1/setup.sh b/bin/tests/system/multisigner/ns1/setup.sh new file mode 100644 index 0000000000..0dd507ff52 --- /dev/null +++ b/bin/tests/system/multisigner/ns1/setup.sh @@ -0,0 +1,35 @@ +#!/bin/sh -e + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# shellcheck source=conf.sh +. ../../conf.sh + +set -e + +zone=. +infile=root.db.in +zonefile=root.db + +echo_i "ns1/setup.sh" + +ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone") +zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone") + +cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile" +"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>signer.root.out + +# Configure the resolving server with a static key. +keyfile_to_static_ds "$ksk" >trusted.conf +cp trusted.conf ../ns3/trusted.conf +cp trusted.conf ../ns4/trusted.conf +cp trusted.conf ../ns5/trusted.conf diff --git a/bin/tests/system/multisigner/ns2/multisigner.db.in b/bin/tests/system/multisigner/ns2/multisigner.db.in new file mode 100644 index 0000000000..f9a77b77f6 --- /dev/null +++ b/bin/tests/system/multisigner/ns2/multisigner.db.in @@ -0,0 +1,30 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 +@ IN SOA me.multisigner. hostmaster.multisigner. ( + 1 ; serial + 20 ; refresh (20 seconds) + 20 ; retry (20 seconds) + 1814400 ; expire (3 weeks) + 3600 ; minimum (1 hour) + ) + +multisigner. NS ns2 +ns2.multisigner. A 10.53.0.2 + +multisigner. NOTIFY CDS 1 @PORT@ scanner.multisigner. +scanner.multisigner. A 10.53.0.2 + +model2.multisigner. NS ns3 +model2.multisigner. NS ns4 +ns3.model2.multisigner. A 10.53.0.3 +ns4.model2.multisigner. A 10.53.0.4 diff --git a/bin/tests/system/multisigner/ns2/named.conf.in b/bin/tests/system/multisigner/ns2/named.conf.in new file mode 100644 index 0000000000..08e3ef2980 --- /dev/null +++ b/bin/tests/system/multisigner/ns2/named.conf.in @@ -0,0 +1,53 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +// NS2 + +options { + query-source address 10.53.0.2; + notify-source 10.53.0.2; + transfer-source 10.53.0.2; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + allow-transfer { any; }; + recursion no; + dnssec-validation no; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm @DEFAULT_HMAC@; +}; + +controls { + inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { + type hint; + file "../../_common/root.hint"; +}; + +zone "multisigner" { + type primary; + dnssec-policy default; + file "multisigner.db"; +}; + +zone "secondary" { + type primary; + dnssec-policy default; + file "secondary.db"; +}; diff --git a/bin/tests/system/multisigner/ns2/secondary.db.in b/bin/tests/system/multisigner/ns2/secondary.db.in new file mode 100644 index 0000000000..bce021a73e --- /dev/null +++ b/bin/tests/system/multisigner/ns2/secondary.db.in @@ -0,0 +1,30 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 +@ IN SOA me.secondary. hostmaster.secondary. ( + 1 ; serial + 20 ; refresh (20 seconds) + 20 ; retry (20 seconds) + 1814400 ; expire (3 weeks) + 3600 ; minimum (1 hour) + ) + +secondary. NS ns2 +ns2.secondary. A 10.53.0.2 + +secondary. NOTIFY CDS 1 @PORT@ scanner.secondary. +scanner.secondary. A 10.53.0.2 + +model2.secondary. NS ns3 +model2.secondary. NS ns4 +ns3.model2.secondary. A 10.53.0.3 +ns4.model2.secondary. A 10.53.0.4 diff --git a/bin/tests/system/multisigner/ns2/setup.sh b/bin/tests/system/multisigner/ns2/setup.sh new file mode 100644 index 0000000000..dad1752f8b --- /dev/null +++ b/bin/tests/system/multisigner/ns2/setup.sh @@ -0,0 +1,34 @@ +#!/bin/sh -e + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# shellcheck source=conf.sh +. ../../conf.sh + +echo_i "ns2/setup.sh" + +for zn in multisigner secondary; do + zone="${zn}" + infile="${zn}.db.in" + unsigned="${zn}.db.unsigned" + zonefile="${zn}.db" + + copy_setports $infile $unsigned + + csk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone") + cat "$csk.key" >> "$unsigned" + private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$csk" >> "$unsigned" + + $SIGNER -S -g -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $unsigned > signer.out.$zone 2>&1 + + cp "dsset-${zn}." ../ns1/ +done diff --git a/bin/tests/system/multisigner/ns3/named.conf.in b/bin/tests/system/multisigner/ns3/named.conf.in index 7cf25bbc44..796e6f578f 100644 --- a/bin/tests/system/multisigner/ns3/named.conf.in +++ b/bin/tests/system/multisigner/ns3/named.conf.in @@ -24,9 +24,9 @@ options { listen-on { 10.53.0.3; }; listen-on-v6 { none; }; allow-transfer { any; }; - recursion no; key-directory "."; - dnssec-validation no; + recursion yes; + dnssec-validation yes; }; key rndc_key { @@ -53,3 +53,10 @@ zone "model2.secondary." { dnssec-policy model2; inline-signing yes; }; + +zone "." { + type hint; + file "../../_common/root.hint"; +}; + +include "trusted.conf"; diff --git a/bin/tests/system/multisigner/ns3/setup.sh b/bin/tests/system/multisigner/ns3/setup.sh index 123528f35c..e7d177d4c8 100644 --- a/bin/tests/system/multisigner/ns3/setup.sh +++ b/bin/tests/system/multisigner/ns3/setup.sh @@ -30,6 +30,8 @@ $SETTIME -s -g $O -k $O now -r $O now -d $O now "$KSK" >settime.out.$zone.1 2>&1 $SETTIME -s -g $O -k $O now -z $O now "$ZSK" >settime.out.$zone.2 2>&1 # ZSK will be added to the other provider with nsupdate. cat "${ZSK}.key" | grep -v ";.*" >"${zone}.zsk" +# Append DS to DS from ns4 +$DSFROMKEY ${KSK} >> "../ns2/dsset-${zone}." zone="model2.secondary" echo_i "setting up zone: $zone" @@ -42,3 +44,5 @@ $SETTIME -s -g $O -k $O now -r $O now -d $O now "$KSK" >settime.out.$zone.1 2>&1 $SETTIME -s -g $O -k $O now -z $O now "$ZSK" >settime.out.$zone.2 2>&1 # ZSK will be added to the other provider with nsupdate. cat "${ZSK}.key" | grep -v ";.*" >"${zone}.zsk" +# Append DS to DS from ns4 +$DSFROMKEY ${KSK} >> "../ns2/dsset-${zone}." diff --git a/bin/tests/system/multisigner/ns4/named.conf.in b/bin/tests/system/multisigner/ns4/named.conf.in index 3f36f76cd5..0a72e97989 100644 --- a/bin/tests/system/multisigner/ns4/named.conf.in +++ b/bin/tests/system/multisigner/ns4/named.conf.in @@ -53,3 +53,8 @@ zone "model2.secondary." { dnssec-policy model2; inline-signing yes; }; + +zone "." { + type hint; + file "../../_common/root.hint"; +}; diff --git a/bin/tests/system/multisigner/ns4/setup.sh b/bin/tests/system/multisigner/ns4/setup.sh index dc3fc7cebd..0e385caa71 100644 --- a/bin/tests/system/multisigner/ns4/setup.sh +++ b/bin/tests/system/multisigner/ns4/setup.sh @@ -31,6 +31,8 @@ $SETTIME -s -g $O -k $O now -z $O now "$ZSK" >settime.out.$zone.2 2>&1 # ZSK will be added to the other provider with nsupdate. cat "${ZSK}.key" | grep -v ";.*" >"${zone}.zsk" +$DSFROMKEY ${KSK} > "../ns2/dsset-${zone}." + zone="model2.secondary" echo_i "setting up zone: $zone" zonefile="${zone}.db" @@ -42,3 +44,5 @@ $SETTIME -s -g $O -k $O now -r $O now -d $O now "$KSK" >settime.out.$zone.1 2>&1 $SETTIME -s -g $O -k $O now -z $O now "$ZSK" >settime.out.$zone.2 2>&1 # ZSK will be added to the other provider with nsupdate. cat "${ZSK}.key" | grep -v ";.*" >"${zone}.zsk" + +$DSFROMKEY ${KSK} > "../ns2/dsset-${zone}." diff --git a/bin/tests/system/multisigner/ns5/named.conf.in b/bin/tests/system/multisigner/ns5/named.conf.in index 0a8e4f556c..bce7ba0187 100644 --- a/bin/tests/system/multisigner/ns5/named.conf.in +++ b/bin/tests/system/multisigner/ns5/named.conf.in @@ -43,3 +43,8 @@ zone "model2.secondary." { allow-update { any; }; file "model2.secondary.db"; }; + +zone "." { + type hint; + file "../../_common/root.hint"; +}; diff --git a/bin/tests/system/multisigner/setup.sh b/bin/tests/system/multisigner/setup.sh index d1020f3fcc..00ab8d3221 100644 --- a/bin/tests/system/multisigner/setup.sh +++ b/bin/tests/system/multisigner/setup.sh @@ -18,12 +18,14 @@ set -e $SHELL clean.sh +copy_setports ns1/named.conf.in ns1/named.conf +copy_setports ns2/named.conf.in ns2/named.conf copy_setports ns3/named.conf.in ns3/named.conf copy_setports ns4/named.conf.in ns4/named.conf copy_setports ns5/named.conf.in ns5/named.conf ( - cd ns3 + cd ns5 $SHELL setup.sh ) ( @@ -31,6 +33,14 @@ copy_setports ns5/named.conf.in ns5/named.conf $SHELL setup.sh ) ( - cd ns5 + cd ns3 + $SHELL setup.sh +) +( + cd ns2 + $SHELL setup.sh +) +( + cd ns1 $SHELL setup.sh )