add dnskey and soa signatures disable resigning

bin/tests/system/autosign/clean.sh

@@ -53,6 +53,7 @@ rm -f ns3/oldsigs.example.db
 rm -f ns3/optout.example.db
 rm -f ns3/optout.nsec3.example.db
 rm -f ns3/optout.optout.example.db
+rm -f ns3/partialnsec3.example.db
 rm -f ns3/prepub.example.db
 rm -f ns3/prepub.example.db.in
 rm -f ns3/reconf.example.db

bin/tests/system/autosign/ns2/example.db.in

@@ -84,3 +84,6 @@ oldsigs			NS	ns.oldsigs
 ns.oldsigs		A	10.53.0.3
 
 dname-at-apex-nsec3	NS	ns3
+
+partialnsec3		NS	ns.partialnsec3
+ns.partialnsec3		A	10.53.0.3

bin/tests/system/autosign/ns3/keygen.sh

@@ -223,7 +223,7 @@ $KEYGEN -a RSASHA1 -3 -q $zone > kg.out 2>&1 || dumpit kg.out
 cp $infile $zonefile
 
 # default key TTL should be used
-setup ttl2.example 
+setup ttl2.example
 $KEYGEN -a RSASHA1 -3 -q -fk -L 60 $zone > kg.out 2>&1 || dumpit kg.out
 $KEYGEN -a RSASHA1 -3 -q -L 60 $zone > kg.out 2>&1 || dumpit kg.out
 cp $infile $zonefile
@@ -355,3 +355,16 @@ cp $infile $zonefile
 ksk=`$KEYGEN -q -a RSASHA1 -3 -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -q -a RSASHA1 -3 $zone > kg.out 2>&1 || dumpit kg.out
 $DSFROMKEY $ksk.key > dsset-${zone}$TP
+
+#
+# A zone that starts with partial signed zone (soa only) and
+# with a partial NSEC3 chain
+#
+setup partialnsec3.example
+ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -fk $zone 2> kg.out` || dumpit kg.out
+zsk=`$KEYGEN -a NSEC3RSASHA1 -3 -q $zone 2> kg.out` || dumpit kg.out
+cp "$infile" "$zonefile"
+"$SIGNER" -S -P -3 D399EAAB -H 1 -O full -u -o "$zone" "$zonefile" > /dev/null 2>&1
+grep "IN.RRSIG.SOA" "$zonefile.signed" > "$zonefile"
+cat "$infile" "${ksk}.key" "${zsk}.key" >> "$zonefile"
+$DSFROMKEY $ksk.key > dsset-${zone}$TP

bin/tests/system/autosign/ns3/named.conf.in

@@ -308,4 +308,11 @@ zone "dname-at-apex-nsec3.example" {
 	auto-dnssec maintain;
 };
 
+zone "partialnsec3.example" {
+	type master;
+	file "partialnsec3.example.db";
+	allow-update { any; };
+	auto-dnssec maintain;
+};
+
 include "trusted.conf";

bin/tests/system/autosign/ns3/partialnsec3.example.db.in

@@ -0,0 +1,43 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+			NSEC3PARAM 1 0 1 D399EAAB
+ns			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4
+z			A	10.0.0.26
+a.a.a.a			A	10.0.0.3
+child			NS	ns2.example.
+insecure		NS	ns.insecure
+ns.insecure 		A	10.53.0.3
+secure			NS	ns.secure
+ns.secure 		A	10.53.0.3
+nsec3			NS	ns.nsec3
+ns.nsec3 		A	10.53.0.3
+optout			NS	ns.optout
+ns.optout 		A	10.53.0.3
+;
+; Some precomputed NSEC3 records that form a NSEC3 chain that is in the process of being built.
+;
+GEM086NTU6MT7CN45ATEBFC473U77CGS 3600 IN NSEC3 1 0 1 D399EAAB HPUJ4AVM0DHBBQGS3CCS9IO72VC9RVL8 A RRSIG
+HPUJ4AVM0DHBBQGS3CCS9IO72VC9RVL8 3600 IN NSEC3 1 0 1 D399EAAB OS76SJMB4GB8RM465M6RBPOU6KFUC75C A RRSIG
+OS76SJMB4GB8RM465M6RBPOU6KFUC75C 3600 IN NSEC3 1 0 1 D399EAAB PG32CM31KNS5VP0D6POA66ASP7GQSM42 A RRSIG
+PG32CM31KNS5VP0D6POA66ASP7GQSM42 3600 IN NSEC3 1 0 1 D399EAAB TBJCRM4C31K8CT7H2PJ17GU2BETVFBC2 A RRSIG
+TBJCRM4C31K8CT7H2PJ17GU2BETVFBC2 3600 IN NSEC3 1 0 1 D399EAAB GEM086NTU6MT7CN45ATEBFC473U77CGS

bin/tests/system/autosign/tests.sh

@@ -1620,5 +1620,16 @@ del=`grep "DNSKEY .* is now deleted" ns1/named.run | wc -l`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+echo_i "check that zone with a partial unsigned NSEC3 chain gets signed ($n)"
+$DIG $DIGOPTS @10.53.0.3 axfr partialnsec3.example > dig.out.ns3.test$n || ret=1
+for hash in GEM086NTU6MT7CN45ATEBFC473U77CGS HPUJ4AVM0DHBBQGS3CCS9IO72VC9RVL8 \
+	    OS76SJMB4GB8RM465M6RBPOU6KFUC75C PG32CM31KNS5VP0D6POA66ASP7GQSM42
+do
+	grep "^$hash.*IN RRSIG NSEC3.*" dig.out.ns3.test$n > /dev/null || ret=1
+done
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1