Update checkds system test

Make the checkds system test more structured with the many more test
cases to come. Add a README for clarity.

Update the 'has_signed_apex_nsec' helper function so it can take any
domain name regardless of the number of labels.

Change the DNS tree structure such that we have different TLD names
for the various test scenarios, because we need servers that respond
differently to DS queries. Note that this isn't applicable to the
existing "checkds explicit" test cases, but is preparation work for
testing "checkds yes" (automatic parental agents).

Add a trust-anchor to the server that will be querying for parent
NS records.

bin/tests/system/checkds/README

@@ -14,6 +14,7 @@ The test setup for the checkds tests.
 These servers are parent servers:
 - ns2 is a primary authoritative server that serves the parent zone for zones
   configured in ns9.
+- ns3 is a resolver that can be configured as a parental agent.
 - ns4 is the secondary server for ns2.
 - ns5 is a primary authoritative server that serves the parent zone for zones
   configured in ns9, but this one does not publish DS records (to test cases
@@ -24,3 +25,65 @@ These servers are parent servers:
 
 Finally, ns9 is the authoritative server for the various DNSSEC enabled test
 domains.
+
+We need multiple test cases for testing the "checkds" functionality. Basically,
+the behavior of "checkds" is of importance in three cases:
+
+1. Enabling DNSSEC
+2. KSK rollover
+3. Going insecure
+
+All these three cases involve publishing DS records into the parent, and
+withdrawing them. The named instance is responsible for checking that the
+relevant DS records are published or removed from the parent zone. Therefor,
+it needs to know what the parental agents are (the servers that it can send
+the DS queries to).
+
+Then there are two ways of retrieving parental agents, either through explicit
+configuration ("checkds explicit;"), or through discovery ("checkds yes;"). In
+the latter case, the parental agents are retrieved by querying for the parent NS
+RRset.
+
+The third value is "checkds no;", which disables the feature.
+
+Depending on the DS publication status, the DS state of the key needs to be
+updated. In case of DS publication, the "DSPublish" state should be set, only
+if all parental agents have the relevant DS published. In case of DS withdrawal,
+the "DSRemoved" state should be set, only if none of the parental agents have
+the relevant DS in their zone.
+
+Regardless of how parental agents are retrieved, we identify the following test
+cases:
+
+1.	Enabling DNSSEC
+
+1.1.	- With one parental agent
+1.1.1.	  - DS is correctly published in the parent:		DSPublish
+1.1.2.	  - DS is not (yet) published in the parent:		!DSPublish
+1.1.3.	  - The parental agent is badly configured:		!DSPublish
+1.1.4.	  - DS is published, but has bogus signature:		!DSPublish
+
+1.2.	- With multiple parental agents
+1.2.1.	  - DS is correctly published in all parents:		DSPublish
+1.2.2.	  - DS is not (yet) published in some parents:		!DSPublish
+1.2.3.	  - One parental agent is badly configured:		!DSPublish
+1.2.4.	  - DS is completely published, bogus signature:	!DSPublish
+
+2.	Going insecure
+
+2.1.	- With one parental agent
+2.1.1.	  - DS is correctly withdrawn from the parent:		DSRemoved
+2.1.2.	  - DS is (still) published in the parent:		!DSRemoved
+2.1.3.	  - The parental agent is badly configured:		!DSRemoved
+2.1.4.	  - DS is withdrawn, but has bogus signature:		!DSRemoved
+
+2.2.	- With multiple parental agents
+2.2.1.	  - DS is correctly withdrawn from all parents:		DSRemoved
+2.2.2.	  - DS is not (yet) withdrawn from some parents:	!DSRemoved
+2.2.3.	  - One parental agent is badly configured:		!DSRemoved
+2.2.4.	  - DS is removed completely, bogus signature:		!DSRemoved
+
+We deliberately don't test the "KSK Rollover" case in this system test as this
+can be considered as the same as "Enabling DNSSEC" for one key and
+"Going insecure" for another case. In other words, it is covered by the two
+other scenarios (although we might still add the test cases in the future).

bin/tests/system/checkds/clean.sh

@@ -17,6 +17,7 @@ rm -f dig.out*
 rm -f ns*/named.conf ns*/named.memstats ns*/named.run*
 rm -f ns*/*.jnl ns*/*.jbk
 rm -f ns*/K*.private ns*/K*.key ns*/K*.state
+rm -f ns*/*.keyname
 rm -f ns*/dsset-*
 rm -f ns*/*.db ns*/*.jnl ns*/*.jbk ns*/*.db.signed ns*/*.db.infile
 rm -f ns*/keygen.out.* ns*/settime.out.* ns*/signer.out.*
@@ -24,4 +25,4 @@ rm -f ns*/managed-keys.bind*
 rm -f ns*/trusted.conf
 rm -f ns*/*.mkeys
 rm -f ns*/zones
-rm -f *.checkds.out
+rm -f ./*.out

bin/tests/system/checkds/ns1/root.db.in

@@ -20,5 +20,49 @@ $TTL 300
 .			NS	a.root-servers.nil.
 a.root-servers.nil.	A	10.53.0.1
 
-checkds.		NS	ns2.checkds.
+ns2.			NS	ns2.ns2.
-ns2.checkds.		A	10.53.0.2
+ns2.ns2.		A	10.53.0.2
+
+ns2-4.			NS	ns2.ns2-4.
+ns2-4.			NS	ns4.ns2-4.
+ns2.ns2-4.		A	10.53.0.2
+ns4.ns2-4.		A	10.53.0.4
+
+ns2-4-5.		NS	ns2.ns2-4-5.
+ns2-4-5.		NS	ns4.ns2-4-5.
+ns2-4-5.		NS	ns5.ns2-4-5.
+ns2.ns2-4-5.		A	10.53.0.2
+ns4.ns2-4-5.		A	10.53.0.4
+ns5.ns2-4-5.		A	10.53.0.5
+
+ns2-4-6.		NS	ns2.ns2-4-6.
+ns2-4-6.		NS	ns4.ns2-4-6.
+ns2-4-6.		NS	ns6.ns2-4-6.
+ns2.ns2-4-6.		A	10.53.0.2
+ns4.ns2-4-6.		A	10.53.0.4
+ns6.ns2-4-6.		A	10.53.0.6
+
+ns2-5-7.		NS	ns2.ns2-5-7.
+ns2-5-7.		NS	ns5.ns2-5-7.
+ns2-5-7.		NS	ns7.ns2-5-7.
+ns2.ns2-5-7.		A	10.53.0.2
+ns5.ns2-5-7.		A	10.53.0.5
+ns7.ns2-5-7.		A	10.53.0.7
+
+ns5.			NS	ns5.ns5.
+ns5.ns5.		A	10.53.0.5
+
+ns5-6-7.		NS	ns5.ns5-6-7.
+ns5-6-7.		NS	ns6.ns5-6-7.
+ns5-6-7.		NS	ns7.ns5-6-7.
+ns5.ns5-6-7.		A	10.53.0.5
+ns6.ns5-6-7.		A	10.53.0.6
+ns7.ns5-6-7.		A	10.53.0.7
+
+ns5-7.			NS	ns5.ns5-7.
+ns5-7.			NS	ns7.ns5-7.
+ns5.ns5-7.		A	10.53.0.5
+ns7.ns5-7.		A	10.53.0.7
+
+ns6.			NS	ns6.ns6.
+ns6.ns6.		A	10.53.0.6

bin/tests/system/checkds/ns1/setup.sh

@@ -22,8 +22,6 @@ zonefile=root.db
 
 echo_i "ns1/setup.sh"
 
-cp "../ns2/dsset-checkds." .
-
 ksk=$("$KEYGEN" -q -fk -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 cp "$ksk.key" "../ns10/"
@@ -44,3 +42,4 @@ cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile"
 keyfile_to_static_ds "$ksk" > trusted.conf
 cp trusted.conf ../ns3/trusted.conf
 cp trusted.conf ../ns8/trusted.conf
+cp trusted.conf ../ns9/trusted.conf

bin/tests/system/checkds/ns2/named.conf.in

@@ -39,8 +39,83 @@ zone "." {
 	file "../../common/root.hint";
 };
 
-zone "checkds" {
+zone "ns2" {
 	type primary;
+	allow-update { any; };
 	allow-transfer { 10.53.0.2; 10.53.0.4; };
-	file "checkds.db";
+	also-notify { 10.53.0.4; };
+	dnssec-policy default;
+	file "ns2.db";
+};
+
+zone "ns2-4" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; };
+	also-notify { 10.53.0.4; };
+	dnssec-policy default;
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; };
+	also-notify { 10.53.0.4; };
+	dnssec-policy default;
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; };
+	also-notify { 10.53.0.4; };
+	dnssec-policy default;
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; };
+	also-notify { 10.53.0.4; };
+	dnssec-policy default;
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; };
+	also-notify { 10.53.0.4; };
+	dnssec-policy default;
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; };
+	also-notify { 10.53.0.4; };
+	dnssec-policy default;
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; };
+	also-notify { 10.53.0.4; };
+	dnssec-policy default;
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.2; 10.53.0.4; };
+	also-notify { 10.53.0.4; };
+	dnssec-policy default;
+	file "ns6.db";
 };

bin/tests/system/checkds/ns2/ns2-4-5.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+				NS	ns5
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+ns5				A	10.53.0.5
+
+$ORIGIN explicit.dspublish.ns2-4-5.
+incomplete			NS	ns9.incomplete
+ns9.imcomplete			A	10.53.0.9

bin/tests/system/checkds/ns2/ns2-4-6.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+				NS	ns6
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+ns6				A	10.53.0.6
+
+$ORIGIN explicit.dspublish.ns2-4-6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9

bin/tests/system/checkds/ns2/ns2-4.db.in

@@ -0,0 +1,28 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+
+$ORIGIN explicit.dspublish.ns2-4.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9

bin/tests/system/checkds/ns2/ns2-5-7.db.in

@@ -0,0 +1,30 @@
+	; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns5
+				NS	ns7
+ns2				A	10.53.0.2
+ns5				A	10.53.0.5
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns2-5-7.
+incomplete			NS	ns9.incomplete
+ns9.incomplete			A	10.53.0.9

bin/tests/system/checkds/ns2/ns2.db.in

@@ -21,19 +21,14 @@ $TTL 300
 				NS	ns2
 ns2				A	10.53.0.2
 
-dspublished			NS	ns9.dspublished
+$ORIGIN explicit.dspublish.ns2.
+good				NS	ns9.good
 reference			NS	ns9.reference
-missing-dspublished		NS	ns9.missing-dspublished
+resolver			NS	ns9.resolver
-bad-dspublished			NS	ns9.bad-dspublished
+ns9.good			A	10.53.0.9
-multiple-dspublished		NS	ns9.multiple-dspublished
+ns9.reference			A	10.53.0.9
-incomplete-dspublished		NS	ns9.incomplete-dspublished
+ns9.resolver			A	10.53.0.9
-bad2-dspublished		NS	ns9.bad2-dspublished
-resolver-dspublished		NS	ns9.resolver-dspublished
 
-dswithdrawn			NS	ns9.dswithdrawn
+$ORIGIN explicit.dsremoved.ns2.
-missing-dswithdrawn		NS	ns9.missing-dswithdrawn
+still-there			NS	ns9.still-there
-bad-dswithdrawn			NS	ns9.bad-dswithdrawn
+ns9.still-there			A	10.53.0.9
-multiple-dswithdrawn		NS	ns9.multiple-dswithdrawn
-incomplete-dswithdrawn		NS	ns9.incomplete-dswithdrawn
-bad2-dswithdrawn		NS	ns9.bad2-dswithdrawn
-resolver-dswithdrawn		NS	ns9.resolver-dswithdrawn

bin/tests/system/checkds/ns2/ns5-6-7.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+				NS	ns6
+				NS	ns7
+ns5				A	10.53.0.5
+ns6				A	10.53.0.6
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns5-6-7.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9

bin/tests/system/checkds/ns2/ns5-7.db.in

@@ -0,0 +1,28 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+				NS	ns7
+ns5				A	10.53.0.5
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns5-7.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9

bin/tests/system/checkds/ns2/ns5.db.in

@@ -0,0 +1,32 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+ns5				A	10.53.0.5
+
+$ORIGIN explicit.dspublish.ns5.
+not-yet				NS	ns9.not-yet
+ns9.not-yet			A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns5.
+good				NS	ns9.good
+resolver			NS	ns9.resolver
+ns9.good			A	10.53.0.9
+ns9.resolver			A	10.53.0.9

bin/tests/system/checkds/ns2/ns6.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns6
+ns6				A	10.53.0.6
+
+$ORIGIN explicit.dspublish.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9

bin/tests/system/checkds/ns2/setup.sh

@@ -16,21 +16,19 @@
 
 echo_i "ns2/setup.sh"
 
-for subdomain in dspublished reference missing-dspublished bad-dspublished \
+for zn in \
-		 multiple-dspublished incomplete-dspublished bad2-dspublished \
+	ns2 ns2-4 ns2-4-5 ns2-4-6 ns2-5-7 \
-		 resolver-dspublished \
+	ns5 ns5-6-7 ns5-7 ns6
-		 dswithdrawn missing-dswithdrawn bad-dswithdrawn \
-		 multiple-dswithdrawn incomplete-dswithdrawn bad2-dswithdrawn \
-		 resolver-dswithdrawn
 do
-	cp "../ns9/dsset-$subdomain.checkds." .
+	zone="${zn}"
-done
+	infile="${zn}.db.infile"
+	zonefile="${zn}.db"
 
-zone="checkds"
+	# The signing key is copied from ns5.
-infile="checkds.db.infile"
+	CSK=$(cat "${zn}.keyname")
-zonefile="checkds.db"
+	cat "${zn}.db.in" "${CSK}.key" > "$infile"
-
-CSK=$($KEYGEN -k default $zone 2> keygen.out.$zone)
-cat template.db.in "${CSK}.key" > "$infile"
 	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
 	$SIGNER -S -g -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone 2>&1
+
+	cp "dsset-${zn}." ../ns1/
+done

bin/tests/system/checkds/ns4/named.conf.in

@@ -34,8 +34,56 @@ controls {
 	inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
-zone "checkds" {
+zone "ns2" {
 	type secondary;
-	file "checkds.db";
 	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2.db";
+};
+
+zone "ns2-4" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type secondary;
+	primaries source 10.53.0.4 { 10.53.0.2 port @PORT@; };
+	file "ns6.db";
 };

bin/tests/system/checkds/ns5/named.conf.in

@@ -39,8 +39,83 @@ zone "." {
 	file "../../common/root.hint";
 };
 
-zone "checkds" {
+zone "ns2" {
 	type primary;
+	allow-update { any; };
 	allow-transfer { 10.53.0.5; 10.53.0.7; };
-	file "checkds.db";
+	also-notify { 10.53.0.7; };
+	dnssec-policy default;
+	file "ns2.db";
+};
+
+zone "ns2-4" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; };
+	also-notify { 10.53.0.7; };
+	dnssec-policy default;
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; };
+	also-notify { 10.53.0.7; };
+	dnssec-policy default;
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; };
+	also-notify { 10.53.0.7; };
+	dnssec-policy default;
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; };
+	also-notify { 10.53.0.7; };
+	dnssec-policy default;
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; };
+	also-notify { 10.53.0.7; };
+	dnssec-policy default;
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; };
+	also-notify { 10.53.0.7; };
+	dnssec-policy default;
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; };
+	also-notify { 10.53.0.7; };
+	dnssec-policy default;
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type primary;
+	allow-update { any; };
+	allow-transfer { 10.53.0.5; 10.53.0.7; };
+	also-notify { 10.53.0.7; };
+	dnssec-policy default;
+	file "ns6.db";
 };

bin/tests/system/checkds/ns5/ns2-4-5.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+				NS	ns5
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+ns5				A	10.53.0.5
+
+$ORIGIN explicit.dspublish.ns2-4-5.
+incomplete			NS	ns9.incomplete
+ns9.imcomplete			A	10.53.0.9

bin/tests/system/checkds/ns5/ns2-4-6.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+				NS	ns6
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+ns6				A	10.53.0.6
+
+$ORIGIN explicit.dspublish.ns2-4-6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9

bin/tests/system/checkds/ns5/ns2-4.db.in

@@ -0,0 +1,28 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns4
+ns2				A	10.53.0.2
+ns4				A	10.53.0.4
+
+$ORIGIN explicit.dspublish.ns2-4.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9

bin/tests/system/checkds/ns5/ns2-5-7.db.in

@@ -0,0 +1,30 @@
+	; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+				NS	ns5
+				NS	ns7
+ns2				A	10.53.0.2
+ns5				A	10.53.0.5
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns2-5-7.
+incomplete			NS	ns9.incomplete
+ns9.incomplete			A	10.53.0.9

bin/tests/system/checkds/ns5/ns2.db.in

@@ -0,0 +1,34 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns2
+ns2				A	10.53.0.2
+
+$ORIGIN explicit.dspublish.ns2.
+good				NS	ns9.good
+reference			NS	ns9.reference
+resolver			NS	ns9.resolver
+ns9.good			A	10.53.0.9
+ns9.reference			A	10.53.0.9
+ns9.resolver			A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns2.
+still-there			NS	ns9.still-there
+ns9.still-there			A	10.53.0.9

bin/tests/system/checkds/ns5/ns5-6-7.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+				NS	ns6
+				NS	ns7
+ns5				A	10.53.0.5
+ns6				A	10.53.0.6
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns5-6-7.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9

bin/tests/system/checkds/ns5/ns5-7.db.in

@@ -0,0 +1,28 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+				NS	ns7
+ns5				A	10.53.0.5
+ns7				A	10.53.0.7
+
+$ORIGIN explicit.dsremoved.ns5-7.
+good				NS	ns9.good
+ns9.good			A	10.53.0.9

bin/tests/system/checkds/ns5/ns5.db.in

@@ -0,0 +1,32 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns5
+ns5				A	10.53.0.5
+
+$ORIGIN explicit.dspublish.ns5.
+not-yet				NS	ns9.not-yet
+ns9.not-yet			A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns5.
+good				NS	ns9.good
+resolver			NS	ns9.resolver
+ns9.good			A	10.53.0.9
+ns9.resolver			A	10.53.0.9

bin/tests/system/checkds/ns5/ns6.db.in

@@ -0,0 +1,30 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@			IN	SOA  secondary.example. hostmaster.example. (
+				1       ; serial
+				20      ; refresh (20 seconds)
+				20      ; retry (20 seconds)
+				1814400 ; expire (3 weeks)
+				3600    ; minimum (1 hour)
+				)
+
+				NS	ns6
+ns6				A	10.53.0.6
+
+$ORIGIN explicit.dspublish.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9
+
+$ORIGIN explicit.dsremoved.ns6.
+bad				NS	ns9.bad
+ns9.bad				A	10.53.0.9

bin/tests/system/checkds/ns5/setup.sh

@@ -16,11 +16,21 @@
 
 echo_i "ns5/setup.sh"
 
-zone="checkds"
+for zn in \
-infile="checkds.db.infile"
+	ns2 ns2-4 ns2-4-5 ns2-4-6 ns2-5-7 \
-zonefile="checkds.db"
+	ns5 ns5-6-7 ns5-7 ns6
+do
+	zone="${zn}"
+	infile="${zn}.db.infile"
+	zonefile="${zn}.db"
 
 	CSK=$($KEYGEN -k default $zone 2> keygen.out.$zone)
-cat template.db.in "${CSK}.key" > "$infile"
+	cat "${zn}.db.in" "${CSK}.key" > "$infile"
 	private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
 	$SIGNER -S -g -z -x -s now-1h -e now+30d -o $zone -O full -f $zonefile $infile > signer.out.$zone 2>&1
+
+	# Copy key to ns2, the other primary.
+	echo "${CSK}" > "../ns2/${zn}.keyname"
+	cp "${CSK}.key" ../ns2/
+	cp "${CSK}.private" ../ns2/
+done

bin/tests/system/checkds/ns5/template.db.in

@@ -1,40 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300
-@			IN	SOA  secondary.example. hostmaster.example. (
-				1       ; serial
-				20      ; refresh (20 seconds)
-				20      ; retry (20 seconds)
-				1814400 ; expire (3 weeks)
-				3600    ; minimum (1 hour)
-				)
-
-				NS	ns5
-ns5				A	10.53.0.5
-
-dspublished			NS	ns9.dspublished
-reference			NS	ns9.reference
-missing-dspublished		NS	ns9.missing-dspublished
-bad-dspublished			NS	ns9.bad-dspublished
-multiple-dspublished		NS	ns9.multiple-dspublished
-incomplete-dspublished		NS	ns9.incomplete-dspublished
-bad2-dspublished		NS	ns9.bad2-dspublished
-resolver-dspublished		NS	ns9.resolver-dspublished
-
-dswithdrawn			NS	ns9.dswithdrawn
-missing-dswithdrawn		NS	ns9.missing-dswithdrawn
-bad-dswithdrawn			NS	ns9.bad-dswithdrawn
-multiple-dswithdrawn		NS	ns9.multiple-dswithdrawn
-incomplete-dswithdrawn		NS	ns9.incomplete-dswithdrawn
-bad2-dswithdrawn		NS	ns9.bad2-dswithdrawn
-resolver-dswithdrawn		NS	ns9.resolver-dswithdrawn
-

bin/tests/system/checkds/ns7/named.conf.in

@@ -34,13 +34,56 @@ controls {
 	inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
 };
 
-zone "." {
+zone "ns2" {
-        type hint;
+	type secondary;
-        file "../../common/root.hint";
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2.db";
 };
 
-zone "checkds" {
+zone "ns2-4" {
 	type secondary;
-	file "checkds.db";
 	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2-4.db";
+};
+
+zone "ns2-4-5" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2-4-5.db";
+};
+
+zone "ns2-4-6" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2-4-6.db";
+};
+
+zone "ns2-5-7" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns2-5-7.db";
+};
+
+zone "ns5" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns5.db";
+};
+
+zone "ns5-6-7" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns5-6-7.db";
+};
+
+zone "ns5-7" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns5-7.db";
+};
+
+zone "ns6" {
+	type secondary;
+	primaries source 10.53.0.7 { 10.53.0.5 port @PORT@; };
+	file "ns6.db";
 };

bin/tests/system/checkds/ns9/named.conf.in

@@ -13,6 +13,8 @@
 
 // NS9
 
+include "trusted.conf";
+
 options {
 	query-source address 10.53.0.9;
 	notify-source 10.53.0.9;
@@ -44,113 +46,31 @@ zone "." {
 };
 
 /*
- * Zone with parental agent configured, due for DS checking.
+ * 1.     Enabling DNSSEC
+ * 1.1    - With one parental agent
+ * 1.1.1. - DS is correctly published in the parent.
  */
-zone "dspublished.checkds" {
+zone "good.explicit.dspublish.ns2" {
 	type primary;
-	file "dspublished.checkds.db";
+	file "good.explicit.dspublish.ns2.db";
 	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents { 10.53.0.2 port @PORT@; };
 };
 
-/*
+/* Same as above, but now with a reference to parental-agents. */
- * Zone with parental agent configured, due for DS checking.
+zone "reference.explicit.dspublish.ns2" {
- * Same as above, but now with a reference to parental-agents.
- */
-zone "reference.checkds" {
 	type primary;
-	file "reference.checkds.db";
+	file "reference.explicit.dspublish.ns2.db";
 	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents { "ns2"; };
 };
 
-/*
+/* Same as above, but now with resolver parental agent configured. */
- * Zone with parental agent configured, due for DS checking.
+zone "resolver.explicit.dspublish.ns2" {
- * The parental agent does not have the DS yet.
- */
-zone "missing-dspublished.checkds" {
 	type primary;
-	file "missing-dspublished.checkds.db";
+	file "resolver.explicit.dspublish.ns2.db";
-	inline-signing yes;
-	dnssec-policy "default";
-	parental-agents {
-		10.53.0.5 port @PORT@; // missing
-	};
-};
-
-
-/*
- * Zone with parental agent configured, due for DS checking.
- * This case, the server is badly configured.
- */
-zone "bad-dspublished.checkds" {
-	type primary;
-	file "bad-dspublished.checkds.db";
-	inline-signing yes;
-	dnssec-policy "default";
-	parental-agents {
-		10.53.0.6 port @PORT@; // bad
-	};
-};
-
-/*
- * Zone with multiple parental agents configured, due for DS checking.
- * All need to have the DS before the rollover may continue.
- */
-zone "multiple-dspublished.checkds" {
-	type primary;
-	file "multiple-dspublished.checkds.db";
-	inline-signing yes;
-	dnssec-policy "default";
-	parental-agents {
-		10.53.0.2 port @PORT@;
-		10.53.0.4 port @PORT@;
-	};
-};
-
-/*
- * Zone with multiple parental agents configured, due for DS checking.
- * All need to have the DS before the rollover may continue.
- * This case, one server is still missing the DS.
- */
-zone "incomplete-dspublished.checkds" {
-	type primary;
-	file "incomplete-dspublished.checkds.db";
-	inline-signing yes;
-	dnssec-policy "default";
-	parental-agents {
-		10.53.0.2 port @PORT@;
-		10.53.0.4 port @PORT@;
-		10.53.0.5 port @PORT@; // missing
-	};
-};
-
-
-/*
- * Zone with multiple parental agents configured, due for DS checking.
- * All need to have the DS before the rollover may continue.
- * This case, one server is badly configured.
- */
-zone "bad2-dspublished.checkds" {
-	type primary;
-	file "bad2-dspublished.checkds.db";
-	inline-signing yes;
-	dnssec-policy "default";
-	parental-agents {
-		10.53.0.2 port @PORT@;
-		10.53.0.4 port @PORT@;
-		10.53.0.6 port @PORT@; // bad
-	};
-};
-
-/*
- * Zone with resolver parental agent configured, due for DS checking.
- */
-zone "resolver-dspublished.checkds" {
-	type primary;
-	file "resolver-dspublished.checkds.db";
 	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents {
@@ -158,84 +78,217 @@ zone "resolver-dspublished.checkds" {
 	};
 };
 
+/*
+ * 1.     Enabling DNSSEC
+ * 1.1    - With one parental agent
+ * 1.1.2. - DS is not (yet) published in the parent.
+ */
+zone "not-yet.explicit.dspublish.ns5" {
+	type primary;
+	file "not-yet.explicit.dspublish.ns5.db";
+	inline-signing yes;
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.5 port @PORT@; // missing
+	};
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.1    - With one parental agent
+ * 1.1.3. - The parental agent is badly configured.
+ */
+zone "bad.explicit.dspublish.ns6" {
+	type primary;
+	file "bad.explicit.dspublish.ns6.db";
+	inline-signing yes;
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.6 port @PORT@; // bad
+	};
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.1    - With one parental agent
+ * 1.1.4. - DS is published, but has bogus signature
+ */
+// TODO
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.2    - With multiple parental agent
+ * 1.2.1. - DS is correctly published in all parents.
+ */
+zone "good.explicit.dspublish.ns2-4" {
+	type primary;
+	file "good.explicit.dspublish.ns2-4.db";
+	inline-signing yes;
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.2 port @PORT@;
+		10.53.0.4 port @PORT@;
+	};
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.2    - With multiple parental agent
+ * 1.2.2. - DS is not (yet) published in some parents.
+ */
+zone "incomplete.explicit.dspublish.ns2-4-5" {
+	type primary;
+	file "incomplete.explicit.dspublish.ns2-4-5.db";
+	inline-signing yes;
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.2 port @PORT@;
+		10.53.0.4 port @PORT@;
+		10.53.0.5 port @PORT@; // missing
+	};
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.2    - With multiple parental agent
+ * 1.2.3. - DS is not (yet) published in some parents.
+ */
+zone "bad.explicit.dspublish.ns2-4-6" {
+	type primary;
+	file "bad.explicit.dspublish.ns2-4-6.db";
+	inline-signing yes;
+	dnssec-policy "default";
+	parental-agents {
+		10.53.0.2 port @PORT@;
+		10.53.0.4 port @PORT@;
+		10.53.0.6 port @PORT@; // bad
+	};
+};
+
+/*
+ * 1.     Enabling DNSSEC
+ * 1.2    - With multiple parental agent
+ * 1.2.4. - DS is completely published, bogus signature.
+ */
+// TODO
+
 // TODO: Other test cases:
-// - Test with bogus response
 // - check with TSIG
 // - check with TLS
 
-
 /*
- * Zones that are going insecure (test DS withdrawn polling).
+ * 2.     Going insecure
+ * 2.1    - With one parental agent
+ * 2.1.1. - DS is correctly withdrawn from the parent.
  */
-zone "dswithdrawn.checkds" {
+zone "good.explicit.dsremoved.ns5" {
 	type primary;
-	file "dswithdrawn.checkds.db";
+	file "good.explicit.dsremoved.ns5.db";
 	inline-signing yes;
 	dnssec-policy "insecure";
 	parental-agents { 10.53.0.5 port @PORT@; };
 };
 
-zone "missing-dswithdrawn.checkds" {
+zone "resolver.explicit.dsremoved.ns5" {
 	type primary;
-	file "missing-dswithdrawn.checkds.db";
+	file "resolver.explicit.dsremoved.ns5.db";
-	inline-signing yes;
-	dnssec-policy "insecure";
-	parental-agents {
-		10.53.0.2 port @PORT@; // still published
-	};
-};
-
-zone "bad-dswithdrawn.checkds" {
-	type primary;
-	file "bad-dswithdrawn.checkds.db";
-	inline-signing yes;
-	dnssec-policy "insecure";
-	parental-agents {
-		10.53.0.6 port @PORT@; // bad
-	};
-};
-
-zone "multiple-dswithdrawn.checkds" {
-	type primary;
-	file "multiple-dswithdrawn.checkds.db";
-	inline-signing yes;
-	dnssec-policy "insecure";
-	parental-agents {
-		10.53.0.5 port @PORT@;
-		10.53.0.7 port @PORT@;
-	};
-};
-
-zone "incomplete-dswithdrawn.checkds" {
-	type primary;
-	file "incomplete-dswithdrawn.checkds.db";
-	inline-signing yes;
-	dnssec-policy "insecure";
-	parental-agents {
-		10.53.0.2 port @PORT@; // still published
-		10.53.0.5 port @PORT@;
-		10.53.0.7 port @PORT@;
-	};
-};
-
-zone "bad2-dswithdrawn.checkds" {
-	type primary;
-	file "bad2-dswithdrawn.checkds.db";
-	inline-signing yes;
-	dnssec-policy "insecure";
-	parental-agents {
-		10.53.0.5 port @PORT@;
-		10.53.0.7 port @PORT@;
-		10.53.0.6 port @PORT@; // bad
-	};
-};
-
-zone "resolver-dswithdrawn.checkds" {
-	type primary;
-	file "resolver-dswithdrawn.checkds.db";
 	inline-signing yes;
 	dnssec-policy "default";
 	parental-agents {
-		10.53.0.8 port @PORT@;
+		10.53.0.3 port @PORT@;
 	};
 };
+
+/*
+ * 2.     Going insecure
+ * 2.1    - With one parental agent
+ * 2.1.2. - DS is (still) published in the parent.
+ */
+zone "still-there.explicit.dsremoved.ns2" {
+	type primary;
+	file "still-there.explicit.dsremoved.ns2.db";
+	inline-signing yes;
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.2 port @PORT@; // still published
+	};
+};
+
+/*
+ * 2.     Going insecure
+ * 2.1    - With one parental agent
+ * 2.1.3. - The parental agent is badly configured.
+ */
+zone "bad.explicit.dsremoved.ns6" {
+	type primary;
+	file "bad.explicit.dsremoved.ns6.db";
+	inline-signing yes;
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.6 port @PORT@; // bad
+	};
+};
+
+/*
+ * 2.     Going insecure
+ * 2.1    - With one parental agent
+ * 2.1.4. - DS is withdrawn, but has bogus signature.
+ */
+// TODO
+
+/*
+ * 2.     Going insecure
+ * 2.2.    - With multiple parental agents
+ * 2.2.1.  - DS is correctly withdrawn from all parents.
+ */
+zone "good.explicit.dsremoved.ns5-7" {
+	type primary;
+	file "good.explicit.dsremoved.ns5-7.db";
+	inline-signing yes;
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.5 port @PORT@;
+		10.53.0.7 port @PORT@;
+	};
+};
+
+/*
+ * 2.     Going insecure
+ * 2.2.    - With multiple parental agents
+ * 2.2.2.  - DS is not (yet) withdrawn from some parents.
+ */
+zone "incomplete.explicit.dsremoved.ns2-5-7" {
+	type primary;
+	file "incomplete.explicit.dsremoved.ns2-5-7.db";
+	inline-signing yes;
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.2 port @PORT@; // still published
+		10.53.0.5 port @PORT@;
+		10.53.0.7 port @PORT@;
+	};
+};
+
+/*
+ * 2.     Going insecure
+ * 2.2.    - With multiple parental agents
+ * 2.2.3.  - One parental agent is badly configured.
+ */
+zone "bad.explicit.dsremoved.ns5-6-7" {
+	type primary;
+	file "bad.explicit.dsremoved.ns5-6-7.db";
+	inline-signing yes;
+	dnssec-policy "insecure";
+	parental-agents {
+		10.53.0.5 port @PORT@;
+		10.53.0.7 port @PORT@;
+		10.53.0.6 port @PORT@; // bad
+	};
+};
+
+/*
+ * 2.     Going insecure
+ * 2.2.    - With multiple parental agents
+ * 2.2.4.  - DS is removed completely, bogus signature
+ */
+// TODO

bin/tests/system/checkds/ns9/setup.sh

@@ -33,31 +33,54 @@ T="now-30d"
 Y="now-1y"
 
 # DS Publication.
-for zn in dspublished reference missing-dspublished bad-dspublished \
+for checkds in explicit
-	  multiple-dspublished incomplete-dspublished bad2-dspublished resolver-dspublished
 do
-	setup "${zn}.checkds"
+	for zn in \
+		good.${checkds}.dspublish.ns2 \
+		reference.${checkds}.dspublish.ns2 \
+		resolver.${checkds}.dspublish.ns2 \
+		not-yet.${checkds}.dspublish.ns5 \
+		bad.${checkds}.dspublish.ns6 \
+		good.${checkds}.dspublish.ns2-4 \
+		incomplete.${checkds}.dspublish.ns2-4-5 \
+		bad.${checkds}.dspublish.ns2-4-6
+	do
+		setup "${zn}"
 		cp template.db.in "$zonefile"
 		keytimes="-P $T -P sync $T -A $T"
 		CSK=$($KEYGEN -k default $keytimes $zone 2> keygen.out.$zone)
 		$SETTIME -s -g $O -k $O $T -r $O $T -z $O $T -d $R $T "$CSK" > settime.out.$zone 2>&1
-	cat template.db.in "${CSK}.key" > "$infile"
+		cat "$zonefile" "${CSK}.key" > "$infile"
 		private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
 		cp $infile $zonefile
 		$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+
+	        cp "dsset-${zone}." ../ns2/
+	done
 done
 
 # DS Withdrawal.
-for zn in dswithdrawn missing-dswithdrawn bad-dswithdrawn multiple-dswithdrawn \
+for checkds in explicit
-	  incomplete-dswithdrawn bad2-dswithdrawn resolver-dswithdrawn
 do
-	setup "${zn}.checkds"
+	for zn in \
+		good.${checkds}.dsremoved.ns5 \
+		resolver.${checkds}.dsremoved.ns5 \
+		still-there.${checkds}.dsremoved.ns2 \
+		bad.${checkds}.dsremoved.ns6 \
+		good.${checkds}.dsremoved.ns5-7 \
+		incomplete.${checkds}.dsremoved.ns2-5-7 \
+		bad.${checkds}.dsremoved.ns5-6-7
+	do
+		setup "${zn}"
 		cp template.db.in "$zonefile"
 		keytimes="-P $Y -P sync $Y -A $Y"
 		CSK=$($KEYGEN -k default $keytimes $zone 2> keygen.out.$zone)
 		$SETTIME -s -g $H -k $O $T -r $O $T -z $O $T -d $U $T "$CSK" > settime.out.$zone 2>&1
-	cat template.db.in "${CSK}.key" > "$infile"
+		cat "$zonefile" "${CSK}.key" > "$infile"
 		private_type_record $zone $DEFAULT_ALGORITHM_NUMBER "$CSK" >> "$infile"
 		cp $infile $zonefile
 		$SIGNER -S -z -x -s now-1h -e now+30d -o $zone -O raw -f "${zonefile}.signed" $infile > signer.out.$zone.1 2>&1
+
+	        cp "dsset-${zone}." ../ns2/
+	done
 done

bin/tests/system/checkds/tests_checkds.py

@@ -36,9 +36,10 @@ def has_signed_apex_nsec(zone, response):
 
     ttl = 300
     nextname = "a."
+    labelcount = zone.count(".")  # zone is specified as FQDN
     types = "NS SOA RRSIG NSEC DNSKEY"
     match = "{0} {1} IN NSEC {2}{0} {3}".format(zone, ttl, nextname, types)
-    sig = "{0} {1} IN RRSIG NSEC 13 2 300".format(zone, ttl)
+    sig = "{0} {1} IN RRSIG NSEC 13 {2} 300".format(zone, ttl, labelcount)
 
     for rr in response.answer:
         if match in rr.to_text():
@@ -258,107 +259,134 @@ def test_checkds_dspublished(named_port):
     parent.nameservers = ["10.53.0.2"]
     parent.port = named_port
 
-    # DS correctly published in parent.
+    #
-    zone_check(server, "dspublished.checkds.")
+    # 1.1.1: DS is correctly published in parent.
+    # parental-agents: ns2
+    #
+
+    # The simple case.
+    zone_check(server, "good.explicit.dspublish.ns2.")
     wait_for_log(
         "ns9/named.run",
-        "zone dspublished.checkds/IN (signed): checkds: DS response from 10.53.0.2",
+        "zone good.explicit.dspublish.ns2/IN (signed): checkds: "
-    )
-    keystate_check(parent, "dspublished.checkds.", "DSPublish")
-
-    # DS correctly published in parent (reference to parental-agent).
-    zone_check(server, "reference.checkds.")
-    wait_for_log(
-        "ns9/named.run",
-        "zone reference.checkds/IN (signed): checkds: DS response from 10.53.0.2",
-    )
-    keystate_check(parent, "reference.checkds.", "DSPublish")
-
-    # DS not published in parent.
-    zone_check(server, "missing-dspublished.checkds.")
-    wait_for_log(
-        "ns9/named.run",
-        "zone missing-dspublished.checkds/IN (signed): checkds: "
-        "empty DS response from 10.53.0.5",
-    )
-    keystate_check(parent, "missing-dspublished.checkds.", "!DSPublish")
-
-    # Badly configured parent.
-    zone_check(server, "bad-dspublished.checkds.")
-    wait_for_log(
-        "ns9/named.run",
-        "zone bad-dspublished.checkds/IN (signed): checkds: "
-        "bad DS response from 10.53.0.6",
-    )
-    keystate_check(parent, "bad-dspublished.checkds.", "!DSPublish")
-
-    # TBD: DS published in parent, but bogus signature.
-
-    # DS correctly published in all parents.
-    zone_check(server, "multiple-dspublished.checkds.")
-    wait_for_log(
-        "ns9/named.run",
-        "zone multiple-dspublished.checkds/IN (signed): checkds: "
 	"DS response from 10.53.0.2",
     )
-    wait_for_log(
+    keystate_check(parent, "good.explicit.dspublish.ns2.", "DSPublish")
-        "ns9/named.run",
-        "zone multiple-dspublished.checkds/IN (signed): checkds: "
-        "DS response from 10.53.0.4",
-    )
-    keystate_check(parent, "multiple-dspublished.checkds.", "DSPublish")
 
-    # DS published in only one of multiple parents.
+    # Using a reference to parental-agents.
-    zone_check(server, "incomplete-dspublished.checkds.")
+    zone_check(server, "reference.explicit.dspublish.ns2.")
     wait_for_log(
         "ns9/named.run",
-        "zone incomplete-dspublished.checkds/IN (signed): checkds: "
+        "zone reference.explicit.dspublish.ns2/IN (signed): "
-        "DS response from 10.53.0.2",
+	"checkds: DS response from 10.53.0.2",
     )
-    wait_for_log(
+    keystate_check(parent, "reference.explicit.dspublish.ns2.", "DSPublish")
-        "ns9/named.run",
-        "zone incomplete-dspublished.checkds/IN (signed): checkds: "
-        "DS response from 10.53.0.4",
-    )
-    wait_for_log(
-        "ns9/named.run",
-        "zone incomplete-dspublished.checkds/IN (signed): checkds: "
-        "empty DS response from 10.53.0.5",
-    )
-    keystate_check(parent, "incomplete-dspublished.checkds.", "!DSPublish")
 
-    # One of the parents is badly configured.
+    # Using a resolver as parental-agent (ns3).
-    zone_check(server, "bad2-dswithdrawn.checkds.")
+    zone_check(server, "resolver.explicit.dspublish.ns2.")
     wait_for_log(
         "ns9/named.run",
-        "zone bad2-dspublished.checkds/IN (signed): checkds: "
+        "zone resolver.explicit.dspublish.ns2/IN (signed): checkds: "
-        "DS response from 10.53.0.2",
-    )
-    wait_for_log(
-        "ns9/named.run",
-        "zone bad2-dspublished.checkds/IN (signed): checkds: "
-        "DS response from 10.53.0.4",
-    )
-    wait_for_log(
-        "ns9/named.run",
-        "zone bad2-dspublished.checkds/IN (signed): checkds: "
-        "bad DS response from 10.53.0.6",
-    )
-    keystate_check(parent, "bad2-dspublished.checkds.", "!DSPublish")
-
-    # Check with resolver parental-agent.
-    zone_check(server, "resolver-dspublished.checkds.")
-    wait_for_log(
-        "ns9/named.run",
-        "zone resolver-dspublished.checkds/IN (signed): checkds: "
         "DS response from 10.53.0.3",
     )
-    keystate_check(parent, "resolver-dspublished.checkds.", "DSPublish")
+    keystate_check(parent, "resolver.explicit.dspublish.ns2.", "DSPublish")
 
-    # TBD: DS published in all parents, but one has bogus signature.
+    #
+    # 1.1.2: DS is not published in parent.
+    # parental-agents: ns5
+    #
+    zone_check(server, "not-yet.explicit.dspublish.ns5.")
+    wait_for_log(
+        "ns9/named.run",
+        "zone not-yet.explicit.dspublish.ns5/IN (signed): checkds: "
+        "empty DS response from 10.53.0.5",
+    )
+    keystate_check(parent, "not-yet.explicit.dspublish.ns5.", "!DSPublish")
+
+    #
+    # 1.1.3: The parental agent is badly configured.
+    # parental-agents: ns6
+    #
+    zone_check(server, "bad.explicit.dspublish.ns6.")
+    wait_for_log(
+        "ns9/named.run",
+        "zone bad.explicit.dspublish.ns6/IN (signed): checkds: "
+        "bad DS response from 10.53.0.6",
+    )
+    keystate_check(parent, "bad.explicit.dspublish.ns6.", "!DSPublish")
+
+    #
+    # 1.1.4: DS is published, but has bogus signature.
+    #
+    # TBD
+
+    #
+    # 1.2.1: DS is correctly published in all parents.
+    # parental-agents: ns2, ns4
+    #
+    zone_check(server, "good.explicit.dspublish.ns2-4.")
+    wait_for_log(
+        "ns9/named.run",
+        "zone good.explicit.dspublish.ns2-4/IN (signed): checkds: "
+        "DS response from 10.53.0.2",
+    )
+    wait_for_log(
+        "ns9/named.run",
+        "zone good.explicit.dspublish.ns2-4/IN (signed): checkds: "
+        "DS response from 10.53.0.4",
+    )
+    keystate_check(parent, "good.explicit.dspublish.ns2-4.", "DSPublish")
+
+    #
+    # 1.2.2: DS is not published in some parents.
+    # parental-agents: ns2, ns4, ns5
+    #
+    zone_check(server, "incomplete.explicit.dspublish.ns2-4-5.")
+    wait_for_log(
+        "ns9/named.run",
+        "zone incomplete.explicit.dspublish.ns2-4-5/IN (signed): checkds: "
+        "DS response from 10.53.0.2",
+    )
+    wait_for_log(
+        "ns9/named.run",
+        "zone incomplete.explicit.dspublish.ns2-4-5/IN (signed): checkds: "
+        "DS response from 10.53.0.4",
+    )
+    wait_for_log(
+        "ns9/named.run",
+        "zone incomplete.explicit.dspublish.ns2-4-5/IN (signed): checkds: "
+        "empty DS response from 10.53.0.5",
+    )
+    keystate_check(parent, "incomplete.explicit.dspublish.ns2-4-5.", "!DSPublish")
+
+    #
+    # 1.2.3: One parental agent is badly configured.
+    # parental-agents: ns2, ns4, ns6
+    #
+    zone_check(server, "bad.explicit.dspublish.ns2-4-6.")
+    wait_for_log(
+        "ns9/named.run",
+        "zone bad.explicit.dspublish.ns2-4-6/IN (signed): checkds: "
+        "DS response from 10.53.0.2",
+    )
+    wait_for_log(
+        "ns9/named.run",
+        "zone bad.explicit.dspublish.ns2-4-6/IN (signed): checkds: "
+        "DS response from 10.53.0.4",
+    )
+    wait_for_log(
+        "ns9/named.run",
+        "zone bad.explicit.dspublish.ns2-4-6/IN (signed): checkds: "
+        "bad DS response from 10.53.0.6",
+    )
+    keystate_check(parent, "bad.explicit.dspublish.ns2-4-6.", "!DSPublish")
+
+    #
+    # 1.2.4: DS is completely published, bogus signature.
+    #
+    # TBD
 
     # TBD: Check with TSIG
-
     # TBD: Check with TLS
 
 
@@ -372,94 +400,120 @@ def test_checkds_dswithdrawn(named_port):
     parent.nameservers = ["10.53.0.2"]
     parent.port = named_port
 
-    # DS correctly published in single parent.
+    #
-    zone_check(server, "dswithdrawn.checkds.")
+    # 2.1.1: DS correctly withdrawn from the parent.
+    # parental-agents: ns5
+    #
+
+    # The simple case.
+    zone_check(server, "good.explicit.dsremoved.ns5.")
     wait_for_log(
         "ns9/named.run",
-        "zone dswithdrawn.checkds/IN (signed): checkds: "
+        "zone good.explicit.dsremoved.ns5/IN (signed): checkds: "
         "empty DS response from 10.53.0.5",
     )
-    keystate_check(parent, "dswithdrawn.checkds.", "DSRemoved")
+    keystate_check(parent, "good.explicit.dsremoved.ns5.", "DSRemoved")
 
-    # DS not withdrawn from parent.
+    # Using a resolver as parental-agent (ns3).
-    zone_check(server, "missing-dswithdrawn.checkds.")
+    zone_check(server, "resolver.explicit.dsremoved.ns5.")
     wait_for_log(
         "ns9/named.run",
-        "zone missing-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone resolver.explicit.dsremoved.ns5/IN (signed): checkds: "
+        "empty DS response from 10.53.0.3",
+    )
+    keystate_check(parent, "resolver.explicit.dsremoved.ns5.", "DSRemoved")
+
+    #
+    # 2.1.2: DS is published in the parent.
+    # parental-agents: ns2
+    #
+    zone_check(server, "still-there.explicit.dsremoved.ns2.")
+    wait_for_log(
+        "ns9/named.run",
+        "zone still-there.explicit.dsremoved.ns2/IN (signed): checkds: "
         "DS response from 10.53.0.2",
     )
-    keystate_check(parent, "missing-dswithdrawn.checkds.", "!DSRemoved")
+    keystate_check(parent, "still-there.explicit.dsremoved.ns2.", "!DSRemoved")
 
-    # Badly configured parent.
+    #
-    zone_check(server, "bad-dswithdrawn.checkds.")
+    # 2.1.3: The parental agent is badly configured.
+    # parental-agents: ns6
+    #
+    zone_check(server, "bad.explicit.dsremoved.ns6.")
     wait_for_log(
         "ns9/named.run",
-        "zone bad-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone bad.explicit.dsremoved.ns6/IN (signed): checkds: "
         "bad DS response from 10.53.0.6",
     )
-    keystate_check(parent, "bad-dswithdrawn.checkds.", "!DSRemoved")
+    keystate_check(parent, "bad.explicit.dsremoved.ns6.", "!DSRemoved")
 
-    # TBD: DS published in parent, but bogus signature.
+    #
+    # 2.1.4: DS is withdrawn, but has bogus signature.
+    #
+    # TBD
 
-    # DS correctly withdrawn from all parents.
+    #
-    zone_check(server, "multiple-dswithdrawn.checkds.")
+    # 2.2.1: DS is correctly withdrawn from all parents.
+    # parental-agents: ns5, ns7
+    #
+    zone_check(server, "good.explicit.dsremoved.ns5-7.")
     wait_for_log(
         "ns9/named.run",
-        "zone multiple-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone good.explicit.dsremoved.ns5-7/IN (signed): checkds: "
         "empty DS response from 10.53.0.5",
     )
     wait_for_log(
         "ns9/named.run",
-        "zone multiple-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone good.explicit.dsremoved.ns5-7/IN (signed): checkds: "
         "empty DS response from 10.53.0.7",
     )
-    keystate_check(parent, "multiple-dswithdrawn.checkds.", "DSRemoved")
+    keystate_check(parent, "good.explicit.dsremoved.ns5-7.", "DSRemoved")
 
-    # DS withdrawn from only one of multiple parents.
+    #
-    zone_check(server, "incomplete-dswithdrawn.checkds.")
+    # 2.2.2: DS is not withdrawn from some parents.
+    # parental-agents: ns2, ns5, ns7
+    #
+    zone_check(server, "incomplete.explicit.dsremoved.ns2-5-7.")
     wait_for_log(
         "ns9/named.run",
-        "zone incomplete-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone incomplete.explicit.dsremoved.ns2-5-7/IN (signed): checkds: "
         "DS response from 10.53.0.2",
     )
     wait_for_log(
         "ns9/named.run",
-        "zone incomplete-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone incomplete.explicit.dsremoved.ns2-5-7/IN (signed): checkds: "
         "empty DS response from 10.53.0.5",
     )
     wait_for_log(
         "ns9/named.run",
-        "zone incomplete-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone incomplete.explicit.dsremoved.ns2-5-7/IN (signed): checkds: "
         "empty DS response from 10.53.0.7",
     )
-    keystate_check(parent, "incomplete-dswithdrawn.checkds.", "!DSRemoved")
+    keystate_check(parent, "incomplete.explicit.dsremoved.ns2-5-7.", "!DSRemoved")
 
-    # One of the parents is badly configured.
+    #
-    zone_check(server, "bad2-dswithdrawn.checkds.")
+    # 2.2.3: One parental agent is badly configured.
+    # parental-agents: ns5, ns6, ns7
+    #
+    zone_check(server, "bad.explicit.dsremoved.ns5-6-7.")
     wait_for_log(
         "ns9/named.run",
-        "zone bad2-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone bad.explicit.dsremoved.ns5-6-7/IN (signed): checkds: "
         "empty DS response from 10.53.0.5",
     )
     wait_for_log(
         "ns9/named.run",
-        "zone bad2-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone bad.explicit.dsremoved.ns5-6-7/IN (signed): checkds: "
         "empty DS response from 10.53.0.7",
     )
     wait_for_log(
         "ns9/named.run",
-        "zone bad2-dswithdrawn.checkds/IN (signed): checkds: "
+        "zone bad.explicit.dsremoved.ns5-6-7/IN (signed): checkds: "
         "bad DS response from 10.53.0.6",
     )
-    keystate_check(parent, "bad2-dswithdrawn.checkds.", "!DSRemoved")
+    keystate_check(parent, "bad.explicit.dsremoved.ns5-6-7.", "!DSRemoved")
 
-    # Check with resolver parental-agent.
+    #
-    zone_check(server, "resolver-dswithdrawn.checkds.")
+    # 2.2.4:: DS is removed completely, bogus signature.
-    wait_for_log(
+    #
-        "ns9/named.run",
+    # TBD
-        "zone resolver-dswithdrawn.checkds/IN (signed): checkds: "
-        "empty DS response from 10.53.0.8",
-    )
-    keystate_check(parent, "resolver-dswithdrawn.checkds.", "DSRemoved")
-
-    # TBD: DS withdrawn from all parents, but one has bogus signature.