Add stripped DS RRSIG senario

(cherry picked from commit 66f293a952)

bin/tests/system/dnssec/ns1/root.db.in

@@ -39,3 +39,5 @@ too-many-iterations.	NS	ns2.too-many-iterations.
 ns2.too-many-iterations.	A	10.53.0.2
 dnskey-rrsigs-stripped.	NS	ns2.dnskey-rrsigs-stripped.
 ns2.dnskey-rrsigs-stripped.	A	10.53.0.2
+ds-rrsigs-stripped.	NS	ns2.ds-rrsigs-stripped.
+ns2.ds-rrsigs-stripped.	A	10.53.0.2

bin/tests/system/dnssec/ns1/sign.sh

@@ -31,6 +31,7 @@ cp "../ns2/dsset-in-addr.arpa." .
 cp "../ns2/dsset-too-many-iterations." .
 cp "../ns2/dsset-lazy-ksk." .
 cp "../ns2/dsset-dnskey-rrsigs-stripped." .
+cp "../ns2/dsset-ds-rrsigs-stripped." .
 
 grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll." >"dsset-algroll."
 cp "../ns6/dsset-optout-tld." .

bin/tests/system/dnssec/ns2/child.ds-rrsigs-stripped.db.in

@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns2
+			NS	ns3
+ns2			A	10.53.0.2
+ns3			A	10.53.0.3
+
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4

bin/tests/system/dnssec/ns2/ds-rrsigs-stripped.db.in

@@ -0,0 +1,29 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			IN SOA	mname1. . (
+				2000042407 ; serial
+				20         ; refresh (20 seconds)
+				20         ; retry (20 seconds)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns2
+			NS	ns3
+ns2			A	10.53.0.2
+ns3			A	10.53.0.3
+
+child			NS	ns2.child
+ns2.child		A	10.53.0.2
+a			A	10.0.0.1
+b			A	10.0.0.2
+d			A	10.0.0.4

bin/tests/system/dnssec/ns2/named.conf.in

@@ -221,4 +221,14 @@ zone "dnskey-rrsigs-stripped" {
 	file "dnskey-rrsigs-stripped.db.signed";
 };
 
+zone "ds-rrsigs-stripped" {
+	type primary;
+	file "ds-rrsigs-stripped.db.signed";
+};
+
+zone "child.ds-rrsigs-stripped" {
+	type primary;
+	file "child.ds-rrsigs-stripped.db.signed";
+};
+
 include "trusted.conf";

bin/tests/system/dnssec/ns2/sign.sh

@@ -386,3 +386,31 @@ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
   | awk '$4 == "SOA" { $7 = $7 + 1; print; next } { print }' >"$zonefile.next"
 "$SIGNER" -g -o "$zone" -f "$zonefile.next" "$zonefile.next" >/dev/null 2>&1
 cp "$zonefile.stripped" "$zonefile.signed"
+
+#
+# A child zone for the stripped DS RRSIGs test
+#
+zone=child.ds-rrsigs-stripped
+infile=child.ds-rrsigs-stripped.db.in
+zonefile=child.ds-rrsigs-stripped.db
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
+
+#
+# A zone with the DNSKEY RRSIGS stripped
+#
+zone=ds-rrsigs-stripped
+infile=ds-rrsigs-stripped.db.in
+zonefile=ds-rrsigs-stripped.db
+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
+"$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" \
+  | awk '$4 == "RRSIG" && $5 == "DS" { next } { print }' >"$zonefile.stripped"
+"$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" \
+  | awk '$4 == "SOA" { $7 = $7 + 1; print; next } { print }' >"$zonefile.next"
+"$SIGNER" -g -o "$zone" -f "$zonefile.next" "$zonefile.next" >/dev/null 2>&1
+cp "$zonefile.stripped" "$zonefile.signed"

bin/tests/system/dnssec/tests.sh

@@ -207,6 +207,29 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
 
+echo_i "checking recovery from stripped DS RRSIG ($n)"
+ret=0
+# prime cache with DS without RRSIGs
+dig_with_opts +noauth +cd child.ds-rrsigs-stripped. @10.53.0.4 ds >dig.out.prime.ns4.test$n || ret=1
+grep ";; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1" dig.out.prime.ns4.test$n >/dev/null || ret=1
+grep "status: NOERROR" dig.out.prime.ns4.test$n >/dev/null || ret=1
+grep "RRSIG.DS" dig.out.prime.ns4.test$n >/dev/null && ret=1
+# reload server with properly signed zone
+cp ns2/ds-rrsigs-stripped.db.next ns2/ds-rrsigs-stripped.db.signed
+nextpart ns2/named.run >/dev/null
+rndccmd 10.53.0.2 reload ds-rrsigs-stripped | sed 's/^/ns2 /' | cat_i
+wait_for_log 5 "zone ds-rrsigs-stripped/IN: loaded serial 2000042408" ns2/named.run || ret=1
+# make a query that flushes the unsigned DS RRset
+dig_with_opts +noauth a.child.ds-rrsigs-stripped. @10.53.0.4 a >dig.out.ns4.test$n || ret=1
+# make a second query that should now validate
+dig_with_opts +noauth b.child.ds-rrsigs-stripped. @10.53.0.2 a >dig.out.ns2.test$n || ret=1
+dig_with_opts +noauth b.child.ds-rrsigs-stripped. @10.53.0.4 a >dig.out.ns4.test$n || ret=1
+digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 echo_i "checking that 'example/DS' from the referral was used in previous validation ($n)"
 ret=0
 grep "query 'example/DS/IN' approved" ns1/named.run >/dev/null && ret=1

bin/tests/system/dnssec/tests_sh_dnssec.py

@@ -59,6 +59,10 @@ pytestmark = pytest.mark.extra_artifacts(
         "ns2/dnskey-rrsigs-stripped.db",
         "ns2/dnskey-rrsigs-stripped.db.next",
         "ns2/dnskey-rrsigs-stripped.db.stripped",
+        "ns2/child.ds-rrsigs-stripped.db",
+        "ns2/ds-rrsigs-stripped.db",
+        "ns2/ds-rrsigs-stripped.db.next",
+        "ns2/ds-rrsigs-stripped.db.stripped",
         "ns2/example.db",
         "ns2/in-addr.arpa.db",
         "ns2/lazy-ksk.db",