From ab49205af37ffafb70a3ba112897152f31a7a83d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
Date: Tue, 4 Jan 2022 15:41:46 +0100
Subject: [PATCH] Check unsigned serial number in signed zone files

All signed zone files present in bin/tests/system/inline/ns8 should
contain the unsigned serial number in the raw-format header.  Add a
check to ensure that is the case.  Extend the dnssec-signzone command
line in ns8/sign.sh with the -L option to allow the zones initially
signed there to pass the newly added check.  Add another zone to the
configuration for the ns8 named instance to ensure the check also passes
when multiple zones are inline-signed by a single named instance.
---
 bin/tests/system/inline/ns8/named.conf.in     |  7 ++
 bin/tests/system/inline/ns8/sign.sh           | 15 ++--
 .../system/inline/tests_signed_zone_files.py  | 68 +++++++++++++++++++
 util/copyrights                               |  1 +
 4 files changed, 84 insertions(+), 7 deletions(-)
 create mode 100755 bin/tests/system/inline/tests_signed_zone_files.py

diff --git a/bin/tests/system/inline/ns8/named.conf.in b/bin/tests/system/inline/ns8/named.conf.in
index 242c4dc870..b6ee1bf16a 100644
--- a/bin/tests/system/inline/ns8/named.conf.in
+++ b/bin/tests/system/inline/ns8/named.conf.in
@@ -151,3 +151,10 @@ zone example {
 	auto-dnssec maintain;
 	file "example.db";
 };
+
+zone "unsigned-serial-test" {
+	type primary;
+	inline-signing yes;
+	auto-dnssec maintain;
+	file "unsigned-serial-test.db";
+};
diff --git a/bin/tests/system/inline/ns8/sign.sh b/bin/tests/system/inline/ns8/sign.sh
index 9033c72079..d8702fd2bc 100755
--- a/bin/tests/system/inline/ns8/sign.sh
+++ b/bin/tests/system/inline/ns8/sign.sh
@@ -21,12 +21,13 @@ do
   keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
   keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
   cp example.com.db.in ${zone}.db
-  $SIGNER -S -T 3600 -O raw -o ${zone} ${zone}.db > /dev/null 2>&1
+  $SIGNER -S -T 3600 -O raw -L 2000042407 -o ${zone} ${zone}.db > /dev/null 2>&1
 done
 
-zone=example
-rm -f K${zone}.+*+*.key
-rm -f K${zone}.+*+*.private
-keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
-keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
-cp ${zone}.db.in ${zone}.db
+for zone in example unsigned-serial-test; do
+  rm -f K${zone}.+*+*.key
+  rm -f K${zone}.+*+*.private
+  keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone $zone`
+  keyname=`$KEYGEN -q -a $DEFAULT_ALGORITHM -b $DEFAULT_BITS -n zone -f KSK $zone`
+  cp example.db.in ${zone}.db
+done
diff --git a/bin/tests/system/inline/tests_signed_zone_files.py b/bin/tests/system/inline/tests_signed_zone_files.py
new file mode 100755
index 0000000000..0abbb987be
--- /dev/null
+++ b/bin/tests/system/inline/tests_signed_zone_files.py
@@ -0,0 +1,68 @@
+############################################################################
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+############################################################################
+
+import glob
+import struct
+
+
+class RawFormatHeader(dict):
+    '''
+    A dictionary of raw-format header fields read from a zone file.
+    '''
+
+    fields = [
+        'format',
+        'version',
+        'dumptime',
+        'flags',
+        'sourceserial',
+        'lastxfrin',
+    ]
+
+    def __init__(self, file_name):
+        header = struct.Struct('>IIIIII')
+        with open(file_name, 'rb') as data:
+            header_data = data.read(header.size)
+        super().__init__(zip(self.fields, header.unpack_from(header_data)))
+
+
+def test_unsigned_serial_number():
+
+    '''
+    Check whether all signed zone files in the "ns8" subdirectory contain the
+    serial number of the unsigned version of the zone in the raw-format header.
+    The test assumes that all "*.signed" files in the "ns8" subdirectory are in
+    raw format.
+
+    Notes:
+
+      - The actual zone signing and dumping happens while the tests.sh phase of
+        the "inline" system test is set up and run.  This check only verifies
+        the outcome of those events; it does not initiate any signing or
+        dumping itself.
+
+      - example[0-9][0-9].com.db.signed files are initially signed by
+        dnssec-signzone while the others - by named.
+    '''
+
+    zones_with_unsigned_serial_missing = []
+
+    for signed_zone in sorted(glob.glob('ns8/*.signed')):
+        raw_header = RawFormatHeader(signed_zone)
+        # Ensure the unsigned serial number is placed where it is expected.
+        assert raw_header['format'] == 2
+        assert raw_header['version'] == 1
+        # Check whether the header flags indicate that the unsigned serial
+        # number is set and that the latter is indeed set.
+        if raw_header['flags'] & 0x02 == 0 or raw_header['sourceserial'] == 0:
+            zones_with_unsigned_serial_missing.append(signed_zone)
+
+    assert not zones_with_unsigned_serial_missing
diff --git a/util/copyrights b/util/copyrights
index e57b83189e..b1752be8ce 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -426,6 +426,7 @@
 ./bin/tests/system/inline/ns8/sign.sh		SH	2020,2021,2022
 ./bin/tests/system/inline/setup.sh		SH	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021,2022
 ./bin/tests/system/inline/tests.sh		SH	2011,2012,2013,2014,2016,2017,2018,2019,2020,2021,2022
+./bin/tests/system/inline/tests_signed_zone_files.py	PYTHON	2022
 ./bin/tests/system/integrity/clean.sh		SH	2017,2018,2019,2020,2021,2022
 ./bin/tests/system/integrity/setup.sh		SH	2018,2019,2020,2021,2022
 ./bin/tests/system/integrity/tests.sh		SH	2017,2018,2019,2020,2021,2022