Commit 196e01da authored by Mark Andrews's avatar Mark Andrews
Browse files

4837. [bug] dns_update_signatures{inc} (add_sigs) was not

                        properly determining if there were active KSK and
                        ZSK keys for a algorithm when update-check-ksk is
                        true (default) leaving records unsigned. [RT #46743]
parent 1b0ca5d5
4837. [bug] dns_update_signatures{inc} (add_sigs) was not
properly determining if there were active KSK and
ZSK keys for a algorithm when update-check-ksk is
true (default) leaving records unsigned. [RT #46743]
--- 9.12.0rc1 released ---
 
4836. [bug] Zones created using "rndc addzone" could
......
......@@ -15,6 +15,8 @@ rm -f ns1/root.db.signed
rm -f ns2/bits.db
rm -f ns2/bits.db.jnl
rm -f ns1/signer.out
rm -f ns2/inactivezsk.db
rm -f ns2/inactivezsk.db.jnl
rm -f ns2/retransfer.db
rm -f ns2/retransfer.db.jnl
rm -f ns2/retransfer3.db
......@@ -44,6 +46,10 @@ rm -f ns3/expired.db
rm -f ns3/expired.db.jnl
rm -f ns3/expired.db.signed
rm -f ns3/expired.db.signed.jnl
rm -f ns3/inactivezsk.bk
rm -f ns3/inactivezsk.bk.jnl
rm -f ns3/inactivezsk.bk.signed
rm -f ns3/inactivezsk.bk.signed.jnl
rm -f ns3/nsec3.db
rm -f ns3/nsec3.db.jnl
rm -f ns3/nsec3.db.signed
......
......@@ -48,3 +48,6 @@ ns3.externalkey. A 10.53.0.3
retransfer3. NS ns3.retransfer.
ns3.retransfer3. A 10.53.0.3
inactivezsk. NS ns3.inactivezsk.
ns3.inactivezsk. A 10.53.0.3
......@@ -53,3 +53,9 @@ zone "nsec3-loop" {
file "nsec3-loop.db";
notify no;
};
zone "inactivezsk" {
type master;
file "inactivezsk.db";
allow-update { any; };
};
......@@ -112,3 +112,11 @@ zone "retransfer3" {
auto-dnssec maintain;
file "retransfer3.bk";
};
zone "inactivezsk" {
type slave;
masters { 10.53.0.2; };
inline-signing yes;
auto-dnssec maintain;
file "inactivezsk.bk";
};
......@@ -75,6 +75,15 @@ keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone $zone`
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
zone=inactivezsk
rm -f K${zone}.+*+*.key
rm -f K${zone}.+*+*.private
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -P now -A now+3600 $zone`
keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone -f KSK $zone`
$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
for s in a c d h k l m q z
do
zone=test-$s
......
......@@ -16,6 +16,7 @@ rm -f ns1/root.db.signed
touch ns2/trusted.conf
cp ns2/bits.db.in ns2/bits.db
cp ns2/bits.db.in ns2/inactivezsk.db
cp ns2/bits.db.in ns2/retransfer.db
cp ns2/bits.db.in ns2/retransfer3.db
rm -f ns2/bits.db.jnl
......
......@@ -1022,5 +1022,36 @@ serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.post.test$n`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
n=`expr $n + 1`
echo "I:testing checking that inline signing works with inactive KSK ($n)"
ret=0
$DIG $DIGOPTS @10.53.0.3 -p 5300 soa inactivezsk > dig.out.ns3.pre.test$n || ret=1
soa1=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.pre.test$n`
$NSUPDATE << EOF
server 10.53.0.2 5300
update add added.inactivezsk 0 IN TXT added record
send
EOF
for i in 1 2 3 4 5 6 7 8 9 10
do
$DIG $DIGOPTS @10.53.0.3 -p 5300 soa inactivezsk > dig.out.ns3.post.test$n || ret=1
soa2=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
test ${soa1:-0} -ne ${soa2:-0} && break
sleep 1
done
test ${soa1:-0} -ne ${soa2:-0} || ret=1
$DIG $DIGOPTS @10.53.0.3 -p 5300 txt added.inactivezsk > dig.out.ns3.test$n || ret=1
grep "ANSWER: 3," dig.out.ns3.test$n > /dev/null || ret=1
grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
grep "TXT 7 2" dig.out.ns3.test$n > /dev/null || ret=1
grep "TXT 8 2" dig.out.ns3.test$n > /dev/null || ret=1
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
echo "I:exit status: $status"
[ $status -eq 0 ] || exit 1
......@@ -1105,6 +1105,8 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
if (!dst_key_isprivate(keys[i]))
continue;
if (dst_key_inactive(keys[i])) /* Should be redundant. */
continue;
if (check_ksk && !REVOKE(keys[i])) {
isc_boolean_t have_ksk, have_nonksk;
......@@ -1118,6 +1120,10 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
for (j = 0; j < nkeys; j++) {
if (j == i || ALG(keys[i]) != ALG(keys[j]))
continue;
if (!dst_key_isprivate(keys[j]))
continue;
if (dst_key_inactive(keys[j])) /* SBR */
continue;
if (REVOKE(keys[j]))
continue;
if (KSK(keys[j]))
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment