diff options
| -rw-r--r-- | CHANGES | 11 | ||||
| -rw-r--r-- | bin/tests/system/dlv/clean.sh | 17 | ||||
| -rw-r--r-- | bin/tests/system/dlv/ns1/named.conf | 6 | ||||
| -rw-r--r-- | bin/tests/system/dlv/ns1/root.db.in (renamed from bin/tests/system/dlv/ns1/root.db) | 4 | ||||
| -rwxr-xr-x | bin/tests/system/dlv/ns1/sign.sh | 52 | ||||
| -rw-r--r-- | bin/tests/system/dlv/ns2/druz.db.in | 54 | ||||
| -rw-r--r-- | bin/tests/system/dlv/ns2/named.conf | 5 | ||||
| -rwxr-xr-x | bin/tests/system/dlv/ns2/sign.sh | 44 | ||||
| -rw-r--r-- | bin/tests/system/dlv/ns3/named.conf | 10 | ||||
| -rwxr-xr-x | bin/tests/system/dlv/ns3/sign.sh | 143 | ||||
| -rw-r--r-- | bin/tests/system/dlv/ns5/named.conf | 3 | ||||
| -rw-r--r-- | bin/tests/system/dlv/ns6/named.conf | 10 | ||||
| -rwxr-xr-x | bin/tests/system/dlv/ns6/sign.sh | 121 | ||||
| -rw-r--r-- | bin/tests/system/dlv/setup.sh | 4 | ||||
| -rw-r--r-- | bin/tests/system/dlv/tests.sh | 18 | ||||
| -rw-r--r-- | lib/dns/api | 2 | ||||
| -rw-r--r-- | lib/dns/ncache.c | 4 | ||||
| -rw-r--r-- | lib/dns/validator.c | 33 | ||||
| -rw-r--r-- | lib/dns/win32/libdns.def | 1 | ||||
| -rw-r--r-- | version | 4 |
20 files changed, 501 insertions, 45 deletions
@@ -1,3 +1,14 @@ + --- 9.8.0-P2 released --- + +3121. [security] An authoritative name server sending a negative + response containing a very large RRset could + trigger an off-by-one error in the ncache code + and crash named. [RT #24650] + +3120. [bug] Named could fail to validate zones listed in a DLV + that validated insecure without using DLV and had + DS records in the parent zone. [RT #24631] + --- 9.8.0-P1 released --- 3100. [security] Certain response policy zone configurations could diff --git a/bin/tests/system/dlv/clean.sh b/bin/tests/system/dlv/clean.sh index 8b49fe50..43e06871 100644 --- a/bin/tests/system/dlv/clean.sh +++ b/bin/tests/system/dlv/clean.sh @@ -14,17 +14,30 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: clean.sh,v 1.7 2010-05-27 23:51:08 tbox Exp $ +# $Id: clean.sh,v 1.7.242.1 2011-05-27 00:57:30 each Exp $ rm -f random.data rm -f ns*/named.run +rm -f ns1/K* +rm -f ns1/dsset-* +rm -f ns1/*.signed +rm -f ns1/signer.err +rm -f ns1/root.db +rm -f ns2/K* +rm -f ns2/dlvset-* +rm -f ns2/dsset-* +rm -f ns2/*.signed +rm -f ns2/*.pre +rm -f ns2/signer.err +rm -f ns2/druz.db rm -f ns3/K* rm -f ns3/*.db rm -f ns3/*.signed rm -f ns3/dlvset-* rm -f ns3/dsset-* rm -f ns3/keyset-* -rm -f ns3/trusted.conf ns5/trusted.conf +rm -f ns1/trusted.conf ns5/trusted.conf +rm -f ns3/trusted-dlv.conf ns5/trusted-dlv.conf rm -f ns3/signer.err rm -f ns6/K* rm -f ns6/*.db diff --git a/bin/tests/system/dlv/ns1/named.conf b/bin/tests/system/dlv/ns1/named.conf index 2d5d8c16..db840893 100644 --- a/bin/tests/system/dlv/ns1/named.conf +++ b/bin/tests/system/dlv/ns1/named.conf @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.4 2007-06-19 23:47:02 tbox Exp $ */ +/* $Id: named.conf,v 1.4.950.1 2011-05-27 00:57:30 each Exp $ */ controls { /* empty */ }; @@ -28,8 +28,8 @@ options { listen-on-v6 { none; }; recursion no; notify yes; - dnssec-enable no; + dnssec-enable yes; }; -zone "." { type master; file "root.db"; }; +zone "." { type master; file "root.signed"; }; zone "rootservers.utld" { type master; file "rootservers.utld.db"; }; diff --git a/bin/tests/system/dlv/ns1/root.db b/bin/tests/system/dlv/ns1/root.db.in index 620c66e9..9846cb68 100644 --- a/bin/tests/system/dlv/ns1/root.db +++ b/bin/tests/system/dlv/ns1/root.db.in @@ -12,7 +12,7 @@ ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR ; PERFORMANCE OF THIS SOFTWARE. -; $Id: root.db,v 1.4 2007-06-19 23:47:02 tbox Exp $ +; $Id: root.db.in,v 1.3.8.2 2011-05-27 00:57:30 each Exp $ $TTL 120 @ SOA ns.rootservers.utld hostmaster.ns.rootservers.utld ( @@ -22,3 +22,5 @@ ns A 10.53.0.1 ; utld NS ns.utld ns.utld A 10.53.0.2 +druz NS ns.druz +ns.druz A 10.53.0.2 diff --git a/bin/tests/system/dlv/ns1/sign.sh b/bin/tests/system/dlv/ns1/sign.sh new file mode 100755 index 00000000..3f992fba --- /dev/null +++ b/bin/tests/system/dlv/ns1/sign.sh @@ -0,0 +1,52 @@ +#!/bin/sh +# +# Copyright (C) 2004, 2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: sign.sh,v 1.3.8.2 2011-05-27 00:57:30 each Exp $ + +(cd ../ns2 && sh -e ./sign.sh || exit 1) + +echo "I:dlv/ns1/sign.sh" + +SYSTEMTESTTOP=../.. +. $SYSTEMTESTTOP/conf.sh + +RANDFILE=../random.data + +zone=. +infile=root.db.in +zonefile=root.db +outfile=root.signed + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -r $RANDFILE -g -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err + +echo "I: signed $zone" + +grep -v '^;' $keyname2.key | $PERL -n -e ' +local ($dn, $class, $type, $flags, $proto, $alg, @rest) = split; +local $key = join("", @rest); +print <<EOF +trusted-keys { + "$dn" $flags $proto $alg "$key"; +}; +EOF +' > trusted.conf +cp trusted.conf ../ns5 + diff --git a/bin/tests/system/dlv/ns2/druz.db.in b/bin/tests/system/dlv/ns2/druz.db.in new file mode 100644 index 00000000..5c7adc18 --- /dev/null +++ b/bin/tests/system/dlv/ns2/druz.db.in @@ -0,0 +1,54 @@ +; Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") +; +; Permission to use, copy, modify, and/or distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +; PERFORMANCE OF THIS SOFTWARE. + +; $Id: druz.db.in,v 1.4.8.2 2011-05-27 00:57:30 each Exp $ + +$TTL 120 +@ SOA ns hostmaster.ns 1 3600 1200 604800 60 +@ NS ns +ns A 10.53.0.2 +; +rootservers NS ns.rootservers +ns.rootservers A 10.53.0.1 +; +; +child1 NS ns.child1 +ns.child1 A 10.53.0.3 +; +child2 NS ns.child2 +ns.child2 A 10.53.0.4 +; +child3 NS ns.child3 +ns.child3 A 10.53.0.3 +; +child4 NS ns.child4 +ns.child4 A 10.53.0.3 +; +child5 NS ns.child5 +ns.child5 A 10.53.0.3 +; +child6 NS ns.child6 +ns.child6 A 10.53.0.4 +; +child7 NS ns.child7 +ns.child7 A 10.53.0.3 +; +child8 NS ns.child8 +ns.child8 A 10.53.0.3 +; +child9 NS ns.child9 +ns.child9 A 10.53.0.3 +; +child10 NS ns.child10 +ns.child10 A 10.53.0.3 diff --git a/bin/tests/system/dlv/ns2/named.conf b/bin/tests/system/dlv/ns2/named.conf index c7e6ba8d..baca63d8 100644 --- a/bin/tests/system/dlv/ns2/named.conf +++ b/bin/tests/system/dlv/ns2/named.conf @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.4 2007-06-19 23:47:02 tbox Exp $ */ +/* $Id: named.conf,v 1.4.950.1 2011-05-27 00:57:30 each Exp $ */ controls { /* empty */ }; @@ -28,8 +28,9 @@ options { listen-on-v6 { none; }; recursion no; notify yes; - dnssec-enable no; + dnssec-enable yes; }; zone "." { type hint; file "hints"; }; zone "utld" { type master; file "utld.db"; }; +zone "druz" { type master; file "druz.signed"; }; diff --git a/bin/tests/system/dlv/ns2/sign.sh b/bin/tests/system/dlv/ns2/sign.sh new file mode 100755 index 00000000..976ad7e6 --- /dev/null +++ b/bin/tests/system/dlv/ns2/sign.sh @@ -0,0 +1,44 @@ +#!/bin/sh +# +# Copyright (C) 2004, 2007, 2009, 2010 Internet Systems Consortium, Inc. ("ISC") +# +# Permission to use, copy, modify, and/or distribute this software for any +# purpose with or without fee is hereby granted, provided that the above +# copyright notice and this permission notice appear in all copies. +# +# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +# PERFORMANCE OF THIS SOFTWARE. + +# $Id: sign.sh,v 1.3.8.2 2011-05-27 00:57:31 each Exp $ + +(cd ../ns3 && sh -e ./sign.sh || exit 1) + +echo "I:dlv/ns2/sign.sh" + +SYSTEMTESTTOP=../.. +. $SYSTEMTESTTOP/conf.sh + +RANDFILE=../random.data + +zone=druz. +infile=druz.db.in +zonefile=druz.db +outfile=druz.pre +dlvzone=utld. + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -r $RANDFILE -l $dlvzone -g -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err + +$CHECKZONE -q -D -i none druz druz.pre | +sed '/IN DNSKEY/s/\([a-z0-9A-Z/]\{10\}\)[a-z0-9A-Z/]\{16\}/\1XXXXXXXXXXXXXXXX/'> druz.signed + +echo "I: signed $zone" diff --git a/bin/tests/system/dlv/ns3/named.conf b/bin/tests/system/dlv/ns3/named.conf index daa862ac..bbb51053 100644 --- a/bin/tests/system/dlv/ns3/named.conf +++ b/bin/tests/system/dlv/ns3/named.conf @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.4 2007-06-19 23:47:02 tbox Exp $ */ +/* $Id: named.conf,v 1.4.950.1 2011-05-27 00:57:31 each Exp $ */ controls { /* empty */ }; @@ -41,3 +41,11 @@ zone "child7.utld" { type master; file "child7.signed"; }; // no dlv zone "child8.utld" { type master; file "child8.signed"; }; // no dlv zone "child9.utld" { type master; file "child9.signed"; }; // dlv zone "child10.utld" { type master; file "child.db.in"; }; // dlv unsigned +zone "child1.druz" { type master; file "child1.druz.signed"; }; // dlv +zone "child3.druz" { type master; file "child3.druz.signed"; }; // dlv +zone "child4.druz" { type master; file "child4.druz.signed"; }; // dlv +zone "child5.druz" { type master; file "child5.druz.signed"; }; // dlv +zone "child7.druz" { type master; file "child7.druz.signed"; }; // no dlv +zone "child8.druz" { type master; file "child8.druz.signed"; }; // no dlv +zone "child9.druz" { type master; file "child9.druz.signed"; }; // dlv +zone "child10.druz" { type master; file "child.db.in"; }; // dlv unsigned diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh index 1b716d7b..cb0f9e36 100755 --- a/bin/tests/system/dlv/ns3/sign.sh +++ b/bin/tests/system/dlv/ns3/sign.sh @@ -14,21 +14,24 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: sign.sh,v 1.9 2010-05-27 23:51:08 tbox Exp $ +# $Id: sign.sh,v 1.9.242.1 2011-05-27 00:57:31 each Exp $ (cd ../ns6 && sh -e ./sign.sh) +echo "I:dlv/ns3/sign.sh" + SYSTEMTESTTOP=../.. . $SYSTEMTESTTOP/conf.sh RANDFILE=../random.data +dlvzone=dlv.utld. dlvsets= +dssets= zone=child1.utld. infile=child.db.in zonefile=child1.utld.db outfile=child1.signed -dlvzone=dlv.utld. dlvsets="$dlvsets dlvset-$zone" keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` @@ -44,7 +47,6 @@ zone=child3.utld. infile=child.db.in zonefile=child3.utld.db outfile=child3.signed -dlvzone=dlv.utld. dlvsets="$dlvsets dlvset-$zone" keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` @@ -60,7 +62,6 @@ zone=child4.utld. infile=child.db.in zonefile=child4.utld.db outfile=child4.signed -dlvzone=dlv.utld. dlvsets="$dlvsets dlvset-$zone" keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` @@ -76,7 +77,6 @@ zone=child5.utld. infile=child.db.in zonefile=child5.utld.db outfile=child5.signed -dlvzone=dlv.utld. dlvsets="$dlvsets dlvset-$zone" keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` @@ -92,7 +92,6 @@ zone=child7.utld. infile=child.db.in zonefile=child7.utld.db outfile=child7.signed -dlvzone=dlv.utld. keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` @@ -107,7 +106,6 @@ zone=child8.utld. infile=child.db.in zonefile=child8.utld.db outfile=child8.signed -dlvzone=dlv.utld. keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` @@ -122,7 +120,6 @@ zone=child9.utld. infile=child.db.in zonefile=child9.utld.db outfile=child9.signed -dlvzone=dlv.utld. dlvsets="$dlvsets dlvset-$zone" keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` @@ -137,7 +134,6 @@ zone=child10.utld. infile=child.db.in zonefile=child10.utld.db outfile=child10.signed -dlvzone=dlv.utld. dlvsets="$dlvsets dlvset-$zone" keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` @@ -148,12 +144,133 @@ cat $infile $keyname1.key $keyname2.key >$zonefile $SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err echo "I: signed $zone" +zone=child1.druz. +infile=child.db.in +zonefile=child1.druz.db +outfile=child1.druz.signed +dlvsets="$dlvsets dlvset-$zone" +dssets="$dssets dsset-$zone" + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile + +$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=child3.druz. +infile=child.db.in +zonefile=child3.druz.db +outfile=child3.druz.signed +dlvsets="$dlvsets dlvset-$zone" +dssets="$dssets dsset-$zone" + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile + +$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=child4.druz. +infile=child.db.in +zonefile=child4.druz.db +outfile=child4.druz.signed +dlvsets="$dlvsets dlvset-$zone" +dssets="$dssets dsset-$zone" + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=child5.druz. +infile=child.db.in +zonefile=child5.druz.db +outfile=child5.druz.signed +dlvsets="$dlvsets dlvset-$zone" +dssets="$dssets dsset-$zone" + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile + +$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=child7.druz. +infile=child.db.in +zonefile=child7.druz.db +outfile=child7.druz.signed +dssets="$dssets dsset-$zone" + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile + +$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=child8.druz. +infile=child.db.in +zonefile=child8.druz.db +outfile=child8.druz.signed + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=child9.druz. +infile=child.db.in +zonefile=child9.druz.db +outfile=child9.druz.signed +dlvsets="$dlvsets dlvset-$zone" + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + +zone=child10.druz. +infile=child.db.in +zonefile=child10.druz.db +outfile=child10.druz.signed +dlvsets="$dlvsets dlvset-$zone" +dssets="$dssets dsset-$zone" + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + zone=dlv.utld. infile=dlv.db.in zonefile=dlv.utld.db outfile=dlv.signed -dlvzone=dlv.utld. keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` @@ -172,5 +289,7 @@ trusted-keys { "$dn" $flags $proto $alg "$key"; }; EOF -' > trusted.conf -cp trusted.conf ../ns5 +' > trusted-dlv.conf +cp trusted-dlv.conf ../ns5 + +cp $dssets ../ns2 diff --git a/bin/tests/system/dlv/ns5/named.conf b/bin/tests/system/dlv/ns5/named.conf index e3c5fc2d..c220134a 100644 --- a/bin/tests/system/dlv/ns5/named.conf +++ b/bin/tests/system/dlv/ns5/named.conf @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.8 2007-06-18 23:47:28 tbox Exp $ */ +/* $Id: named.conf,v 1.8.950.1 2011-05-27 00:57:31 each Exp $ */ /* * Choose a keyname that is unlikely to clash with any real key names. @@ -46,6 +46,7 @@ controls { }; include "trusted.conf"; +include "trusted-dlv.conf"; options { query-source address 10.53.0.5; diff --git a/bin/tests/system/dlv/ns6/named.conf b/bin/tests/system/dlv/ns6/named.conf index e6034ab7..c3950fe8 100644 --- a/bin/tests/system/dlv/ns6/named.conf +++ b/bin/tests/system/dlv/ns6/named.conf @@ -14,7 +14,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.4 2010-07-11 01:18:24 each Exp $ */ +/* $Id: named.conf,v 1.4.210.1 2011-05-27 00:57:31 each Exp $ */ controls { /* empty */ }; @@ -40,3 +40,11 @@ zone "grand.child7.utld" { type master; file "grand.child7.signed"; }; zone "grand.child8.utld" { type master; file "grand.child8.signed"; }; zone "grand.child9.utld" { type master; file "grand.child9.signed"; }; zone "grand.child10.utld" { type master; file "grand.child10.signed"; }; +zone "grand.child1.druz" { type master; file "grand.child1.druz.signed"; }; +zone "grand.child3.druz" { type master; file "grand.child3.druz.signed"; }; +zone "grand.child4.druz" { type master; file "grand.child4.druz.signed"; }; +zone "grand.child5.druz" { type master; file "grand.child5.druz.signed"; }; +zone "grand.child7.druz" { type master; file "grand.child7.druz.signed"; }; +zone "grand.child8.druz" { type master; file "grand.child8.druz.signed"; }; +zone "grand.child9.druz" { type master; file "grand.child9.druz.signed"; }; +zone "grand.child10.druz" { type master; file "grand.child10.druz.signed"; }; diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh index 2fea6c23..b64a57ab 100755 --- a/bin/tests/system/dlv/ns6/sign.sh +++ b/bin/tests/system/dlv/ns6/sign.sh @@ -14,11 +14,13 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: sign.sh,v 1.3 2010-05-27 23:51:08 tbox Exp $ +# $Id: sign.sh,v 1.3.250.1 2011-05-27 00:57:31 each Exp $ SYSTEMTESTTOP=../.. . $SYSTEMTESTTOP/conf.sh +echo "I:dlv/ns6/sign.sh" + RANDFILE=../random.data zone=grand.child1.utld. @@ -137,3 +139,120 @@ cat $infile $keyname1.key $keyname2.key >$zonefile $SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err echo "I: signed $zone" + +zone=grand.child1.druz. +infile=child.db.in +zonefile=grand.child1.druz.db +outfile=grand.child1.druz.signed + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=grand.child3.druz. +infile=child.db.in +zonefile=grand.child3.druz.db +outfile=grand.child3.druz.signed +dlvzone=dlv.druz. + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=grand.child4.druz. +infile=child.db.in +zonefile=grand.child4.druz.db +outfile=grand.child4.druz.signed +dlvzone=dlv.druz. + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=grand.child5.druz. +infile=child.db.in +zonefile=grand.child5.druz.db +outfile=grand.child5.druz.signed +dlvzone=dlv.druz. + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=grand.child7.druz. +infile=child.db.in +zonefile=grand.child7.druz.db +outfile=grand.child7.druz.signed +dlvzone=dlv.druz. + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=grand.child8.druz. +infile=child.db.in +zonefile=grand.child8.druz.db +outfile=grand.child8.druz.signed +dlvzone=dlv.druz. + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + + +zone=grand.child9.druz. +infile=child.db.in +zonefile=grand.child9.druz.db +outfile=grand.child9.druz.signed +dlvzone=dlv.druz. + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" + +zone=grand.child10.druz. +infile=child.db.in +zonefile=grand.child10.druz.db +outfile=grand.child10.druz.signed +dlvzone=dlv.druz. + +keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` +keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` + +cat $infile $keyname1.key $keyname2.key >$zonefile + +$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err +echo "I: signed $zone" diff --git a/bin/tests/system/dlv/setup.sh b/bin/tests/system/dlv/setup.sh index b35a87f0..594f9189 100644 --- a/bin/tests/system/dlv/setup.sh +++ b/bin/tests/system/dlv/setup.sh @@ -14,8 +14,8 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: setup.sh,v 1.6 2009-03-02 23:47:43 tbox Exp $ +# $Id: setup.sh,v 1.6.528.1 2011-05-27 00:57:30 each Exp $ ../../../tools/genrandom 400 random.data -(cd ns3 && sh -e sign.sh) +(cd ns1 && sh -e sign.sh) diff --git a/bin/tests/system/dlv/tests.sh b/bin/tests/system/dlv/tests.sh index 19f2175f..437335f1 100644 --- a/bin/tests/system/dlv/tests.sh +++ b/bin/tests/system/dlv/tests.sh @@ -14,7 +14,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: tests.sh,v 1.6 2010-05-27 23:51:08 tbox Exp $ +# $Id: tests.sh,v 1.6.242.1 2011-05-27 00:57:30 each Exp $ SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh @@ -42,5 +42,21 @@ n=`expr $n + 1` if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` +echo "I:checking that SOA reference by DLV in a DRUZ with DS validates as secure ($n)" +ret=0 +$DIG $DIGOPTS child1.druz soa @10.53.0.5 > dig.out.ns5.test$n || ret=1 +grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1 +n=`expr $n + 1` +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + +echo "I:checking that child SOA reference by DLV in a DRUZ with DS validates as secure ($n)" +ret=0 +$DIG $DIGOPTS grand.child1.druz soa @10.53.0.5 > dig.out.ns5.test$n || ret=1 +grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1 +n=`expr $n + 1` +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + echo "I:exit status: $status" exit $status diff --git a/lib/dns/api b/lib/dns/api index af1a23fe..9d9c7586 100644 --- a/lib/dns/api +++ b/lib/dns/api @@ -1,3 +1,3 @@ LIBINTERFACE = 82 -LIBREVISION = 1 +LIBREVISION = 2 LIBAGE = 1 diff --git a/lib/dns/ncache.c b/lib/dns/ncache.c index 211d5fc6..e72571ee 100644 --- a/lib/dns/ncache.c +++ b/lib/dns/ncache.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: ncache.c,v 1.50.124.1 2011-02-03 07:39:03 marka Exp $ */ +/* $Id: ncache.c,v 1.50.124.1.2.1 2011-05-27 00:57:31 each Exp $ */ /*! \file */ @@ -186,7 +186,7 @@ dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache, */ isc_buffer_availableregion(&buffer, &r); - if (r.length < 2) + if (r.length < 3) return (ISC_R_NOSPACE); isc_buffer_putuint16(&buffer, rdataset->type); diff --git a/lib/dns/validator.c b/lib/dns/validator.c index 7895c7cc..fa6fa610 100644 --- a/lib/dns/validator.c +++ b/lib/dns/validator.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: validator.c,v 1.197 2010-12-23 04:07:58 marka Exp $ */ +/* $Id: validator.c,v 1.197.40.1 2011-05-27 00:57:31 each Exp $ */ #include <config.h> @@ -428,7 +428,8 @@ fetch_callback_validator(isc_task_t *task, isc_event_t *event) { validator_done(val, ISC_R_CANCELED); } else if (eresult == ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), - "keyset with trust %d", rdataset->trust); + "keyset with trust %s", + dns_trust_totext(rdataset->trust)); /* * Only extract the dst key if the keyset is secure. */ @@ -505,7 +506,8 @@ dsfetched(isc_task_t *task, isc_event_t *event) { validator_done(val, ISC_R_CANCELED); } else if (eresult == ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), - "dsset with trust %d", rdataset->trust); + "dsset with trust %s", + dns_trust_totext(rdataset->trust)); val->dsset = &val->frdataset; result = validatezonekey(val); if (result != DNS_R_WAIT) @@ -660,7 +662,8 @@ keyvalidated(isc_task_t *task, isc_event_t *event) { validator_done(val, ISC_R_CANCELED); } else if (eresult == ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), - "keyset with trust %d", val->frdataset.trust); + "keyset with trust %s", + dns_trust_totext(val->frdataset.trust)); /* * Only extract the dst key if the keyset is secure. */ @@ -731,10 +734,10 @@ dsvalidated(isc_task_t *task, isc_event_t *event) { isc_boolean_t have_dsset; dns_name_t *name; validator_log(val, ISC_LOG_DEBUG(3), - "%s with trust %d", + "%s with trust %s", val->frdataset.type == dns_rdatatype_ds ? "dsset" : "ds non-existance", - val->frdataset.trust); + dns_trust_totext(val->frdataset.trust)); have_dsset = ISC_TF(val->frdataset.type == dns_rdatatype_ds); name = dns_fixedname_name(&val->fname); if ((val->attributes & VALATTR_INSECURITY) != 0 && @@ -1385,8 +1388,8 @@ view_find(dns_validator_t *val, dns_name_t *name, dns_rdatatype_t type) { INSIST(type == dns_rdatatype_dlv); if (val->frdataset.trust != dns_trust_secure) { validator_log(val, ISC_LOG_DEBUG(3), - "covering nsec: trust %u", - val->frdataset.trust); + "covering nsec: trust %s", + dns_trust_totext(val->frdataset.trust)); goto notfound; } result = dns_rdataset_first(&val->frdataset); @@ -1721,8 +1724,8 @@ get_key(dns_validator_t *val, dns_rdata_rrsig_t *siginfo) { * See if we've got the key used in the signature. */ validator_log(val, ISC_LOG_DEBUG(3), - "keyset with trust %d", - val->frdataset.trust); + "keyset with trust %s", + dns_trust_totext(val->frdataset.trust)); result = get_dst_key(val, siginfo, val->keyset); if (result != ISC_R_SUCCESS) { /* @@ -2492,8 +2495,11 @@ validatezonekey(dns_validator_t *val) { " insecure DS"); return (DNS_R_MUSTBESECURE); } - markanswer(val, "validatezonekey (2)"); - return (ISC_R_SUCCESS); + if (val->view->dlv == NULL || DLVTRIED(val)) { + markanswer(val, "validatezonekey (2)"); + return (ISC_R_SUCCESS); + } + return (startfinddlvsep(val, val->event->name)); } /* @@ -3231,7 +3237,8 @@ dlvvalidated(isc_task_t *task, isc_event_t *event) { validator_done(val, ISC_R_CANCELED); } else if (eresult == ISC_R_SUCCESS) { validator_log(val, ISC_LOG_DEBUG(3), - "dlvset with trust %d", val->frdataset.trust); + "dlvset with trust %s", + dns_trust_totext(val->frdataset.trust)); dns_rdataset_clone(&val->frdataset, &val->dlv); val->havedlvsep = ISC_TRUE; if (dlv_algorithm_supported(val)) diff --git a/lib/dns/win32/libdns.def b/lib/dns/win32/libdns.def index 83a1cf62..dac286ef 100644 --- a/lib/dns/win32/libdns.def +++ b/lib/dns/win32/libdns.def @@ -675,6 +675,7 @@ dns_tkey_processgssresponse dns_tkey_processquery dns_tkeyctx_create dns_tkeyctx_destroy +dns_trust_totext dns_tsig_sign dns_tsig_verify dns_tsigkey_attach @@ -1,4 +1,4 @@ -# $Id: version,v 1.53.8.2.2.1 2011-04-27 17:06:27 each Exp $ +# $Id: version,v 1.53.8.2.2.2 2011-05-27 00:57:29 each Exp $ # # This file must follow /bin/sh rules. It is imported directly via # configure. @@ -7,4 +7,4 @@ MAJORVER=9 MINORVER=8 PATCHVER=0 RELEASETYPE=-P -RELEASEVER=1 +RELEASEVER=2 |