mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-29 13:38:26 +00:00
Code Issues Releases Wiki Activity

handle CDS deletion record in consistancy checks

Browse Source
This commit is contained in:
Mark Andrews 2020-01-13 15:08:17 +11:00
parent 77332eb2c8
commit 0adb4b25d3
2 changed files with 38 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
bin/tests/system/dnssec/tests.sh
View File

@ -3362,6 +3362,25 @@ n=$((n+1))
test "$ret" -eq 0 || echo_i "failed" test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret)) status=$((status+ret))
echo_i "check that CDS deletion records are signed only using KSK when added by"
echo_i " nsupdate when dnssec-dnskey-kskonly is yes ($n)"
ret=0
(
echo zone cds-kskonly.secure
echo server 10.53.0.2 "$PORT"
echo update delete cds-kskonly.secure CDS
echo update add cds-kskonly.secure 0 CDS 0 0 0 00
echo send
) | $NSUPDATE
dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n
lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l)
test "$lines" -eq 1 || ret=1
lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l)
test "$lines" -eq 1 || ret=1
n=$((n+1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status+ret))
echo_i "checking that positive unknown NSEC3 hash algorithm with OPTOUT does validate ($n)" echo_i "checking that positive unknown NSEC3 hash algorithm with OPTOUT does validate ($n)"
ret=0 ret=0
dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example SOA > dig.out.ns3.test$n dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example SOA > dig.out.ns3.test$n

21
lib/dns/zone.c
View File

@ -19177,9 +19177,11 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
/* /*
* For each DNSSEC algorithm in the CDS RRset there must be * For each DNSSEC algorithm in the CDS RRset there must be
* a matching DNSKEY record. * a matching DNSKEY record with the exception of a CDS deletion
* record which must be by itself.
*/ */
if (dns_rdataset_isassociated(&cds)) { if (dns_rdataset_isassociated(&cds)) {
bool delete = false;
memset(algorithms, 0, sizeof(algorithms)); memset(algorithms, 0, sizeof(algorithms));
for (result = dns_rdataset_first(&cds); for (result = dns_rdataset_first(&cds);
result == ISC_R_SUCCESS; result == ISC_R_SUCCESS;
@ -19188,6 +19190,16 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
dns_rdata_cds_t structcds; dns_rdata_cds_t structcds;
dns_rdataset_current(&cds, &crdata); dns_rdataset_current(&cds, &crdata);
/*
* CDS deletion record has this form "0 0 0 00" which
* is 5 zero octets.
*/
if (crdata.length == 5U &&
memcmp(crdata.data, "\0\0\0\0", 5) == 0)
{
delete = true;
continue;
}
CHECK(dns_rdata_tostruct(&crdata, &structcds, NULL)); CHECK(dns_rdata_tostruct(&crdata, &structcds, NULL));
if (algorithms[structcds.algorithm] == 0) if (algorithms[structcds.algorithm] == 0)
algorithms[structcds.algorithm] = 1; algorithms[structcds.algorithm] = 1;
@ -19211,7 +19223,12 @@ dns_zone_cdscheck(dns_zone_t *zone, dns_db_t *db, dns_dbversion_t *version) {
goto failure; goto failure;
} }
for (i = 0; i < sizeof(algorithms); i++) { for (i = 0; i < sizeof(algorithms); i++) {
if (algorithms[i] == 1) { if (delete) {
if (algorithms[i] != 0) {
result = DNS_R_BADCDNSKEY;
goto failure;
}
} else if (algorithms[i] == 1) {
result = DNS_R_BADCDNSKEY; result = DNS_R_BADCDNSKEY;
goto failure; goto failure;
} }