mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

Add stripped DS RRSIG senario

Browse Source 
(cherry picked from commit 66f293a952)
This commit is contained in:
Mark Andrews
2024-12-23 11:12:56 +11:00
committed by Evan Hunt
parent 1b814f1ee9
commit 39bfa739fb
8 changed files with 124 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bin/tests/system/dnssec/ns1/root.db.in
View File

@@ -39,3 +39,5 @@ too-many-iterations. NS ns2.too-many-iterations.
ns2.too-many-iterations. A 10.53.0.2
dnskey-rrsigs-stripped. NS ns2.dnskey-rrsigs-stripped.
ns2.dnskey-rrsigs-stripped. A 10.53.0.2
ds-rrsigs-stripped. NS ns2.ds-rrsigs-stripped.
ns2.ds-rrsigs-stripped. A 10.53.0.2

1
bin/tests/system/dnssec/ns1/sign.sh
View File

@@ -31,6 +31,7 @@ cp "../ns2/dsset-in-addr.arpa." .
cp "../ns2/dsset-too-many-iterations." .
cp "../ns2/dsset-lazy-ksk." .
cp "../ns2/dsset-dnskey-rrsigs-stripped." .
cp "../ns2/dsset-ds-rrsigs-stripped." .
grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll." >"dsset-algroll."
cp "../ns6/dsset-optout-tld." .

27
bin/tests/system/dnssec/ns2/child.ds-rrsigs-stripped.db.in Normal file
View File

@@ -0,0 +1,27 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; SPDX-License-Identifier: MPL-2.0
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
$TTL 300 ; 5 minutes
@ IN SOA mname1. . (
2000042407 ; serial
20 ; refresh (20 seconds)
20 ; retry (20 seconds)
1814400 ; expire (3 weeks)
3600 ; minimum (1 hour)
)
NS ns2
NS ns3
ns2 A 10.53.0.2
ns3 A 10.53.0.3
a A 10.0.0.1
b A 10.0.0.2
d A 10.0.0.4

29
bin/tests/system/dnssec/ns2/ds-rrsigs-stripped.db.in Normal file
View File

@@ -0,0 +1,29 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; SPDX-License-Identifier: MPL-2.0
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
$TTL 300 ; 5 minutes
@ IN SOA mname1. . (
2000042407 ; serial
20 ; refresh (20 seconds)
20 ; retry (20 seconds)
1814400 ; expire (3 weeks)
3600 ; minimum (1 hour)
)
NS ns2
NS ns3
ns2 A 10.53.0.2
ns3 A 10.53.0.3
child NS ns2.child
ns2.child A 10.53.0.2
a A 10.0.0.1
b A 10.0.0.2
d A 10.0.0.4

10
bin/tests/system/dnssec/ns2/named.conf.in
View File

@@ -221,4 +221,14 @@ zone "dnskey-rrsigs-stripped" {
file "dnskey-rrsigs-stripped.db.signed";
};
zone "ds-rrsigs-stripped" {
type primary;
file "ds-rrsigs-stripped.db.signed";
};
zone "child.ds-rrsigs-stripped" {
type primary;
file "child.ds-rrsigs-stripped.db.signed";
};
include "trusted.conf";

28
bin/tests/system/dnssec/ns2/sign.sh
View File

@@ -386,3 +386,31 @@ cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
| awk '$4 == "SOA" { $7 = $7 + 1; print; next } { print }' >"$zonefile.next"
"$SIGNER" -g -o "$zone" -f "$zonefile.next" "$zonefile.next" >/dev/null 2>&1
cp "$zonefile.stripped" "$zonefile.signed"
#
# A child zone for the stripped DS RRSIGs test
#
zone=child.ds-rrsigs-stripped
infile=child.ds-rrsigs-stripped.db.in
zonefile=child.ds-rrsigs-stripped.db
ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
#
# A zone with the DNSKEY RRSIGS stripped
#
zone=ds-rrsigs-stripped
infile=ds-rrsigs-stripped.db.in
zonefile=ds-rrsigs-stripped.db
ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
cat "$infile" "$ksk.key" "$zsk.key" >"$zonefile"
"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1
"$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" \
| awk '$4 == "RRSIG" && $5 == "DS" { next } { print }' >"$zonefile.stripped"
"$CHECKZONE" -D -q -i local "$zone" "$zonefile.signed" \
| awk '$4 == "SOA" { $7 = $7 + 1; print; next } { print }' >"$zonefile.next"
"$SIGNER" -g -o "$zone" -f "$zonefile.next" "$zonefile.next" >/dev/null 2>&1
cp "$zonefile.stripped" "$zonefile.signed"

23
bin/tests/system/dnssec/tests.sh
View File

@@ -207,6 +207,29 @@ n=$((n + 1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status + ret))
echo_i "checking recovery from stripped DS RRSIG ($n)"
ret=0
# prime cache with DS without RRSIGs
dig_with_opts +noauth +cd child.ds-rrsigs-stripped. @10.53.0.4 ds >dig.out.prime.ns4.test$n || ret=1
grep ";; flags: qr rd ra cd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1" dig.out.prime.ns4.test$n >/dev/null || ret=1
grep "status: NOERROR" dig.out.prime.ns4.test$n >/dev/null || ret=1
grep "RRSIG.DS" dig.out.prime.ns4.test$n >/dev/null && ret=1
# reload server with properly signed zone
cp ns2/ds-rrsigs-stripped.db.next ns2/ds-rrsigs-stripped.db.signed
nextpart ns2/named.run >/dev/null
rndccmd 10.53.0.2 reload ds-rrsigs-stripped | sed 's/^/ns2 /' | cat_i
wait_for_log 5 "zone ds-rrsigs-stripped/IN: loaded serial 2000042408" ns2/named.run || ret=1
# make a query that flushes the unsigned DS RRset
dig_with_opts +noauth a.child.ds-rrsigs-stripped. @10.53.0.4 a >dig.out.ns4.test$n || ret=1
# make a second query that should now validate
dig_with_opts +noauth b.child.ds-rrsigs-stripped. @10.53.0.2 a >dig.out.ns2.test$n || ret=1
dig_with_opts +noauth b.child.ds-rrsigs-stripped. @10.53.0.4 a >dig.out.ns4.test$n || ret=1
digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
n=$((n + 1))
test "$ret" -eq 0 || echo_i "failed"
status=$((status + ret))
echo_i "checking that 'example/DS' from the referral was used in previous validation ($n)"
ret=0
grep "query 'example/DS/IN' approved" ns1/named.run >/dev/null && ret=1

4
bin/tests/system/dnssec/tests_sh_dnssec.py
View File

@@ -59,6 +59,10 @@ pytestmark = pytest.mark.extra_artifacts(
"ns2/dnskey-rrsigs-stripped.db",
"ns2/dnskey-rrsigs-stripped.db.next",
"ns2/dnskey-rrsigs-stripped.db.stripped",
"ns2/child.ds-rrsigs-stripped.db",
"ns2/ds-rrsigs-stripped.db",
"ns2/ds-rrsigs-stripped.db.next",
"ns2/ds-rrsigs-stripped.db.stripped",
"ns2/example.db",
"ns2/in-addr.arpa.db",
"ns2/lazy-ksk.db",