mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-01 15:05:23 +00:00
Code Issues Releases Wiki Activity

Merge branch '4363-lower-max-nsec3-iterations' into 'main'

Browse Source 
Lower NSEC3 iteration limit to 50

Closes #4363

See merge request isc-projects/bind9!8515
This commit is contained in:
Matthijs Mekking
2023-12-05 14:59:48 +00:00
parent 336d99f121 a759f7f33c
commit e67bbe5c9a
19 changed files with 90 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGES
View File

@@ -1,3 +1,9 @@
6292. [func] Lower the maximum number of allowed NSEC3 iterations,
from 150 to 50. DNSSEC responses with a higher
iteration count are treated as insecure. For signing
with dnssec-policy, iterations must be set to zero.
[GL #4363]
6291. [bug] SIGTERM failed to properly stop multiple outstanding 6291. [bug] SIGTERM failed to properly stop multiple outstanding
lookup in dig. [GL #4457] lookup in dig. [GL #4457]

2
bin/dnssec/dnssec-signzone.c
View File

@@ -3494,7 +3494,7 @@ main(int argc, char *argv[]) {
set_iter = true; set_iter = true;
/* too-many is NOT DOCUMENTED */ /* too-many is NOT DOCUMENTED */
if (strcmp(isc_commandline_argument, "too-many") == 0) { if (strcmp(isc_commandline_argument, "too-many") == 0) {
nsec3iter = 151; nsec3iter = 51;
no_max_check = true; no_max_check = true;
break; break;
} }

2
bin/tests/system/autosign/ns2/named.conf.in
View File

@@ -67,7 +67,7 @@ dnssec-policy "optout" {
zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@; zsk key-directory lifetime unlimited algorithm @DEFAULT_ALGORITHM@;
}; };
nsec3param iterations 1 optout yes salt-length 0; nsec3param iterations 0 optout yes salt-length 0;
}; };
zone "." { zone "." {

4
bin/tests/system/autosign/tests.sh
View File

@@ -1269,9 +1269,9 @@ n=$((n + 1))
if [ $ret != 0 ]; then echo_i "failed"; fi if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status + ret)) status=$((status + ret))
echo_i "check removal of ENT NSEC3 records when opt out delegations are removed" echo_i "check removal of ENT NSEC3 records when opt out delegations are removed ($n)"
zone=optout-with-ent zone=optout-with-ent
hash=JTR8R6AVFULU0DQH9I6HNN2KUK5956EL hash=JE76PJ65FUO86UIR594L8P0SNJJ6RMNI
# check that NSEC3 for ENT is present # check that NSEC3 for ENT is present
echo_i "check ENT NSEC3 is initially present" echo_i "check ENT NSEC3 is initially present"

2
bin/tests/system/checkconf/good-kasp.conf
View File

@@ -29,7 +29,7 @@ dnssec-policy "test" {
csk key-directory lifetime unlimited algorithm rsasha256 2048; csk key-directory lifetime unlimited algorithm rsasha256 2048;
}; };
max-zone-ttl 86400; max-zone-ttl 86400;
nsec3param iterations 5 optout no salt-length 8; nsec3param iterations 0 optout no salt-length 8;
parent-ds-ttl 7200; parent-ds-ttl 7200;
parent-propagation-delay PT1H; parent-propagation-delay PT1H;
publish-safety PT3600S; publish-safety PT3600S;

6
bin/tests/system/checkconf/good-key-directory.conf
View File

@@ -17,7 +17,7 @@ dnssec-policy "internet" {
zsk key-directory lifetime P90D algorithm ecdsa256; zsk key-directory lifetime P90D algorithm ecdsa256;
}; };
nsec3param iterations 15 optout no salt-length 8; nsec3param iterations 0 optout no salt-length 8;
}; };
dnssec-policy "intranet" { dnssec-policy "intranet" {
@@ -25,7 +25,7 @@ dnssec-policy "intranet" {
ksk key-directory lifetime unlimited algorithm ecdsa256; ksk key-directory lifetime unlimited algorithm ecdsa256;
zsk key-directory lifetime P30D algorithm ecdsa256; zsk key-directory lifetime P30D algorithm ecdsa256;
}; };
nsec3param iterations 15 optout no salt-length 8; nsec3param iterations 0 optout no salt-length 8;
}; };
dnssec-policy "localhost" { dnssec-policy "localhost" {
@@ -33,7 +33,7 @@ dnssec-policy "localhost" {
ksk key-directory lifetime unlimited algorithm ecdsa256; ksk key-directory lifetime unlimited algorithm ecdsa256;
zsk key-directory lifetime P30D algorithm ecdsa256; zsk key-directory lifetime P30D algorithm ecdsa256;
}; };
nsec3param iterations 15 optout no salt-length 8; nsec3param iterations 0 optout no salt-length 8;
}; };
options { options {

8
bin/tests/system/checkconf/kasp-bad-nsec3-iter-fips.conf
View File

@@ -15,28 +15,28 @@ dnssec-policy "rsasha256" {
keys { keys {
csk lifetime P10Y algorithm rsasha256 2048; csk lifetime P10Y algorithm rsasha256 2048;
}; };
nsec3param iterations 150; nsec3param iterations 0;
}; };
dnssec-policy "rsasha256-bad" { dnssec-policy "rsasha256-bad" {
keys { keys {
csk lifetime P10Y algorithm rsasha256 2048; csk lifetime P10Y algorithm rsasha256 2048;
}; };
nsec3param iterations 151; nsec3param iterations 1;
}; };
dnssec-policy "rsasha512" { dnssec-policy "rsasha512" {
keys { keys {
csk lifetime P10Y algorithm rsasha512 4096; csk lifetime P10Y algorithm rsasha512 4096;
}; };
nsec3param iterations 150; nsec3param iterations 0;
}; };
dnssec-policy "rsasha512-bad" { dnssec-policy "rsasha512-bad" {
keys { keys {
csk lifetime P10Y algorithm rsasha512 4096; csk lifetime P10Y algorithm rsasha512 4096;
}; };
nsec3param iterations 151; nsec3param iterations 1;
}; };
zone "example.net" { zone "example.net" {

12
bin/tests/system/checkconf/kasp-bad-nsec3-iter.conf
View File

@@ -15,42 +15,42 @@ dnssec-policy "rsasha1" {
keys { keys {
csk lifetime P10Y algorithm nsec3rsasha1 1024; csk lifetime P10Y algorithm nsec3rsasha1 1024;
}; };
nsec3param iterations 150; nsec3param iterations 0;
}; };
dnssec-policy "rsasha1-bad" { dnssec-policy "rsasha1-bad" {
keys { keys {
csk lifetime P10Y algorithm nsec3rsasha1 1024; csk lifetime P10Y algorithm nsec3rsasha1 1024;
}; };
nsec3param iterations 151; nsec3param iterations 1;
}; };
dnssec-policy "rsasha256" { dnssec-policy "rsasha256" {
keys { keys {
csk lifetime P10Y algorithm rsasha256 2048; csk lifetime P10Y algorithm rsasha256 2048;
}; };
nsec3param iterations 150; nsec3param iterations 0;
}; };
dnssec-policy "rsasha256-bad" { dnssec-policy "rsasha256-bad" {
keys { keys {
csk lifetime P10Y algorithm rsasha256 2048; csk lifetime P10Y algorithm rsasha256 2048;
}; };
nsec3param iterations 151; nsec3param iterations 1;
}; };
dnssec-policy "rsasha512" { dnssec-policy "rsasha512" {
keys { keys {
csk lifetime P10Y algorithm rsasha512 4096; csk lifetime P10Y algorithm rsasha512 4096;
}; };
nsec3param iterations 150; nsec3param iterations 0;
}; };
dnssec-policy "rsasha512-bad" { dnssec-policy "rsasha512-bad" {
keys { keys {
csk lifetime P10Y algorithm rsasha512 4096; csk lifetime P10Y algorithm rsasha512 4096;
}; };
nsec3param iterations 151; nsec3param iterations 1;
}; };
zone "example.net" { zone "example.net" {

2
bin/tests/system/checkconf/tests.sh
View File

@@ -620,7 +620,7 @@ else
expect=3 expect=3
fi fi
$CHECKCONF $conf >checkconf.out$n 2>&1 && ret=1 $CHECKCONF $conf >checkconf.out$n 2>&1 && ret=1
grep "dnssec-policy: nsec3 iterations value 151 out of range" <checkconf.out$n >/dev/null || ret=1 grep "dnssec-policy: nsec3 iterations value 1 not allowed, must be zero" <checkconf.out$n >/dev/null || ret=1
lines=$(wc -l <"checkconf.out$n") lines=$(wc -l <"checkconf.out$n")
if [ $lines -ne $expect ]; then ret=1; fi if [ $lines -ne $expect ]; then ret=1; fi
if [ $ret -ne 0 ]; then echo_i "failed"; fi if [ $ret -ne 0 ]; then echo_i "failed"; fi

8
bin/tests/system/dnssec/tests.sh
View File

@@ -1467,7 +1467,7 @@ ret=0
( (
cd signer/general || exit 0 cd signer/general || exit 0
rm -f signed.zone rm -f signed.zone
$SIGNER -f signed.zone -3 - -H 151 -o example.com. test9.zone >signer.out.$n $SIGNER -f signed.zone -3 - -H 51 -o example.com. test9.zone >signer.out.$n
test -f signed.zone test -f signed.zone
) && ret=1 ) && ret=1
n=$((n + 1)) n=$((n + 1))
@@ -1492,7 +1492,7 @@ ret=0
( (
cd signer/general || exit 1 cd signer/general || exit 1
rm -f signed.zone rm -f signed.zone
$SIGNER -f signed.zone -3 - -H 150 -o example.com. test9.zone >signer.out.$n $SIGNER -f signed.zone -3 - -H 50 -o example.com. test9.zone >signer.out.$n
test -f signed.zone test -f signed.zone
) || ret=1 ) || ret=1
n=$((n + 1)) n=$((n + 1))
@@ -4317,8 +4317,8 @@ status=$((status + ret))
echo_i "checking excessive NSEC3 iteration warnings in named.run ($n)" echo_i "checking excessive NSEC3 iteration warnings in named.run ($n)"
ret=0 ret=0
grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 150" ns2/named.run >/dev/null 2>&1 || ret=1 grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 50" ns2/named.run >/dev/null 2>&1 || ret=1
grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 150" ns3/named.run >/dev/null 2>&1 || ret=1 grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 50" ns3/named.run >/dev/null 2>&1 || ret=1
n=$((n + 1)) n=$((n + 1))
test "$ret" -eq 0 || echo_i "failed" test "$ret" -eq 0 || echo_i "failed"
status=$((status + ret)) status=$((status + ret))

2
bin/tests/system/nsec3/ns3/named-fips.conf.in
View File

@@ -27,7 +27,7 @@ dnssec-policy "optout" {
}; };
dnssec-policy "nsec3-other" { dnssec-policy "nsec3-other" {
nsec3param iterations 11 optout yes salt-length 8; nsec3param iterations 0 optout yes salt-length 8;
}; };
options { options {

2
bin/tests/system/nsec3/ns3/named2-fips.conf.in
View File

@@ -27,7 +27,7 @@ dnssec-policy "optout" {
}; };
dnssec-policy "nsec3-other" { dnssec-policy "nsec3-other" {
nsec3param iterations 11 optout yes salt-length 0; nsec3param iterations 0 optout yes salt-length 8;
}; };
options { options {

81
bin/tests/system/nsec3/tests.sh
View File

@@ -46,12 +46,10 @@ set_zone_policy() {
CDS_SHA256="yes" CDS_SHA256="yes"
CDS_SHA384="no" CDS_SHA384="no"
} }
# Set expected NSEC3 parameters: flags ($1), iterations ($2), and # Set expected NSEC3 parameters: flags ($1) and salt length ($2).
# salt length ($3).
set_nsec3param() { set_nsec3param() {
FLAGS=$1 FLAGS=$1
ITERATIONS=$2 SALTLEN=$2
SALTLEN=$3
# Reset salt. # Reset salt.
SALT="" SALT=""
} }
@@ -102,7 +100,7 @@ set_key_states() {
# The apex NSEC3PARAM record indicates that it is signed. # The apex NSEC3PARAM record indicates that it is signed.
_wait_for_nsec3param() { _wait_for_nsec3param() {
dig_with_opts +noquestion "@${SERVER}" "$ZONE" NSEC3PARAM >"dig.out.test$n.wait" || return 1 dig_with_opts +noquestion "@${SERVER}" "$ZONE" NSEC3PARAM >"dig.out.test$n.wait" || return 1
grep "${ZONE}\..*IN.*NSEC3PARAM.*1.*0.*${ITERATIONS}.*${SALT}" "dig.out.test$n.wait" >/dev/null || return 1 grep "${ZONE}\..*IN.*NSEC3PARAM 1 0 0.*${SALT}" "dig.out.test$n.wait" >/dev/null || return 1
grep "${ZONE}\..*IN.*RRSIG" "dig.out.test$n.wait" >/dev/null || return 1 grep "${ZONE}\..*IN.*RRSIG" "dig.out.test$n.wait" >/dev/null || return 1
return 0 return 0
} }
@@ -188,7 +186,7 @@ check_nsec() {
# Test: check NSEC3 parameters in answers # Test: check NSEC3 parameters in answers
_check_nsec3_nsec3param() { _check_nsec3_nsec3param() {
dig_with_opts +noquestion @$SERVER "${ZONE}" NSEC3PARAM >"dig.out.test$n.nsec3param.$ZONE" || return 1 dig_with_opts +noquestion @$SERVER "${ZONE}" NSEC3PARAM >"dig.out.test$n.nsec3param.$ZONE" || return 1
grep "${ZONE}.*0.*IN.*NSEC3PARAM.*1.*0.*${ITERATIONS}.*${SALT}" "dig.out.test$n.nsec3param.$ZONE" >/dev/null || return 1 grep "${ZONE}.*0.*IN.*NSEC3PARAM.*1.*0.*0.*${SALT}" "dig.out.test$n.nsec3param.$ZONE" >/dev/null || return 1
if [ -z "$SALT" ]; then if [ -z "$SALT" ]; then
SALT=$(awk '$4 == "NSEC3PARAM" { print $8 }' dig.out.test$n.nsec3param.$ZONE) SALT=$(awk '$4 == "NSEC3PARAM" { print $8 }' dig.out.test$n.nsec3param.$ZONE)
@@ -198,7 +196,7 @@ _check_nsec3_nsec3param() {
_check_nsec3_nxdomain() { _check_nsec3_nxdomain() {
dig_with_opts @$SERVER "nosuchname.${ZONE}" >"dig.out.test$n.nxdomain.$ZONE" || return 1 dig_with_opts @$SERVER "nosuchname.${ZONE}" >"dig.out.test$n.nxdomain.$ZONE" || return 1
grep ".*\.${ZONE}.*IN.*NSEC3.*1.${FLAGS}.*${ITERATIONS}.*${SALT}" "dig.out.test$n.nxdomain.$ZONE" >/dev/null || return 1 grep ".*\.${ZONE}.*IN.*NSEC3.*1.${FLAGS}.*0.*${SALT}" "dig.out.test$n.nxdomain.$ZONE" >/dev/null || return 1
return 0 return 0
} }
@@ -206,14 +204,14 @@ check_nsec3() {
wait_for_zone_is_signed "nsec3" wait_for_zone_is_signed "nsec3"
n=$((n + 1)) n=$((n + 1))
echo_i "check that NSEC3PARAM 1 0 ${ITERATIONS} is published zone ${ZONE} ($n)" echo_i "check that NSEC3PARAM 1 0 0 ${SALT} is published zone ${ZONE} ($n)"
ret=0 ret=0
retry_quiet 10 _check_nsec3_nsec3param || log_error "bad NSEC3PARAM response for ${ZONE}" retry_quiet 10 _check_nsec3_nsec3param || log_error "bad NSEC3PARAM response for ${ZONE}"
test "$ret" -eq 0 || echo_i "failed" test "$ret" -eq 0 || echo_i "failed"
status=$((status + ret)) status=$((status + ret))
n=$((n + 1)) n=$((n + 1))
echo_i "check NXDOMAIN response has correct NSEC3 1 ${FLAGS} ${ITERATIONS} ${SALT} for zone ${ZONE} ($n)" echo_i "check NXDOMAIN response has correct NSEC3 1 ${FLAGS} 0 ${SALT} for zone ${ZONE} ($n)"
ret=0 ret=0
retry_quiet 10 _check_nsec3_nxdomain || log_error "bad NXDOMAIN response for zone ${ZONE}" retry_quiet 10 _check_nsec3_nxdomain || log_error "bad NXDOMAIN response for zone ${ZONE}"
test "$ret" -eq 0 || echo_i "failed" test "$ret" -eq 0 || echo_i "failed"
@@ -277,21 +275,21 @@ fi
# Zone: nsec3.kasp. # Zone: nsec3.kasp.
set_zone_policy "nsec3.kasp" "nsec3" 1 3600 set_zone_policy "nsec3.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
# Zone: nsec3-dynamic.kasp. # Zone: nsec3-dynamic.kasp.
set_zone_policy "nsec3-dynamic.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-dynamic.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
# Zone: nsec3-change.kasp. # Zone: nsec3-change.kasp.
set_zone_policy "nsec3-change.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-change.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
@@ -316,49 +314,49 @@ retry_quiet 10 _wait_for_new_soa || log_error "failed to update SOA record in zo
# Zone: nsec3-dynamic-change.kasp. # Zone: nsec3-dynamic-change.kasp.
set_zone_policy "nsec3-dynamic-change.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-dynamic-change.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
# Zone: nsec3-dynamic-to-inline.kasp. # Zone: nsec3-dynamic-to-inline.kasp.
set_zone_policy "nsec3-dynamic-to-inline.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-dynamic-to-inline.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
# Zone: nsec3-inline-to-dynamic.kasp. # Zone: nsec3-inline-to-dynamic.kasp.
set_zone_policy "nsec3-inline-to-dynamic.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-inline-to-dynamic.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
# Zone: nsec3-to-nsec.kasp. # Zone: nsec3-to-nsec.kasp.
set_zone_policy "nsec3-to-nsec.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-to-nsec.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
# Zone: nsec3-to-optout.kasp. # Zone: nsec3-to-optout.kasp.
set_zone_policy "nsec3-to-optout.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-to-optout.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
# Zone: nsec3-from-optout.kasp. # Zone: nsec3-from-optout.kasp.
set_zone_policy "nsec3-from-optout.kasp" "optout" 1 3600 set_zone_policy "nsec3-from-optout.kasp" "optout" 1 3600
set_nsec3param "1" "0" "0" set_nsec3param "1" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
# Zone: nsec3-other.kasp. # Zone: nsec3-other.kasp.
set_zone_policy "nsec3-other.kasp" "nsec3-other" 1 3600 set_zone_policy "nsec3-other.kasp" "nsec3-other" 1 3600
set_nsec3param "1" "11" "8" set_nsec3param "1" "8"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
@@ -403,7 +401,7 @@ rndc_reconfig ns3 10.53.0.3
# Zone: nsec-to-nsec3.kasp. (reconfigured) # Zone: nsec-to-nsec3.kasp. (reconfigured)
set_zone_policy "nsec-to-nsec3.kasp" "nsec3" 1 3600 set_zone_policy "nsec-to-nsec3.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} after reconfig" echo_i "check zone ${ZONE} after reconfig"
check_nsec3 check_nsec3
@@ -431,7 +429,7 @@ if ($SHELL ../testcrypto.sh -q RSASHA1); then
# Zone: nsec3-to-rsasha1.kasp. # Zone: nsec3-to-rsasha1.kasp.
set_zone_policy "nsec3-to-rsasha1.kasp" "rsasha1" 2 3600 set_zone_policy "nsec3-to-rsasha1.kasp" "rsasha1" 2 3600
set_nsec3param "1" "0" "0" set_nsec3param "1" "0"
set_server "ns3" "10.53.0.3" set_server "ns3" "10.53.0.3"
set_key_default_values "KEY1" set_key_default_values "KEY1"
set_key_states "KEY1" "hidden" "unretentive" "unretentive" "unretentive" "hidden" set_key_states "KEY1" "hidden" "unretentive" "unretentive" "unretentive" "hidden"
@@ -443,7 +441,7 @@ if ($SHELL ../testcrypto.sh -q RSASHA1); then
# Zone: nsec3-to-rsasha1-ds.kasp. # Zone: nsec3-to-rsasha1-ds.kasp.
set_zone_policy "nsec3-to-rsasha1-ds.kasp" "rsasha1" 2 3600 set_zone_policy "nsec3-to-rsasha1-ds.kasp" "rsasha1" 2 3600
set_nsec3param "1" "0" "0" set_nsec3param "1" "0"
set_server "ns3" "10.53.0.3" set_server "ns3" "10.53.0.3"
set_key_default_values "KEY1" set_key_default_values "KEY1"
set_key_states "KEY1" "hidden" "omnipresent" "omnipresent" "omnipresent" "omnipresent" set_key_states "KEY1" "hidden" "omnipresent" "omnipresent" "omnipresent" "omnipresent"
@@ -457,21 +455,21 @@ fi
# Zone: nsec3.kasp. (same) # Zone: nsec3.kasp. (same)
set_zone_policy "nsec3.kasp" "nsec3" 1 3600 set_zone_policy "nsec3.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} after reconfig" echo_i "check zone ${ZONE} after reconfig"
check_nsec3 check_nsec3
# Zone: nsec3-dyamic.kasp. (same) # Zone: nsec3-dyamic.kasp. (same)
set_zone_policy "nsec3-dynamic.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-dynamic.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} after reconfig" echo_i "check zone ${ZONE} after reconfig"
check_nsec3 check_nsec3
# Zone: nsec3-change.kasp. (reconfigured) # Zone: nsec3-change.kasp. (reconfigured)
set_zone_policy "nsec3-change.kasp" "nsec3-other" 1 3600 set_zone_policy "nsec3-change.kasp" "nsec3-other" 1 3600
set_nsec3param "1" "11" "8" set_nsec3param "1" "8"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} after reconfig" echo_i "check zone ${ZONE} after reconfig"
check_nsec3 check_nsec3
@@ -486,30 +484,36 @@ grep "${ZONE}\..*900.*IN.*NSEC3PARAM" "dig.out.nsec3param.test$n" >/dev/null ||
test "$ret" -eq 0 || echo_i "failed" test "$ret" -eq 0 || echo_i "failed"
status=$((status + ret)) status=$((status + ret))
# Using rndc signing -nsec3param (should fail)
echo_i "use rndc signing -nsec3param ${ZONE} to change NSEC3 settings"
rndccmd $SERVER signing -nsec3param 1 1 12 ffff $ZONE >rndc.signing.test$n.$ZONE || log_error "failed to call rndc signing -nsec3param $ZONE"
grep "zone uses dnssec-policy, use rndc dnssec command instead" rndc.signing.test$n.$ZONE >/dev/null || log_error "rndc signing -nsec3param should fail"
check_nsec3
# Zone: nsec3-dynamic-change.kasp. (reconfigured) # Zone: nsec3-dynamic-change.kasp. (reconfigured)
set_zone_policy "nsec3-dynamic-change.kasp" "nsec3-other" 1 3600 set_zone_policy "nsec3-dynamic-change.kasp" "nsec3-other" 1 3600
set_nsec3param "1" "11" "8" set_nsec3param "1" "8"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} after reconfig" echo_i "check zone ${ZONE} after reconfig"
check_nsec3 check_nsec3
# Zone: nsec3-dynamic-to-inline.kasp. (same) # Zone: nsec3-dynamic-to-inline.kasp. (same)
set_zone_policy "nsec3-dynamic-to-inline.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-dynamic-to-inline.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} after reconfig" echo_i "check zone ${ZONE} after reconfig"
check_nsec3 check_nsec3
# Zone: nsec3-inline-to-dynamic.kasp. (same) # Zone: nsec3-inline-to-dynamic.kasp. (same)
set_zone_policy "nsec3-inline-to-dynamic.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-inline-to-dynamic.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "initial check zone ${ZONE}" echo_i "initial check zone ${ZONE}"
check_nsec3 check_nsec3
# Zone: nsec3-to-nsec.kasp. (reconfigured) # Zone: nsec3-to-nsec.kasp. (reconfigured)
set_zone_policy "nsec3-to-nsec.kasp" "nsec" 1 3600 set_zone_policy "nsec3-to-nsec.kasp" "nsec" 1 3600
set_nsec3param "1" "11" "8" set_nsec3param "1" "8"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} after reconfig" echo_i "check zone ${ZONE} after reconfig"
check_nsec check_nsec
@@ -519,7 +523,7 @@ check_nsec
# There is a bug in the nsec3param building code that thinks when the # There is a bug in the nsec3param building code that thinks when the
# optout bit is changed, the chain already exists. [GL #2216] # optout bit is changed, the chain already exists. [GL #2216]
#set_zone_policy "nsec3-to-optout.kasp" "optout" 1 3600 #set_zone_policy "nsec3-to-optout.kasp" "optout" 1 3600
#set_nsec3param "1" "0" "0" #set_nsec3param "1" "0"
#set_key_default_values "KEY1" #set_key_default_values "KEY1"
#echo_i "check zone ${ZONE} after reconfig" #echo_i "check zone ${ZONE} after reconfig"
#check_nsec3 #check_nsec3
@@ -529,28 +533,21 @@ check_nsec
# There is a bug in the nsec3param building code that thinks when the # There is a bug in the nsec3param building code that thinks when the
# optout bit is changed, the chain already exists. [GL #2216] # optout bit is changed, the chain already exists. [GL #2216]
#set_zone_policy "nsec3-from-optout.kasp" "nsec3" 1 3600 #set_zone_policy "nsec3-from-optout.kasp" "nsec3" 1 3600
#set_nsec3param "0" "0" "0" #set_nsec3param "0" "0"
#set_key_default_values "KEY1" #set_key_default_values "KEY1"
#echo_i "check zone ${ZONE} after reconfig" #echo_i "check zone ${ZONE} after reconfig"
#check_nsec3 #check_nsec3
# Zone: nsec3-other.kasp. (same) # Zone: nsec3-other.kasp. (same)
set_zone_policy "nsec3-other.kasp" "nsec3-other" 1 3600 set_zone_policy "nsec3-other.kasp" "nsec3-other" 1 3600
set_nsec3param "1" "11" "8" set_nsec3param "1" "8"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} after reconfig" echo_i "check zone ${ZONE} after reconfig"
check_nsec3 check_nsec3
# Using rndc signing -nsec3param (should fail)
set_zone_policy "nsec3-change.kasp" "nsec3-other" 1 3600
echo_i "use rndc signing -nsec3param ${ZONE} to change NSEC3 settings"
rndccmd $SERVER signing -nsec3param 1 1 12 ffff $ZONE >rndc.signing.test$n.$ZONE || log_error "failed to call rndc signing -nsec3param $ZONE"
grep "zone uses dnssec-policy, use rndc dnssec command instead" rndc.signing.test$n.$ZONE >/dev/null || log_error "rndc signing -nsec3param should fail"
check_nsec3
# Test NSEC3 and NSEC3PARAM is the same after restart # Test NSEC3 and NSEC3PARAM is the same after restart
set_zone_policy "nsec3.kasp" "nsec3" 1 3600 set_zone_policy "nsec3.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} before restart" echo_i "check zone ${ZONE} before restart"
check_nsec3 check_nsec3
@@ -570,7 +567,7 @@ status=$((status + ret))
prevsalt="${SALT}" prevsalt="${SALT}"
set_zone_policy "nsec3.kasp" "nsec3" 1 3600 set_zone_policy "nsec3.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
SALT="${prevsalt}" SALT="${prevsalt}"
echo_i "check zone ${ZONE} after restart has salt ${SALT}" echo_i "check zone ${ZONE} after restart has salt ${SALT}"
@@ -581,7 +578,7 @@ cp ns3/template.db.in ns3/nsec3-fails-to-load.kasp.db
rndc_reload ns3 10.53.0.3 rndc_reload ns3 10.53.0.3
set_zone_policy "nsec3-fails-to-load.kasp" "nsec3" 1 3600 set_zone_policy "nsec3-fails-to-load.kasp" "nsec3" 1 3600
set_nsec3param "0" "0" "0" set_nsec3param "0" "0"
set_key_default_values "KEY1" set_key_default_values "KEY1"
echo_i "check zone ${ZONE} after reload" echo_i "check zone ${ZONE} after reload"
check_nsec3 check_nsec3

6
bin/tests/system/nsupdate/tests.sh
View File

@@ -433,7 +433,7 @@ if $PERL -e 'use Net::DNS;' 2>/dev/null; then
n=$((n + 1)) n=$((n + 1))
ret=0 ret=0
echo_i "check for too many NSEC3 iterations log ($n)" echo_i "check for too many NSEC3 iterations log ($n)"
grep "updating zone 'update.nil/IN': too many NSEC3 iterations (151)" ns1/named.run >/dev/null || ret=1 grep "updating zone 'update.nil/IN': too many NSEC3 iterations (51)" ns1/named.run >/dev/null || ret=1
[ $ret -eq 1 ] && { [ $ret -eq 1 ] && {
echo_i "failed" echo_i "failed"
status=1 status=1
@@ -1899,9 +1899,9 @@ echo_i "check that excessive NSEC3PARAM iterations are rejected by nsupdate ($n)
$NSUPDATE -d <<END >nsupdate.out.test$n 2>&1 && ret=1 $NSUPDATE -d <<END >nsupdate.out.test$n 2>&1 && ret=1
server 10.53.0.3 ${PORT} server 10.53.0.3 ${PORT}
zone example zone example
update add example 0 in NSEC3PARAM 1 0 151 - update add example 0 in NSEC3PARAM 1 0 51 -
END END
grep "NSEC3PARAM has excessive iterations (> 150)" nsupdate.out.test$n >/dev/null || ret=1 grep "NSEC3PARAM has excessive iterations (> 50)" nsupdate.out.test$n >/dev/null || ret=1
[ $ret = 0 ] || { [ $ret = 0 ] || {
echo_i "failed" echo_i "failed"
status=1 status=1

4
bin/tests/system/nsupdate/update_test.pl
View File

@@ -417,8 +417,8 @@ if ($Net::DNS::VERSION < 1.01) {
print "skipped Excessive NSEC3PARAM iterations; Net::DNS too old.\n"; print "skipped Excessive NSEC3PARAM iterations; Net::DNS too old.\n";
} else { } else {
section("Excessive NSEC3PARAM iterations"); section("Excessive NSEC3PARAM iterations");
test("REFUSED", ["update", rr_add("$zone 300 NSEC3PARAM 1 0 151 -")]); test("REFUSED", ["update", rr_add("$zone 300 NSEC3PARAM 1 0 51 -")]);
test("NOERROR", ["update", rr_add("$zone 300 NSEC3PARAM 1 0 150 -")]); test("NOERROR", ["update", rr_add("$zone 300 NSEC3PARAM 1 0 50 -")]);
} }
if ($failures) { if ($failures) {

7
doc/notes/notes-current.rst
View File

@@ -33,7 +33,12 @@ Removed Features
Feature Changes Feature Changes
~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~
- None. - The maximum number of allowed NSEC3 iterations for validation has been
lowered from 150 to 50. DNSSEC responses containing NSEC3 records with
iteration counts greater than 50 are now treated as insecure. :gl:`#4363`
- The number of NSEC3 iterations that can be configured for a zone must be 0.
:gl:`#4363`
Bug Fixes Bug Fixes
~~~~~~~~~ ~~~~~~~~~

2
lib/dns/include/dns/nsec3.h
View File

@@ -26,7 +26,7 @@
#include <dns/types.h> #include <dns/types.h>
#define DNS_NSEC3_SALTSIZE 255 #define DNS_NSEC3_SALTSIZE 255
#define DNS_NSEC3_MAXITERATIONS 150U #define DNS_NSEC3_MAXITERATIONS 50U
/* /*
* hash = 1, flags =1, iterations = 2, salt length = 1, salt = 255 (max) * hash = 1, flags =1, iterations = 2, salt length = 1, salt = 255 (max)

9
lib/isccfg/kaspconf.c
View File

@@ -291,15 +291,12 @@ cfg_nsec3param_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp,
return (DNS_R_NSEC3BADALG); return (DNS_R_NSEC3BADALG);
} }
if (iter > dns_nsec3_maxiterations()) { if (iter != DEFAULT_NSEC3PARAM_ITER) {
ret = DNS_R_NSEC3ITERRANGE;
}
if (ret == DNS_R_NSEC3ITERRANGE) {
cfg_obj_log(obj, logctx, ISC_LOG_ERROR, cfg_obj_log(obj, logctx, ISC_LOG_ERROR,
"dnssec-policy: nsec3 iterations value %u " "dnssec-policy: nsec3 iterations value %u "
"out of range", "not allowed, must be zero",
iter); iter);
return (DNS_R_NSEC3ITERRANGE);
return (ret); return (ret);
} }

10
tests/dns/nsec3_test.c
View File

@@ -115,11 +115,11 @@ nsec3param_salttotext_test(const nsec3param_salttotext_test_params_t *params) {
ISC_RUN_TEST_IMPL(max_iterations) { ISC_RUN_TEST_IMPL(max_iterations) {
UNUSED(state); UNUSED(state);
iteration_test(TESTS_DIR "/testdata/nsec3/1024.db", 150); iteration_test(TESTS_DIR "/testdata/nsec3/1024.db", 50);
iteration_test(TESTS_DIR "/testdata/nsec3/2048.db", 150); iteration_test(TESTS_DIR "/testdata/nsec3/2048.db", 50);
iteration_test(TESTS_DIR "/testdata/nsec3/4096.db", 150); iteration_test(TESTS_DIR "/testdata/nsec3/4096.db", 50);
iteration_test(TESTS_DIR "/testdata/nsec3/min-1024.db", 150); iteration_test(TESTS_DIR "/testdata/nsec3/min-1024.db", 50);
iteration_test(TESTS_DIR "/testdata/nsec3/min-2048.db", 150); iteration_test(TESTS_DIR "/testdata/nsec3/min-2048.db", 50);
} }
/* check dns_nsec3param_salttotext() */ /* check dns_nsec3param_salttotext() */