Skip to content

Commit f0c3881

Browse files
marka63marka63
committed
Merge branch '4027-nsec3-of-removed-empty-non-terminal-remains-in-chain-breaking-validation-tools' into 'main'
Resolve "NSEC3 of removed empty-non-terminal remains in chain, breaking validation tools" Closes #4027 See merge request isc-projects/bind9!7857
2 parents 2aff1d6 + 7dbb2b8 commit f0c3881

File tree

7 files changed

+91
-5
lines changed

7 files changed

+91
-5
lines changed

‎CHANGES‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
6157. [bug] When removing delegations in an OPTOUT range
2+
empty-non-terminal NSEC3 records generated by
3+
those delegations where not removed. [GL #4027]
4+
15
6156. [bug] Reimplement the maximum and idle timeouts for incoming
26
zone tranfers. [GL #4004]
37

‎bin/tests/system/autosign/clean.sh‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,14 +23,13 @@ rm -f active.key inact.key del.key delzsk.key unpub.key standby.key rev.key
2323
rm -f delayksk.key delayzsk.key autoksk.key autozsk.key
2424
rm -f dig.out.*
2525
rm -f digcomp.out.test*
26-
rm -f digcomp.out.test*
2726
rm -f noksk-ksk.key nozsk-ksk.key nozsk-zsk.key inaczsk-zsk.key inaczsk-ksk.key
2827
rm -f nopriv.key vanishing.key del1.key del2.key
2928
rm -f ns*/managed-keys.bind*
3029
rm -f ns*/named.lock
31-
rm -f ns*/named.lock
3230
rm -f ns1/root.db
3331
rm -f ns2/example.db
32+
rm -f ns2/optout-with-ent.db
3433
rm -f ns2/private.secure.example.db ns2/bar.db
3534
rm -f ns3/*.nzd ns3/*.nzd-lock ns3/*.nzf
3635
rm -f ns3/*.nzf

‎bin/tests/system/autosign/ns2/keygen.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,3 +54,11 @@ do
5454
done
5555
$KEYGEN -a ECDSAP256SHA256 -q $zone > /dev/null
5656
$DSFROMKEY Kbar.+013+60101.key > dsset-bar.
57+
58+
# a zone with empty non-terminals.
59+
zone=optout-with-ent
60+
zonefile=optout-with-ent.db
61+
infile=optout-with-ent.db.in
62+
cat $infile > $zonefile
63+
kskname=$($KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q -fk $zone)
64+
$KEYGEN -a ${DEFAULT_ALGORITHM} -3 -q $zone > /dev/null

‎bin/tests/system/autosign/ns2/named.conf.in‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,4 +97,13 @@ zone "child.optout.example" {
9797
auto-dnssec maintain;
9898
};
9999

100+
zone "optout-with-ent" {
101+
type primary;
102+
file "optout-with-ent.db";
103+
allow-query { any; };
104+
allow-transfer { any; };
105+
allow-update { any; };
106+
auto-dnssec maintain;
107+
};
108+
100109
include "trusted.conf";

‎bin/tests/system/autosign/ns2/optout-with-ent.db.in‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
2+
;
3+
; SPDX-License-Identifier: MPL-2.0
4+
;
5+
; This Source Code Form is subject to the terms of the Mozilla Public
6+
; License, v. 2.0. If a copy of the MPL was not distributed with this
7+
; file, you can obtain one at https://mozilla.org/MPL/2.0/.
8+
;
9+
; See the COPYRIGHT file distributed with this work for additional
10+
; information regarding copyright ownership.
11+
12+
$TTL 300 ; 5 minutes
13+
@ IN SOA ns2.example. . (
14+
2010042407 ; serial
15+
20 ; refresh (20 seconds)
16+
20 ; retry (20 seconds)
17+
1814400 ; expire (3 weeks)
18+
3600 ; minimum (1 hour)
19+
)
20+
NS ns2.example.
21+
sub1.ent NS .
22+
sub2.ent NS .

‎bin/tests/system/autosign/tests.sh‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ do
160160
$DIG $DIGOPTS $z @10.53.0.1 nsec > dig.out.ns1.test$n || ret=1
161161
grep "NS SOA" dig.out.ns1.test$n > /dev/null || ret=1
162162
done
163-
for z in bar. example. private.secure.example.
163+
for z in bar. example. private.secure.example. optout-with-ent.
164164
do
165165
$DIG $DIGOPTS $z @10.53.0.2 nsec > dig.out.ns2.test$n || ret=1
166166
grep "NS SOA" dig.out.ns2.test$n > /dev/null || ret=1
@@ -180,6 +180,9 @@ n=$((n + 1))
180180
if [ $ret != 0 ]; then echo_i "done"; fi
181181
status=$((status + ret))
182182

183+
echo_i "Convert optout-with-ent from nsec to nsec3"
184+
($RNDCCMD 10.53.0.2 signing -nsec3param 1 1 1 - optout-with-ent 2>&1 | sed 's/^/ns2 /' | cat_i) || ret=1
185+
183186
echo_i "Initial counts of RRSIG expiry fields values for auto signed zones"
184187
for z in .
185188
do
@@ -1566,5 +1569,45 @@ n=$((n + 1))
15661569
if [ $ret != 0 ]; then echo_i "failed"; fi
15671570
status=$((status + ret))
15681571

1572+
echo_i "check removal of ENT NSEC3 records when opt out delegations are removed ($n)"
1573+
ret=0
1574+
zone=optout-with-ent
1575+
hash=JTR8R6AVFULU0DQH9I6HNN2KUK5956EL
1576+
# check that NSEC3 for ENT is present
1577+
$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" > dig.out.pre.ns2.test$n
1578+
grep "status: NOERROR" dig.out.pre.ns2.test$n >/dev/null || ret=1
1579+
grep "ANSWER: 0, AUTHORITY: 4, " dig.out.pre.ns2.test$n > /dev/null || ret=1
1580+
grep "^${hash}.${zone}." dig.out.pre.ns2.test$n > /dev/null || ret=1
1581+
# remove first delegation of two delegations, NSEC3 for ENT should remain.
1582+
(
1583+
echo zone $zone
1584+
echo server 10.53.0.2 "$PORT"
1585+
echo update del sub1.ent.$zone NS
1586+
echo send
1587+
) | $NSUPDATE
1588+
# check that NSEC3 for ENT is still present
1589+
$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" > dig.out.pre.ns2.test$n
1590+
$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" > dig.out.mid.ns2.test$n
1591+
grep "status: NOERROR" dig.out.mid.ns2.test$n >/dev/null || ret=1
1592+
grep "ANSWER: 0, AUTHORITY: 4, " dig.out.mid.ns2.test$n > /dev/null || ret=1
1593+
grep "^${hash}.${zone}." dig.out.mid.ns2.test$n > /dev/null || ret=1
1594+
# remove second delegation of two delegations, NSEC3 for ENT should be deleted.
1595+
(
1596+
echo zone $zone
1597+
echo server 10.53.0.2 "$PORT"
1598+
echo update del sub2.ent.$zone NS
1599+
echo send
1600+
) | $NSUPDATE
1601+
# check that NSEC3 for ENT is gone present
1602+
$DIG $DIGOPTS @10.53.0.2 a "ent.${zone}" > dig.out.post.ns2.test$n
1603+
grep "status: NXDOMAIN" dig.out.post.ns2.test$n >/dev/null || ret=1
1604+
grep "ANSWER: 0, AUTHORITY: 4, " dig.out.post.ns2.test$n > /dev/null || ret=1
1605+
grep "^${hash}.${zone}." dig.out.post.ns2.test$n > /dev/null && ret=1
1606+
$DIG $DIGOPTS @10.53.0.2 axfr "${zone}" > dig.out.axfr.ns2.test$n
1607+
grep "^${hash}.${zone}." dig.out.axfr.ns2.test$n > /dev/null && ret=1
1608+
n=$((n+1))
1609+
if [ "$ret" -ne 0 ]; then echo_i "failed"; fi
1610+
status=$((status+ret))
1611+
15691612
echo_i "exit status: $status"
15701613
[ $status -eq 0 ] || exit 1

‎lib/dns/nsec3.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1440,7 +1440,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version,
14401440

14411441
result = dns_dbiterator_seek(dbit, hashname);
14421442
if (result == ISC_R_NOTFOUND || result == DNS_R_PARTIALMATCH) {
1443-
goto success;
1443+
goto cleanup_orphaned_ents;
14441444
}
14451445
if (result != ISC_R_SUCCESS) {
14461446
goto failure;
@@ -1452,7 +1452,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version,
14521452
(isc_stdtime_t)0, &rdataset, NULL);
14531453
dns_db_detachnode(db, &node);
14541454
if (result == ISC_R_NOTFOUND) {
1455-
goto success;
1455+
goto cleanup_orphaned_ents;
14561456
}
14571457
if (result != ISC_R_SUCCESS) {
14581458
goto failure;
@@ -1537,6 +1537,7 @@ dns_nsec3_delnsec3(dns_db_t *db, dns_dbversion_t *version,
15371537
/*
15381538
* Delete NSEC3 records for now non active nodes.
15391539
*/
1540+
cleanup_orphaned_ents:
15401541
dns_name_init(&empty, NULL);
15411542
dns_name_clone(name, &empty);
15421543
do {

0 commit comments

Comments
 (0)