ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

2940. [func] Check that named successfully skips NSEC3 records

Browse Source 
that fail to match the NSEC3PARAM record currently
                        in use. [RT# 21868]
This commit is contained in:
Mark Andrews
2010-08-13 07:21:39 +00:00
parent 467bf79aa6
commit 3a3a245419
8 changed files with 75 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@@ -1,3 +1,7 @@
2940. [func] Check that named successfully skips NSEC3 records
that fail to match the NSEC3PARAM record currently
in use. [RT# 21868]
2937. [bug] Worked around an apparent race condition in over
memory conditions. Without this fix a DNS cache DB or
ADB could incorrectly stay in an over memory state,

3
bin/tests/system/dnssec/clean.sh
View File

@@ -15,7 +15,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
# $Id: clean.sh,v 1.23.48.3 2010/06/03 03:38:53 marka Exp $
# $Id: clean.sh,v 1.23.48.4 2010/08/13 07:21:39 marka Exp $
rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed */trusted.conf */tmp* */*.jnl */*.bk
rm -f ns1/root.db ns2/example.db ns3/secure.example.db
@@ -23,6 +23,7 @@ rm -f ns3/unsecure.example.db ns3/bogus.example.db ns3/keyless.example.db
rm -f ns3/dynamic.example.db ns3/dynamic.example.db.signed.jnl
rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
rm -f ns2/private.secure.example.db
rm -f ns2/badparam.db ns2/badparam.db.bad
rm -f */example.bk
rm -f dig.out.*
rm -f random.data

6
bin/tests/system/dnssec/dnssec_update_test.pl
View File

@@ -32,7 +32,7 @@
#
# perl -MCPAN -e "install Net::DNS"
#
# $Id: dnssec_update_test.pl,v 1.5 2007/06/19 23:47:02 tbox Exp $
# $Id: dnssec_update_test.pl,v 1.5.332.1 2010/08/13 07:21:39 marka Exp $
#
use Getopt::Std;
@@ -97,9 +97,9 @@ section("Delete the name");
test("NOERROR", ["update", rr_del("a.$zone")]);
if ($failures) {
print "I:$failures tests failed.\n";
print "I:$failures update tests failed.\n";
} else {
print "I:All tests successful.\n";
print "I:All update tests successful.\n";
}
exit $failures;

26
bin/tests/system/dnssec/ns2/badparam.db.in Normal file
View File

@@ -0,0 +1,26 @@
; Copyright (C) 2010 Internet Systems Consortium, Inc. ("ISC")
;
; Permission to use, copy, modify, and/or distribute this software for any
; purpose with or without fee is hereby granted, provided that the above
; copyright notice and this permission notice appear in all copies.
;
; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
; PERFORMANCE OF THIS SOFTWARE.
; $Id: badparam.db.in,v 1.2.4.2 2010/08/13 07:21:39 marka Exp $
$TTL 300 ; 5 minutes
@ IN SOA mname1. . (
2010081000 ; serial
20 ; refresh (20 seconds)
20 ; retry (20 seconds)
1814400 ; expire (3 weeks)
3600 ; minimum (1 hour)
)
NS ns2
ns2 A 10.53.0.2

8
bin/tests/system/dnssec/ns2/named.conf
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: named.conf,v 1.30 2008/09/25 04:02:38 tbox Exp $ */
/* $Id: named.conf,v 1.30.48.1 2010/08/13 07:21:39 marka Exp $ */
// NS2
@@ -80,4 +80,10 @@ zone "child.optout.example" {
allow-update { none; };
};
zone "badparam" {
type master;
file "badparam.db.bad";
};
include "trusted.conf";

18
bin/tests/system/dnssec/ns2/sign.sh
View File

@@ -15,7 +15,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
# $Id: sign.sh,v 1.30.48.8 2010/01/15 23:47:33 tbox Exp $
# $Id: sign.sh,v 1.30.48.9 2010/08/13 07:21:39 marka Exp $
SYSTEMTESTTOP=../..
. $SYSTEMTESTTOP/conf.sh
@@ -114,3 +114,19 @@ dlvkeyname=`$KEYGEN -r $RANDFILE -a RSAMD5 -b 768 -n zone $dlvzone`
cat $dlvinfile $dlvkeyname.key dlvset-$privzone > $dlvzonefile
$SIGNER -P -g -r $RANDFILE -o $dlvzone $dlvzonefile > /dev/null
# Sign the badparam secure file
zone=badparam.
infile=badparam.db.in
zonefile=badparam.db
keyname1=`$KEYGEN -r $RANDFILE -a RSASHA256 -b 1024 -n zone -f KSK $zone`
keyname2=`$KEYGEN -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
cat $infile $keyname1.key $keyname2.key >$zonefile
$SIGNER -P -3 - -H 1 -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
sed 's/IN NSEC3 1 0 1 /IN NSEC3 1 0 10 /' $zonefile.signed > $zonefile.bad

13
bin/tests/system/dnssec/tests.sh
View File

@@ -15,7 +15,7 @@
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
# PERFORMANCE OF THIS SOFTWARE.
# $Id: tests.sh,v 1.53.48.11 2010/08/09 22:35:18 each Exp $
# $Id: tests.sh,v 1.53.48.12 2010/08/13 07:21:39 marka Exp $
SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh
@@ -952,6 +952,17 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
#
# RT21868 regression test.
#
echo "I:checking NSEC3 zone with mismatched NSEC3PARAM / NSEC parameters ($n)"
ret=0
$DIG $DIGOPTS non-exist.badparam. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
n=`expr $n + 1`
if [ $ret != 0 ]; then echo "I:failed"; fi
status=`expr $status + $ret`
# Run a minimal update test if possible. This is really just
# a regression test for RT #2399; more tests should be added.

5
lib/dns/rbtdb.c
View File

@@ -15,7 +15,7 @@
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: rbtdb.c,v 1.270.12.21 2010/08/11 23:04:20 jinmei Exp $ */
/* $Id: rbtdb.c,v 1.270.12.22 2010/08/13 07:21:38 marka Exp $ */
/*! \file */
@@ -3254,6 +3254,9 @@ matchparams(rdatasetheader_t *header, rbtdb_search_t *search)
return (ISC_FALSE);
}
/*
* Find node of the NSEC/NSEC3 record that is 'name'.
*/
static inline isc_result_t
find_closest_nsec(rbtdb_search_t *search, dns_dbnode_t **nodep,
dns_name_t *foundname, dns_rdataset_t *rdataset,