From 53d275bcf7543a5fb7f7aa7f45ea4e64b223cada Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Mon, 21 Mar 2011 01:08:12 +0000 Subject: [PATCH] 3083. [bug] NOTIFY messages were not being sent when generating a NSEC3 chain incrementally. [RT #23702] --- CHANGES | 3 +++ bin/tests/system/dnssec/ns2/named.conf | 9 +++++++- bin/tests/system/dnssec/ns2/sign.sh | 20 +++++++++++++++- bin/tests/system/dnssec/ns3/named.conf | 8 ++++++- bin/tests/system/dnssec/tests.sh | 32 +++++++++++++++++++++++++- lib/dns/zone.c | 3 ++- 6 files changed, 70 insertions(+), 5 deletions(-) diff --git a/CHANGES b/CHANGES index 5f3f8b1665..a192f7d951 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ +3083. [bug] NOTIFY messages were not being sent when generating + a NSEC3 chain incrementally. [RT #23702] + 3081. [bug] Failure of DNAME substitution did not return YXDOMAIN. [RT #23591] diff --git a/bin/tests/system/dnssec/ns2/named.conf b/bin/tests/system/dnssec/ns2/named.conf index 4fb6aff7bb..a8cb7b2610 100644 --- a/bin/tests/system/dnssec/ns2/named.conf +++ b/bin/tests/system/dnssec/ns2/named.conf @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.30.268.4 2010/11/16 01:21:49 marka Exp $ */ +/* $Id: named.conf,v 1.30.268.5 2011/03/21 01:08:12 marka Exp $ */ // NS2 @@ -33,6 +33,7 @@ options { notify yes; dnssec-enable yes; dnssec-validation yes; + notify-delay 1; }; zone "." { @@ -95,4 +96,10 @@ zone "algroll" { file "algroll.db.signed"; }; +zone "nsec3chain-test" { + type master; + file "nsec3chain-test.db.signed"; + allow-update {any;}; +}; + include "trusted.conf"; diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh index 7a989291d4..f7f08620ca 100644 --- a/bin/tests/system/dnssec/ns2/sign.sh +++ b/bin/tests/system/dnssec/ns2/sign.sh @@ -15,7 +15,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: sign.sh,v 1.35.32.11 2011/02/28 14:28:00 fdupont Exp $ +# $Id: sign.sh,v 1.35.32.12 2011/03/21 01:08:12 marka Exp $ SYSTEMTESTTOP=../.. . $SYSTEMTESTTOP/conf.sh @@ -161,3 +161,21 @@ keynew2=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone` cat $infile $keynew1.key $keynew2.key >$zonefile $SIGNER -P -r $RANDFILE -o $zone -k $keyold1 -k $keynew1 $zonefile $keyold1 $keyold2 $keynew1 $keynew2 > /dev/null + +# +# +# +zone=nsec3chain-test +zonefile=nsec3chain-test.db.signed + +cat > $zonefile << EOF +@ 10 SOA ns2 hostmaster 0 3600 1200 864000 1200 +@ 10 NS ns2 +@ 10 NS ns3 +ns2 10 A 10.53.0.2 +ns3 10 A 10.53.0.3 +EOF +awk 'END { for (i = 0; i < 1000; i++) + print "host" i, 10, "NS", "ns.elsewhere"; }' < /dev/null >> $zonefile +k=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone -fk $zone` +k=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone` diff --git a/bin/tests/system/dnssec/ns3/named.conf b/bin/tests/system/dnssec/ns3/named.conf index e7364fb30d..a7edb739fe 100644 --- a/bin/tests/system/dnssec/ns3/named.conf +++ b/bin/tests/system/dnssec/ns3/named.conf @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: named.conf,v 1.35.32.9 2011/02/28 14:28:00 fdupont Exp $ */ +/* $Id: named.conf,v 1.35.32.10 2011/03/21 01:08:12 marka Exp $ */ // NS3 @@ -207,4 +207,10 @@ zone "ttlpatch.example" { file "ttlpatch.example.db.patched"; }; +zone "nsec3chain-test" { + type slave; + file "nsec3chain-test.bk"; + masters { 10.53.0.2; }; +}; + include "trusted.conf"; diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index 993f391646..83bca76b98 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -15,7 +15,7 @@ # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR # PERFORMANCE OF THIS SOFTWARE. -# $Id: tests.sh,v 1.55.32.23 2011/03/01 16:47:13 smann Exp $ +# $Id: tests.sh,v 1.55.32.24 2011/03/21 01:08:11 marka Exp $ SYSTEMTESTTOP=.. . $SYSTEMTESTTOP/conf.sh @@ -1173,5 +1173,35 @@ n=`expr $n + 1` if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` +echo "I:check that NOTIFY is sent at the end of NSEC3 chain generation ($n)" +ret=0 +( +echo zone nsec3chain-test +echo server 10.53.0.2 5300 +grep DNSKEY ns2/Knsec3chain-test.*.key | +sed -e 's/.*://' -e 's/^/update add /' -e 's/IN/300 IN/' +echo update add nsec3chain-test. 0 nsec3param 1 0 1 - +echo send +) | $NSUPDATE +for i in 1 2 3 4 5 6 7 8 9 +do + $DIG $DIGOPTS nsec3param nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1 + if grep "ANSWER: 2," dig.out.ns2.test$n >/dev/null + then + break; + fi + echo "I:sleeping ...." + sleep 3 +done; +grep "ANSWER: 2," dig.out.ns2.test$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo "I:nsec3 chain generation not complete"; fi +sleep 3 +$DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1 +$DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1 +$PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n || ret=1 +n=`expr $n + 1` +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + echo "I:exit status: $status" exit $status diff --git a/lib/dns/zone.c b/lib/dns/zone.c index d9d9ec3cc6..2cc3fd90c7 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: zone.c,v 1.540.2.51 2011/03/17 05:30:21 marka Exp $ */ +/* $Id: zone.c,v 1.540.2.52 2011/03/21 01:08:12 marka Exp $ */ /*! \file */ @@ -6243,6 +6243,7 @@ zone_nsec3chain(dns_zone_t *zone) { LOCK_ZONE(zone); zone_needdump(zone, DNS_DUMP_DELAY); + DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY); UNLOCK_ZONE(zone); done: