ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

check that DNSKEY and other occluded data are excluded from the delegating bitmap

Browse Source 
(cherry picked from commit 7e4b82103b)
This commit is contained in:
Mark Andrews
2018-12-12 12:21:50 +11:00
parent 587c81ac99
commit 637e3c4c4b
7 changed files with 149 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

180
bin/tests/system/dnssec/clean.sh
View File

@@ -9,90 +9,96 @@
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.
rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed
rm -f */example.bk
rm -f */named.conf
rm -f */named.memstats
rm -f */named.run
rm -f */named.secroots
rm -f */tmp* */*.jnl */*.bk */*.jbk
rm -f */trusted.conf */managed.conf */revoked.conf
rm -f Kexample.*
rm -f canonical?.*
rm -f delv.out*
rm -f delve.out*
rm -f dig.out.*
rm -f dsfromkey.out.*
rm -f keygen.err
rm -f named.secroots.test*
rm -f nosign.before
rm -f ns*/*.nta
rm -f ns*/managed-keys.bind* ns*/*.mkeys*
rm -f ns*/named.lock
rm -f ns1/managed.key.id
rm -f ns1/root.db ns2/example.db ns3/secure.example.db
rm -f ns2/algroll.db
rm -f ns2/badparam.db ns2/badparam.db.bad
rm -f ns2/cdnskey-update.secure.db
rm -f ns2/cdnskey.secure.db
rm -f ns2/cds-auto.secure.db ns2/cds-auto.secure.db.jnl
rm -f ns2/cds-update.secure.db ns2/cds-update.secure.db.jnl
rm -f ns2/cds.secure.db
rm -f ns2/dlv.db
rm -f ns2/in-addr.arpa.db
rm -f ns2/nsec3chain-test.db
rm -f ns2/private.secure.example.db
rm -f ns2/single-nsec3.db
rm -f ns3/auto-nsec.example.db ns3/auto-nsec3.example.db
rm -f ns3/badds.example.db
rm -f ns3/dname-at-apex-nsec3.example.db
rm -f ns3/dnskey-nsec3-unknown.example.db
rm -f ns3/dnskey-nsec3-unknown.example.db.tmp
rm -f ns3/dnskey-unknown.example.db
rm -f ns3/dnskey-unknown.example.db.tmp
rm -f ns3/dynamic.example.db ns3/dynamic.example.db.signed.jnl
rm -f ns3/expired.example.db ns3/update-nsec3.example.db
rm -f ns3/expiring.example.db ns3/nosign.example.db
rm -f ns3/future.example.db ns3/trusted-future.key
rm -f ns3/inline.example.db.signed
rm -f ns3/kskonly.example.db
rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower
rm -f ns3/multiple.example.db ns3/nsec3-unknown.example.db ns3/nsec3.example.db
rm -f ns3/nsec3.nsec3.example.db
rm -f ns3/nsec3.optout.example.db
rm -f ns3/optout-unknown.example.db ns3/optout.example.db
rm -f ns3/optout.nsec3.example.db
rm -f ns3/optout.optout.example.db
rm -f ns3/publish-inactive.example.db
rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
rm -f ns3/secure.below-cname.example.db
rm -f ns3/secure.nsec3.example.db
rm -f ns3/secure.optout.example.db
rm -f ns3/siginterval.conf
rm -f ns3/siginterval.example.db
rm -f ns3/split-dnssec.example.db
rm -f ns3/split-smart.example.db
rm -f ns3/ttlpatch.example.db ns3/ttlpatch.example.db.signed
rm -f ns3/ttlpatch.example.db.patched
rm -f ns3/unsecure.example.db ns3/bogus.example.db ns3/keyless.example.db
rm -f ns3/revkey.example.db
rm -f ns3/managed-future.example.db
rm -f ns4/managed-keys.bind*
rm -f ns4/named_dump.db
rm -f ns6/optout-tld.db
rm -f ns7/multiple.example.bk ns7/nsec3.example.bk ns7/optout.example.bk
rm -f ns7/split-rrsig.db ns7/split-rrsig.db.unsplit
rm -f nsupdate.out*
rm -f python.out.*
rm -f rndc.out.*
rm -f signer/*.db
rm -f signer/example.db.after signer/example.db.before
rm -f signer/example.db.changed
rm -f signer/general/dsset*
rm -f signer/general/signed.zone
rm -f signer/general/signer.out.*
rm -f signer/nsec3param.out
rm -f signer/signer.out.*
rm -f signing.out*
rm -f signer/*.signed.pre*
rm -f signer/*.signed.post*
set -e
rm -f ./*/K* ./*/keyset-* ./*/dsset-* ./*/dlvset-* ./*/signedkey-* ./*/*.signed
rm -f ./*/example.bk
rm -f ./*/named.conf
rm -f ./*/named.memstats
rm -f ./*/named.run
rm -f ./*/named.secroots
rm -f ./*/tmp* ./*/*.jnl ./*/*.bk ./*/*.jbk
rm -f ./*/trusted.conf ./*/managed.conf ./*/revoked.conf
rm -f ./Kexample.*
rm -f ./canonical?.*
rm -f ./delv.out*
rm -f ./delve.out*
rm -f ./dig.out.*
rm -f ./dsfromkey.out.*
rm -f ./keygen.err
rm -f ./named.secroots.test*
rm -f ./nosign.before
rm -f ./ns*/*.nta
rm -f ./ns*/managed-keys.bind* ./ns*/*.mkeys*
rm -f ./ns*/named.lock
rm -f ./ns1/managed.key.id
rm -f ./ns1/root.db ./ns2/example.db ./ns3/secure.example.db
rm -f ./ns2/algroll.db
rm -f ./ns2/badparam.db ./ns2/badparam.db.bad
rm -f ./ns2/cdnskey-kskonly.secure.db
rm -f ./ns2/cdnskey-update.secure.db
rm -f ./ns2/cdnskey-x.secure.db
rm -f ./ns2/cdnskey.secure.db
rm -f ./ns2/cds-auto.secure.db ./ns2/cds-auto.secure.db.jnl
rm -f ./ns2/cds-kskonly.secure.db
rm -f ./ns2/cds-update.secure.db ./ns2/cds-update.secure.db.jnl
rm -f ./ns2/cds.secure.db ./ns2/cds-x.secure.db
rm -f ./ns2/dlv.db
rm -f ./ns2/in-addr.arpa.db
rm -f ./ns2/nsec3chain-test.db
rm -f ./ns2/private.secure.example.db
rm -f ./ns2/single-nsec3.db
rm -f ./ns3/auto-nsec.example.db ./ns3/auto-nsec3.example.db
rm -f ./ns3/badds.example.db
rm -f ./ns3/dname-at-apex-nsec3.example.db
rm -f ./ns3/dnskey-nsec3-unknown.example.db
rm -f ./ns3/dnskey-nsec3-unknown.example.db.tmp
rm -f ./ns3/dnskey-unknown.example.db
rm -f ./ns3/dnskey-unknown.example.db.tmp
rm -f ./ns3/dynamic.example.db ./ns3/dynamic.example.db.signed.jnl
rm -f ./ns3/expired.example.db ./ns3/update-nsec3.example.db
rm -f ./ns3/expiring.example.db ./ns3/nosign.example.db
rm -f ./ns3/future.example.db ./ns3/trusted-future.key
rm -f ./ns3/inline.example.db.signed
rm -f ./ns3/kskonly.example.db
rm -f ./ns3/lower.example.db ./ns3/upper.example.db ./ns3/upper.example.db.lower
rm -f ./ns3/managed-future.example.db
rm -f ./ns3/multiple.example.db ./ns3/nsec3-unknown.example.db ./ns3/nsec3.example.db
rm -f ./ns3/nsec3.nsec3.example.db
rm -f ./ns3/nsec3.optout.example.db
rm -f ./ns3/occluded.example.db
rm -f ./ns3/optout-unknown.example.db ./ns3/optout.example.db
rm -f ./ns3/optout.nsec3.example.db
rm -f ./ns3/optout.optout.example.db
rm -f ./ns3/publish-inactive.example.db
rm -f ./ns3/revkey.example.db
rm -f ./ns3/rsasha256.example.db ./ns3/rsasha512.example.db
rm -f ./ns3/secure.below-cname.example.db
rm -f ./ns3/secure.nsec3.example.db
rm -f ./ns3/secure.optout.example.db
rm -f ./ns3/siginterval.conf
rm -f ./ns3/siginterval.example.db
rm -f ./ns3/split-dnssec.example.db
rm -f ./ns3/split-smart.example.db
rm -f ./ns3/ttlpatch.example.db ./ns3/ttlpatch.example.db.signed
rm -f ./ns3/ttlpatch.example.db.patched
rm -f ./ns3/unsecure.example.db ./ns3/bogus.example.db ./ns3/keyless.example.db
rm -f ./ns4/managed-keys.bind*
rm -f ./ns4/named_dump.db
rm -f ./ns6/optout-tld.db
rm -f ./ns7/multiple.example.bk ./ns7/nsec3.example.bk ./ns7/optout.example.bk
rm -f ./ns7/split-rrsig.db ./ns7/split-rrsig.db.unsplit
rm -f ./nsupdate.out*
rm -f ./python.out.*
rm -f ./rndc.out.*
rm -f ./signer/*.db
rm -f ./signer/*.signed.post*
rm -f ./signer/*.signed.pre*
rm -f ./signer/example.db.after ./signer/example.db.before
rm -f ./signer/example.db.changed
rm -f ./signer/general/dsset*
rm -f ./signer/general/signed.zone
rm -f ./signer/general/signer.out.*
rm -f ./signer/nsec3param.out
rm -f ./signer/signer.out.*
rm -f ./signing.out*

2
bin/tests/system/dnssec/ns2/sign.sh
View File

@@ -25,7 +25,7 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
ttlpatch split-dnssec split-smart expired expiring upper lower \
dnskey-unknown dnskey-nsec3-unknown managed-future revkey \
dname-at-apex-nsec3
dname-at-apex-nsec3 occluded
do
cp ../ns3/dsset-$subdomain.example$TP .
done

5
bin/tests/system/dnssec/ns3/named.conf.in
View File

@@ -298,6 +298,11 @@ zone "dname-at-apex-nsec3.example" {
file "dname-at-apex-nsec3.example.db.signed";
};
zone "occluded.example" {
type master;
file "occluded.example.db.signed";
};
include "siginterval.conf";
include "trusted.conf";

24
bin/tests/system/dnssec/ns3/occluded.example.db.in Normal file
View File

@@ -0,0 +1,24 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, You can obtain one at http://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
$TTL 300 ; 5 minutes
@ IN SOA mname1. . (
2000042407 ; serial
20 ; refresh (20 seconds)
20 ; retry (20 seconds)
1814400 ; expire (3 weeks)
3600 ; minimum (1 hour)
)
NS ns
ns A 10.53.0.3
a.b A 10.0.0.1
delegation NS ns
A 10.53.0.3
AAAA 2002::

15
bin/tests/system/dnssec/ns3/sign.sh
View File

@@ -554,3 +554,18 @@ kskname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -3fk $zone`
zskname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -3 $zone`
cat $infile $kskname.key $zskname.key >$zonefile
$SIGNER -P -r $RANDFILE -3 - -o $zone $zonefile > /dev/null 2>&1
#
# A NSEC zone with occuded data at the delegation
#
zone=occluded.example
infile=occluded.example.db.in
zonefile=occluded.example.db
kskname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA256 -b 1024 -fk "$zone"`
zskname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA256 -b 1024 "$zone"`
keyname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA1 -b 1024 -n ENTITY -T KEY "delegation.$zone"`
dnskeyname=`"$KEYGEN" -q -r $RANDFILE -a RSASHA256 -b 1024 -fk "delegation.$zone"`
$DSFROMKEY "$dnskeyname.key" > "dsset-delegation.${zone}$TP"
cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \
"${dnskeyname}.key" "dsset-delegation.${zone}$TP" >"$zonefile"
"$SIGNER" -P -r $RANDFILE -o "$zone" "$zonefile" > /dev/null 2>&1

10
bin/tests/system/dnssec/tests.sh
View File

@@ -3521,5 +3521,15 @@ n=`expr $n + 1`
if [ $ret != 0 ]; then echo_i "failed"; fi
status=`expr $status + $ret`
echo_i "check that DNSKEY and other occluded data are excluded from the delegating bitmap ($n)"
ret=0
$DIG $DIGOPTS axfr occluded.example @10.53.0.3 > dig.out.ns3.test$n || ret=1
grep "^delegation.occluded.example..*NSEC.*NS KEY DS RRSIG NSEC$" dig.out.ns3.test$n > /dev/null || ret=1
grep "^delegation.occluded.example..*DNSKEY.*" dig.out.ns3.test$n > /dev/null || ret=1
grep "^delegation.occluded.example..*AAAA.*" dig.out.ns3.test$n > /dev/null || ret=1
n=`expr $n + 1`
test "$ret" -eq 0 || echo_i "failed"
status=`expr $status + $ret`
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1

1
util/copyrights
View File

@@ -1114,6 +1114,7 @@
./bin/tests/system/dnssec/ns3/nsec3.example.db.in ZONE 2006,2008,2016,2018
./bin/tests/system/dnssec/ns3/nsec3.nsec3.example.db.in ZONE 2008,2016,2018
./bin/tests/system/dnssec/ns3/nsec3.optout.example.db.in ZONE 2008,2016,2018
./bin/tests/system/dnssec/ns3/occluded.example.db.in ZONE 2018
./bin/tests/system/dnssec/ns3/optout-unknown.example.db.in ZONE 2006,2008,2016,2018
./bin/tests/system/dnssec/ns3/optout.example.db.in ZONE 2006,2008,2016,2018
./bin/tests/system/dnssec/ns3/optout.nsec3.example.db.in ZONE 2008,2016,2018