From 0c0f10b53fb9071cca067c1d692bf3adb1792e50 Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Tue, 23 Feb 2021 15:35:47 +0100 Subject: [PATCH 1/3] Add tests for NSEC3 on dynamic zones GitLab issue #2498 is a bug report on NSEC3 with dynamic zones. Tests for it in the nsec3 system test directory were missing. --- bin/tests/system/nsec3/ns3/named.conf.in | 18 ++++++++++++++-- bin/tests/system/nsec3/ns3/named2.conf.in | 19 +++++++++++++++-- bin/tests/system/nsec3/ns3/setup.sh | 2 +- bin/tests/system/nsec3/tests.sh | 26 +++++++++++++++++++++++ 4 files changed, 60 insertions(+), 5 deletions(-) diff --git a/bin/tests/system/nsec3/ns3/named.conf.in b/bin/tests/system/nsec3/ns3/named.conf.in index e40fa4e656..791881225b 100644 --- a/bin/tests/system/nsec3/ns3/named.conf.in +++ b/bin/tests/system/nsec3/ns3/named.conf.in @@ -56,13 +56,20 @@ zone "nsec-to-nsec3.kasp" { dnssec-policy "nsec"; }; -/* This zone uses the default NSEC3 settings. */ +/* These zones use the default NSEC3 settings. */ zone "nsec3.kasp" { type primary; file "nsec3.kasp.db"; dnssec-policy "nsec3"; }; +zone "nsec3-dynamic.kasp" { + type primary; + file "nsec3-dynamic.kasp.db"; + dnssec-policy "nsec3"; + allow-update { any; }; +}; + /* This zone uses non-default NSEC3 settings. */ zone "nsec3-other.kasp" { type primary; @@ -70,13 +77,20 @@ zone "nsec3-other.kasp" { dnssec-policy "nsec3-other"; }; -/* The zone will be reconfigured to use other NSEC3 settings. */ +/* These zones will be reconfigured to use other NSEC3 settings. */ zone "nsec3-change.kasp" { type primary; file "nsec3-change.kasp.db"; dnssec-policy "nsec3"; }; +zone "nsec3-dynamic-change.kasp" { + type primary; + file "nsec3-dynamic-change.kasp.db"; + dnssec-policy "nsec3"; + allow-update { any; }; +}; + /* The zone will be reconfigured to use opt-out. */ zone "nsec3-to-optout.kasp" { type primary; diff --git a/bin/tests/system/nsec3/ns3/named2.conf.in b/bin/tests/system/nsec3/ns3/named2.conf.in index 327f549559..ece1549395 100644 --- a/bin/tests/system/nsec3/ns3/named2.conf.in +++ b/bin/tests/system/nsec3/ns3/named2.conf.in @@ -57,13 +57,20 @@ zone "nsec-to-nsec3.kasp" { dnssec-policy "nsec3"; }; -/* This zone uses the default NSEC3 settings. */ +/* These zones use the default NSEC3 settings. */ zone "nsec3.kasp" { type primary; file "nsec3.kasp.db"; dnssec-policy "nsec3"; }; +zone "nsec3-dynamic.kasp" { + type primary; + file "nsec3-dynamic.kasp.db"; + dnssec-policy "nsec3"; + allow-update { any; }; +}; + /* This zone uses non-default NSEC3 settings. */ zone "nsec3-other.kasp" { type primary; @@ -71,7 +78,7 @@ zone "nsec3-other.kasp" { dnssec-policy "nsec3-other"; }; -/* The zone will be reconfigured to use other NSEC3 settings. */ +/* These zone will be reconfigured to use other NSEC3 settings. */ zone "nsec3-change.kasp" { type primary; file "nsec3-change.kasp.db"; @@ -79,6 +86,14 @@ zone "nsec3-change.kasp" { dnssec-policy "nsec3-other"; }; +zone "nsec3-dynamic-change.kasp" { + type primary; + file "nsec3-dynamic-change.kasp.db"; + //dnssec-policy "nsec3"; + dnssec-policy "nsec3-other"; + allow-update { any; }; +}; + /* The zone will be reconfigured to use opt-out. */ zone "nsec3-to-optout.kasp" { type primary; diff --git a/bin/tests/system/nsec3/ns3/setup.sh b/bin/tests/system/nsec3/ns3/setup.sh index 950ca1ea1e..4b529d33d9 100644 --- a/bin/tests/system/nsec3/ns3/setup.sh +++ b/bin/tests/system/nsec3/ns3/setup.sh @@ -23,7 +23,7 @@ setup() { } for zn in nsec-to-nsec3 nsec3 nsec3-other nsec3-change nsec3-to-nsec \ - nsec3-to-optout nsec3-from-optout + nsec3-to-optout nsec3-from-optout nsec3-dynamic nsec3-dynamic-change do setup "${zn}.kasp" done diff --git a/bin/tests/system/nsec3/tests.sh b/bin/tests/system/nsec3/tests.sh index ee12115683..b9b8cff25c 100644 --- a/bin/tests/system/nsec3/tests.sh +++ b/bin/tests/system/nsec3/tests.sh @@ -175,12 +175,25 @@ echo_i "initial check zone ${ZONE}" check_nsec3 dnssec_verify +# Zone: nsec3-dynamic.kasp. +set_zone_policy "nsec3-dynamic.kasp" "nsec3" +set_nsec3param "0" "5" "8" +echo_i "initial check zone ${ZONE}" +check_nsec3 +dnssec_verify + # Zone: nsec3-change.kasp. set_zone_policy "nsec3-change.kasp" "nsec3" echo_i "initial check zone ${ZONE}" check_nsec3 dnssec_verify +# Zone: nsec3-dynamic-change.kasp. +set_zone_policy "nsec3-dynamic-change.kasp" "nsec3" +echo_i "initial check zone ${ZONE}" +check_nsec3 +dnssec_verify + # Zone: nsec3-to-nsec.kasp. set_zone_policy "nsec3-to-nsec.kasp" "nsec3" echo_i "initial check zone ${ZONE}" @@ -227,6 +240,12 @@ echo_i "check zone ${ZONE} after reconfig" check_nsec3 dnssec_verify +# Zone: nsec3-dyamic.kasp. (same) +set_zone_policy "nsec3-dynamic.kasp" "nsec3" +echo_i "check zone ${ZONE} after reconfig" +check_nsec3 +dnssec_verify + # Zone: nsec3-change.kasp. (reconfigured) set_zone_policy "nsec3-change.kasp" "nsec3-other" set_nsec3param "1" "11" "0" @@ -234,6 +253,13 @@ echo_i "check zone ${ZONE} after reconfig" check_nsec3 dnssec_verify +# Zone: nsec3-dynamic-change.kasp. (reconfigured) +set_zone_policy "nsec3-dynamic-change.kasp" "nsec3-other" +set_nsec3param "1" "11" "0" +echo_i "check zone ${ZONE} after reconfig" +check_nsec3 +dnssec_verify + # Zone: nsec3-to-nsec.kasp. (reconfigured) set_zone_policy "nsec3-to-nsec.kasp" "nsec" echo_i "check zone ${ZONE} after reconfig" From 4b176c850b943fb2f57a430480f155952360ec95 Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Wed, 24 Feb 2021 09:35:06 +0100 Subject: [PATCH 2/3] Fix dnssec-policy NSEC3 on dynamic zones When applying dnssec-policy on a dynamic zone (e.g. that allows Dynamic Updates), the NSEC3 parameters were put on the queue, but they were not being processed (until a reload of the zone or reconfiguration). Process the NSEC3PARAM queue on zone postload when handling a dynamic zone. --- lib/dns/zone.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/lib/dns/zone.c b/lib/dns/zone.c index 2fe91debe4..5b8b1f1ddc 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -4881,12 +4881,32 @@ zone_postload(dns_zone_t *zone, dns_db_t *db, isc_time_t loadtime, "could not find NS and/or SOA records"); } + /* + * Process any queued NSEC3PARAM change requests. Only for dynamic + * zones, an inline-signing zone will perform this action when + * receiving the secure db (receive_secure_db). + */ + is_dynamic = dns_zone_isdynamic(zone, true); + if (is_dynamic) { + isc_event_t *setnsec3param_event; + dns_zone_t *dummy; + + while (!ISC_LIST_EMPTY(zone->setnsec3param_queue)) { + setnsec3param_event = + ISC_LIST_HEAD(zone->setnsec3param_queue); + ISC_LIST_UNLINK(zone->setnsec3param_queue, + setnsec3param_event, ev_link); + dummy = NULL; + zone_iattach(zone, &dummy); + isc_task_send(zone->task, &setnsec3param_event); + } + } + /* * Check to make sure the journal is up to date, and remove the * journal file if it isn't, as we wouldn't be able to apply * updates otherwise. */ - is_dynamic = dns_zone_isdynamic(zone, true); if (zone->journal != NULL && is_dynamic && !DNS_ZONE_OPTION(zone, DNS_ZONEOPT_IXFRFROMDIFFS)) { From 89c47b3b42c30fecdc515bee1dfbd954f29aeec0 Mon Sep 17 00:00:00 2001 From: Matthijs Mekking Date: Wed, 24 Feb 2021 10:23:14 +0100 Subject: [PATCH 3/3] Add changes and notes for [#2498] --- CHANGES | 4 ++++ doc/notes/notes-current.rst | 3 +++ 2 files changed, 7 insertions(+) diff --git a/CHANGES b/CHANGES index d87e86a96d..c88380912f 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +5590. [bug] Process NSEC3PARAM queue when loading a dynamic zone. + This will immediately create NSEC3 records for zones + that use "dnssec-policy" and "nsec3param". [GL #2498] + 5589. [placeholder] 5588. [func] Add "purge-keys" option to "dnssec-policy". This sets diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst index c08c6f6954..54733d22c3 100644 --- a/doc/notes/notes-current.rst +++ b/doc/notes/notes-current.rst @@ -54,5 +54,8 @@ Bug Fixes UDP sockets that we enabled during the DNS Flag Day 2020 to fix this issue. [GL #2487] +- NSEC3 records were not immediately created when signing a dynamic zone with + ``dnssec-policy`` and ``nsec3param``. This has been fixed [GL #2498]. + - An invalid direction field (not one of 'N'/'S' or 'E'/'W') in a LOC record triggered an INSIST failure. [GL #2499]