ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

dnssec-policy: reduce NSEC3 iterations to 150

Browse Source 
When reducing the number of NSEC3 iterations to 150, commit
aa26cde2ae added tests for dnssec-policy
to check that a too high iteration count is a configuration failure.

The test is not sufficient because 151 was always too high for
ECDSAP256SHA256. The test should check for a different algorithm.

There was an existing test case that checks for NSEC3 iterations.
Update the test with the new maximum values.

Update the code in 'kaspconf.c' to allow at most 150 iterations.
This commit is contained in:
Matthijs Mekking
2021-04-29 09:54:51 +02:00
parent 0fd3c8e48b
commit efa5d84dcf
5 changed files with 6 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
bin/tests/system/checkconf/bad-kasp-iterations.conf
View File

@@ -1,14 +0,0 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
dnssec-policy too-many-iterations {
nsec3param iterations 151;
};

14
bin/tests/system/checkconf/good-kasp-iterations.conf
View File

@@ -1,14 +0,0 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
dnssec-policy max-iterations {
nsec3param iterations 150;
};

8
bin/tests/system/checkconf/kasp-bad-nsec3-iter.conf
View File

@@ -27,28 +27,28 @@ dnssec-policy "rsasha256" {
keys {
csk lifetime P10Y algorithm rsasha256 2048;
};
nsec3param iterations 500;
nsec3param iterations 150;
};
dnssec-policy "rsasha256-bad" {
keys {
csk lifetime P10Y algorithm rsasha256 2048;
};
nsec3param iterations 501;
nsec3param iterations 151;
};
dnssec-policy "rsasha512" {
keys {
csk lifetime P10Y algorithm rsasha512 4096;
};
nsec3param iterations 2500;
nsec3param iterations 150;
};
dnssec-policy "rsasha512-bad" {
keys {
csk lifetime P10Y algorithm rsasha512 4096;
};
nsec3param iterations 2501;
nsec3param iterations 151;
};
zone "example.net" {

2
bin/tests/system/checkconf/tests.sh
View File

@@ -495,8 +495,6 @@ echo_i "checking named-checkconf kasp nsec3 iterations errors ($n)"
ret=0
$CHECKCONF kasp-bad-nsec3-iter.conf > checkconf.out$n 2>&1 && ret=1
grep "dnssec-policy: nsec3 iterations value 151 out of range" < checkconf.out$n > /dev/null || ret=1
grep "dnssec-policy: nsec3 iterations value 501 out of range" < checkconf.out$n > /dev/null || ret=1
grep "dnssec-policy: nsec3 iterations value 2501 out of range" < checkconf.out$n > /dev/null || ret=1
lines=$(wc -l < "checkconf.out$n")
if [ $lines != 3 ]; then ret=1; fi
if [ $ret != 0 ]; then echo_i "failed"; fi