Michał KępieńandEvan Hunt
f04f107b7e
If named is configured to perform DNSSEC validation and also forwards
all queries ("forward only;") to validating resolvers, negative trust
anchors do not work properly because the CD bit is not set in queries
sent to the forwarders. As a result, instead of retrieving bogus DNSSEC
material and making validation decisions based on its configuration,
named is only receiving SERVFAIL responses to queries for bogus data.
Fix by ensuring the CD bit is always set in queries sent to forwarders
if the query name is covered by an NTA.
(cherry picked from commit 5e80488270)
44 lines
1.2 KiB
Bash
44 lines
1.2 KiB
Bash
#!/bin/sh -e
|
|
#
|
|
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
#
|
|
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
#
|
|
# See the COPYRIGHT file distributed with this work for additional
|
|
# information regarding copyright ownership.
|
|
|
|
SYSTEMTESTTOP=..
|
|
. $SYSTEMTESTTOP/conf.sh
|
|
|
|
$SHELL clean.sh
|
|
|
|
test -r $RANDFILE || $GENRANDOM $RANDOMSIZE $RANDFILE
|
|
|
|
copy_setports ns1/named.conf.in ns1/named.conf
|
|
copy_setports ns2/named.conf.in ns2/named.conf
|
|
copy_setports ns3/named.conf.in ns3/named.conf
|
|
|
|
copy_setports ns4/named1.conf.in ns4/named.conf
|
|
copy_setports ns5/named1.conf.in ns5/named.conf
|
|
|
|
copy_setports ns6/named.conf.in ns6/named.conf
|
|
copy_setports ns7/named.conf.in ns7/named.conf
|
|
copy_setports ns8/named.conf.in ns8/named.conf
|
|
copy_setports ns9/named.conf.in ns9/named.conf
|
|
|
|
cd ns1
|
|
$SHELL sign.sh
|
|
|
|
echo "a.bogus.example. A 10.0.0.22" >>../ns3/bogus.example.db.signed
|
|
echo "b.bogus.example. A 10.0.0.23" >>../ns3/bogus.example.db.signed
|
|
echo "c.bogus.example. A 10.0.0.23" >>../ns3/bogus.example.db.signed
|
|
|
|
cd ../ns3
|
|
cp -f siginterval1.conf siginterval.conf
|
|
|
|
cd ../ns5
|
|
cp -f trusted.conf.bad trusted.conf
|
|
$SHELL sign.sh
|