From: Remi Gacogne Date: Wed, 22 Feb 2023 09:26:53 +0000 (+0100) Subject: rec: Update validation state after a missing negative indication X-Git-Tag: dnsdist-1.8.0-rc2~5^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e73aabd4b348b5944f3434e0e455f28d91f4b452;p=thirdparty%2Fpdns.git rec: Update validation state after a missing negative indication --- diff --git a/pdns/recursordist/syncres.cc b/pdns/recursordist/syncres.cc index 386065628e..2c24c40aba 100644 --- a/pdns/recursordist/syncres.cc +++ b/pdns/recursordist/syncres.cc @@ -5399,7 +5399,7 @@ bool SyncRes::processAnswer(unsigned int depth, const string& prefix, LWResult& LOG(prefix << qname << ": NXDOMAIN without a negative indication (missing SOA in authority) in a DNSSEC secure zone, going Bogus" << endl); updateValidationState(qname, state, vState::BogusMissingNegativeIndication, prefix); } - else if (state == vState::Indeterminate) { + else { /* we might not have validated any record, because we did get a NXDOMAIN without any SOA from an insecure zone, for example */ updateValidationState(qname, state, tempState, prefix); @@ -5421,7 +5421,7 @@ bool SyncRes::processAnswer(unsigned int depth, const string& prefix, LWResult& LOG(prefix << qname << ": NODATA without a negative indication (missing SOA in authority) in a DNSSEC secure zone, going Bogus" << endl); updateValidationState(qname, state, vState::BogusMissingNegativeIndication, prefix); } - else if (state == vState::Indeterminate) { + else { /* we might not have validated any record, because we did get a NODATA without any SOA from an insecure zone, for example */ updateValidationState(qname, state, tempState, prefix); diff --git a/pdns/recursordist/test-syncres_cc7.cc b/pdns/recursordist/test-syncres_cc7.cc index 13acf217c0..9ee88d298e 100644 --- a/pdns/recursordist/test-syncres_cc7.cc +++ b/pdns/recursordist/test-syncres_cc7.cc @@ -1429,6 +1429,156 @@ BOOST_AUTO_TEST_CASE(test_dnssec_bogus_nodata) BOOST_CHECK_EQUAL(queriesCount, 5U); } +BOOST_AUTO_TEST_CASE(test_dnssec_insecure_missing_soa_on_nodata) +{ + std::unique_ptr sr; + initSR(sr, true); + + setDNSSECValidation(sr, DNSSECMode::ValidateAll); + + primeHints(); + const DNSName target("powerdns.com."); + testkeysset_t keys; + + auto luaconfsCopy = g_luaconfs.getCopy(); + luaconfsCopy.dsAnchors.clear(); + generateKeyMaterial(DNSName("."), DNSSECKeeper::ECDSA256, DNSSECKeeper::DIGEST_SHA256, keys, luaconfsCopy.dsAnchors); + generateKeyMaterial(DNSName("com."), DNSSECKeeper::ECDSA256, DNSSECKeeper::DIGEST_SHA256, keys, luaconfsCopy.dsAnchors); + g_luaconfs.setState(luaconfsCopy); + + size_t queriesCount = 0; + + sr->setAsyncCallback([target, &queriesCount, keys](const ComboAddress& ip, const DNSName& domain, int type, bool doTCP, bool sendRDQuery, int EDNS0Level, struct timeval* now, boost::optional& srcmask, boost::optional context, LWResult* res, bool* chained) { + queriesCount++; + + if (type == QType::DS || type == QType::DNSKEY) { + if (domain.isPartOf(target)) { + /* proves cut */ + return genericDSAndDNSKEYHandler(res, domain, domain, type, keys, true); + } + else { + return genericDSAndDNSKEYHandler(res, domain, domain, type, keys); + } + } + else if (isRootServer(ip)) { + setLWResult(res, 0, false, false, true); + addRecordToLW(res, "com.", QType::NS, "ns1.com.", DNSResourceRecord::AUTHORITY, 3600); + addDS(DNSName("com."), 300, res->d_records, keys); + addRRSIG(keys, res->d_records, DNSName("com."), 300); + addRecordToLW(res, "ns1.com.", QType::A, "192.0.2.1", DNSResourceRecord::ADDITIONAL, 3600); + return LWResult::Result::Success; + } + else { + if (domain == DNSName("com.")) { + setLWResult(res, 0, true, false, true); + addRecordToLW(res, DNSName("com"), QType::SOA, "whatever.com. blah.com. 2017032301 10800 3600 604800 3600", DNSResourceRecord::AUTHORITY, 3600); + addRRSIG(keys, res->d_records, DNSName("com"), 300); + addNSECRecordToLW(DNSName("com"), DNSName("com."), {QType::SOA}, 600, res->d_records); + addRRSIG(keys, res->d_records, DNSName("com."), 300); + return LWResult::Result::Success; + } + else if (domain == target) { + setLWResult(res, 0, true, false, true); + return LWResult::Result::Success; + } + } + + return LWResult::Result::Timeout; + }); + + vector ret; + int res = sr->beginResolve(target, QType(QType::AAAA), QClass::IN, ret); + BOOST_CHECK_EQUAL(res, RCode::NoError); + BOOST_CHECK_EQUAL(sr->getValidationState(), vState::Insecure); + BOOST_REQUIRE_EQUAL(ret.size(), 0U); + /* powerdns.com|A, com|A, com|DNSKEY, powerdns.com|DS */ + BOOST_CHECK_EQUAL(queriesCount, 4U); + + /* again, to test the cache */ + ret.clear(); + res = sr->beginResolve(target, QType(QType::AAAA), QClass::IN, ret); + BOOST_CHECK_EQUAL(res, RCode::NoError); + BOOST_CHECK_EQUAL(sr->getValidationState(), vState::Insecure); + BOOST_REQUIRE_EQUAL(ret.size(), 0U); + /* we don't store empty results */ + BOOST_CHECK_EQUAL(queriesCount, 5U); +} + +BOOST_AUTO_TEST_CASE(test_dnssec_insecure_missing_soa_on_nxd) +{ + std::unique_ptr sr; + initSR(sr, true); + + setDNSSECValidation(sr, DNSSECMode::ValidateAll); + + primeHints(); + const DNSName target("powerdns.com."); + testkeysset_t keys; + + auto luaconfsCopy = g_luaconfs.getCopy(); + luaconfsCopy.dsAnchors.clear(); + generateKeyMaterial(DNSName("."), DNSSECKeeper::ECDSA256, DNSSECKeeper::DIGEST_SHA256, keys, luaconfsCopy.dsAnchors); + generateKeyMaterial(DNSName("com."), DNSSECKeeper::ECDSA256, DNSSECKeeper::DIGEST_SHA256, keys, luaconfsCopy.dsAnchors); + g_luaconfs.setState(luaconfsCopy); + + size_t queriesCount = 0; + + sr->setAsyncCallback([target, &queriesCount, keys](const ComboAddress& ip, const DNSName& domain, int type, bool doTCP, bool sendRDQuery, int EDNS0Level, struct timeval* now, boost::optional& srcmask, boost::optional context, LWResult* res, bool* chained) { + queriesCount++; + + if (type == QType::DS || type == QType::DNSKEY) { + if (domain.isPartOf(target)) { + /* proves cut */ + return genericDSAndDNSKEYHandler(res, domain, domain, type, keys, true); + } + else { + return genericDSAndDNSKEYHandler(res, domain, domain, type, keys); + } + } + else if (isRootServer(ip)) { + setLWResult(res, 0, false, false, true); + addRecordToLW(res, "com.", QType::NS, "ns1.com.", DNSResourceRecord::AUTHORITY, 3600); + addDS(DNSName("com."), 300, res->d_records, keys); + addRRSIG(keys, res->d_records, DNSName("com."), 300); + addRecordToLW(res, "ns1.com.", QType::A, "192.0.2.1", DNSResourceRecord::ADDITIONAL, 3600); + return LWResult::Result::Success; + } + else { + if (domain == DNSName("com.")) { + setLWResult(res, 0, true, false, true); + addRecordToLW(res, DNSName("com"), QType::SOA, "whatever.com. blah.com. 2017032301 10800 3600 604800 3600", DNSResourceRecord::AUTHORITY, 3600); + addRRSIG(keys, res->d_records, DNSName("com"), 300); + addNSECRecordToLW(DNSName("com"), DNSName("com."), {QType::SOA}, 600, res->d_records); + addRRSIG(keys, res->d_records, DNSName("com."), 300); + return LWResult::Result::Success; + } + else if (domain == target) { + setLWResult(res, RCode::NXDomain, true, false, true); + return LWResult::Result::Success; + } + } + + return LWResult::Result::Timeout; + }); + + vector ret; + int res = sr->beginResolve(target, QType(QType::AAAA), QClass::IN, ret); + BOOST_CHECK_EQUAL(res, RCode::NXDomain); + BOOST_CHECK_EQUAL(sr->getValidationState(), vState::Insecure); + BOOST_REQUIRE_EQUAL(ret.size(), 0U); + /* powerdns.com|A, com|A, com|DNSKEY, powerdns.com|DS */ + BOOST_CHECK_EQUAL(queriesCount, 4U); + + /* again, to test the cache */ + ret.clear(); + res = sr->beginResolve(target, QType(QType::AAAA), QClass::IN, ret); + BOOST_CHECK_EQUAL(res, RCode::NXDomain); + BOOST_CHECK_EQUAL(sr->getValidationState(), vState::Insecure); + BOOST_REQUIRE_EQUAL(ret.size(), 0U); + /* we don't store empty results */ + BOOST_CHECK_EQUAL(queriesCount, 5U); +} + BOOST_AUTO_TEST_CASE(test_dnssec_bogus_nxdomain) { std::unique_ptr sr;