Michał Kępień [Tue, 3 Jul 2018 06:44:05 +0000 (08:44 +0200)]
Add CHANGES entry
4987. [cleanup] dns_rdataslab_tordataset() and its related
dns_rdatasetmethods_t callbacks were removed as they
were not being used by anything in BIND. [GL #371]
Michał Kępień [Tue, 3 Jul 2018 06:44:05 +0000 (08:44 +0200)]
Remove dns_rdataslab_tordataset() and its related dns_rdatasetmethods_t callbacks
Since BIND libraries are no longer considered public and
dns_rdataslab_tordataset() is not used anywhere in the tree, remove the
latter and its associated dns_rdatasetmethods_t callbacks from
lib/dns/rdataslab.c.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Add CHANGES entry
4985. [func] Add a new slave zone option, "mirror", to enable
serving a non-authoritative copy of a zone that
is subject to DNSSEC validation before being
used. For now, this option is only meant to
facilitate deployment of an RFC 7706-style local
copy of the root zone. [GL #33]
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Make "rndc zonestatus" output for mirror zones different than for regular slave zones
Replace "type: slave" with "type: mirror" in "rndc zonestatus" output
for mirror zones in order to enable the user to tell a regular slave
zone and a mirror zone apart.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Disable notifies for mirror zones unless also-notify is used
Since the mirror zone feature is expected to mostly be used for the root
zone, prevent slaves from sending NOTIFY messages for mirror zones by
default. Retain the possibility to use "also-notify" as it might be
useful in certain cases.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Disable outgoing mirror zone transfers by default
As mirror zone data should be treated the way validated, cached DNS
responses are, outgoing mirror zone transfers should be disabled unless
they are explicitly enabled by zone configuration.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Treat mirror zone data as cache data for access control purposes
As mirror zone data should be treated the way validated, cached DNS
responses are, it should not be used when responding to clients who are
not allowed cache access. Reuse code responsible for determining cache
database access for evaluating mirror zone access.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Rework query_checkcacheaccess()
Modify query_checkcacheaccess() so that it only contains a single return
statement rather than three and so that the "check_acl" variable is no
longer needed. Tweak and expand comments. Fix coding style issues.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Simplify query_getcachedb()
Modify query_getcachedb() so that it uses a common return path for both
success and failure. Remove a redundant NULL check since 'db' will
never be NULL after being passed as a target pointer to dns_db_attach().
Fix coding style issues.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Extract cache access checks in query_getcachedb() to a separate function
Extract the parts of query_getcachedb() responsible for checking whether
the client is allowed to access the cache to a separate function, so
that it can be reused for determining mirror zone access.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Fall back to normal recursion when mirror zone data is unavailable
If transferring or loading a mirror zone fails, resolution should still
succeed by means of falling back to regular recursive queries.
Currently, though, if a slave zone is present in the zone table and not
loaded, a SERVFAIL response is generated. Thus, mirror zones need
special handling in this regard.
Add a new dns_zt_find() flag, DNS_ZTFIND_MIRROR, and set it every time a
domain name is looked up rather than a zone itself. Handle that flag in
dns_zt_find() in such a way that a mirror zone which is expired or not
yet loaded is ignored when looking up domain names, but still possible
to find when the caller wants to know whether the zone is configured.
This causes a fallback to recursion when mirror zone data is unavailable
without making unloaded mirror zones invisible to code checking a zone's
existence.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Ensure responses sourced from mirror zones have the AD bit set
Zone RRsets are assigned trust level "ultimate" upon load, which causes
the AD bit to not be set in responses coming from slave zones, including
mirror zones. Make dns_zoneverify_dnssec() update the trust level of
verified RRsets to "secure" so that the AD bit is set in such responses.
No rollback mechanism is implemented as dns_zoneverify_dnssec() fails in
case of any DNSSEC failure, which causes the mirror zone version being
verified to be discarded.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Do not treat mirror zone data as authoritative
Section 4 of RFC 7706 suggests that responses sourced from a local copy
of a zone should not have the AA bit set. Follow that recommendation by
setting 'qctx->authoritative' to ISC_FALSE when a response to a query is
coming from a mirror zone.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Ensure delegations inside mirror zones are properly handled for non-recursive queries
When a resolver is a regular slave (i.e. not a mirror) for some zone,
non-recursive queries for names below that slaved zone will return a
delegation sourced from it. This behavior is suboptimal for mirror
zones as their contents should rather be treated as validated, cached
DNS responses. Modify query_delegation() and query_zone_delegation() to
permit clients allowed cache access to check its contents for a better
answer when responding to non-recursive queries.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Perform basic resolution checks with a mirror zone in use
Make ns3 mirror the "root" zone from ns1 and query the former for a
properly signed record below the root. Ensure ns1 is not queried during
resolution and that the AD bit is set in the response.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Verify mirror zone journals
As mirror zone files are verified when they are loaded from disk, verify
journal files as well to ensure invalid data is not used. Reuse the
journals generated during IXFR tests to test this.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Verify mirror zone AXFRs
Update axfr_commit() so that all incoming versions of a mirror zone
transferred using AXFR are verified before being used. If zone
verification fails, discard the received version of the zone, wait until
the next refresh and retry.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Add dns_zone_verifydb()
Add a function for determining whether the supplied version of a mirror
zone passes DNSSEC validation and is signed using a trusted key. Define
a new libdns result signifying a zone verification failure.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Enable dns_zoneverify_dnssec() to check whether the zone was signed by a trust anchor
Extend check_dnskey_sigs() so that, if requested, it checks whether the
DNSKEY RRset at zone apex is signed by at least one trust anchor. The
trust anchor table is passed as an argument to dns_zoneverify_dnssec()
and passed around in the verification context structure. Neither
dnssec-signzone nor dnssec-verify are yet modified to make use of that
feature, though.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Implement a "read-only" version of nextpart()
The system test helper function nextpart() always updates the "lines
read so far" marker ("<file>.prev") when it is called, which somewhat
limits its flexibility. Add two new helper functions, nextpartpeek()
and nextpartreset(), so that certain parts of log files can be easily
examined more than once. Add some documentation to help understand the
purpose of each function in the nextpart*() family.
Michał Kępień [Thu, 28 Jun 2018 11:38:39 +0000 (13:38 +0200)]
Add new "mirror" slave zone option
Add a new slave-only boolean configuration option, "mirror", along with
its corresponding dns_zoneopt_t enum and a helper function for checking
whether that option was set for a given zone. This commit does not
introduce any behavior changes yet.
Michał Kępień [Tue, 26 Jun 2018 10:19:41 +0000 (12:19 +0200)]
Do not use IANA DNSSEC keys in the "rpz" system test
With "dnssec-validation" now defaulting to "auto", it needs to be
explicitly set to "yes" (the previous default value) for all validating
resolvers used in system tests. Ensure that requirement is satisfied by
the resolvers used in the "rpz" system test.
Michał Kępień [Tue, 26 Jun 2018 10:19:41 +0000 (12:19 +0200)]
Determine "rpz" system test mode based on $mode rather than $DNSRPS_TEST_MODE
Change 4897 modified the way the $DNSRPS_TEST_MODE variable is used in
bin/tests/system/rpz/tests.sh without updating all references to it,
which i.a. causes the $native and $dnsrps variables to not be set in the
default testing mode, effectively preventing failed checks from being
propagated to the final result of the test. Use $mode instead of
$DNSRPS_TEST_MODE where appropriate to fix error handling in the "rpz"
system test.
projects / thirdparty / bind9.git / log
