From: Libor Peltan Date: Fri, 27 Mar 2020 10:59:27 +0000 (+0100) Subject: DNSSEC validation: allow garbage NSEC3 nodes... X-Git-Tag: v3.0.0~62^2~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9f53bb6cd51f64d217ee5201171e673bdd6a063d;p=thirdparty%2Fknot-dns.git DNSSEC validation: allow garbage NSEC3 nodes... ...more precisely, if zone has NSEC3 tree, allow any NSEC3 records with different salt this is useful for checking zones with slow-resalt --- diff --git a/src/knot/dnssec/nsec-chain.c b/src/knot/dnssec/nsec-chain.c index 6344f7cdac..f4b160ebc3 100644 --- a/src/knot/dnssec/nsec-chain.c +++ b/src/knot/dnssec/nsec-chain.c @@ -286,10 +286,27 @@ static int nsec_update_bitmaps(zone_tree_t *node_ptrs, return ret; } +static bool node_nsec3_unmatching(const zone_node_t *node, const dnssec_nsec3_params_t *params) +{ + knot_rdataset_t *nsec3 = node_rdataset(node, KNOT_RRTYPE_NSEC3); + if (nsec3 == NULL || nsec3->count < 1 || params == NULL) { + return false; + } + knot_rdata_t *rdata = nsec3->rdata; + for (int i = 0; i < nsec3->count; i++) { + if (knot_nsec3_salt_len(rdata) == params->salt.size && + memcmp(knot_nsec3_salt(rdata), params->salt.data, params->salt.size) == 0) { + return false; + } + rdata = knot_rdataset_next(rdata); + } + return true; +} + int nsec_check_connect_nodes(zone_node_t *a, zone_node_t *b, nsec_chain_iterate_data_t *data) { - if (node_no_nsec(b)) { + if (node_no_nsec(b) || node_nsec3_unmatching(b, data->nsec3_params)) { return NSEC_NODE_SKIP; } knot_rdataset_t *nsec = node_rdataset(a, data->nsec_type); @@ -319,7 +336,17 @@ int nsec_check_connect_nodes(zone_node_t *a, zone_node_t *b, return KNOT_EOK; } -static zone_node_t *nsec_prev(zone_node_t *node); // declaration +static zone_node_t *nsec_prev(zone_node_t *node, const dnssec_nsec3_params_t *matching_params) +{ + zone_node_t *res = node; + do { + res = node_prev(res); + } while (res != NULL && ((res->flags & NODE_FLAGS_NONAUTH) || + res->rrset_count == 0 || + node_nsec3_unmatching(res, matching_params))); + assert(res == NULL || !knot_nsec_empty_nsec_and_rrsigs_in_node(res)); + return res; +} static int nsec_check_prev_next(zone_node_t *node, void *ctx) { @@ -328,7 +355,10 @@ static int nsec_check_prev_next(zone_node_t *node, void *ctx) } nsec_chain_iterate_data_t *data = ctx; - int ret = nsec_check_connect_nodes(nsec_prev(node), node, data); + int ret = nsec_check_connect_nodes(nsec_prev(node, data->nsec3_params), node, data); + if (ret == NSEC_NODE_SKIP) { + return KNOT_EOK; + } if (ret != KNOT_EOK) { return ret; } @@ -363,7 +393,7 @@ static int nsec_check_prev_next(zone_node_t *node, void *ctx) hint->rrtype = KNOT_RRTYPE_ANY; return KNOT_DNSSEC_ENSEC_CHAIN; } - if (nsec_prev((zone_node_t *)nn) != node) { + if (nsec_prev((zone_node_t *)nn, data->nsec3_params) != node) { hint->node = node->owner; hint->rrtype = data->nsec_type; return KNOT_DNSSEC_ENSEC_CHAIN; @@ -446,16 +476,6 @@ int nsec_check_bitmaps(zone_tree_t *nsec_ptrs, nsec_chain_iterate_data_t *data) return zone_tree_apply(nsec_ptrs, check_nsec_bitmap, data); } -static zone_node_t *nsec_prev(zone_node_t *node) -{ - zone_node_t *res = node; - do { - res = node_prev(res); - } while (res != NULL && ((res->flags & NODE_FLAGS_NONAUTH) || res->rrset_count == 0)); - assert(res == NULL || !knot_nsec_empty_nsec_and_rrsigs_in_node(res)); - return res; -} - /*! \brief Return the one from those nodes which has * closest lower (lexicographically) owner name to ref. */ static zone_node_t *node_nearer(zone_node_t *a, zone_node_t *b, zone_node_t *ref) @@ -563,7 +583,7 @@ int knot_nsec_chain_iterate_fix(zone_tree_t *node_ptrs, if (!del_old && del_new && started_with != NULL) { zone_node_t *prev_old = curr_old, *prev_new; do { - prev_old = nsec_prev(prev_old); + prev_old = nsec_prev(prev_old, NULL); prev_new = binode_counterpart(prev_old); } while (node_no_nsec(prev_new)); @@ -571,7 +591,7 @@ int knot_nsec_chain_iterate_fix(zone_tree_t *node_ptrs, ret = cb_reconn(curr_old, prev_near, data); } if (del_old && !del_new && started_with != NULL) { - zone_node_t *prev_new = nsec_prev(curr_new); + zone_node_t *prev_new = nsec_prev(curr_new, NULL); ret = cb_reconn(prev_new, curr_new, data); if (ret == KNOT_EOK) { ret = callback(prev_new, curr_new, data); diff --git a/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone b/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone new file mode 100644 index 0000000000..c853e99f54 --- /dev/null +++ b/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone @@ -0,0 +1,19 @@ +ok.2nsec3. 3600 SOA a.ok.2nsec3. a.ok.2nsec3. 1000000003 10800 10 1209600 7200 +ok.2nsec3. 3600 NS a.ok.2nsec3. +ok.2nsec3. 3600 MX 10 a.ok.2nsec3. +ok.2nsec3. 2 DNSKEY 256 3 8 AwEAAcTVitl37eO+ViFZOpPM3UuH9oKfE0LVfFrNJOTGqHOQngySB71OExKsaS6Y08RRpNfMS94sGIxchjMXRZyLJi3zH2ukiUiubXjTI0rymIRLDpNHaYm6dR+hR2YEQtERmsQ4ttgNkU1Dl9tPGg1Yt2ILfEK/8OFTkz5r69u2V/f/ +ok.2nsec3. 2 DNSKEY 257 3 8 AwEAAcOyxKOo35/KKf4o2MJYNpRA5CHX627jaeLqrWsVgZx7mTg+Uxcv3KSHZKXoS8IWUL/7K9YccU9fxDzQimK03yoGk9vqxCJXiBQIrt6XJiMX6FNtu4QoDzEcJX95ib664AlpGPRFIjNqKhS3HvvAxC93ktiXbpbCcKH5y+AcqJ4r +ok.2nsec3. 0 NSEC3PARAM 1 0 15 16BB2CD605BF6409 +a.ok.2nsec3. 3600 A 1.2.3.4 +ok.2nsec3. 3600 RRSIG NS 8 2 3600 20300325100832 20200327083832 1083 ok.2nsec3. F0a5ni5zuVx7d+G1eYl2VInmpGh6WirWcxi9od8ryinYl+Kzqax25BzWFUREoaqh2jzDBh/e0PjdoawUPPlaFxKwFX2XNc4wdpazCHaRO2zVi+OMaDEgSU5hSNGQrRS3VdAdRNhg2wq8up2n8NKvCPzryA5e7FLQMxd0m8QdSm8= +ok.2nsec3. 3600 RRSIG SOA 8 2 3600 20300325100908 20200327083908 1083 ok.2nsec3. RbesJicqOnwXIr95RZynBBfQj+akrfA9VilBoqXf3KX+2X3ypzVDZtKvNfua4Wk3g4iLf5pxAh7es58MOVPrEQkVhGau/rC3g+xkQ/TJVKR151C6UBYtsrgohQwQmBZB6Z4/Wz3fNmJWLg2+1NVz/aqWSwT/uQfxM33Nmo6jW88= +ok.2nsec3. 3600 RRSIG MX 8 2 3600 20300325100832 20200327083832 1083 ok.2nsec3. gDAZeV5cC+DnHr3/CRSn1xxksjSq2kh39p4b84JYkIiA9WhH4+T1fE87H0CMDuWisaa3+G+ViCVF+EsvJJylOGzpdMNl2RLeigNIyrsYQnWz7m5r7RvGhRtOQMMsMi7FvfY8FuYlunoTUMqwFxPKmLunGuqwDAa99MdayNq3y9g= +ok.2nsec3. 2 RRSIG DNSKEY 8 2 2 20300325100832 20200327083832 19360 ok.2nsec3. L675OPk6MW8vm6Yi5boyp2IumEgcEYWyed3stGWAYihxZrpFZ5RgfxboVgcM3wvq3rxV5e/fe/CQ/LxKh7VH/tR5swoOfQSlTby9CI6MuF5UJ3EbsVNKQ3YYSIbuYH9WkhRfM4lx4aVgy/ZXiMd6VC0RUbK4idlbDkcOiqkUGe8= +ok.2nsec3. 0 RRSIG NSEC3PARAM 8 2 0 20300325100832 20200327083832 1083 ok.2nsec3. DmJ1pcboLskCahOSZTsg9vn2x7vue4j4+QwnNIWqardVvk4vbmdHckxmHJ6XVKrhjjU67WP42j0MLYLRfIYNuc73UwQZi/kSMzuBCFTAcGFrzgB8hiN0PRxqjZtJb+iYVCN9aBghwpBzMOCwKkkUVsYtJOL7RkSkX2mkD7QHV2o= +a.ok.2nsec3. 3600 RRSIG A 8 3 3600 20300325100832 20200327083832 1083 ok.2nsec3. R3CQNVWaO3veiZPsJAbdo3lz1tBTQLhkvNbKZepq4kRtvqbh74CfMqiKvUx0O8o9EkF5/fhbB9qqKbrDETeu4wU0xjZzCSsQ+75Pfn2HyC1WM+GgLx2vZec8YCTR9fkDPNiABbPywt791wlID0x8mQzF8XPyKyW0oLcINy0F6yk= +1ncif4ogq3uov6dsuppl2jc5q3dq6d5m.ok.2nsec3. 7200 NSEC3 1 0 15 16BB2CD605BF6409 spcsif81i3ij1na7td4othdersk0ddvh NS SOA MX RRSIG DNSKEY NSEC3PARAM +eklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200 NSEC3 1 0 10 874A1253FD24911F p6qgkmgustj7tf1471jct7e3ir9n6sib A RRSIG +spcsif81i3ij1na7td4othdersk0ddvh.ok.2nsec3. 7200 NSEC3 1 0 15 16BB2CD605BF6409 1ncif4ogq3uov6dsuppl2jc5q3dq6d5m A RRSIG +1ncif4ogq3uov6dsuppl2jc5q3dq6d5m.ok.2nsec3. 7200 RRSIG NSEC3 8 3 7200 20300325100832 20200327083832 1083 ok.2nsec3. lYbsiUFKA0El/qInmq6MUZfMmTCvbXcIatHvLs5jIR3qQYal1Y4WM/k0ZYtmkJAp3olto2fO8TO2JN1xx1sCi5EilaHWrX/iQc6ftWi+QR0Z/YdpkQYZEYHKu8AgmnYDUxruu4c/rAqJmqZ3TRu8dT+Xmc8nLPRK0r0byUW1/OQ= +eklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200 RRSIG NSEC3 8 3 7200 20300325100908 20200327083908 1083 ok.2nsec3. wlAETOQ94sWCcS5Cb8ojK8iIgciCVck2vWfpSdpmcmStAKKHirCHIPnvhj46eR+WXAnHWonDHwcmpZq+joVdip3XZ287oVmqmZEYse5WcrGzb5OGqOwzNwbzXRXyChLwALfZ/xWRYMvGn0nis4eqqa1e4nb5M3K4pUXAQWJRNO8= +spcsif81i3ij1na7td4othdersk0ddvh.ok.2nsec3. 7200 RRSIG NSEC3 8 3 7200 20300325100832 20200327083832 1083 ok.2nsec3. A8S3oFHSlw/x7+We0FsHZiJJKHKJfyps1gQ/fmCL6LvNcOR+upUTubBAw92bqxMoq4mAcn4a9dW8wnukfy9WtMggD5LVzDH9SH2VYDdcaHpV4PlLD/qCtGsZVNh9IHcBJP1n69Yr9Q2Fr70ARsaXM5PoRDxe4657Fhb3sM8cEb8= diff --git a/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone.2 b/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone.2 new file mode 100644 index 0000000000..7419274697 --- /dev/null +++ b/tests-extra/tests/dnssec/validate/data/ok.2nsec3.zone.2 @@ -0,0 +1,25 @@ +ok.2nsec3. 3600 SOA a.ok.2nsec3. a.ok.2nsec3. 1000000004 10800 10 1209600 7200 +ok.2nsec3. 3600 NS a.ok.2nsec3. +ok.2nsec3. 3600 MX 10 a.ok.2nsec3. +ok.2nsec3. 2 DNSKEY 256 3 8 AwEAAcTVitl37eO+ViFZOpPM3UuH9oKfE0LVfFrNJOTGqHOQngySB71OExKsaS6Y08RRpNfMS94sGIxchjMXRZyLJi3zH2ukiUiubXjTI0rymIRLDpNHaYm6dR+hR2YEQtERmsQ4ttgNkU1Dl9tPGg1Yt2ILfEK/8OFTkz5r69u2V/f/ +ok.2nsec3. 2 DNSKEY 257 3 8 AwEAAcOyxKOo35/KKf4o2MJYNpRA5CHX627jaeLqrWsVgZx7mTg+Uxcv3KSHZKXoS8IWUL/7K9YccU9fxDzQimK03yoGk9vqxCJXiBQIrt6XJiMX6FNtu4QoDzEcJX95ib664AlpGPRFIjNqKhS3HvvAxC93ktiXbpbCcKH5y+AcqJ4r +ok.2nsec3. 0 NSEC3PARAM 1 0 15 16BB2CD605BF6409 +a.ok.2nsec3. 3600 A 1.2.3.4 +added.ok.2nsec3. 3600 A 3.4.5.6 +ok.2nsec3. 3600 RRSIG NS 8 2 3600 20300325100832 20200327083832 1083 ok.2nsec3. F0a5ni5zuVx7d+G1eYl2VInmpGh6WirWcxi9od8ryinYl+Kzqax25BzWFUREoaqh2jzDBh/e0PjdoawUPPlaFxKwFX2XNc4wdpazCHaRO2zVi+OMaDEgSU5hSNGQrRS3VdAdRNhg2wq8up2n8NKvCPzryA5e7FLQMxd0m8QdSm8= +ok.2nsec3. 3600 RRSIG SOA 8 2 3600 20300325100941 20200327083941 1083 ok.2nsec3. B7mqYKCvO+pMFtmmoPyV9I+ZvwXqLV3OE/H7RtGkGvxcLym+03lSpmnfppyKgWGdwSeHOwsEoUI4OX7I/oNjCbyWex17ijj7MkRmBLsH8vkeXANPYQ0QQjGergObmqYHPqe6jFZiqML/UVS+rrRO63QhORbcl05fiWLZtx7Q8CI= +ok.2nsec3. 3600 RRSIG MX 8 2 3600 20300325100832 20200327083832 1083 ok.2nsec3. gDAZeV5cC+DnHr3/CRSn1xxksjSq2kh39p4b84JYkIiA9WhH4+T1fE87H0CMDuWisaa3+G+ViCVF+EsvJJylOGzpdMNl2RLeigNIyrsYQnWz7m5r7RvGhRtOQMMsMi7FvfY8FuYlunoTUMqwFxPKmLunGuqwDAa99MdayNq3y9g= +ok.2nsec3. 2 RRSIG DNSKEY 8 2 2 20300325100832 20200327083832 19360 ok.2nsec3. L675OPk6MW8vm6Yi5boyp2IumEgcEYWyed3stGWAYihxZrpFZ5RgfxboVgcM3wvq3rxV5e/fe/CQ/LxKh7VH/tR5swoOfQSlTby9CI6MuF5UJ3EbsVNKQ3YYSIbuYH9WkhRfM4lx4aVgy/ZXiMd6VC0RUbK4idlbDkcOiqkUGe8= +ok.2nsec3. 0 RRSIG NSEC3PARAM 8 2 0 20300325100832 20200327083832 1083 ok.2nsec3. DmJ1pcboLskCahOSZTsg9vn2x7vue4j4+QwnNIWqardVvk4vbmdHckxmHJ6XVKrhjjU67WP42j0MLYLRfIYNuc73UwQZi/kSMzuBCFTAcGFrzgB8hiN0PRxqjZtJb+iYVCN9aBghwpBzMOCwKkkUVsYtJOL7RkSkX2mkD7QHV2o= +a.ok.2nsec3. 3600 RRSIG A 8 3 3600 20300325100832 20200327083832 1083 ok.2nsec3. R3CQNVWaO3veiZPsJAbdo3lz1tBTQLhkvNbKZepq4kRtvqbh74CfMqiKvUx0O8o9EkF5/fhbB9qqKbrDETeu4wU0xjZzCSsQ+75Pfn2HyC1WM+GgLx2vZec8YCTR9fkDPNiABbPywt791wlID0x8mQzF8XPyKyW0oLcINy0F6yk= +added.ok.2nsec3. 3600 RRSIG A 8 3 3600 20300325100941 20200327083941 1083 ok.2nsec3. rzw0Qa3bcVgNo6/7UDM8jXnw1hFOIX0qEwaB4H0VbuevYtVtKU3bkoTF2mOXiIDnz2OZSAJqWXAXQUkNh4J6mKniGXyXH/IGgAzladdLDGEvt7TMKU10SecaUzl4qhXOj8yWt+fwKyGmXdDzB1IgHVOI16kRa6xeUVg4g+AXCEE= +1ncif4ogq3uov6dsuppl2jc5q3dq6d5m.ok.2nsec3. 7200 NSEC3 1 0 15 16BB2CD605BF6409 spcsif81i3ij1na7td4othdersk0ddvh NS SOA MX RRSIG DNSKEY NSEC3PARAM +bklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200 NSEC3 1 0 10 874A1253FD24911F r6qgkmgustj7tf1471jct7e3ir9n6sib A RRSIG +eklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200 NSEC3 1 0 10 874A1253FD24911F p6qgkmgustj7tf1471jct7e3ir9n6sib A RRSIG +spcsif81i3ij1na7td4othdersk0ddvh.ok.2nsec3. 7200 NSEC3 1 0 15 16BB2CD605BF6409 t335gu7261vda3c8h9visei2i4g64lkb A RRSIG +t335gu7261vda3c8h9visei2i4g64lkb.ok.2nsec3. 7200 NSEC3 1 0 15 16BB2CD605BF6409 1ncif4ogq3uov6dsuppl2jc5q3dq6d5m A RRSIG +1ncif4ogq3uov6dsuppl2jc5q3dq6d5m.ok.2nsec3. 7200 RRSIG NSEC3 8 3 7200 20300325100832 20200327083832 1083 ok.2nsec3. lYbsiUFKA0El/qInmq6MUZfMmTCvbXcIatHvLs5jIR3qQYal1Y4WM/k0ZYtmkJAp3olto2fO8TO2JN1xx1sCi5EilaHWrX/iQc6ftWi+QR0Z/YdpkQYZEYHKu8AgmnYDUxruu4c/rAqJmqZ3TRu8dT+Xmc8nLPRK0r0byUW1/OQ= +bklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200 RRSIG NSEC3 8 3 7200 20300325100941 20200327083941 1083 ok.2nsec3. nofbPG1AXGF7VZVylt4Kcw6TNykXwIlRx42WPpVUPJ4aT/h4KbSTcU5UV9MBu39hUoSBX7/6GLtA74rGYv/P5mwgan4ZGCAE6eCQShlvO70mGkkr2FC4sdZjErMokztzR/kYdTlFoow8h3ypbrEGbkEYdGTUcinxZcIabLmuHwI= +eklqtt0r7eebkdtlldoe7n6ui86u8n0t.ok.2nsec3. 7200 RRSIG NSEC3 8 3 7200 20300325100941 20200327083941 1083 ok.2nsec3. PV+/1WXuT7vjBXknFR5nLakshWiABueyRyVG1Y1m7EpL1speXfXkRs0MubA7L3vKaXbGA/WO3dhG1ORpAgLukHBMcXH2Q8vHMH9t5ol5YCVELGWdI4oA3dzIUTmpbxLsv0oR1VwWEoa5yMFmykc/2G6DoGe4v/16XuK9zA3z77E= +spcsif81i3ij1na7td4othdersk0ddvh.ok.2nsec3. 7200 RRSIG NSEC3 8 3 7200 20300325100941 20200327083941 1083 ok.2nsec3. muXZVEt1TbllHehCx9OxRmPfqZd5sMHP+d6C4RJgE3RQZCx5EgFjlR3GgXGni0bK3AQRSjp6XHnnJyqbYkHf3bsH2ZX9AOQl+migrchLy0wmYB4lmXLJpYzhaUxfbnhnAKcTPzaM2tlbob2j+WOfTe4KG2ElIjX8RrplRD7e9ng= +t335gu7261vda3c8h9visei2i4g64lkb.ok.2nsec3. 7200 RRSIG NSEC3 8 3 7200 20300325100941 20200327083941 1083 ok.2nsec3. c1JUC38l2qea7kDosEjCdvOolrFaAnfJLpPL45RmGLjhwmLP9ORxMMZhkbLSIyOmQfOi11dEGtgyl57ORwV3vrpjo8cM5ZQXcsJZdHLCdSPdqwuGESr393lwX0BckXsgf9OFQsvJkINwFyKjjssVAjVBPyhJkp4cWKeMi+dBtfs= diff --git a/tests-extra/tests/dnssec/validate/test.py b/tests-extra/tests/dnssec/validate/test.py index f1a0ea7e57..7c92dc697b 100644 --- a/tests-extra/tests/dnssec/validate/test.py +++ b/tests-extra/tests/dnssec/validate/test.py @@ -11,7 +11,7 @@ master = t.server("knot") slave = t.server("knot") zones_ok = t.zone("ok.nsec.", storage=".") -zones_ok3 = t.zone("ok.nsec3.", storage=".") +zones_ok3 = t.zone("ok.nsec3.", storage=".") + t.zone("ok.2nsec3.", storage=".") zones_nok = t.zone("missing.nsec.", storage=".") + t.zone("bitmap.nsec.", storage=".") + \ t.zone("chain.nsec.", storage=".") + t.zone("rrsig.a.", storage=".") + \ t.zone("rrsig.nsec.", storage=".")