2904. [bug] When using DLV, sub-zones of the zones in the DLV,

                        could be incorrectly marked as insecure instead of
                        secure leading to negative proofs failing.  This was
                        a unintended outcome from change 2890. [RT# 21392]

diff --git a/CHANGES b/CHANGES
index e109229657deb9a293aef3b7884bf76f8b379b12..42ab62880fb539b7f1d9c68296856a184c3dfbe6 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+2904.   [bug]           When using DLV, sub-zones of the zones in the DLV,
+                       could be incorrectly marked as insecure instead of
+                       secure leading to negative proofs failing.  This was
+                       a unintended outcome from change 2890. [RT# 21392]
+
 2900.  [bug]           The placeholder negative caching element was not
                        properly constructed triggering a INSIST in 
                        dns_ncache_towire(). [RT #21346]

diff --git a/bin/tests/system/conf.sh.in b/bin/tests/system/conf.sh.in
index 672230f3ff3ff255a57696365aacd50e46d8a53b..b23ae23f87bf282c8990ab8f32ca9ecd674971e9 100644 (file)
--- a/bin/tests/system/conf.sh.in
+++ b/bin/tests/system/conf.sh.in
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: conf.sh.in,v 1.27.18.12 2009/11/25 23:46:51 tbox Exp $
+# $Id: conf.sh.in,v 1.27.18.13 2010/06/03 00:36:02 marka Exp $
 
 #
 # Common configuration data for system tests, to be sourced into
@@ -43,9 +43,10 @@ CHECKCONF=$TOP/bin/check/named-checkconf
 # The "stress" test is not run by default since it creates enough
 # load on the machine to make it unusable to other users.
 # v6synth
-SUBDIRS="acl cacheclean checkconf checknames dnssec forward glue ixfr limits
-    lwresd masterfile masterformat notify nsupdate pending resolver rrsetorder
-    sortlist stub tkey unknown upforwd views xfer xferquota zonechecks"
+SUBDIRS="acl cacheclean checkconf checknames dlv dnssec forward glue ixfr
+    limits lwresd masterfile masterformat notify nsupdate pending
+    resolver rrsetorder sortlist stub tkey unknown upforwd views
+    xfer xferquota zonechecks"
 
 # PERL will be an empty string if no perl interpreter was found.
 PERL=@PERL@

diff --git a/bin/tests/system/dlv/clean.sh b/bin/tests/system/dlv/clean.sh
index 378edc8f5a52715c7c6a40b4c5625c49a724dc8f..ddfc2eb7e57ac9815fe0bddd14cb4acaad33447a 100644 (file)
--- a/bin/tests/system/dlv/clean.sh
+++ b/bin/tests/system/dlv/clean.sh
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: clean.sh,v 1.2 2004/05/14 04:58:18 marka Exp $
+# $Id: clean.sh,v 1.2.2.2 2010/06/03 00:36:02 marka Exp $
 
 rm -f random.data
 rm -f ns*/named.run
@@ -25,3 +25,11 @@ rm -f ns3/dlvset-*
 rm -f ns3/dsset-*
 rm -f ns3/keyset-*
 rm -f ns3/trusted.conf ns5/trusted.conf
+rm -f ns3/signer.err
+rm -f ns6/K*
+rm -f ns6/*.db
+rm -f ns6/*.signed
+rm -f ns6/dsset-*
+rm -f ns6/signer.err
+rm -f */named.memstats
+rm -f dig.out.ns*.test*

diff --git a/bin/tests/system/dlv/ns3/child.db.in b/bin/tests/system/dlv/ns3/child.db.in
index f172b694d96eb593b73ac969bafb757d9980be71..890036b7f7e82cc20cb7e9c4224ee2df068220d8 100644 (file)
--- a/bin/tests/system/dlv/ns3/child.db.in
+++ b/bin/tests/system/dlv/ns3/child.db.in
@@ -12,7 +12,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: child.db.in,v 1.2 2004/05/14 04:58:21 marka Exp $
+; $Id: child.db.in,v 1.2.2.2 2010/06/03 00:36:02 marka Exp $
 
 $TTL   120
 @              SOA     ns hostmaster.ns 1 3600 1200 604800 60
@@ -20,3 +20,5 @@ $TTL  120
 ns             A       10.53.0.3
 foo            TXT     foo
 bar            TXT     bar
+grand          NS      ns.grand
+ns.grand       A       10.53.0.6

diff --git a/bin/tests/system/dlv/ns3/sign.sh b/bin/tests/system/dlv/ns3/sign.sh
index d1bb2c4740206654e689b781cbb05ab63e6957f0..86e0310d8338a082f38dc2d37ac99dcc349ac806 100755 (executable)
--- a/bin/tests/system/dlv/ns3/sign.sh
+++ b/bin/tests/system/dlv/ns3/sign.sh
@@ -14,7 +14,9 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: sign.sh,v 1.2 2004/05/14 04:58:22 marka Exp $
+# $Id: sign.sh,v 1.2.2.2 2010/06/03 00:36:02 marka Exp $
+
+(cd ../ns6 && sh -e sign.sh)
 
 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -29,12 +31,12 @@ outfile=child1.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null` 
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 
-cat $infile $keyname1.key $keyname2.key >$zonefile
+cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
 
-$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 
+$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo "I: signed $zone"
 
 
@@ -45,12 +47,12 @@ outfile=child3.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 
-cat $infile $keyname1.key $keyname2.key >$zonefile
+cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
 
-$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
+$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo "I: signed $zone"
 
 
@@ -61,12 +63,12 @@ outfile=child4.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
-$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
+$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo "I: signed $zone"
 
 
@@ -77,12 +79,12 @@ outfile=child5.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
-$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null
+$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo "I: signed $zone"
 
 
@@ -92,12 +94,12 @@ zonefile=child7.utld.db
 outfile=child7.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 
-cat $infile $keyname1.key $keyname2.key >$zonefile
+cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
 
-$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null
+$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo "I: signed $zone"
 
 
@@ -107,12 +109,12 @@ zonefile=child8.utld.db
 outfile=child8.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
-$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
+$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo "I: signed $zone"
 
 
@@ -123,12 +125,12 @@ outfile=child9.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 
 cat $infile $keyname1.key $keyname2.key >$zonefile
 
-$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
+$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.er
 echo "I: signed $zone"
 
 zone=child10.utld.
@@ -138,12 +140,12 @@ outfile=child10.signed
 dlvzone=dlv.utld.
 dlvsets="$dlvsets dlvset-$zone"
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 
-cat $infile $keyname1.key $keyname2.key >$zonefile
+cat $infile $keyname1.key $keyname2.key ../ns6/dsset-grand.$zone >$zonefile
 
-$SIGNER -g -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null
+$SIGNER -r $RANDFILE -l $dlvzone -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo "I: signed $zone"
 
 
@@ -153,12 +155,12 @@ zonefile=dlv.utld.db
 outfile=dlv.signed
 dlvzone=dlv.utld.
 
-keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone`
-keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone`
+keyname1=`$KEYGEN -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
+keyname2=`$KEYGEN -f KSK -r $RANDFILE -a DSA -b 768 -n zone $zone 2> /dev/null`
 
 cat $infile $dlvsets $keyname1.key $keyname2.key >$zonefile
 
-$SIGNER -g -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null
+$SIGNER -r $RANDFILE -o $zone -f $outfile $zonefile > /dev/null 2> signer.err || cat signer.err
 echo "I: signed $zone"
 
 

diff --git a/bin/tests/system/dlv/ns6/hints b/bin/tests/system/dlv/ns6/hints
index b2696f6ac04eb766bcbe92d783539cb830328b1f..0d28327a420648b4dae4bc6e8433b975f378e7cd 100644 (file)
--- a/bin/tests/system/dlv/ns6/hints
+++ b/bin/tests/system/dlv/ns6/hints
@@ -1,4 +1,4 @@
-; Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+; Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
 ;
 ; Permission to use, copy, modify, and/or distribute this software for any
 ; purpose with or without fee is hereby granted, provided that the above
@@ -12,7 +12,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: hints,v 1.3 2010/05/26 23:50:47 tbox Exp $
+; $Id: hints,v 1.3.12.1 2010/06/03 00:36:02 marka Exp $
 
 . 0 NS ns.rootservers.utld.
 ns.rootservers.utld. 0 A 10.53.0.1

diff --git a/bin/tests/system/dlv/ns6/named.conf b/bin/tests/system/dlv/ns6/named.conf
index 4b4055c8522119f5077462e5dd1321febb9cbec3..a622fbbfc44a6109405abb11450db6ad4a93a0b7 100644 (file)
--- a/bin/tests/system/dlv/ns6/named.conf
+++ b/bin/tests/system/dlv/ns6/named.conf
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2007  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.3 2010/05/27 23:51:08 tbox Exp $ */
+/* $Id: named.conf,v 1.3.10.1 2010/06/03 00:36:02 marka Exp $ */
 
 controls { /* empty */ };
 

diff --git a/bin/tests/system/dlv/ns6/sign.sh b/bin/tests/system/dlv/ns6/sign.sh
index 62797822e1f8176bf9ec5d462b59334f18a287ec..bbad6df9d7a5495751c1242701036c70ba89c405 100755 (executable)
--- a/bin/tests/system/dlv/ns6/sign.sh
+++ b/bin/tests/system/dlv/ns6/sign.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+# Copyright (C) 2004, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and/or distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -14,7 +14,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: sign.sh,v 1.3 2010/05/27 23:51:08 tbox Exp $
+# $Id: sign.sh,v 1.3.10.1 2010/06/03 00:36:02 marka Exp $
 
 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh

diff --git a/bin/tests/system/dlv/tests.sh b/bin/tests/system/dlv/tests.sh
index d074faf711a5ecaf8348f36236c1587652d29b0f..f0edcaa430c56ed678cd4f2ef6a557e111cdd6ac 100644 (file)
--- a/bin/tests/system/dlv/tests.sh
+++ b/bin/tests/system/dlv/tests.sh
@@ -14,6 +14,33 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.2 2004/05/14 04:58:19 marka Exp $
+# $Id: tests.sh,v 1.2.2.2 2010/06/03 00:36:02 marka Exp $
 
-exit 0
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+status=0
+n=0
+
+rm -f dig.out.*
+
+DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"
+
+echo "I:checking that DNSKEY reference by DLV validates as secure ($n)"
+ret=0
+$DIG $DIGOPTS child1.utld dnskey @10.53.0.5 > dig.out.ns5.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking that child DNSKEY reference by DLV validates as secure ($n)"
+ret=0
+$DIG $DIGOPTS grand.child1.utld dnskey @10.53.0.5 > dig.out.ns5.test$n || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:exit status: $status"
+exit $status

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 8a36ff3cf601070247273b39b971d78823e69539..ddae1b6ae15649d529e499c12d754203a5b5c107 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.119.18.55 2010/06/03 00:07:58 marka Exp $ */
+/* $Id: validator.c,v 1.119.18.56 2010/06/03 00:36:02 marka Exp $ */
 
 /*! \file */
 
@@ -1801,6 +1801,17 @@ validatezonekey(dns_validator_t *val) {
                return (dlv_validatezonekey(val));
 
        if (val->dsset == NULL) {
+
+               /*
+                * We have a dlv sep.  Skip looking up the SEP from
+                * {trusted,managed}-keys.  If the dlv sep is for the
+                * root then it will have been handled above so we don't
+                * need to check whether val->event->name is "." prior to
+                * looking up the DS.
+                */
+               if (val->havedlvsep)
+                       goto find_ds;
+
                /*
                 * First, see if this key was signed by a trusted key.
                 */
@@ -1833,13 +1844,13 @@ validatezonekey(dns_validator_t *val) {
                                  val->event->name, found) != ISC_R_SUCCESS) {
                                if (val->mustbesecure) {
                                        validator_log(val, ISC_LOG_WARNING,
-                                                     "must be secure failure, "
-                                                     "not beneath secure root");
+                                                    "must be secure failure, "
+                                                    "not beneath secure root");
                                        return (DNS_R_MUSTBESECURE);
                                } else
                                        validator_log(val, ISC_LOG_DEBUG(3),
-                                                     "not beneath secure root");
-                               if (val->view->dlv == NULL || DLVTRIED(val)) {
+                                                    "not beneath secure root");
+                               if (val->view->dlv == NULL) {
                                        markanswer(val, "validatezonekey (1)");
                                        return (ISC_R_SUCCESS);
                                }
@@ -1874,17 +1885,6 @@ validatezonekey(dns_validator_t *val) {
                        }
                }
 
-               /*
-                * If this is the root name and there was no trusted key,
-                * give up, since there's no DS at the root.
-                */
-               if (dns_name_equal(event->name, dns_rootname)) {
-                       if ((val->attributes & VALATTR_TRIEDVERIFY) != 0)
-                               return (DNS_R_NOVALIDSIG);
-                       else
-                               return (DNS_R_NOVALIDDS);
-               }
-
                if (atsep) {
                        /*
                         * We have not found a key to verify this DNSKEY
@@ -1904,6 +1904,22 @@ validatezonekey(dns_validator_t *val) {
                        return (DNS_R_NOVALIDKEY);
                }
 
+               /*
+                * If this is the root name and there was no trusted key,
+                * give up, since there's no DS at the root.
+                */
+               if (dns_name_equal(event->name, dns_rootname)) {
+                       if ((val->attributes & VALATTR_TRIEDVERIFY) != 0) {
+                               validator_log(val, ISC_LOG_DEBUG(3),
+                                             "root key failed to validate");
+                               return (DNS_R_NOVALIDSIG);
+                       } else {
+                               validator_log(val, ISC_LOG_DEBUG(3),
+                                             "no trusted root key");
+                               return (DNS_R_NOVALIDDS);
+                       }
+               }
+ find_ds:
                /*
                 * Otherwise, try to find the DS record.
                 */