2951. [bug] named failed to generate a correct signed response

                        in a optout, delegation only zone with no secure
                        delegations. [RT #22007]

diff --git a/CHANGES b/CHANGES
index 655cb74001ac281ec28866a9365b3bb48bf0f330..2bc98c46e55cc8145a9c326cfaf1f80aa916bc80 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+2951.  [bug]           named failed to generate a correct signed response
+                       in a optout, delegation only zone with no secure
+                       delegations. [RT #22007]
+
 2950.  [bug]           named failed to perform a SOA up to date check when
                        falling back to TCP on UDP timeouts when
                        ixfr-from-differences was set. [RT #21595]

diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index b2877f62957f3a39c2d1c925722f13e7728efe7d..1894126ae284232ddac1dddd7027bd069021c2e4 100644 (file)
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: clean.sh,v 1.29 2010/08/13 06:46:24 marka Exp $
+# $Id: clean.sh,v 1.30 2010/09/07 00:58:35 marka Exp $
 
 rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed */trusted.conf */tmp* */*.jnl */*.bk
 rm -f ns1/root.db ns2/example.db ns3/secure.example.db
@@ -24,6 +24,7 @@ rm -f ns3/dynamic.example.db ns3/dynamic.example.db.signed.jnl
 rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
 rm -f ns2/private.secure.example.db
 rm -f ns2/badparam.db ns2/badparam.db.bad
+rm -f ns2/single-nsec3.db
 rm -f */example.bk
 rm -f dig.out.*
 rm -f random.data

diff --git a/bin/tests/system/dnssec/ns2/named.conf b/bin/tests/system/dnssec/ns2/named.conf
index aca7085974e0ecb787bf693a18eb759942f347ee..bffb22c1b657a1aa39f0eb4ca0497f2df35015be 100644 (file)
--- a/bin/tests/system/dnssec/ns2/named.conf
+++ b/bin/tests/system/dnssec/ns2/named.conf
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: named.conf,v 1.32 2010/08/13 23:47:03 tbox Exp $ */
+/* $Id: named.conf,v 1.33 2010/09/07 00:58:35 marka Exp $ */
 
 // NS2
 
@@ -80,10 +80,14 @@ zone "child.optout.example" {
        allow-update { none; };
 };
 
-
 zone "badparam" {
        type master;
        file "badparam.db.bad";
 };
 
+zone "single-nsec3" {
+       type master;
+       file "single-nsec3.db.signed";
+};
+
 include "trusted.conf";

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index b61e9a72eea89865736d4e92d30bd5e0d75d7652..683062d1cf1248d3f49cedc179643e57b9a2def6 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: sign.sh,v 1.39 2010/08/13 06:46:25 marka Exp $
+# $Id: sign.sh,v 1.40 2010/09/07 00:58:35 marka Exp $
 
 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -115,7 +115,6 @@ cat $dlvinfile $dlvkeyname.key dlvset-$privzone > $dlvzonefile
 
 $SIGNER -P -g -r $RANDFILE -o $dlvzone $dlvzonefile > /dev/null
 
-
 # Sign the badparam secure file
 
 zone=badparam.
@@ -130,3 +129,16 @@ cat $infile $keyname1.key $keyname2.key >$zonefile
 $SIGNER -P -3 - -H 1 -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null
 
 sed 's/IN NSEC3 1 0 1 /IN NSEC3 1 0 10 /' $zonefile.signed > $zonefile.bad
+
+# Sign the single-nsec3 secure zone with optout
+
+zone=single-nsec3.
+infile=single-nsec3.db.in
+zonefile=single-nsec3.db
+
+keyname1=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone -f KSK $zone`
+keyname2=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
+
+cat $infile $keyname1.key $keyname2.key >$zonefile
+
+$SIGNER -P -3 - -A -H 1 -g -r $RANDFILE -o $zone -k $keyname1 $zonefile $keyname2 > /dev/null

diff --git a/bin/tests/system/dnssec/ns2/single-nsec3.db.in b/bin/tests/system/dnssec/ns2/single-nsec3.db.in
new file mode 100644 (file)
index 0000000..a3b1299
--- /dev/null
+++ b/bin/tests/system/dnssec/ns2/single-nsec3.db.in
@@ -0,0 +1,26 @@
+; Copyright (C) 2010  Internet Systems Consortium, Inc. ("ISC")
+;
+; Permission to use, copy, modify, and/or distribute this software for any
+; purpose with or without fee is hereby granted, provided that the above
+; copyright notice and this permission notice appear in all copies.
+;
+; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+; AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+; PERFORMANCE OF THIS SOFTWARE.
+
+; $Id: single-nsec3.db.in,v 1.2 2010/09/07 00:58:36 marka Exp $
+
+$TTL 300       ; 5 minutes
+@                      IN SOA  ns2.example. . (
+                               2010042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns2.example.
+delegation             NS      ns3.example.

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 73ea6a674f04185de06bcf0155c188237cb0f177..b7b2579d0d92e77b42911b0951f1c693cbe69359 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.69 2010/08/13 06:46:24 marka Exp $
+# $Id: tests.sh,v 1.70 2010/09/07 00:58:35 marka Exp $
 
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -1006,6 +1006,36 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+#
+# RT22007 regression test.
+#
+echo "I:checking optout NSEC3 referral with only insecure delegations ($n)"
+ret=0
+$DIG $DIGOPTS +norec delegation.single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
+grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+echo "I:checking optout NSEC3 NXDOMAIN with only insecure delegations ($n)"
+ret=0
+$DIG $DIGOPTS +norec nonexist.single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1
+grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+
+status=`expr $status + $ret`
+echo "I:checking optout NSEC3 nodata with only insecure delegations ($n)"
+ret=0
+$DIG $DIGOPTS +norec single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
+grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
+grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 # Run a minimal update test if possible.  This is really just
 # a regression test for RT #2399; more tests should be added.
 

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 07154ddf17610b19b2521010b3a54e04e684e212..1cf75acd6a96a8f01f56f650bdd00162dc97443e 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: rbtdb.c,v 1.304 2010/08/13 23:47:03 tbox Exp $ */
+/* $Id: rbtdb.c,v 1.305 2010/09/07 00:58:36 marka Exp $ */
 
 /*! \file */
 
@@ -7378,6 +7378,8 @@ dns_rbtdb_create
         * change.
         */
        if (!IS_CACHE(rbtdb)) {
+               dns_rbtnode_t *nsec3node;
+
                rbtdb->origin_node = NULL;
                result = dns_rbt_addnode(rbtdb->tree, &rbtdb->common.origin,
                                         &rbtdb->origin_node);
@@ -7400,6 +7402,32 @@ dns_rbtdb_create
                rbtdb->origin_node->locknum =
                        dns_name_hash(&name, ISC_TRUE) %
                        rbtdb->node_lock_count;
+#endif
+               /*
+                * Add an apex node to the NSEC3 tree so that NSEC3 searches
+                * return partial matches when there is only a single NSEC3
+                * record in the tree.
+                */
+               nsec3node = NULL;
+               result = dns_rbt_addnode(rbtdb->nsec3, &rbtdb->common.origin,
+                                        &nsec3node);
+               if (result != ISC_R_SUCCESS) {
+                       INSIST(result != ISC_R_EXISTS);
+                       free_rbtdb(rbtdb, ISC_FALSE, NULL);
+                       return (result);
+               }
+               nsec3node->nsec = DNS_RBT_NSEC_NSEC3;
+               /*
+                * We need to give the nsec3 origin node the right locknum.
+                */
+               dns_name_init(&name, NULL);
+               dns_rbt_namefromnode(nsec3node, &name);
+#ifdef DNS_RBT_USEHASH
+               nsec3node->locknum = nsec3node->hashval %
+                       rbtdb->node_lock_count;
+#else
+               nsec3node->locknum = dns_name_hash(&name, ISC_TRUE) %
+                       rbtdb->node_lock_count;
 #endif
        }