Use signer name when disabling DNSSEC algorithms

When disabling algorithms, use the signer name to determine if the
algorithm is disabled or not.  This allows for algorithms to be
cleanly disabled on a zone level basis.  Previously, just using the
records owner name, "disable-algorithms" could impact resolution of
names that where not disabled.  This does now mean that
"disable-algorithms" can not be used to disable part of a zone anymore.

(cherry picked from commit a0945f6337fb4a27fb7104838ee51d3722e1e9a0)

diff --git a/bin/tests/system/dnssec/ns3/badalg.secure.example.db.in b/bin/tests/system/dnssec/ns3/badalg.secure.example.db.in
new file mode 100644 (file)
index 0000000..93cb343
--- /dev/null
+++ b/bin/tests/system/dnssec/ns3/badalg.secure.example.db.in
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300       ; 5 minutes
+@                      IN SOA  mname1. . (
+                               2000042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns3
+                       A       10.53.0.4
+ns3                    A       10.53.0.3

diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
index 293ff2dda8f1d014632e2ae21a732dd804d88d7d..3b66a9d69614f6d9ff6abe085f7f95830cb21863 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
@@ -91,6 +91,12 @@ zone "secure.example" {
        allow-update { any; };
 };
 
+zone "badalg.secure.example" {
+       type primary;
+       file "badalg.secure.example.db.signed";
+       allow-update { any; };
+};
+
 zone "bogus.example" {
        type primary;
        file "bogus.example.db.signed";

diff --git a/bin/tests/system/dnssec/ns3/secure.example.db.in b/bin/tests/system/dnssec/ns3/secure.example.db.in
index 9aebd98007889154775b79305ba4ba9cf7abb78f..43ad1e557e88f865afa82afa2254b23db6dd6e94 100644 (file)
--- a/bin/tests/system/dnssec/ns3/secure.example.db.in
+++ b/bin/tests/system/dnssec/ns3/secure.example.db.in
@@ -30,7 +30,9 @@ g                     A       10.0.0.7
 z                      A       10.0.0.26
 a.a.a.a.a.a.a.a.a.a.e  A       10.0.0.27
 x                      CNAME   a
-badalg                 A       10.53.0.4
+
+badalg                 NS      ns3.badalg
+ns3.badalg             A       10.53.0.3
 
 private                        NS      ns.private
 ns.private             A       10.53.0.2

diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
index f61ea2838145bb0752cc7a422751cc96dc127ea8..3669cd3f7b30ba92a8b432f50541a337baaa424c 100644 (file)
--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
@@ -77,6 +77,19 @@ done
 
 echo_i "ns3/sign.sh: example zones"
 
+# A zone that will be treated as insecure as the DEFAULT_ALGORITHM is
+# disabled for it.
+zone=badalg.secure.example.
+infile=badalg.secure.example.db.in
+zonefile=badalg.secure.example.db
+
+keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone")
+
+cat "$infile" "$keyname.key" >"$zonefile"
+
+"$SIGNER" -z -o "$zone" "$zonefile" >/dev/null
+
+#
 zone=secure.example.
 infile=secure.example.db.in
 zonefile=secure.example.db
@@ -85,7 +98,7 @@ cnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n
 dnameandkey=$("$KEYGEN" -T KEY -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n host "dnameandkey.$zone")
 keyname=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 
-cat "$infile" "$cnameandkey.key" "$dnameandkey.key" "$keyname.key" >"$zonefile"
+cat "$infile" dsset-badalg.secure.example. "$cnameandkey.key" "$dnameandkey.key" "$keyname.key" >"$zonefile"
 
 "$SIGNER" -z -D -o "$zone" "$zonefile" >/dev/null
 cat "$zonefile" "$zonefile".signed >"$zonefile".tmp

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index cf7ce13d3ad3b785bc767cf39257fa8fed9a0944..3702cf7eb400511658e44df245a036035688f772 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -3757,6 +3757,16 @@ n=$((n + 1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status + ret))
 
+echo_i "check that DS records are still treated as secure at the disable-algorithm name ($n)"
+ret=0
+dig_with_opts @10.53.0.4 badalg.secure.example DS >dig.out.ns4.test$n || ret=1
+grep "ANSWER: 2," dig.out.ns4.test$n >/dev/null || ret=1
+grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1
+n=$((n + 1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status + ret))
+
 echo_i "checking EDE code 1 for bad alg mnemonic ($n)"
 ret=0
 dig_with_opts @10.53.0.4 badalg.secure.example >dig.out.ns4.test$n || ret=1

diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py
index d3350561d971fe1accaabb5cc44f4482bbe0aa5c..52730aec0bd2e4014fcfb96928d637c381cdbb2f 100644 (file)
--- a/bin/tests/system/dnssec/tests_sh_dnssec.py
+++ b/bin/tests/system/dnssec/tests_sh_dnssec.py
@@ -79,6 +79,7 @@ pytestmark = pytest.mark.extra_artifacts(
         "ns3/NSEC3",
         "ns3/auto-nsec.example.db",
         "ns3/auto-nsec3.example.db",
+        "ns3/badalg.secure.example.db",
         "ns3/badds.example.db",
         "ns3/bogus.example.db",
         "ns3/disabled.managed.db",

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 1f7c7154e8383d9bc65134d98296afb70971d952..bcbe026f916c0f093a62d2060baff607747bd717 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -1679,7 +1679,8 @@ validate_answer_process(void *arg) {
         * At this point we could check that the signature algorithm
         * was known and "sufficiently good".
         */
-       if (!dns_resolver_algorithm_supported(val->view->resolver, val->name,
+       if (!dns_resolver_algorithm_supported(val->view->resolver,
+                                             &val->siginfo->signer,
                                              val->siginfo->algorithm))
        {
                if (val->unsupported_algorithm == 0) {

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 54c541d55defd549a615a73d2ef513a0a8bdf943..1710cabb6f1c6d69f1ddf9224c971dd0674bf36f 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2504,7 +2504,8 @@ validate(ns_client_t *client, dns_db_t *db, dns_name_t *name,
                result = dns_rdata_tostruct(&rdata, &rrsig, NULL);
                RUNTIME_CHECK(result == ISC_R_SUCCESS);
                if (!dns_resolver_algorithm_supported(client->view->resolver,
-                                                     name, rrsig.algorithm))
+                                                     &rrsig.signer,
+                                                     rrsig.algorithm))
                {
                        char txt[DNS_NAME_FORMATSIZE + 32];
                        isc_buffer_t buffer;