3203. [bug] Increase log level to 'info' for validation failures

			from expired or not-yet-valid RRSIGs. [RT #21796]

diff --git a/CHANGES b/CHANGES
index f9b9a91f7c31acfcd5389cda4e901674bb7bc07c..f1a021a69214dfc998a31de3c463d31a5c73a724 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3203.  [bug]           Increase log level to 'info' for validation failures
+                       from expired or not-yet-valid RRSIGs. [RT #21796]
+
 3202.  [bug]           NOEDNS caching on timeout was too agressive.
                        [RT #26416]
 

diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
index 964ce74cfc18ee3f5c2d640123793a49d1ff3fca..384c0b9636d8c506da761dde779bd72839c5a192 100644 (file)
--- a/bin/tests/system/dnssec/ns2/example.db.in
+++ b/bin/tests/system/dnssec/ns2/example.db.in
@@ -13,7 +13,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: example.db.in,v 1.30 2011/03/05 06:35:41 marka Exp $
+; $Id: example.db.in,v 1.31 2011/11/04 05:36:28 each Exp $
 
 $TTL 300       ; 5 minutes
 @                      IN SOA  mname1. . (
@@ -73,6 +73,10 @@ dynamic                      A       10.53.0.3
 mustbesecure           NS      ns.mustbesecure
 ns.mustbesecure                A       10.53.0.3
 
+; A subdomain with expired signatures
+expired                        NS      ns.expired
+ns.expired             A       10.53.0.3
+
 ; A rfc2535 signed zone w/ CNAME
 rfc2535                        NS      ns.rfc2535
 ns.rfc2535             A       10.53.0.3

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index 4ccb53eb1cae0754ec48c0e17e6d73c4cf2c4fdd..04a525b53f06801265f1a94574fa100d38fe3ed1 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: sign.sh,v 1.49 2011/03/21 20:31:22 marka Exp $
+# $Id: sign.sh,v 1.50 2011/11/04 05:36:28 each Exp $
 
 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -33,7 +33,7 @@ zonefile=example.db
 for subdomain in secure bogus dynamic keyless nsec3 optout nsec3-unknown \
     optout-unknown multiple rsasha256 rsasha512 kskonly update-nsec3 \
     auto-nsec auto-nsec3 secure.below-cname ttlpatch split-dnssec \
-    split-smart
+    split-smart expired
 do
        cp ../ns3/dsset-$subdomain.example. .
 done

diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
index 24731960bddc986a86f8efb7ea5ac7227d183697..fdca3b00df219dbe083202376ee07c18985a0888 100644 (file)
--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: sign.sh,v 1.42 2011/05/23 20:10:02 each Exp $
+# $Id: sign.sh,v 1.43 2011/11/04 05:36:28 each Exp $
 
 SYSTEMTESTTOP=../..
 . $SYSTEMTESTTOP/conf.sh
@@ -271,7 +271,7 @@ zonefile=expired.example.db
 kskname=`$KEYGEN -q -r $RANDFILE -fk $zone`
 zskname=`$KEYGEN -q -r $RANDFILE $zone`
 cat $infile $kskname.key $zskname.key >$zonefile
-$SIGNER -P -r $RANDFILE -o $zone -s -3h -e +1h $zonefile > /dev/null 2>&1
+$SIGNER -P -r $RANDFILE -o $zone -s -1d -e +1h $zonefile > /dev/null 2>&1
 rm -f $kskname.* $zskname.*
 
 #

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 58f9a0310a03519a1978f56d4701cfd791d68b0c..f3a0351d0894fd1b6d2a754780c0f7abe87ff7ae 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.101 2011/10/28 06:20:05 each Exp $
+# $Id: tests.sh,v 1.102 2011/11/04 05:36:28 each Exp $
 
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -1273,8 +1273,18 @@ status=`expr $status + $ret`
 
 echo "I:checking expired signatures remain with "'"allow-update { none; };"'" and no keys available ($n)"
 ret=0
-$DIG $DIGOPTS +noauth expired.example. +dnssec @10.53.0.3 soa > dig.out.ns2.test$n || ret=1
-grep "RRSIG.SOA" dig.out.ns2.test$n > /dev/null || ret=1
+$DIG $DIGOPTS +noauth expired.example. +dnssec @10.53.0.3 soa > dig.out.ns3.test$n || ret=1
+grep "RRSIG.SOA" dig.out.ns3.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+
+status=`expr $status + $ret`
+echo "I:checking expired signatures do not validate ($n)"
+ret=0
+$DIG $DIGOPTS +noauth expired.example. +dnssec @10.53.0.4 soa > dig.out.ns4.test$n || ret=1
+grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1
+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
+grep "expired.example .*: RRSIG has expired" ns4/named.run > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`

diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 233461ec70d07943cfda49b0276da64df238f34b..da07711999b3a3010d8ca09e573e71571da099ab 100644 (file)
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: validator.c,v 1.207 2011/10/20 23:46:51 tbox Exp $ */
+/* $Id: validator.c,v 1.208 2011/11/04 05:36:28 each Exp $ */
 
 #include <config.h>
 
@@ -1930,7 +1930,9 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
  again:
        result = dns_dnssec_verify2(val->event->name, val->event->rdataset,
                                    key, ignore, val->view->mctx, rdata, wild);
-       if (result == DNS_R_SIGEXPIRED && val->view->acceptexpired) {
+       if ((result == DNS_R_SIGEXPIRED || result == DNS_R_SIGFUTURE) &&
+           val->view->acceptexpired)
+       {
                ignore = ISC_TRUE;
                goto again;
        }
@@ -1939,6 +1941,10 @@ verify(dns_validator_t *val, dst_key_t *key, dns_rdata_t *rdata,
                              "accepted expired %sRRSIG (keyid=%u)",
                              (result == DNS_R_FROMWILDCARD) ?
                              "wildcard " : "", keyid);
+       else if (result == DNS_R_SIGEXPIRED || result == DNS_R_SIGFUTURE)
+               validator_log(val, ISC_LOG_INFO,
+                             "verify failed due to bad signature (keyid=%u): "
+                             "%s", keyid, isc_result_totext(result));
        else
                validator_log(val, ISC_LOG_DEBUG(3),
                              "verify rdataset (keyid=%u): %s",