Warn if multiple keys have same role

If a dnssec-policy has multiple keys configured with the
same algorithm and role.

(cherry picked from commit f54dad005e02bd40d353037f562a695f53ed19c0)

diff --git a/bin/tests/system/checkconf/kasp-warning.conf b/bin/tests/system/checkconf/kasp-warning.conf
new file mode 100644 (file)
index 0000000..765c09b
--- /dev/null
+++ b/bin/tests/system/checkconf/kasp-warning.conf
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+dnssec-policy "warn1" {
+       keys {
+               // This policy has keys in the same algorithm with the same
+               // role, this should trigger a warning.
+               ksk lifetime unlimited algorithm ecdsa256;
+               zsk lifetime unlimited algorithm ecdsa256;
+               zsk lifetime unlimited algorithm ecdsa256;
+               ksk lifetime unlimited algorithm ecdsa256;
+       };
+};
+
+dnssec-policy "warn2" {
+       keys {
+               // This policy has keys in the same algorithm with the same
+               // role, this should trigger a warning.
+               csk lifetime unlimited algorithm rsasha256;
+               ksk lifetime unlimited algorithm rsasha256;
+               zsk lifetime unlimited algorithm rsasha256;
+       };
+};
+
+zone "warn1.example.net" {
+       type primary;
+       file "warn1.example.db";
+       dnssec-policy "warn1";
+};
+
+zone "warn2.example.net" {
+       type primary;
+       file "warn2.example.db";
+       dnssec-policy "warn2";
+};
+

diff --git a/bin/tests/system/checkconf/tests.sh b/bin/tests/system/checkconf/tests.sh
index 5c159924c75989ca73e2e56a09cb4b0ed04bfdf1..807c79b5dc9ad67db256a90ec3c9c1cf87ab3cdb 100644 (file)
--- a/bin/tests/system/checkconf/tests.sh
+++ b/bin/tests/system/checkconf/tests.sh
@@ -536,6 +536,19 @@ grep "dnssec-policy: key algorithm ecdsa256 has predefined length; ignoring leng
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "checking named-checkconf kasp warns about weird policies ($n)"
+ret=0
+$CHECKCONF kasp-warning.conf > checkconf.out$n 2>&1 || ret=1
+grep "dnssec-policy: algorithm 8 has multiple keys with ZSK role" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: algorithm 8 has multiple keys with ZSK role" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: algorithm 13 has multiple keys with KSK role" < checkconf.out$n > /dev/null || ret=1
+grep "dnssec-policy: algorithm 13 has multiple keys with ZSK role" < checkconf.out$n > /dev/null || ret=1
+lines=$(wc -l < "checkconf.out$n")
+if [ $lines != 4 ]; then ret=1; fi
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "check that a good 'kasp' configuration is accepted ($n)"
 ret=0

diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c
index a8a078f0c78cb4ecd788a5c8fec78f6cc294c785..97c8a1466c782e6f2a48619066765e2b9b335810 100644 (file)
--- a/lib/isccfg/kaspconf.c
+++ b/lib/isccfg/kaspconf.c
@@ -324,6 +324,7 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, const char *name, isc_mem_t *mctx,
        (void)confget(maps, "keys", &keys);
        if (keys != NULL) {
                char role[256] = { 0 };
+               bool warn[256][2] = { { false } };
                dns_kasp_key_t *kkey = NULL;
 
                for (element = cfg_list_first(keys); element != NULL;
@@ -344,24 +345,46 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, const char *name, isc_mem_t *mctx,
                        INSIST(keyalg < ARRAY_SIZE(role));
 
                        if (dns_kasp_key_zsk(kkey)) {
+                               if ((role[keyalg] & DNS_KASP_KEY_ROLE_ZSK) != 0)
+                               {
+                                       warn[keyalg][0] = true;
+                               }
                                role[keyalg] |= DNS_KASP_KEY_ROLE_ZSK;
                        }
 
                        if (dns_kasp_key_ksk(kkey)) {
+                               if ((role[keyalg] & DNS_KASP_KEY_ROLE_KSK) != 0)
+                               {
+                                       warn[keyalg][1] = true;
+                               }
                                role[keyalg] |= DNS_KASP_KEY_ROLE_KSK;
                        }
                }
                dns_kasp_thaw(kasp);
                for (i = 0; i < ARRAY_SIZE(role); i++) {
-                       if (role[i] != 0 && role[i] != (DNS_KASP_KEY_ROLE_ZSK |
-                                                       DNS_KASP_KEY_ROLE_KSK))
-                       {
+                       if (role[i] == 0) {
+                               continue;
+                       }
+                       if (role[i] !=
+                           (DNS_KASP_KEY_ROLE_ZSK | DNS_KASP_KEY_ROLE_KSK)) {
                                cfg_obj_log(keys, logctx, ISC_LOG_ERROR,
                                            "dnssec-policy: algorithm %zu "
                                            "requires both KSK and ZSK roles",
                                            i);
                                result = ISC_R_FAILURE;
                        }
+                       if (warn[i][0]) {
+                               cfg_obj_log(keys, logctx, ISC_LOG_WARNING,
+                                           "dnssec-policy: algorithm %zu has "
+                                           "multiple keys with ZSK role",
+                                           i);
+                       }
+                       if (warn[i][1]) {
+                               cfg_obj_log(keys, logctx, ISC_LOG_WARNING,
+                                           "dnssec-policy: algorithm %zu has "
+                                           "multiple keys with KSK role",
+                                           i);
+                       }
                }
                if (result != ISC_R_SUCCESS) {
                        goto cleanup;