[master] fix insecure delegation across static-stub zones

3689.	[bug]		Fixed a bug causing an insecure delegation from one
			static-stub zone to another to fail with a broken
			trust chain. [RT #35081]

diff --git a/CHANGES b/CHANGES
index 38acd889277f84fa08d34e1b53877b3eb7546334..eea882c858ec6c00e428ee76ca6738af09be44cb 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3689.  [bug]           Fixed a bug causing an insecure delegation from one
+                       static-stub zone to another to fail with a broken
+                       trust chain. [RT #35081]
+
 3688.  [bug]           loadnode could return a freed node on out of memory.
                        [RT #35106]
 

diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
index 7be104420470a7f34077b692be25b8b79f7c4fd8..28200ef94d099ed6863abc9f2d876dc194ed610a 100644 (file)
--- a/bin/tests/system/dnssec/ns2/example.db.in
+++ b/bin/tests/system/dnssec/ns2/example.db.in
@@ -54,8 +54,8 @@ dname2                        DNAME   dname2-target
 foo.dname2-target      TXT     "testing dname"
 
 ; A secure subdomain
-secure                 NS      ns.secure
-ns.secure              A       10.53.0.3
+secure                 NS      ns3.secure
+ns3.secure             A       10.53.0.3
 
 ; An insecure subdomain
 insecure               NS      ns.insecure

diff --git a/bin/tests/system/dnssec/ns2/insecure.secure.example.db b/bin/tests/system/dnssec/ns2/insecure.secure.example.db
index f16a2cf8f687851ddf9afe747a627e66a4b87b45..3892f92fa8239477c2accae9c96af0f48c1d1945 100644 (file)
--- a/bin/tests/system/dnssec/ns2/insecure.secure.example.db
+++ b/bin/tests/system/dnssec/ns2/insecure.secure.example.db
@@ -13,8 +13,6 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: insecure.secure.example.db,v 1.9 2007/06/19 23:47:02 tbox Exp $
-
 $TTL 300       ; 5 minutes
 @                      IN SOA  mname1. . (
                                2000042407 ; serial
@@ -23,8 +21,8 @@ $TTL 300      ; 5 minutes
                                1814400    ; expire (3 weeks)
                                3600       ; minimum (1 hour)
                                )
-                       NS      ns
-ns                     A       10.53.0.3
+                       NS      ns2
+ns2                    A       10.53.0.2
 
 a                      A       10.0.0.1
 b                      A       10.0.0.2

diff --git a/bin/tests/system/dnssec/ns3/secure.example.db.in b/bin/tests/system/dnssec/ns3/secure.example.db.in
index c9de3e5b6d1d163e6e5f7f3c48a231caf186c09e..1e757ae408d7de0829e0a09fe00e0ceb9a90d576 100644 (file)
--- a/bin/tests/system/dnssec/ns3/secure.example.db.in
+++ b/bin/tests/system/dnssec/ns3/secure.example.db.in
@@ -13,8 +13,6 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: secure.example.db.in,v 1.16 2010/07/15 01:17:45 jinmei Exp $
-
 $TTL 300       ; 5 minutes
 @                      IN SOA  mname1. . (
                                2000042407 ; serial
@@ -23,8 +21,8 @@ $TTL 300      ; 5 minutes
                                1814400    ; expire (3 weeks)
                                3600       ; minimum (1 hour)
                                )
-                       NS      ns
-ns                     A       10.53.0.3
+                       NS      ns3
+ns3                    A       10.53.0.3
 
 a                      A       10.0.0.1
 b                      A       10.0.0.2
@@ -36,8 +34,8 @@ x                     CNAME   a
 private                        NS      ns.private
 ns.private             A       10.53.0.2
 
-insecure               NS      ns.insecure
-ns.insecure            A       10.53.0.2
+insecure               NS      ns2.insecure
+ns2.insecure           A       10.53.0.2
 
 nosoa                  NS      ns.nosoa
 ns.nosoa               A       10.53.0.7

diff --git a/bin/tests/system/dnssec/ns4/named4.conf b/bin/tests/system/dnssec/ns4/named4.conf
new file mode 100644 (file)
index 0000000..1afde2d
--- /dev/null
+++ b/bin/tests/system/dnssec/ns4/named4.conf
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2013  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+// NS4
+
+controls { /* empty */ };
+
+options {
+       query-source address 10.53.0.4;
+       notify-source 10.53.0.4;
+       transfer-source 10.53.0.4;
+       port 5300;
+       pid-file "named.pid";
+       listen-on { 10.53.0.4; };
+       listen-on-v6 { none; };
+};
+
+key rndc_key {
+       secret "1234abcd8765";
+       algorithm hmac-sha256;
+};
+
+controls {
+       inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; };
+};
+
+key auth {
+       secret "1234abcd8765";
+       algorithm hmac-sha256;
+};
+
+include "trusted.conf";
+
+view rec {
+       match-recursive-only yes;
+       recursion yes;
+       acache-enable yes;
+       dnssec-validation yes;
+       dnssec-accept-expired yes;
+
+       zone "." {
+               type hint;
+               file "../../common/root.hint";
+       };
+
+       zone secure.example {
+               type static-stub;
+               server-addresses { 10.53.0.4; };
+       };
+
+       zone insecure.secure.example {
+               type static-stub;
+               server-addresses { 10.53.0.4; };
+       };
+};
+
+view auth {
+       recursion no;
+       allow-recursion { none; };
+
+       zone secure.example {
+               type slave;
+               masters { 10.53.0.3; };
+       };
+
+       zone insecure.secure.example {
+               type slave;
+               masters { 10.53.0.2; };
+       };
+};

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 9ec9fd473431f70a479570748029306f1c5dfa77..b19e3d7b853d9838a6f0b5aa63d72b5822cad359 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -2371,5 +2371,21 @@ n=`expr $n + 1`
 if test "$before" = "$after" ; then echo "I:failed"; ret=1; fi
 status=`expr $status + $ret`
 
+cp ns4/named4.conf ns4/named.conf
+$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 reconfig 2>&1 | sed 's/^/I:ns4 /'
+sleep 3
+
+echo "I:check insecure delegation between static-stub zones ($n)"
+ret=0
+$DIG $DIGOPTS ns insecure.secure.example \
+       @10.53.0.4 > dig.out.ns4.1.test$n || ret=1
+grep "SERVFAIL" dig.out.ns4.1.test$n > /dev/null && ret=1
+$DIG $DIGOPTS ns secure.example \
+       @10.53.0.4 > dig.out.ns4.2.test$n || ret=1
+grep "SERVFAIL" dig.out.ns4.2.test$n > /dev/null && ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 8b6872fe465a94b888c170fa247db9f56c3e9ed5..6df7e561a4f6ee4df66c5aa1bc117bc19e475136 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -3747,12 +3747,14 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type,
                         */
                        if (dns_rdatatype_atparent(fctx->type))
                                findoptions |= DNS_DBFIND_NOEXACT;
-                       result = dns_view_findzonecut(res->view, name, domain,
-                                                     0, findoptions, ISC_TRUE,
+                       result = dns_view_findzonecut(res->view, fwdname,
+                                                     domain, 0, findoptions,
+                                                     ISC_TRUE,
                                                      &fctx->nameservers,
                                                      NULL);
                        if (result != ISC_R_SUCCESS)
                                goto cleanup_name;
+
                        result = dns_name_dup(domain, mctx, &fctx->domain);
                        if (result != ISC_R_SUCCESS) {
                                dns_rdataset_disassociate(&fctx->nameservers);
@@ -7477,9 +7479,12 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
                 * NXDOMAIN, NXRDATASET, or referral.
                 */
                result = noanswer_response(fctx, NULL, 0);
-               if (result == DNS_R_CHASEDSSERVERS) {
-               } else if (result == DNS_R_DELEGATION) {
-               force_referral:
+               switch (result) {
+               case ISC_R_SUCCESS:
+               case DNS_R_CHASEDSSERVERS:
+                       break;
+               case DNS_R_DELEGATION:
+ force_referral:
                        /*
                         * We don't have the answer, but we know a better
                         * place to look.
@@ -7504,7 +7509,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) {
                        fctx->adberr = 0;
 
                        result = ISC_R_SUCCESS;
-               } else if (result != ISC_R_SUCCESS) {
+                       break;
+               default:
                        /*
                         * Something has gone wrong.
                         */