3041. [bug] dnssec-signzone failed to generate new signatures on

                        ttl changes. [RT #23330]

diff --git a/CHANGES b/CHANGES
index 7c33605db56334c600e09827cf251d73755b7d3b..d32d390e429c1491f3c5b668ce9f0bf47489acba 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3041.  [bug]           dnssec-signzone failed to generate new signatures on
+                       ttl changes. [RT #23330]
+
 3040.  [bug]           Named failed to validate insecure zones where a node
                        with a CNAME existed between the trust anchor and the
                        top of the zone. [RT #23338]

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 390748cbeda50cebf4d9a550fd8ceba83986fa4e..2ad072cf60b521f6e63539522aec4286a0fc7088 100644 (file)
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -29,7 +29,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.262 2010/06/03 23:51:04 tbox Exp $ */
+/* $Id: dnssec-signzone.c,v 1.262.110.1 2011/02/24 03:11:48 marka Exp $ */
 
 /*! \file */
 
@@ -486,32 +486,32 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
                        if (!expired)
                                keep = ISC_TRUE;
                } else if (issigningkey(key)) {
-                       if (!expired && setverifies(name, set, key->key,
-                                                   &sigrdata)) {
+                       if (!expired && rrsig.originalttl == set->ttl &&
+                           setverifies(name, set, key->key, &sigrdata)) {
                                vbprintf(2, "\trrsig by %s retained\n", sigstr);
                                keep = ISC_TRUE;
                                wassignedby[key->index] = ISC_TRUE;
                                nowsignedby[key->index] = ISC_TRUE;
                        } else {
                                vbprintf(2, "\trrsig by %s dropped - %s\n",
-                                        sigstr,
-                                        expired ? "expired" :
-                                                  "failed to verify");
+                                        sigstr, expired ? "expired" :
+                                        rrsig.originalttl != set->ttl ?
+                                        "ttl change" : "failed to verify");
                                wassignedby[key->index] = ISC_TRUE;
                                resign = ISC_TRUE;
                        }
                } else if (iszonekey(key)) {
-                       if (!expired && setverifies(name, set, key->key,
-                                                   &sigrdata)) {
+                       if (!expired && rrsig.originalttl == set->ttl &&
+                           setverifies(name, set, key->key, &sigrdata)) {
                                vbprintf(2, "\trrsig by %s retained\n", sigstr);
                                keep = ISC_TRUE;
                                wassignedby[key->index] = ISC_TRUE;
                                nowsignedby[key->index] = ISC_TRUE;
                        } else {
                                vbprintf(2, "\trrsig by %s dropped - %s\n",
-                                        sigstr,
-                                        expired ? "expired" :
-                                                  "failed to verify");
+                                        sigstr, expired ? "expired" :
+                                        rrsig.originalttl != set->ttl ?
+                                        "ttl change" : "failed to verify");
                                wassignedby[key->index] = ISC_TRUE;
                        }
                } else if (!expired) {
@@ -1387,6 +1387,13 @@ verifyset(dns_rdataset_t *rdataset, dns_name_t *name, dns_dbnode_t *node,
 
                dns_rdataset_current(&sigrdataset, &rdata);
                dns_rdata_tostruct(&rdata, &sig, NULL);
+               if (rdataset->ttl != sig.originalttl) {
+                       dns_name_format(name, namebuf, sizeof(namebuf));
+                       type_format(rdataset->type, typebuf, sizeof(typebuf));
+                       fprintf(stderr, "TTL mismatch for %s %s keytag %u\n",
+                               namebuf, typebuf, sig.keyid);
+                       continue;
+               }
                if ((set_algorithms[sig.algorithm] != 0) ||
                    (ksk_algorithms[sig.algorithm] == 0))
                        continue;

diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index 7b12f9da1c41e165653755e3a6c11800c6c96032..740a93554976686eda16953d98d0fad91271a10f 100644 (file)
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: clean.sh,v 1.33.14.2 2011/02/23 11:36:02 marka Exp $
+# $Id: clean.sh,v 1.33.14.3 2011/02/24 03:11:48 marka Exp $
 
 rm -f */K* */keyset-* */dsset-* */dlvset-* */signedkey-* */*.signed
 rm -f */trusted.conf */managed.conf */tmp* */*.jnl */*.bk
@@ -49,4 +49,5 @@ rm -f ns3/kskonly.example.db
 rm -f ns4/named.conf
 rm -f ns3/auto-nsec.example.db ns3/auto-nsec3.example.db
 rm -f ns3/secure.below-cname.example.db
-
+rm -f signer/example.db.after signer/example.db.before
+rm -f signer/example.db.changed

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index f931a2c216c433f381cde8ff78d3849957dde697..efdd5b69ff7dd0b4bd83deae97fe939e06cbe60d 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.73.14.4 2011/02/23 11:36:02 marka Exp $
+# $Id: tests.sh,v 1.73.14.5 2011/02/24 03:11:48 marka Exp $
 
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -959,6 +959,24 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I:checking that dnsssec-signzone updates originalttl on ttl changes ($n)"
+ret=0
+(
+cd signer
+RANDFILE=../random.data
+zone=example
+key1=`$KEYGEN -q -r $RANDFILE -a RSASHA1 -b 1024 -n zone $zone`
+key2=`$KEYGEN -q -r $RANDFILE -f KSK -a RSASHA1 -b 1024 -n zone $zone`
+cat example.db.in $key1.key $key2.key > example.db
+$SIGNER -o example -f example.db.before example.db > /dev/null 2>&1
+sed 's/60.IN.SOA./50 IN SOA /' example.db.before > example.db.changed
+$SIGNER -o example -f example.db.after example.db.changed > /dev/null 2>&1
+)
+grep "SOA 5 1 50" signer/example.db.after > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 # Test that "rndc secroots" is able to dump trusted keys
 echo "I:checking rndc secroots ($n)"
 ret=0