4837. [bug] dns_update_signatures{inc} (add_sigs) was not

                        properly determining if there were active KSK and
                        ZSK keys for a algorithm when update-check-ksk is
                        true (default) leaving records unsigned. [RT #46743]

(cherry picked from commit 196e01da5fed56b219b7a86b5549450ce05249a7)

diff --git a/CHANGES b/CHANGES
index 1076bb2d357412798a14ac2f414d34c29a71a287..f8781ef698221f0d6a8b6b0b0ef474e4def68d49 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+4837.  [bug]           dns_update_signatures{inc} (add_sigs) was not
+                       properly determining if there were active KSK and
+                       ZSK keys for a algorithm when update-check-ksk is
+                       true (default) leaving records unsigned. [RT #46743]
+
 4836.  [bug]           Zones created using "rndc addzone" could
                        temporarily fail to inherit an "allow-transfer"
                        ACL that had been configured in the options

diff --git a/bin/tests/system/inline/clean.sh b/bin/tests/system/inline/clean.sh
index bdc584db1abd027790c4cdaf7c98b0138fc67bb5..86f43bb70a3227256049397bca5ed2e91c7e9a2b 100644 (file)
--- a/bin/tests/system/inline/clean.sh
+++ b/bin/tests/system/inline/clean.sh
@@ -15,6 +15,8 @@ rm -f ns1/root.db.signed
 rm -f ns2/bits.db
 rm -f ns2/bits.db.jnl
 rm -f ns1/signer.out
+rm -f ns2/inactivezsk.db
+rm -f ns2/inactivezsk.db.jnl
 rm -f ns2/retransfer.db
 rm -f ns2/retransfer.db.jnl
 rm -f ns2/retransfer3.db
@@ -44,6 +46,10 @@ rm -f ns3/expired.db
 rm -f ns3/expired.db.jnl
 rm -f ns3/expired.db.signed
 rm -f ns3/expired.db.signed.jnl
+rm -f ns3/inactivezsk.bk
+rm -f ns3/inactivezsk.bk.jnl
+rm -f ns3/inactivezsk.bk.signed
+rm -f ns3/inactivezsk.bk.signed.jnl
 rm -f ns3/nsec3.db
 rm -f ns3/nsec3.db.jnl
 rm -f ns3/nsec3.db.signed

diff --git a/bin/tests/system/inline/ns1/root.db.in b/bin/tests/system/inline/ns1/root.db.in
index 3c758e8acbc3afb0b3dff56824f219d0d8cc15e4..3f0024ac2a7598eff2da32ec4ee57359a116fb4f 100644 (file)
--- a/bin/tests/system/inline/ns1/root.db.in
+++ b/bin/tests/system/inline/ns1/root.db.in
@@ -48,3 +48,6 @@ ns3.externalkey.      A       10.53.0.3
 
 retransfer3.           NS      ns3.retransfer.
 ns3.retransfer3.       A       10.53.0.3
+
+inactivezsk.           NS      ns3.inactivezsk.
+ns3.inactivezsk.       A       10.53.0.3

diff --git a/bin/tests/system/inline/ns2/named.conf b/bin/tests/system/inline/ns2/named.conf
index b4adc834b8af796f1003d1695a02a465164318a7..d236fc72d6dacda2802b2cf269e9dbf67f662a62 100644 (file)
--- a/bin/tests/system/inline/ns2/named.conf
+++ b/bin/tests/system/inline/ns2/named.conf
@@ -53,3 +53,9 @@ zone "nsec3-loop" {
        file "nsec3-loop.db";
        notify no;
 };
+
+zone "inactivezsk" {
+       type master;
+       file "inactivezsk.db";
+       allow-update { any; };
+};

diff --git a/bin/tests/system/inline/ns3/named.conf b/bin/tests/system/inline/ns3/named.conf
index 3e987deaa1b47c298c6f48d267f54a7e6a721e6f..0157e2b22ea27492da82cb32839b4d46fa88d466 100644 (file)
--- a/bin/tests/system/inline/ns3/named.conf
+++ b/bin/tests/system/inline/ns3/named.conf
@@ -112,3 +112,11 @@ zone "retransfer3" {
        auto-dnssec maintain;
        file "retransfer3.bk";
 };
+
+zone "inactivezsk" {
+       type slave;
+       masters { 10.53.0.2; };
+       inline-signing yes;
+       auto-dnssec maintain;
+       file "inactivezsk.bk";
+};

diff --git a/bin/tests/system/inline/ns3/sign.sh b/bin/tests/system/inline/ns3/sign.sh
index f2c3eace877bbd4d2a4616b2a083591e97edb919..ed72f4cc7c7889eddd1516d2f62ab916d404d3f9 100755 (executable)
--- a/bin/tests/system/inline/ns3/sign.sh
+++ b/bin/tests/system/inline/ns3/sign.sh
@@ -75,6 +75,15 @@ keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 768 -n zone $zone`
 keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
 $DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
 
+zone=inactivezsk
+rm -f K${zone}.+*+*.key
+rm -f K${zone}.+*+*.private
+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -P now -A now+3600 $zone`
+keyname=`$KEYGEN -q -r $RANDFILE -a NSEC3RSASHA1 -b 1024 -n zone -f KSK $zone`
+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone $zone`
+keyname=`$KEYGEN -q -r $RANDFILE -a RSASHA256 -b 1024 -n zone -f KSK $zone`
+$DSFROMKEY -T 1200 $keyname >> ../ns1/root.db
+
 for s in a c d h k l m q z
 do
        zone=test-$s

diff --git a/bin/tests/system/inline/setup.sh b/bin/tests/system/inline/setup.sh
index 98d52983a48f61c12d8117f930afa6a2c0a63ac8..6bf522d3ae606bde0995f971abe7ee737c83c600 100644 (file)
--- a/bin/tests/system/inline/setup.sh
+++ b/bin/tests/system/inline/setup.sh
@@ -16,6 +16,7 @@ rm -f ns1/root.db.signed
 
 touch ns2/trusted.conf
 cp ns2/bits.db.in ns2/bits.db
+cp ns2/bits.db.in ns2/inactivezsk.db
 cp ns2/bits.db.in ns2/retransfer.db
 cp ns2/bits.db.in ns2/retransfer3.db
 rm -f ns2/bits.db.jnl

diff --git a/bin/tests/system/inline/tests.sh b/bin/tests/system/inline/tests.sh
index cf497220f1c1cf7d12d71c69212e8c3d7d8ee579..0893db32c83f3e1c52c2d2bce7f0b02a265359c9 100755 (executable)
--- a/bin/tests/system/inline/tests.sh
+++ b/bin/tests/system/inline/tests.sh
@@ -1022,5 +1022,36 @@ serial=`awk '$4 == "SOA" { print $7 }' dig.out.ns2.post.test$n`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo "I:testing checking that inline signing works with inactive KSK ($n)"
+ret=0
+
+$DIG $DIGOPTS @10.53.0.3 -p 5300 soa inactivezsk  > dig.out.ns3.pre.test$n || ret=1
+soa1=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.pre.test$n`
+
+$NSUPDATE << EOF
+server 10.53.0.2 5300
+update add added.inactivezsk 0 IN TXT added record
+send
+EOF
+
+for i in 1 2 3 4 5 6 7 8 9 10
+do
+    $DIG $DIGOPTS @10.53.0.3 -p 5300 soa inactivezsk  > dig.out.ns3.post.test$n || ret=1
+    soa2=`awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n`
+    test ${soa1:-0} -ne ${soa2:-0} && break
+    sleep 1
+done
+test ${soa1:-0} -ne ${soa2:-0} || ret=1
+
+$DIG $DIGOPTS @10.53.0.3 -p 5300 txt added.inactivezsk > dig.out.ns3.test$n || ret=1
+grep "ANSWER: 3," dig.out.ns3.test$n > /dev/null || ret=1
+grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1
+grep "TXT 7 2" dig.out.ns3.test$n > /dev/null || ret=1
+grep "TXT 8 2" dig.out.ns3.test$n > /dev/null || ret=1
+
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/lib/dns/update.c b/lib/dns/update.c
index 4b5d8a7d5f5c45c0209bdab987ccc6e7859841f8..6cbb4a38de9e1ae076faa4244d9f18895d4aa352 100644 (file)
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -1105,6 +1105,8 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 
                if (!dst_key_isprivate(keys[i]))
                        continue;
+               if (dst_key_inactive(keys[i]))  /* Should be redundant. */
+                       continue;
 
                if (check_ksk && !REVOKE(keys[i])) {
                        isc_boolean_t have_ksk, have_nonksk;
@@ -1118,6 +1120,10 @@ add_sigs(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
                        for (j = 0; j < nkeys; j++) {
                                if (j == i || ALG(keys[i]) != ALG(keys[j]))
                                        continue;
+                               if (!dst_key_isprivate(keys[j]))
+                                       continue;
+                               if (dst_key_inactive(keys[j]))  /* SBR */
+                                       continue;
                                if (REVOKE(keys[j]))
                                        continue;
                                if (KSK(keys[j]))