4839. [bug] zone.c:zone_sign was not properly determining

                        if there were active KSK and ZSK keys for
                        a algorithm when update-check-ksk is true
                        (default) leaving records unsigned with one or
                        more DNSKEY algorithms. [RT #46774]

(cherry picked from commit 00f5ea91cf6d3897f24efb2ba097bda1df24082f)

diff --git a/CHANGES b/CHANGES
index e509e164a3425b3034148b4455575f5f4b4e086f..58439606a315eced5d80bc72a34784e6a5f8c7e1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+4839.  [bug]           zone.c:zone_sign was not properly determining
+                        if there were active KSK and ZSK keys for
+                        a algorithm when update-check-ksk is true
+                        (default) leaving records unsigned with one or
+                        more DNSKEY algorithms. [RT #46774]
+
 4838.  [bug]           zone.c:add_sigs was not properly determining
                        if there were active KSK and ZSK keys for
                        a algorithm when update-check-ksk is true

diff --git a/bin/tests/system/autosign/clean.sh b/bin/tests/system/autosign/clean.sh
index 887b661ed284468b646d1ff85011350d7f21d927..199a99d529131e17c04c7348be48042e957cee97 100644 (file)
--- a/bin/tests/system/autosign/clean.sh
+++ b/bin/tests/system/autosign/clean.sh
@@ -28,6 +28,7 @@ rm -f ns3/*.nzd ns3/*.nzd-lock ns3/*.nzf
 rm -f ns3/*.nzf
 rm -f ns3/autonsec3.example.db
 rm -f ns3/inaczsk2.example.db
+rm -f ns3/inaczsk3.example.db
 rm -f ns3/kg.out ns3/s.out ns3/st.out
 rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
 rm -f ns3/nsec.example.db

diff --git a/bin/tests/system/autosign/ns3/inaczsk3.example.db.in b/bin/tests/system/autosign/ns3/inaczsk3.example.db.in
new file mode 100644 (file)
index 0000000..8a7f25c
--- /dev/null
+++ b/bin/tests/system/autosign/ns3/inaczsk3.example.db.in
@@ -0,0 +1,21 @@
+; Copyright (C) 2017  Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+$TTL 300       ; 5 minutes
+@                      IN SOA  mname1. . (
+                               1          ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns
+ns                     A       10.53.0.3
+
+a                      A       10.0.0.1
+b                      A       10.0.0.2
+d                      A       10.0.0.4
+x                      CNAME   a

diff --git a/bin/tests/system/autosign/ns3/keygen.sh b/bin/tests/system/autosign/ns3/keygen.sh
index a6ed5ef71f5bd4578d2c15bcc4805e49259e516b..4f2cf35e7781b5ac868892bad13338a619d08af7 100644 (file)
--- a/bin/tests/system/autosign/ns3/keygen.sh
+++ b/bin/tests/system/autosign/ns3/keygen.sh
@@ -273,3 +273,14 @@ cp $infile $zonefile
 ksk=`$KEYGEN -a NSEC3RSASHA1 -b 1024 -3 -q -r $RANDFILE -fk $zone 2> kg.out` || dumpit kg.out
 $KEYGEN -a NSEC3RSASHA1 -b 1024 -3 -q -r $RANDFILE -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
 $DSFROMKEY $ksk.key > dsset-${zone}$TP
+
+#
+#  A zone that starts with a active KSK + ZSK and a inactive ZSK which becomes
+#  a zone with a active KSK and a inactive ZSK after 20 seconds.
+#
+setup inaczsk3.example
+cp $infile $zonefile
+ksk=`$KEYGEN -a NSEC3RSASHA1 -3 -q -r $RANDFILE -fk $zone 2> kg.out` || dumpit kg.out
+$KEYGEN -a NSEC3RSASHA1 -3 -q -r $RANDFILE -D now+20 $zone > kg.out 2>&1 || dumpit kg.out
+$KEYGEN -a NSEC3RSASHA1 -3 -q -r $RANDFILE -P now -A now+3600 $zone > kg.out 2>&1 || dumpit kg.out
+$DSFROMKEY $ksk.key > dsset-${zone}$TP

diff --git a/bin/tests/system/autosign/ns3/named.conf b/bin/tests/system/autosign/ns3/named.conf
index 77090f81ec172c732a79b31623098e8ac605aedc..67739e34b65d7909cb3731f556f12bce0247c0c1 100644 (file)
--- a/bin/tests/system/autosign/ns3/named.conf
+++ b/bin/tests/system/autosign/ns3/named.conf
@@ -250,4 +250,11 @@ zone "inaczsk2.example" {
        auto-dnssec maintain;
 };
 
+zone "inaczsk3.example" {
+       type master;
+       file "inaczsk3.example.db";
+       allow-update { any; };
+       auto-dnssec maintain;
+};
+
 include "trusted.conf";

diff --git a/bin/tests/system/autosign/tests.sh b/bin/tests/system/autosign/tests.sh
index c800b4ddcbbadff9d476355b5c38da035321fa82..5b10f4638d013b66662aaa0c77dfbb731ec4f314 100644 (file)
--- a/bin/tests/system/autosign/tests.sh
+++ b/bin/tests/system/autosign/tests.sh
@@ -72,7 +72,7 @@ do
                $DIG $DIGOPTS $z @10.53.0.2 nsec > dig.out.ns2.test$n || ret=1
                grep "NS SOA" dig.out.ns2.test$n > /dev/null || ret=1
        done
-       for z in bar. example. inaczsk2.example.
+       for z in bar. example. inaczsk2.example. inaczsk3.example
        do 
                $DIG $DIGOPTS $z @10.53.0.3 nsec > dig.out.ns3.test$n || ret=1
                grep "NS SOA" dig.out.ns3.test$n > /dev/null || ret=1
@@ -86,6 +86,28 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; else echo "I:done"; fi
 status=`expr $status + $ret`
 
+#
+# Check that zone is initially signed with a ZSK and not a KSK.
+#
+echo "I:check that zone with active and inactive ZSK and active KSK is properly resigned after the active ZSK is deleted - stage 1 ($n)"
+ret=0
+$DIG  $DIGOPTS @10.53.0.3 axfr inaczsk3.example > dig.out.ns3.test$n
+kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
+       $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' `
+grep "CNAME 7 3 " dig.out.ns3.test$n > /dev/null || ret=1
+grep "CNAME 7 3 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null && ret=1
+count=`awk 'BEGIN { count = 0 }
+           $4 == "RRSIG" && $5 == "CNAME" { count++ }
+           END {print count}' dig.out.ns3.test$n`
+test $count -eq 1 || ret=1
+count=`awk 'BEGIN { count = 0 }
+       $4 == "DNSKEY" { count++ }
+       END {print count}' dig.out.ns3.test$n`
+test $count -eq 3 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:checking NSEC->NSEC3 conversion prerequisites ($n)"
 ret=0
 # these commands should result in an empty file:
@@ -1214,5 +1236,26 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+#
+# Check that zone is now signed with the KSK.
+#
+echo "I:check that zone with active and inactive ZSK and active KSK is properly resigned after the active ZSK is deleted - stage 2 ($n)"
+ret=0
+$DIG  $DIGOPTS @10.53.0.3 axfr inaczsk3.example > dig.out.ns3.test$n
+kskid=`awk '$4 == "DNSKEY" && $5 == 257 { print }' dig.out.ns3.test$n |
+       $DSFROMKEY -2 -f - inaczsk3.example | awk '{ print $4}' `
+grep "CNAME 7 3 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null || ret=1
+count=`awk 'BEGIN { count = 0 }
+       $4 == "RRSIG" && $5 == "CNAME" { count++ }
+       END {print count}' dig.out.ns3.test$n`
+test $count -eq 1 || ret=1
+count=`awk 'BEGIN { count = 0 }
+       $4 == "DNSKEY" { count++ }
+       END {print count}' dig.out.ns3.test$n`
+test $count -eq 2 || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index bf45788520a82bd68d4c8ee3a060efd2928ddb57..e32a2ae73507b8f846e459b2c74d381673c84d6e 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -8466,6 +8466,11 @@ zone_sign(dns_zone_t *zone) {
                         */
                        if (!dst_key_isprivate(zone_keys[i]))
                                continue;
+                       /*
+                        * Should be redundant.
+                        */
+                       if (dst_key_inactive(zone_keys[i]))
+                               continue;
 
                        /*
                         * When adding look for the specific key.
@@ -8500,6 +8505,13 @@ zone_sign(dns_zone_t *zone) {
                                            ALG(zone_keys[i]) !=
                                            ALG(zone_keys[j]))
                                                continue;
+                                       if (!dst_key_isprivate(zone_keys[j]))
+                                               continue;
+                                       /*
+                                        * Should be redundant.
+                                        */
+                                       if (dst_key_inactive(zone_keys[j]))
+                                               continue;
                                        if (REVOKE(zone_keys[j]))
                                                continue;
                                        if (KSK(zone_keys[j]))