Check that excessive iterations in logged by named when

loading an existing zone or transfering from the primary.

(manually picked from commit 46eb21c546eb36362bafcefa65ee8650fe2de795)

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 51906e0d300456364cfd78dfca056bc46df5a9fe..a097ac848c72a434423ebc070f77825756b6f587 100644 (file)
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -176,8 +176,9 @@ static bool remove_orphansigs = false;
 static bool remove_inactkeysigs = false;
 static bool output_dnssec_only = false;
 static bool output_stdout = false;
-bool set_maxttl = false;
+static bool set_maxttl = false;
 static dns_ttl_t maxttl = 0;
+static bool no_max_check = false;
 
 #define INCSTAT(counter)               \
        if (printstats) {               \
@@ -3275,6 +3276,12 @@ main(int argc, char *argv[]) {
 
                case 'H':
                        set_iter = true;
+                       /* too-many is NOT DOCUMENTED */
+                       if (strcmp(isc_commandline_argument, "too-many") == 0) {
+                               nsec3iter = 151;
+                               no_max_check = true;
+                               break;
+                       }
                        nsec3iter = strtoul(isc_commandline_argument, &endp, 0);
                        if (*endp != '\0')
                                fatal("iterations must be numeric");
@@ -3698,10 +3705,17 @@ main(int argc, char *argv[]) {
                        fatal("NSEC3 generation requested with "
                              "NSEC-only DNSKEY");
 
-               if (nsec3iter > dns_nsec3_maxiterations())
-                       fatal("NSEC3 iterations too big for weakest DNSKEY "
-                             "strength. Maximum iterations allowed %u.",
-                             dns_nsec3_maxiterations());
+               if (nsec3iter > dns_nsec3_maxiterations()) {
+                       if (no_max_check) {
+                               fprintf(stderr,
+                                       "Ignoring max iterations check.\n");
+                       } else {
+                               fatal("NSEC3 iterations too big. Maximum "
+                                     "iterations allowed %u.",
+                                     dns_nsec3_maxiterations());
+                       }
+               }
+
        } else {
                hashlist_init(&hashlist, 0, 0); /* silence clang */
        }

diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index 1772470871ac57c13d8662e88018ab9307d0bc79..4a822d7b38651ad4d92e3cd2a613cd6c5720bb99 100644 (file)
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -25,6 +25,7 @@ rm -f ./canonical?.*
 rm -f ./delv.out*
 rm -f ./delve.out*
 rm -f ./dig.out.*
+rm -f ./ns2/too-many-iterations.db
 rm -f ./dnssectools.out*
 rm -f ./dsfromkey.out.*
 rm -f ./keygen.err

diff --git a/bin/tests/system/dnssec/ns1/root.db.in b/bin/tests/system/dnssec/ns1/root.db.in
index 8c5f3ed481fb27176253b6af883b67d800957713..04862387455be0e42b270469819821d97c06bd0d 100644 (file)
--- a/bin/tests/system/dnssec/ns1/root.db.in
+++ b/bin/tests/system/dnssec/ns1/root.db.in
@@ -33,3 +33,5 @@ ns6.optout-tld.               A       10.53.0.6
 in-addr.arpa.          NS      ns2.example.
 inprogress.            NS      ns10.inprogress.
 ns10.inprogress.       A       10.53.0.10
+too-many-iterations.   NS      ns2.too-many-iterations.
+ns2.too-many-iterations. A     10.53.0.2

diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index 47d9d1fe17194416a7ca013327cfc6775a04d5c6..f6741d559be1af04cb518ab76e37e879a640969a 100644 (file)
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -25,6 +25,7 @@ echo_i "ns1/sign.sh"
 cp ../ns2/dsset-example$TP .
 cp ../ns2/dsset-dlv$TP .
 cp ../ns2/dsset-in-addr.arpa$TP .
+cp ../ns2/dsset-too-many-iterations$TP .
 
 grep "$DEFAULT_ALGORITHM_NUMBER [12] " ../ns2/dsset-algroll$TP > dsset-algroll$TP
 cp ../ns6/dsset-optout-tld$TP .

diff --git a/bin/tests/system/dnssec/ns2/named.conf.in b/bin/tests/system/dnssec/ns2/named.conf.in
index 59eb72b884ffc2c768934eb14beab70cf9292d11..4b8f02665d84cdbaf7121d0ae7989aca24c9f4f6 100644 (file)
--- a/bin/tests/system/dnssec/ns2/named.conf.in
+++ b/bin/tests/system/dnssec/ns2/named.conf.in
@@ -168,4 +168,9 @@ zone "corp" {
        file "corp.db";
 };
 
+zone "too-many-iterations" {
+       type master;
+       file "too-many-iterations.db.signed";
+};
+
 include "trusted.conf";

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index e28b3f112ce2c22f3255a90d366f04cd5f093328..d4018238ffe12aabc91a0b73fa73621db9e0422f 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -291,3 +291,14 @@ $DSFROMKEY -C $key1.key > $key1.cds
 cat $infile $key1.key $key2.key $key1.cdnskey $key1.cds > $zonefile
 # Don't sign, let auto-dnssec maintain do it.
 mv $zonefile $zonefile.signed
+
+#
+# Negative result from this zone should come back as insecure.
+#
+zone=too-many-iterations
+infile=too-many-iterations.db.in
+zonefile=too-many-iterations.db
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
+"$SIGNER" -P -3 - -H too-many -g -o "$zone" "$zonefile" > /dev/null 2>&1

diff --git a/bin/tests/system/dnssec/ns2/too-many-iterations.db.in b/bin/tests/system/dnssec/ns2/too-many-iterations.db.in
new file mode 100644 (file)
index 0000000..43a2ebe
--- /dev/null
+++ b/bin/tests/system/dnssec/ns2/too-many-iterations.db.in
@@ -0,0 +1,25 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 30        ; 5 minutes
+@                      IN SOA  mname1. . (
+                               2000042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               30       ; minimum (1 hour)
+                               )
+                       NS      ns2
+ns2                    A       10.53.0.2
+ns3                    A       10.53.0.3
+
+a                      A       10.0.0.1
+*.a                    A       10.0.0.3
+b                      A       10.0.0.2
+d                      A       10.0.0.4

diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
index aaefe22c45f8db7018ad967b111c7eda8e5f9d04..708b8b0e62bedfef26034c9f90280c81cdd7cccf 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
@@ -333,6 +333,12 @@ zone "unsupported.trusted" {
        file "unsupported.trusted.db.signed";
 };
 
+zone "too-many-iterations" {
+       type slave;
+       masters { 10.53.0.2; };
+       file "too-many-iterations.bk";
+};
+
 include "siginterval.conf";
 
 include "trusted.conf";

diff --git a/bin/tests/system/dnssec/ns4/named4.conf.in b/bin/tests/system/dnssec/ns4/named4.conf.in
index 79457c6eaf41e4e18af7cf3bd274cf4b1ab85418..6a28eea0376d7f4f134a2321239023e0db30f8e6 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named4.conf.in
+++ b/bin/tests/system/dnssec/ns4/named4.conf.in
@@ -25,6 +25,7 @@ options {
        dnssec-validation auto;
        bindkeys-file "managed.conf";
        dnssec-accept-expired yes;
+       minimal-responses no;
 };
 
 key rndc_key {

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index aca472bf202d5848e3dc12fcb92080abfb257715..55226fb36dacb187855dc3c91ed0dcccdea03613 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -4058,5 +4058,13 @@ n=`expr $n + 1`
 test "$ret" -eq 0 || echo_i "failed"
 status=`expr $status + $ret`
 
+echo_i "checking excessive NSEC3 iteration warnings in named.run ($n)"
+ret=0
+grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 150" ns2/named.run >/dev/null 2>&1 || ret=1
+grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 150" ns3/named.run >/dev/null 2>&1 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/util/copyrights b/util/copyrights
index 7be17c5c29d1b4e04dd14914635681190d86a628..f829e3b06fca1c8b966df02ba4947fc00d39c519 100644 (file)
--- a/util/copyrights
+++ b/util/copyrights
@@ -1133,6 +1133,7 @@
 ./bin/tests/system/dnssec/ns2/sign.sh          SH      2000,2001,2002,2003,2004,2006,2007,2008,2009,2010,2011,2012,2014,2015,2016,2018,2019,2020,2021
 ./bin/tests/system/dnssec/ns2/single-nsec3.db.in       ZONE    2010,2016,2018,2019,2020,2021
 ./bin/tests/system/dnssec/ns2/template.secure.db.in    ZONE    2019,2020,2021
+./bin/tests/system/dnssec/ns2/too-many-iterations.db.in        ZONE    2021
 ./bin/tests/system/dnssec/ns3/auto-nsec.example.db.in  ZONE    2011,2016,2018,2019,2020,2021
 ./bin/tests/system/dnssec/ns3/auto-nsec3.example.db.in ZONE    2011,2016,2018,2019,2020,2021
 ./bin/tests/system/dnssec/ns3/bogus.example.db.in      ZONE    2000,2001,2004,2007,2014,2016,2018,2019,2020,2021