Check that excessive iterations in logged by named when

loading an existing zone or transfering from the primary.

(cherry picked from commit 46eb21c546eb36362bafcefa65ee8650fe2de795)

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 083f30b6a1b30312bbf2c58f463e4646668438fd..66341b5d2c2b22e2a87b62de936fdf6de2a12a9c 100644 (file)
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -176,8 +176,9 @@ static bool remove_orphansigs = false;
 static bool remove_inactkeysigs = false;
 static bool output_dnssec_only = false;
 static bool output_stdout = false;
-bool set_maxttl = false;
+static bool set_maxttl = false;
 static dns_ttl_t maxttl = 0;
+static bool no_max_check = false;
 
 #define INCSTAT(counter)            \
        if (printstats) {           \
@@ -3437,6 +3438,12 @@ main(int argc, char *argv[]) {
 
                case 'H':
                        set_iter = true;
+                       /* too-many is NOT DOCUMENTED */
+                       if (strcmp(isc_commandline_argument, "too-many") == 0) {
+                               nsec3iter = 151;
+                               no_max_check = true;
+                               break;
+                       }
                        nsec3iter = strtoul(isc_commandline_argument, &endp, 0);
                        if (*endp != '\0') {
                                fatal("iterations must be numeric");
@@ -3874,9 +3881,14 @@ main(int argc, char *argv[]) {
                }
 
                if (nsec3iter > dns_nsec3_maxiterations()) {
-                       fatal("NSEC3 iterations too big for weakest DNSKEY "
-                             "strength. Maximum iterations allowed %u.",
-                             dns_nsec3_maxiterations());
+                       if (no_max_check) {
+                               fprintf(stderr,
+                                       "Ignoring max iterations check.\n");
+                       } else {
+                               fatal("NSEC3 iterations too big. Maximum "
+                                     "iterations allowed %u.",
+                                     dns_nsec3_maxiterations());
+                       }
                }
        } else {
                hashlist_init(&hashlist, 0, 0); /* silence clang */

diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index e660c3349d51a33cf239cb51545dc87bfc68a5da..adcb52f7d2df131a2ab2ffbd2ba37a22d664bfc8 100644 (file)
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -25,6 +25,7 @@ rm -f ./canonical?.*
 rm -f ./delv.out*
 rm -f ./delve.out*
 rm -f ./dig.out.*
+rm -f ./ns2/too-many-iterations.db
 rm -f ./dnssectools.out*
 rm -f ./dsfromkey.out.*
 rm -f ./keygen.err

diff --git a/bin/tests/system/dnssec/ns1/root.db.in b/bin/tests/system/dnssec/ns1/root.db.in
index 09855f7d20453f91758aa975183110a5106de9a6..9c1296e89940731f563c24762b77dbddd553b702 100644 (file)
--- a/bin/tests/system/dnssec/ns1/root.db.in
+++ b/bin/tests/system/dnssec/ns1/root.db.in
@@ -31,3 +31,5 @@ ns6.optout-tld.               A       10.53.0.6
 in-addr.arpa.          NS      ns2.example.
 inprogress.            NS      ns10.inprogress.
 ns10.inprogress.       A       10.53.0.10
+too-many-iterations.   NS      ns2.too-many-iterations.
+ns2.too-many-iterations.       A       10.53.0.2

diff --git a/bin/tests/system/dnssec/ns1/sign.sh b/bin/tests/system/dnssec/ns1/sign.sh
index 95888aed806926bba2cc73fea089536742afe878..dd5385e530829b1a6627a7221829c8204ba5831c 100644 (file)
--- a/bin/tests/system/dnssec/ns1/sign.sh
+++ b/bin/tests/system/dnssec/ns1/sign.sh
@@ -26,6 +26,7 @@ echo_i "ns1/sign.sh"
 
 cp "../ns2/dsset-example$TP" .
 cp "../ns2/dsset-in-addr.arpa$TP" .
+cp "../ns2/dsset-too-many-iterations$TP" .
 
 grep "$DEFAULT_ALGORITHM_NUMBER [12] " "../ns2/dsset-algroll$TP" > "dsset-algroll$TP"
 cp "../ns6/dsset-optout-tld$TP" .

diff --git a/bin/tests/system/dnssec/ns2/named.conf.in b/bin/tests/system/dnssec/ns2/named.conf.in
index 4b75918a56dba692d419d2b48aa80c56fd72ff9c..3928ec03adb0215d0f9391013c925b48103acdff 100644 (file)
--- a/bin/tests/system/dnssec/ns2/named.conf.in
+++ b/bin/tests/system/dnssec/ns2/named.conf.in
@@ -191,4 +191,9 @@ zone "hours-vs-days" {
        allow-update { any; };
 };
 
+zone "too-many-iterations" {
+       type master;
+       file "too-many-iterations.db.signed";
+};
+
 include "trusted.conf";

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index b255d37c2be05fb1e33e8bfd18d1b2ceb66c65da..e8b255bfadb389a1b601de1f74638fff84c54937 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -318,3 +318,14 @@ key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$
 key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
 $SETTIME -P sync now "$key1" > /dev/null
 cat "$infile" > "$zonefile.signed"
+
+#
+# Negative result from this zone should come back as insecure.
+#
+zone=too-many-iterations
+infile=too-many-iterations.db.in
+zonefile=too-many-iterations.db
+key1=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone -f KSK "$zone")
+key2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone")
+cat "$infile" "$key1.key" "$key2.key" > "$zonefile"
+"$SIGNER" -P -3 - -H too-many -g -o "$zone" "$zonefile" > /dev/null 2>&1

diff --git a/bin/tests/system/dnssec/ns2/too-many-iterations.db.in b/bin/tests/system/dnssec/ns2/too-many-iterations.db.in
new file mode 100644 (file)
index 0000000..e6f502f
--- /dev/null
+++ b/bin/tests/system/dnssec/ns2/too-many-iterations.db.in
@@ -0,0 +1,25 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 30        ; 5 minutes
+@                      IN SOA  mname1. . (
+                               2000042407 ; serial
+                               20         ; refresh (20 seconds)
+                               20         ; retry (20 seconds)
+                               1814400    ; expire (3 weeks)
+                               30       ; minimum (1 hour)
+                               )
+                       NS      ns2
+ns2                    A       10.53.0.2
+ns3                    A       10.53.0.3
+
+a                      A       10.0.0.1
+*.a                    A       10.0.0.3
+b                      A       10.0.0.2
+d                      A       10.0.0.4

diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in
index 196a13dd4e764d5b6006028c5272fa1dd49e9147..233db0cc91d933236646fd21070f24b79dcdf7ff 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf.in
+++ b/bin/tests/system/dnssec/ns3/named.conf.in
@@ -363,6 +363,12 @@ zone "revoked.trusted" {
        file "revoked.trusted.db.signed";
 };
 
+zone "too-many-iterations" {
+       type secondary;
+       primaries { 10.53.0.2; };
+       file "too-many-iterations.bk";
+};
+
 include "siginterval.conf";
 
 include "trusted.conf";

diff --git a/bin/tests/system/dnssec/ns4/named4.conf.in b/bin/tests/system/dnssec/ns4/named4.conf.in
index 77590b30f3410164ef5754f678d3d7c4b98d4f8d..6e5b40a8300cb253b5e29f372a61fd69d5b92d55 100644 (file)
--- a/bin/tests/system/dnssec/ns4/named4.conf.in
+++ b/bin/tests/system/dnssec/ns4/named4.conf.in
@@ -42,6 +42,7 @@ view rec {
        recursion yes;
        dnssec-validation yes;
        dnssec-accept-expired yes;
+       minimal-responses no;
 
        zone "." {
                type hint;

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index 7c6569570592b2e08af2ebb63d9b040dea4a4d61..51d42edd6020fd44c38c28d61b87a4bb689ac682 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -4306,5 +4306,13 @@ n=$((n+1))
 test "$ret" -eq 0 || echo_i "failed"
 status=$((status+ret))
 
+echo_i "checking excessive NSEC3 iteration warnings in named.run ($n)"
+ret=0
+grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 150" ns2/named.run >/dev/null 2>&1 || ret=1
+grep "zone too-many-iterations/IN: excessive NSEC3PARAM iterations [0-9]* > 150" ns3/named.run >/dev/null 2>&1 || ret=1
+n=$((n+1))
+test "$ret" -eq 0 || echo_i "failed"
+status=$((status+ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1