From: Evan Hunt Date: Tue, 14 Aug 2012 05:24:36 +0000 (-0700) Subject: support '-' salt in rndc signing -nsec3param X-Git-Tag: v9.10.0a1~968 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=8f6d6d72e80314bd36c50f1805e424b6f6332cae;p=thirdparty%2Fbind9.git support '-' salt in rndc signing -nsec3param 3361. [bug] "rndc signing -nsec3param" didn't work correctly when salt was set to '-' (no salt). [RT #30099] --- diff --git a/CHANGES b/CHANGES index 9453c5088ec..a55037ce89b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,6 @@ +3361. [bug] "rndc signing -nsec3param" didn't work correctly + when salt was set to '-' (no salt). [RT #30099] + 3360. [bug] 'host -w' could die. [RT #18723] 3359. [bug] An improperly-formed TSIG secret could cause a diff --git a/bin/named/server.c b/bin/named/server.c index cb592dfffdf..e7573311857 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -8015,7 +8015,6 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) { memcpy(keystr, ptr, sizeof(keystr)); } else if(strcasecmp(ptr, "-nsec3param") == 0) { const char *hashstr, *flagstr, *iterstr; - isc_buffer_t buf; char nbuf[512]; chain = ISC_TRUE; @@ -8043,9 +8042,13 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t *text) { ptr = next_token(&args, " \t"); if (ptr == NULL) return (ISC_R_UNEXPECTEDEND); - isc_buffer_init(&buf, salt, sizeof(salt)); - CHECK(isc_hex_decodestring(ptr, &buf)); - saltlen = isc_buffer_usedlength(&buf); + if (strcmp(ptr, "-") != 0) { + isc_buffer_t buf; + + isc_buffer_init(&buf, salt, sizeof(salt)); + CHECK(isc_hex_decodestring(ptr, &buf)); + saltlen = isc_buffer_usedlength(&buf); + } } } else CHECK(DNS_R_SYNTAX); diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh index a38d17592a6..fe98a3a774a 100644 --- a/bin/tests/system/dnssec/clean.sh +++ b/bin/tests/system/dnssec/clean.sh @@ -60,6 +60,7 @@ rm -f signer/nsec3param.out rm -f ns3/ttlpatch.example.db ns3/ttlpatch.example.db.signed rm -f ns3/ttlpatch.example.db.patched rm -f ns3/split-smart.example.db +rm -f ns3/inline.example.db.signed rm -f ns3/lower.example.db ns3/upper.example.db ns3/upper.example.db.lower rm -f nosign.before rm -f signing.out* diff --git a/bin/tests/system/dnssec/ns3/inline.example.db b/bin/tests/system/dnssec/ns3/inline.example.db new file mode 100644 index 00000000000..036adc54cd2 --- /dev/null +++ b/bin/tests/system/dnssec/ns3/inline.example.db @@ -0,0 +1,32 @@ +; Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") +; Copyright (C) 2000, 2001 Internet Software Consortium. +; +; Permission to use, copy, modify, and/or distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +; PERFORMANCE OF THIS SOFTWARE. + +; $Id: insecure.example.db,v 1.9 2007/06/19 23:47:02 tbox Exp $ + +$TTL 300 ; 5 minutes +@ IN SOA mname1. . ( + 2000042407 ; serial + 20 ; refresh (20 seconds) + 20 ; retry (20 seconds) + 1814400 ; expire (3 weeks) + 3600 ; minimum (1 hour) + ) + NS ns +ns A 10.53.0.3 + +a A 10.0.0.1 +b A 10.0.0.2 +d A 10.0.0.4 +z A 10.0.0.26 diff --git a/bin/tests/system/dnssec/ns3/named.conf b/bin/tests/system/dnssec/ns3/named.conf index fac2e352d60..a23c6f872b9 100644 --- a/bin/tests/system/dnssec/ns3/named.conf +++ b/bin/tests/system/dnssec/ns3/named.conf @@ -255,4 +255,11 @@ zone "LOWER.EXAMPLE" { file "lower.example.db.signed"; }; +zone "inline.example" { + type master; + file "inline.example.db"; + inline-signing yes; + auto-dnssec maintain; +}; + include "trusted.conf"; diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh index d1c58b615de..728ab228461 100644 --- a/bin/tests/system/dnssec/ns3/sign.sh +++ b/bin/tests/system/dnssec/ns3/sign.sh @@ -429,3 +429,9 @@ $CHECKZONE -D nosign.example nosign.example.db.signed 2>&- | \ awk '$4 == "RRSIG" && $5 == "NS" {$2 = ""; print}' | \ sed 's/[ ][ ]*/ /g'> ../nosign.before +# +# An inline signing zone +# +zone=inline.example. +kskname=`$KEYGEN -q -3 -r $RANDFILE -fk $zone` +zskname=`$KEYGEN -q -3 -r $RANDFILE $zone` diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index 311c23cb023..5f2c06b2930 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -1481,7 +1481,42 @@ n=`expr $n + 1` if [ $ret != 0 ]; then echo "I:failed"; fi status=`expr $status + $ret` +echo "I:check that 'rndc signing -nsec3param' works with salt ($n)" +ret=0 +$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 signing -nsec3param 1 0 0 ffff inline.example > /dev/null 2>&1 || ret=1 +$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 status > /dev/null || ret=1 +for i in 1 2 3 4 5 6 7 8 9 10 ; do + salt=`$DIG $DIGOPTS +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}'` + if [ "$salt" = "FFFF" ]; then + break; + fi + echo "I:sleeping ...." + sleep 1 +done; +[ "$salt" = "FFFF" ] || ret=1 +n=`expr $n + 1` +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + +echo "I:check that 'rndc signing -nsec3param' works without salt ($n)" +ret=0 +$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 signing -nsec3param 1 0 0 - inline.example > /dev/null 2>&1 || ret=1 +$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 status > /dev/null || ret=1 +for i in 1 2 3 4 5 6 7 8 9 10 ; do + salt=`$DIG $DIGOPTS +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}'` + if [ "$salt" = "-" ]; then + break; + fi + echo "I:sleeping ...." + sleep 1 +done; +[ "$salt" = "-" ] || ret=1 +n=`expr $n + 1` +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + echo "I:check rndc signing -list output ($n)" +ret=0 $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 signing -list dynamic.example 2>&1 > signing.out grep "No signing records found" signing.out > /dev/null 2>&1 || { ret=1 diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index fdbc7010a66..fa8f2b74c64 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -1645,11 +1645,31 @@ zone "eng.example.com" { inline-signing zones. Parameters are specified in the same format as an NSEC3PARAM resource record: hash algorithm, - flags, iterations, salt. For example, to set an - NSEC3 chain using the SHA-1 hash algorithm, - no opt-out flag, 10 iterations, and a salt value - of "FFFF", use: - rndc signing -nsec3param 1 0 10 FFFF. + flags, iterations, and salt, in that order. + + + Currently, the only defined value for hash algorithm + is 1, representing SHA-1. + The may be set to + 0 or 1, + depending on whether you wish to set the opt-out + bit in the NSEC3 chain. + defines the number of additional times to apply + the algorithm when generating an NSEC3 hash. The + is a string of data expressed + in hexidecimal, or a hyphen (`-') if no salt is + to be used. + + + So, for example, to create an NSEC3 chain using + the SHA-1 hash algorithm, no opt-out flag, + 10 iterations, and a salt value of "FFFF", use: + rndc signing -nsec3param 1 0 10 FFFF <zone>. + To set the opt-out flag, 15 iterations, and no + salt, use: + rndc signing -nsec3param 1 1 15 - <zone>. + + rndc signing -nsec3param none removes an existing NSEC3 chain and replaces it with NSEC.