[master] fixed revoked key regression

4436.	[bug]		Fixed a regression introduced in change #4337 which
			caused signed domains with revoked KSKs to fail
			validation. [RT #42147]

diff --git a/CHANGES b/CHANGES
index 6a6ada48f203053bf4e55212b350ec319b1ea3b2..98ec8470dd4dcb762353b629f2113b15422dc1b9 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+4436.  [bug]           Fixed a regression introduced in change #4337 which
+                       caused signed domains with revoked KSKs to fail
+                       validation. [RT #42147]
+
 4345.  [contrib]       perftcpdns mishandled the return values from
                        clock_nanosleep. [RT #42131]
 

diff --git a/bin/tests/system/dnssec/clean.sh b/bin/tests/system/dnssec/clean.sh
index c4b3f3794e56a455c140aa740fd45ad2e50a69b4..dbab82ac3c25a6f0ecf80b2237746792f2d9e6d8 100644 (file)
--- a/bin/tests/system/dnssec/clean.sh
+++ b/bin/tests/system/dnssec/clean.sh
@@ -77,6 +77,7 @@ rm -f ns3/split-smart.example.db
 rm -f ns3/ttlpatch.example.db ns3/ttlpatch.example.db.signed
 rm -f ns3/ttlpatch.example.db.patched
 rm -f ns3/unsecure.example.db ns3/bogus.example.db ns3/keyless.example.db
+rm -f ns3/revkey.example.db
 rm -f ns3/managed-future.example.db
 rm -f ns4/managed-keys.bind*
 rm -f ns4/named.conf

diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in
index 8b6925cdb08b9555da4fc49e7c8e7053333d923b..3e89508eeb2ea248e08bbb686e56530d0665e902 100644 (file)
--- a/bin/tests/system/dnssec/ns2/example.db.in
+++ b/bin/tests/system/dnssec/ns2/example.db.in
@@ -163,3 +163,6 @@ ns.future           A       10.53.0.3
 
 managed-future         NS      ns.managed-future
 ns.managed-future      A       10.53.0.3
+
+revkey                 NS      ns.revkey
+ns.revkey              A       10.53.0.3

diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh
index 3bcc812ce4342e7228a3e055ae8e62eaf5122c5e..1fbee7065b9af2ad7b26dc1ab9cade6968786325 100644 (file)
--- a/bin/tests/system/dnssec/ns2/sign.sh
+++ b/bin/tests/system/dnssec/ns2/sign.sh
@@ -30,7 +30,7 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \
        nsec3-unknown optout-unknown multiple rsasha256 rsasha512 \
        kskonly update-nsec3 auto-nsec auto-nsec3 secure.below-cname \
        ttlpatch split-dnssec split-smart expired expiring upper lower \
-       dnskey-unknown dnskey-nsec3-unknown managed-future
+       dnskey-unknown dnskey-nsec3-unknown managed-future revkey
 do
        cp ../ns3/dsset-$subdomain.example. .
 done

diff --git a/bin/tests/system/dnssec/ns3/keyless.example.db.in b/bin/tests/system/dnssec/ns3/generic.example.db.in
similarity index 94%
rename from bin/tests/system/dnssec/ns3/keyless.example.db.in
rename to bin/tests/system/dnssec/ns3/generic.example.db.in
index e2d1ffa95e2367ac89ff1e701ed01a09cc659d4e..3a7165d2526b1b6782918f463a7051738778b077 100644 (file)
--- a/bin/tests/system/dnssec/ns3/keyless.example.db.in
+++ b/bin/tests/system/dnssec/ns3/generic.example.db.in
@@ -13,8 +13,6 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: keyless.example.db.in,v 1.5 2007/06/19 23:47:02 tbox Exp $
-
 $TTL 300       ; 5 minutes
 @                      IN SOA  mname1. . (
                                2000042407 ; serial

diff --git a/bin/tests/system/dnssec/ns3/named.conf b/bin/tests/system/dnssec/ns3/named.conf
index b0ad225141149d3442f5542b8ee63b4f6152dc50..9eb63c85e19ba27a3f98786b3f3c2df65feb1e2f 100644 (file)
--- a/bin/tests/system/dnssec/ns3/named.conf
+++ b/bin/tests/system/dnssec/ns3/named.conf
@@ -298,6 +298,11 @@ zone "managed-future.example" {
        allow-update { any; };
 };
 
+zone "revkey.example" {
+       type master;
+       file "revkey.example.db.signed";
+};
+
 include "siginterval.conf";
 
 include "trusted.conf";

diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh
index 7aaec718b9bac80fe9a97042c3d19abf21c2e728..7f0b3cce247edad2db6b70d1084ec3e93d255926 100644 (file)
--- a/bin/tests/system/dnssec/ns3/sign.sh
+++ b/bin/tests/system/dnssec/ns3/sign.sh
@@ -52,7 +52,7 @@ cat $infile $keyname1.key $keyname2.key >$zonefile
 $SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
 
 zone=keyless.example.
-infile=keyless.example.db.in
+infile=generic.example.db.in
 zonefile=keyless.example.db
 
 keyname=`$KEYGEN -q -r $RANDFILE -a RSAMD5 -b 768 -n zone $zone`
@@ -531,3 +531,19 @@ kskname=`$KEYGEN -q -r $RANDFILE -f KSK $zone`
 zskname=`$KEYGEN -q -r $RANDFILE $zone`
 cat $infile $kskname.key $zskname.key >$zonefile
 $SIGNER -P -s +3600 -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1
+
+#
+# A zone with a revoked key
+#
+zone=revkey.example.
+infile=generic.example.db.in
+zonefile=revkey.example.db
+
+ksk1=`$KEYGEN -q -r $RANDFILE -3fk $zone`
+ksk1=`$REVOKE $ksk1`
+ksk2=`$KEYGEN -q -r $RANDFILE -3fk $zone`
+zsk1=`$KEYGEN -q -r $RANDFILE -3 $zone`
+
+cat $infile ${ksk1}.key ${ksk2}.key ${zsk1}.key >$zonefile
+
+$SIGNER -P -r $RANDFILE -o $zone $zonefile > /dev/null 2>&1

diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh
index eff2cc1d03907ddc096d0ba0214c7cd8fcaa9961..5e9a079a2d7dbb7ffcc5cd71530c1d2eaa77f254 100644 (file)
--- a/bin/tests/system/dnssec/tests.sh
+++ b/bin/tests/system/dnssec/tests.sh
@@ -872,6 +872,25 @@ if [ -x ${DELV} ] ; then
    status=`expr $status + $ret`
 fi
 
+echo "I:checking that validation succeeds when a revoked key is encountered ($n)"
+ret=0
+$DIG $DIGOPTS revkey.example soa @10.53.0.4 > dig.out.ns4.test$n || ret=1
+grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
+grep "flags: .* ad" dig.out.ns4.test$n > /dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
+if [ -x ${DELV} ] ; then
+   ret=0
+   echo "I:checking that validation succeeds when a revoked key is encountered using dns_client ($n)"
+   $DELV $DELVOPTS +cd @10.53.0.4 soa revkey.example > delv.out$n 2>&1 || ret=1
+   grep "fully validated" delv.out$n > /dev/null || ret=1
+   n=`expr $n + 1`
+   if [ $ret != 0 ]; then echo "I:failed"; fi
+   status=`expr $status + $ret`
+fi
+
 echo "I:Checking that a bad CNAME signature is caught after a +CD query ($n)"
 ret=0
 #prime

diff --git a/lib/dns/view.c b/lib/dns/view.c
index e7a4998229c286fca2f02b644765932bfe376c74..67dcf711250d8c773a6ec99db0b2f3aeb8c6661a 100644 (file)
--- a/lib/dns/view.c
+++ b/lib/dns/view.c
@@ -1931,15 +1931,29 @@ dns_view_untrust(dns_view_t *view, dns_name_t *keyname,
        isc_buffer_init(&buffer, data, sizeof(data));
        dns_rdata_fromstruct(&rdata, dnskey->common.rdclass,
                             dns_rdatatype_dnskey, dnskey, &buffer);
+
        result = dns_dnssec_keyfromrdata(keyname, &rdata, mctx, &key);
        if (result != ISC_R_SUCCESS)
                return;
+
        result = dns_view_getsecroots(view, &sr);
        if (result == ISC_R_SUCCESS) {
-               dns_keytable_deletekeynode(sr, key);
-               dns_keytable_marksecure(sr, keyname);
+               result = dns_keytable_deletekeynode(sr, key);
+
+               /*
+                * If key was found in secroots, then it was a
+                * configured trust anchor, and we want to fail
+                * secure. If there are no other configured keys,
+                * then leave a null key so that we can't validate
+                * anymore.
+                */
+
+               if (result == ISC_R_SUCCESS)
+                       dns_keytable_marksecure(sr, keyname);
+
                dns_keytable_detach(&sr);
        }
+
        dst_key_free(&key);
 }