From: Evan Hunt Date: Fri, 13 Dec 2013 06:19:33 +0000 (-0800) Subject: [master] fix insecure delegation across static-stub zones X-Git-Tag: v9.10.0a2~164 X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=9b895f30f1734fd463a02b27cfd0cf36ec9893d5;p=thirdparty%2Fbind9.git [master] fix insecure delegation across static-stub zones 3689. [bug] Fixed a bug causing an insecure delegation from one static-stub zone to another to fail with a broken trust chain. [RT #35081] --- diff --git a/CHANGES b/CHANGES index 38acd889277..eea882c858e 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +3689. [bug] Fixed a bug causing an insecure delegation from one + static-stub zone to another to fail with a broken + trust chain. [RT #35081] + 3688. [bug] loadnode could return a freed node on out of memory. [RT #35106] diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in index 7be10442047..28200ef94d0 100644 --- a/bin/tests/system/dnssec/ns2/example.db.in +++ b/bin/tests/system/dnssec/ns2/example.db.in @@ -54,8 +54,8 @@ dname2 DNAME dname2-target foo.dname2-target TXT "testing dname" ; A secure subdomain -secure NS ns.secure -ns.secure A 10.53.0.3 +secure NS ns3.secure +ns3.secure A 10.53.0.3 ; An insecure subdomain insecure NS ns.insecure diff --git a/bin/tests/system/dnssec/ns2/insecure.secure.example.db b/bin/tests/system/dnssec/ns2/insecure.secure.example.db index f16a2cf8f68..3892f92fa82 100644 --- a/bin/tests/system/dnssec/ns2/insecure.secure.example.db +++ b/bin/tests/system/dnssec/ns2/insecure.secure.example.db @@ -13,8 +13,6 @@ ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR ; PERFORMANCE OF THIS SOFTWARE. -; $Id: insecure.secure.example.db,v 1.9 2007/06/19 23:47:02 tbox Exp $ - $TTL 300 ; 5 minutes @ IN SOA mname1. . ( 2000042407 ; serial @@ -23,8 +21,8 @@ $TTL 300 ; 5 minutes 1814400 ; expire (3 weeks) 3600 ; minimum (1 hour) ) - NS ns -ns A 10.53.0.3 + NS ns2 +ns2 A 10.53.0.2 a A 10.0.0.1 b A 10.0.0.2 diff --git a/bin/tests/system/dnssec/ns3/secure.example.db.in b/bin/tests/system/dnssec/ns3/secure.example.db.in index c9de3e5b6d1..1e757ae408d 100644 --- a/bin/tests/system/dnssec/ns3/secure.example.db.in +++ b/bin/tests/system/dnssec/ns3/secure.example.db.in @@ -13,8 +13,6 @@ ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR ; PERFORMANCE OF THIS SOFTWARE. -; $Id: secure.example.db.in,v 1.16 2010/07/15 01:17:45 jinmei Exp $ - $TTL 300 ; 5 minutes @ IN SOA mname1. . ( 2000042407 ; serial @@ -23,8 +21,8 @@ $TTL 300 ; 5 minutes 1814400 ; expire (3 weeks) 3600 ; minimum (1 hour) ) - NS ns -ns A 10.53.0.3 + NS ns3 +ns3 A 10.53.0.3 a A 10.0.0.1 b A 10.0.0.2 @@ -36,8 +34,8 @@ x CNAME a private NS ns.private ns.private A 10.53.0.2 -insecure NS ns.insecure -ns.insecure A 10.53.0.2 +insecure NS ns2.insecure +ns2.insecure A 10.53.0.2 nosoa NS ns.nosoa ns.nosoa A 10.53.0.7 diff --git a/bin/tests/system/dnssec/ns4/named4.conf b/bin/tests/system/dnssec/ns4/named4.conf new file mode 100644 index 00000000000..1afde2d6a99 --- /dev/null +++ b/bin/tests/system/dnssec/ns4/named4.conf @@ -0,0 +1,83 @@ +/* + * Copyright (C) 2013 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +// NS4 + +controls { /* empty */ }; + +options { + query-source address 10.53.0.4; + notify-source 10.53.0.4; + transfer-source 10.53.0.4; + port 5300; + pid-file "named.pid"; + listen-on { 10.53.0.4; }; + listen-on-v6 { none; }; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; + +controls { + inet 10.53.0.4 port 9953 allow { any; } keys { rndc_key; }; +}; + +key auth { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; + +include "trusted.conf"; + +view rec { + match-recursive-only yes; + recursion yes; + acache-enable yes; + dnssec-validation yes; + dnssec-accept-expired yes; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone secure.example { + type static-stub; + server-addresses { 10.53.0.4; }; + }; + + zone insecure.secure.example { + type static-stub; + server-addresses { 10.53.0.4; }; + }; +}; + +view auth { + recursion no; + allow-recursion { none; }; + + zone secure.example { + type slave; + masters { 10.53.0.3; }; + }; + + zone insecure.secure.example { + type slave; + masters { 10.53.0.2; }; + }; +}; diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh index 9ec9fd47343..b19e3d7b853 100644 --- a/bin/tests/system/dnssec/tests.sh +++ b/bin/tests/system/dnssec/tests.sh @@ -2371,5 +2371,21 @@ n=`expr $n + 1` if test "$before" = "$after" ; then echo "I:failed"; ret=1; fi status=`expr $status + $ret` +cp ns4/named4.conf ns4/named.conf +$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 reconfig 2>&1 | sed 's/^/I:ns4 /' +sleep 3 + +echo "I:check insecure delegation between static-stub zones ($n)" +ret=0 +$DIG $DIGOPTS ns insecure.secure.example \ + @10.53.0.4 > dig.out.ns4.1.test$n || ret=1 +grep "SERVFAIL" dig.out.ns4.1.test$n > /dev/null && ret=1 +$DIG $DIGOPTS ns secure.example \ + @10.53.0.4 > dig.out.ns4.2.test$n || ret=1 +grep "SERVFAIL" dig.out.ns4.2.test$n > /dev/null && ret=1 +n=`expr $n + 1` +if [ $ret != 0 ]; then echo "I:failed"; fi +status=`expr $status + $ret` + echo "I:exit status: $status" exit $status diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index 8b6872fe465..6df7e561a4f 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -3747,12 +3747,14 @@ fctx_create(dns_resolver_t *res, dns_name_t *name, dns_rdatatype_t type, */ if (dns_rdatatype_atparent(fctx->type)) findoptions |= DNS_DBFIND_NOEXACT; - result = dns_view_findzonecut(res->view, name, domain, - 0, findoptions, ISC_TRUE, + result = dns_view_findzonecut(res->view, fwdname, + domain, 0, findoptions, + ISC_TRUE, &fctx->nameservers, NULL); if (result != ISC_R_SUCCESS) goto cleanup_name; + result = dns_name_dup(domain, mctx, &fctx->domain); if (result != ISC_R_SUCCESS) { dns_rdataset_disassociate(&fctx->nameservers); @@ -7477,9 +7479,12 @@ resquery_response(isc_task_t *task, isc_event_t *event) { * NXDOMAIN, NXRDATASET, or referral. */ result = noanswer_response(fctx, NULL, 0); - if (result == DNS_R_CHASEDSSERVERS) { - } else if (result == DNS_R_DELEGATION) { - force_referral: + switch (result) { + case ISC_R_SUCCESS: + case DNS_R_CHASEDSSERVERS: + break; + case DNS_R_DELEGATION: + force_referral: /* * We don't have the answer, but we know a better * place to look. @@ -7504,7 +7509,8 @@ resquery_response(isc_task_t *task, isc_event_t *event) { fctx->adberr = 0; result = ISC_R_SUCCESS; - } else if (result != ISC_R_SUCCESS) { + break; + default: /* * Something has gone wrong. */