upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-04-20 21:58:03 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/tests/dns/keytable_test.c

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

706 lines
20 KiB
C
Raw Normal View History

[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/*
[master] copyrights
2017-10-12 00:11:37 -04:00
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
*
* SPDX-License-Identifier: MPL-2.0
Update the copyright information in all files in the repository This commit converts the license handling to adhere to the REUSE specification. It specifically: 1. Adds used licnses to LICENSES/ directory 2. Add "isc" template for adding the copyright boilerplate 3. Changes all source files to include copyright and SPDX license header, this includes all the C sources, documentation, zone files, configuration files. There are notes in the doc/dev/copyrights file on how to add correct headers to the new files. 4. Handle the rest that can't be modified via .reuse/dep5 file. The binary (or otherwise unmodifiable) files could have license places next to them in <foo>.license file, but this would lead to cluttered repository and most of the files handled in the .reuse/dep5 file are system test files.
2021-06-03 02:37:05 -04:00
*
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
Update license headers to not include years in copyright in all applicable files
2018-02-23 03:53:12 -05:00
*
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
Include <sched.h> where necessary for musl libc All unit tests define the UNIT_TESTING macro, which causes <cmocka.h> to replace malloc(), calloc(), realloc(), and free() with its own functions tracking memory allocations. In order for this not to break compilation, the system header declaring the prototypes for these standard functions must be included before <cmocka.h>. Normally, these prototypes are only present in <stdlib.h>, so we make sure it is included before <cmocka.h>. However, musl libc also defines the prototypes for calloc() and free() in <sched.h>, which is included by <pthread.h>, which is included e.g. by <isc/mutex.h>. Thus, unit tests including "dnstest.h" (which includes <isc/mem.h>, which includes <isc/mutex.h>) after <cmocka.h> will not compile with musl libc as for these programs, <sched.h> will be included after <cmocka.h>. Always including <cmocka.h> after all other header files is not a feasible solution as that causes the mock assertion macros defined in <isc/util.h> to mangle the contents of <cmocka.h>, thus breaking compilation. We cannot really use the __noreturn__ or analyzer_noreturn attributes with cmocka assertion functions because they do return if the tested condition is true. The problem is that what BIND unit tests do is incompatible with Clang Static Analyzer's assumptions: since we use cmocka, our custom assertion handlers are present in a shared library (i.e. it is the cmocka library that checks the assertion condition, not a macro in unit test code). Redefining cmocka's assertion macros in <isc/util.h> is an ugly hack to overcome that problem - unfortunately, this is the only way we can think of to make Clang Static Analyzer properly process unit test code. Giving up on Clang Static Analyzer being able to properly process unit test code is not a satisfactory solution. Undefining _GNU_SOURCE for unit test code could work around the problem (musl libc's <sched.h> only defines the prototypes for calloc() and free() when _GNU_SOURCE is defined), but doing that could introduce discrepancies for unit tests including entire *.c files, so it is also not a good solution. All in all, including <sched.h> before <cmocka.h> for all affected unit tests seems to be the most benign way of working around this musl libc quirk. While quite an ugly solution, it achieves our goals here, which are to keep the benefit of proper static analysis of unit test code and to fix compilation against musl libc.
2019-07-30 15:08:40 -04:00
#include <inttypes.h>
#include <sched.h> /* IWYU pragma: keep */
convert keytable_test
2018-11-14 06:50:53 -05:00
#include <setjmp.h>
#include <stdarg.h>
Replace custom isc_boolean_t with C standard bool type
2018-04-17 11:29:14 -04:00
#include <stdbool.h>
convert keytable_test
2018-11-14 06:50:53 -05:00
#include <stddef.h>
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
#include <stdio.h>
Include <sched.h> where necessary for musl libc All unit tests define the UNIT_TESTING macro, which causes <cmocka.h> to replace malloc(), calloc(), realloc(), and free() with its own functions tracking memory allocations. In order for this not to break compilation, the system header declaring the prototypes for these standard functions must be included before <cmocka.h>. Normally, these prototypes are only present in <stdlib.h>, so we make sure it is included before <cmocka.h>. However, musl libc also defines the prototypes for calloc() and free() in <sched.h>, which is included by <pthread.h>, which is included e.g. by <isc/mutex.h>. Thus, unit tests including "dnstest.h" (which includes <isc/mem.h>, which includes <isc/mutex.h>) after <cmocka.h> will not compile with musl libc as for these programs, <sched.h> will be included after <cmocka.h>. Always including <cmocka.h> after all other header files is not a feasible solution as that causes the mock assertion macros defined in <isc/util.h> to mangle the contents of <cmocka.h>, thus breaking compilation. We cannot really use the __noreturn__ or analyzer_noreturn attributes with cmocka assertion functions because they do return if the tested condition is true. The problem is that what BIND unit tests do is incompatible with Clang Static Analyzer's assumptions: since we use cmocka, our custom assertion handlers are present in a shared library (i.e. it is the cmocka library that checks the assertion condition, not a macro in unit test code). Redefining cmocka's assertion macros in <isc/util.h> is an ugly hack to overcome that problem - unfortunately, this is the only way we can think of to make Clang Static Analyzer properly process unit test code. Giving up on Clang Static Analyzer being able to properly process unit test code is not a satisfactory solution. Undefining _GNU_SOURCE for unit test code could work around the problem (musl libc's <sched.h> only defines the prototypes for calloc() and free() when _GNU_SOURCE is defined), but doing that could introduce discrepancies for unit tests including entire *.c files, so it is also not a good solution. All in all, including <sched.h> before <cmocka.h> for all affected unit tests seems to be the most benign way of working around this musl libc quirk. While quite an ugly solution, it achieves our goals here, which are to keep the benefit of proper static analysis of unit test code and to fix compilation against musl libc.
2019-07-30 15:08:40 -04:00
#include <stdlib.h>
Replace custom isc_u?intNN_t types with C99 u?intNN_t types
2018-03-28 08:19:37 -04:00
#include <unistd.h>
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
convert keytable_test
2018-11-14 06:50:53 -05:00
#define UNIT_TESTING
#include <cmocka.h>
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
#include <isc/base64.h>
#include <isc/buffer.h>
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
#include <isc/md.h>
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
#include <isc/util.h>
#include <dns/fixedname.h>
#include <dns/keytable.h>
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
#include <dns/name.h>
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
#include <dns/nta.h>
#include <dns/rdataclass.h>
#include <dns/rdatastruct.h>
#include <dns/rootns.h>
#include <dns/view.h>
#include <dst/dst.h>
Use clang-format to reformat the source files
2020-02-12 07:59:18 -05:00
Move all the unit tests to /tests/<libname>/ The unit tests are now using a common base, which means that lib/dns/tests/ code now has to include lib/isc/include/isc/test.h and link with lib/isc/test.c and lib/ns/tests has to include both libisc and libdns parts. Instead of cross-linking code between the directories, move the /lib/<foo>/test.c to /tests/<foo>.c and /lib/<foo>/include/<foo>test.h to /tests/include/tests/<foo>.h and create a single libtest.la convenience library in /tests/. At the same time, move the /lib/<foo>/tests/ to /tests/<foo>/ (but keep it symlinked to the old location) and adjust paths accordingly. In few places, we are now using absolute paths instead of relative paths, because the directory level has changed. By moving the directories under the /tests/ directory, the test-related code is kept in a single place and we can avoid referencing files between libns->libdns->libisc which is unhealthy because they live in a separate Makefile-space. In the future, the /bin/tests/ should be merged to /tests/ and symlink kept, and the /fuzz/ directory moved to /tests/fuzz/.
2022-05-03 05:37:31 -04:00
#include <tests/dns.h>
convert keytable_test
2018-11-14 06:50:53 -05:00
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
static int
setup_test(void **state) {
setup_loopmgr(state);
return (0);
}
static int
teardown_test(void **state) {
teardown_loopmgr(state);
return (0);
}
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
dns_keytable_t *keytable = NULL;
dns_ntatable_t *ntatable = NULL;
static const char *keystr1 = "BQEAAAABok+vaUC9neRv8yeT/"
"FEGgN7svR8s7VBUVSBd8NsAiV8AlaAg "
"O5FHar3JQd95i/puZos6Vi6at9/"
"JBbN8qVmO2AuiXxVqfxMKxIcy+LEB "
"0Vw4NaSJ3N3uaVREso6aTSs98H/"
"25MjcwLOr7SFfXA7bGhZatLtYY/xu kp6Km5hMfkE=";
static const char *keystr2 = "BQEAAAABwuHz9Cem0BJ0JQTO7C/a3McR6hMaufljs1dfG/"
"inaJpYv7vH "
"XTrAOm/MeKp+/x6eT4QLru0KoZkvZJnqTI8JyaFTw2OM/"
"ItBfh/hL2lm "
"Cft2O7n3MfeqYtvjPnY7dWghYW4sVfH7VVEGm958o9nfi7953"
"2Qeklxh x8pXWdeAaRU=";
[master] complete NTA work 3882. [func] By default, negative trust anchors will be tested periodically to see whether data below them can be validated, and if so, they will be allowed to expire early. The "rndc nta -force" option overrides this behvaior. The default NTA lifetime and the recheck frequency can be configured by the "nta-lifetime" and "nta-recheck" options. [RT #36146]
2014-06-18 19:47:22 -04:00
static dns_view_t *view = NULL;
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/*
* Test utilities. In general, these assume input parameters are valid
convert keytable_test
2018-11-14 06:50:53 -05:00
* (checking with assert_int_equal, thus aborting if not) and unlikely run time
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
* errors (such as memory allocation failure) won't happen. This helps keep
* the test code concise.
*/
/*
* Utility to convert C-string to dns_name_t. Return a pointer to
* static data, and so is not thread safe.
*/
static dns_name_t *
str2name(const char *namestr) {
static dns_fixedname_t fname;
static dns_name_t *name;
static isc_buffer_t namebuf;
Use dns_fixedname_initname() where possible Replace dns_fixedname_init() calls followed by dns_fixedname_name() calls with calls to dns_fixedname_initname() where it is possible without affecting current behavior and/or performance. This patch was mostly prepared using Coccinelle and the following semantic patch: @@ expression fixedname, name; @@ - dns_fixedname_init(&fixedname); ... - name = dns_fixedname_name(&fixedname); + name = dns_fixedname_initname(&fixedname); The resulting set of changes was then manually reviewed to exclude false positives and apply minor tweaks. It is likely that more occurrences of this pattern can be refactored in an identical way. This commit only takes care of the low-hanging fruit.
2018-03-28 08:38:09 -04:00
name = dns_fixedname_initname(&fname);
Replace DE_CONST(k, v) with v = UNCONST(k) macro Replace the complicated DE_CONST macro that required union with much simple reference-dereference trick in the UNCONST() macro.
2023-03-30 16:34:12 -04:00
isc_buffer_init(&namebuf, UNCONST(namestr), strlen(namestr));
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
isc_buffer_add(&namebuf, strlen(namestr));
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(
dns_name_fromtext(name, &namebuf, dns_rootname, 0, NULL),
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
return (name);
}
static void
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
create_keystruct(uint16_t flags, uint8_t proto, uint8_t alg, const char *keystr,
dns_rdata_dnskey_t *keystruct) {
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
unsigned char keydata[4096];
isc_buffer_t keydatabuf;
isc_region_t r;
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
const dns_rdataclass_t rdclass = dns_rdataclass_in;
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
keystruct->common.rdclass = rdclass;
keystruct->common.rdtype = dns_rdatatype_dnskey;
Give the unit tests a big overhaul The unit tests contain a lot of duplicated code and here's an attempt to reduce code duplication. This commit does several things: 1. Remove #ifdef HAVE_CMOCKA - we already solve this with automake conditionals. 2. Create a set of ISC_TEST_* and ISC_*_TEST_ macros to wrap the test implementations, test lists, and the main test routine, so we don't have to repeat this all over again. The macros were modeled after libuv test suite but adapted to cmocka as the test driver. A simple example of a unit test would be: ISC_RUN_TEST_IMPL(test1) { assert_true(true); } ISC_TEST_LIST_START ISC_TEST_ENTRY(test1) ISC_TEST_LIST_END ISC_TEST_MAIN (Discussion: Should this be ISC_TEST_RUN ?) For more complicated examples including group setup and teardown functions, and per-test setup and teardown functions. 3. The macros prefix the test functions and cmocka entries, so the name of the test can now match the tested function name, and we don't have to append `_test` because `run_test_` is automatically prepended to the main test function, and `setup_test_` and `teardown_test_` is prepended to setup and teardown function. 4. Update all the unit tests to use the new syntax and fix a few bits here and there. 5. In the future, we can separate the test declarations and test implementations which are going to greatly help with uncluttering the bigger unit tests like doh_test and netmgr_test, because the test implementations are not declared static (see `ISC_RUN_TEST_DECLARE` and `ISC_RUN_TEST_IMPL` for more details. NOTE: This heavily relies on preprocessor macros, but the result greatly outweighs all the negatives of using the macros. There's less duplicated code, the tests are more uniform and the implementation can be more flexible.
2022-05-02 04:56:42 -04:00
keystruct->mctx = mctx;
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
ISC_LINK_INIT(&keystruct->common, link);
keystruct->flags = flags;
keystruct->protocol = proto;
keystruct->algorithm = alg;
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(isc_base64_decodestring(keystr, &keydatabuf),
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
isc_buffer_usedregion(&keydatabuf, &r);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
keystruct->datalen = r.length;
Give the unit tests a big overhaul The unit tests contain a lot of duplicated code and here's an attempt to reduce code duplication. This commit does several things: 1. Remove #ifdef HAVE_CMOCKA - we already solve this with automake conditionals. 2. Create a set of ISC_TEST_* and ISC_*_TEST_ macros to wrap the test implementations, test lists, and the main test routine, so we don't have to repeat this all over again. The macros were modeled after libuv test suite but adapted to cmocka as the test driver. A simple example of a unit test would be: ISC_RUN_TEST_IMPL(test1) { assert_true(true); } ISC_TEST_LIST_START ISC_TEST_ENTRY(test1) ISC_TEST_LIST_END ISC_TEST_MAIN (Discussion: Should this be ISC_TEST_RUN ?) For more complicated examples including group setup and teardown functions, and per-test setup and teardown functions. 3. The macros prefix the test functions and cmocka entries, so the name of the test can now match the tested function name, and we don't have to append `_test` because `run_test_` is automatically prepended to the main test function, and `setup_test_` and `teardown_test_` is prepended to setup and teardown function. 4. Update all the unit tests to use the new syntax and fix a few bits here and there. 5. In the future, we can separate the test declarations and test implementations which are going to greatly help with uncluttering the bigger unit tests like doh_test and netmgr_test, because the test implementations are not declared static (see `ISC_RUN_TEST_DECLARE` and `ISC_RUN_TEST_IMPL` for more details. NOTE: This heavily relies on preprocessor macros, but the result greatly outweighs all the negatives of using the macros. There's less duplicated code, the tests are more uniform and the implementation can be more flexible.
2022-05-02 04:56:42 -04:00
keystruct->data = isc_mem_allocate(mctx, r.length);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
memmove(keystruct->data, r.base, r.length);
}
convert keytable_test
2018-11-14 06:50:53 -05:00
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
static void
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(dns_name_t *name, uint16_t flags, uint8_t proto, uint8_t alg,
const char *keystr, unsigned char *digest,
dns_rdata_ds_t *dsstruct) {
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
isc_result_t result;
unsigned char rrdata[4096];
isc_buffer_t rrdatabuf;
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
dns_rdata_t rdata = DNS_RDATA_INIT;
dns_rdata_dnskey_t dnskey;
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
/*
* Populate DNSKEY rdata structure.
*/
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_keystruct(flags, proto, alg, keystr, &dnskey);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
/*
* Convert to wire format.
*/
isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
result = dns_rdata_fromstruct(&rdata, dnskey.common.rdclass,
dnskey.common.rdtype, &dnskey,
&rrdatabuf);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
/*
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
* Build DS rdata struct.
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
*/
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
result = dns_ds_fromkeyrdata(name, &rdata, DNS_DSDIGEST_SHA256, digest,
dsstruct);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
dns_rdata_freestruct(&dnskey);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
/* Common setup: create a keytable and ntatable to test with a few keys */
static void
Complete rewrite the BIND 9 build system The rewrite of BIND 9 build system is a large work and cannot be reasonable split into separate merge requests. Addition of the automake has a positive effect on the readability and maintainability of the build system as it is more declarative, it allows conditional and we are able to drop all of the custom make code that BIND 9 developed over the years to overcome the deficiencies of autoconf + custom Makefile.in files. This squashed commit contains following changes: - conversion (or rather fresh rewrite) of all Makefile.in files to Makefile.am by using automake - the libtool is now properly integrated with automake (the way we used it was rather hackish as the only official way how to use libtool is via automake - the dynamic module loading was rewritten from a custom patchwork to libtool's libltdl (which includes the patchwork to support module loading on different systems internally) - conversion of the unit test executor from kyua to automake parallel driver - conversion of the system test executor from custom make/shell to automake parallel driver - The GSSAPI has been refactored, the custom SPNEGO on the basis that all major KRB5/GSSAPI (mit-krb5, heimdal and Windows) implementations support SPNEGO mechanism. - The various defunct tests from bin/tests have been removed: bin/tests/optional and bin/tests/pkcs11 - The text files generated from the MD files have been removed, the MarkDown has been designed to be readable by both humans and computers - The xsl header is now generated by a simple sed command instead of perl helper - The <irs/platform.h> header has been removed - cleanups of configure.ac script to make it more simpler, addition of multiple macros (there's still work to be done though) - the tarball can now be prepared with `make dist` - the system tests are partially able to run in oot build Here's a list of unfinished work that needs to be completed in subsequent merge requests: - `make distcheck` doesn't yet work (because of system tests oot run is not yet finished) - documentation is not yet built, there's a different merge request with docbook to sphinx-build rst conversion that needs to be rebased and adapted on top of the automake - msvc build is non functional yet and we need to decide whether we will just cross-compile bind9 using mingw-w64 or fix the msvc build - contributed dlz modules are not included neither in the autoconf nor automake
2018-08-07 10:46:53 -04:00
create_tables(void) {
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
unsigned char digest[ISC_MAX_MD_SIZE];
dns_rdata_ds_t ds;
dns_fixedname_t fn;
dns_name_t *keyname = dns_fixedname_name(&fn);
Apply the semantic patch to remove isc_stdtime_get() This is a simple replacement using the semantic patch from the previous commit and as added bonus, one removal of previously undetected unused variable in named/server.c.
2023-03-30 15:13:41 -04:00
isc_stdtime_t now = isc_stdtime_now();
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
Attach to the dns_dispatchmgr in the dns_view object The dns_dispatchmgr object was only set in the dns_view object making it prone to use-after-free in the dns_xfrin unit when shutting down named. Remove dns_view_setdispatchmgr() and optionally pass the dispatchmgr directly to dns_view_create() when it is attached and not just assigned, so the dns_dispatchmgr doesn't cease to exist too early. The dns_view_getdnsdispatchmgr() is now protected by the RCU lock, the dispatchmgr reference is incremented, so the caller needs to detach from it, and the function can return NULL in case the dns_view has been already shut down.
2023-08-15 11:29:27 -04:00
assert_int_equal(dns_test_makeview("view", false, false, &view),
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
ISC_R_SUCCESS);
[master] complete NTA work 3882. [func] By default, negative trust anchors will be tested periodically to see whether data below them can be validated, and if so, they will be allowed to expire early. The "rndc nta -force" option overrides this behvaior. The default NTA lifetime and the recheck frequency can be configured by the "nta-lifetime" and "nta-recheck" options. [RT #36146]
2014-06-18 19:47:22 -04:00
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keytable_create(view, &keytable);
use a qp-trie for the NTA table replace the red-black tree used by the negative trust anchor table with a QP trie. because of this change, dns_ntatable_init() can no longer fail, and neither can dns_view_initntatable(). these functions have both been changed to type void.
2023-04-05 03:36:37 -04:00
dns_ntatable_create(view, loopmgr, &ntatable);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* Add a normal key */
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("example.com.", &fn);
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds,
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
/* Add an initializing managed key */
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("managed.com.", &fn);
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_add(keytable, true, true, keyname, &ds,
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* Add a null key */
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(
dns_keytable_marksecure(keytable, str2name("null.example")),
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* Add a negative trust anchor, duration 1 hour */
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(dns_ntatable_add(ntatable,
str2name("insecure.example"), false,
now, 3600),
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
static void
Complete rewrite the BIND 9 build system The rewrite of BIND 9 build system is a large work and cannot be reasonable split into separate merge requests. Addition of the automake has a positive effect on the readability and maintainability of the build system as it is more declarative, it allows conditional and we are able to drop all of the custom make code that BIND 9 developed over the years to overcome the deficiencies of autoconf + custom Makefile.in files. This squashed commit contains following changes: - conversion (or rather fresh rewrite) of all Makefile.in files to Makefile.am by using automake - the libtool is now properly integrated with automake (the way we used it was rather hackish as the only official way how to use libtool is via automake - the dynamic module loading was rewritten from a custom patchwork to libtool's libltdl (which includes the patchwork to support module loading on different systems internally) - conversion of the unit test executor from kyua to automake parallel driver - conversion of the system test executor from custom make/shell to automake parallel driver - The GSSAPI has been refactored, the custom SPNEGO on the basis that all major KRB5/GSSAPI (mit-krb5, heimdal and Windows) implementations support SPNEGO mechanism. - The various defunct tests from bin/tests have been removed: bin/tests/optional and bin/tests/pkcs11 - The text files generated from the MD files have been removed, the MarkDown has been designed to be readable by both humans and computers - The xsl header is now generated by a simple sed command instead of perl helper - The <irs/platform.h> header has been removed - cleanups of configure.ac script to make it more simpler, addition of multiple macros (there's still work to be done though) - the tarball can now be prepared with `make dist` - the system tests are partially able to run in oot build Here's a list of unfinished work that needs to be completed in subsequent merge requests: - `make distcheck` doesn't yet work (because of system tests oot run is not yet finished) - documentation is not yet built, there's a different merge request with docbook to sphinx-build rst conversion that needs to be rebased and adapted on top of the automake - msvc build is non functional yet and we need to decide whether we will just cross-compile bind9 using mingw-w64 or fix the msvc build - contributed dlz modules are not included neither in the autoconf nor automake
2018-08-07 10:46:53 -04:00
destroy_tables(void) {
convert keytable_test
2018-11-14 06:50:53 -05:00
if (ntatable != NULL) {
Resolve violation of weak referencing dns_view The dns_view implements weak and strong reference counting. When strong reference counting reaches zero, the adb, ntatable and resolver objects are shut down and detached. In dns_zone and dns_nta the dns_view was weakly attached, but the view->resolver reference was accessed directly leading to dereferencing the NULL pointer. Add dns_view_getresolver() method which attaches to view->resolver object under the lock (if it still exists) ensuring the dns_resolver will be kept referenced until not needed.
2022-10-03 09:54:12 -04:00
dns_ntatable_shutdown(ntatable);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
dns_ntatable_detach(&ntatable);
convert keytable_test
2018-11-14 06:50:53 -05:00
}
if (keytable != NULL) {
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
dns_keytable_detach(&keytable);
convert keytable_test
2018-11-14 06:50:53 -05:00
}
[master] complete NTA work 3882. [func] By default, negative trust anchors will be tested periodically to see whether data below them can be validated, and if so, they will be allowed to expire early. The "rndc nta -force" option overrides this behvaior. The default NTA lifetime and the recheck frequency can be configured by the "nta-lifetime" and "nta-recheck" options. [RT #36146]
2014-06-18 19:47:22 -04:00
dns_view_detach(&view);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
convert keytable_test
2018-11-14 06:50:53 -05:00
/* add keys to the keytable */
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
ISC_LOOP_TEST_IMPL(add) {
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
dns_keynode_t *keynode = NULL;
dns_keynode_t *null_keynode = NULL;
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
unsigned char digest[ISC_MAX_MD_SIZE];
dns_rdata_ds_t ds;
dns_fixedname_t fn;
dns_name_t *keyname = dns_fixedname_name(&fn);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
UNUSED(arg);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
create_tables();
/*
remove all code that uses non-DS trust anchors as initial-key and static-key trust anchors will now be stored as a DS rrset, code referencing keynodes storing DNSKEY trust anchors will no longer be reached.
2019-12-19 22:39:33 -05:00
* Getting the keynode for the example.com key should succeed.
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
*/
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(
dns_keytable_find(keytable, str2name("example.com"), &keynode),
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/*
remove all code that uses non-DS trust anchors as initial-key and static-key trust anchors will now be stored as a DS rrset, code referencing keynodes storing DNSKEY trust anchors will no longer be reached.
2019-12-19 22:39:33 -05:00
* Try to add the same key. This should have no effect but
* report success.
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
*/
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("example.com.", &fn);
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds,
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
remove all code that uses non-DS trust anchors as initial-key and static-key trust anchors will now be stored as a DS rrset, code referencing keynodes storing DNSKEY trust anchors will no longer be reached.
2019-12-19 22:39:33 -05:00
assert_int_equal(
dns_keytable_find(keytable, str2name("example.com"), &keynode),
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* Add another key (different keydata) */
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(keyname, 257, 3, 5, keystr2, digest, &ds);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds,
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
assert_int_equal(
dns_keytable_find(keytable, str2name("example.com"), &keynode),
ISC_R_SUCCESS);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
/*
remove all code that uses non-DS trust anchors as initial-key and static-key trust anchors will now be stored as a DS rrset, code referencing keynodes storing DNSKEY trust anchors will no longer be reached.
2019-12-19 22:39:33 -05:00
* Get the keynode for the managed.com key. Ensure the
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
* retrieved key is an initializing key, then mark it as trusted using
* dns_keynode_trust() and ensure the latter works as expected.
*/
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(
dns_keytable_find(keytable, str2name("managed.com"), &keynode),
ISC_R_SUCCESS);
assert_int_equal(dns_keynode_initial(keynode), true);
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
dns_keynode_trust(keynode);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(dns_keynode_initial(keynode), false);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
/*
* Add a different managed key for managed.com, marking it as an
fix a bug with the insertion of DS records into existing keynodes NOTE: the keytable test is still failing because dns_keytable_deletekey() is looking for exact matches in keynodes containing dst_key objects, which no keynode has anymore.
2019-12-20 19:23:25 -05:00
* initializing key. Since there is already a trusted key at the
* node, the node should *not* be marked as initializing.
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
*/
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("managed.com.", &fn);
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(keyname, 257, 3, 5, keystr2, digest, &ds);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_add(keytable, true, true, keyname, &ds,
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
assert_int_equal(
dns_keytable_find(keytable, str2name("managed.com"), &keynode),
ISC_R_SUCCESS);
fix a bug with the insertion of DS records into existing keynodes NOTE: the keytable test is still failing because dns_keytable_deletekey() is looking for exact matches in keynodes containing dst_key objects, which no keynode has anymore.
2019-12-20 19:23:25 -05:00
assert_int_equal(dns_keynode_initial(keynode), false);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
/*
* Add the same managed key again, but this time mark it as a
* non-initializing key. Ensure the previously added key is upgraded
* to a non-initializing key and make sure there are still two key
* nodes for managed.com, both containing non-initializing keys.
*/
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_add(keytable, true, false, keyname, &ds,
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
assert_int_equal(
dns_keytable_find(keytable, str2name("managed.com"), &keynode),
ISC_R_SUCCESS);
assert_int_equal(dns_keynode_initial(keynode), false);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
/*
* Add a managed key at a new node, two.com, marking it as an
remove all code that uses non-DS trust anchors as initial-key and static-key trust anchors will now be stored as a DS rrset, code referencing keynodes storing DNSKEY trust anchors will no longer be reached.
2019-12-19 22:39:33 -05:00
* initializing key.
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
*/
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("two.com.", &fn);
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_add(keytable, true, true, keyname, &ds,
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
assert_int_equal(
dns_keytable_find(keytable, str2name("two.com"), &keynode),
ISC_R_SUCCESS);
assert_int_equal(dns_keynode_initial(keynode), true);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
/*
* Add a different managed key for two.com, marking it as a
fix a bug with the insertion of DS records into existing keynodes NOTE: the keytable test is still failing because dns_keytable_deletekey() is looking for exact matches in keynodes containing dst_key objects, which no keynode has anymore.
2019-12-20 19:23:25 -05:00
* non-initializing key. Since there is already an iniitalizing
* trust anchor for two.com and we haven't run dns_keynode_trust(),
* the initialization status should not change.
[master] tag initializing keys 4798. [func] Keys specified in "managed-keys" statements are tagged as "initializing" until they have been updated by a key refresh query. If initialization fails it will be visible from "rndc secroots". [RT #46267]
2017-10-27 18:45:18 -04:00
*/
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(keyname, 257, 3, 5, keystr2, digest, &ds);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_add(keytable, true, false, keyname, &ds,
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
assert_int_equal(
dns_keytable_find(keytable, str2name("two.com"), &keynode),
ISC_R_SUCCESS);
fix a bug with the insertion of DS records into existing keynodes NOTE: the keytable test is still failing because dns_keytable_deletekey() is looking for exact matches in keynodes containing dst_key objects, which no keynode has anymore.
2019-12-20 19:23:25 -05:00
assert_int_equal(dns_keynode_initial(keynode), true);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/*
* Add a normal key to a name that has a null key. The null key node
* will be updated with the normal key.
*/
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(dns_keytable_find(keytable, str2name("null.example"),
&null_keynode),
ISC_R_SUCCESS);
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("null.example.", &fn);
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(keyname, 257, 3, 5, keystr2, digest, &ds);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_add(keytable, false, false, keyname, &ds,
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
assert_int_equal(
dns_keytable_find(keytable, str2name("null.example"), &keynode),
ISC_R_SUCCESS);
Use proper cmocka macros for pointer checks Make sure pointer checks in unit tests use cmocka assertion macros dedicated for use with pointers instead of those dedicated for use with integers or booleans.
2020-11-26 07:10:40 -05:00
assert_ptr_equal(keynode, null_keynode); /* should be the same node */
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&null_keynode);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/*
* Try to add a null key to a name that already has a key. It's
remove all code that uses non-DS trust anchors as initial-key and static-key trust anchors will now be stored as a DS rrset, code referencing keynodes storing DNSKEY trust anchors will no longer be reached.
2019-12-19 22:39:33 -05:00
* effectively no-op, so the same key node is still there.
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
* (Note: this and above checks confirm that if a name has a null key
* that's the only key for the name).
*/
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(
dns_keytable_marksecure(keytable, str2name("null.example")),
ISC_R_SUCCESS);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(dns_keytable_find(keytable, str2name("null.example"),
&null_keynode),
ISC_R_SUCCESS);
Use proper cmocka macros for pointer checks Make sure pointer checks in unit tests use cmocka assertion macros dedicated for use with pointers instead of those dedicated for use with integers or booleans.
2020-11-26 07:10:40 -05:00
assert_ptr_equal(keynode, null_keynode);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&null_keynode);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
destroy_tables();
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
isc_loopmgr_shutdown(loopmgr);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
convert keytable_test
2018-11-14 06:50:53 -05:00
/* delete keys from the keytable */
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
ISC_LOOP_TEST_IMPL(delete) {
UNUSED(arg);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
create_tables();
/* dns_keytable_delete requires exact match */
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_delete(keytable, str2name("example.org"),
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_NOTFOUND);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_delete(keytable,
str2name("s.example.com"), NULL,
NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_NOTFOUND);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_delete(keytable, str2name("example.com"),
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* works also for nodes with a null key */
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_delete(keytable, str2name("null.example"),
NULL, NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* or a negative trust anchor */
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(
dns_ntatable_delete(ntatable, str2name("insecure.example")),
ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
destroy_tables();
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
isc_loopmgr_shutdown(loopmgr);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
convert keytable_test
2018-11-14 06:50:53 -05:00
/* delete key nodes from the keytable */
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
ISC_LOOP_TEST_IMPL(deletekey) {
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
dns_rdata_dnskey_t dnskey;
dns_fixedname_t fn;
dns_name_t *keyname = dns_fixedname_name(&fn);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
UNUSED(arg);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
create_tables();
/* key name doesn't match */
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("example.org.", &fn);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
create_keystruct(257, 3, 5, keystr1, &dnskey);
assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_NOTFOUND);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
dns_rdata_freestruct(&dnskey);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* subdomain match is the same as no match */
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("sub.example.org.", &fn);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
create_keystruct(257, 3, 5, keystr1, &dnskey);
assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_NOTFOUND);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
dns_rdata_freestruct(&dnskey);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* name matches but key doesn't match (resulting in PARTIALMATCH) */
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("example.com.", &fn);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
create_keystruct(257, 3, 5, keystr2, &dnskey);
assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
convert keytable_test
2018-11-14 06:50:53 -05:00
DNS_R_PARTIALMATCH);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
dns_rdata_freestruct(&dnskey);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/*
make dns_keytable_deletekey() work correctly it now removes matching trust anchors from from the dslist while leaving the other trust anchors in place. also cleaned up the API to remove functions that were never being used.
2019-12-23 23:26:03 -05:00
* exact match: should return SUCCESS on the first try, then
* PARTIALMATCH on the second (because the name existed but
* not a matching key).
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
*/
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
create_keystruct(257, 3, 5, keystr1, &dnskey);
assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_SUCCESS);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
make dns_keytable_deletekey() work correctly it now removes matching trust anchors from from the dslist while leaving the other trust anchors in place. also cleaned up the API to remove functions that were never being used.
2019-12-23 23:26:03 -05:00
DNS_R_PARTIALMATCH);
/*
* after deleting the node, any deletekey or delete attempt should
* result in NOTFOUND.
*/
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_delete(keytable, keyname, NULL, NULL),
ISC_R_SUCCESS);
make dns_keytable_deletekey() work correctly it now removes matching trust anchors from from the dslist while leaving the other trust anchors in place. also cleaned up the API to remove functions that were never being used.
2019-12-23 23:26:03 -05:00
assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
convert keytable_test
2018-11-14 06:50:53 -05:00
ISC_R_NOTFOUND);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
dns_rdata_freestruct(&dnskey);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/*
[master] fix keytable test
2015-02-06 17:08:28 -05:00
* A null key node for a name is not deleted when searched by key;
* it must be deleted by dns_keytable_delete()
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
*/
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("null.example.", &fn);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
create_keystruct(257, 3, 5, keystr1, &dnskey);
assert_int_equal(dns_keytable_deletekey(keytable, keyname, &dnskey),
convert keytable_test
2018-11-14 06:50:53 -05:00
DNS_R_PARTIALMATCH);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
assert_int_equal(dns_keytable_delete(keytable, keyname, NULL, NULL),
ISC_R_SUCCESS);
rename dns_keytable_deletekeynode to dns_keytable_deletekey this function is used by dns_view_untrust() to handle revoked keys, so it will still be needed after the keytable/validator refactoring is complete, even though the keytable will be storing DS trust anchors instead of keys. to simplify the way it's called, it now takes a DNSKEY rdata struct instead of a DST key.
2019-12-11 03:09:15 -05:00
dns_rdata_freestruct(&dnskey);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
destroy_tables();
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
isc_loopmgr_shutdown(loopmgr);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
convert keytable_test
2018-11-14 06:50:53 -05:00
/* check find-variant operations */
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
ISC_LOOP_TEST_IMPL(find) {
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
dns_keynode_t *keynode = NULL;
dns_fixedname_t fname;
dns_name_t *name;
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
UNUSED(arg);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
create_tables();
/*
* dns_keytable_find() requires exact name match. It matches node
[master] Improve clarity of keytable unit tests 4799. [cleanup] Improve clarity of keytable unit tests. [RT #46407]
2017-10-28 13:59:40 -04:00
* that has a null key, too.
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
*/
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(
dns_keytable_find(keytable, str2name("example.org"), &keynode),
ISC_R_NOTFOUND);
assert_int_equal(dns_keytable_find(keytable,
str2name("sub.example.com"),
&keynode),
ISC_R_NOTFOUND);
assert_int_equal(
dns_keytable_find(keytable, str2name("example.com"), &keynode),
ISC_R_SUCCESS);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(
dns_keytable_find(keytable, str2name("null.example"), &keynode),
ISC_R_SUCCESS);
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_keynode_detach(&keynode);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/*
* dns_keytable_finddeepestmatch() allows partial match. Also match
[master] Improve clarity of keytable unit tests 4799. [cleanup] Improve clarity of keytable unit tests. [RT #46407]
2017-10-28 13:59:40 -04:00
* nodes with a null key.
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
*/
Use dns_fixedname_initname() where possible Replace dns_fixedname_init() calls followed by dns_fixedname_name() calls with calls to dns_fixedname_initname() where it is possible without affecting current behavior and/or performance. This patch was mostly prepared using Coccinelle and the following semantic patch: @@ expression fixedname, name; @@ - dns_fixedname_init(&fixedname); ... - name = dns_fixedname_name(&fixedname); + name = dns_fixedname_initname(&fixedname); The resulting set of changes was then manually reviewed to exclude false positives and apply minor tweaks. It is likely that more occurrences of this pattern can be refactored in an identical way. This commit only takes care of the low-hanging fruit.
2018-03-28 08:38:09 -04:00
name = dns_fixedname_initname(&fname);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(dns_keytable_finddeepestmatch(
keytable, str2name("example.com"), name),
ISC_R_SUCCESS);
assert_true(dns_name_equal(name, str2name("example.com")));
assert_int_equal(dns_keytable_finddeepestmatch(
keytable, str2name("s.example.com"), name),
ISC_R_SUCCESS);
assert_true(dns_name_equal(name, str2name("example.com")));
assert_int_equal(dns_keytable_finddeepestmatch(
keytable, str2name("example.org"), name),
ISC_R_NOTFOUND);
assert_int_equal(dns_keytable_finddeepestmatch(
keytable, str2name("null.example"), name),
ISC_R_SUCCESS);
assert_true(dns_name_equal(name, str2name("null.example")));
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
destroy_tables();
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
isc_loopmgr_shutdown(loopmgr);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
convert keytable_test
2018-11-14 06:50:53 -05:00
/* check issecuredomain() */
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
ISC_LOOP_TEST_IMPL(issecuredomain) {
Replace custom isc_boolean_t with C standard bool type
2018-04-17 11:29:14 -04:00
bool issecure;
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
const char **n;
const char *names[] = { "example.com", "sub.example.com",
"null.example", "sub.null.example", NULL };
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
UNUSED(arg);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
create_tables();
/*
* Domains that are an exact or partial match of a key name are
* considered secure. It's the case even if the key is null
* (validation will then fail, but that's actually the intended effect
* of installing a null key).
*/
for (n = names; *n != NULL; n++) {
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(dns_keytable_issecuredomain(keytable,
str2name(*n), NULL,
&issecure),
ISC_R_SUCCESS);
assert_true(issecure);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
/*
[master] Improve clarity of keytable unit tests 4799. [cleanup] Improve clarity of keytable unit tests. [RT #46407]
2017-10-28 13:59:40 -04:00
* If the key table has no entry (not even a null one) for a domain or
* any of its ancestors, that domain is considered insecure.
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
*/
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(dns_keytable_issecuredomain(keytable,
str2name("example.org"),
NULL, &issecure),
ISC_R_SUCCESS);
assert_false(issecure);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
destroy_tables();
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
isc_loopmgr_shutdown(loopmgr);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
convert keytable_test
2018-11-14 06:50:53 -05:00
/* check dns_keytable_dump() */
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
ISC_LOOP_TEST_IMPL(dump) {
remove (or hide behind a 'verbose' flag) extra output from system tests
2018-11-16 03:19:06 -05:00
FILE *f = fopen("/dev/null", "w");
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
UNUSED(arg);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
create_tables();
/*
* Right now, we only confirm the dump attempt doesn't cause disruption
* (so we don't check the dump content).
*/
remove (or hide behind a 'verbose' flag) extra output from system tests
2018-11-16 03:19:06 -05:00
assert_int_equal(dns_keytable_dump(keytable, f), ISC_R_SUCCESS);
fclose(f);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
destroy_tables();
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
isc_loopmgr_shutdown(loopmgr);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
}
convert keytable_test
2018-11-14 06:50:53 -05:00
/* check negative trust anchors */
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
ISC_LOOP_TEST_IMPL(nta) {
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
isc_result_t result;
Replace custom isc_boolean_t with C standard bool type
2018-04-17 11:29:14 -04:00
bool issecure, covered;
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
dns_fixedname_t fn;
dns_name_t *keyname = dns_fixedname_name(&fn);
unsigned char digest[ISC_MAX_MD_SIZE];
dns_rdata_ds_t ds;
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
dns_view_t *myview = NULL;
Apply the semantic patch to remove isc_stdtime_get() This is a simple replacement using the semantic patch from the previous commit and as added bonus, one removal of previously undetected unused variable in named/server.c.
2023-03-30 15:13:41 -04:00
isc_stdtime_t now = isc_stdtime_now();
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
Attach to the dns_dispatchmgr in the dns_view object The dns_dispatchmgr object was only set in the dns_view object making it prone to use-after-free in the dns_xfrin unit when shutting down named. Remove dns_view_setdispatchmgr() and optionally pass the dispatchmgr directly to dns_view_create() when it is attached and not just assigned, so the dns_dispatchmgr doesn't cease to exist too early. The dns_view_getdnsdispatchmgr() is now protected by the RCU lock, the dispatchmgr reference is incremented, so the caller needs to detach from it, and the function can return NULL in case the dns_view has been already shut down.
2023-08-15 11:29:27 -04:00
result = dns_test_makeview("view", false, false, &myview);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
use a qp-trie for the keytable Instead of an RBT for the trust anchor tables, use a QP-trie.
2023-04-15 17:49:45 -04:00
dns_view_initsecroots(myview);
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
result = dns_view_getsecroots(myview, &keytable);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
use a qp-trie for the NTA table replace the red-black tree used by the negative trust anchor table with a QP trie. because of this change, dns_ntatable_init() can no longer fail, and neither can dns_view_initntatable(). these functions have both been changed to type void.
2023-04-05 03:36:37 -04:00
dns_view_initntatable(myview, loopmgr);
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
result = dns_view_getntatable(myview, &ntatable);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
Support for relative names in unit tests The dns_test_namefromstring() function can now generate relative names, and all the tests that used it before it have been updated to use FQDNs.
2022-06-09 15:29:58 -04:00
dns_test_namefromstring("example.", &fn);
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
create_dsstruct(keyname, 257, 3, 5, keystr1, digest, &ds);
Add synth-from-dnssec namespaces for keytable entries We do this by adding callbacks for when a node is added or deleted from the keytable. dns_keytable_add and dns_keytable_delete where extended to take a callback. dns_keytable_deletekey does not remove the node so it was not extended.
2022-06-16 20:40:47 -04:00
result = dns_keytable_add(keytable, false, false, keyname, &ds, NULL,
NULL),
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
disable adding keys to keytable; only DS trust anchors can now be added the internal keytable structure has not yet been changed, but insertion of DS anchors is the only method now available. NOTE: the keytable unit test is currently failing because of tests that expect individual keynode objects to contain single DST key objects.
2019-12-20 14:37:11 -05:00
result = dns_ntatable_add(ntatable, str2name("insecure.example"), false,
Replace custom isc_boolean_t with C standard bool type
2018-04-17 11:29:14 -04:00
now, 1);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* Should be secure */
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
result = dns_view_issecuredomain(myview,
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
str2name("test.secure.example"), now,
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
true, &covered, &issecure);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
assert_false(covered);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_true(issecure);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* Should not be secure */
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
result = dns_view_issecuredomain(myview,
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
str2name("test.insecure.example"), now,
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
true, &covered, &issecure);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
assert_true(covered);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_false(issecure);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* NTA covered */
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
covered = dns_view_ntacovers(myview, now, str2name("insecure.example"),
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
dns_rootname);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_true(covered);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* Not NTA covered */
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
covered = dns_view_ntacovers(myview, now, str2name("secure.example"),
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
dns_rootname);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_false(covered);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* As of now + 2, the NTA should be clear */
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
result = dns_view_issecuredomain(myview,
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
str2name("test.insecure.example"),
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
now + 2, true, &covered, &issecure);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
assert_false(covered);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_true(issecure);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* Now check deletion */
[master] Improve clarity of keytable unit tests 4799. [cleanup] Improve clarity of keytable unit tests. [RT #46407]
2017-10-28 13:59:40 -04:00
result = dns_view_issecuredomain(myview, str2name("test.new.example"),
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
now, true, &covered, &issecure);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
assert_false(covered);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_true(issecure);
[master] Improve clarity of keytable unit tests 4799. [cleanup] Improve clarity of keytable unit tests. [RT #46407]
2017-10-28 13:59:40 -04:00
[master] complete NTA work 3882. [func] By default, negative trust anchors will be tested periodically to see whether data below them can be validated, and if so, they will be allowed to expire early. The "rndc nta -force" option overrides this behvaior. The default NTA lifetime and the recheck frequency can be configured by the "nta-lifetime" and "nta-recheck" options. [RT #36146]
2014-06-18 19:47:22 -04:00
result = dns_ntatable_add(ntatable, str2name("new.example"), false, now,
Replace custom isc_boolean_t with C standard bool type
2018-04-17 11:29:14 -04:00
3600);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
result = dns_view_issecuredomain(myview, str2name("test.new.example"),
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
now, true, &covered, &issecure);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
assert_true(covered);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_false(issecure);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
result = dns_ntatable_delete(ntatable, str2name("new.example"));
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
result = dns_view_issecuredomain(myview, str2name("test.new.example"),
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
now, true, &covered, &issecure);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_int_equal(result, ISC_R_SUCCESS);
Make NTAs work with validating forwarders If named is configured to perform DNSSEC validation and also forwards all queries ("forward only;") to validating resolvers, negative trust anchors do not work properly because the CD bit is not set in queries sent to the forwarders. As a result, instead of retrieving bogus DNSSEC material and making validation decisions based on its configuration, named is only receiving SERVFAIL responses to queries for bogus data. Fix by ensuring the CD bit is always set in queries sent to forwarders if the query name is covered by an NTA.
2019-04-24 05:17:15 -04:00
assert_false(covered);
convert keytable_test
2018-11-14 06:50:53 -05:00
assert_true(issecure);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
use a qp-trie for the NTA table replace the red-black tree used by the negative trust anchor table with a QP trie. because of this change, dns_ntatable_init() can no longer fail, and neither can dns_view_initntatable(). these functions have both been changed to type void.
2023-04-05 03:36:37 -04:00
isc_loopmgr_shutdown(loopmgr);
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
/* Clean up */
dns_ntatable_detach(&ntatable);
dns_keytable_detach(&keytable);
[master] clean up gcc -Wshadow warnings 4039. [cleanup] Cleaned up warnings from gcc -Wshadow. [RT #37381]
2015-01-20 16:29:18 -05:00
dns_view_detach(&myview);
convert keytable_test
2018-11-14 06:50:53 -05:00
}
[master] rndc nta 3867. [func] "rndc nta" can now be used to set a temporary negative trust anchor, which disables DNSSEC validation below a specified name for a specified period of time (not exceeding 24 hours). This can be used when validation for a domain is known to be failing due to a configuration error on the part of the domain owner rather than a spoofing attack. [RT #29358]
2014-05-30 01:22:53 -04:00
Give the unit tests a big overhaul The unit tests contain a lot of duplicated code and here's an attempt to reduce code duplication. This commit does several things: 1. Remove #ifdef HAVE_CMOCKA - we already solve this with automake conditionals. 2. Create a set of ISC_TEST_* and ISC_*_TEST_ macros to wrap the test implementations, test lists, and the main test routine, so we don't have to repeat this all over again. The macros were modeled after libuv test suite but adapted to cmocka as the test driver. A simple example of a unit test would be: ISC_RUN_TEST_IMPL(test1) { assert_true(true); } ISC_TEST_LIST_START ISC_TEST_ENTRY(test1) ISC_TEST_LIST_END ISC_TEST_MAIN (Discussion: Should this be ISC_TEST_RUN ?) For more complicated examples including group setup and teardown functions, and per-test setup and teardown functions. 3. The macros prefix the test functions and cmocka entries, so the name of the test can now match the tested function name, and we don't have to append `_test` because `run_test_` is automatically prepended to the main test function, and `setup_test_` and `teardown_test_` is prepended to setup and teardown function. 4. Update all the unit tests to use the new syntax and fix a few bits here and there. 5. In the future, we can separate the test declarations and test implementations which are going to greatly help with uncluttering the bigger unit tests like doh_test and netmgr_test, because the test implementations are not declared static (see `ISC_RUN_TEST_DECLARE` and `ISC_RUN_TEST_IMPL` for more details. NOTE: This heavily relies on preprocessor macros, but the result greatly outweighs all the negatives of using the macros. There's less duplicated code, the tests are more uniform and the implementation can be more flexible.
2022-05-02 04:56:42 -04:00
ISC_TEST_LIST_START
Update netmgr, tasks, and applications to use isc_loopmgr Previously: * applications were using isc_app as the base unit for running the application and signal handling. * networking was handled in the netmgr layer, which would start a number of threads, each with a uv_loop event loop. * task/event handling was done in the isc_task unit, which used netmgr event loops to run the isc_event calls. In this refactoring: * the network manager now uses isc_loop instead of maintaining its own worker threads and event loops. * the taskmgr that manages isc_task instances now also uses isc_loopmgr, and every isc_task runs on a specific isc_loop bound to the specific thread. * applications have been updated as necessary to use the new API. * new ISC_LOOP_TEST macros have been added to enable unit tests to run isc_loop event loops. unit tests have been updated to use this where needed.
2022-07-26 07:03:45 -04:00
ISC_TEST_ENTRY_CUSTOM(add, setup_test, teardown_test)
ISC_TEST_ENTRY_CUSTOM(delete, setup_test, teardown_test)
ISC_TEST_ENTRY_CUSTOM(deletekey, setup_test, teardown_test)
ISC_TEST_ENTRY_CUSTOM(find, setup_test, teardown_test)
ISC_TEST_ENTRY_CUSTOM(issecuredomain, setup_test, teardown_test)
ISC_TEST_ENTRY_CUSTOM(dump, setup_test, teardown_test)
ISC_TEST_ENTRY_CUSTOM(nta, setup_test, teardown_test)
Give the unit tests a big overhaul The unit tests contain a lot of duplicated code and here's an attempt to reduce code duplication. This commit does several things: 1. Remove #ifdef HAVE_CMOCKA - we already solve this with automake conditionals. 2. Create a set of ISC_TEST_* and ISC_*_TEST_ macros to wrap the test implementations, test lists, and the main test routine, so we don't have to repeat this all over again. The macros were modeled after libuv test suite but adapted to cmocka as the test driver. A simple example of a unit test would be: ISC_RUN_TEST_IMPL(test1) { assert_true(true); } ISC_TEST_LIST_START ISC_TEST_ENTRY(test1) ISC_TEST_LIST_END ISC_TEST_MAIN (Discussion: Should this be ISC_TEST_RUN ?) For more complicated examples including group setup and teardown functions, and per-test setup and teardown functions. 3. The macros prefix the test functions and cmocka entries, so the name of the test can now match the tested function name, and we don't have to append `_test` because `run_test_` is automatically prepended to the main test function, and `setup_test_` and `teardown_test_` is prepended to setup and teardown function. 4. Update all the unit tests to use the new syntax and fix a few bits here and there. 5. In the future, we can separate the test declarations and test implementations which are going to greatly help with uncluttering the bigger unit tests like doh_test and netmgr_test, because the test implementations are not declared static (see `ISC_RUN_TEST_DECLARE` and `ISC_RUN_TEST_IMPL` for more details. NOTE: This heavily relies on preprocessor macros, but the result greatly outweighs all the negatives of using the macros. There's less duplicated code, the tests are more uniform and the implementation can be more flexible.
2022-05-02 04:56:42 -04:00
ISC_TEST_LIST_END
convert keytable_test
2018-11-14 06:50:53 -05:00
Give the unit tests a big overhaul The unit tests contain a lot of duplicated code and here's an attempt to reduce code duplication. This commit does several things: 1. Remove #ifdef HAVE_CMOCKA - we already solve this with automake conditionals. 2. Create a set of ISC_TEST_* and ISC_*_TEST_ macros to wrap the test implementations, test lists, and the main test routine, so we don't have to repeat this all over again. The macros were modeled after libuv test suite but adapted to cmocka as the test driver. A simple example of a unit test would be: ISC_RUN_TEST_IMPL(test1) { assert_true(true); } ISC_TEST_LIST_START ISC_TEST_ENTRY(test1) ISC_TEST_LIST_END ISC_TEST_MAIN (Discussion: Should this be ISC_TEST_RUN ?) For more complicated examples including group setup and teardown functions, and per-test setup and teardown functions. 3. The macros prefix the test functions and cmocka entries, so the name of the test can now match the tested function name, and we don't have to append `_test` because `run_test_` is automatically prepended to the main test function, and `setup_test_` and `teardown_test_` is prepended to setup and teardown function. 4. Update all the unit tests to use the new syntax and fix a few bits here and there. 5. In the future, we can separate the test declarations and test implementations which are going to greatly help with uncluttering the bigger unit tests like doh_test and netmgr_test, because the test implementations are not declared static (see `ISC_RUN_TEST_DECLARE` and `ISC_RUN_TEST_IMPL` for more details. NOTE: This heavily relies on preprocessor macros, but the result greatly outweighs all the negatives of using the macros. There's less duplicated code, the tests are more uniform and the implementation can be more flexible.
2022-05-02 04:56:42 -04:00
ISC_TEST_MAIN
Reference in a new issue Copy permalink