upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch '1674-reject-axfr-streams-with-bad-id' into 'master'

Browse source 
Reject AXFR streams with bad message id

Closes #1674

See merge request isc-projects/bind9!3382
This commit is contained in:
Mark Andrews 2020-04-20 08:58:27 +00:00
commit 548ec481fb
7 changed files with 144 additions and 134 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
CHANGES
View file

@ -1,5 +1,9 @@
5386. [cleanup] Address Coverity warnings in keymgr.c [GL #1737]
5388. [func] Reject AXFR streams where the message id is not
consistent. [GL #1674]
5387. [placeholder]
5386. [cleanup] Address Coverity warnings in keymgr.c [GL #1737]
5385. [func] Make ISC rwlock implementation the default again.
[GL #1753]

12
bin/tests/system/ans.pl
View file

@ -62,6 +62,11 @@
# Note that this data will still be sent with any request for
# pattern, only this data will be signed. Currently, this is only
# done for TCP.
#
# /pattern bad-id <key> <key_data>/
# /pattern bad-id/
#
# will add 50 to the message id of the response.
use IO::File;
@ -361,7 +366,7 @@ sub handleTCP {
my $r;
foreach $r (@rules) {
my $pattern = $r->{pattern};
my($dbtype, $key_name, $key_data) = split(/ /,$pattern);
my($dbtype, $key_name, $key_data, $extra) = split(/ /,$pattern);
print "[handleTCP] $dbtype, $key_name, $key_data \n";
if ("$qname $qtype" =~ /$dbtype/) {
$count_these++;
@ -369,6 +374,11 @@ sub handleTCP {
foreach $a (@{$r->{answer}}) {
$packet->push("answer", $a);
}
if(defined($key_name) && $key_name eq "bad-id") {
$packet->header->id(($id+50)%0xffff);
$key_name = $key_data;
$key_data = $extra;
}
if (defined($key_name) && defined($key_data)) {
my $tsig;
# sign the packet

10
bin/tests/system/xfer/ans5/badmessageid Normal file
View file

@ -0,0 +1,10 @@
/SOA tsig_key LSAnCU+Z/
nil. 300 SOA ns.nil. root.nil. 1 300 300 604800 300
/AXFR tsig_key LSAnCU+Z/
nil. 300 SOA ns.nil. root.nil. 1 300 300 604800 300
/AXFR bad-id tsig_key LSAnCU+Z/
nil. 300 NS ns.nil.
nil. 300 TXT "bad message id"
a.nil. 60 A 10.0.0.61
/AXFR bad-id tsig_key LSAnCU+Z/
nil. 300 SOA ns.nil. root.nil. 1 300 300 604800 300

26
bin/tests/system/xfer/clean.sh
View file

@ -13,25 +13,25 @@
# Clean up after zone transfer tests.
#
rm -f dig.out.*
rm -f */ans.run
rm -f */named.conf
rm -f */named.memstats
rm -f */named.run
rm -f */named.run.prev
rm -f axfr.out
rm -f stats.*
rm -f ns1/slave.db ns2/slave.db
rm -f dig.out.*
rm -f ns*/managed-keys.bind*
rm -f ns*/named.lock
rm -f ns1/edns-expire.db
rm -f ns1/ixfr-too-big.db ns1/ixfr-too-big.db.jnl
rm -f ns1/slave.db ns2/slave.db
rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl
rm -f ns2/mapped.db
rm -f ns3/example.bk ns3/xfer-stats.bk ns3/tsigzone.bk ns3/example.bk.jnl
rm -f ns3/mapped.bk
rm -f ns3/master.bk ns3/master.bk.jnl
rm -f ns4/*.db ns4/*.jnl
rm -f ns6/*.db ns6/*.bk ns6/*.jnl
rm -f ns7/*.db ns7/*.bk ns7/*.jnl
rm -f ns8/large.db ns8/small.db
rm -f */named.conf
rm -f */named.run
rm -f */named.memstats
rm -f */named.run
rm -f */ans.run
rm -f ns*/named.lock
rm -f ns2/mapped.db
rm -f ns3/mapped.bk
rm -f ns1/ixfr-too-big.db ns1/ixfr-too-big.db.jnl
rm -f ns*/managed-keys.bind*
rm -f stats.*

215
bin/tests/system/xfer/tests.sh
View file

@ -21,29 +21,24 @@ n=0
n=$((n+1))
echo_i "testing basic zone transfer functionality (from primary) ($n)"
tmp=0
$DIG $DIGOPTS example. \
@10.53.0.2 axfr > dig.out.ns2.test$n || tmp=1
$DIG $DIGOPTS example. @10.53.0.2 axfr > dig.out.ns2.test$n || tmp=1
grep "^;" dig.out.ns2.test$n | cat_i
digcomp dig1.good dig.out.ns2.test$n || tmp=1
if test $tmp != 0 ; then echo_i "failed"; fi
status=$((status+tmp))
n=$((n+1))
echo_i "testing basic zone transfer functionality (from secondary) ($n)"
tmp=0
#
# Spin to allow the zone to transfer.
#
for i in 1 2 3 4 5
do
tmp=0
$DIG $DIGOPTS example. \
@10.53.0.3 axfr > dig.out.ns3.test$n || tmp=1
grep "^;" dig.out.ns3.test$n > /dev/null || break
echo_i "plain zone re-transfer"
sleep 5
done
wait_for_xfer () {
$DIG $DIGOPTS example. @10.53.0.3 axfr > dig.out.ns3.test$n || return 1
grep "^;" dig.out.ns3.test$n > /dev/null && return 1
return 0
}
retry_quiet 25 wait_for_xfer || tmp=1
grep "^;" dig.out.ns3.test$n | cat_i
digcomp dig1.good dig.out.ns3.test$n || tmp=1
if test $tmp != 0 ; then echo_i "failed"; fi
@ -51,25 +46,23 @@ status=$((status+tmp))
n=$((n+1))
echo_i "testing TSIG signed zone transfers ($n)"
$DIG $DIGOPTS tsigzone. @10.53.0.2 axfr -y tsigzone.:1234abcd8765 > dig.out.ns2.test$n || status=1
tmp=0
$DIG $DIGOPTS tsigzone. @10.53.0.2 axfr -y tsigzone.:1234abcd8765 > dig.out.ns2.test$n || tmp=1
grep "^;" dig.out.ns2.test$n | cat_i
#
# Spin to allow the zone to transfer.
#
for i in 1 2 3 4 5
do
tmp=0
$DIG $DIGOPTS tsigzone. @10.53.0.3 axfr -y tsigzone.:1234abcd8765 > dig.out.ns3.test$n || tmp=1
grep "^;" dig.out.ns3.test$n > /dev/null
if test $? -ne 0 ; then break; fi
echo_i "plain zone re-transfer"
sleep 5
done
if test $tmp -eq 1 ; then status=1; fi
wait_for_xfer_tsig () {
$DIG $DIGOPTS tsigzone. @10.53.0.3 axfr -y tsigzone.:1234abcd8765 > dig.out.ns3.test$n || return 1
grep "^;" dig.out.ns3.test$n > /dev/null && return 1
return 0
}
retry_quiet 25 wait_for_xfer_tsig || tmp=1
grep "^;" dig.out.ns3.test$n | cat_i
digcomp dig.out.ns2.test$n dig.out.ns3.test$n || status=1
digcomp dig.out.ns2.test$n dig.out.ns3.test$n || tmp=1
if test $tmp != 0 ; then echo_i "failed"; fi
status=$((status+tmp))
echo_i "reload servers for in preparation for ixfr-from-differences tests"
@ -115,6 +108,7 @@ sleep 3
n=$((n+1))
echo_i "testing zone is dumped after successful transfer ($n)"
tmp=0
$DIG $DIGOPTS +noall +answer +multi @10.53.0.2 \
slave. soa > dig.out.ns2.test$n || tmp=1
grep "1397051952 ; serial" dig.out.ns2.test$n > /dev/null 2>&1 || tmp=1
@ -126,38 +120,36 @@ n=$((n+1))
echo_i "testing ixfr-from-differences yes; ($n)"
tmp=0
for i in 0 1 2 3 4 5 6 7 8 9
do
a=0 b=0 c=0 d=0
echo_i "wait for reloads..."
echo_i "wait for reloads..."
wait_for_reloads() (
$DIG $DIGOPTS @10.53.0.6 +noall +answer soa master > dig.out.soa1.ns6.test$n
grep "1397051953" dig.out.soa1.ns6.test$n > /dev/null && a=1
grep "1397051953" dig.out.soa1.ns6.test$n > /dev/null || return 1
$DIG $DIGOPTS @10.53.0.1 +noall +answer soa slave > dig.out.soa2.ns1.test$n
grep "1397051953" dig.out.soa2.ns1.test$n > /dev/null && b=1
grep "1397051953" dig.out.soa2.ns1.test$n > /dev/null || return 1
$DIG $DIGOPTS @10.53.0.2 +noall +answer soa example > dig.out.soa3.ns2.test$n
grep "1397051953" dig.out.soa3.ns2.test$n > /dev/null && c=1
[ $a -eq 1 -a $b -eq 1 -a $c -eq 1 ] && break
sleep 2
done
grep "1397051953" dig.out.soa3.ns2.test$n > /dev/null || return 1
return 0
)
retry_quiet 20 wait_for_reloads || tmp=1
for i in 0 1 2 3 4 5 6 7 8 9
do
echo_i "wait for transfers..."
wait_for_transfers() (
a=0 b=0 c=0 d=0
echo_i "wait for transfers..."
$DIG $DIGOPTS @10.53.0.3 +noall +answer soa example > dig.out.soa1.ns3.test$n
grep "1397051953" dig.out.soa1.ns3.test$n > /dev/null && a=1
$DIG $DIGOPTS @10.53.0.3 +noall +answer soa master > dig.out.soa2.ns3.test$n
grep "1397051953" dig.out.soa2.ns3.test$n > /dev/null && b=1
$DIG $DIGOPTS @10.53.0.6 +noall +answer soa slave > dig.out.soa3.ns6.test$n
grep "1397051953" dig.out.soa3.ns6.test$n > /dev/null && c=1
[ $a -eq 1 -a $b -eq 1 -a $c -eq 1 ] && break
[ $a -eq 1 -a $b -eq 1 -a $c -eq 1 ] && return 0
# re-notify if necessary
$RNDCCMD 10.53.0.6 notify master 2>&1 | sed 's/^/ns6 /' | cat_i
$RNDCCMD 10.53.0.1 notify slave 2>&1 | sed 's/^/ns1 /' | cat_i
$RNDCCMD 10.53.0.2 notify example 2>&1 | sed 's/^/ns2 /' | cat_i
sleep 2
done
return 1
)
retry_quiet 20 wait_for_transfers || tmp=1
$DIG $DIGOPTS example. \
@10.53.0.3 axfr > dig.out.ns3.test$n || tmp=1
@ -260,10 +252,10 @@ DIGCMD="$DIG $DIGOPTS @10.53.0.4"
SENDCMD="$PERL ../send.pl 10.53.0.5 $EXTRAPORT1"
echo_i "testing that incorrectly signed transfers will fail..."
echo_i "initial correctly-signed transfer should succeed"
n=$((n+1))
echo_i "initial correctly-signed transfer should succeed ($n)"
$SENDCMD < ans5/goodaxfr
sleep 1
# Initially, ns4 is not authoritative for anything.
# Now that ans is up and running with the right data, we make ns4
@ -277,128 +269,143 @@ zone "nil" {
};
EOF
cur=`awk 'END {print NR}' ns4/named.run`
nextpart ns4/named.run >/dev/null
rndc_reload ns4 10.53.0.4
for i in 0 1 2 3 4 5 6 7 8 9
do
wait_for_soa() (
$DIGCMD nil. SOA > dig.out.ns4.test$n
grep SOA dig.out.ns4.test$n > /dev/null && break
sleep 1
done
grep SOA dig.out.ns4.test$n > /dev/null
)
retry_quiet 10 wait_for_soa
sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: success" > /dev/null || {
nextpart ns4/named.run | grep "Transfer status: success" > /dev/null || {
echo_i "failed: expected status was not logged"
status=$((status+1))
}
cur=`awk 'END {print NR}' ns4/named.run`
$DIGCMD nil. TXT | grep 'initial AXFR' >/dev/null || {
echo_i "failed"
status=$((status+1))
}
echo_i "unsigned transfer"
n=$((n+1))
echo_i "unsigned transfer ($n)"
$SENDCMD < ans5/unsigned
sleep 1
$RNDCCMD 10.53.0.4 retransfer nil | sed 's/^/ns4 /' | cat_i
sleep 2
sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: expected a TSIG or SIG(0)" > /dev/null || {
nextpart ns4/named.run | grep "Transfer status: expected a TSIG or SIG(0)" > /dev/null || {
echo_i "failed: expected status was not logged"
status=$((status+1))
}
cur=`awk 'END {print NR}' ns4/named.run`
$DIGCMD nil. TXT | grep 'unsigned AXFR' >/dev/null && {
echo_i "failed"
status=$((status+1))
}
echo_i "bad keydata"
n=$((n+1))
echo_i "bad keydata ($n)"
$SENDCMD < ans5/badkeydata
sleep 1
$RNDCCMD 10.53.0.4 retransfer nil | sed 's/^/ns4 /' | cat_i
sleep 2
sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: tsig verify failure" > /dev/null || {
nextpart ns4/named.run | grep "Transfer status: tsig verify failure" > /dev/null || {
echo_i "failed: expected status was not logged"
status=$((status+1))
}
cur=`awk 'END {print NR}' ns4/named.run`
$DIGCMD nil. TXT | grep 'bad keydata AXFR' >/dev/null && {
echo_i "failed"
status=$((status+1))
}
echo_i "partially-signed transfer"
n=$((n+1))
echo_i "partially-signed transfer ($n)"
$SENDCMD < ans5/partial
sleep 1
$RNDCCMD 10.53.0.4 retransfer nil | sed 's/^/ns4 /' | cat_i
sleep 2
sed -n "$cur,\$p" < ns4/named.run | grep "Transfer status: expected a TSIG or SIG(0)" > /dev/null || {
nextpart ns4/named.run | grep "Transfer status: expected a TSIG or SIG(0)" > /dev/null || {
echo_i "failed: expected status was not logged"
status=$((status+1))
}
cur=`awk 'END {print NR}' ns4/named.run`
$DIGCMD nil. TXT | grep 'partially signed AXFR' >/dev/null && {
echo_i "failed"
status=$((status+1))
}
echo_i "unknown key"
n=$((n+1))
echo_i "unknown key ($n)"
$SENDCMD < ans5/unknownkey
sleep 1
$RNDCCMD 10.53.0.4 retransfer nil | sed 's/^/ns4 /' | cat_i
sleep 2
sed -n "$cur,\$p" < ns4/named.run | grep "tsig key 'tsig_key': key name and algorithm do not match" > /dev/null || {
nextpart ns4/named.run | grep "tsig key 'tsig_key': key name and algorithm do not match" > /dev/null || {
echo_i "failed: expected status was not logged"
status=$((status+1))
}
cur=`awk 'END {print NR}' ns4/named.run`
$DIGCMD nil. TXT | grep 'unknown key AXFR' >/dev/null && {
echo_i "failed"
status=$((status+1))
}
echo_i "incorrect key"
n=$((n+1))
echo_i "incorrect key ($n)"
$SENDCMD < ans5/wrongkey
sleep 1
$RNDCCMD 10.53.0.4 retransfer nil | sed 's/^/ns4 /' | cat_i
sleep 2
sed -n "$cur,\$p" < ns4/named.run | grep "tsig key 'tsig_key': key name and algorithm do not match" > /dev/null || {
nextpart ns4/named.run | grep "tsig key 'tsig_key': key name and algorithm do not match" > /dev/null || {
echo_i "failed: expected status was not logged"
status=$((status+1))
}
cur=`awk 'END {print NR}' ns4/named.run`
$DIGCMD nil. TXT | grep 'incorrect key AXFR' >/dev/null && {
echo_i "failed"
status=$((status+1))
}
n=$((n+1))
echo_i "bad message id ($n)"
$SENDCMD < ans5/badmessageid
# Uncomment to see AXFR stream with mismatching IDs.
# $DIG $DIGOPTS @10.53.0.5 -y tsig_key:LSAnCU+Z nil. AXFR +all
$RNDCCMD 10.53.0.4 retransfer nil | sed 's/^/ns4 /' | cat_i
sleep 2
nextpart ns4/named.run | grep "unexpected message id" > /dev/null || {
echo_i "failed: expected status was not logged"
status=$((status+1))
}
$DIGCMD nil. TXT | grep 'bad message id' >/dev/null && {
echo_i "failed"
status=$((status+1))
}
n=$((n+1))
echo_i "check that we ask for and get a EDNS EXPIRE response ($n)"
# force a refresh query
@ -438,19 +445,14 @@ $DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.1.test$n
grep "status: NOERROR," dig.out.1.test$n > /dev/null || tmp=1
$PERL $SYSTEMTESTTOP/stop.pl xfer ns3
$PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} xfer ns3
for try in 0 1 2 3 4 5 6 7 8 9; do
iret=0
$DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.2.test$n
grep "status: NOERROR," dig.out.2.test$n > /dev/null || iret=1
if [ "$iret" -eq 0 ]
then
$DIG -p ${PORT} axfr mapped @10.53.0.3 > dig.out.3.test$n
digcomp knowngood.mapped dig.out.3.test$n || iret=1
fi
[ "$iret" -eq 0 ] && break
sleep 1
done
[ "$iret" -eq 0 ] || tmp=1
check_mapped () {
$DIG -p ${PORT} txt mapped @10.53.0.3 > dig.out.2.test$n
grep "status: NOERROR," dig.out.2.test$n > /dev/null || return 1
$DIG -p ${PORT} axfr mapped @10.53.0.3 > dig.out.3.test$n
digcomp knowngood.mapped dig.out.3.test$n || return 1
return 0
}
retry_quiet 10 check_mapped || tmp=1
[ "$tmp" -ne 0 ] && echo_i "failed"
status=$((status+tmp))
@ -464,43 +466,35 @@ status=$((status+tmp))
n=$((n+1))
echo_i "test that a zone with too many records is rejected (IXFR) ($n)"
tmp=0
grep "'ixfr-too-big./IN.*: too many records" ns6/named.run >/dev/null && tmp=1
nextpart ns6/named.run > /dev/null
$NSUPDATE << EOF
zone ixfr-too-big
server 10.53.0.1 ${PORT}
update add the-31st-record.ixfr-too-big 0 TXT this is it
send
EOF
for i in 1 2 3 4 5 6 7 8
do
grep "'ixfr-too-big/IN'.*: too many records" ns6/named.run >/dev/null && break
sleep 1
done
grep "'ixfr-too-big/IN'.*: too many records" ns6/named.run >/dev/null || tmp=1
msg="'ixfr-too-big/IN' from 10.53.0.1#${PORT}: Transfer status: too many records"
wait_for_log 10 "$msg" ns6/named.run || tmp=1
if test $tmp != 0 ; then echo_i "failed"; fi
status=$((status+tmp))
n=$((n+1))
echo_i "checking whether dig calculates AXFR statistics correctly ($n)"
tmp=0
# Loop until the secondary server manages to transfer the "xfer-stats" zone so
# that we can both check dig output and immediately proceed with the next test.
# Use -b so that we can discern between incoming and outgoing transfers in ns3
# logs later on.
tmp=1
for i in 1 2 3 4 5 6 7 8 9 10; do
wait_for_xfer() (
$DIG $DIGOPTS +noedns +stat -b 10.53.0.2 @10.53.0.3 xfer-stats. AXFR > dig.out.ns3.test$n
if grep "; Transfer failed" dig.out.ns3.test$n > /dev/null; then
sleep 1
else
tmp=0
break
fi
done
if [ $tmp -ne 0 ]; then
echo_i "timed out waiting for zone transfer"
else
grep "; Transfer failed" dig.out.ns3.test$n > /dev/null || return 0
return 1
)
if retry_quiet 10 wait_for_xfer; then
get_dig_xfer_stats dig.out.ns3.test$n > stats.dig
diff axfr-stats.good stats.dig || tmp=1
else
echo_i "timed out waiting for zone transfer"
fi
if test $tmp != 0 ; then echo_i "failed"; fi
status=$((status+tmp))
@ -518,15 +512,12 @@ status=$((status+tmp))
n=$((n+1))
echo_i "checking whether named calculates outgoing AXFR statistics correctly ($n)"
tmp=1
for i in 0 1 2 3 4 5 6 7 8 9; do
tmp=0
check_xfer_stats() {
get_named_xfer_stats ns3/named.run 10.53.0.2 xfer-stats "AXFR ended" > stats.outgoing
if diff axfr-stats.good stats.outgoing > /dev/null; then
tmp=0
break
fi
sleep 1
done
diff axfr-stats.good stats.outgoing > /dev/null
}
retry_quiet 10 check_xfer_stats || tmp=1
if test $tmp != 0 ; then echo_i "failed"; fi
status=$((status+tmp))

8
lib/dns/xfrin.c
View file

@ -111,7 +111,6 @@ struct dns_xfrin_ctx {
dns_name_t name; /*%< Name of zone to transfer */
dns_rdataclass_t rdclass;
bool checkid;
dns_messageid_t id;
/*%
@ -551,9 +550,6 @@ redo:
xfr->ixfr.request_serial, xfr->end_serial);
FAIL(DNS_R_UPTODATE);
}
if (xfr->reqtype == dns_rdatatype_axfr) {
xfr->checkid = false;
}
xfr->state = XFRST_FIRSTDATA;
break;
@ -835,7 +831,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_task_t *task,
dns_name_init(&xfr->name, NULL);
xfr->rdclass = rdclass;
xfr->checkid = true;
xfr->id = (dns_messageid_t)isc_random16();
xfr->reqtype = reqtype;
xfr->dscp = dscp;
@ -1145,7 +1140,6 @@ xfrin_send_request(dns_xfrin_ctx_t *xfr) {
&xfr->ixfr.request_serial));
}
xfr->checkid = true;
xfr->id++;
xfr->nmsg = 0;
xfr->nrecs = 0;
@ -1289,7 +1283,7 @@ xfrin_recv_done(isc_task_t *task, isc_event_t *ev) {
if (result != ISC_R_SUCCESS || msg->rcode != dns_rcode_noerror ||
msg->opcode != dns_opcode_query || msg->rdclass != xfr->rdclass ||
(xfr->checkid && msg->id != xfr->id))
msg->id != xfr->id)
{
if (result == ISC_R_SUCCESS && msg->rcode != dns_rcode_noerror)
{

1
util/copyrights
View file

@ -1167,6 +1167,7 @@
./bin/tests/system/win32/pipequeries.vcxproj.in X 2016,2017,2018,2019,2020
./bin/tests/system/win32/pipequeries.vcxproj.user X 2016,2018,2019,2020
./bin/tests/system/xfer/ans5/badkeydata X 2011,2018,2019,2020
./bin/tests/system/xfer/ans5/badmessageid X 2020
./bin/tests/system/xfer/ans5/goodaxfr X 2011,2018,2019,2020
./bin/tests/system/xfer/ans5/partial X 2011,2018,2019,2020
./bin/tests/system/xfer/ans5/unknownkey X 2011,2018,2019,2020