547973dea7
This adds initial support for validating RRSIG/DNSKEY/DS chains when doing lookups. Proof-of-non-existance, or proof-of-unsigned-zones is not implemented yet. With this change DnsTransaction objects will generate additional DnsTransaction objects when looking for DNSKEY or DS RRs to validate an RRSIG on a response. DnsTransaction objects are thus created for three reasons now: 1) Because a user asked for something to be resolved, i.e. requested by a DnsQuery/DnsQueryCandidate object. 2) As result of LLMNR RR probing, requested by a DnsZoneItem. 3) Because another DnsTransaction requires the requested RRs for validation of its own response. DnsTransactions are shared between all these users, and are GC automatically as soon as all of these users don't need a specific transaction anymore. To unify the handling of these three reasons for existance for a DnsTransaction, a new common naming is introduced: each DnsTransaction now tracks its "owners" via a Set* object named "notify_xyz", containing all owners to notify on completion. A new DnsTransaction state is introduced called "VALIDATING" that is entered after a response has been receieved which needs to be validated, as long as we are still waiting for the DNSKEY/DS RRs from other DnsTransactions. This patch will request the DNSKEY/DS RRs bottom-up, and then validate them top-down. Caching of RRs is now only done after verification, so that the cache is not poisoned with known invalid data. The "DnsAnswer" object gained a substantial number of new calls, since we need to add/remove RRs to it dynamically now.
220 lines
10 KiB
C
220 lines
10 KiB
C
/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
|
|
|
|
/***
|
|
This file is part of systemd.
|
|
|
|
Copyright 2015 Lennart Poettering
|
|
|
|
systemd is free software; you can redistribute it and/or modify it
|
|
under the terms of the GNU Lesser General Public License as published by
|
|
the Free Software Foundation; either version 2.1 of the License, or
|
|
(at your option) any later version.
|
|
|
|
systemd is distributed in the hope that it will be useful, but
|
|
WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public License
|
|
along with systemd; If not, see <http://www.gnu.org/licenses/>.
|
|
***/
|
|
|
|
#include <arpa/inet.h>
|
|
#include <netinet/in.h>
|
|
#include <sys/socket.h>
|
|
|
|
#include "alloc-util.h"
|
|
#include "resolved-dns-dnssec.h"
|
|
#include "resolved-dns-rr.h"
|
|
#include "string-util.h"
|
|
|
|
static void test_dnssec_verify_rrset(void) {
|
|
|
|
static const uint8_t signature_blob[] = {
|
|
0x7f, 0x79, 0xdd, 0x5e, 0x89, 0x79, 0x18, 0xd0, 0x34, 0x86, 0x8c, 0x72, 0x77, 0x75, 0x48, 0x4d,
|
|
0xc3, 0x7d, 0x38, 0x04, 0xab, 0xcd, 0x9e, 0x4c, 0x82, 0xb0, 0x92, 0xca, 0xe9, 0x66, 0xe9, 0x6e,
|
|
0x47, 0xc7, 0x68, 0x8c, 0x94, 0xf6, 0x69, 0xcb, 0x75, 0x94, 0xe6, 0x30, 0xa6, 0xfb, 0x68, 0x64,
|
|
0x96, 0x1a, 0x84, 0xe1, 0xdc, 0x16, 0x4c, 0x83, 0x6c, 0x44, 0xf2, 0x74, 0x4d, 0x74, 0x79, 0x8f,
|
|
0xf3, 0xf4, 0x63, 0x0d, 0xef, 0x5a, 0xe7, 0xe2, 0xfd, 0xf2, 0x2b, 0x38, 0x7c, 0x28, 0x96, 0x9d,
|
|
0xb6, 0xcd, 0x5c, 0x3b, 0x57, 0xe2, 0x24, 0x78, 0x65, 0xd0, 0x9e, 0x77, 0x83, 0x09, 0x6c, 0xff,
|
|
0x3d, 0x52, 0x3f, 0x6e, 0xd1, 0xed, 0x2e, 0xf9, 0xee, 0x8e, 0xa6, 0xbe, 0x9a, 0xa8, 0x87, 0x76,
|
|
0xd8, 0x77, 0xcc, 0x96, 0xa0, 0x98, 0xa1, 0xd1, 0x68, 0x09, 0x43, 0xcf, 0x56, 0xd9, 0xd1, 0x66,
|
|
};
|
|
|
|
static const uint8_t dnskey_blob[] = {
|
|
0x03, 0x01, 0x00, 0x01, 0x9b, 0x49, 0x9b, 0xc1, 0xf9, 0x9a, 0xe0, 0x4e, 0xcf, 0xcb, 0x14, 0x45,
|
|
0x2e, 0xc9, 0xf9, 0x74, 0xa7, 0x18, 0xb5, 0xf3, 0xde, 0x39, 0x49, 0xdf, 0x63, 0x33, 0x97, 0x52,
|
|
0xe0, 0x8e, 0xac, 0x50, 0x30, 0x8e, 0x09, 0xd5, 0x24, 0x3d, 0x26, 0xa4, 0x49, 0x37, 0x2b, 0xb0,
|
|
0x6b, 0x1b, 0xdf, 0xde, 0x85, 0x83, 0xcb, 0x22, 0x4e, 0x60, 0x0a, 0x91, 0x1a, 0x1f, 0xc5, 0x40,
|
|
0xb1, 0xc3, 0x15, 0xc1, 0x54, 0x77, 0x86, 0x65, 0x53, 0xec, 0x10, 0x90, 0x0c, 0x91, 0x00, 0x5e,
|
|
0x15, 0xdc, 0x08, 0x02, 0x4c, 0x8c, 0x0d, 0xc0, 0xac, 0x6e, 0xc4, 0x3e, 0x1b, 0x80, 0x19, 0xe4,
|
|
0xf7, 0x5f, 0x77, 0x51, 0x06, 0x87, 0x61, 0xde, 0xa2, 0x18, 0x0f, 0x40, 0x8b, 0x79, 0x72, 0xfa,
|
|
0x8d, 0x1a, 0x44, 0x47, 0x0d, 0x8e, 0x3a, 0x2d, 0xc7, 0x39, 0xbf, 0x56, 0x28, 0x97, 0xd9, 0x20,
|
|
0x4f, 0x00, 0x51, 0x3b,
|
|
};
|
|
|
|
_cleanup_(dns_resource_record_unrefp) DnsResourceRecord *a = NULL, *rrsig = NULL, *dnskey = NULL;
|
|
_cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
|
|
_cleanup_free_ char *x = NULL, *y = NULL, *z = NULL;
|
|
DnssecResult result;
|
|
|
|
a = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_A, "nAsA.gov");
|
|
assert_se(a);
|
|
|
|
a->a.in_addr.s_addr = inet_addr("52.0.14.116");
|
|
|
|
assert_se(dns_resource_record_to_string(a, &x) >= 0);
|
|
log_info("A: %s", x);
|
|
|
|
rrsig = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_RRSIG, "NaSa.GOV.");
|
|
assert_se(rrsig);
|
|
|
|
rrsig->rrsig.type_covered = DNS_TYPE_A;
|
|
rrsig->rrsig.algorithm = DNSSEC_ALGORITHM_RSASHA256;
|
|
rrsig->rrsig.labels = 2;
|
|
rrsig->rrsig.original_ttl = 600;
|
|
rrsig->rrsig.expiration = 0x5683135c;
|
|
rrsig->rrsig.inception = 0x565b7da8;
|
|
rrsig->rrsig.key_tag = 63876;
|
|
rrsig->rrsig.signer = strdup("Nasa.Gov.");
|
|
assert_se(rrsig->rrsig.signer);
|
|
rrsig->rrsig.signature_size = sizeof(signature_blob);
|
|
rrsig->rrsig.signature = memdup(signature_blob, rrsig->rrsig.signature_size);
|
|
assert_se(rrsig->rrsig.signature);
|
|
|
|
assert_se(dns_resource_record_to_string(rrsig, &y) >= 0);
|
|
log_info("RRSIG: %s", y);
|
|
|
|
dnskey = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_DNSKEY, "nASA.gOV");
|
|
assert_se(dnskey);
|
|
|
|
dnskey->dnskey.flags = 256;
|
|
dnskey->dnskey.protocol = 3;
|
|
dnskey->dnskey.algorithm = DNSSEC_ALGORITHM_RSASHA256;
|
|
dnskey->dnskey.key_size = sizeof(dnskey_blob);
|
|
dnskey->dnskey.key = memdup(dnskey_blob, sizeof(dnskey_blob));
|
|
assert_se(dnskey->dnskey.key);
|
|
|
|
assert_se(dns_resource_record_to_string(dnskey, &z) >= 0);
|
|
log_info("DNSKEY: %s", z);
|
|
log_info("DNSKEY keytag: %u", dnssec_keytag(dnskey));
|
|
|
|
assert_se(dnssec_key_match_rrsig(a->key, rrsig) > 0);
|
|
assert_se(dnssec_rrsig_match_dnskey(rrsig, dnskey) > 0);
|
|
|
|
answer = dns_answer_new(1);
|
|
assert_se(answer);
|
|
assert_se(dns_answer_add(answer, a, 0) >= 0);
|
|
|
|
/* Validate the RR as it if was 2015-12-2 today */
|
|
assert_se(dnssec_verify_rrset(answer, a->key, rrsig, dnskey, 1449092754*USEC_PER_SEC, &result) >= 0);
|
|
assert_se(result == DNSSEC_VALIDATED);
|
|
}
|
|
|
|
static void test_dnssec_verify_dns_key(void) {
|
|
|
|
static const uint8_t ds1_fprint[] = {
|
|
0x46, 0x8B, 0xC8, 0xDD, 0xC7, 0xE8, 0x27, 0x03, 0x40, 0xBB, 0x8A, 0x1F, 0x3B, 0x2E, 0x45, 0x9D,
|
|
0x80, 0x67, 0x14, 0x01,
|
|
};
|
|
static const uint8_t ds2_fprint[] = {
|
|
0x8A, 0xEE, 0x80, 0x47, 0x05, 0x5F, 0x83, 0xD1, 0x48, 0xBA, 0x8F, 0xF6, 0xDD, 0xA7, 0x60, 0xCE,
|
|
0x94, 0xF7, 0xC7, 0x5E, 0x52, 0x4C, 0xF2, 0xE9, 0x50, 0xB9, 0x2E, 0xCB, 0xEF, 0x96, 0xB9, 0x98,
|
|
};
|
|
static const uint8_t dnskey_blob[] = {
|
|
0x03, 0x01, 0x00, 0x01, 0xa8, 0x12, 0xda, 0x4f, 0xd2, 0x7d, 0x54, 0x14, 0x0e, 0xcc, 0x5b, 0x5e,
|
|
0x45, 0x9c, 0x96, 0x98, 0xc0, 0xc0, 0x85, 0x81, 0xb1, 0x47, 0x8c, 0x7d, 0xe8, 0x39, 0x50, 0xcc,
|
|
0xc5, 0xd0, 0xf2, 0x00, 0x81, 0x67, 0x79, 0xf6, 0xcc, 0x9d, 0xad, 0x6c, 0xbb, 0x7b, 0x6f, 0x48,
|
|
0x97, 0x15, 0x1c, 0xfd, 0x0b, 0xfe, 0xd3, 0xd7, 0x7d, 0x9f, 0x81, 0x26, 0xd3, 0xc5, 0x65, 0x49,
|
|
0xcf, 0x46, 0x62, 0xb0, 0x55, 0x6e, 0x47, 0xc7, 0x30, 0xef, 0x51, 0xfb, 0x3e, 0xc6, 0xef, 0xde,
|
|
0x27, 0x3f, 0xfa, 0x57, 0x2d, 0xa7, 0x1d, 0x80, 0x46, 0x9a, 0x5f, 0x14, 0xb3, 0xb0, 0x2c, 0xbe,
|
|
0x72, 0xca, 0xdf, 0xb2, 0xff, 0x36, 0x5b, 0x4f, 0xec, 0x58, 0x8e, 0x8d, 0x01, 0xe9, 0xa9, 0xdf,
|
|
0xb5, 0x60, 0xad, 0x52, 0x4d, 0xfc, 0xa9, 0x3e, 0x8d, 0x35, 0x95, 0xb3, 0x4e, 0x0f, 0xca, 0x45,
|
|
0x1b, 0xf7, 0xef, 0x3a, 0x88, 0x25, 0x08, 0xc7, 0x4e, 0x06, 0xc1, 0x62, 0x1a, 0xce, 0xd8, 0x77,
|
|
0xbd, 0x02, 0x65, 0xf8, 0x49, 0xfb, 0xce, 0xf6, 0xa8, 0x09, 0xfc, 0xde, 0xb2, 0x09, 0x9d, 0x39,
|
|
0xf8, 0x63, 0x9c, 0x32, 0x42, 0x7c, 0xa0, 0x30, 0x86, 0x72, 0x7a, 0x4a, 0xc6, 0xd4, 0xb3, 0x2d,
|
|
0x24, 0xef, 0x96, 0x3f, 0xc2, 0xda, 0xd3, 0xf2, 0x15, 0x6f, 0xda, 0x65, 0x4b, 0x81, 0x28, 0x68,
|
|
0xf4, 0xfe, 0x3e, 0x71, 0x4f, 0x50, 0x96, 0x72, 0x58, 0xa1, 0x89, 0xdd, 0x01, 0x61, 0x39, 0x39,
|
|
0xc6, 0x76, 0xa4, 0xda, 0x02, 0x70, 0x3d, 0xc0, 0xdc, 0x8d, 0x70, 0x72, 0x04, 0x90, 0x79, 0xd4,
|
|
0xec, 0x65, 0xcf, 0x49, 0x35, 0x25, 0x3a, 0x14, 0x1a, 0x45, 0x20, 0xeb, 0x31, 0xaf, 0x92, 0xba,
|
|
0x20, 0xd3, 0xcd, 0xa7, 0x13, 0x44, 0xdc, 0xcf, 0xf0, 0x27, 0x34, 0xb9, 0xe7, 0x24, 0x6f, 0x73,
|
|
0xe7, 0xea, 0x77, 0x03,
|
|
};
|
|
|
|
_cleanup_(dns_resource_record_unrefp) DnsResourceRecord *dnskey = NULL, *ds1 = NULL, *ds2 = NULL;
|
|
_cleanup_free_ char *a = NULL, *b = NULL, *c = NULL;
|
|
|
|
/* The two DS RRs in effect for nasa.gov on 2015-12-01. */
|
|
ds1 = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_DS, "nasa.gov");
|
|
assert_se(ds1);
|
|
|
|
ds1->ds.key_tag = 47857;
|
|
ds1->ds.algorithm = DNSSEC_ALGORITHM_RSASHA256;
|
|
ds1->ds.digest_type = DNSSEC_DIGEST_SHA1;
|
|
ds1->ds.digest_size = sizeof(ds1_fprint);
|
|
ds1->ds.digest = memdup(ds1_fprint, ds1->ds.digest_size);
|
|
assert_se(ds1->ds.digest);
|
|
|
|
assert_se(dns_resource_record_to_string(ds1, &a) >= 0);
|
|
log_info("DS1: %s", a);
|
|
|
|
ds2 = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_DS, "NASA.GOV");
|
|
assert_se(ds2);
|
|
|
|
ds2->ds.key_tag = 47857;
|
|
ds2->ds.algorithm = DNSSEC_ALGORITHM_RSASHA256;
|
|
ds2->ds.digest_type = DNSSEC_DIGEST_SHA256;
|
|
ds2->ds.digest_size = sizeof(ds2_fprint);
|
|
ds2->ds.digest = memdup(ds2_fprint, ds2->ds.digest_size);
|
|
assert_se(ds2->ds.digest);
|
|
|
|
assert_se(dns_resource_record_to_string(ds2, &b) >= 0);
|
|
log_info("DS2: %s", b);
|
|
|
|
dnskey = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_DNSKEY, "nasa.GOV");
|
|
assert_se(dnskey);
|
|
|
|
dnskey->dnskey.flags = 257;
|
|
dnskey->dnskey.protocol = 3;
|
|
dnskey->dnskey.algorithm = DNSSEC_ALGORITHM_RSASHA256;
|
|
dnskey->dnskey.key_size = sizeof(dnskey_blob);
|
|
dnskey->dnskey.key = memdup(dnskey_blob, sizeof(dnskey_blob));
|
|
assert_se(dnskey->dnskey.key);
|
|
|
|
assert_se(dns_resource_record_to_string(dnskey, &c) >= 0);
|
|
log_info("DNSKEY: %s", c);
|
|
log_info("DNSKEY keytag: %u", dnssec_keytag(dnskey));
|
|
|
|
assert_se(dnssec_verify_dnskey(dnskey, ds1) > 0);
|
|
assert_se(dnssec_verify_dnskey(dnskey, ds2) > 0);
|
|
}
|
|
|
|
static void test_dnssec_canonicalize_one(const char *original, const char *canonical, int r) {
|
|
char canonicalized[DNSSEC_CANONICAL_HOSTNAME_MAX];
|
|
|
|
assert_se(dnssec_canonicalize(original, canonicalized, sizeof(canonicalized)) == r);
|
|
if (r < 0)
|
|
return;
|
|
|
|
assert_se(streq(canonicalized, canonical));
|
|
}
|
|
|
|
static void test_dnssec_canonicalize(void) {
|
|
test_dnssec_canonicalize_one("", ".", 1);
|
|
test_dnssec_canonicalize_one(".", ".", 1);
|
|
test_dnssec_canonicalize_one("foo", "foo.", 4);
|
|
test_dnssec_canonicalize_one("foo.", "foo.", 4);
|
|
test_dnssec_canonicalize_one("FOO.", "foo.", 4);
|
|
test_dnssec_canonicalize_one("FOO.bar.", "foo.bar.", 8);
|
|
test_dnssec_canonicalize_one("FOO..bar.", NULL, -EINVAL);
|
|
}
|
|
|
|
int main(int argc, char*argv[]) {
|
|
|
|
test_dnssec_canonicalize();
|
|
test_dnssec_verify_dns_key();
|
|
test_dnssec_verify_rrset();
|
|
|
|
return 0;
|
|
}
|