Created attachment 1633742 [details]
Proposed patch, verified by the customer

Description of problem:
BIND with DNSSEC validation enabled will not validate a zone that has all resource records signed using a supported algorithm KSK as well as using unsupported algorithm ZSK.

The do-while loop in get_dst_key() in validator.c is broken when unsupported-algo ZSK is found first in dst_key_fromdns(), which returns an error as passed from algorithm_status().

File: validator.c
1652: 		result = dst_key_fromdns(&siginfo->signer, rdata.rdclass, &b,
1653: 					 val->view->mctx, &val->key);
1654: 		if (result != ISC_R_SUCCESS)
1655: 			goto failure;

That is a premature exit from the loop as on next iteration(s) of the do-while loop a valid DNSKEY would be found.

I am proposing a patch that does not break the loop when "DST_R_UNSUPPORTEDALG" is returned from dst_key_fromdns(), but it would be good to revise what error should break the loop (if any) and which certainly not.

This error causes a valid DNSSEC-signed zone not to pass a validation on all RHEL-6 machines running BIND.

Version-Release number of selected component (if applicable):
bind-9.8.2-0.68.rc1.el6_10.3

How reproducible:
Always

Steps to Reproduce:

The reproducer requires two machines, RHEL-7 (authoritative DNS), RHEL-6 (BIND as a forwarder). Make sure RHEL-6 can reach RHEL-7 on port 53/udp.

1. Install BIND on RHEL-7 host.
2. Edit /etc/named/named.conf:

--8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<------
options {
	listen-on port 53 { 127.0.0.1; <IP-of-RHEL7-host>; };
	listen-on-v6 port 53 { ::1; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
	statistics-file "/var/named/data/named_stats.txt";
	memstatistics-file "/var/named/data/named_mem_stats.txt";
	recursing-file  "/var/named/data/named.recursing";
	secroots-file   "/var/named/data/named.secroots";
	allow-query     { localhost; <IP-of-RHEL6-host>; };

	recursion no;

	dnssec-enable yes;
	dnssec-validation yes;

	/* Path to ISC DLV key */
	bindkeys-file "/etc/named.root.key";

	managed-keys-directory "/var/named/dynamic";

	pid-file "/run/named/named.pid";
	session-keyfile "/run/named/session.key";
};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

zone "bad." IN {
	type master;
	file "bad.zone.signed";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";
--8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<------

3. Create /var/named/bad.zone:

--8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<------
$TTL 5M
@	IN SOA	<short-hostname-of-RHEL7>.bad. hostmaster.bad. (
					1	; serial
					5M	; refresh
					1M	; retry
					1H	; expire
					5M )	; minimum
	NS	<hostname-of-RHEL7>
	A	127.0.0.1
	AAAA	::1
<short-hostname-of-RHEL7> A	127.0.0.1
	AAAA	::1
--8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<------

4. Create key pairs (still on RHEL-7):

# cd /var/named

RHEL-6 supported KSK:

# dnssec-keygen -f KSK -a RSASHA512 -b 2048 bad

(remember the KSK name, it will be Kbad.+010+?????)

One or two RHEL-6 unsupported ZSKs:

# dnssec-keygen -a ECDSAP256SHA256 -n ZONE bad
# dnssec-keygen -a ECDSAP256SHA256 -n ZONE bad

5. Include the keys in the bad.zone:

# for key in `ls Kbad.+0*.key`; do echo "\$INCLUDE $key">> /var/named/bad.zone; done

6. Sign the zone using the KSK (replace ???? with the KSK key-id):

# dnssec-signzone -A -k Kbad.+010+????? -z -3 9911c319070e83f8 -N INCREMENT -o bad -t /var/named/bad.zone

7. Start named.

# systemctl start named

8. Install BIND on RHEL-6 host.

# yum install bind bind-utils

9. Copy the content of your KSK .key file to clipboard.

10. Edit /etc/named.conf:

--8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<------
options {
	listen-on port 53 { 127.0.0.1; };
	listen-on-v6 port 53 { ::1; };
	directory 	"/var/named";
	dump-file 	"/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
	allow-query     { localhost; };
	recursion yes;
	forward only;

        forwarders { <IP-of-RHEL7-host>; };

	dnssec-enable yes;
	dnssec-validation yes;

	/* Path to ISC DLV key */
	bindkeys-file "/etc/named.iscdlv.key";

	managed-keys-directory "/var/named/dynamic";
};


trusted-keys {

<paste the KSK key content here in the following example format>

/*	bad.	257 3 10 "AwEAAcjgApTNTSiRSKs4vKQtjbg0rRZSH2eFze87mbRJgH8CWJrKzDT9 XorxywQuiDGDtB/MLGRumrtRQbXppgZR+5KZrwej3AzD2TFRXQokN8k9 Rrf0vuY2XEMEXgEfEHTuaNH5vzdJlv4PbHh/HDH0b2i5JuWGKbCJmt9A 6WUUkj/PsRzGXxnEqKvRjgGGsxyJsZdmR+NeOKXP7yLQej4JYsqcnd/0 ycuKjHtQn4L7fjafS8yi/75yyrcdegN97aldBZXyMOjfvkLa3Sn3WGQD qVmM/t7WlkjOhyPqBcTUCPch74YZoWph4cjnYrxWGrVQJnRku7DUUllA jzTLZxFGuH8="; */

};

logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

--8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<------

11. Start named.

# service named start

12. Run the query.

# dig +dnssec @127.0.0.1 bad.


Actual results:
# dig +dnssec @127.0.0.1 bad.

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3 <<>> +dnssec @127.0.0.1 bad.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12693
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

... lines omitted ...

Expected results:
# dig +dnssec @127.0.0.1 bad.

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6_10.3.case02507102.test.5 <<>> +dnssec @127.0.0.1 bad.
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10172
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;bad.				IN	A

;; ANSWER SECTION:
bad.			300	IN	A	127.0.0.1
bad.			300	IN	RRSIG	A 10 1 300 20191207125630 20191107125630 13167 bad. Zp3I16Ot306MltsUqjwe5EpdX1cVTwXp57ruMbNLy1q4ynWvAlRf1SWS /YZHa+iEjaSN64FtNsJRQGFyBt50XqAo6jgQK/vXH8zNdTwRLrAAbcgx Rq7rauRb3lw1WV2JQJqpjxKHDE+Fw6I3mkjj4wo1U6pdUDZxF8cnqcZM bf6u9FJqjXb2MlF7ndOkP/HK41xMOfZIFOIjw6QC1Jgeal4Fqnf4aGVX dgrWDXIO2k+v512XP+C2Da2rXhEd2lXx9yO24xxQJIU7fNzLRG9UDbXZ 3473LMtWSy7zIos/7af75jQ05nPlhPWMN8jn5F0lDF3mFDYtcY5DZR55 pD6cSQ==
bad.			300	IN	RRSIG	A 13 1 300 20191207125630 20191107125630 3120 bad. WSPFR1aH12gmD/94ajKNYQeCPXmTQZHiQeGPgtvKESf364fXQC1nFYQs wRjCYnDDSEYvzcfK4zFqS1c23VnZ8g==
bad.			300	IN	RRSIG	A 13 1 300 20191207125630 20191107125630 36598 bad. UYDUjnfo0rDXc7PznBdUeQQEP8tQZ0ldJ8A2VW0BuMgcxyywaAdV+0Tl OI7SX9QUduB4+MZDz4GNHovqlb57lQ==

... lines omitted ...

Additional info:
The issue is also present upstream, however, it does not manifest itself because ECDSA256 (algo 13) is already supported. The issue can reoccur anytime for a new valid algorithm that would not yet be supported in BIND.